Efficient diagnosis of logs based on events

1 . A method comprising:

receiving, by a processor set, a notification of an incident associated with an application;

obtaining, by the processor set and based on the receiving the notification of the incident, data defining a set of events related to the application for a predefined range of time, wherein the set of events comprises multiple event types;

creating, by the processor set, a multivariate time series comprising respective univariate time series for the multiple event types;

defining, by the processor set, multiple windows within each of the univariate time series;

computing, by the processor set, a respective event change score of low or high for each event in the multiple windows, wherein the event change score is computed as a z-score on a moving average and standard deviation of the univariate time series in the respective window to which the particular event belongs, and wherein the event change score is labeled as low or high based on a comparison of the z-score to a threshold value;

computing, by the processor set, an overall score for each of the multiple windows based on the respective event change scores for each of the windows by aggregating the event change scores and labeling the respective window according to a majority vote scheme, wherein each event in the respective window provides a respective vote for the majority vote scheme; and

identifying, by the processor set, ones of the windows as a region of interest based on the respective overall score of the ones of the windows being labeled as high.

2 . The method of claim 1 , wherein the application comprises a cloud-native application.

3 . The method of claim 1 , wherein the data defining the set of events related to the application comprises information technology (IT) log data.

4 . The method of claim 1 , wherein the set of events comprises metrics-based events.

5 . The method of claim 4 , further comprising corroborating the identifying of each one of the windows identified as a region of interest, the corroborating comprising:

retaining one of the ones of the windows as a region of interest based on determining a change-based event occurred in the one of the windows; and

eliminating one of the ones of the windows as a region of interest based on determining a change-based event did not occur in the one of the windows.

6 . The method of claim 1 , further comprising:

determining portions of IT log data defined by the ones of the windows identified as regions of interest; and

passing the determined portions of the IT log data to a user for analysis of the incident.

7 . The method of claim 1 , further comprising:

determining portions of IT log data defined by the ones of the windows identifies a regions of interest; and

performing automated analysis of the incident using the determined portions of the IT log data.

8 . The method of claim 1 , wherein the set of events comprises an event type CPU, an event type RAM, an event type disk, an event type IO, and an event type HTTP delay.

9 . A computer program product comprising:

one or more computer readable storage media; and

program instructions stored on the one or more computer readable storage media for performing operations comprising:

receiving a notification of an incident associated with an application;

obtaining, based on the receiving the notification of the incident, data defining a set of events related to the application for a predefined range of time, wherein the set of events comprises multiple event types;

creating a multivariate time series comprising respective univariate time series for the multiple event types;

defining event type windows within each of the univariate time series and defining comprehensive windows within the multivariate time series;

computing a respective event change score of low or high for each event in the event type windows, wherein the event change score is computed as a z-score on a moving average and standard deviation of the univariate time series in the respective event type window to which the particular event belongs, and wherein the event change score is labeled as low or high based on a comparison of the z-score to a threshold value;

computing an overall score for each of the event type windows of low or high based on the respective event change scores within the respective event type window by labeling the respective event type window according to a majority vote scheme, wherein each event in the respective window provides a respective vote with its low or high label for the majority vote scheme;

computing an overall comprehensive score for each of the comprehensive windows based on the overall score for each of the event type windows which overlap in time with a respective one of the comprehensive windows, wherein the computing of the overall comprehensive score occurs by performing a comprehensive majority vote scheme, wherein each overall score of the event type windows which overlap in time with the respective one of the comprehensive windows provides a respective vote for the comprehensive majority vote scheme, and wherein each of the comprehensive windows includes events of at least two of the event types; and

identifying ones of the windows as a region of interest based on the respective overall comprehensive score of the comprehensive window being labeled as high.

10 . The computer program product of claim 9 , wherein the application comprises a cloud-native application.

11 . The computer program product of claim 9 , wherein the data defining the set of events related to the application comprises information technology (IT) log data.

12 . The computer program product of claim 9 , wherein the set of events comprises metrics-based events.

13 . The computer program product of claim 12 , wherein the operations further comprise corroborating the identifying of each one of the windows identified as a region of interest, the corroborating comprising:

retaining one of the ones of the windows as a region of interest based on determining a change-based event occurred in the one of the windows; and

eliminating one of the ones of the windows as a region of interest based on determining a change-based event did not occur in the one of the windows.

14 . The computer program product of claim 9 , wherein the operations further comprise:

determining portions of IT log data defined by the ones of the windows identified as regions of interest; and

passing the determined portions of the IT log data to a user for analysis of the incident.

15 . The computer program product of claim 9 , wherein the operations further comprise:

determining portions of IT log data defined by the ones of the windows identifies a regions of interest; and

performing automated analysis of the incident using the determined portions of the IT log data.

16 . The computer program product of claim 9 , wherein the set of events comprises an event type CPU, an event type RAM, an event type disk, an event type IO, and an event type HTTP delay.

17 . A system comprising:

a processor set;

one or more computer readable storage media; and

program instructions stored on the one or more computer readable storage media to be executed by the processor set to perform operations comprising:

receiving a notification of an incident associated with an application;

obtaining, based on the receiving the notification of the incident, data defining a set of events related to the application for a predefined range of time, wherein the set of events comprises multiple event types;

creating a multivariate time series comprising respective univariate time series for the multiple event types;

defining multiple windows within each of the univariate time series;

computing a respective event change score of low or high for each event in the multiple windows, wherein the event change score is computed as a z-score on a moving average and standard deviation of the univariate time series in the respective window to which the particular event belongs, and wherein the event change score is labeled as low or high based on a comparison of the z-score to a threshold value;

computing an overall score for each of the multiple windows based on the respective event change scores for each of the windows by aggregating the event change scores and labeling the respective window according to a majority vote scheme, wherein each event in the respective window provides a respective vote for the majority vote scheme; and

identifying ones of the windows as a region of interest based on the respective overall score of the ones of the windows being labeled as high.

18 . The computer program product of claim 17 , wherein the operations further comprise:

determining portions of IT log data defined by the ones of the windows identified as regions of interest; and

passing the determined portions of the IT log data to a user for analysis of the incident.

19 . The computer program product of claim 17 , wherein the operations further comprise:

determining portions of IT log data defined by the ones of the windows identifies a regions of interest; and

performing automated analysis of the incident using the determined portions of the IT log data.

20 . The computer program product of claim 17 , wherein the set of events comprises an event type CPU, an event type RAM, an event type disk, an event type IO, and an event type HTTP delay.