Unsupervised Online Event Ranking for IT Operations

Keeping high service levels of a fast-growing number of servers is crucial and challenging for IT operations teams. Online monitoring systems trigger many occurrences that experts find hard to keep up with. In addition, most of the triggered warnings do not correspond to real, critical problems, making it difficult for technicians to know which to focus on and address in a timely manner. Outlier and concept drift detection techniques can be applied to multiple streams of readings related to server monitoring metrics, but they also generate many False Positives. Ranking algorithms can already prioritize relevant results in information retrieval and recommender systems. However, these approaches are supervised, making them inapplicable in event detection on data streams. We propose a framework that combines event aggregations and uses a customized clustering algorithm to score and rank alarms in the context of IT operations. To the best of our knowledge, this is the first unsupervised, online, high-dimensional approach to rank IT ops events and contributes to advancing knowledge about associated key concepts and challenges of this problem.