Abstract: Methods and systems for system failure diagnosis and correction include extracting syntactic patterns from a plurality of logs with heterogeneous formats. The syntactic patterns are clustered according to categories of system failure. A single semantically unique pattern is extracted for each category of system failure. The semantically unique patterns are matched to recent log information to detect a corresponding system failure. A corrective action us performed responsive to the detected system failure.

Abstract: Systems and methods for automatically generating failure signatures in a computer system for performing computer system fault diagnosis are provided. The method includes receiving log data, converting each log in the log data into a collection of log pattern sequences including one or more log pattern sequences corresponding to one or more respective failure categories associated with the computer system, generating a collection of seed patterns by computing a global set of patterns from the collection of log pattern sequences, and extracting the collection of seed patterns from the global set of patterns, generating a log pattern grammar representation for each of the one or more log pattern sequences, generating a failure signature for each of the one or more failure categories based on the log pattern grammar representation and the collection of seed patterns, and employing the failure signatures to perform computer system fault diagnosis on new log data.

Abstract: A method for discovering representative composite configuration item (CI) patterns in an IT system that includes a plurality of configuration items may include data mining a graph representing the IT system to extract extended frequent composite CI patterns. The method may also include clustering the extended frequent composite CI patterns into clusters based on similarity between the maximal frequent composite CI patterns. The method may further include extracting a representative composite CI pattern for each of the clusters, and using an output device, outputting the representative composite CI pattern for each of the clusters.

Abstract: Methods and systems for system failure diagnosis and correction include extracting syntactic patterns from a plurality of logs with heterogeneous formats. The syntactic patterns are clustered according to categories of system failure. A single semantically unique pattern is extracted for each category of system failure. The semantically unique patterns are matched to recent log information to detect a corresponding system failure. A corrective action us performed responsive to the detected system failure.

Abstract: Systems and methods for automatically generating failure signatures in a computer system for performing computer system fault diagnosis are provided. The method includes receiving log data, converting each log in the log data into a collection of log pattern sequences including one or more log pattern sequences corresponding to one or more respective failure categories associated with the computer system, generating a collection of seed patterns by computing a global set of patterns from the collection of log pattern sequences, and extracting the collection of seed patterns from the global set of patterns, generating a log pattern grammar representation for each of the one or more log pattern sequences, generating a failure signature for each of the one or more failure categories based on the log pattern grammar representation and the collection of seed patterns, and employing the failure signatures to perform computer system fault diagnosis on new log data.

Abstract: A mechanism is provided in a data processing system for extracting subgraphs from a multigraph with approximation. The mechanism receives a multigraph and a relevance function and a pattern generation component executing within the data processing system searches the multigraph for occurrences of at least one pattern based on an approximation function. A relevance computation component executing within the data processing system determines a relevance measure for the multigraph based on the relevance function and the occurrences of the at least one pattern. The mechanism provides output of relevant patterns based on the occurrences of the at least one pattern.

Abstract: Aspects of the present disclosure describe structural event detection from system log messages. More particularly disclosed are computer-implemented methods to mine structural events as directed workflow graphs where nodes of the graphs represent log patterns and edges represent relations among patterns. Advantageously, the structural events are inclusive and correspond to interpretable episodes in the system and methods according to the present disclosure directly model the overall quality of structural events. Through both qualitative and quantitative experiments on real-world datasets, the effectiveness of the disclosed methods are demonstrated.

Abstract: A mechanism is provided in a data processing system for extracting subgraphs from a multigraph with approximation. The mechanism receives a multigraph and a relevance function and a pattern generation component executing within the data processing system searches the multigraph for occurrences of at least one pattern based on an approximation function. A relevance computation component executing within the data processing system determines a relevance measure for the multigraph based on the relevance function and the occurrences of the at least one pattern. The mechanism provides output of relevant patterns based on the occurrences of the at least one pattern.

Abstract: A computer-implemented method provides an early warning of an impending failure in a monitored system. The method includes performing, by a processor, an offline model learning process that generates a model of expected log rates in the monitored system from historical log data. The model represents a normal behavior of the monitored system. The method further includes performing an online detection process that detects the impending failure in the monitored system prior to an actual occurrence thereof based on (i) the model of expected log rates and (ii) observed log rates. The method also includes displaying, by a display device based on (i) the model of expected log rates and (ii) observed log rates in the monitored system, information relating to the impending failure prior to the actual occurrence of the impending failure. The online detection process identifies short term and long term failures and long term failures.

Abstract: A mechanism is provided in a data processing system for extracting subgraphs from a multigraph with approximation. The mechanism receives a multigraph and a relevance function and a pattern generation component executing within the data processing system searches the multigraph for occurrences of at least one pattern based on an approximation function. A relevance computation component executing within the data processing system determines a relevance measure for the multigraph based on the relevance function and the occurrences of the at least one pattern. The mechanism provides output of relevant patterns based on the occurrences of the at least one pattern.

Abstract: A mechanism is provided in a data processing system for extracting subgraphs from a multigraph with approximation. The mechanism receives a multigraph and a relevance function and a pattern generation component executing within the data processing system searches the multigraph for occurrences of at least one pattern based on an approximation function. A relevance computation component executing within the data processing system determines a relevance measure for the multigraph based on the relevance function and the occurrences of the at least one pattern. The mechanism provides output of relevant patterns based on the occurrences of the at least one pattern.

Abstract: A method for discovering representative composite configuration item (CI) patterns in an IT system that includes a plurality of configuration items may include data mining a graph representing the IT system to extract extended frequent composite CI patterns. The method may also include clustering the extended frequent composite CI patterns into clusters based on similarity between the maximal frequent composite CI patterns. The method may further include extracting a representative composite CI pattern for each of the clusters, and using an output device, outputting the representative composite CI pattern for each of the clusters.