Performing root cause analysis for information technology incident management using cognitive computing

Methods and systems for performing root cause analysis for information technology incident management using cognitive computing are disclosed. A method includes: generating, by a computing device, a cache including a plurality of links between causes and solutions; obtaining, by the computing device, information about a current incident; generating, by the computing device, search keys from the information about the current incident using natural language processing; searching, by the computing device, the cache using the search keys; iteratively generating, by the computing device, new search keys using results from a previous search and searching the cache using the new search keys; and displaying, by the computing device, solutions based on results from the searching and the iteratively generating and searching.

BACKGROUND

The present invention generally relates to computing devices and, more particularly, to methods and systems for performing root cause analysis for information technology incident management using cognitive computing.

Monitored information technology (IT) environments with automation processes are used to reduce the risks of impacts caused by IT outages and improve speed, control, and agility in incident response. Monitoring systems usually respond to a symptom by opening a ticket for an incident. Each ticket that is opened must be addressed in a short period of time to avoid degradation or disruption of services.

Some incidents can be addressed with automated solutions, without requiring human intervention. Human intervention is required to address other incidents. If an incident is not automatically addressed, more time is typically required to solve the incident, because an analyst/specialist must be assigned and determine the problem. The analyst/specialist typically spends time researching previous incidents to determine the problem and identify a solution. Once the incident is solved, the ticket is closed and the root cause for the incident is described and stored in a database for future analysis or reference.

SUMMARY

In a first aspect of the invention, there is a method that includes: generating, by a computing device, a cache including a plurality of links between causes and solutions; obtaining, by the computing device, information about a current incident; generating, by the computing device, search keys from the information about the current incident using natural language processing; searching, by the computing device, the cache using the search keys; iteratively generating, by the computing device, new search keys using results from a previous search and searching the cache using the new search keys; and displaying, by the computing device, solutions based on results from the searching and the iteratively generating and searching.

In another aspect of the invention, there is a computer program product that includes a computer readable storage medium having program instructions embodied therewith. The program instructions are executable by a computing device to cause the computing device to: obtain information about a current incident; generate search keys from the information about the current incident using natural language processing; search a cache using the search keys; over four iterations, generate new search keys using results from a previous search and search the cache using the new search keys; and display solutions based on results from the searching and the iteratively generating and searching.

In another aspect of the invention, there is a system that includes: a hardware processor, a computer readable memory, and a computer readable storage medium associated with a computing device; program instructions configured to generate a cache including a plurality of links between causes and solutions; program instructions configured to obtain information about a current incident; program instructions configured to generate search keys from the information about the current incident using natural language processing; program instructions configured to search the cache using the search keys; program instructions configured to iteratively generate new search keys using results from a previous search and search the cache using the new search keys; and program instructions configured to display solutions based on results from the searching and the iteratively generating and searching, wherein the program instructions are stored on the computer readable storage medium for execution by the hardware processor via the computer readable memory.

DETAILED DESCRIPTION

The present invention generally relates to computing devices and, more particularly, to methods and systems for performing root cause analysis for information technology incident management using cognitive computing. As described herein, aspects of the invention include a method and system that generate a cache of causes and solutions, receive information about a current incident, search the cache to determine a set of possible solutions, rank each of the solutions in the set, and display the ranked solutions.

In conventional practice, in response to an IT incident, analysts/specialists often spend time trying to answer questions such as, “How can I fix this to prevent the same issue from happening in the future?” or “How has this issue been fixed in the past?” Analysts/specialists typically search for solutions by asking peers for information or looking at reports describing previous incidents (e.g., issues that occurred a single time), problems (e.g., issues that occurred multiple times), and known issues (e.g., issues that are documented by a software provider or other party). This may consume valuable time, and the customer business may be impacted during this time before the incident is solved.

In embodiments, the 5-Whys root cause analysis technique is used to automatically determine causes and solutions for an incident, reducing the time required to resolve the incident. In particular, in response to an incident, natural language processing is used to search for causes and solutions in a cache that integrates information from incident databases, problem databases, knowledge management databases, and other trusted resources. Five levels of analysis are used to limit a search for solutions and avoid search loops.

In embodiments, a system and method are provided that autonomously perform the 5-Whys technique to perform root cause analysis of IT incidents. Cognitive technologies are used to analyze previous incidents and pre-index them in a cache. The cache is generated in a learning phase, during which multiple available databases are analyzed using natural language processing. In particular, natural language processing is used to analyze incident databases, problem databases, and knowledge management databases and generate a cache cause dataset and a cache solution dataset. These datasets function as a cache to speed up the search for causes and solutions.

In embodiments, after the initial learning phase, when an incident occurs, the system uses natural language processing to generate keys associated with the incident and searches the cache database to identify matching cause keys. The search results may include one or more cause keys, each having one or more associated solution keys representing possible solutions associated with the cause. This search is repeated four more times. In each subsequent search, each of the cause keys included in the results of the previous search is used to search the cache databases. Each subsequent search may return cause keys and associated solution keys that represent new solutions and/or the same solutions as were returned in one or more of the previous searches. The system stores and ranks each possible solution, based on a level of correlation with the cause being analyzed. The possible solutions with the highest ranks are then presented, via a user interface of an incident management tool, as the output of the system. Additionally, in embodiments, in order to improve the data that is stored in cache, the incident databases, problem databases, and knowledge management databases are periodically reanalyzed in order to identify new incidents and problems and add them to the cache databases.

Embodiments improve the functioning of a computer by providing methods and systems for performing root cause analysis for information technology incident management using cognitive computing. In particular, embodiments improve software by providing an improved mechanism for generating a cache of causes and solutions, receiving information about a current incident, searching the cache to determine a set of possible solutions, ranking each of the solutions in the set, and displaying the ranked solutions. These software improvements related to performing root cause analysis for information technology incident management using cognitive computing provide for automatically determining causes and solutions for an incident, reducing the time required to resolve the incident. Embodiments generate new data in the form of a cache and utilize this new data in performing the steps of the embodiments. Additionally, implementations of the invention use techniques that are, by definition, rooted in computer technology (e.g., cognitive computing and natural language processing). For example, natural language processing includes using computers to process, understand, and interpret human languages.

Referring now toFIG. 1, a schematic of an example of a computing infrastructure is shown. Computing infrastructure10is only one example of a suitable computing infrastructure and is not intended to suggest any limitation as to the scope of use or functionality of embodiments of the invention described herein. Regardless, computing infrastructure10is capable of being implemented and/or performing any of the functionality set forth hereinabove.

FIG. 2depicts an illustrative environment200in accordance with aspects of the invention. As shown, the environment200comprises a computer server210, external data servers230-1,230-2,230-3,230-4, . . . ,230-n, and a user computing device240which are in communication via a computer network260. In embodiments, the computer network260is any suitable network including any combination of a LAN, WAN, or the Internet. In embodiments, the computer server210, the external data servers230-1,230-2,230-3,230-4, . . . ,230-n, and the user computing device240are physically collocated, or, more typically, are situated in separate physical locations.

The quantity of devices and/or networks in the environment200is not limited to what is shown inFIG. 2. In practice, the environment200may include additional devices and/or networks; fewer devices and/or networks; different devices and/or networks; or differently arranged devices and/or networks than illustrated inFIG. 2. Also, in some implementations, one or more of the devices of the environment200may perform one or more functions described as being performed by another one or more of the devices of the environment200.

In embodiments, the computer server210is a computer device comprising one or more elements of the computer system/server12(as shown inFIG. 1). In particular, the computer server210is implemented as hardware and/or software using components such as mainframes; RISC (Reduced Instruction Set Computer) architecture based servers; servers; blade servers; storage devices; networks and networking components; virtual servers; virtual storage; virtual networks, including virtual private networks; virtual applications and operating systems; and virtual clients.

In embodiments, the computer server210includes an incident management program module220, which includes hardware and/or software and is one or more of the program modules42shown inFIG. 1. According to an embodiment, the incident management program module220includes program instructions for performing root cause analysis for information technology incident management using cognitive computing. In embodiments, the program instructions included in the incident management program module220of the computer server210are executed by one or more hardware processors. In embodiments, the computer server210also stores a cache database225.

Still referring toFIG. 2, in embodiments, the external data servers230-1,230-2,230-3,230-4, . . . ,230-nare computer devices comprising one or more elements of the computer system/server12(as shown inFIG. 1). In particular, the external data servers230-1,230-2,230-3,230-4, . . . ,230-nare implemented as hardware and/or software using components such as mainframes; RISC (Reduced Instruction Set Computer) architecture based servers; servers; blade servers; storage devices; networks and networking components; virtual servers; virtual storage; virtual networks, including virtual private networks; virtual applications and operating systems; and virtual clients. In embodiments, the external data server 1230-1stores an incident database231, the external data server 2230-2stores a problem database232, the external data server 3230-3stores a known issue database233, and the external data server 4230-4stores a trusted IT website database234.

In embodiments, the incident database231stores information about IT incidents, including, for each incident, a description of a cause of the incident, a description of a solution used to resolve the incident, and services, devices, and/or applications associated with the incident. In embodiments, the problem database232stores information about IT problems obtained from root cause analysis for each of the problems, including, for each problem, a description of a cause of the problem, a number of occurrences of the problem, a description of one or more solutions used to resolve the problem, and services, devices, and/or applications associated with the problem. In embodiments, the known issue database233stores information about IT known issues (e.g., provided by a hardware/software company), including, for each known issue, a description of a cause of the known issue, a description of one or more solutions used to resolve the known issue, and services, devices, and/or applications associated with the known issue. In embodiments, the trusted IT website database234is associated with a trusted IT website and provides information about IT problems including, for each problem, a description of a cause of the problem, a description of one or more solutions used to resolve the problem, and services, devices, and/or applications associated with the problem.

Still referring toFIG. 2, in embodiments, the user computing device240is a computer device comprising one or more elements of the computer system/server12(as shown inFIG. 1) and is a desktop computer, a laptop computer, a mobile device such as a cellular phone, tablet, personal digital assistant (PDA), or other computing device. In other embodiments, the user computing device240is implemented as hardware and/or software using components such as mainframes; RISC (Reduced Instruction Set Computer) architecture based servers; servers; blade servers; storage devices; networks and networking components; virtual servers; virtual storage; virtual networks, including virtual private networks; virtual applications and operating systems; and virtual clients.

In embodiments, the user computing device240includes an incident management user interface program module250, which includes hardware and/or software and is one or more of the program modules42shown inFIG. 1. According to an embodiment, the incident management user interface program module250includes program instructions for displaying one or more possible solutions for an IT incident that are received from the incident management program module220of the computer server210. In embodiments, the program instructions included in the incident management user interface program module250of the user computing device240are executed by one or more hardware processors.

FIG. 3depicts a flowchart of an exemplary method performed by the incident management program module220of the computer server210as a caching or pre-indexing process in accordance with aspects of the invention. The steps of the method are performed in the environment ofFIG. 2and are described with reference to the elements shown inFIG. 2.

At step300, the computer server210collects information about incidents, problems, and known issues from a set of sources. In embodiments, the incident management program module220requests and receives information about incidents from the external data server 1230-1(ofFIG. 2), requests and receives information about problems from the external data server 2230-2and the external data server 4230-4(ofFIG. 2), and requests and receives information about known issues from the external data server 3230-3(ofFIG. 2).

In particular, the incident management program module220receives from the incident database231of the external data server 1230-1, for each incident stored therein, a description of a cause of the incident, a description of a solution used to resolve the incident, and services, devices, and/or applications associated with the incident. The incident management program module220receives from the problem database232of the external data server 2230-2, for each problem stored therein, a description of a cause of the problem, a number of occurrences of the problem, a description of one or more solutions used to resolve the problem, and services, devices, and/or applications associated with the problem. The incident management program module220receives from the known issue database233of the external data server 3230-3, for each known issue stored therein, a description of a cause of the known issue, a description of one or more solutions used to resolve the known issue, and services, devices, and/or applications associated with the known issue. The incident management program module220receives from the trusted IT website database234of the external data server 4230-4, for each problem stored therein, a description of a cause of the problem, a description of one or more solutions used to resolve the problem, and services, devices, and/or applications associated with the problem.

At step310, the computer server210generates, for each incident, problem, and known issue, a set of keys using natural language processing, including cause keys and solution keys. In embodiments, the incident management program module220uses natural language processing to interpret the information collected at step300and step360(described herein). In particular, for each incident, problem, and known issue collected at step300, or for each new incident, new problem, and new known issue collected at step360, the incident management program module220applies natural language processing to the description of the cause to generate one or more cause keys that describe the cause of the incident, problem, or known issue. Additionally, for each incident, problem, and known issue collected at step300, or for each new incident, new problem, and new known issue collected at step360, the incident management program module220applies natural language processing to the description of the resolution to generate one or more solution keys that describe the solution to the incident, problem, or known issue.

In an example, for a problem of “XYZ application stopped,” the incident management program module220generates, from a description of the cause of the problem, a “file system full” cause key. Additionally, the incident management program module220generates, from the resolution description, solution keys describing various solutions, including Solution1, Solution2, and Solution3.

At step320, the computer server210stores the cause keys into a cache cause dataset and stores the solution keys into a cache solution dataset. In embodiments, the incident management program module220stores the cache cause keys generated at step310as the cache cause dataset (e.g., a cache cause table) in the cache database225on the computer server210and stores the cache solutions keys generated at step310as the cache solution dataset (e.g., a cache solution table) in the cache database225on the computer server210.

At step330, the computer server210determines a total number of occurrences of each cause in the information received at step300, using weights based on the sources. In embodiments, the incident management program module220analyzes the information collected at step300to determine a number of occurrences for each cause, corresponding to one or more cause keys generated at step310, across each of the incident database231, the problem database232, the known issue database233, and the trusted IT website database234.

In an example, a first cause Cause1 corresponds to a set of cause keys Key1, Key2, Key3; a second cause Cause2 corresponds to a set of cause keys Key2, Key3; and a third cause Cause3 corresponds to a set of cause keys Key2, Key4. The incident management program module220analyzes the information collected at step300and determines that Cause1 occurs 10 times in the incident database231, 5 times in the problem database232, 5 times in the known issue database233, and 7 times in the trusted IT website database234. Additionally, the incident management program module220analyzes the information collected at step300and determines that Cause2 occurs 6 times in the incident database231, 4 times in the problem database232, 1 time in the known issue database233, and 2 times in the trusted IT website database234. Finally, the incident management program module220analyzes the information collected at step300and determines that Cause3 occurs 2 times in the incident database231,1time in the problem database232, 0 times in the known issue database233, and 0 times in the trusted IT website database234.

After determining the number of occurrences for each cause in the information received at step300across each of the sources, the incident management program module220applies weights to determine the total number of occurrences for each cause. In embodiments, the incident management program module220assigns a highest weight to causes occurring in the known issue database233, assigns an intermediate weight to causes occurring in the problem database232, and assigns a lowest weight to causes occurring in the incident database231and the trusted IT website database234. The number occurrences of the cause in each source is multiplied by the weight associated with the source, and the numbers are summed to determine the total number of occurrences for the cause.

Continuing the above example, the incident management program module220assigns a weight of 4 to causes occurring in the known issue database233, assigns a weight of 2 to causes occurring in the problem database232, and assigns a weight of 1 to causes occurring in the incident database231and the trusted IT website database234. Accordingly, the incident management program module220determines a total number of occurrences for Cause1 to be 1*(10+7)+2*5+4*5=47. Additionally, the incident management program module220determines a total number of occurrences for Cause2 to be 1*(6+2)+2*4+4*1=20. Finally, the incident management program module220determines a total number of occurrences for Cause3 to be 1*(2+0)+2*1+4*0=4.

At step340, the computer server210generates and stores links between each cause and one or more possible solutions, including the determined total number of occurrences. In embodiments, the incident management program module220, for each cause in the information received at step300, generates and stores, in the cache database225, information about a link between the cause and one or more possible solutions. In particular, for each cause, the incident management program module220stores in the cache database225, as the information about the link, information identifying each of the cause keys (generated at step310) corresponding to the cause, information identifying one or more possible solutions (each possible solution corresponding to a set of one or more solution keys generated at step310), information about the number of occurrences (in association with the cause) of each of the one or more possible solutions in the information received at step300, and the determined total number of occurrences of the cause (generated at step330).

At step350, the computer server210, for each cause, determines an occurrence percentage for each of the one or more possible solutions corresponding to the cause. In embodiments, the incident management program module220uses the information about the number of occurrences (in association with the cause) of each of the one or more possible solutions from the links generated and stored at step340to determine a percentage of the time each of the possible solutions is the solution for the cause. The incident management program module220stores the determined occurrence percentages with the link between the cause and the one or more possible solutions in the cache database225.

In an example, Solution1 is a possible solution that corresponds to the set of solution keys Key1, Key2, Key3 and is determined to be the solution to Cause1 in 60% of the occurrences of Cause1. Solution2 is a possible solution that corresponds to the set of solution keys Key2, Key3 and is determined to be the solution to Cause1 in 30% of the occurrences of Cause1. Solution3 is a possible solution that corresponds to the set of solution keys Key2, Key4 and is determined to be the solution to Cause1 in 5% of the occurrences of Cause1. Other solutions are determined to be the solutions for the other 5% of the occurrences of Cause1.

At step360, the computer server210periodically reevaluates the set of sources to collect information about new incidents, problems, and known issues. In embodiments, at predetermined intervals, the incident management program module220requests and receives information about new and updated incidents from the external data server 1230-1(ofFIG. 2), requests and receives information about new and updated problems from the external data server 2230-2and the external data server 4230-4(ofFIG. 2), and requests and receives information about new and updated known issues from the external data server 3230-3(ofFIG. 2).

In particular, the incident management program module220receives from the incident database231of the external data server 1230-1, for each new and updated incident stored therein, a description of a cause of the incident, a description of a solution used to resolve the incident, and services, devices, and/or applications associated with the incident. The incident management program module220receives from the problem database232of the external data server 2230-2, for each new and updated problem stored therein, a description of a cause of the problem, a number of occurrences of the problem, a description of one or more solutions used to resolve the problem, and services, devices, and/or applications associated with the problem. The incident management program module220receives from the known issue database233of the external data server 3230-3, for each new and updated known issue stored therein, a description of a cause of the known issue, a description of one or more solutions used to resolve the known issue, and services, devices, and/or applications associated with the known issue. The incident management program module220receives from the trusted IT website database234of the external data server 4230-4, for each new and updated problem stored therein, a description of a cause of the problem, a description of one or more solutions used to resolve the problem, and services, devices, and/or applications associated with the problem. The flow then returns to step310.

FIG. 4depicts a flowchart of an exemplary method performed by the incident management program module220of the computer server210as an autonomous solution identification process in accordance with aspects of the invention. The steps of the method are performed in the environment ofFIG. 2and are described with reference to the elements shown inFIG. 2.

At step400, the computer server210receives information about a current incident. In embodiments, the incident management program module220requests and receives information about the current incident from the user interface program module250of the user computing device240(ofFIG. 2). In particular, the incident management program module220receives, from the user interface program module250, information including a description of the current incident and services, devices, and/or applications associated with the current incident.

At step410, the computer server210generates search keys using natural language processing. In embodiments, the incident management program module220uses natural language processing to interpret the information collected at step400. In particular, the incident management program module220applies natural language processing to the description of the current incident and services, devices, and/or applications associated with the current incident received at step400to generate a plurality of search keys. In an example, the incident management program module220generates search keys SearchKey1, SearchKey2, and SearchKey3 from the description of the current incident and services, devices, and/or applications associated with the current incident.

At step420, the computer server210searches the cache using different combinations of search keys. In embodiments, the incident management program module220uses different combinations of the search keys generated at step410or the new search keys selected at step450to search the cache database225to identify links having cause keys corresponding to the search keys. In an example, the incident management program module220searches the cache database225using a first combination of SearchKey1, SearchKey2, SearchKey3; a second combination of SearchKey1, SearchKey2; a third combination of SearchKey1, SearchKey3; and a fourth combination of SearchKey2, SearchKey3 to identify links having combinations of cause keys matching the search keys.

At step430, the computer server210obtains the search results including linked cause keys and solution keys. In embodiments, the incident management program module220identifies, as the search results from the search at step420, one or more links stored in the cache database225. Each link identified as a search result by the incident management program module220includes cause keys corresponding to the search keys used to search the cache database225at step420, and potentially also includes additional cause keys.

At step440, the computer server210determines whether the cache has been searched five times. In embodiments, the incident management program module220determines whether or not the search at step420has been performed five times. If the incident management program module220determines that the search at step420has not been performed five times, then the flow proceeds to step450. On the other hand, if the incident management program module220determines that the search at step420has been performed five times, then the flow proceeds to step460. In other embodiments, a different number or threshold may be used instead of five.

At step450, the computer server210selects cause keys from the search results to use as new search keys. In embodiments, the incident management program module220selects the cause keys included in the links stored in the cache database225from the search results obtained at step430to be used as the new search keys. The cause keys selected by the incident management program module220may include cause keys that were previously used as search keys as well as cause keys that were not previously used as search keys.

At step460, the computer server210ranks solutions based on source weight, cause occurrences, and solution occurrence percentages. In embodiments, the incident management program module220ranks each of the solutions included in the search results obtained at step430in each of the five searches. In particular, for each solution, a rank is obtained by multiplying the weight for the source associated with the cause and solution by the number of occurrences of the cause and by the occurrence percentage associated with the solution.

At step470, the computer server210displays the solutions ordered based upon determined rank. In embodiments, the incident management program module220causes the solutions to be displayed by the user interface program module250of the user computing device240. In particular, the user interface program module250displays each of the solutions in order from highest ranked to lowest ranked, based on the ranking determined at step460. In other embodiments, the user interface program module250only displays solutions above a predetermined rank or only displays a predetermined number of the highest-ranking solutions.

FIG. 5depicts an illustrative example500of the search performed by the incident management program module220in accordance with aspects of the invention. In the example500, a first search is performed using search key505. The first search results include cause506and linked solutions507as well as cause508and linked solution509. A second search is performed using search keys510and511. The second search results include causes512,513,514, and515and linked solutions516,517,518, and519. A third search is performed using search keys520and521. The third search results include causes522,523, and524and linked solutions525,526, and527. A fourth search is performed using search key528. The fourth search results include causes529and530and linked solutions531and532. Finally, a fifth search is performed using search key533. The fifth search results include causes534and535and linked solutions536and537.