US 12,130,699 B2
Using an event graph schema for root cause identification and event classification in system monitoring
Nigel Slinger, Los Gatos, CA (US); and Wenjie Zhu, Dublin (IE)
Assigned to BMC Software, Inc., Houston, TX (US)
Filed by BMC Software, Inc., Houston, TX (US)
Filed on May 1, 2023, as Appl. No. 18/310,288.
Application 18/310,288 is a continuation of application No. 17/444,102, filed on Jul. 30, 2021, granted, now 11,640,329.
Claims priority of provisional application 63/200,896, filed on Apr. 1, 2021.
Prior Publication US 2023/0267032 A1, Aug. 24, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 11/00 (2006.01); G06F 11/07 (2006.01); G06F 11/22 (2006.01); G06F 11/30 (2006.01); G06F 11/32 (2006.01); G06F 11/34 (2006.01); G06N 20/00 (2019.01)
CPC G06F 11/079 (2013.01) [G06F 11/0772 (2013.01); G06F 11/2263 (2013.01); G06F 11/3006 (2013.01); G06F 11/3075 (2013.01); G06F 11/327 (2013.01); G06F 11/3409 (2013.01); G06N 20/00 (2019.01)] 20 Claims
OG exemplary drawing
 
1. A computer program product, the computer program product being tangibly embodied on a non-transitory computer-readable storage medium and comprising instructions that, when executed by at least one computing device, are configured to cause the at least one computing device to:
determine an event graph schema for a technology landscape, the technology landscape being characterized by scores assigned to performance metrics for the technology landscape, wherein the event graph schema includes a plurality of nodes corresponding to the performance metrics and the scores, and includes directional edges connecting node pairs of the plurality of nodes, each directional edge having a score-dependent validity criterion defined by the scores of a corresponding node pair;
determine anomalous scores of the scores associated with an event within the technology landscape;
determine, from the anomalous scores, anomalous nodes;
generate an event graph instance of the event graph schema including instantiating valid edges from the directional edges, each valid edge connecting two of the anomalous nodes and satisfying the score-dependent validity criterion of the directional edges;
determine at least one path within the event graph instance that includes the valid edges and connected anomalous nodes;
traverse the at least one path to identify at least one of the connected anomalous nodes as a root cause node of the event;
store the scores in association with the event to obtain labelled training data;
train a machine learning model using the labelled training data and a supervised machine learning algorithm; and
predict a future event, based on the trained machine learning model and current values of the scores.