Recommendations for remedial actions
Described systems and techniques determine causal associations between events that occur within an information technology landscape. Individual situations that are likely to represent active occurrences requiring a response may be identified as causal event clusters, without requiring manual tuning to determine cluster boundaries. Consequently, it is possible to identify root causes, analyze effects, predict future events, and prevent undesired outcomes, even in complicated, dispersed, interconnected systems.
1. A computer-implemented method for training a remedial action recommendation (RAR) model, the method comprising:
receiving a plurality of source alarms and a plurality of target remedial actions;
extracting features from the plurality of source alarms and the plurality of target remedial actions;
collecting implicit feedback and explicit feedback;
storing the features, the implicit feedback, and the explicit feedback in a rated remedial action log, wherein the implicit feedback and the explicit feedback are associated with particular source alarms from the plurality of source alarms and particular target remedial actions from the plurality of target remedial actions;
processing the features, the implicit feedback, and the explicit feedback through a learning algorithm and producing a plurality of regression trees;
processing the plurality of regression trees through the RAR model; and
producing metrics from the RAR model to provide feedback and train the RAR model.
2. The computer-implemented method as in claim 1 , further comprising:
receiving a plurality of new source alarms and a plurality of new target remedial actions;
extracting new features from the plurality of new source alarms and the plurality of new target remedial actions;
processing the new features through the RAR model; and
producing ranked recommended remedial actions.
3. The computer-implemented method as in claim 2 , wherein the ranked recommended remedial actions include a confidence value.
4. The computer-implemented method as in claim 1 , wherein the implicit feedback includes positive reinforcement implicit feedback when a target remedial action from the plurality of target remedial actions closes a corresponding source alarm from the plurality of source alarms.
5. The computer-implemented method as in claim 1 , wherein the implicit feedback includes negative reinforcement implicit feedback.
6. The computer-implemented method as in claim 1 , wherein the implicit feedback includes feedback received without manual intervention.
7. The computer-implemented method as in claim 1 , wherein the explicit feedback includes a selected response from a user.
8. A computer program product for training a remedial action recommendation (RAR) model, the computer program product being tangibly embodied on a non-transitory computer-readable medium and including executable code that, when executed, causes a computing device to:
receive a plurality of source alarms and a plurality of target remedial actions;
extract features from the plurality of source alarms and the plurality of target remedial actions;
collect implicit feedback and explicit feedback;
store the features, the implicit feedback, and the explicit feedback in a rated remedial action log, wherein the implicit feedback and the explicit feedback are associated with particular source alarms from the plurality of source alarms and particular target remedial actions from the plurality of target remedial actions;
process the features, the implicit feedback, and the explicit feedback through a learning algorithm and producing a plurality of regression trees;
process the plurality of regression trees through the RAR model; and
produce metrics from the RAR model to provide feedback and train the RAR model.
9. The computer program product of claim 8 , further comprising executable code that, when executed, causes a computing device to:
receive a plurality of new source alarms and a plurality of new target remedial actions;
extract new features from the plurality of new source alarms and the plurality of new target remedial actions;
process the new features through the RAR model; and
produce ranked recommended remedial actions.
10. The computer program product of claim 9 , wherein the ranked recommended remedial actions include a confidence value.
11. The computer program product of claim 9 , wherein the implicit feedback includes positive reinforcement implicit feedback when a target remedial action from the plurality of target remedial actions closes a corresponding source alarm from the plurality of source alarms.