Systems, devices, media, and methods are presented for splitting decision trees between server and client. The client of the systems and methods sends a configuration query. The server of the system and method receives the configuration query. The server retrieves Config rule(s) according to the configuration query. Each of the Config rule(s) can be represented by decision tree(s). The server evaluates the decision tree(s). If a definitive True or False cannot be derived from the evaluation using server knowledge, the server prunes the decision tree(s) and returns them to client side for further evaluation.

A system described herein may use automated techniques, such as machine learning techniques, to identify network events (e.g., based on user-submitted reports and/or system-generated alerts). The system may identify a type and/or attributes of the network event, and may identify past network events that share the same or similar attributes. An estimated time to remediate the network event, and/or one or more remedial measures, may be determined and implemented based on remediation measures taken to remediate the past network events. The determined remedial measures may include one or more temporary remedial measures effected until a permanent solution is put into place. Users who are affected, or who are likely to be affected, may be contacted to indicate the estimated remediation time. Feedback may be used to refine the estimation and/or remediation for future similar network events.

A fault root cause analysis method and apparatus are provided. The method includes: obtaining a first alarm event set, where the first alarm event set includes a plurality of alarm events; for a first alarm event in the first alarm event set, extracting a feature vector of the first alarm event, where a part of or all features of the feature vector are used to represent a relationship between the first alarm event and another alarm event in the first alarm event set; and determining, based on the feature vector of the first alarm event, whether the first alarm event is a root cause alarm event. In this application, whether the first alarm event is the root cause alarm event is determined based on a feature vector of the relationship between the first alarm event and the another alarm event, and the accuracy of fault root cause identification is improved.

A system and method for the aggregation and grouping of previously identified, causally related abnormal operating condition, that are observed in a monitored environment, is disclosed. Agents are deployed to the monitored environment which capture data describing structural aspects of the monitored environment, as well as data describing activities performed on it, like the execution of distributed transactions. The data describing structural aspects is aggregated into a topology model which describes individual components of the monitored environments, their communication activities and resource dependencies and which also identifies and groups components that serve the same purpose, like e.g. processes executing the same code. Activity related monitoring data is constantly monitored to identify abnormal operating conditions. Data describing abnormal operating condition is analyzed in combination with topology data to identify networks of causally related abnormal operating conditions. Causally related abnormal operating conditions are then grouped using known topological resource and same purpose dependencies. Identified groups are analyzed to determine their root cause relevance.

Described herein are improvements for generating courses of action for an information technology (IT) environment. In one example, a method includes identifying a first course of action for responding to an incident type in an information technology environment and generating a simulated incident associated with the incident type. The method further includes initiating performance of the first course of action based on the generation of the simulated incident. The method also includes, upon reaching a particular step of the first course of action that prevents the performance of the first course of action from proceeding, providing a first simulated result that allows the performance of the first course of action to proceed.

A system described herein may use automated techniques, such as machine learning techniques, to identify network events (e.g., based on user-submitted reports and/or system-generated alerts). The system may identify a type and/or attributes of the network event, and may identify past network events that share the same or similar attributes. An estimated time to remediate the network event, and/or one or more remedial measures, may be determined and implemented based on remediation measures taken to remediate the past network events. The determined remedial measures may include one or more temporary remedial measures effected until a permanent solution is put into place. Users who are affected, or who are likely to be affected, may be contacted to indicate the estimated remediation time. Feedback may be used to refine the estimation and/or remediation for future similar network events.

Systems and methods for predicting device failure, including inputting a plurality of records for electronic communication devices, each including one or more attributes and a label, as a table to a modeling algorithm, wherein there are separate tables for each period in a time sequence; building a multi-stage decision tree from the time sequence of records using the modeling algorithm running on a processor device; inputting a record for a device having an empty label value into the decision tree to determine the likelihood of entity failure; and reporting a predicted failure for the device to a user on a display to initiate replacement before a next time period.

In one embodiment, an issue analysis service obtains telemetry data from a plurality of devices in a network across a plurality of time intervals. The service detects a failure event in which a device in the network is in a failure state. The service clusters the telemetry data obtained prior to the failure event into rounds according to time intervals in which the telemetry data was collected. Each round corresponds to a particular time interval. The service applies a machine learning-based classifier to each one of the rounds of clustered telemetry data to identify one or more common traits appearing in the telemetry data for each round. The service generates a trait change report indicating a change in the one or more common traits appearing in the telemetry data across the rounds leading up to the failure event.

Various examples of the present invention provide a server for providing information of an electronic device, and the server can comprise: a communication unit for receiving, from at least one first electronic device, at least one piece of information of the first electronic device; and a control unit for determining, from the received information, a current state among a plurality of states preset for the first electronic device, and controlling the first electronic device such that state prediction information of the first electronic device is transmitted to a second electronic device if the determined current state satisfies a preset notification condition on a state diagram in which a relationship among the plurality of states is set. Additionally, other examples could be possible besides the various examples of the present invention.

A system is provided herein that can correlate service issues with system telemetry associated with the software session associated with those service issues. Using a statistical approach, the system can evaluate data across numerous software sessions to rank the importance of the reported service issues. To accomplish the ranking, the system can parse the reports of service issues on a periodic basis, can extract telemetry identifiers (IDs) from the logs, can query the telemetry, may compute the relative importance of detected issues (in the context of calls going on for that day), and then can report this impact back to the service issue database.