Device operation anomaly identification and reporting system
A device operation anomaly identification and reporting system includes device that generates an operating metric data stream. A management system is coupled to the device and receives and analyzes the operating metric data stream. The management system identifies peaks present in the operating metric data stream, and determines a peak height and a peak area for each of the peaks. The management system then clusters the peaks into height clusters based on their heights, and clusters the peaks into area clusters based on their areas. The management system then defines an operating periodicity for the device based on the height clusters and area clusters, and when the management system detects an operating anomaly in the device using the operating periodicity defined for the device, it generates and transmits an operating anomaly alert that reports the operating anomaly in the device.
1. A device operation anomaly identification and reporting system, comprising:
a device that is configured to operate and, in response, generate an operating metric data stream; and
a management system that is coupled to the device, wherein the management system is configured to:
receive, from the device, the operating metric data stream;
analyze the operating metric data stream over a time period;
identify a plurality of peaks present in the operating metric data stream during the time period;
determine, for each of the plurality of peaks, a peak height and a peak area;
cluster the plurality of peaks into a plurality of height clusters based on the peak height determined for each of the plurality of peaks;
cluster the plurality of peaks into a plurality of area clusters based on the peak area determined for each of the plurality of peaks;
define an operating periodicity for the device based on the plurality of height clusters and the plurality of area clusters by:
mapping a set of height clusters of interest that are included in the plurality of height clusters and a set of area clusters of interest that are included in the plurality of area clusters as pairs to a common cluster identifier,
clustering a time distance between consecutive peaks within the mapping of the set of height clusters of interest and the set of area clusters of interest into a plurality of time clusters, and
defining the operating periodicity based on the plurality of time clusters;
detect an operating anomaly in the device using the operating periodicity defined for the device; and
generate and transmit an operating anomaly alert that reports the operating anomaly in the device.
2. The system of claim 1 , wherein the management system is configured to:
determine, for the plurality of peaks present in the operating metric data stream during the time period, a peak baseline, wherein the peak height the peak area for each of the plurality of peaks is determined using the peak baseline.
3. The system of claim 1 , wherein the identification of each of the plurality of peaks in the operating metric data stream during the time period includes:
identifying a Gaussian-like distribution in the operating metric data stream; and
identifying the peak of the Gaussian-like distribution in the operating metric data stream.
4. The system of claim 1 , wherein the identification of each of the plurality of peaks in the operating metric data stream during the time period includes:
identifying a peak beginning in the operating metric data stream;
identifying a peak ending in the operating metric data stream; and
identifying the peak in the operating metric data stream as at least one of a maximum or a midpoint between the peak beginning and the peak ending.
5. The system of claim 1 , wherein the defining the operating periodicity for the device based on the plurality of height clusters includes:
clustering time distances between each of the plurality of peaks within each of the plurality of height clusters.
6. An Information Handling System (IHS), comprising:
a processing system; and
a memory system that is coupled to the processing system and that includes instructions that, when executed by the processing system, cause the processing system to provide a device operation anomaly identification and reporting engine that is configured to:
receive, from a device, an operating metric data stream that is generated by the device during operation of the device;
analyze the operating metric data stream over a time period;
identify a plurality of peaks present in the operating metric data stream during the time period;
determine, for each of the plurality of peaks, a peak height and a peak area;
cluster the plurality of peaks into a plurality of height clusters based on the peak height determined for each of the plurality of peaks;
cluster the plurality of peaks into a plurality of area clusters based on the peak area determined for each of the plurality of peaks;
define an operating periodicity for the device based on the plurality of height clusters and the plurality of area clusters by:
mapping a set of height clusters of interest that are included in the plurality of height clusters and a set of area clusters of interest that are included in the plurality of area clusters as pairs to a common cluster identifier,
clustering a time distance between consecutive peaks within the mapping of the set of height clusters of interest and the set of area clusters of interest into a plurality of time clusters, and
defining the operating periodicity based on the plurality of time clusters;
detect an operating anomaly in the device using the operating periodicity defined for the device; and
generate and transmit an operating anomaly alert that reports the operating anomaly in the device.
7. The IHS of claim 6 , wherein the device operation anomaly identification and reporting engine is configured to:
determine, for the plurality of peaks present in the operating metric data stream during the time period, a peak baseline, wherein the peak height the peak area for each of the plurality of peaks is determined using the peak baseline.
8. The IHS of claim 6 , wherein the identification of each of the plurality of peaks in the operating metric data stream during the time period includes:
identifying a Gaussian-like distribution in the operating metric data stream; and
identifying the peak of the Gaussian-like distribution in the operating metric data stream.
9. The IHS of claim 6 , wherein the identification of each of the plurality of peaks in the operating metric data stream during the time period includes:
identifying a peak beginning in the operating metric data stream;
identifying a peak ending in the operating metric data stream; and
identifying the peak in the operating metric data stream as at least one of a maximum and a midpoint between the peak beginning and the peak ending.
10. The IHS of claim 6 , wherein the defining the operating periodicity for the device includes:
defining, for each of a plurality of times, an expected value of the operating metric, a positive deviation from the expected value of the operating metric, and a negative deviation of the expected value of the operating metric, and wherein the detecting the operating anomaly in the device includes:
detecting, at a particular time included in the plurality of times, that an observed operating metric value is outside of the positive deviation from the expected value of the operating metric and the negative deviation of the expected value of the operating metric.
11. A method for device operation anomaly identification and reporting:
receiving, by a management system from a device, an operating metric data stream that is generated by the device during operation of the device;
analyzing, by the management system, the operating metric data stream over a time period;
identifying, by the management system, a plurality of peaks present in the operating metric data stream during the time period;
determining, by the management system for each of the plurality of peaks, a peak height and a peak area;
clustering, by the management system, the plurality of peaks into a plurality of height clusters based on the peak height determined for each of the plurality of peaks;
clustering, by the management system, the plurality of peaks into a plurality of area clusters based on the peak area determined for each of the plurality of peaks;
defining, by the management system, an operating periodicity for the device based on the plurality of height clusters and the plurality of area clusters by:
mapping a set of height clusters of interest that are included in the plurality of height clusters and a set of area clusters of interest that are included in the plurality of area clusters as pairs to a common cluster identifier,
clustering a time distance between consecutive peaks within the mapping of the set of height clusters of interest and the set of area clusters of interest into a plurality of time clusters; and
defining the operating periodicity based on the plurality of time clusters;
detecting, by the management system, an operating anomaly in the device using the operating periodicity defined for the device; and
generating and transmitting, by the management system, an operating anomaly alert that reports the operating anomaly in the device.
12. The method of claim 11 , further comprising:
determining, by the management system for the plurality of peaks present in the operating metric data stream during the time period, a peak baseline, wherein the peak height the peak area for each of the plurality of peaks is determined using the peak baseline.
13. The method of claim 11 , wherein the identification of each of the plurality of peaks in the operating metric data stream during the time period includes:
identifying, by the management system, a Gaussian-like distribution in the operating metric data stream; and
identifying, by the management system, the peak of the Gaussian-like distribution in the operating metric data stream.
14. The method of claim 11 , wherein the identification of each of the plurality of peaks in the operating metric data stream during the time period includes:
identifying, by the management system, a peak beginning in the operating metric data stream;
identifying, by the management system, a peak ending in the operating metric data stream; and
identifying, by the management system, the peak in the operating metric data stream as at least one of a maximum and a midpoint between the peak beginning and the peak ending.
15. The method of claim 11 , wherein the defining the operating periodicity for the device based on the plurality of height clusters includes:
clustering time distances between each of the plurality of peaks within each of the plurality of height clusters.
16. The method of claim 11 , wherein the defining the operating periodicity for the device includes:
defining, by the management system for each of a plurality of times, an expected value of the operating metric, a positive deviation from the expected value of the operating metric, and a negative deviation of the expected value of the operating metric, and wherein the detecting the operating anomaly in the device includes:
detecting, by the management system at a particular time included in the plurality of times, that an observed operating metric value is outside of the positive deviation from the expected value of the operating metric and the negative deviation of the expected value of the operating metric.