Automated problem diagnosis on logs using anomalous telemetry analysis
Systems and techniques are described for performing automatic problem diagnosis. Telemetry data of a system can be analyzed to identify a set of time ranges during which the telemetry data exhibits anomalous behavior. Next, a subset of log entries having a timestamp that is in one of the time ranges in set of time ranges can be extracted from a set of log entries generated by the system. The subset of log entries can then be analyzed, by using natural language processing, to identify a subset of the subset of log entries that has a high likelihood to be associated with one or problems in the system. Next, human-readable text can be extracted from the subset of the subset of log entries. A knowledge database can then be searched by using the human-readable text to identify one or more solutions to resolve the one or more problems in the system.
1. A non-transitory computer-readable storage medium storing instructions that, when executed by a computer, cause the computer to perform a method for automated problem diagnosis, the method comprising:
analyzing telemetry data of a system to identify a set of time ranges during which the telemetry data exhibits anomalous behavior;
extracting, from a set of log entries generated by the system, a subset of log entries having a timestamp that is in one of the time ranges in set of time ranges;
calculating, by using natural language processing, a sentiment score for each log entry in the subset of log entries;
using the sentiment scores to identify a subset of the subset of log entries that has a high likelihood to be associated with one or more problems in the system, wherein said using the sentiment scores to identify the subset of the subset of log entries comprises ordering log entries based on increasing sentiment scores, whereby log entries that are most likely to be associated with the one or more problems in the system appear at the top of the ordering;
extracting human-readable text from the subset of the subset of log entries; and
searching a knowledge database by using the human-readable text to identify one or more solutions to resolve the one or more problems in the system.
2. The non-transitory computer-readable storage medium of claim 1 , wherein said analyzing telemetry data of the system comprises using self-similarity analysis of a time series of a system variable.
3. The non-transitory computer-readable storage medium of claim 1 , wherein said analyzing telemetry data of the system comprises detecting when a system variable value is outside a normal operating range.
4. The non-transitory computer-readable storage medium of claim 1 , wherein said analyzing telemetry data of the system comprises detecting anomalous behavior based on calculating a discrepancy between (1) a piecewise linear model of mutual dependence between two system variables that is created based on historical data, and (2) measured values of the two system variables in the telemetry data.
5. The non-transitory computer-readable storage medium of claim 1 , wherein prior to said analyzing the telemetry data of the system, the method comprises receiving the telemetry data and the set of log entries from a user via a support portal.
6. The non-transitory computer-readable storage medium of claim 5 , wherein after said searching the knowledge database, the method comprises displaying the one or more solutions to the user via the support portal.
7. The non-transitory computer-readable storage medium of claim 1 , wherein the telemetry data of the system comprises processor utilization, memory usage, disk load, and network traffic metrics, and wherein the set of log entries comprises notifications, warnings, errors, and alarms generated by processes executing on the system.
8. The method of claim 1 , wherein said analyzing telemetry data of the system comprises detecting anomalous behavior based on calculating a discrepancy between (1) a piecewise linear model of mutual dependence between two system variables that is created based on historical data, and (2) measured values of the two system variables in the telemetry data.
9. The method of claim 1 , wherein prior to said analyzing the telemetry data of the system, the method comprises receiving the telemetry data and the set of log entries from a user via a support portal.
10. The method of claim 1 , wherein after said searching the knowledge database, the method comprises displaying the one or more solutions to the user via the support portal.
11. A computer, comprising:
a processor; and
a non-transitory computer-readable storage medium storing instructions that, when executed by the processor, cause the computer to perform a method for automated problem diagnosis, the method comprising:
analyzing telemetry data of a system to identify a set of time ranges during which the telemetry data exhibits anomalous behavior;
extracting, from a set of log entries generated by the system, a subset of log entries having a timestamp that is in one of the time ranges in set of time ranges;
calculating, by using natural language processing, a sentiment score for each log entry in the subset of log entries;
using the sentiment scores to identify a subset of the subset of log entries that has a high likelihood to be associated with one or more problems in the system, wherein said using the sentiment scores to identify the subset of the subset of log entries comprises ordering log entries based on increasing sentiment scores, whereby log entries that are most likely to be associated with the one or more problems in the system appear at the top of the ordering;
extracting human-readable text from the subset of the subset of log entries; and
searching a knowledge database by using the human-readable text to identify one or more solutions to resolve the one or more problems in the system.
12. The computer of claim 11 , wherein said analyzing telemetry data of the system comprises using self-similarity analysis of a time series of a system variable.
13. The computer of claim 11 , wherein said analyzing telemetry data of the system comprises detecting when a system variable value is outside a normal operating range.
14. The computer of claim 11 , wherein said analyzing telemetry data of the system comprises detecting anomalous behavior based on calculating a discrepancy between (1) a piecewise linear model of mutual dependence between two system variables that is created based on historical data, and (2) measured values of the two system variables in the telemetry data.
15. The computer of claim 11 , wherein prior to said analyzing the telemetry data of the system, the method comprises receiving the telemetry data and the set of log entries from a user via a support portal.
16. The computer of claim 15 , wherein after said searching the knowledge database, the method comprises displaying the one or more solutions to the user via the support portal.
17. The computer of claim 11 , wherein the telemetry data of the system comprises processor utilization, memory usage, disk load, and network traffic metrics, and wherein the set of log entries comprises notifications, warnings, errors, and alarms generated by processes executing on the system.
18. A method for automated problem diagnosis, the method comprising:
analyzing, by using a computer, telemetry data of a system to identify a set of time ranges during which the telemetry data exhibits anomalous behavior, wherein the telemetry data of the system comprises processor utilization, memory usage, disk load, and network traffic metrics;
extracting, from a set of log entries generated by the system, a subset of log entries having a timestamp that is in one of the time ranges in set of time ranges, wherein the set of log entries comprises notifications, warnings, errors, and alarms generated by processes executing on the system;
calculating, by using natural language processing, a sentiment score for each log entry in the subset of log entries;
using the sentiment scores to identify a subset of the subset of log entries that has a high likelihood to be associated with one or more problems in the system, wherein said using the sentiment scores to identify the subset of the subset of log entries comprises ordering log entries based on increasing sentiment scores, whereby log entries that are most likely to be associated with the one or more problems in the system appear at the top of the ordering;
extracting human-readable text from the subset of the subset of log entries; and
searching a knowledge database by using the human-readable text to identify one or more solutions to resolve the one or more problems in the system.