Granted Patent B2

US 12,406,026 · App. 17/363,147 · Granted Sep 2, 2025

Inventors: Yi Ming Wang (Xian, CN); Hui Dong (Xian, CN); Zhong Fang Yuan (Xian, CN); Tong Liu (Xian, CN); Yan Fen Liu (Tianjin, CN); Ling Chen (Beijing, CN)

Assignee: International Business Machines Corporation

G06F18/23213G06F16/1805G06F16/90332G06F16/906G06F18/214

Abstract

Claims (69)

1. A computer-implemented method comprising:

receiving a current log line of a log file indicative of a current log event reflecting a portion of processing performed by one or more computer(s) in an information technology (IT) system;

categorizing the current log event as belonging to a first event cluster of a plurality of event clusters with the first event cluster being a central processing unit (CPU) normal type cluster;

determining a probability value that the first event cluster will be followed by event(s) from a second event cluster of the plurality of event clusters, with the second event cluster being a CPU abnormal type cluster;

responsive to determining the probability value that the first event cluster will be followed by the event(s) from the second event cluster, determining that the probability value exceeds a first threshold;

responsive to determining that the probability value exceeds the first threshold, predicting, by machine logic, a predicted time of event transition from a time of the current log event until event(s) of the second event cluster are likely to occur;

responsive to predicting the predicted time of the event transition, determining that the predicted time of the event transition from the time of the current log event until event(s) of the second event cluster are likely to occur is below a second threshold; and

responsive to the determination that the probability value that the first event cluster will be followed by the event(s) from the second event cluster exceeds the first threshold and further responsive to the determination that the predicted time of the event transition is below the second threshold, communicating a warning that abnormal CPU operations are likely to occur so that countermeasures can be taken so that the CPU remains operational, wherein predicting the predicted time of the event transition comprises:

obtaining, by one or more processors, a probability of the event transition from the current event cluster to each of the plurality of event clusters to form a plurality of obtained event transitions;

determining, by the one or more processors, an obtained event transition having a highest probability from the plurality of obtained event transitions; and

in response to the obtained event transition having the highest probability being directed to at least one abnormal event cluster, calculating, by the one or more processors, a mean time of the obtained event transition having the highest probability in an operational history of the IT system as the predicted time.

2. The computer-implemented method of claim 1 , further comprising:

converting the current log line to a sentence vector:

determining relevance between the sentence vector and the plurality of event clusters; and

determining the current event cluster based on the relevance between the sentence vector and the plurality of event clusters.

3. The computer-implemented method of claim 2 , wherein the first event cluster is determined based on relevance between the sentence vector and the plurality of event clusters.

4. The computer-implemented method of claim 1 , wherein the warning comprises the probability value and the predicted time.

5. The computer-implemented method of claim 1 , further comprising:

in response to the obtained event transition having the highest probability not being directed to the at least one abnormal event cluster;

determining, by the one or more processors, a next event cluster from the plurality of event clusters for a next log line in the log file; and

predicting, by the one or more processors, a time of event transition from the next event cluster to the at least one abnormal event cluster.

6. The computer-implemented method of claim 1 , wherein the plurality of event clusters comprises CPU normal, CPU abnormal, memory normal, memory abnormal, disk normal, and disk abnormal.

7. A computer program product comprising program code executable by a processor to perform steps of:

receiving a current log line of a log file indicative of a current log event reflecting a portion of processing performed by one or more computer(s) in an information technology (IT) system;

categorizing the current log event as belonging to a first event cluster of a plurality of event clusters with the first event cluster being a disk normal type cluster;

determining a probability value that the first event cluster will be followed by event(s) from a second event cluster of the plurality of event clusters, with the second event cluster being a disk abnormal type cluster;

responsive to determining the probability value that the first event cluster will be followed by the event(s) from the second event cluster, determining that the probability value exceeds a first threshold;

responsive to determining that the probability value exceeds the first threshold, predicting, by machine logic, a predicted time of event transition from a time of the current log event until event(s) of the second event cluster are likely to occur;

responsive to predicting the predicted time of the event transition, determining that the predicted time of the event transition from the time of the current log event until event(s) of the second event cluster are likely to occur is below a second threshold; and

responsive to the determination that the probability value that the first event cluster will be followed by the event(s) from the second event cluster exceeds the first threshold and further responsive to the determination that the predicted time of the event transition is below the second threshold, communicating a warning that abnormal disk operations are likely to occur so that countermeasures can be taken so that the disk remains operational, wherein predicting the predicted time of the event transition comprises:

obtaining, by one or more processors, a probability of the event transition from the current event cluster to each of the plurality of event clusters to form a plurality of obtained event transitions;

determining, by the one or more processors, an obtained event transition having a highest probability from the plurality of obtained event transitions; and

in response to the obtained event transition having the highest probability being directed to at least one abnormal event cluster, calculating, by the one or more processors, a mean time of the obtained event transition having the highest probability in an operational history of the IT system as the predicted time.

8. The computer program product of claim 7 , further comprising:

converting the current log line to a sentence vector:

determining relevance between the sentence vector and the plurality of event clusters; and

determining the current event cluster based on the relevance between the sentence vector and the plurality of event clusters.

9. The computer program product of claim 8 , wherein the first event cluster is determined based on relevance between the sentence vector and the plurality of event clusters.

10. The computer program product of claim 7 , wherein the warning comprises the probability value and the predicted time.

11. The computer program product of claim 7 , further comprising:

in response to the obtained event transition having the highest probability not being directed to the at least one abnormal event cluster;

determining, by the one or more processors, a next event cluster from the plurality of event clusters for a next log line in the log file; and

predicting, by the one or more processors, a time of event transition from the next event cluster to the at least one abnormal event cluster.

12. The computer program product of claim 7 , wherein the plurality of event clusters comprises CPU normal, CPU abnormal, memory normal, memory abnormal, disk normal, and disk abnormal.

13. The computer program product of claim 7 , where each event cluster of the plurality of event clusters includes one or more log events.

14. A computer system comprising:

a processor coupled to a memory including instructions executable by the processor to perform steps of:

receiving a current log line of a log file indicative of a current log event reflecting a portion of processing performed by one or more computer(s) in an information technology (IT) system;

categorizing the current log event as belonging to a first event cluster of a plurality of event clusters with the first event cluster being a memory normal type cluster;

determining a probability value that the first event cluster will be followed by event(s) from a second event cluster of the plurality of event clusters, with the second event cluster being a memory abnormal type cluster;

responsive to determining the probability value that the first event cluster will be followed by the event(s) from the second event cluster, determining that the probability value exceeds a first threshold;

responsive to determining that the probability value exceeds the first threshold, predicting, by machine logic, a predicted time of event transition from a time of the current log event until event(s) of the second event cluster are likely to occur;

responsive to predicting the predicted time of the event transition, determining that the predicted time of the event transition from the time of the current log event until event(s) of the second event cluster are likely to occur is below a second threshold; and

responsive to the determination that the probability value that the first event cluster will be followed by the event(s) from the second event cluster exceeds the first threshold and further responsive to the determination that the predicted time of the event transition is below the second threshold, communicating a warning that abnormal memory operations are likely to occur so that countermeasures can be taken so that the memory remains operational, wherein predicting the predicted time of the event transition comprises:

obtaining, by one or more processors, a probability of the event transition from the current event cluster to each of the plurality of event clusters to form a plurality of obtained event transitions;

determining, by the one or more processors, an obtained event transition having a highest probability from the plurality of obtained event transitions; and

in response to the obtained event transition having the highest probability being directed to at least one abnormal event cluster, calculating, by the one or more processors, a mean time of the obtained event transition having the highest probability in an operational history of the IT system as the predicted time.

15. The computer system of claim 14 , further comprising:

converting the current log line to a sentence vector:

determining relevance between the sentence vector and the plurality of event clusters; and

determining the current event cluster based on the relevance between the sentence vector and the plurality of event clusters.

16. The computer system of claim 15 , wherein the first event cluster is determined based on relevance between the sentence vector and the plurality of event clusters.

17. The computer system of claim 14 , wherein the warning comprises the probability value and the predicted time.

18. The computer system of claim 14 , further comprising:

in response to the obtained event transition having the highest probability not being directed to the at least one abnormal event cluster;

determining, by the one or more processors, a next event cluster from the plurality of event clusters for a next log line in the log file; and

predicting, by the one or more processors, a time of event transition from the next event cluster to the at least one abnormal event cluster.

19. The computer system of claim 14 , wherein the plurality of event clusters comprises CPU normal, CPU abnormal, memory normal, memory abnormal, disk normal, and disk abnormal.

20. The computer system of claim 14 , where each event cluster of the plurality of event clusters includes one or more log events.

Assignments (1)

Continuity (1)

References Cited (44)