Management of computing system alerts

Abstract

An apparatus for grouping alerts generated by automated monitoring of at least an operating condition of a machine, represented as a configuration item in a configuration management database, in a computer network. A first event pattern is identified based on configuration items associated with an alert avalanche identified from received historical alert data stored in memory. A second event pattern is identified based on co-occurrences of configuration item pairs in the historical alert data and on at least one conditional probability parameter. At least one alert group is determined by comparing at least one configuration item associated with a current alert to the plurality of configuration items of the first event pattern and of the second event pattern stored in memory. A graphical display region for displaying the alert group is generated.

1 - 19 . (canceled) 
     
     
         20 . A method, comprising:
 dividing a historical alert dataset into subsets of alert data, wherein the historical alert dataset comprises alert data indicative of a plurality of types of alerts generated by a computing system;   determining a first amount of overlap in the historical alert dataset in which a first alert type and a second alert type both occur;   determining a total amount of the historical alert dataset in which the first alert type occurs; and   determining a pairwise probability based at least in part on a ratio between the first amount and the total amount;   identifying a relationship between the first alert type and the second alert type based at least in part on the pairwise probability being greater than a probability threshold; and   updating a visualization of the historical alert dataset to indicate the relationship.   
     
     
         21 . The method of  claim 20 , comprising:
 receiving data corresponding to an alert stream; and   using the relationship to group a subset of alerts from the alert stream in an alert group.   
     
     
         22 . The method of  claim 21 , comprising:
 maintaining a time window corresponding to a duration of time;   receiving a first alert comprising the first alert type at a time within the time window;   in response to receiving the first alert, determining to group the first alert in the alert group based at least in part on the relationship; and   receiving a second alert comprising the first alert type at a time after the time window; and   in response to receiving the second alert, not grouping the second alert into the alert group.   
     
     
         23 . The method of  claim 20 , comprising:
 determining an additional relationship when an amount of alerts comprising the first alert type, the second alert type, or both, is greater than an avalanche threshold;   receiving data corresponding to an alert stream; and   using the relationship and the additional relationship to group a subset of alerts from the alert stream into an alert group.   
     
     
         24 . The method of  claim 23 , comprising:
 determining the amount of alerts over a duration of time, wherein the duration of time is based at least in part on a product of a value associated with arrival times of consecutive historical alerts and a factor value.   
     
     
         25 . The method of  claim 23 , comprising:
 identifying a configuration item identifier and an alert pattern identifier for a first alert of the alert group, wherein the configuration item identifier is associated with the first alert, and wherein the alert pattern identifier is associated with the relationship, the additional relationship, or any combination thereof;   storing the configuration item identifier and the alert pattern identifier in a data table; and   updating the visualization of the historical alert dataset based at least in part on the data table.   
     
     
         26 . The method of  claim 20 , comprising:
 receiving data corresponding to an alert stream;   determining that the relationship matches a respective alert of the alert stream based at least in part on an alert type of the respective alert or a pattern of the respective alert matching that of the relationship;   in response to the relationship matching the respective alert of the alert stream, determining that a time window associated with the respective alert is active; and   in response to determining that the time window is active, adding the respective alert to an alert group corresponding to the relationship and the time window.   
     
     
         27 . The method of  claim 26 , comprising in response to determining that the time window is expired, finalizing the alert group without adding the respective alert. 
     
     
         28 . The method of  claim 20 , wherein identifying the relationship between the first alert type and the second alert type based at least in part on the pairwise probability being greater than the probability threshold comprises:
 setting the probability threshold to a first value to generate a first probability threshold;   identifying a first relationship using the first probability threshold;   setting the probability threshold to a second value to generate a second probability threshold, wherein the second value is greater than the first value;   identifying a second relationship using the second probability threshold; and   identifying the relationship between the first alert type and the second alert type to correspond to the second relationship.   
     
     
         29 . The method of  claim 28 , wherein identifying the first relationship using the first probability threshold comprises:
 filtering a plurality of pairwise probabilities associated with the first alert type, the second alert type, and a third alert type; and   using the first probably threshold to identify a relationship between the first alert type and the third alert type as the first relationship without identifying the relationship between the first alert type and the second alert type.   
     
     
         30 . A tangible, non-transitory, computer-readable medium having stored thereon program instructions that, upon execution by a computing device, cause the computing device to perform operations comprising:
 receiving a historical alert dataset comprising a plurality of indications of a plurality of alerts, wherein each indication of the plurality of indications corresponds to a configuration item and a timestamp;   dividing the historical alert dataset to form subsets of alert data having equal time windows;   determining an amount of co-occurrence of a first alert type and a second alert type over the historical alert dataset, wherein the amount of co-occurrence corresponds to a respective number of the subsets of alert data that respectively comprise the first alert type and the second alert type;   determining a total number of the subsets of alert data in which the first alert type occurs; and   determining a frequency parameter value based at least in part on the amount of co-occurrence and the total number of the subsets of alert data in which the first alert type occurs;   determining a relationship between the first alert type and the second alert type based at least in part on the frequency parameter value being greater than a frequency parameter threshold value; and   updating a visualization of the historical alert dataset to indicate the relationship.   
     
     
         31 . The tangible, non-transitory, computer-readable medium of  claim 30 , wherein the frequency parameter value is configured to indicate a likelihood of the first alert type being related to the second alert type. 
     
     
         32 . The tangible, non-transitory, computer-readable medium of  claim 30 , wherein the frequency parameter value is configured to indicate a likelihood of the first alert type being related to the second alert type. 
     
     
         33 . The tangible, non-transitory, computer-readable medium of  claim 30 , wherein the historical alert dataset is associated with a plurality of configuration items. 
     
     
         34 . The tangible, non-transitory, computer-readable medium of  claim 30 , comprising instructions that, upon execution by the computing device, cause the computing device to:
 identifying the first alert type as corresponding to a first configuration item;   identifying the second alert type as corresponding to a second configuration item; and   determining the relationship between the first configuration item and the second configuration item in response to determining the relationship between the first alert type and the second alert type.   
     
     
         35 . A system for grouping alerts generated by monitoring of a device in a computer network, the system comprising:
 a processor; and   a memory configured to store instructions executable by the processor that, when executed by the processor, cause the system to perform operations comprising:   identifying an event pattern within historical alert data independent of known dependency relationships between devices of the computer network, wherein the event pattern is based on a likelihood of a relationship between alert types of the historical alert data, and wherein the likelihood is determined based at least in part on a ratio of a total number of occurrences of a respective alert pair with respect to a total number of occurrences of a given alert of the respective alert pair; and   assigning a current alert to an alert group by matching the current alert to the event pattern; and   generating, via a presentation module, a graphical display region configured to present the alert group.   
     
     
         36 . The system of  claim 35 , wherein the instructions executable by the processor comprise additional instructions executable by the processor that, when executed by the processor, cause the system to perform operations comprising:
 prioritizing the alert group with respect to an additional alert group in a visualization rendered on a graphical user interface based at least in part on respective severities of alerts associated with the alert group.   
     
     
         37 . The system of  claim 35 , wherein the instructions executable by the processor comprise additional instructions executable by the processor that, when executed by the processor, cause the system to perform operations comprising:
 determining the event pattern based at least in part on an intersection of a first subset of the alerts identified in an avalanche of alerts with a second subset of the alerts identified based at least in part on the likelihood;   determining a plurality of time windows at least in part by dividing a duration of the historical alert data into fixed intervals equal to a fixed time window size; and   determining the likelihood of the respective alert pair based at least in part on identifying a number of time windows that the respective alert pair occurs within with respect to a total number of time windows that the given alert of the respective alert pair occurs within.   
     
     
         38 . The system of  claim 37 , wherein the instructions executable by the processor comprise additional instructions executable by the processor that, when executed by the processor, cause the system to perform operations comprising:
 identifying the avalanche of alerts at least in part by assigning a score to an additional intersection of a total number of alert intersections and of a total number of alerts in the avalanche of alerts.   
     
     
         39 . The system of  claim 38 , wherein the instructions executable by the processor comprise additional instructions executable by the processor that, when executed by the processor, cause the system to perform operations comprising:
 identifying the event pattern when the score of the additional intersection is greater than an avalanche pattern threshold parameter.