Providing decision instructions for problem incidents
A method, computer program product, and computer system are described for providing decision instructions for problem incidents in information technology (IT) systems. The method includes categorizing incident instances as incident types, where an incident instance includes one or more events having resources identifying one or more hosts specific to the incident instance and wherein an incident type categorizes incident instances having a common underlying problem with the incident type having generalized resources. The method includes generating decision instructions for an incident type wherein the decision instructions provide generalized command steps for interacting with hosts for the resolution of incident instances of the incident type.
1 . A computer-implemented method for providing decision instructions for problem incidents in information technology (IT) systems, said method carried out by one or more processors of a computer system and comprising:
categorizing incident instances as incident types, wherein an incident instance includes one or more events having resources identifying one or more hosts specific to the incident instance and wherein an incident type categorizes incident instances having a common underlying problem with the incident type having generalized resources; and
generating decision instructions for an incident type wherein the decision instructions provide generalized command steps for interacting with hosts for resolution of incident instances of the incident type.
2 . The computer-implemented method of claim 1 , including:
resolving a current incident instance by determining a current position in the decision instructions of an incident type in which the current incident instance is categorized and progressing through the decision instructions.
3 . The computer-implemented method of claim 2 , wherein resolving a current incident instance includes converting a generalized resource in the incident type to one or more hosts specific to the incident instance identified from events in the current incident instance.
4 . The computer-implemented method of claim 1 , including:
converting the decision instructions for an incident type to a set of prompts in form of a conversation tree of an online messaging interface for user interaction with the decision instructions.
5 . The computer-implemented method of claim 1 , wherein categorizing incident instances as incident types is based on one or more of groups of: events within an incident instance; steps taken by an operator to resolve an incident instance; tickets raised against an incident instance; and teams and/or operators assigned to an incident instance.
6 . The computer-implemented method of claim 1 , including generating categories of incident types based on analysis of a set of resolved incident instance sessions with initially generalized commands and responses to and from one or more problem hosts.
7 . The computer-implemented method of claim 1 , including initially generalizing commands by parameterizing any matches between originating event attributes and command arguments.
8 . The computer-implemented method of claim 7 , wherein generating categories of incident types includes generalizing resources of an incident type by:
identifying common resource fields within events of a subset of incident instances of the incident type used to connect to one or more problem hosts; and
generalizing the common resource fields across a threshold of subset of resolved incident instances as contextual host information for the incident type.
9 . The computer-implemented method of claim 1 , wherein generating decision instructions for an incident type is based on analysis of a set of resolved incident instance sessions of the incident type with initially generalized commands and responses to and from one or more generalized resources.
10 . The computer-implemented method of claim 9 , including further generalizing commands and responses by building on the initial generalization with further generalization parameterizing any command arguments which appear in the responses from previous commands and correspond to each other.
11 . The computer-implemented method of claim 10 , wherein generating decision instructions for an incident type includes comparing commands to:
add common sub-sequences of complete commands to the instructions, with one node per command with an incoming directed connection to any previous commands;
add divergent sub-sequences of complete commands as conditional paths in the instructions based on tokenized parameters; and
process and add common sub-sequences of partial commands to the instructions.
12 . The computer-implemented method of claim 10 , including for each set of similar generalized commands, identify variation sources.
13 . The computer-implemented method of claim 1 , wherein the decision instructions are provided as a decision tree having generalized commands.
14 . A system for providing decision instructions for problem incidents in information technology (IT) systems, comprising:
a processor and a memory configured to provide computer program instructions to the processor to execute the computer program instructions, wherein steps of the computer program instructions further comprising function of the components:
categorizing incident instances as incident types, wherein an incident instance includes one or more events having resources identifying one or more hosts specific to the incident instance and wherein an incident type categorizes incident instances having a common underlying problem with the incident type having generalized resources; and
generating decision instructions for an incident type wherein the decision instructions provide generalized command steps for interacting with hosts for resolution of incident instances of the incident type;
an incident type categorizing component for categorizing incident instances as incident types, wherein an incident instance includes one or more events having resources identifying one or more hosts specific to the incident instance and wherein an incident type categorizes incident instances having a common underlying problem with the incident type having generalized resources; and
a decision instruction generating component for generating decision instructions for an incident type wherein the decision instructions provide generalized command steps for interacting with hosts for the resolution of incident instances of the incident type.
15 . The system of claim 14 , including:
a current incident resolving component for resolving a current incident instance by determining a current position in the decision instructions of an incident type in which the current incident instance is categorized and progressing through the decision instructions.
16 . The system of claim 15 , further comprising:
resolving a current incident instance by determining a current position in the decision instructions of an incident type in which the current incident instance is categorized and progressing through the decision instructions;
wherein the current incident resolving component includes a resource converting component for converting a generalized resource in the incident type to one or more hosts specific to the incident instance identified from events in the current incident instance.
17 . The system of claim 14 , including:
converting the decision instructions for an incident type to a set of prompts in form of a conversation tree of an online messaging interface for user interaction with the decision instructions;
a prompt conversion component for converting the decision instructions for an incident type to a set of prompts in the form of a conversation tree of an online messaging interface for user interaction with the decision instructions.
18 . A computer program product for providing decision instructions for problem incidents in information technology (IT) systems, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:
categorize incident instances as incident types, wherein an incident instance includes one or more events having resources identifying one or more hosts specific to the incident instance and wherein an incident type categorizes incident instances having a common underlying problem with the incident type having generalized resources; and
generate decision instructions for an incident type wherein the decision instructions provide generalized command steps for interacting with hosts for resolution of incident instances of the incident type.