Magnitude based alarm flap detection
AssigneeCA, Inc.
InventorsGregory James Lipinski, Richard George Kenders
Life of this patent
Estimating the term…
Abstract
A flap detector can detect significant flapping with magnitudes of state deltas (i.e., differences between values representing events or states). The flap detector aggregates monotonic state deltas. Aggregating monotonic state deltas yields a magnitude of monotonic state deltas. A magnitude of a series of same direction state deltas can be considered the magnitude of flap because the end of the series corresponds to a beginning of a state delta series in a different direction. When directional transition occurs (i.e., flapping occurs), the flap detector generates multiple monotonic state delta magnitudes. The determined magnitudes can be used to filter out insignificant flapping that could be considered noise.
Claims20
A method comprising:
- determining deltas between levels of successive alarms for a system within a time window;
- determining aggregates of monotonic series of the deltas;
- determining those of the aggregates of the monotonic series with a magnitude that satisfies a first threshold;
- determining that a second threshold is satisfied by a count of the aggregates that satisfy the first threshold;
- and
- in response to the determination that the second threshold is satisfied, generating an alarm that indicates flapping has been detected and that indicates a first alarm level based, at least in part, on the magnitudes of the aggregates that satisfy the first threshold.
One or more machine readable storage media comprising program code for flap detection, the program code comprising instructions to:
- determine deltas between levels of successive alarms for a system within a time window;
- determine aggregates of monotonic series of the deltas;
- determine those of the aggregates of the monotonic series with a magnitude that satisfies a first threshold;
- determine that a second threshold is satisfied by a count of the aggregates that satisfy the first threshold;
- and
- in response to the determination that the second threshold is satisfied, generate an alarm that indicates flapping has been detected and that indicates a first alarm level based, at least in part, on the magnitudes of the aggregates that satisfy the first threshold.
An apparatus comprising:
- a processor;
- and
- a machine-readable medium having program code executable by the processor to cause the apparatus to,
- determine deltas between levels of successive alarms for a system within a time window;
- determine aggregates of monotonic series of the deltas;
- determine whether any magnitudes of the aggregates of the monotonic series of the deltas satisfy a first threshold;
- determine whether a second threshold is satisfied by a count of the aggregates that satisfy the first threshold;
- and
- in response to a determination that the second threshold is satisfied, generate an alarm that indicates flapping has been detected in the time window and that indicates a first alarm level based, at least in part, on the magnitudes of the aggregates that satisfy the first threshold.
Dependencies are inferred from the claim text.