Systems and methods for automated alert processing
Systems and methods for automated alert processing are disclosed. In one embodiment, in an information processing apparatus comprising at least one computer processor, a method for automated alert processing may include: (1) receiving, from a computer system, an alert; (2) classifying the alert as relevant using a relevance classification model, wherein the relevance classification model is a machine-learning trained model; (3) identifying a proposed solution for the alert using a root cause analysis classification model, wherein the root cause analysis classification model is a machine-learning trained model; (4) determining whether the proposed solution was successful; and (5) updating the root cause analysis classification model based on the determination.
1 . A method for automated alert processing, comprising:
in an information processing apparatus comprising at least one computer processor:
receiving, from a monitoring program executed by a computer system, an alert that identifies the computer system and log data from a log on the computer system, wherein the monitoring program monitors the log and generates the alert based on a condition in the log, wherein the alert includes a severity flag;
classifying the alert as relevant using a relevance classification model as relevant or not relevant based in part on the severity flag, wherein the relevance classification model is a first machine-learning trained model;
pre-processing a training data set for a root cause analysis classification model by removing stop words and special characters;
tokenizing the pre-processed training data set using term frequency-inverse document frequency;
training the root cause analysis classification model with the tokenized pre-processed training data set;
identifying a proposed solution for the alert using the root cause analysis classification model and the classification, wherein the root cause analysis classification model is a second machine-learning trained model;
retraining the relevance classification model based on the proposed solution from the root cause analysis classification model;
automatically executing, by the information processing apparatus, the proposed solution on the computer system to remediate the condition identified in the alert;
monitoring the log to determine if a solution has been implemented, whether the classification of relevant or not relevant resulted in a relevant alert, and to verify remediation of the condition;
determining whether the solution addresses the condition for the alert; and
updating the root cause analysis classification model based on the determination.
2 . The method of claim 1 , wherein the alert is received as an email.
3 . The method of claim 1 , wherein the alert is received as a service ticket.
4 . The method of claim 1 , wherein the alert is received in an analysis tool log.
5 . The method of claim 1 , wherein the alert comprises an identification of an error condition.
6 . The method of claim 1 , wherein the relevance classification model and the root cause analysis classification model comprises a decision tree model.
7 . The method of claim 1 , wherein the relevance classification model and the root cause analysis classification model comprises a random forest classifier model, a logistic regression model, or a support vector classification model.
8 . The method of claim 1 , further comprising:
self-training the relevance classification model and the root cause analysis classification model for a new alert, a new alert format, and a new solution.
9 . A system for automated alert processing, comprising:
a plurality of computer systems;
a monitoring program executed on each of the plurality of computer systems, the monitoring program generating an alert from at least one of the computer systems, the alert identifying the at least one computer system and log data from a log on the at least one computer system, wherein the monitoring program monitors the log and generates alerts based on the log, wherein the alert comprises an identification of an error condition and a severity flag;
an electronic device comprising at least one computer processor in communication with the plurality of computer systems that receives the alert from at least one of the computer systems; and
a computer program executed by the electronic device;
wherein the computer program:
classifies the alert as relevant using a relevance classification model as relevant or not relevant based in part on the severity flag, wherein the relevance classification model is a first machine-learning trained model;
pre-processes a training data set, wherein the training data set is pre-processed to remove stop words and special characters;
tokenizes the pre-processed training data set, wherein the pre-processed training data set is tokenized using term frequency-inverse document frequency; and
trains the root cause analysis classification model with the tokenized pre-processed training data set;
identifies a proposed solution for the alert using the root cause analysis classification model, wherein the root cause analysis classification model is a second machine-learning trained model;
retrains the relevance classification model based on the proposed solution from the root cause analysis classification model;
monitoring the log to determine if a solution has been implemented whether the classification of relevant or not relevant resulted in a relevant alert, and to verify remediation of the condition;
automatically executing, by the information processing apparatus, the proposed solution on the computer system to remediate the error condition identified in the alert;
determines whether the proposed solution was successful; and
updates the root cause analysis classification model based on the determination.
10 . The system of claim 9 , wherein the alert is received as an email, a service ticket, or as an analysis tool log.
11 . The system of claim 9 , wherein the relevance classification model and the root cause analysis classification model comprises a decision tree model, a random forest classifier model, a logistic regression model, or a support vector classification model.
12 . The system of claim 9 , wherein the computer program further self-trains the relevance classification model and the root cause analysis classification model for a new alert, a new alert format, and a new solution.