# US 2014/0195860 A1 · Early Detection Of Failing Computers > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0195860 A1 - Document ID: US20140195860A1 - Status: Published application - Kind: A1 - Application number: 14/204,948 - Filed: 2014-03-11 - Published: 2014-07-10 - Earliest claimed: 2010-12-13 - Assignees: Microsoft Corporation - Applicants: Microsoft Corporation - Inventors: Nikolaj Bjorner; Assaf Schuster; Moshe Gabel; Ran Gilad-Bachrach - Web page: https://patentgrep.com/patent/US20140195860A1 ## CPC - G06F 11/3055: {Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available (error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction of the data by redundancy in operations G06F11/14; error detection or correction by redundancy in hardware G06F11/16)} - G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computer management system may track services on multiple computers executing the same workload. Various performance counters may be retrieved from the computers and analyzed to identify those with low deviations and low mean deviations. Statistical tests may then be used to compare the values of a particular computer to the deviation of the group of computers to identify outliers, which may indicate degraded performance and imminent failure of the computer. The management system may analyze any collectable performance related parameter to identify outlying systems. ## Claims ### Claim 1 At a computer system, the computer system including a processor, a method for identifying a computer system problem during execution of an application, instances of the application load balanced on a plurality of devices, the method comprising: identifying a set of performance indicators that are to be monitored for the application; for each of the plurality of devices, the processor collecting values for the set of performance indicators, the values collected over different periods when there is varied levels of demand for the application; for each of the performance indicators, calculating an average value based on said collected values; and identifying a device as an outlying device when a value for a monitored performance indicator for the device varies from the calculated average for the monitored performance indicator, the identified device identified from among the plurality of devices. ### Claim 2 (depends on 1) The method as recited in claim 1, further comprising collecting a plurality of performance indicators from the plurality of devices; and wherein identifying a set of performance indicators that are to be monitored for the application comprises analyzing the plurality of performance indicators to identify the set of performance indicators. ### Claim 3 (depends on 1) The method of claim 1, wherein collecting values for the set of monitored performance indicators comprises: collecting values over a first plurality of periods when there is a one level of demand for the application; and collecting values over a second plurality of periods when there is another different level of demand for the application, the second level of demand being a higher level of demand than the first level of demand. ### Claim 4 (depends on 1) The method of claim 1, wherein collecting values for the set of monitored performance indicators comprises collecting fault counters over a period of time. ### Claim 5 (depends on 1) The method of claim 1, wherein identifying a set of performance indicators that are to be monitored for the application comprises identifying a set of instantaneous performance indicators that are to be monitored for the application. ### Claim 6 (depends on 1) The method of claim 1, wherein identifying a device as an outlying device comprises: calculating a faultiness score for the device; and determining that the faultiness score exceeds a specified threshold. ### Claim 7 (depends on 6) The method of claim 6, further comprising calculating a failure signature for the outlying device. ### Claim 8 At a computer system, the computer system including a processor, a method for selecting performance indicators to monitor for identifying a computer system problem during execution of an application, instances of the application load balanced on a plurality of other devices, the method comprising: for each of said plurality of devices, collecting operational data for the application over different periods when there is varied levels of demand for the application, the performance data including values for a plurality of different performance indicators; the processor identifying a subset of performance indicators that are statistically relevant, the a subset of performance indicators identified from among the plurality of different performance indicators, including for each performance indicator in the subset of performance indicators: for each device in at least a sub-plurality of devices, determining that an average value indicator for the performance indicator is statistically similar to an average value indicator for the performance indicator for other devices in the sub-plurality of devices, the sub-plurality of devices selected from among the plurality of devices; and determining that an aggregated deviation over one period for time for the performance indicator is statistically similar to an aggregated deviation over multiple periods of time for the performance indicator; and setting each of the identified subset of performance indicators as monitored performance indicators. ### Claim 9 (depends on 8) The method of claim 8, further comprising for each performance indicator in the subset of performance indicators determining that the general variance for the performance indicator is below a specified threshold. ### Claim 10 (depends on 8) The method of claim 8, further comprising for each performance indicator in the subset of performance indicators determining that the performance indicator has a sufficient number of values to be statistically relevant. ### Claim 11 (depends on 8) The method of claim 8, further comprising creating a heuristic model for the monitored performance indicators. ### Claim 12 (depends on 11) The method of claim 11, wherein creating a heuristic model for the monitored performance indicators comprises creating a heuristic model that ranks some of the monitored performance indicators as more important relative to other of the monitored performance indicators. ### Claim 13 (depends on 8) The method of claim 8, further comprising monitoring the monitored performance indicators to determine if any of the plurality of devices is staring to fail. ### Claim 14 At a computer system, the computer system including a processor, a method for selecting performance indicators to monitor for identifying a computer system problem during execution of an application, instances of the application load balanced on a plurality of other devices, the method comprising: for each of said plurality of devices, collecting operational data for the application over different periods when there is varied levels of demand for the application, the performance data including values for a plurality of different performance indicators; identifying a subset of performance indicators that are statistically relevant based on the values for the plurality of different performance indicators, the subset of performance indicators identified from among the plurality of different performance indicators; and setting each of the identified subset of performance indicators as monitored performance indicators for the application. ### Claim 15 (depends on 14) The method of claim 14, wherein identifying a subset of performance indicators that are statistically relevant comprises: for each performance indicator in the subset of performance indicators: for each device in at least a sub-plurality of devices, determining that an average value indicator for the performance indicator is statistically similar to an average value indicator for the performance indicator for other devices in the sub-plurality of devices, the sub-plurality of devices selected from among the plurality of devices. ### Claim 16 (depends on 14) The method of claim 14, wherein identifying a subset of performance indicators that are statistically relevant comprises: for each performance indicator in the subset of performance indicators: determining that an aggregated deviation over one period for time for the performance indicator is statistically similar to an aggregated deviation over multiple periods of time for the performance indicator. ### Claim 17 (depends on 14) The method of claim 14, further comprising creating a heuristic model for the monitored performance indicators. ### Claim 18 (depends on 17) The method of claim 17, wherein creating a heuristic model for the monitored performance indicators comprises creating a heuristic model that ranks some of the monitored performance indicators as more important relative to other of the monitored performance indicators. ### Claim 19 (depends on 14) The method of claim 14, further comprising monitoring the monitored performance indicators to determine if any of the plurality of devices is staring to fail. ### Claim 20 (depends on 19) The method of claim 19, further comprising calculating a failure signature for at least one device that is starting to fail, the at least one device selected from among the plurality of devices.