Abstract: The invention relates to a computer implemented system that automates ATM deployment. The innovative system comprises a datacenter that communicates via a communication network to a first plurality of remote devices, via a remote server, and to a second plurality of remote devices. The centralized server comprises: a phone home tool that receives a remote request from a remote ATM device and transmits, in response to the remote request, configuration data to the remote ATM device to initiate an automated software build; a retail event management tool that provides a user interface that integrates multiple backend systems to control operating software migrations; an ATM management tool that preloads the remote ATM device with software and patch management data; and a software policy tool that that standardizes disparate ATM models and manages multiple components of an ATM software build.

Abstract: Methods and systems are directed to detecting and classifying changes in a distributed computing system. Divergence value are computed from distributions of different types of event messages generated in time intervals of a sliding time window. Each divergence value is a measure of change in types of events generated in each time interval. When a divergence value, or a rate of change in divergence values, exceeds a threshold, the time interval associated with the threshold violation is used to determine a change point in the operation of the distributed computing system. Based on the change point, a start time of the change is determined. The change is classified based on various previously classified change points in the disturbed computing system. A recommendation may be generated to address the change based on the classification of the change.

Abstract: Embodiments of the present disclosure provide a method and apparatus for classifying a failure. The method comprises obtaining a log associated with a failure and identifying a key event in the log, and the key event indicates a predetermined situation. The method further comprises determining a similarity between the failure and each of a set of historical failures based on the key event, and the set of historical failures have been classified into at least one category. The method further comprises classifying the failure based at least partly on the similarity. Embodiments of the present disclosure enable classifying the failure fast and accurately by determining the similarity associated with key event between failures.

Abstract: A method for aggregating relevant log statements from distributed components is provided. The method includes representing a plurality of error codes of an application as nodes in a graph, with each of the plurality of error codes connected to at least one other of the plurality of error codes by a causal relationship represented in the graph. The method includes determining causal relationships among a plurality of log statements from distributed components, based on correlating error codes in the plurality of log statements in accordance with causal relationship connections represented in the graph, and determining a subset of information from the plurality of log statements as one or more single composite events, each comprising a plurality of error codes, in causal relationship in accordance with the graph, based on the determining the causal relationships.

Abstract: Trace data is received that was captured for a execution of a first query on first input data. The trace data associates clauses of the first query with respective evaluation states that arise during the execution. Second input data is generated from the trace data without accessing the first input data. An execution of a second query is performed on the second input data, wherein performing the execution of the second query on the second input data reproduces evaluation states from the execution of the first query on the first input data.

Abstract: Mechanisms are provided to implement a brand personality perception gap assessment engine. The mechanisms receive an inferred brand personality for a specified brand. The mechanisms further receive an intended brand personality for the specified brand. The mechanisms calculate at least one gap between the inferred brand personality and the intended brand personality. The mechanisms output an output indicating aspects of the at least one gap.

Abstract: A mechanism is provided for managing a plurality of computing machines. An indication of a management activity having an applicability rule is deployed to a plurality of computing machines to cause each of the plurality of computing machines having corresponding values of one or more characteristics fulfilling the applicability rule to apply the management activity. Results are received indicating that the management activity has been applied successfully on corresponding success computing machines and that the management activity has not been applied on corresponding excluded computing machines. One or more candidate computing machines of the excluded computing machines is selected according to a comparison of the corresponding values of the further characteristics of the excluded computing machines with a success fingerprint.

Abstract: Aspects of systems and methods for providing an enhanced diagnostic and remediation system are discussed herein. The enhanced diagnostic and remediation system enables a user to monitor a computing system/framework for interruptions or other issues that impact the accessibility of the computing system/framework. When an interruption occurs at the monitored computing system/framework, the enhanced diagnostic and remediation system sends an alert communication to the user. In response, the user communicates with the enhanced diagnostic and remediation system to diagnose and remediate the interruption. Thus, the user is able to efficiently address the interruption that impacts accessibility of the computing system/framework.

Abstract: A system for clustering events includes an extraction engine configured to receive message data from managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information. The managed infrastructure is associated with produced events that relate to it. Those events are converted into words and subsets used to group the events that relate to failures or errors in the managed infrastructure, including the managed infrastructure physical and virtual hardware and software. A sigalizer engine and a compare and merge engine are included.

Abstract: A computer-implemented method for detecting compromised automated teller machines is provided. The method includes receiving activity data from an ATM, activity data including user input data and machine data, wherein user input data includes instructions input by a user at the ATM during a transaction, and wherein machine data is associated with processes performed by the ATM; storing operating parameter rules in the memory, the operating parameter rules configured to indicate whether the received activity data is within a normal activity range for the ATM; applying the received activity data to the operating parameter rules; generating an activity score for the ATM based on the applying, wherein the activity score is configured to indicate a likelihood that the ATM is compromised; and initiating a response based on the activity score.

Abstract: A method is provided for providing mobile device support services. The method may include monitoring a mobile device status. The method may additionally include performing device diagnostics based at least in part on captured device status data to identify potential faults that may affect mobile device functionality. A corresponding system, apparatus, and computer program product are also provided.

Abstract: Embodiments are directed towards automatically learning user behavioral patterns when interacting with messages and based on the learned patterns, suggesting one or more predicted actions that a user might take in response to receiving subsequent message. One or more classifiers are trained and employed to predict one or more actions that a user might take in response to receiving the message. In one embodiment, the one or more predicted actions are provided suggested to the user as an action the user might take on the message. Messages may be rank ordered within a given suggested action based on a confidence level of the prediction.

Abstract: Embodiments of the present invention provide systems, methods, and program products for automatic ranking of a technical software defect of a software service. Embodiments of the present invention can be used to collect technical environment parameters of a software service responsive to receiving a message associated with a technical software defect of the software service and determine a severity ranking value of the technical software defect based on a combined rating of the collected technical environment parameters wherein the technical environment parameters comprise at least a usage rate of the software service; a percentage of a number of users of the software-as-a-service environment authorized for using the software program; a log pattern of a signature of the technical software defect; and a percentage of a total functionality number of the software program, wherein the percentage defines a defect impact value.

Abstract: Techniques for providing a system wide manageability interface are provided. In one aspect, manageability data may be received from a plurality of manageability subsystems. Each manageability subsystem may be contained in a domain. The received manageability data may be coalesced into a system wide view. The system wide view may span all domains.

Abstract: Techniques are described for automatically and dynamically modifying ongoing operations of computing devices in device-specific manners, such as based on an automated identification of a computing device's status (e.g., identifying a likely ongoing or imminent failure of a smart phone or other computing device based on a series of observed hardware states of the computing device, and taking automated corrective actions to prevent or otherwise mitigate such device failure, such as by modifying configuration settings on the computing device or on associated systems). The techniques may include, for each of multiple device status outcomes of interest (e.g., device failure versus device non-failure), generating a state-space outcome model representing devices that reach that status outcome within a time period of interest, and using such outcome models to identify a likely ongoing or imminent outcome of a current device, with corresponding automated corrective actions then taken.

Abstract: Embodiments of the invention provide systems and methods for an eService ecosystem that provides a common trouble ticket platform for creating and handling trouble tickets generated by and received from an “Internet of Things (IoT).” More specifically, many product vendors are moving to make all of their products internet connected. This move includes not only products that are typically considered to be technology-type products such as personal computers, cellphones, media players, etc., but any and all types of products including but not limited to household appliances, automobiles, medical devices, and a variety of other devices which are increasingly available with processing and communications abilities. Embodiments of the present invention provide a common trouble ticket management platform that all Internet of Things vendors can use.

Abstract: A system is provided for clustering events. A first engine receives message data from a managed infrastructure that includes managed infrastructure physical hardware which supports the flow and processing of information. A second engine determines common characteristics of events and produces clusters of events relating to the failure of errors in the managed infrastructure. Membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information. Events are produced that relate to the managed infrastructure while converting the events into words and subsets used to group the events that relate to failures or errors in the managed infrastructure, including the managed infrastructure physical hardware. A situation room is provided with a collaborative interface (UI) for decomposing events from managed infrastructures.

Abstract: An application performance management system is provided, which is adapted to analyze the performance of one or more applications running on information technology (IT) infrastructure. The application performance management system includes a data collector, an anomaly detector, an anomaly correlator, an anomaly ranking unit, and a source problem detector. The data collector collects performance metrics for one or more applications running on the IT infrastructure. The anomaly detector analyzes the performance metrics and detects anomalies, which may include performance metrics whose values deviate from historic values with a deviation that exceeds a predefined threshold. The anomaly correlator detects dependencies between plural anomalies and generates anomaly clusters. Each anomaly cluster includes anomalies that are correlated through one or more of the dependencies. The anomaly ranking unit ranks anomalies within an anomaly cluster.

Abstract: Examples include sending and receiving recovery agents and recovery plans over networks. Some examples include receiving a recovery request over a network from a requestor, sending a response to the requestor over the network, sending an executable copy of a recovery agent with a validation measure to the requestor, establishing an encrypted connection with the requestor, receiving a second request from the requester over the encrypted connection, determining a recovery plan that includes a command executable by the recovery agent, and sending the recovery plan to the requester over the encrypted connection. In some examples, the recovery request includes data that identifies the requester and the response and the recovery plan are based on the data identifying the requester.

Abstract: A system and method for determining a false alarm includes receiving a provisional alarm signal from a safety alarm system, the provisional alarm signal indicating an alarm type. At least one sensor senses at least one present condition of a type corresponding to the alarm type indicated by the provisional alarm signal. A normal alarm signal is transmitted based on the at least one present condition sensed by the sensor.

Abstract: In one embodiment, a device in a network receives traffic metrics for a plurality of applications in the network. The device populates a feature space for a machine learning-based anomaly detector. The device identifies a missing dataset in the feature space for a particular one of the plurality of applications. The device adjusts how traffic is sent in the network, to capture the missing dataset.

Abstract: In the invariant analysis, a fault cause is judged correctly. A correlation model storing unit (112) of an operation management apparatus (100) stores a correlation model including one or more correlation functions each of which indicates a correlation between two metrics different each other among a plurality of metrics in a system. The correlation destruction detecting unit (103) detects correlation destruction of the correlation which is included in the correlation model by applying newly inputted values of the plurality of metrics to the correlation model. The abnormality calculation unit (104) calculates and outputs a centrality degree which indicates a degree to which a first metric is estimated to be center of distribution of correlation destruction on the basis of a correlation destruction degree of one or more correlations between each of one or more second metrics having a correlation with the first metric and each of one or more metrics other than the first metric among the plurality of metrics.

Abstract: Technologies are generally described to provide a passive monitoring system employing a logging schema to track usage data in order to analyze performance and reliability of a service. The logging schema may be configured to track user requests as each request is received and processed at individual subsystems of the collaborative service. A logging entry may be created at a data store of the service, where the logging entry includes a subsystem name, an operation performed by the subsystem to fulfill the request, and start and end times of the operation. The logging schema nay also detect errors fulfilling the requests, and may classify detected errors into a bucket, where each bucket denotes a failure scenario. Reliability of the service may be calculated based on analysis of the buckets to compute error rates. Reports may be generated to enable continuous monitoring of a performance and reliability of the system.

Abstract: Disclosed herein are system, method, and computer program product embodiments for performing distributed correlation to determine a probable cause for a performance problem detected in an application. An embodiment operates by triggering an alert for a performance metric of an application executing on a local-level node. The alert may be sent to a higher-level node. Upon receiving the alert, the higher-level node may send a distributed correlation request, used to determine a root cause of the alert, to the lower-level node. Upon receiving the distributed correlation request, the lower-level node may produce and send a correlation result to the higher-level node. Upon receiving the correlation result, the higher-level node may select the probable cause of triggering the alert based on the correlation result. The probable cause may then be presented to the user.

Abstract: Techniques for automatically or autonomously performing signal processing-based learning in a process plant are disclosed. Generally, said techniques automatically or autonomously perform signal processing on a real-time signal that is generated based on the process plant controlling a process. Typically, the signal corresponds to a parameter value that varies over time, and the signal is processed as it is generated in real-time during on-line plant operations. Results of the signal processing may indicate characteristics of the signal, and one or more analytics functions may determine the sources of the characteristics, which may include a process element or device, a piece of equipment, and/or an asset of the process plant that is upstream, within the process, of the source of the signal. An autonomous signal processor may be integrated with or included in a process control device and/or a big data node of the process plant.

Abstract: In one embodiment, a system includes a data navigation unit configured to navigate through a data structure stored in a first memory to a first representation of at least one rule. The system further includes at least one rule processing unit configured to a) receive the at least one rule based on the first representation of the at least one rule from a second memory to one of the rule processing unit, and b) processing a key using the at least one rule.

Abstract: A computerized method and system for conducting performance testing of a networked target system (NTS). The method comprises receiving at least one instruction and at least one parameter generated respective of a plurality of actions provided in a received test specification; testing the performance of the NTS using the at least one instruction and the at least one parameter; and gathering information respective of the performance testing of the NTS.

Abstract: A fault diagnosis method for a big-data network system includes extracting fault information from historical data in the network system, to form training sample data, which is trained to obtain a deep sum product network model that can be used to perform fault diagnosis; and diagnosing a fault of the network system based on the deep sum product network model. The embodiments of the present application resolve a problem that it is difficult to diagnose a fault of a big-data network system.

Abstract: An event management method of attributing a seasonal fault to maintenance activity is described. The method includes identifying a sequence of fault events as a seasonal fault, and calculating an initial seasonality metric indicating a degree of seasonality of the sequence of fault events. One or more maintenance windows are identified, and then a subset of the sequence of the fault events which correspond in time with the maintenance windows are identified. A compensated seasonality metric is calculated for the sequence of fault events minus at least some of the subset of fault events. Based on determining that the compensated seasonality metric indicates a reduction in seasonality compared with the initial seasonality metric, an indication that the sequence of fault events is associated with maintenance activities is generated.

Abstract: A method is presented to verify correctness of computer system software and hardware components. The method includes: operating a test environment with a verified system software and hardware version; monitoring and recording each hardware access during operation of the test environment with the verified system software and hardware version to generate a corresponding verified trace file; operating the test environment with a modified system software and/or hardware version; monitoring and recording each hardware access to generate a corresponding new trace file during operation of the test environment with the modified system software and/or hardware version; defining an arbitrary order for target chips in the verified and the modified hardware model or hardware system version; sorting sequences of entries in both trace files according to the target chip order; and comparing the sorted trace files by comparing their entries each by each and outputting a corresponding comparison result.

Abstract: A technology is described for processing a log message. An example method may include identifying a log template in a log statement associated with a computer program. Extracting the log template from the log statement and creating a log template file that includes a template identifier referencing the log template. The computer program and the log template file may be deployed to a server that hosts the computer program, and a log message output by the computer program executing on the server may include the template identifier and a log data value that is stored to a log data store.

Abstract: Methods, systems, apparatus, and non-transitory computer readable media are described for detecting system outages using application event logs. Various aspects may include obtaining several prior application event logs where the status of the system is known at the time the application event logs were recorded. Additionally, various aspects may include determining characteristics of prior application event logs which were recorded during a system outage, and/or determining characteristics of prior application event logs which were recorded while the system was available. When current application event logs are obtained where the status of the system is unknown at the time the current application event logs are recorded, various aspects include comparing the current application event logs to the prior application event logs to determine that a system outage has occurred based upon the comparison.

Abstract: Techniques for providing ancillary services to a power grid using customer premises such as commercial buildings. The techniques may involve receiving a regulation signal from a grid operator that is specific to a commercial building and modifying power consumption by at least one power consumption component in the building based on the regulation signal. The power consumption component may be a fan and/or a chiller of a Heating, Ventilation, and Air Conditioning (HVAC) system. The regulation signal may be tracked in a at least a portion of a frequency band from about 4 seconds to about 60 minutes, and the control architecture may depend on the portion of the frequency band.

Abstract: A remote network management platform may include a database containing representations of configuration items associated with a managed network that is managed by the remote network management platform. The remote network management platform may further include a server device. The server device may be configured to obtain a plurality of preferred relationships for a particular configuration item class. The server device may be further configured to store, in the database, the plurality of preferred relationships.

Abstract: Embodiments include methods, reconfiguration and verification systems, and computer program products automating manual reconfiguration and verification process. Aspects include manually configuring processing units (Pus) through LPAR partition's reconfiguration panel using a hardware management console, creating by an computer operating system an MSGLOG API to allow a test program (TP) to communicate with an automation system's automation program (AP), TP generating reconfiguration tests (RT) of PUs and transmitting RTs to AP while holding an MSGLOG API lock, and TP going to sleep for a predetermined time using a sleep timer to allow AP to perform tests, determining whether sleep timer is expired. When sleep timer is expired, print a sleep timer expiration error, and exit. Otherwise, TP obtains states of PUs under RTs, and determine whether results of RTs are correct. When results of RTs are not correct, test program prints reconfiguration test failure error messages, and exit.

Abstract: A method includes receiving an anomaly data point and comparing the anomaly data point to a magnitude bounding box to produce a first comparison. The method also includes comparing the anomaly data point to a principal component analysis (PCA) bounding box to produce a second comparison and classifying the anomaly data point in accordance with the first comparison and the second comparison to produce a classification.

Abstract: Method and system for performing close-loop analysis to electronic component failures are provided. The system establishes an electronic component fault tree of physics of failure (FTPF), converts the FTPF into a failure locating fault tree, establishes an electronic component fault dictionary with the cause of failure mechanism corresponding to failure characteristics, and performs close-loop analysis to the electronic component according to the fault tree and the fault dictionary.

Abstract: A system for performing failure signature recognition training for at least one unit of equipment. The system includes a memory and a processor coupled to the memory. The processor is configured by computer code to receive sensor data relating to the unit of equipment and to receive failure information relating to equipment failures. The processor is further configured to analyze the sensor data in view of the failure information in order to develop at least one learning agent for performing failure signature recognition with respect to the at least one unit of equipment.

Abstract: Methods that use marking, leveling and linking (“MLL”) processes to identify problems and dynamically correlate events recorded in various log files generated for a use-case of an application are described. The marking process determines fact objects associated with the use-case from events recorded in the various log files, database dumps, captured user actions, network traffic, and third-party component logs in order to identify non-predefined problems with running the application in a distributed computing environment. The MLL methods do not assume a predefined input format and may be used with any data structure and plain log files. The MLL methods present results in a use-case trace in a graphical user interface. The use-case trace enables human users to monitor and troubleshoot execution of the application. The use-case trace identifies the types of non-predefined problems that have occurred and points in time when the problems occurred.

Abstract: Method and system are provided for event relationship analysis in fault management. The method includes: providing a history of a plurality of event instances relating to multiple events identified by event identifiers, where an event instance has one or more event occurrences referencing an event identifier, the history including the event occurrences and resolution event information; analyzing the event occurrences relating to each event identifier to identify a first occurrence(s) of an event instance; analyzing the resolution event information relating to each event identifier to identify any event resolution time for an event instance; comparing two event identifiers to obtain a relationship score between the two event identifiers, wherein the comparing is based on a combination of first occurrences of event instances relating to the two event identifiers and resolution times of the event instances; and creating a group of events that are related based on the relationship scores.

Abstract: A method to build a failure predictive model includes: receiving an input of a set of event sequences, where each sequence is labeled as representing a failure or not representing a failure, extracting a single predictive closed pattern from among the input sequences that represents a failure, creating a root node with the single closed pattern, splitting the set of event sequences into a first set that includes the single closed pattern and a second set that excludes the single pattern, and processing each of the first and second sets until at least one child node is created that is labeled as either representing a failure or not representing a failure.

Abstract: A method of transparently inserting a virtual storage layer into a Fiber channel based storage area network (SAN) while maintaining continuous I/O operations is provided. A device is inserted between a host entity and a first storage device. The device identifies a plurality of first paths between the host entity and the first storage device, and defines a plurality of second paths by defining, for each first path among the plurality of first paths, a corresponding second path between the host entity and a second storage device. The device determines, for each of the plurality of first paths, a respective first state. The device establishes, for each of the second paths among the plurality of second paths, a second state based on the first state of the corresponding first path. The device redirects, to the second storage device, communications directed from the host entity to the first storage device, via the plurality of second paths.

Abstract: In one implementation, a computer-implemented method includes receiving information that describes an issue with a building; accessing data that identifies (i) a plurality of components that are included in the building and (ii) features of the plurality of components; identifying one or more candidate components that have at least a threshold likelihood of being a cause of the issue; selecting a candidate service provider from among a plurality of service providers based on a comparison of (i) the one or more candidate components and (ii) information identifying technical qualifications for the plurality of service providers; transmitting a service request for the issue to the candidate service provider; receiving a response from the candidate service provider; and scheduling, based on the response, a service appointment with the candidate service provider to resolve the issue.

Abstract: A system to monitor a composite system component may include a plurality of sensors mounted proximate to the composite system component. A signal processing unit may receive, from each of the plurality of sensors, a series of sensed values associated with the composite system component and determine a kurtosis value for each series of sensed values. A threshold exceedance detector may detect if at least one of the kurtosis values exceeds a pre-determined threshold value. A delamination location estimation unit may calculate an estimated location of a composite system component delamination alert signal based on calculated time difference delay values of detected signal impulses in the series of sensed values using at least four of the plurality of sensors. A delamination alert output may then transmit a composite system component delamination alert signal, along with the estimated location, when at least one of the kurtosis values exceeds the pre-determined threshold.

Abstract: Data from an application is analyzed periodically in real-time using a predictive data model to predict potential application failures. Application logs are used to build the predictive data model. The predictive data model includes features created from the application logs which are good predictors of application failures. The predictive data model analyzes and provides anomaly scores for various anomalies for the real-time data collected over a time period. The anomaly scores are compared with a threshold score to predict the probability of occurrences of application failures. If there is a higher probability of occurrence of an incident of application failure, corrective actions to mitigate or reduce the probability of occurrence of the application failure are implemented.

Abstract: In some embodiments, anomaly detection may be facilitated via a multi-neural-network architecture. In some embodiments, a first neural network may be configured to generate hidden representations of data items corresponding to a concept. A second neural network may be configured to generate reconstructions of the data items from the hidden representations. The first neural network may be configured to assess the reconstructions against the data items and update configurations of the first neural network based on the assessment of the reconstructions. Subsequent to the update of the first neural network, the first neural network may generate a hidden representation of a first data item from the first data item. The second neural network may generate a reconstruction of the first data item from the hidden representation. An anomaly in the first data item may be detected based on differences between the first data item and the reconstruction.

Abstract: Provided is a method of providing a fault management service in a cloud. During requisition of a cloud service involving a service element provided by the cloud it is determined whether solutions are available for potential faults related to the service element. The available solutions are highlighted for potential faults related to the service element to a user. Upon selection of a highlighted solution by the user, the selected solution is applied to the service element.

Abstract: A system, method, and computer readable medium for statistical application-agnostic fault detection of multi-process applications. The computer readable medium includes computer-executable instructions for execution by a processing system. A multi-process application runs on a host. Interceptors collect statistical events and sends said events to a statistical fault detector. The statistical fault detector creates one or more distributions and compares recent statistical event data to historical statistical event data and uses deviation from historical norm for fault detection. The present invention detects faults both within the application and within the environment wherein the application executes, if conditions within the environment cause impaired application performance. The invention also teaches consensus fault detection and elimination of cascading fault notifications based on a hierarchy of events and event groups.

Abstract: According to one method for mobile device service, with a user diagnostics application running on a user mobile device a user diagnostics screen is presented to a display of the user mobile device, diagnostics data is recorded from the user mobile device in response to input made at a customer care agent terminal, the user diagnostics screen of the diagnostics application is mirrored at the customer care agent terminal and the mirrored user diagnostics screen is populated with the diagnostics data. Mobile device graphics display data is excluded from transmission to the customer care agent terminal. A system for providing the mobile device service and an associated computer program product are also provided.

Abstract: A storage system comprises multiple storage apparatuses and the multiple storage apparatuses provide a host system with a virtual volume in which multiple logical volumes are virtualized into one. When a first storage apparatus has detected a first event, the first storage apparatus changes the status of a first resource. Thereafter, the first storage apparatus sends a notice of the status change with respect to a first logical volume to a second storage apparatus comprising a second logical volume which is the basis of a virtual volume associated with the first logical volume, when the first storage apparatus has detected a second event which signifies that the host system is informed, in the future, of the status of the first resource. The second storage apparatus receives the notice and configures the status change based on the received notice.