Identifying a dimension associated with an abnormal condition
View Patent ↗At least one value of abnormal metrics is identified as being an abnormal dimension value. A dominant dimension related to the anomaly is identified based on the identified abnormal dimension value.
1. A method comprising:
receiving abnormal metrics indicating presence of an anomaly in a system, wherein the abnormal metrics are associated with a plurality of dimensions;
determining, based on values of the plurality of dimensions, at least one of the values as being an abnormal dimension value; and
based on determining the at least one abnormal dimension value, identifying a dominant dimension that is associated with the anomaly, the dominant dimension being one of the plurality of dimensions.
2. The method of claim 1 , wherein determining that the at least one value is an abnormal dimension value is based on determining an amount of occurrences of the at least one value in the received abnormal metrics.
3. The method of claim 2 , wherein the at least one value is determined to be an abnormal dimension value in response to a ratio of the amount of occurrences of the at least one value in the received abnormal metrics to an amount of occurrences of the at least one value in overall received metrics exceeding a threshold.
4. The method of claim 3 , wherein the threshold is one of a static threshold and a dynamically learned threshold.
5. The method of claim 2 , wherein the at least one value is determined to be an abnormal dimension value in response to a proportion of the at least one value to other values of the dimension exceeding a computed proportion by greater than a predefined amount.
6. The method of claim 5 , wherein the computed portion is based on relative amounts of the values of the dimensions learned during an operation of the system.
7. The method of claim 1 , further comprising:
using the abnormal dimension value to determine whether the anomaly is associated with a first entity representing the abnormal dimension value, or is associated with a second entity that is at a higher hierarchical level than the first entity.
8. The method of claim 7 , further comprising:
receiving a representation of dimension values of a particular dimension at a plurality of hierarchical levels, where the representation identifies dimension values that are children of other dimension values.
9. The method of claim 8 , wherein determining that the anomaly is associated with the second entity is in response to determining that the second entity has a number of children abnormal dimension values that satisfies a predefined rule.
10. The method of claim 1 , wherein the determining and the identifying are performed by at least one processor.
11. The method of claim 1 , wherein the determining comprises determining a plurality of the values of the plurality of dimensions as abnormal dimension values, a first of the abnormal dimension values being a value of a first of the plurality of dimensions, and a second of the abnormal dimension values being a value of a second of the plurality of dimensions, wherein identifying the dominant dimension is based on comparing a number of abnormal metrics containing the first abnormal dimension value to a number of abnormal metrics containing the second abnormal dimension value.
12. An article comprising at least one non-transitory machine-readable storage medium storing instructions that upon execution cause a system to:
determine baseline values of metrics in a system;
identify abnormal metrics indicative of an anomaly based on the baseline values, where each of the abnormal metrics is associated with a common set of a plurality of dimensions;
identify selected dimension values of the abnormal metrics as being abnormal dimension values according to a predefined criterion, a first of the abnormal dimension values being a value of a first of the plurality of dimensions, and a second of the abnormal dimension values being a value of a second of the plurality of dimensions; and
identify a dominant dimension related to the anomaly based on the identified abnormal dimension values, the dominant dimension being associated with the anomaly and being one of the first and second dimensions.
13. The article of claim 12 , wherein the dominant dimension and the abnormal dimension values are useable in determining a cause of the anomaly.
14. The article of claim 12 , wherein the instructions upon execution cause the system to further:
identify a largest problem scope based on the identified abnormal dimension values.
15. The article of claim 14 , wherein identifying the largest problem scope comprises identifying a dimension value that covers multiple ones of the abnormal dimension values.
16. The article of claim 15 , wherein identifying the largest problem scope uses a hierarchical data structure having nodes representing respective dimension values, wherein the largest problem scope corresponds to a node that has children nodes corresponding to plural ones of the multiple abnormal dimension values.
17. The article of claim 12 , wherein identifying the dominant dimension is based on comparing a number of abnormal metrics containing the first abnormal dimension value to a number of abnormal metrics containing the second abnormal dimension value.
18. A system comprising:
at least one processor to:
receive abnormal metrics indicating presence of an anomaly in the system, wherein each of the abnormal metrics is associated with a common set of a plurality of dimensions;
determine, based on values of the plurality of dimensions, a plurality of the values as being abnormal dimension values, a first of the abnormal dimension values being a value of a first of the plurality of dimensions, and a second of the abnormal dimension values being a value of a second of the plurality of dimensions; and
based on determining the abnormal dimension values, identify a dominant dimension that is associated with the anomaly, the dominant dimension being one of the first and second dimensions.
19. The system of claim 18 , wherein the at least one processor is to further:
identify a largest problem scope based on the abnormal dimension values.
20. The system of claim 19 , wherein the largest problem scope comprises a dimension value that covers multiple ones of the abnormal dimension values.
21. The system of claim 18 , wherein identifying the dominant dimension is based on comparing a number of abnormal metrics containing the first abnormal dimension value to a number of abnormal metrics containing the second abnormal dimension value.