System and method for recording behavior history for abnormality detection
View Patent ↗Disclosed is an autonomic abnormality detection device having a plurality of agents, a server with a one or more processors, a data storage device and a corrective actions engine. The device is adapted to detect and diagnose abnormalities in system components. Particularly, the device uses agents to track performance/workload measurements of system components and dynamically compiles a history of those performance/workload measurements for each component. In order to detect abnormalities a processor compares current performance/workload measurements for a component to the compiled histories for that component and for other components. The processor can further be adapted to determine possible causes of a detected abnormality and to report the abnormality, including the possible causes, to a corrective actions engine.
1. An abnormality detection device for a system with a plurality of components, said abnormality detection device comprising:
a server comprising a processor;
a plurality of agents in communication with said components and with said server and wherein said agents are adapted to periodically determine current performance/workload measurements for each of said components and to periodically transmit said current performance/workload measurements to said server; and
a data storage device in communication with said server;
wherein said processor is adapted to dynamically compile a history of performance/workload measurements for each of said components and to compare said current performance/workload measurement for each of said components to said history for each of said components so as to detect an abnormality,
wherein said data storage device stores said current performance/workload measurements for each of said components, said history for each of said components, and a record of detected abnormalities for each of said components,
wherein said processor is further adapted to compile said history by clustering performance/workload measurements for each of said components into clusters and determining an average performance/workload measurement for each of said clusters,
wherein each of said performance/workload measurements comprises a workload value, and wherein for each of said components said processor is adapted to detect an abnormality by:
identifying a predetermined number of said average performance/workload measurements having workload values closest to said workload value of said current performance/workload measurement;
determining a combined average of said predetermined number of said average performance/workload measurements; and
determining if said current performance/workload measurement is greater than a predetermined value from said combined average of said predetermined number of said average performance/workload measurements.
2. The device of claim 1 , wherein each of said performance/workload measurements comprises a workload value, and wherein for each of said components said processor is adapted to detect an abnormality by:
identifying one average performance/workload measurement in which said workload value is approximately equal to said workload value of said current performance/workload measurement; and
determining if said current performance/workload measurement is greater than a predetermined value from said one average performance/workload measurement.
3. The device of claim 1 , wherein said processor is further adapted to determine said average performance/workload measurement for each of said clusters by using at least one of a weighted average and a decay function to allow for changes in normal operation of each of said components over time.
4. The device of claim 1 , wherein said processor is further adapted to analyze said record of detected abnormalities for each of said components to determine if said abnormality in said current performance/workload measurement is random.
5. The device of claim 1 , wherein said server is further adapted to issue directives to said agents to adjust tracking parameters for said performance/workload measurements.
6. The device of claim 1 , wherein said processor is further adapted to determine a possible cause of an abnormality detected in a current performance/workload measurement of one component based on said history of said one component and on said histories and said current performance/workload measurements of other components in an invocation path of said one component.
7. The device of claim 1 , further comprising an engine in communication with said server and adapted to receive a report of a detected abnormality, to determine what if any corrective actions are necessary, and to implement said corrective actions in said system.
8. A method of detecting abnormalities in a system with a plurality of components, said method comprising:
using a plurality of agents to periodically determine a current performance/workload measurement for each of said components;
dynamically compiling a history of performance/workload measurements for each of said components;
comparing said current performance/workload measurement for each of said components to said history for each of said components to detect an abnormality in said current performance/workload measurement for each of said components; and
for each of said components, storing said current performance/workload measurements, said histories, and a record of detected abnormalities;
wherein said histories are compiled by clustering performance/workload measurements for each of said components into clusters and determining an average performance/workload measurement for each of said clusters, and
wherein each of said performance/workload measurements comprises a workload value, and wherein said method further comprises detecting an abnormality by:
identifying a predetermined number of said average performance/workload measurements having workload values closest to said workload value of said current performance/workload measurement;
determining a combined average of said predetermined number of said average performance/workload measurements; and
determining if said current performance/workload measurement is greater than a predetermined value from said combined average of said predetermined number of said average performance/workload measurements.
9. The method of claim 8 , wherein each of said performance/workload measurements comprises a workload value, and wherein said method further comprises detecting an abnormality in said current performance/workload measurement of one component by:
identifying one average performance/workload measurement for said one component in which said workload value is approximately equal to said workload value of said current performance/workload measurement of said one component; and
determining if said current performance/workload measurement is greater than a predetermined value from said one average performance/workload measurement.
10. The method of claim 8 , wherein said determining of said average performance/workload measurement for each of said clusters comprises using at least one of a weighted average and a decay function to allow for changes in normal operation of each of said components over time.
11. The method of claim 8 , further comprising issuing directives to said agents to adjust tracking parameters for said performance/workload measurements.
12. The method of claim 8 , further comprising determining a possible cause of a detected abnormality in a current performance/workload measurement of one component based on said history of said one component and on said histories and said current performance/workload measurements of other components in an invocation path of said one component.
13. A program storage device readable by a computer, tangibly embodying a program of instructions executable by said computer to perform a method of detecting abnormalities in a system with a plurality of components, said method comprising:
using a plurality of agents to periodically determine a current performance/workload measurement for each of said components;
dynamically compiling a history of performance/workload measurements for each of said components;
comparing said current performance/workload measurement to said history to detect an abnormality in said current performance/workload measurement for each of said components; and
for each of said components, storing said current performance/workload measurements, said histories, and a record of detected abnormalities; wherein said histories are compiled by clustering performance/workload measurements for each of said components into clusters and determining an average performance/workload measurement for each of said clusters;
wherein said histories are compiled by clustering performance/workload measurements for each of said components into clusters and determining an average performance/workload measurement for each of said clusters,
wherein each of said performance/workload measurements comprises a workload value, and wherein said method further comprises detecting an abnormality by:
identifying a predetermined number of said average performance/workload measurements having workload values closest to said workload value of said current performance/workload measurement;
determining a combined average of said predetermined number of said average performance/workload measurements; and
determining if said current performance/workload measurement is greater than a predetermined value from said combined average of said predetermined number of said average performance/workload measurements.
14. The program storage device of claim 13 wherein each of said performance/workload measurements comprises a workload value, and wherein said method further comprises detecting an abnormality in said current performance/workload measurement of one component by:
identifying one average performance/workload measurement in which said workload value is approximately equal to said workload value of said current performance/workload measurement of said one component; and
determining if said current performance/workload measurement is greater than a predetermined value from said one average performance/workload measurement.