Proactive alert aggregation and correlation management with automated summarization
An information handling system includes a data store configured to store an account associated with a first alert and a second alert. A processor may receive the first alert and the second alert, map the first alert and the second alert to a first node and a second node of a causality graph, traverse the causality graph starting from the sink node to the source node to determine an association between the first alert and the second alert, and generate the account based on the association between the first alert and the second alert.
1 . A method comprising:
receiving, by a processor, a first alert and a second alert;
determining a hierarchal association of nodes in a causality graph by traversing the nodes of the causality graph starting from a sink node until a source node is reached;
creating a trail of connected alerts on a path to the sink node with the traversing, wherein the trail of alerts is associated with flagged nodes among the nodes in the causality graph, wherein the trail of alerts includes the first alert and the second alert, wherein the first alert and the second alert are associated with a first node and a second node respectively, and wherein the first node and the second node are among the flagged nodes;
determining a root cause of the first alert and the second alert included in the trail of alerts associated with the flagged nodes based on the hierarchal association of the nodes;
determining a priority between a first priority of the first alert and a second priority of the second alert based on distance to the sink node along the path, wherein the first priority of the first alert has a lower priority with shorter distance to the sink node that includes a first edge, and wherein the second priority has a higher priority with longer distance to the sink node that includes the first edge and a second edge;
mapping the first alert and the second alert to a vocabulary and associated hardware component, wherein the vocabulary is based a semantic meaning of the first alert and the second alert;
generating an account of the root cause based on the mapping of the vocabulary and the associated hardware component;
generating a support ticket that includes the account of the root cause; and
transmitting the support ticket to a technical support specialist to resolve the root cause according to the priority.
2 . The method of claim 1 , further comprising adding the sink node into a queue for processing.
3 . The method of claim 1 , wherein the causality graph is updated when alert is raised within a time window.
4 . The method of claim 3 , further comprising determining a first aggregation score that is associated with a parent node and a second aggregation score that is associated with a child node.
5 . The method of claim 4 , further comprising removing one or more nodes with an aggregation score of zero from the causality graph.
6 . The method of claim 4 , wherein the second aggregation score is multiplied by a weight associated with a severity of the second alert.
7 . The method of claim 6 , wherein the second aggregation score is added to the first aggregation score.
8 . The method of claim 4 , further comprising generating a prioritized list of issues based on the first aggregation score.
9 . The method of claim 1 , further comprising:
performing a semantic analysis of a first language term in the first alert and a second language term in the second alert; and
determining that the first language term and the second language term are semantically equivalent to a third language term and mapping the first language term and the second language term to the third language term.
10 . The method of claim 1 , further comprising mapping the first alert and the second alert to a first device and a second device respectively.
11 . The method of claim 1 , further comprising if a node in the causality graph is associated with an alert, then flagging the node to indicate the alert has occurred.
12 . An information handling system, comprising:
a data store configured to store an account associated with a first alert and a second alert; and
a processor coupled to the data store, the processor configured to:
receive the first alert and the second alert;
map the first alert and the second alert, respectively, to a first node and a second node of a causality graph of nodes, wherein the first node is associated with a first flag and the second node is associated with a second flag, wherein the first flag is set to one and the second flag is set to one based on the map, and wherein the causality graph includes a third node;
calculate a first aggregation score of a sink node, a second aggregation score of a source node, and a third aggregation score of the third node, wherein the second aggregation score includes the first aggregation score, and wherein the third aggregation score is zero;
remove the third node from the causality graph in response to the third aggregation score being zero;
determine a hierarchal association of the sink node and the source node based on a traversal of the causality graph starting from the sink node until the source node is reached;
create a trail of connected alerts on a path to the sink node with the traversal of the causality graph, wherein the alerts in the trail are associated with flagged nodes among the nodes in the causality graph, wherein the trail of alerts includes the first alert and the second alert, wherein the first alert and the second alert are associated with the first node and the second node respectively, and wherein the first node and the second node are among the flagged nodes;
generate the account of a root cause of the first alert and the second alert included in the trail of alerts associated with the flagged nodes based on the hierarchal association;
determining a priority between a first priority of the first alert and a second priority of the second alert based on distance to the sink node along the path, wherein the first priority of the first alert has a lower priority with shorter distance to the sink node that includes a first edge, and wherein the second priority has a higher priority with longer distance to the sink node that includes the first edge and a second edge;
generate a support ticket that includes the account of the root cause; and
send the support ticket to a technical support specialist to resolve the root cause according to the priority.
13 . The information handling system of claim 12 , wherein the causality graph is updated when alert is raised within a time window.
14 . The information handling system of claim 13 , wherein the processor is further configured to generate a prioritized list of issues based on the first aggregation score and the second aggregation score.
15 . The information handling system of claim 12 , wherein the processor is further configured to remove one or more nodes with an aggregation score of zero from the causality graph.
16 . The information handling system of claim 12 , wherein if a node in the causality graph is associated with an alert, then the processor is further configured to flag the node to indicate that the alert has occurred.
17 . A non-transitory computer-readable medium including code that when executed performs a method, the method comprising:
receiving a first alert and a second alert;
traversing a causality graph starting from a sink node until a source node is reached, wherein the causality graph includes a plurality of nodes that includes at least the sink node and the source node;
creating a trail of connected alerts on a path to the sink node with the traversing, wherein the trail of alerts is associated with flagged nodes among the nodes in the causality graph, wherein the trail of alerts includes the first alert and the second alert, wherein the first alert and the second alert are associated with a first node and a second node respectively, and wherein the first node and the second node are among the flagged nodes;
determining a root cause of the first alert and the second alert included in the trail of alerts associated with the flagged nodes based on a hierarchal association of the nodes in the causality graph;
determining a priority between a first priority of the first alert and a second priority of the second alert based on distance to the sink node along the path, wherein the first priority of the first alert has a lower priority with shorter distance to the sink node that includes a first edge, and wherein the second priority has a higher priority with longer distance to the sink node that includes the first edge and a second edge;
mapping the first alert and the second alert to a vocabulary and associated hardware component, wherein the vocabulary is based a semantic meaning of the first alert and the second alert;
generating an account of the root cause based on the mapping of the vocabulary and the associated hardware component;
generating a support ticket that includes the account of the root cause; and
transmitting the support ticket to a technical support specialist to resolve the root cause according to the priority.
18 . The non-transitory computer-readable medium of claim 17 , wherein the method further comprises determining a first aggregation score that is associated with a parent node and a second aggregation score that is associated with a child node.
19 . The non-transitory computer-readable medium of claim 18 , wherein the second aggregation score is multiplied by a weight associated with a severity of the second alert.
20 . The non-transitory computer-readable medium of claim 17 , wherein the method further comprises:
performing a semantic analysis of a first language term in the first alert and a second language term of the second alert; and
determining that the first language term and the second language term are semantically equivalent to a third language term and mapping the first language term and the second language term to the third language term.