Event resolution as a dynamic service

An approach is provided for optimally routing events in an IT system to solvers which provide resolutions of the events. Event streams originating from the IT system are defined. Events are classified into the event streams. An optimization problem is solved that minimizes costs incurred for using respective solvers based on constraints which include success rates of the solvers. Based on the solved optimization problem, policies are defined that associate the event streams to the solvers in a many-to-one correspondence. In real time, the defined policies are applied to the event streams. Based on the applied policies and the classified events, the events are routed to respective solvers. An indication is received that the events are resolved by the respective solvers, which reduces downtime in the IT system.

BACKGROUND

The present invention relates to managing event resolution in an information technology (IT) system, and more particularly to optimally routing an event to one of multiple event resolution vendors.

Traditional event resolution systems include manual activities to resolve a problem that occurred in an information technology (IT) system. Current event resolution techniques employ an expert system between an event management system and an incident problem change system, where the expert system automates some of the activities that were previously performed manually. If the expert system resolves the problem, then no ticket is created in the incident problem change system, but if the expert system cannot resolve the problem, then a ticket is created and manual activities attempt to resolve the problem. Multiple independent software vendors (ISVs) are providing a range of management services in the management-as-a-service arena, including event resolution. Event resolution may be provided by a single service or multiple services belonging to different ISVs. Known techniques for event resolution either utilize the single service or non-optimally select from among the multiple services.

SUMMARY

In a first embodiment, the present invention provides a method of optimally routing events in an IT system to solvers which provide resolutions of the events. The method includes a computer defining event streams originating from the IT system. The method further includes the computer classifying events into the event streams. The method further includes the computer solving an optimization problem that minimizes costs incurred for using respective solvers based on constraints which include success rates of the solvers. The method further includes based on the solved optimization problem, the computer defining policies that associate the event streams to the solvers in a many-to-one correspondence. The method further includes the computer, in real time, applying the defined policies to the event streams. The method further includes based on the applied policies and the classified events, the computer routing the events to respective solvers. The method further includes the computer receiving an indication that the events are resolved by the respective solvers, which reduces downtime in the IT system.

In a second embodiment, the present invention provides a computer program product including a computer-readable storage device and a computer-readable program code stored in the computer-readable storage device. The computer-readable program code includes instructions that are executed by a central processing unit (CPU) of a computer system to implement a method of optimally routing events in an IT system to solvers which provide resolutions of the events. The method includes the computer system defining event streams originating from the IT system. The method further includes the computer system classifying events into the event streams. The method further includes the computer system solving an optimization problem that minimizes costs incurred for using respective solvers based on constraints which include success rates of the solvers. The method further includes based on the solved optimization problem, the computer system defining policies that associate the event streams to the solvers in a many-to-one correspondence. The method further includes the computer system, in real time, applying the defined policies to the event streams. The method further includes based on the applied policies and the classified events, the computer system routing the events to respective solvers. The method further includes the computer system receiving an indication that the events are resolved by the respective solvers, which reduces downtime in the IT system.

In a third embodiment, the present invention provides a computer system including a central processing unit (CPU); a memory coupled to the CPU; and a computer-readable storage device coupled to the CPU. The storage device includes instructions that are executed by the CPU via the memory to implement a method of optimally routing events in an IT system to solvers which provide resolutions of the events. The method includes the computer system defining event streams originating from the IT system. The method further includes the computer system classifying events into the event streams. The method further includes the computer system solving an optimization problem that minimizes costs incurred for using respective solvers based on constraints which include success rates of the solvers. The method further includes based on the solved optimization problem, the computer system defining policies that associate the event streams to the solvers in a many-to-one correspondence. The method further includes the computer system, in real time, applying the defined policies to the event streams. The method further includes based on the applied policies and the classified events, the computer system routing the events to respective solvers. The method further includes the computer system receiving an indication that the events are resolved by the respective solvers, which reduces downtime in the IT system.

Embodiments of the present invention employ a brokerage service for servicing event streams provided by an IT system and selecting an optimal event resolution solver from among multiple solvers.

DETAILED DESCRIPTION

Overview

Embodiments of the present invention provide a brokerage service to dynamically and optimally select a solver provided by an event resolution provider from among multiple solvers provided by respective event resolution providers, where the solver is selected to resolve an event in an IT system. The selection of the solver optimizes the utility of an IT service provider who provides the IT system. In one embodiment, the optimization of the utility includes price optimization. Embodiments of the present invention provide an optimal routing of events to a sequence of solvers based on a policy, where the routing of the events through the sequence of solvers continues until a solver is found that successfully resolves the event.

In one embodiment, at least one of the solvers is provided by a third party that is other than the IT service provider who provides the IT system. In one embodiment, multiple event streams are defined and each event stream is assigned to a corresponding one or more solvers for event resolution.

A decision support system (DSS) may determine an event routing policy that includes a new solver provided by a new event resolution provider. In one embodiment, the DSS enables computation of a policy to route events to respective solvers, where the policy includes one or parameters, such as load on the solver, business rating of the solver, security compliance posture of a solver with respect to a customer's requirements, proficiency of a solver, cost of using a solver, and a measured success or failure rate of a solver in solving a type of requests. In one embodiment, the DSS provides Pareto analysis of the feasible solution vectors to determine the policy. Embodiments of the present invention monitor policy parameters, such as price, risk exposure, performance, etc., of a solver, to be used in the DSS to model a new or updated event routing policy. In one embodiment, the performance and capabilities of a solver may be explored by allocating events to the solver despite not satisfying the policy.

Embodiments of the present invention optimize the utility of the end-to-end IT service provider that provides the IT system, subject to constraints to set the policy. The utility may be based on one or more parameters, such as a total payout to the solvers and the cost incurred internally in solving the events; a total penalty paid to the end customer due to not meeting service level objectives (SLOs); a cumulative risk of choosing the multiple solvers; etc. The event routing policy can be set based on various granularities of events to be routed to a solver, as well as through a solution of an optimization problem that optimizes the utility of the end-to-end IT provider.

As used herein, a solver is defined to be a software-based event resolution system that employs robotic process automation or an expert system to resolve events. As used herein, an event is defined to be a significant occurrence that happens at a particular place and time in an IT system. In one embodiment, each event is an incident. As used herein, an incident is defined as an event that is not part of the standard operation of a service provided in the IT system, and that causes or can cause a disruption to or a reduction in the quality of the service. For example, an event or incident in a server may be indicated by a “log full” or “file system not accessible” condition.

System for Optimally Routing Events to Solvers

FIG. 1is a block diagram of a system for optimally routing an event in an IT system to a solver included in a plurality of solvers, in accordance with embodiments of the present invention. System100includes a computer102which executes a software-based event resolution brokerage system104, which includes the following software modules: event manager106, metric collector108, decision support system (DSS)110, negotiator112, policy manager114, and event distributor116.

System100also includes a source IT system118, which is a managed system in which events occur. Source IT system118includes software and hardware. Event manager106defines event streams, receives specifications of events from source IT system118, and classifies events from source IT system118into respective event streams. Each event from source IT system118is classified into exactly one event stream.

Event manager106sends each event received from source IT system118to event distributor116. Event distributor116receives policies from policy manger114. Based on the received policies, event distributor116optimally routes each event to a corresponding solver included in solver120-1, . . . , solver120-N, where N is an integer greater than or equal to two. The policies received by event distributor116specify the solvers to which event distributor116routes the events.

Each of solvers120-1, . . . ,120-N executes on a corresponding computer (not shown), which may be a computer included in source IT system118or a computer external to source IT system118and controlled by a third party (i.e., an entity different from the entity who controls source IT system118).

In one embodiment, a policy specifies an order in which event distributor116sends an event to a first solver and then to one or more other solvers, in case the first solver cannot successfully resolve the event. For example, a policy may specify that event distributor116sends an event to Solver A, and if Solver A cannot resolve the event, then sends the event to Solver B, and if Solver B cannot resolve the event, sends the event to Solver C. In one embodiment, the policies are a set of tuples that implement conditional rules.

Metric collector108retrieves statistics about events previously distributed by event distributor116to corresponding solvers included in solver120-1, . . . ,120-N. Metric collector108retrieves the aforementioned statistics from a data repository (not shown) populated by event distributor116. In embodiments of the present invention, the retrieved statistics include a combination of the following metrics: duration (i.e., the amount of time a solver takes to resolve an incident correctly), the mean of durations, the variance of durations, the percentage of incidents a solver solved correctly, and the percentage of incidents a solver solved incorrectly. Metric collector uses the retrieved statistics to generate ratings of solvers120-1, . . . ,120-N, where each rating indicates how well the solver corresponding to the rating is able to resolve incidents.

DSS110defines new event streams and the rate of events by using conditional or Boolean expressions. DSS110receives and models input parameters, which include the aforementioned statistics from metric collector108. DSS110also defines decision variables. Based on the event streams, input parameters, and decision variables, DSS110generates policies that map event streams to solvers120-1, . . . ,120-N. The mapping of event streams to the solvers specifies to which solver event distributor116routes an event. In one embodiment, DSS110receives the event stream definitions and the associations between the solvers and the event streams, and generates policies in which stream i is associated with solver j for all 0<i<M and 0<j<N, where M is the total number of event streams and N is the total number of solvers. The DSS can also change one or more of the generated policies in real time.

DSS110defines and models constraints, which are generated from the DSS110and which are specified by custom mappings of event streams to solvers120-1, . . . ,120-N based on factors including the skills and success rate of the solvers.

DSS110defines and models objectives that are optimized. For example, an objective is to have the resolution of an event by a particular solver minimize a cost, which includes an amount of money paid as a penalty for not meeting terms of a service level agreement (SLA) and an amount of money paid to the vendor for providing the solver that resolves the event. Other objectives may include minimizing duration or security compliance risk, or maximizing a customer satisfaction score.

Based on the modeled objectives and the constraints, DSS110compares different policies based on costs of the policies, determines an optimal policy based on the policy that minimizes cost, and/or performs Pareto analysis to determine Pareto dominance and selects a solver from solvers120-1, . . . ,120-N that best satisfies conflicting objectives.

In one embodiment, to determine the optimal policy, DSS110generates and solves a linear programming problem which minimizes a cost incurred for using each of solvers120-1, . . . ,120-N based on the constraints.

After generating a new policy, DSS110sends the policy to negotiator112, which terminates existing contracts with the event resolution providers of solvers120-1, . . . ,120-N in response to a contract expiring, notifies the event resolution providers of the solvers about the new policy, requests that the event resolution providers agree to the policy and the payment mechanism associated with the policy. Negotiator112performs the aforementioned contract termination, notifications, and requests for agreements to a policy by communicating with the event resolution providers via software-based negotiation agents (not shown) coupled to respective solvers120-1, . . . ,120-N. If the event resolution providers of solvers120-1, . . . ,120-N agree with the policy, then negotiator112receives agreements to the policy from the event resolution providers of solvers120-1, . . . ,120-N. Negotiator112notifies policy manager114about the contract terminations, notifications of the event resolution providers, and policy agreements made by the event resolution providers of the solvers.

Policy manager114receives the policy from negotiator112, where the policy had been generated by DSS110and had been agreed upon by event resolution providers of solvers120-1, . . . ,120-N and applies the policy to events received from source IT system118in real time. Policy manager114also receives the solver ratings from metric collector108. Based on the policy and the solver ratings, policy manager114determines the order in which solvers120-1, . . . ,120-N receive the event from event distributor116or from a solver in a prior position in the aforementioned order (i.e., determine (1) which of the solvers is the first solver to attempt to resolve the event received from event distributor116, (2) if the first solver fails to resolve the event, which of the other solvers is the second solver to attempt to resolve the event, where the second solver receives the event from the first solver, (3) if the second solver fails to resolve the event, which of the other solvers (i.e., other than the first and second solvers) is the third solver to attempt to resolve the event, where the third solver receives the event from the second solver, (4) etc.).

Based on policy manager114applying the policy, event resolution brokerage system104optimally routes the event in a sequence to solvers120-1, . . . ,120-N.

The solver ratings provide policy manager114with information about different capabilities of the different solvers which cause one solver to be better at resolving a particular type of event than other solvers. For example, Solver A specializes in resolving events that are storage events and is therefore better at resolving storage event XYZ than other solvers. As another example, Solver B may specialize in resolving events that are network events and is therefore better at resolving a network event ABC than other solvers.

After policy manager114applies the policy and event distributor116distributes the event to solvers120-1, . . . ,120-N in the order specified by policy manager114, solvers120-1, . . . ,120-N access a managed in-scope server122in a sequence determined by the order specified by policy manager114, until one of the accesses of managed in-scope server122successfully resolves the event. In-scope server122is the component of source IT system118which is the source of the problem associated with the event. In another embodiment, managed in-scope server122is replaced with another infrastructure component of source IT system118which is the source of an event and is sequentially accessed by solvers120-1, . . . ,120-N to resolve the event.

If none of solvers120-1, . . . ,120-N is able to successfully resolve the event, then event distributor116receives a first indication that none of the solvers was successful, and in response to the receipt of the first indication, sends a second indication to an incident problem change system124. In response to receiving the second indication, incident problem change system124cuts a ticket for the problem associated with the event and places the ticket in a queue. A dispatcher (not shown) dispatches tickets from the queue to human system administrators (not shown) who manually analyze the ticket and access managed in-scope server122to attempt to resolve the event.

System100includes a software-based central authority (not shown) which receives requests from solvers120-1, . . . ,120-N to access configuration items (CIs) of source IT system118. The central authority serializes access and grants access permissions to solvers120-1, . . . ,120-N to address race conditions and avoid consistency challenges that would occur if two solvers were attempting to access the same CI to resolve respective event stream incidents (e.g., the solvers are working on separate event streams emanating from the same server computer in source IT system118).

As a first solver attempts to resolve an event it may make changes to configuration items (Cis) which results in a new state in the source IT system118. This new state may not be acceptable to the next solver that is next in the sequence of solvers that try to resolve the event if the previous solver cannot resolve the event. To address the possibility of an unacceptable state, before making any CI changes, event resolution brokerage system104may record all current values of the Cis and keep a copy of virtual machines (VMs) in virtual environments. If a first solver is unsuccessful in an attempt to resolve an event which changes (i.e., “dirties”) the VMs so that the changed VMs are unacceptable to the next solver, then the first solver (1) replaces the dirtied VMs with their saved copies and (2) sets all the CIs to their original values. After the aforementioned (1) and (2) are completed, the first solver then escalates the event back.

In one embodiment, as event distributor routes the event by switching between a first solver and a second solver included in solvers120-1, . . . ,120-N, event resolution brokerage system104determines whether a contract with the first solver is terminated. A billing system126generates a bill for the first solver in response to the contract termination, where the bill specifies an amount of money to be paid by the entity managing event resolution brokerage system104to the event resolution provider of the first solver. The event resolution providers of the solvers may agree to other pricing models by which billing system126computes overall payments to be made to each of the solvers. These pricing models are discussed in more detail in the section presented below entitled Contract Termination and Pricing.

The functionality of the components shown inFIG. 1is described in more detail in the discussion ofFIG. 2A,FIG. 2B,FIG. 3,FIG. 4,FIG. 5, andFIG. 6presented below.

FIG. 2AandFIG. 2Bdepict examples of event streams specified by assignments of infrastructure components to solvers included in the system ofFIG. 1, in accordance with embodiments of the present invention. InFIG. 2A, an infrastructure component202is a component of source IT system118(seeFIG. 1). Event manager106(seeFIG. 1) defines m event streams: stream204-1, . . . , stream204-m(i.e., stream λ1, . . . , stream λm), where m is an integer greater than or equal to two. DSS110(seeFIG. 1) assigns each of the streams204-1, . . . ,204-mto a corresponding one of solver A, . . . , solver K (i.e., solver206, . . . , solver208), which are included in solver120-1, . . . ,120-N inFIG. 1. The multiple solvers120-1, . . . ,120-N (seeFIG. 1) are operating simultaneously. This assignment of event streams to multiple solvers is distinguished from a known event resolution system in which only one solver exists and all events go to that single solver except for events that come from servers which are not registered for the service provided by the event resolution system.

In one embodiment, event manager106(seeFIG. 1) defines the event streams204-1, . . . ,204-mto correspond to respective types of infrastructure components, such as software, server, storage, and network infrastructure components. Event manager106(seeFIG. 1) may further categorize event streams204-1, . . . ,204-mbased on metadata of each event (e.g., metadata specifying a first event stream from a server to include “log full” events and a second event stream from the same server to include “memory leak” events).

InFIG. 2B, infrastructure component210is a component of source IT system118(seeFIG. 1). Event manager106(seeFIG. 1) defines a first view212of event streams from infrastructure210as being organized into two sub-categories of events: λabove OS(i.e., events that occur above the operating system (OS) level, such as events at the middleware level) and λOS&below(i.e., events that occur at the OS level or below the OS level, which includes events at the hypervisor, physical server, and network related levels).

InFIG. 2B, event manager106(seeFIG. 1) also defines a second view214of event streams organized by four sub-categories of events: λapp, λmiddleware, λOS, and λhypervisor & below. The λappsub-category includes events that occur at the application level. The λmiddlewaresub-category includes events that occur at the middleware level. The λOSsub-category includes events that occur at the OS level. The λhypervisor & belowsub-category includes events that occur at the hypervisor level or below the hypervisor level (e.g., at the physical server level or a network-related level).

In one embodiment, DSS110(seeFIG. 1) assigns each of the sub-categories inFIG. 2AandFIG. 2Bto a corresponding solver included in solver120-1, . . . , solver120-N (seeFIG. 1), where the solver specializes in resolving the corresponding sub-category of events. That is, in one embodiment, event resolution providers that provide solvers120-1, . . . ,120-N (seeFIG. 1) subscribe to one or more sub-categories of events coming from a server or other infrastructure component.

The same events may be included in two different event streams based on one sub-category of a first view being a subset of another sub-category of a second view. For example, an event in the event stream organized into sub-category λappin view214is also included in another event stream organized into sub-category λabove OSin view212because sub-category λappis a subset of sub-category λabove OS(i.e., an event that occurs at the application level must also be an event that occurs at a level above the OS level).

DSS110(seeFIG. 1) generates a policy that assigns an s-th event stream λsincluded in streams204-1, . . . ,204-mto an i-th solver included solvers120-1, . . . ,120-N (seeFIG. 1). The policy maps each event stream to exactly one solver. Prior to routing an event in an event stream to a solver that is mapped to the event stream, an event resolution provider who provides the solver agrees to the policy that routes the event.

In one embodiment, the routing of events is also based on the load on the solver that is currently operating.

In one embodiment, event resolution brokerage system104accepts a user instruction to violate a policy, which allows an exploration of the effects of using solver(s) other than the solver assigned to a particular event stream.

Process for Optimally Routing Events to Solvers

FIG. 3is a flowchart of a process of optimally routing an event in an IT system to a solver included in a plurality of solvers, where the process is implemented in the system ofFIG. 1, in accordance with embodiments of the present invention. The process ofFIG. 3begins at step300. In step302, event manager106(seeFIG. 1) defines event streams that originate from source IT system118(seeFIG. 1).

In step304, event manager106(seeFIG. 1), in real time, classifies events into the event streams defined in step302. The events classified in step304emanate from source IT system118(seeFIG. 1).

In step306, DSS110(seeFIG. 1) defines and models constraints for an optimization problem that minimizes costs incurred for using respective solvers120-1, . . . ,120-N (seeFIG. 1) and for using incident problem change system124(seeFIG. 1). The constraints include success rates of the solvers120-1, . . . ,120-N (seeFIG. 1) (i.e., the rates of successfully resolving events of classifications into which events are classified in step304). Also in step306, based in part on the constraints, DSS110(seeFIG. 1) generates and determines a solution to the optimization problem to determine the aforementioned costs. In one embodiment, a cost determined by solving the optimization problem includes an amount of money paid as a penalty for not meeting terms of a SLA plus an amount of money paid to an event resolution provider for providing the solver that resolves the event. A solution to a mixed integer nonlinear programming problem to determine the cost that includes the penalty for not meeting terms of a SLA and the cost for using the solvers is described below in the section entitled Optimization Problem. In other embodiments, DSS110(seeFIG. 1) may generate and solve a linear optimization problem in step306to minimize duration or minimize security compliance risk.

In alternate embodiments, step306includes DSS110(seeFIG. 1) defining and modeling constraints for optimization of other linear objective functions, such as (1) maximizing a score indicating customer satisfaction, (2) maximizing up time for the managed applications provided by managed in-scope server122(seeFIG. 1), (3) maximizing the number of events successfully resolved by solvers120-1, . . . ,120-N (seeFIG. 1) or minimizing the number of events resolved by a local incident management process performed by incident problem change system124(seeFIG. 1), (4) minimizing the maximum security risk from an individual solver, (5) maximizing a reputation of a solver, where the reputation may be obtained from the sentiment of the solver on social networking sites, and (6) minimizing the penalty due to not meeting an SLO associated with the event.

In step308, based on the solution to the optimization problem determined in step306, DSS110(seeFIG. 1) defines and compares policies, which are conditionals on which the event streams defined in step302are routed to respective solvers120-1, . . . ,120-N (seeFIG. 1). The defined policies associate the event streams to solver120-1(seeFIG. 1), . . . , solver120-N (seeFIG. 1) in a many-to-one correspondence (i.e., each solver is associated with one or more event streams and each event stream is associated with exactly one solver).

For example, a first policy and a second policy may be defined in step308as follows:

First policy:

λ11: All events from Event Management to Solver A

λ12: If an event cannot be solved by Solver A, then send the event to incident problem change system124(seeFIG. 1)

λ21: If an event is from server xxx.xxx.xxx.xx/aa, then send the event to Solver A

λ22: If an event is from servers yyy.yyy.yyy.yy/bb, then send the event to Solver B

λ23: If Solver A cannot solve an event, then send the event to Solver B

λ24: If Solver B cannot solve an event, then send the event to incident problem change system124(seeFIG. 1)

In one embodiment, in step308, based on the comparison of the policies, DSS110(seeFIG. 1) determines that one of the compared policies is an optimal policy that minimizes the aforementioned cost for different classifications of events. In an alternate embodiment, DSS110(seeFIG. 1) selects a solver from solvers120-1, . . . ,120-N (seeFIG. 1) that best satisfies conflicting objectives based on a Pareto analysis.

In step310, event manager106(seeFIG. 1) applies the optimal policy defined in step308to the event streams.

In step312, based on the optimal policy applied in step310, event distributor116(seeFIG. 1) in real time routes the events to respective solvers included in solver120-1(seeFIG. 1), . . . , solver120-N (seeFIG. 1).

After step312and prior to step314, the solvers to which events were routed in step312generate resolutions to the events. Although not shown inFIG. 3, if none of the solvers can resolve an event, the event resolution brokerage system104(seeFIG. 1) sends the event to incident problem change system124(seeFIG. 1), which cuts a problem ticket to prompt a system administrator to attempt to resolve the event.

In step314, event resolution brokerage system104(seeFIG. 1) receives an indication that the solvers generated resolutions to the events. The process ofFIG. 3ends at step316.

Events that indicate problems with the infrastructure of source IT system118(seeFIG. 1) are resolved more quickly under the process ofFIG. 3implemented in system100(seeFIG. 1), as compared to resolving the same events using known event resolution techniques. By its quicker resolution of infrastructure problems, completing the process ofFIG. 3as implemented system100(seeFIG. 1) reduces downtime of hardware included in and software managed by source IT system118(seeFIG. 1).

Contract Termination and Pricing

As events are routed to solvers in the process ofFIG. 3, event resolution brokerage system104(seeFIG. 1) determines when a contract with an event resolution provider of a solver is terminated. An IT service provider providing event resolution brokerage system104(seeFIG. 1) can distribute or switch between event resolution providers of solvers at different granularities, as presented below.

Per time-block of events: event resolution brokerage system104(seeFIG. 1) routes events over a time-block (i.e., block of time) to an event resolution provider based on a predetermined policy. A block of time may be of the order of minutes, hours, days, months, etc. In response to the time-block being completed, the duration of the contract is completed. This time-block is denoted by T in the pricing functions described below.

Per event: Each event corresponds to a task to be performed to solve the incident associated with the event. Each event can be resolved by a different corresponding solver. The IT service provider may decide to forward no more events to the corresponding solver subsequent to any event being forwarded to the solver. The pricing functions described below use J(i, t, λs) to denote the events successfully processed by solver i by time t since directing a stream λsto Solver i and H(i, t, λs) to denote the events unsuccessfully processed by solver i by time t since directing a stream λsto Solver i.

Per count of events: After event resolution brokerage system104(seeFIG. 1) routes a fixed number of events to a solver, the contract with the event resolution provider of the solver expires.

In one embodiment, there is a cost associated with each time a contract with an event resolution provider is terminated and a new contract is created. This cost can be modeled as a fixed time cost, F. The contract with the event resolution provider can be renewed automatically if there is no change in the contract and the consumer does not commit to the ending of the contract.

The pricing function is denoted by f( . . . ). Billing system128(seeFIG. 1) uses this pricing function to compute the overall payment to be made to each of the solvers120-1, . . . ,120-N (seeFIG. 1). Alternatively, the charges can be sent by the event resolution providers of the solvers.

Event resolution brokerage system104(seeFIG. 1) associates a pricing model with each event stream to which a solver is subscribed. Examples of pricing models are presented below.

Fixed fee per time duration (e.g., monthly) for a specified infrastructure component:

Number of software robots with a price per robot per duration:

Event resolution brokerage system104(seeFIG. 1) chooses the number of software robots, n, based on the expected workload.

Per port pricing: Use the formulas presented above in the number of software robots pricing model, except that n is the number of ports.

Per event pricing: All the events that are resolved correctly are charged a price p while a flat rate q for all the events that could not be successfully resolved:

Customized tiered pricing

Utility models of pricing: The event resolution provider determines charges that are based on the utilization of the managed infrastructure.

Optimization Problem

In one embodiment, step306(seeFIG. 3) includes DSS110(seeFIG. 1) determining a cost which includes the cost of using the solvers120-1, . . . ,120-N (seeFIG. 1) plus the penalty of not meeting the terms of the SLA. DSS110(seeFIG. 1) determines the aforementioned cost by generating and solving a mixed integer nonlinear programming (MINP) problem. The MINP problem uses the following notation:

λ is the total arrival rate of events from the managed infrastructure in source IT system118(seeFIG. 1).

λmsis defined so that the first index m∈{0, 1, . . . , K} corresponds to which solver the event stream is emanating from, the second index s∈{1, . . . , S} corresponds to the event stream index itself, m=0 corresponds to the all the streams of events directly coming from the infrastructure, m>0 corresponds to the solvers shown inFIG. 1, λmsis the sthunresolved event stream coming out of solver m, and m=K corresponds to a native in-house IT department (which includes incident problem change system124(seeFIG. 1)) solving an event that is unsolved by the solvers and thus in this case, by definition, there are no streams emanating from the in-house IT department. As used in this Optimization Problem section, the IT department is a department of an end-to-end service provider that provides event resolution brokerage system104(seeFIG. 1).

λ0sindicates all the streams which are directly coming from the infrastructure. In this case, there are S streams.

The aforementioned notations indicate the possibility that two different streams may have overlapping events. For example, λAPPin the second view214inFIG. 2Band λABOVE OSin the first view212inFIG. 2Bhave overlapping events because λAPPis included in λABOVE OS.

Subsets of the streams from the infrastructure are created such that all the event streams in each subset cover all the events coming from the infrastructure. These subsets are defined through the constants Zgs. Zgsis 1 if s belongs to the gthsubset, otherwise Zgsis 0. Note that Σg, sZgs=S; i.e., for any given subset g, Σsλ0sZgs=λ (i.e., the total stream strength coming out of the managed infrastructure). The first view212(seeFIG. 2B) includes a first example of a subset of streams. The second view214(seeFIG. 2B) includes a second example of a subset of streams.

Because m=K indicates the native in-house IT department solving any unresolved event, λKsis 0 to indicate there are no streams emanating from the in-house IT department.

xmsi=1 if λmsstream is assigned to Solver I; otherwise xmsi=0. Note that i>0. xmsiis an unknown in the optimization problem. The optimization problem is used to solve for xmsi.

In a solution to the optimization problem, only the streams within a subset (as described above) are assigned to solvers and other subsets are discarded. To ensure that only the streams within a single subset are selected in the solution of the optimization problem, the following constraints are needed in the optimization problem:

(1) Σs,g,iλ0sZgsx0si=λ, which indicates that the optimization problem needs to cover all the events that are sent to the solvers from the managed infrastructure.

(2) For each of the subsets g, add the following inequalities x0si≥ΣiΣsZgsx0si/S, where the rationale is if the right hand side of each inequality in (2) is greater than 0, then each of the variables x0siwithin a single subset is driven to 1, and as a consequence of the equality in (1), forcing all the others to 0.

All the other streams which are emanating from the actual solvers (i.e., m>0) are assigned to any other solver including m=K. The Kthsolver is the native in-house IT department (i.e., the end-to-end service provider's IT department itself). xmsm=0 to indicate that there is no point in assigning a stream to the solver from which the stream has emanated.

In the optimization problem, a model of the penalty incurred by the end-to-end service provider in case terms of a SLO are missed is described below.

P(λms, Tj, uj) denotes the penalty rate (e.g., penalty incurred per second expressed as a number of dollars per second) that is input into DSS110(seeFIG. 1) for criticality level j if the target service level Tjis missed. Note that Tjis a time limit to resolve an event according to the terms of an SLO and depends on λms, as described below. Note that m=0, given that all other streams where m>0 are derivatives of streams with m=0 (i.e., initial event streams emanating from a managed infrastructure are mapped to respective solvers, and if a particular solver cannot resolve an event in an event stream, then the event is passed to a next solver in a subsequent stream that is a derivative of the initial stream emanating from the managed infrastructure).

Cmsjis the percentage of events in stream λmsthat have criticality level j, where j∈{0, 1, 2, . . . , L}. Cmsjis based on historical data and is an input to DSS110(seeFIG. 1).

Umsjiis the percentage of events of criticality level j in Cmsjλmsthat could not be resolved in the stipulated time when xmsi=1. Umsjiis an input to DSS110(seeFIG. 1).

ujis the percentage of total events of criticality j that could not be resolved in the stipulated time and equals Σm,s,iUmsjiCmsjλmsxmsi/Σm,s,j,iUmsjiCmsjλmsxmsi

Tjis the service level target for events of criticality j. Tjis an input to DSS110(seeFIG. 1) and is the aforementioned stipulated time.

As an example, consider a Solver A receiving multiple streams λmx, λny, and λlzwhich emanate from other respective solvers. Two event streams λasand λatemanate from Solver A that include events that Solver A cannot resolve. Event stream λasis received by Solver C and event stream λatis received by Solver B. DSS110(seeFIG. 1) generates the mapping that routes the event streams from Solver A to Solvers B and C. In this example, the rate of successfully resolved events from Solver A is expressed as ja:=Σm,sλmsxsa−Σsλas(i.e., the total input minus what Solver A sends out to other solvers equals the rate of successfully resolving events by Solver A). Furthermore, all events into a K-th solver are by definition resolved, which is expressed as ΣsλKs=0.

In determining a cost of using solvers, DSS110(seeFIG. 1) uses an assumption that all the solvers, without loss of generality, use the per-event pricing (i.e., each solver charges for an event that it has been able to successfully resolve and does not charge for an event that it has not been able to successfully resolve). DSS110(seeFIG. 1) then determines the total payout rate as:
Σi>0f(λms, i, ji, hi)=Σi>0pi*ji+qi, where:

i is the index of the ithsolver; λmsis the msthstream that is assigned to i (m≠i); and jiis the rate of successfully resolved events and hiis the rate of unsuccessfully resolved events coming out of solver i in the minimum billing/contract duration;

piis the price or cost of processing a successfully resolved event by the solver I;

qiis the price or cost of sending events to a solver, where those events could not be successfully resolved. This price or cost qimay depend on hibut in this determination of the total payout rate, qiis selected to be a flat rate;

i=0 corresponds to streams coming directly from the managed infrastructure and is thus not considered; and

i=K corresponds to the local IT department of the end-to-end service provider and thus qK=0

An example of the objective function generated and solved by DSS110(seeFIG. 1) for the optimization problem is as follows:

The example objective function (1) may be a linearized function of penalty and cost of using the solvers:
aΣs=0SΣj=0LP(λ0s, Tj, uj)+bΣm=1Kpmjm+qm(1)

The aim is to minimize the objective function presented above subject to the following constraints:

λ00=λ−Σm,k>s>0, i<Kx0siλ0swhich indicates any remaining events solved by the end-to-end service provider; and

x00K=1, where λ00is assigned to the end-to-end service provider; and including other constraints discussed above.

An optimization formulation is presented above using two objective functions in a linear combination. Other objective functions can also be considered in isolation or in a linear combination as presented above.

Heuristic Approach

In one embodiment, DSS110(seeFIG. 1) determines a solution to the aforementioned optimization problem (i.e., integer linear programming (ILP), or non-linear programming program) using a heuristic approach (e.g., linear programming relaxation, simulated annealing, Monte Carlo methods, branch and bound, etc.).FIG. 4is a flowchart of a Monte Carlo process of minimizing the cost and penalty of routing an event to a solver in the system ofFIG. 1, in accordance with embodiments of the present invention. In one embodiment, the process ofFIG. 4is included in step306(seeFIG. 3).

The process ofFIG. 4starts at step400. In step402, DSS110(seeFIG. 1) generates a vector of unknown parameters, which includes xsi. Again, the value of xsiis either zero or one. In step404, DSS110(seeFIG. 1) defines a domain for each of the unknown parameters. For example, xsi∈{0,1}, indicating that either the stream is not mapped to the i-th solver or the stream is mapped to the i-th solver.

In step406, DSS110(seeFIG. 1) utilizes a sampling plugin to repeatedly and randomly generate sample vectors using the domains defined in step404to form a set K of new sample vectors.

In step408, DSS110(seeFIG. 1) determines values of objective functions for respective sample vectors in set K formed in step406, and determines whether each sample vector violates the constraints discussed above relative to objective function (1). If a sample vector violates the constraints, then DSS110(seeFIG. 1) filters out (i.e., discards) the sample vector from the set K because the sample vector is infeasible; otherwise, DSS110(seeFIG. 1) keeps the sample vector in set K.

In step410, DSS110(seeFIG. 1) determines whether more sample vectors are needed. If DSS110(seeFIG. 1) determines in step410that more sample vectors are needed, then the Yes branch of step410is taken, and the process ofFIG. 4loops back to step404to generate more sample vectors.

If DSS110(seeFIG. 1) determines in step410that no more sample vectors are needed, then the No branch of step410is taken and step412is performed.

In one embodiment, DSS110(seeFIG. 1) graphically plots the sample vectors in set K to assist a user in performing Pareto analysis. In step412, based on the objective functions corresponding to the sample vectors in set K, DSS110(seeFIG. 1) determines the optimal set of sample vectors or non-dominated set of sample vectors that are included in set K, thereby determining the vector that minimizes the value of the objective function. The process ofFIG. 4ends at step414.

Policy Determination

FIG. 5is a flowchart of a process of determining policies managed by the system ofFIG. 1, in accordance with embodiments of the present invention. In one embodiment, the process ofFIG. 5is included in step308(seeFIG. 3). The process ofFIG. 5starts at step500. In step502, event resolution brokerage system104(seeFIG. 1) defines knowledge about a domain as an input to the policy determination process. In step504, event resolution brokerage system104(seeFIG. 1) defines event streams as input to the policy determination process

In step506, event resolution brokerage system104(seeFIG. 1) generates an assignment of a policy to meet business objectives. Step506includes steps508through518.

In step508, event resolution brokerage system104(seeFIG. 1) chooses a heuristic approach to solve the optimization problem. In step510, event resolution brokerage system104(seeFIG. 1) executes the chosen heuristic approach (e.g., the Monte Carlo process inFIG. 4) to obtain new assignments.

In step512, if event resolution brokerage system104(seeFIG. 1) determines that exploration is required to choose a policy, then the Yes branch of step512is taken and step514is performed.

In step514, event resolution brokerage system104(seeFIG. 1) generates exploration policy options. In step516, different assignments are manually compared. In step518, based on the comparison in step516, event resolution brokerage system104(seeFIG. 1) chooses a policy, which is the policy whose assignment is generated in step506.

Returning to step512, if event resolution brokerage system104(seeFIG. 1) determines that exploration is not required to choose the policy, then the No branch of step512is taken and step516is performed, as described above.

After the generation of the assignment is completed in step506along with the policy chosen in step518, step520is performed.

In step520, event resolution brokerage system104(seeFIG. 1) performs negotiation with solvers120-1, . . . ,120-N (seeFIG. 1) to accept the policy chosen in step518.

In step522, event resolution brokerage system104(seeFIG. 1) determines whether the policy chosen in step518is acceptable to at least one of solvers120-1, . . . ,120-N (seeFIG. 1). If event resolution brokerage system104(seeFIG. 1) determines in step522that the chosen policy is acceptable by at least one of the solvers, then the Yes branch of step522is taken and step524is performed.

In step524, event resolution brokerage system104(seeFIG. 1) applies the policy chosen in step518in the next contract renewal for the solver(s) for which the policy is acceptable, as determined in step522.

In step526, event resolution brokerage system104(seeFIG. 1) monitors metrics about whether the solver that accepted the policy is successfully resolving events in a particular event stream. The metrics are collected by metric collector108(seeFIG. 1).

In step528, based on the metrics monitored in step526, event resolution brokerage system104(seeFIG. 1) determines whether a new assignment of a policy is needed. If event resolution brokerage system104(seeFIG. 1) determines in step528that a new assignment is needed, then the Yes branch of step528is taken and the process ofFIG. 5loops back to step506to generate a new assignment of a policy. If event resolution brokerage system104(seeFIG. 1) determines in step528that a new assignment is not needed, then the No branch of step528is taken and the process ofFIG. 5ends at step530.

Returning to step522, if event resolution brokerage system104(seeFIG. 1) determines that the policy is not acceptable to at least one of the aforementioned solvers, then the No branch of step522is taken and the process ofFIG. 5loops back to step506to generate another assignment, as described above.

Through the process ofFIG. 5, event resolution brokerage system104(seeFIG. 1) is helping the end-to-end service provider to provide and apply appropriate policies as event resolution brokerage system104(seeFIG. 1) learns about the capabilities of the solvers and improves estimations of the solvers' capabilities.

FIG. 6is a flowchart of a process of performing a negotiation with solvers included in the process ofFIG. 5, in accordance with embodiments of the present invention. The process ofFIG. 6is included in step520(seeFIG. 5). The process ofFIG. 6starts at step600. In step602, negotiator112(seeFIG. 1) receives a new policy chosen by DSS110(seeFIG. 1) in step518(seeFIG. 5).

In step604, negotiator112(seeFIG. 1) selects an i-th solver from solver120-1, . . . ,120-N (seeFIG. 1), where the policy of the i-th solver has changed based on the new policy chosen by DSS110(seeFIG. 1).

In step606, negotiator112(seeFIG. 1) communicates the policy to the i-th solver.

In step608, the i-th solver evaluates the assignment of the new policy, which has been generated in step506(seeFIG. 5).

In step610, negotiator112(seeFIG. 1) determines whether the i-th solver agrees with the assignment of the new policy. If negotiator112(seeFIG. 1) determines in step610that the i-th solver agrees with the assignment, then the Yes branch is taken and step612is performed.

In step612, negotiator112(seeFIG. 1) determines whether there is another solver to select from solvers120-1, . . . ,120-N (seeFIG. 1). If negotiator112(seeFIG. 1) determines in step612that there is another solver to select, then the Yes branch of step612is taken and step614is performed.

In step614, negotiator112(seeFIG. 1) updates i to select the next i-th solver include in solvers120-1, . . . ,120-N (seeFIG. 1), and the process ofFIG. 6loops back to step604to select the next i-th solver.

Returning to step612, if negotiator112(seeFIG. 1) determines that there is not another solver to select, then the No branch of step612is taken and step616is performed.

In step616, negotiator112(seeFIG. 1) sets the acceptance of the solver of the new policy and the process ofFIG. 6ends at step618.

Returning to step610, if negotiator112(seeFIG. 1) determines that i-th solver does not agree to the assignment evaluated in step608, then the No branch of step610is taken and the process ofFIG. 6ends at step618. In this case, the process continues with a new assignment of a policy in step506(seeFIG. 5).

Supervised Learning Based Method

In one embodiment, event resolution brokerage system104includes a capability optimizer that determines whether a solver has a capability to resolve an event by the following steps:

(1) model the capability of the solver to resolve an event using the capability optimizer function presented below:

x1=the category of the problem

x2=the severity of the problem

x3=should_experiment flag indicating whether an exploration of the performance of a solver by allocating events to the solver even though there is a violation of the policy

x4=is_current_solver_for_this_category indicating whether the solver is the current solver for resolving problems in the category

a, b, c, and d dynamically evolve based on periodic feedback from a tool in system100(seeFIG. 1) that produces the status of a resolution of an event and an amount of time taken to resolve the event for each problem assigned to each solver. The a, b, c, and d coefficients are adjusted based on a determination of previous false positives and false negatives.

(2) perform logistic regression using the capability optimizer function described above in step (1). The logistic regression uses past data to improve the next decision. Event resolution brokerage system104uses the logistic regression to estimate the coefficients of the capability optimizer function and output whether a particular solver should resolve an event.

(3) if the result of the regression indicates multiple options, then a series of filters are employed using load balancing and cost optimization to reduce the options to only one option. The cost optimization in the series of filters performs linear regression for each solver using a function based on a cost that will be incurred, a slippage penalty, and a risk rating of the solver.

Computer System

FIG. 7is a block diagram of a computer that is included in the system ofFIG. 1and that implements the process ofFIG. 3, in accordance with embodiments of the present invention. Computer102is a computer system that generally includes a central processing unit (CPU)702, a memory704, an input/output (I/O) interface706, and a bus708. Further, computer102is coupled to I/O devices710and a computer data storage unit712. CPU702performs computation and control functions of computer102, including executing instructions included in program code714for event resolution brokerage system108(seeFIG. 1) to perform a method of optimally routing events in an IT system to solvers, where the instructions are executed by CPU702via memory704. CPU702may include a single processing unit, or be distributed across one or more processing units in one or more locations (e.g., on a client and server).

Memory704includes a known computer readable storage medium, which is described below. In one embodiment, cache memory elements of memory704provide temporary storage of at least some program code (e.g., program code714) in order to reduce the number of times code must be retrieved from bulk storage while instructions of the program code are executed. Moreover, similar to CPU702, memory704may reside at a single physical location, including one or more types of data storage, or be distributed across a plurality of physical systems in various forms. Further, memory704can include data distributed across, for example, a local area network (LAN) or a wide area network (WAN).

I/O interface706includes any system for exchanging information to or from an external source. I/O devices710include any known type of external device, including a display device, keyboard, etc. Bus708provides a communication link between each of the components in computer102, and may include any type of transmission link, including electrical, optical, wireless, etc.

I/O interface706also allows computer102to store information (e.g., data or program instructions such as program code714) on and retrieve the information from computer data storage unit712or another computer data storage unit (not shown). Computer data storage unit712includes a known computer-readable storage medium, which is described below. In one embodiment, computer data storage unit712is a non-volatile data storage device, such as a magnetic disk drive (i.e., hard disk drive) or an optical disc drive (e.g., a CD-ROM drive which receives a CD-ROM disk).

Memory704and/or storage unit712may store computer program code714that includes instructions that are executed by CPU702via memory704to optimally route events in an IT system to solvers. AlthoughFIG. 7depicts memory704as including program code, the present invention contemplates embodiments in which memory704does not include all of code714simultaneously, but instead at one time includes only a portion of code714.

Further, memory704may include an operating system (not shown) and may include other systems not shown inFIG. 7.

Storage unit712and/or one or more other computer data storage units (not shown) that are coupled to computer102may store any combination of: constraints114(seeFIG. 1) and policies110(seeFIG. 1).

As will be appreciated by one skilled in the art, in a first embodiment, the present invention may be a method; in a second embodiment, the present invention may be a system; and in a third embodiment, the present invention may be a computer program product.

Any of the components of an embodiment of the present invention can be deployed, managed, serviced, etc. by a service provider that offers to deploy or integrate computing infrastructure with respect to optimally routing events in an IT system to solvers. Thus, an embodiment of the present invention discloses a process for supporting computer infrastructure, where the process includes providing at least one support service for at least one of integrating, hosting, maintaining and deploying computer-readable code (e.g., program code714) in a computer system (e.g., computer102) including one or more processors (e.g., CPU702), wherein the processor(s) carry out instructions contained in the code causing the computer system to optimally route events in an IT system to solvers. Another embodiment discloses a process for supporting computer infrastructure, where the process includes integrating computer-readable program code into a computer system including a processor. The step of integrating includes storing the program code in a computer-readable storage device of the computer system through use of the processor. The program code, upon being executed by the processor, implements a method of optimally routing events in an IT system to solvers.

While it is understood that program code714for optimally routing events in an IT system to solvers may be deployed by manually loading directly in client, server and proxy computers (not shown) via loading a computer-readable storage medium (e.g., computer data storage unit712), program code714may also be automatically or semi-automatically deployed into computer102by sending program code714to a central server or a group of central servers. Program code714is then downloaded into client computers (e.g., computer102) that will execute program code714. Alternatively, program code714is sent directly to the client computer via e-mail. Program code714is then either detached to a directory on the client computer or loaded into a directory on the client computer by a button on the e-mail that executes a program that detaches program code714into a directory. Another alternative is to send program code714directly to a directory on the client computer hard drive. In a case in which there are proxy servers, the process selects the proxy server code, determines on which computers to place the proxy servers' code, transmits the proxy server code, and then installs the proxy server code on the proxy computer. Program code714is transmitted to the proxy server and then it is stored on the proxy server.

Another embodiment of the invention provides a method that performs the process steps on a subscription, advertising and/or fee basis. That is, a service provider, such as a Solution Integrator, can offer to create, maintain, support, etc. a process of optimally routing events in an IT system to solvers. In this case, the service provider can create, maintain, support, etc. a computer infrastructure that performs the process steps for one or more customers. In return, the service provider can receive payment from the customer(s) under a subscription and/or fee agreement, and/or the service provider can receive payment from the sale of advertising content to one or more third parties.

The present invention may be a system, a method, and/or a computer program product. The computer program product may include a computer readable storage medium (or media) (memory704and computer data storage unit712) having computer readable program instructions714thereon for causing a processor (e.g., CPU702) to carry out aspects of the present invention.

Computer readable program instructions (e.g., program code714) described herein can be downloaded to respective computing/processing devices (e.g., computer102) from a computer readable storage medium or to an external computer or external storage device (e.g., computer data storage unit712) via a network (not shown), for example, the Internet, a local area network, a wide area network and/or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. A network adapter card (not shown) or network interface (not shown) in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device.

Aspects of the present invention are described herein with reference to flowchart illustrations (e.g.,FIG. 3) and/or block diagrams (e.g.,FIG. 1andFIG. 7) of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions (e.g., program code714).

These computer readable program instructions may be provided to a processor (e.g., CPU702) of a general purpose computer, special purpose computer, or other programmable data processing apparatus (e.g., computer102) to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium (e.g., computer data storage unit712) that can direct a computer, a programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function/act specified in the flowchart and/or block diagram block or blocks.

Cloud Computing Environment

Characteristics are as follows:

Service Models are as follows:

Deployment Models are as follows:

Referring now toFIG. 9, a set of functional abstraction layers provided by cloud computing environment50(seeFIG. 8) is shown. It should be understood in advance that the components, layers, and functions shown inFIG. 9are intended to be illustrative only and embodiments of the invention are not limited thereto. As depicted, the following layers and corresponding functions are provided:

Workloads layer90provides examples of functionality for which the cloud computing environment may be utilized. Examples of workloads and functions which may be provided from this layer include: mapping and navigation91; software development and lifecycle management92; virtual classroom education delivery93; data analytics processing94; transaction processing95; and optimal event routing to solvers120-1, . . . ,120-N (seeFIG. 1) for event resolution96.