Diagnosing incidents for information technology service management

摘要

Diagnosing and detecting causes of an incident may comprise classifying the incident by keywords, searching for co-occurring and reoccurring group of incidents, summarizing commonalities in the group of incidents, correlating the group of incidents with causes, defining association rules between the commonalities, and predicting potential problems based on the correlated group of incidents with causes.

主权项

1. A method for diagnosing and detecting causes of an incident interactively, comprising:
classifying the incident by keywords by searching a problem ticket describing the incident for the keywords, the keywords comprising at least server name, application name, middleware and symptoms, wherein the incident is classified automatically by a processor according to the keywords occurring in the problem ticket based on the server name, the application name, the middleware and the symptoms in common with other tickets, the keywords assigned accuracy weights respectively based on a validity of the respective keyword and boosting weights respectively based on impact of the respective keyword; adding dependency keywords to the keywords, the dependency keywords representing dependent components among IT components involved in the problem ticket, wherein the dependency keywords are respectively given a boosting weight, wherein the respective default boosting weight is assigned to each keyword based on the impact of the keyword; searching for co-occurring and reoccurring group of incidents based on the keywords, the co-occurring and reoccurring group of incidents determined based on a similarity score determined as a function of the accuracy weights and the boosting weights associated with said keywords identified in the problem ticket and one or more of said keywords identified in an incident in the co-occurring and reoccurring group of incidents, the co-occurring group of incidents comprising incident tickets that occurred concurrently at different information technology (IT) components and the reoccurring group of incidents comprising incident tickets that repeat over time; summarizing commonalities in the group of incidents; correlating the group of incidents with causes; defining association rules between the commonalities; and predicting potential problems based on the correlated group of incidents with causes.