Guofei Jiang
ABSTRACT
The complexity of large computer systems has raised unprecedented challenges for system management. In practice, operators often collect large volume of monitoring data from system components and set up many rules to check data and trigger alerts. However, the alerts from various rules usually have different problem reporting accuracy because their thresholds are often manually set based on operators' experience and intuition. Meantime, due to system dependencies, a single problem may trigger many alerts at the same time in large systems and the critical question is which alert should be analyzed first in the following problem determination process. In this paper, we propose a novel peer review mechanism to rank the importance of alerts and the top ranked alerts are more likely to be true positives. After comparing a metric value against its threshold to generate alerts, we also compare the value with the equivalent thresholds from many other rules to determine the importance of alerts. Our approach is evaluated with a real test bed system and experimental results are also included to demonstrate its effectiveness.
- M. Aguilera, J. Mogul, J. Wiener, P. Reynolds, and A. Muthitacharoen. Performance debugging for distributed systems of black boxes. In Proceedings of ACM SOSP, pages 74--89, NY, 2003 Google Scholar
Digital Library
- blog.wired.com/business/2008/02/customers-shrug.html.Google Scholar
- money.cnn.com/2007/04/18/technology/rimm/.Google Scholar
- M. Chen, A. Accardi, E. Kiciman, J. Lloyd, D. Patterson, A. Fox, and E. Brewer. Path-based failure and evolution management. In Proceedings of USENIX NSDI, pages 309--322, San Francisco, CA, 2004. Google ScholarDigital Library
- I. Cohen, S. Zhang, M. Goldszmidt, J. Symons, T. Kelly, and A. Fox. Capturing, indexing, clustering, and retrieving system history. SIGOPS Oper. Syst. Rev., 39(5):105--118, 2005. Google ScholarDigital Library
- B. Gruschke. Integrated event management: event correlation using dependency graphs. In Proceedings of the 9th IFIP/IEEE DSOM, Newark, NJ, 1998.Google Scholar
- Z. Guo, G. Jiang, H. Chen, and K. Yoshihira. Tracking probabilistic correlation of monitoring data for fault detection in complex systems. In Proceedings of 2006 DSN, pages 259--268, 2006. Google ScholarDigital Library
- www.jboss.com/.Google Scholar
- G. Jiang, H. Chen, and K. Yoshihira. Discovering likely invariants of distributed transaction systems for autonomic system management. In Proceedings of the 3rd ICAC, pages 199--208, Dublin, Ireland, 2006. Google ScholarDigital Library
- G. Jiang, H. Chen, and K. Yoshihira. Modeling and tracking of transaction ow dynamics for fault detection in complex systems. IEEE Trans. Dependable Sec. Comput., 3(4):312--326, 2006. Google ScholarDigital Library
- G. Jiang, H. Chen, and K. Yoshihira. Efficient and scalable algorithms for inferring likely invariants in distributed systems. IEEE Trans. on Knowledge and Data Engineering, 19(11):1508--1523, 2007. Google ScholarDigital Library
- L. Ljung. System Identification - Theory for The User. Prentice Hall PTR, second edition, 1998. Google ScholarDigital Library
- C. Mas and J.-Y. L. Boudec. An alarm filtering algorithm for optical communication networks. In Chapter 18, Management of Multimedia Networks and Services. Springer, 1998. Google ScholarDigital Library
- www.novell.com/coolsolutions/appnote/16897.html.Google Scholar
- D. Oppenheimer, A. Ganapathi, and D. Patterson. Why do internet services fail, and what can be done about it. In Proceedings of of the 4th USITS, pages 1--16, Seattle, WA, 2003. Google ScholarDigital Library
- J. Parekh, G. Jung, G. Swint, C. Pu, and A. Sahai. Comparison of performance analysis approaches for bottleneck detection in multi-tier enterprise applications. In Proceedings of IEEE IWQoS, pages 302--306, CT, 2006.Google Scholar
- D. Patterson. A simple way to estimate the cost of downtime. In Proceedings of LISA-2002, pages 185--188, Philadelphia, PA, 2002. Google ScholarDigital Library
- java.sun.com/developer/releases/petstore/.Google Scholar
- www.vmware.com/support/vc11/doc/c15alarms.html.Google Scholar
- A. Yemini and S. Kliger. High speed and robust event correlation. IEEE Communication Magazine, 34(5):82--90, May 1996. Google ScholarDigital Library
Index Terms
- Ranking the importance of alerts for problem determination in large computer systems
Recommendations
Collaborative Alert Ranking for Anomaly Detection
CIKM '18: Proceedings of the 27th ACM International Conference on Information and Knowledge ManagementGiven a large number of low-quality heterogeneous categorical alerts collected from an anomaly detection system, how to characterize the complex relationships between different alerts and deliver trustworthy rankings to end users? While existing ...
Ranking the importance of alerts for problem determination in large computer systems
The complexity of large computer systems has raised unprecedented challenges for system management. In practice, operators often collect large volume of monitoring data from system components and set up many rules to check data and trigger alerts. ...
Selective and Early Threat Detection in Large Networked Systems
CIT '10: Proceedings of the 2010 10th IEEE International Conference on Computer and Information TechnologyThe complexity of modern networked information systems, as well as all the defense-in-depth best practices, require distributed intrusion detection architectures relying on the cooperation of multiple components. Similar solutions cause a multiplication ...
Comments