Abstract: Methods, systems, apparatus, and non-transitory computer readable media are described for detecting system outages using application event logs. Various aspects may include obtaining several application event logs where the status of the system is known at the time the application event logs were recorded. Additionally, various aspects may include determining characteristics of application event logs which were recorded during a system outage, and/or determining characteristics of application event logs which were recorded while the system was available. Based upon the characteristics, various aspects include training using various machine learning techniques. When current application event logs are obtained where the status of the system is unknown at the time the current application event logs are recorded, various aspects include using the training data to determine a likelihood that a system outage has occurred based upon the obtained current application event logs.

Abstract: A method, system, and/or computer program product handles a query generated by a user of one of multiple local network devices that are coupled to a network. Multiple system queries request states of the local network devices. Query statements, responsive to the system queries and being sent to a wide area network search engine, are intercepted. A natural language query, which is a logical query that is answered by one of the multiple query statements, is generated from one of the multiple query statements. An unstructured query, from a user, about a state of a particular device is received. The unstructured query from the user is compared with the natural language query in order to determine if a match between the query from the user with the natural language query exceeds a predetermined threshold value.

Abstract: A robust hardware fault management system, method and framework for providing robust hardware fault management for enterprise devices are disclosed. In one example, hardware devices and associated hardware modules in each of the enterprise devices requiring the robust hardware fault management are identified. Further, error structures associated with each hardware module are determined and unique identifiers are assigned to the determined error structures. Furthermore, the error structures are modeled in a centralized repository. In addition, rules are associated with each modeled error structure for detecting hardware failures. Moreover, the rules of each modeled error structure are stored in the centralized repository using associated rule identifiers.

Abstract: There are provided a data preprocessing device and a method thereof. A data preprocessing device according to an embodiment of the present disclosure includes a risk level analyzing unit configured to calculate a failure risk level of a target system using failure history information of the target system and characteristic information of the target system; a collection period setting unit configured to determine a data collection period from the target system according to the calculated failure risk level; and a preprocessing unit configured to preprocess data collected from the target system according to the data collection period.

Abstract: A hierarchical multi-stage model of asset failure risk for complex heterogeneously distributed physical assets is built. The hierarchical multi-stage model considers heterogeneity of failure patterns for the assets. At least one data stream is analyzed to determine whether the hierarchical multi-stage model needs to be updated due to a change in the failure patterns. If the analysis indicates that the hierarchical multi-stage model needs to be updated, the hierarchical multi-stage model is dynamically updated to obtain an updated hierarchical multi-stage model.

Abstract: A user administers web hosting on user's server from his computer remotely. When a run time error is generated, an error message is sent to a server connected to a knowledge database. If the error matches the known error form the knowledge database, the user is provided an article with a solution to the run-time error. Statistics of occurrence of the errors are saved in the knowledge database. The frequently occurring errors are provided to developers for creating hosting application updates. Additionally, security policies of the user's server can be updated based on the data from the knowledge database.

Abstract: An information processing apparatus capable of generating a partition including a plurality of units having hardware devices and the partition operating as an information processing unit by combining the units, the information processing apparatus comprising a processor executing a process that causes the information processing apparatus to perform selecting, upon occurrence of a fault in the partition, a unit as a processing target of a dump process of acquiring dump data from the units included in the partition with the occurrence of the fault, executing the dump process for the unit selected by the selecting and generating the partition by combining the units completing the execution of the dump process.

Abstract: Visual tools are provided for failure analysis in distributed systems. Errors from synthetic measurements and usage data associated with a cloud based service are aggregated by a management application. The errors are processed to create a distribution that segments the errors based on components of the cloud based service. A failed component that generates a subset of the errors associated with a failure is highlighted. The failed component is one of the components of the cloud based service. The distribution is provided in a visualization to identify the failure by emphasizing the failed component with a failure information in proximity to the failed component.

Abstract: A portable information device (PID) having a security module that conducts security-related functionality. At least some of the security-related functionality for the benefit of the PID is provided by a security team of at least one other PID. In one type of arrangement, when configured in a team processing mode, certain ones of the security functions or components operating for the benefit of the PID can be processed on one or more of the security team member devices. In another type of arrangement, the team of devices exchanges security-related information determined as a result of a single team member device's processing of one or more security-related tasks.

Abstract: A non-conformance analysis system may have an associative memory subsystem populated with information involving a plurality of entities defining different attributes of a component, with each entity being categorized under a user defined entity type, the entities and entity types forming an associative memory. A user input device may be used for enabling a user to input a query concerning the component, and to obtain information useful for managing a lifecycle of said component. An associative memory entity analytics engine in communication with the associative memory subsystem, and responsive to said user input device, searches the associative memory using the information provided in the query to retrieve entities helpful to the user in assessing the lifecycle of the component.

Abstract: Determining an impact of an event identified in a first topic map meta-model will have on at least one asset identified in a second topic map meta-model representative of weight. A third topic map meta-model is created which maps at least one asset from the second topic map meta-model to an event from the first topic map meta-model and is comprised of: a topic map representation of assets of the second topic map meta-model and events of the first topic map meta-model, a topic map based index with instance ontology of the first and second topic map meta-models, identification of at least one association between an event identified in the first topic map meta-model and at least one asset identified in the second topic map meta-model; and weight assigned to the at least one association.

Abstract: In one implementation, a computer-implemented method includes receiving information that describes an issue with a building; accessing data that identifies (i) a plurality of components that are included in the building and (ii) features of the plurality of components; identifying one or more candidate components that have at least a threshold likelihood of being a cause of the issue; selecting a candidate service provider from among a plurality of service providers based on a comparison of (i) the one or more candidate components and (ii) information identifying technical qualifications for the plurality of service providers; transmitting a service request for the issue to the candidate service provider; receiving a response from the candidate service provider; and scheduling, based on the response, a service appointment with the candidate service provider to resolve the issue.

Abstract: A method, system and computer program product for identifying lines of code that caused an error as identified in a stack trace in a source code version that generated the stack trace. The line(s) of code in the source code version that generated the stack trace that are identified in the stack trace as causing the error are identified. If there are differences in the line(s) of code that are associated with the cause of the error between the source code version that generated the stack trace and the source code version being utilized by the user, such as a developer, then an annotated version of the source code version that generated the stack trace of the line(s) of code that caused the error is displayed to the user with highlighted differences with respect to the source code version being utilized by the user.

Abstract: A fault detection apparatus includes a storage unit which stores correlation destruction set information which includes one or more correlations between different types of performance values among a plurality of types of performance values of a system, and a comparison unit which detects a set of common correlations between said one or more correlations included in said correlation destruction set information and one or more correlations on each of which a correlation destruction is detected for inputted performance values.

Abstract: The present subject matter relates to a computer implemented method and a computer system for optimizing execution of test cases. The method comprises calculating failure probability level of plurality of test cases based on plurality of test results associated to each of the plurality of test cases and determining dynamic risk profile level based on weights assigned to the failure probability level and risk impact parameter of the plurality of test cases. The method further comprises determining one or more set of optimal test cases to be executed based on the dynamic risk profile level of the plurality of test cases satisfying one or more test rule parameters. Upon determining, the method comprises identifying sequence of executing the one or more set of optimal test cases based on the one or more test sequence parameters and executing the one or more set of optimal test cases in the identified sequence.

Abstract: The present invention relates to antivirus protection and more particularly to antivirus protection in a cloud server. The present invention protects a user machine from a virus while allowing the user to get the benefit of using multiple antivirus options without the need to run the antivirus options on the user machine.

Abstract: In an example, network node failures may be predicted by extracting performance metrics for the network nodes from a plurality of data sources. A fail condition may be defined for the network nodes and input variables related to the fail condition for the network nodes may then be derived from the extracted performance metrics. A plurality of models may then be trained to predict the fail condition for the network nodes using a training set from the extracted performance metrics with at least one of the identified input variables. Each of the plurality of trained models may be validated using a validation set from the extracted performance metrics and may be rated according to predefined criteria. As a result, a highest rated model of the validated models may be selected to predict the fail condition for the network nodes.

Abstract: A method is provided for providing mobile device support services. The method may include monitoring a mobile device status. The method may additionally include performing device diagnostics based at least in part on captured deice status data to identify potential faults that may affect mobile device functionality. A corresponding system, apparatus, and computer program product are also provided.

Abstract: An apparatus includes a computer system programmed to retrieve information from a plurality of data sources; the computer system including a plurality of vault query services; an adapter for each of the data sources, each adapter translating an interface for one of the data sources to a vault query service interface; and a cross-vault query service providing an interface for data communication between an application program and the plurality of vault query services; and a user display for displaying the information retrieved from the data sources in response to a query from the application program.

Abstract: An expert system extracts events associated with executing an application from log files generated by various topological resources in a distributed computing environment. The events are plotted as plot points on a time series graph. Patterns are identified in the plot points that are associated with application problems, along with the computing environment configurations both before the problem and after the problem was resolved. The difference in the configurations represents a corrective action for the application problem, and the expert system links the corrective action to the pattern. When a pattern repeats in conjunction with another application problem, the corrective action is identified as a possible solution to the new problem. A confidence level associated with the pattern/corrective action may be increased when a user accepts the corrective action and may be decreased when a user rejects the corrective action.

Abstract: A system may be configured to receive performance information regarding a set of network devices; compare the performance information to a set of rule objects; and detect an occurrence of a particular network event. The detecting may include determining that the performance information, associated with a particular network device, of the set of network devices, meets the set of conditions associated with a particular rule object with which the particular network event is associated. The system may further present information regarding the particular rule object, such as information regarding the particular network event, and information regarding a recommendation regarding the particular network event.

Abstract: Systems and methods are provided for collecting application performance data. The system (100) includes a server (110) for hosting a server-side application (120). An instrumentation module (130) is included on the server. The instrumentation module can selectively instrument functions (125) of the server-side application to obtain instrumented function operation data. The instrumentation module can also maintain an instrumented function call stack (190) for each application thread. A sampling module (140) is included on the server. The sampling module can sample application threads of the server-side application to obtain sampled function operation data. The sampling module can sample application threads based on at least one of an age of a timestamp obtained through instrumentation and a determination of which threads are executing server requests based on emptiness of the stack.

Abstract: Dynamic service-event management methods to implement a dynamic service-event management system. Generally applicable in fields of utility, telecommunication and financial service providers. Therein, events has affect to status or quality of service projecting to service in two steps and using common-format events. In first step, external source originated events (11, 21, 24) are converted in network parser module(s) (1, 2) to a common event-format. In second step, the common format events (12, 22) are processed and their information projected to a service in a service parser module (3). The resulting common format service-event (31) and network events (13, 23) are stored by an alert parser module (4). The stored events are accessible for other connected systems through a database based application programming interface (41). Opening times are effectively handled using opening events (61). A bearer-to-beared object assignment can be handled in two ways.

Abstract: A system, method, and computer readable medium for statistical application-agnostic fault detection of multi-process applications. The computer readable medium includes computer-executable instructions for execution by a processing system. A multi-process application runs on a host. Interceptors collect statistical events and sends said events to a statistical fault detector. The statistical fault detector creates one or more distributions and compares recent statistical event data to historical statistical event data and uses deviation from historical norm for fault detection. The present invention detects faults both within the application and within the environment wherein the application executes, if conditions within the environment cause impaired application performance. The invention also teaches consensus fault detection and elimination of cascading fault notifications based on a hierarchy of events and event groups.

Abstract: Various exemplary embodiments relate to a method of determining the root cause of service degradation in a network, the method including determining a window of time; determining one or more abnormal Key Quality Indicators (KQIs) in the window; determining one or more abnormal Key Performance Indicators (KPIs) in the window; calculating a conditional probability that each of one or more KPIs is abnormal when a Key Quality Indicator (KQI) is normal; calculating a conditional probability that the each of one or more KPIs is abnormal when the KQI is abnormal; calculating a score for each KPI based upon a divergence of a Beta distribution for the conditional probability that each of one or more KPIs is abnormal when a KQI is normal and a Beta distribution for the conditional probability that the each of one or more KPIs is abnormal when the KQI is abnormal; and generating a representative root-cause list based upon the score for each KPI.

Abstract: Methods and apparatus to provide a cloud computing system having cross domain event correlation. In one embodiment, a first alert is received in a first domain of the system domains and a second alert in a second domain of the system domains, the first and second alerts caused by an event. A topology of the system is determined and connectivity matching is performed to identify connections between a port in the first domain and a port in the second domain. Identify matching, using unique identifiers for domain components, is performed to determine that a first component in the first domain associated with the first alert is the same component as a second component associated with the second alert in the second domain for cross domain event correlation.

Abstract: A method for controlling a computer-implemented application, the method including determining a current state of a computer-implemented application, inducing the application into a predefined state associated with a target action of the application if the current state does not match the predefined state in accordance with predefined match criteria, and causing the target action to be performed.

Abstract: A method and system for correlating, for at least one managed system, at least one monitored computer metric and a plurality of associated alerts, comprising selecting a monitored computer metric designated by a user, selecting a time scale designated by the user; and selecting a number of alerts associated with the monitored computer metric, the alert being designated by the user. The monitored computer metric and the number of alerts are correlated over the selected time period, and a graph of the correlated monitored computer metric superimposed with a number of alerts over the selected time period is transmitted for presentation to the user. The user can select various monitored computer metrics, various alerts and various time periods.

Abstract: Provided are a system and a method for self-healing in a critical system. The present invention monitors a current situation of the critical system, determines whether a system has an error by analyzing the monitoring result, judges whether to perform self-healing in a current state or drive safety software which provides a minimum basic service according to self-healing of the system error or not when the system error occurs, and evaluates self-healing performance after healing the system error. According to exemplary embodiments of the present invention, it is possible to continuously provide a software service and further improve the reliability of the self-healing system through the evaluation of the self-healing performance.

Abstract: In the invariant analysis, a fault cause is judged correctly. A correlation model storing unit (112) of an operation management apparatus (100) stores a correlation model including one or more correlation functions each of which indicates a correlation between two metrics different each other among a plurality of metrics in a system. The correlation destruction detecting unit (103) detects correlation destruction of the correlation which is included in the correlation model by applying newly inputted values of the plurality of metrics to the correlation model. The abnormality calculation unit (104) calculates and outputs a centrality degree which indicates a degree to which a first metric is estimated to be center of distribution of correlation destruction on the basis of a correlation destruction degree of one or more correlations between each of one or more second metrics having a correlation with the first metric and each of one or more metrics other than the first metric among the plurality of metrics.

Abstract: Methods and system for exception detecting and alerting are described. An exception indicating an occurrence of an error in an application and a path to the exception in an application space may be received. The received exception may be compared to a stored exception in a prior version of an exception data structure to determine whether the received exception is a new exception. The exception data structure may include a plurality of stored exceptions. The results of the comparison may be provided.

Abstract: A system analyzer and a method for analyzing an impact of a change in a component of a distributed control system (DCS) are disclosed. The system can collect and store data representing the DCS components and their interconnection as well as signals of the DCS components. The DCS can be graphically modeled with nodes and directed edges, wherein a node represents either a type of DCS component or a signal of a DCS components, and wherein an edge is an “influence”-edge, or a “contains”-edge. Information on a change of a DCS components is received, a depth first or breadth first search is performed over the “influence”-edges and “contains”-edges and determine unchanged DCS components which would be affected by a malfunction, a removal or a taking out of operation of the at least one DCS component, and information on the affected DCS components is transmitted to an operator interface.

Abstract: A method, system, and/or computer program product handles a query generated by a user of one of multiple local network devices that are coupled to a network. Multiple system queries are autonomously issued, by a computer that is coupled to the network, requesting states of the local network devices. Query statements, responsive to the system queries and being sent to a wide area network search engine, are intercepted. A natural language query, which is a logical query that is answered by one of the multiple query statements, is generated from one of the multiple query statements. An unstructured query, from a user, about a state of a particular device is received. The unstructured query from the user is compared with the natural language query in order to determine if a match between the query from the user with the natural language query exceeds a predetermined threshold value.

Abstract: Techniques for backing up replicated data are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for backing up replicated data comprising identifying replicated data on a primary node and a secondary node, and determining whether a backup is capable of being performed on the secondary node. In the event a backup is capable of being performed on the secondary node, the method may create a backup copy of the identified replicated data on the secondary node, and in the event a backup is not capable of being performed on the secondary node, the method may create a backup copy of the identified replicated data on the primary node.

Abstract: A method and a system of associating a runtime event with a component. The method includes catching the runtime event; catching the context of the current running environment and determining the current component based on said context; and getting the associating policy of current component and determining the responsible component associated with said runtime event based on said associating policy.

Abstract: A method for preventing the acquisition of data by a screen capturing malware, comprises preventing an unidentified process that does not open a window from performing screen capture.

Abstract: This disclosure presents systems and methods for run-time analysis of streams of log data for abnormalities using a statistical structure of meta-data associated with the log data. The systems and methods convert a log data stream into meta-data and perform statistical analysis in order to reveal a dominant statistical pattern within the meta-data. The meta-data is represented as a graph with nodes that represent each of the different event types, which are detected in the stream along with event sources associated with the events. The systems and methods use real-time analysis to compare a portion of a current log data stream collected in an operational window with historically collected meta-data represented by a graph in order to determine the degree of abnormality of the current log data stream collected in the operational window.

Abstract: A method and apparatus for determining correlation between input and output messages in a system under test (SUT) is provided in the present invention. The SUT is provided with preset watch-points, and the running of the SUT is detected by triggering watch-points in a test platform at its run time. The method includes the steps of: upon detecting a message input operation, finding a variable that stores an input message, associating the variable with a tag of the input message, and adding a watch-point for the variable in the test platform; as well as, upon detecting network output operation, finding a variable that stores an output message of the SUT; and determining correlation between the output message and an input message according to a tag associated with the variable that stores the output message.

Abstract: Novel tools and techniques that offer more robust solutions for application service management. Some such solutions provide a service management framework for managing a software application. In some cases, the framework can include multiple tools to detect and/or remedy application problems at a variety of different levels. In another aspect, some solutions can define multiple application lifecycle phases, ranging from minor impairment to catastrophic failure. For each of such phases, the service management framework can define one or more diagnostic criteria and/or one or more corrective actions that can be taken to remedy a suboptimal condition of the application.

Abstract: A technique for communicating in a network management system is disclosed. The technique includes transferring information from an application server to a gateway that processes the information, transferring the gateway processed information from the gateway to a plurality of adapters associated with the gateway that process the gateway processed information, and transferring the adapter processed information from one of the adapters to a client.

Abstract: The discussion relates to middlebox reliability. One example can apply event filters to a dataset of middlebox error reports to separate redundant middlebox error reports from a remainder of the middlebox error reports of the dataset. The example can categorize the remainder of the middlebox error reports of the dataset by middlebox device type. The example can also generate a graphical user interface that conveys past reliability and predicted future reliability for an individual model of an individual middlebox device type.

Abstract: Methods and arrangements for handling information technology tickets. A plurality of information technology tickets are received. The tickets are clustered into categories, and a problem area is identified with respect to at least one of the categories. At least one recommendation is automatically generated for addressing the problem area. Other variants and embodiments are broadly contemplated herein.

Abstract: An apparatus for performing remote debugging in a cloud system. The apparatus includes: a receiving unit that is configured to receive a remote debugging request during a remote debugging session; a determining unit configured to determine, according to an isolation level of the remote debugging request, a server node from a plurality of server nodes in the cloud system that is suitable for performing the remote debugging, wherein the isolation level of the remote debugging request comprises at least one of: an exclusive level and a sharing level; and a transmitting unit configured to forward the remote debugging request to the server node. The apparatus is a front-end component of a cloud system, such as a server node.

Abstract: A method for performing remote debugging in a cloud system comprises the steps of: receiving a remote debugging request during a remote debugging session; determining, according to an isolation level of the remote debugging request, a server node from a plurality of server nodes in the cloud system for performing the remote debugging, wherein the isolation level of the remote debugging request comprises at least one of: an exclusive level and a sharing level; and in response to determining the server node, forwarding the remote debugging request to the server node.

Abstract: A method, article of manufacture, and apparatus for identifying defects and resolutions is discussed. Computer systems may be grouped into clusters, and their health may be determined based on these groupings. System optimizations or defect solutions may be distributed to systems in unhealthy clusters, bringing them into a healthy cluster.

Abstract: Systems and methods for replication of test results in a network environment are disclosed. Methods described may include recording network traffic in a first instance of a test case by a network emulator node emplaced in the network environment, recording a time at which a connection open at the network emulator node completes a communication task, and deriving an order of task completion for each extant open connection thereby, and detecting the occurrence of one or more events, such as a packet drop, a packet retransmission, or a packet delay, among other events. Replication, as described, additionally involves recording the nature of the event and identification information associated with the packet to which the event is detected to have occurred; and associating the one or more events with each of the packets recorded, on the basis of the identification information and event recording.

Abstract: A method, article of manufacture, and apparatus for identifying and resolving defects in multiple clusters based on a reported defect instance is discussed. Computer systems may be grouped into clusters. A report of a defective system may be received, and the defective system's cluster may be identified. A defect solution may then be distributed to all the systems in that cluster.

Abstract: Disclosed are various embodiments for an error troubleshooting application. Error data is obtained from a client device. A correlated knowledge base is referenced to determine if a solution is associated with the error data. If a solution is associated with the error data, a notification embodying the solution is communicated to the client device. If a solution is not associated with the error data, a notification indicating the solution is unknown is communicated to the client device.

Abstract: In accordance with the present disclosure, a system and method are herein disclosed for providing in-service diagnostics based on health signatures of an information handling system. In one embodiment, the health of an information handling system is periodically probed by a software agent running as a service. The service polls a set of probes from interfaces on the host system and tracks parameters indicative of system and component health and performance. An analytics engine processes the data to identify anomalies and outliers, and to detect signatures that are precursors to potential service incidents. A rule set matches signatures to potential actions. Based on the detected signatures and rule sets, the service is operable to select, schedule, and execute one or more diagnostic tests. If an information handling system or component thereof fails a diagnostic test, the results are archived to persistent storage and communicated to an administrator.

Abstract: Disclosed is a system and method for extending the web application root cause determination functionality to a web browser. In one aspect, the present invention plots the network topology diagram for the web application by executing network trace commands. In another aspect, the present invention allows user to upload their web application network topology diagram. In another aspect, the present invention allows user to build their web application network topology diagram using UI Devices Toolkit. The present invention collects the information relating to the web application issue from various entities such as network infrastructure devices, servers through ICMP, SNMP, TRAP, SYS/APPLOG, HTTP and Network traffic analysis. In one aspect, the present invention highlights the entity in the web application network topology diagram based on the collected information and provides the experts recommended suggestion for the issue through Internet web search query.