Granted Patent B2

US 12,277,049 · App. 17/655,568 · Granted Apr 15, 2025

Inventors: Seema Nagar (Bangalore, IN); Pooja Aggarwal (Bengaluru, IN); Qing Wang (Sunnyvale, CA); Larisa Shwartz (Greenwich, CT)

Assignee: International Business Machines Corporation

G06F11/3612G06F11/366

Abstract

Claims (66)

1. A computer-implemented method for localizing faults, the method comprising:

monitoring, during runtime execution of an application, for an occurrence of a request failure by tracking requests of the application for a failure, the application communicating with a plurality of resources within a distributed computing system;

identifying a timeframe in which a request failure is observed while tracking requests of the application;

building a causal graph using erroneous logs generated during the timeframe when the request failure is observed;

identifying real-time execution sequences during the timeframe of the request failure based on paths from a gateway node to a set of leaf nodes according to the causal graph;

establishing a set of frequent execution sub-sequences arising during normal operation of the application including communications with the plurality of resources, the establishing based on a log template time series dataset from normal execution logs; and

identifying a missing resource of the plurality of resources by analyzing a candidate execution sequence occurring during the timeframe with respect to a corresponding partially matching frequent execution sub-sequence of the set of frequent execution sub-sequences, the missing resource being present in the corresponding partially matching frequent execution sub-sequence and absent from the candidate execution sequence.

2. The method of claim 1 , further comprising:

collecting the normal execution logs from the application associated with the plurality of resources; and

generating the log template time series dataset from the normal execution logs.

3. The method of claim 1 , wherein identifying the missing resource includes:

comparing the real-time execution sequences to the set of frequent sub-sequences arising during normal execution to identify the candidate execution sequence and the corresponding partially matching frequent execution sequence.

4. The method of claim 1 , wherein the set of frequent sub-sequences are labeled individually with a corresponding type of execution flow.

5. The method of claim 1 , wherein the missing resource is a faulty microservice.

6. The method of claim 1 , wherein:

there is no microservice topology available; and

the missing resource does not emit an error signal during the timeframe.

7. The method of claim 1 , further comprising:

evaluating the missing resource for being a faulty component of the distributed computing system.

8. The method of claim 1 , wherein the set of frequent execution sub-sequences are discovered by apriori-based subgraph frequent pattern mining algorithms, each frequent execution sub-sequence developed from frequently arising individual items and extended to larger item sets having a threshold minimum frequency, the larger item sets being designated frequent execution sub-sequences.

9. A computer program product comprising a computer-readable storage medium having a set of instructions stored therein which, when executed by a processor, causes the processor to localize faults by:

monitoring, during runtime execution of an application, for an occurrence of a request failure by tracking requests of the application for a failure, the application communicating with a plurality of resources within a distributed computing system;

identifying a timeframe in which a request failure is observed while tracking requests of the application;

building a causal graph using erroneous logs generated during the timeframe when the request failure is observed;

identifying real-time execution sequences during the timeframe of the request failure based on paths from a gateway node to a set of leaf nodes according to the causal graph;

establishing a set of frequent execution sub-sequences arising during normal operation of the application including communications with the plurality of resources, the establishing based on a log template time series dataset from normal execution logs; and

identifying a missing resource of the plurality of resources by analyzing a candidate execution sequence occurring during the timeframe with respect to a corresponding partially matching frequent execution sub-sequence of the set of frequent execution sub-sequences, the missing resource being present in the corresponding partially matching frequent execution sub-sequence and absent from the candidate execution sequence.

10. The computer program product of claim 9 , further causing the processor set to localize faults by:

collecting the normal execution logs from the application associated with the plurality of resources; and

generating the log template time series dataset from the normal execution logs.

11. The computer program product of claim 9 , wherein identifying the missing resource includes:

comparing the real-time execution sequences to the set of frequent sub-sequences arising during normal execution to identify the candidate execution sequence and the corresponding partially matching frequent execution sequence.

12. The computer program product of claim 9 , wherein the resources include microservices.

13. The computer program product of claim 9 , wherein the set of frequent sub-sequences are labeled individually with a corresponding type of execution flow.

14. A computer system for localizing faults, the computer system comprising:

a processor set; and

a computer readable storage medium having program instructions stored therein;

wherein:

the processor set executes the program instructions that cause the processor set to localize faults by:

monitoring, during runtime execution of an application, for an occurrence of a request failure by tracking requests of the application for a failure, the application communicating with a plurality of resources within a distributed computing system;

identifying a timeframe in which a request failure is observed while tracking requests of the application;

building a causal graph using erroneous logs generated during the timeframe when the request failure is observed;

identifying real-time execution sequences during the timeframe of the request failure based on paths from a gateway node to a set of leaf nodes according to the causal graph;

establishing a set of frequent execution sub-sequences arising during normal operation of the application including communications with the plurality of resources, the establishing based on a log template time series dataset from normal execution logs; and

identifying a missing resource of the plurality of resources by analyzing a candidate execution sequence occurring during the timeframe with respect to a corresponding partially matching frequent execution sub-sequence of the set of frequent execution sub-sequences, the missing resource being present in the corresponding partially matching frequent execution sub-sequence and absent from the candidate execution sequence.

15. The computer system of claim 14 , further causing the processor set to localize faults by:

collecting the normal execution logs from the application associated with the plurality of resources; and

generating the log template time series dataset from the normal execution logs.

16. The computer system of claim 14 , wherein identifying the missing resource includes:

comparing the real-time execution sequences to the set of frequent sub-sequences arising during normal execution to identify the candidate execution sequence and the corresponding partially matching frequent execution sequence.

17. The computer system of claim 14 , wherein the resources include microservices.

18. The computer system of claim 14 , wherein the set of frequent sub-sequences are labeled individually with a corresponding type of execution flow.

19. The computer system of claim 14 , wherein the missing resource is a faulty microservice.

20. A computer-implemented method comprising:

determining a request failure has occurred in a computing system by tracking requests of an application for a failure;

mining normal execution sequences collected during normal operation of the computing system;

generating a log-template timeseries dataset from the normal execution sequences;

identifying a set of frequently-arising sub-sequences based on the log-template timeseries dataset;

building a causal graph using erroneous logs generated in real time during the occurrence of the system fault;

selecting a candidate real-time sequence from the causal graph, the selected candidate real-time sequence partially matching a frequently-arising sub-sequence of the identified frequently-arising sub-sequences; and

identifying a missing resource in the candidate real-time sequence by comparing the partially matching frequently-arising sub-sequence to the candidate real-time sequence, the missing resource being present in the frequently-arising sub-sequence and absent from the candidate real-time sequence.

21. The method of claim 20 , further comprising:

individually labeling the set of frequently-arising sub-sequences based on corresponding types of execution flows represented by the each frequently-arising sub-sequence.

22. The method of claim 20 , wherein the step of mining normal execution sequences is performed automatically in response to determining a request failure.

23. The method of claim 20 , further comprising:

adding the missing resource to a localization set for system fault resolution.

Assignments (1)

Continuity (1)

References Cited (33)