Abstract: An incident management system comprises a processor adapted for: receiving a plurality of logs each documenting at least one historical investigation instruction executed in the management system and each comprising a parameter range of the historical instruction and a presentation type of response data received in response to executing the historical instruction; and in each of a plurality of iterations: receiving from a GUI of the management system an incident report selected by a user from a plurality of incident reports presented therein; generating, based on the incident report and an analysis of the logs, a sequence of investigation instructions for generating part of the GUI depicting analysis data for cause-analysis of an incident documented by the incident report; and presenting the sequence of instructions in the GUI such that when the user selects one of the sequence of instructions, the selected instruction is executed by the processor.

Abstract: A computer implemented method of creating a clustering model used for clustering a plurality of log messages comprising using one or more processors for receiving a plurality of training log messages, performing the following for each of the plurality of training log messages: calculating a string distance between a textual content of the respective training log message and a representative string pattern of each of the plurality of clusters, associating the respective training log message with a respective one of the plurality of clusters in case the string distance is within a predefined threshold and adding a new cluster to the plurality of clusters for associating respective training log message in case the string distance exceeds the predefined threshold, and outputting the clustering model.

Abstract: An incident management system comprises a processor adapted for: receiving a plurality of logs each documenting at least one historical investigation instruction executed in the management system and each comprising a parameter range of the historical instruction and a presentation type of response data received in response to executing the historical instruction; and in each of a plurality of iterations: receiving from a GUI of the management system an incident report selected by a user from a plurality of incident reports presented therein; generating, based on the incident report and an analysis of the logs, a sequence of investigation instructions for generating part of the GUI depicting analysis data for cause-analysis of an incident documented by the incident report; and presenting the sequence of instructions in the GUI such that when the user selects one of the sequence of instructions, the selected instruction is executed by the processor.

Abstract: A system and methods for classification of events, the system including a memory, a network interface, and a processor configured to monitor system events via the network interface and store the system events as an event log in the memory, collect information about events from various web resources, extract, from the event log and the collected event information, labeling data including data about urgency of events and generate, based on the extracted labeling data, labeling data structures ascribing labels to respective events, extract, from the event log and the collected event information, event features data and generate, based on the extracted event features data, event features data structures ascribing features to respective events, and formulate decision rule structures for identification of urgent events based on the labeling data structures and the event features data structures.

Abstract: A computer implemented method of creating a clustering model used for clustering a plurality of log messages comprising using one or more processors for receiving a plurality of training log messages, performing the following for each of the plurality of training log messages: calculating a string distance between a textual content of the respective training log message and a representative string pattern of each of the plurality of clusters, associating the respective training log message with a respective one of the plurality of clusters in case the string distance is within a predefined threshold and adding a new cluster to the plurality of clusters for associating respective training log message in case the string distance exceeds the predefined threshold, and outputting the clustering model.

Abstract: A computer implemented method of creating a clustering model used for clustering a plurality of log messages comprising using one or more processors for receiving a plurality of training log messages, performing the following for each of the plurality of training log messages: calculating a string distance between a textual content of the respective training log message and a representative string pattern of each of the plurality of clusters, associating the respective training log message with a respective one of the plurality of clusters in case the string distance is within a predefined threshold and adding a new cluster to the plurality of clusters for associating respective training log message in case the string distance exceeds the predefined threshold, and outputting the clustering model.

Abstract: A computer implemented method of creating a clustering model used for clustering a plurality of log messages comprising using one or more processors for receiving a plurality of training log messages, performing the following for each of the plurality of training log messages: calculating a string distance between a textual content of the respective training log message and a representative string pattern of each of the plurality of clusters, associating the respective training log message with a respective one of the plurality of clusters in case the string distance is within a predefined threshold and adding a new cluster to the plurality of clusters for associating respective training log message in case the string distance exceeds the predefined threshold, and outputting the clustering model.

Abstract: A system and methods for classification of events, the system including a memory, a network interface, and a processor configured to monitor system events via the network interface and store the system events as an event log in the memory, collect information about events from various web resources, extract, from the event log and the collected event information, labeling data including data about urgency of events and generate, based on the extracted labeling data, labeling data structures ascribing labels to respective events, extract, from the event log and the collected event information, event features data and generate, based on the extracted event features data, event features data structures ascribing features to respective events, and formulate decision rule structures for identification of urgent events based on the labeling data structures and the event features data structures.

Abstract: A system and methods for classification of events, the system including a memory, a network interface, and a processor configured to monitor system events via the network interface and store the system events as an event log in the memory, collect information about events from various web resources, extract, from the event log and the collected event information, labeling data including data about urgency of events and generate, based on the extracted labeling data, labeling data structures ascribing labels to respective events, extract, from the event log and the collected event information, event features data and generate, based on the extracted event features data, event features data structures ascribing features to respective events, and formulate decision rule structures for identification of urgent events based on the labeling data structures and the event features data structures.

Abstract: A system and methods for classification of events, the system including a memory, a network interface, and a processor configured to monitor system events via the network interface and store the system events as an event log in the memory, collect information about events from various web resources, extract, from the event log and the collected event information, labeling data including data about urgency of events and generate, based on the extracted labeling data, labeling data structures ascribing labels to respective events, extract, from the event log and the collected event information, event features data and generate, based on the extracted event features data, event features data structures ascribing features to respective events, and formulate decision rule structures for identification of urgent events based on the labeling data structures and the event features data structures.