Example techniques for adaptive time window-based log message deduplication are described. In an example, message values are obtained from received log messages. Further, the number of log messages received in a time window having a message value is counted. A log message from which the message value is obtained and the counted number are transmitted upon expiry of the time window. A length of a time window in which a subsequent counting of log messages is to be performed is determined based on various parameters.

Example techniques for adaptive time window-based log message deduplication are described. In an example, message values are obtained from received log messages. Further, the number of log messages received in a time window having a message value is counted. A log message from which the message value is obtained and the counted number are transmitted upon expiry of the time window. A length of a time window in which a subsequent counting of log messages is to be performed is determined based on various parameters.

The disclosed technology is directed towards automatically detecting failure states and the cause of the failure. For a network, the technology collects status messages from equipment and customers into batches as they occur. The technology groups and aggregates messages, then transforms the aggregations to the frequency domain. Anomalies induce detectable changes in the particle distribution of a trained particle filter, from which an anomalous spectrogram is generated. The status messages of each device are iteratively removed from the larger set of messages, resulting in reduced subsets that are each aggregated, transformed into a modified spectrogram and compared against the anomalous spectrogram to obtain a distance score. The distance score for each device is used to rank the devices with respect to being the cause of the failure.

The disclosed technology is directed towards automatically detecting failure states and the cause of the failure. For a network, the technology collects status messages from equipment and customers into batches as they occur. The technology groups and aggregates messages, then transforms the aggregations to the frequency domain. Anomalies induce detectable changes in the particle distribution of a trained particle filter, from which an anomalous spectrogram is generated. The status messages of each device are iteratively removed from the larger set of messages, resulting in reduced subsets that are each aggregated, transformed into a modified spectrogram and compared against the anomalous spectrogram to obtain a distance score. The distance score for each device is used to rank the devices with respect to being the cause of the failure.

Various embodiments herein described are directed to methods, apparatuses and computer program products configured for improving alert generation and management in network computer systems. In some embodiments, a client device may generate one or more responder alert data objects for an incident data object based at least in part on global alert policy data object(s) and inline alert policy data object(s). Additional example embodiments provide various example global alert policy creation user interfaces, global alert policy edit user interfaces, inline alert policy creation user interfaces, and/or inline alert policy edit user interfaces that facilitate various user inputs and software operations in an incident alert and management platform.

Various embodiments herein described are directed to methods, apparatuses and computer program products configured for improving alert generation and management in network computer systems. In some embodiments, a client device may generate one or more responder alert data objects for an incident data object based at least in part on global alert policy data object(s) and inline alert policy data object(s). Additional example embodiments provide various example global alert policy creation user interfaces, global alert policy edit user interfaces, inline alert policy creation user interfaces, and/or inline alert policy edit user interfaces that facilitate various user inputs and software operations in an incident alert and management platform.

A computer implemented method of monitoring and controlling a target system, such as a communication network or an industrial process. The method includes receiving information about anomalies in operation of the target system detected by an automated anomaly detection mechanism; automatically determining certainty characteristics of the detected anomalies; submitting detected anomalies to expert evaluation in priority order determined based on the certainty characteristics; and adjusting the determination of certainty characteristics of the detected anomalies and/or the automated anomaly detection mechanism based on results of the expert evaluation.

A method for improving performance of a streaming media session between a plurality of communicating entities. Observation reports are collected from a plurality of monitoring entities. Each observation report includes information pertaining to events observed and recorded at a corresponding monitoring entity. A size of at least one window to be used for analyzing the observation reports is determined. The observation reports are analyzed using the at least one window of the determined size, to determine a correlation between the events across the observation reports. A problem encountered during the streaming media session is identified, based upon the correlation between the events. A notification is sent to at least one of the monitoring entities, based upon the problem. The notification is sent during the streaming media session.

A method for improving performance of a streaming media session between a plurality of communicating entities. Observation reports are collected from a plurality of monitoring entities. Each observation report includes information pertaining to events observed and recorded at a corresponding monitoring entity. A size of at least one window to be used for analyzing the observation reports is determined. The observation reports are analyzed using the at least one window of the determined size, to determine a correlation between the events across the observation reports. A problem encountered during the streaming media session is identified, based upon the correlation between the events. A notification is sent to at least one of the monitoring entities, based upon the problem. The notification is sent during the streaming media session.

Various techniques include detecting noise resulting from data network impairments and analyzing the noise to determine a likely source and location of the data network impairments. The analysis is used to generate noise reports that instruct network technicians how to check network devices for network impairments. The instructions can be provided on portable electronic devices that are further configured to receive data characterizing any impairments identified at the network devices. The data generated by the network technicians can be used to improve the ability of the techniques to correctly identify the source of data network impairments.