Methods and systems for discovering incidents through clustering of alert occurring in a data center

1. An automated computer-implemented method for discovering incidents through clusters of alerts occurring with objects executing in a data center, the method comprising:

getting alerts with start times in a sliding run-time window from an alerts database, each alert corresponding to a run-time event occurring with an object executing in the data center;

detecting clusters of alerts in the sliding run-time window based on start times of the alerts and topological proximity of objects, each cluster of alerts corresponding to an incident occurring with objects executing in the data center,

determining high priority alerts in the clusters of alerts based on types of alerts; and

displaying discovered incidents associated with the clusters of alerts, events associated with the clusters of alerts, and high priority events in a graphical user interface (“GUI”).

2. The method of claim 1 further comprising:

comparing run-time metric values of metrics of the data center to corresponding thresholds;

detecting run-time violations of the corresponding thresholds; and

recording alerts associate with each of the run-time violations in the alerts database.

3. The method of claim 1 further comprising:

determining incident descriptions of the alerts of the clusters of alerts based on a hierarchy of the objects in a topological hierarchy of the data center; and

displaying the incident descriptions in the GUI.

4. The method of claim 1 wherein detecting clusters of alerts in the sliding run-time window comprises:

partitioning the sliding run-time window into four equal duration time intervals, including an earliest interval, a second earliest interval, a third earliest interval, and a fourth earliest interval;

detecting core alerts with start times in a second earliest interval of the time intervals based on time and topological proximity of alerts in the second earliest interval;

assigning cluster identification (“ID”) to each core alert in the second earliest interval;

assigning cluster IDs of core alerts to border alerts in the earliest interval, based on the border alerts lying with neighborhoods of the core alerts;

detecting border alerts in the second earliest interval; and

advancing the sliding run-time window by the duration of the time intervals.

5. The method of claim 4 wherein assigning cluster identification (“ID”) to each core alert in the second earliest interval comprises:

for each core alert,

in response to the core alert having two or more core alerts with different cluster IDs, assigning to the core alert the cluster ID of the cluster with a largest number core alerts,

in response to the core alert having a core alert with a cluster ID, assigning to the core alert the cluster ID, and

assigning the core alert a new cluster ID when the core alert does not contain a core alert with a cluster ID.

6. The method of claim 1 wherein determining priorities of the alerts in the clusters of alerts based on alert types.

7. The method of claim 1 further comprising:

sorting alerts based on start time recorded in a historical time interval;

identifying an alert as corresponding to an incident; and

for each subsequent alert,

determining whether the alert is in time and topological proximity with each alert in a cluster of alerts associated with the incident,

adding the alert to the cluster of alerts in response to the alert being in time and topological proximity with each of the alerts in the cluster, and

stating a new incident for the alert in response to the alert not being in time and topological proximity with each of the alerts in the cluster.

8. The method of claim 1 further comprising:

for each alert recorded in a historical time period, determining a number of alerts that are within a neighborhood of the alert:

forming a first cluster of alerts from the alerts that are within a neighborhood with the largest number of alerts; and

forming a second cluster of alerts from the alerts that are within a neighborhood with the second largest number of alerts and excluded alerts in the first cluster of alerts.

9. A computer system for discovering incidents through clusters of alerts occurring with objects executing in a data center, the computer system comprising:

one or more processors;

one or more data-storage devices; and

machine-readable instructions stored in the one or more data-storage devices that when executed using the one or more processors control the system to performance operations comprising:

getting alerts with start times in a sliding run-time window from an alerts database, each alert corresponding to a run-time event occurring with an object executing in the data center;

detecting clusters of alerts in the sliding run-time window based on start times of the alerts and topological proximity of objects, each cluster of alerts corresponding to an incident occurring with objects executing in the data center;

determining high priority alerts in the clusters of alerts based on types of alerts; and

displaying discovered incidents associated with the clusters of alerts, events associated with the clusters of alerts, and high priority events in a graphical user interface (“GUI”).

10. The computer system of claim 9 further comprising:

comparing run-time metric values of metrics of the data center to corresponding thresholds;

detecting run-time violations of the corresponding thresholds; and

recording alerts associate with each of the run-time violations in the alerts database.

11. The computer system of claim 9 further comprising:

determining incident descriptions of the alerts of the clusters of alerts based on a hierarchy of the objects in a topological hierarchy of the data center; and

displaying the incident descriptions in the GUI.

12. The computer system of claim 9 wherein detecting clusters of alerts in the sliding run-time window comprises:

partitioning the sliding run-time window into four equal duration time intervals, including an earliest interval, a second earliest interval, a third earliest interval, and a fourth earliest interval:

detecting core alerts with start times in a second earliest interval of the time intervals based on time and topological proximity of alerts in the second earliest interval:

assigning cluster identification (“ID”) to each core alert in the second earliest interval;

assigning cluster IDs of core alerts to border alerts in the earliest interval, based on the border alerts lying with neighborhoods of the core alerts;

detecting border alerts in the second earliest interval; and

advancing the sliding run-time window by the duration of the time intervals.

13. The computer system of claim 12 wherein assigning cluster identification (“ID”) to each core alert in the second earliest interval comprises:

for each core alert,

in response to the core alert having two or more core alerts with different cluster IDs, assigning to the core alert the cluster ID of the cluster with a largest number core alerts,

in response to the core alert having a core alert with a cluster ID, assigning to the core alert the cluster ID, and

assigning the core alert a new cluster ID when the core alert does not contain a core alert with a cluster ID.

14. The computer system of claim 9 wherein determining priorities of the alerts in the clusters of alerts based on alert types.

15. The computer system of claim 9 further comprising:

sorting alerts based on start time recorded in a historical time interval;

identifying an alert as corresponding to an incident; and

for each subsequent alert,

determining whether the alert is in time and topological proximity with each alert in a cluster of alerts associated with the incident,

adding the alert to the cluster of alerts in response to the alert being in time and topological proximity with each of the alerts in the cluster, and

stating a new incident for the alert in response to the alert not being in time and topological proximity with each of the alerts in the cluster.

16. The computer system of claim 9 further comprising:

for each alert recorded in a historical time period, determining a number of alerts that are within a neighborhood of the alert;

forming a first cluster of alerts from the alerts that are within a neighborhood with the largest number of alerts; and

forming a second cluster of alerts from the alerts that are within a neighborhood with the second largest number of alerts and excluded alerts in the first cluster of alerts.

17. A non-transitory computer-readable medium having instructions encoded thereon for enabling one or more processors of a computer system to perform operations comprising:

getting alerts with start times in a sliding run-time window from an alerts database, each alert corresponding to a run-time event occurring with an object executing in the data center;

detecting clusters of alerts in the sliding run-time window based on start times of the alerts and topological proximity of objects, each cluster of alerts corresponding to an incident occurring with objects executing in the data center;

determining high priority alerts in the clusters of alerts based on types of alerts; and

displaying discovered incidents associated with the clusters of alerts, events associated with the clusters of alerts, and high priority events in a graphical user interface (“GUI”).

18. The medium of claim 17 further comprising:

comparing run-time metric values of metrics of the data center to corresponding thresholds;

detecting run-time violations of the corresponding thresholds; and

recording alerts associate with each of the run-time violations in the alerts database.

19. The medium of claim 17 further comprising:

determining incident descriptions of the alerts of the clusters of alerts based on a hierarchy of the objects in a topological hierarchy of the data center; and

displaying the incident descriptions in the GUI.

20. The medium of claim 17 wherein detecting clusters of alerts in the sliding run-time window comprises:

partitioning the sliding run-time window into four equal duration time intervals, including an earliest interval, a second earliest interval, a third earliest interval, and a fourth earliest interval:

detecting core alerts with start times in a second earliest interval of the time intervals based on time and topological proximity of alerts in the second earliest interval;

assigning cluster identification (“ID”) to each core alert in the second earliest interval;

assigning cluster IDs of core alerts to border alerts in the earliest interval, based on the border alerts lying with neighborhoods of the core alerts;

detecting border alerts in the second earliest interval; and

advancing the sliding run-time window by the duration of the time intervals.

21. The medium of claim 20 wherein assigning cluster identification (“ID”) to each core alert in the second earliest interval comprises:

for each core alert,

in response to the core alert having two or more core alerts with different cluster IDs, assigning to the core alert the cluster ID of the cluster with a largest number core alerts,

in response to the core alert having a core alert with a cluster ID, assigning to the core alert the cluster ID, and

assigning the core alert a new cluster ID when the core alert does not contain a core alert with a cluster ID.

22. The medium of claim 17 wherein determining priorities of the alerts in the clusters of alerts based on alert types.

23. The medium of claim 17 further comprising discovering clusters of alerts using time evolution clustering based on the start times of the alerts and the topological proximity of the objects.

24. The medium of claim 17 further comprising discovering clusters of alerts using coverage evolution of alerts based on the start times of the alerts and the topological proximity of the objects.

25. The medium of claim 17 further comprising:

sorting alerts based on start time recorded in a historical time interval;

identifying an alert as corresponding to an incident; and

for each subsequent alert,

determining whether the alert is in time and topological proximity with each alert in a cluster of alerts associated with the incident,

adding the alert to the cluster of alerts in response to the alert being in time and topological proximity with each of the alerts in the cluster, and

stating a new incident for the alert in response to the alert not being in time and topological proximity with each of the alerts in the cluster.

26. The medium of claim 17 further comprising:

for each alert recorded in a historical time period, determining a number of alerts that are within a neighborhood of the alert;

forming a first cluster of alerts from the alerts that are within a neighborhood with the largest number of alerts; and

forming a second cluster of alerts from the alerts that are within a neighborhood with the second largest number of alerts and excluded alerts in the first cluster of alerts.