PagerDuty, Inc.

Accepted events are processed. Each accepted event is associated with a respective ingested timestamp, a respective processing-start timestamp, and a respective processing-complete timestamp. Events are accepted at a rate of a target rate limit. A current error value is obtained as a difference between a target lag time and a second value. The target lag time indicates a configured maximum time within which an accepted event is to be processed. The second value is an average of differences between the respective processing-complete timestamps and the respective ingested timestamps. A base throttle is obtained based on previous error values and the current error value. The base throttle is smaller than the target rate limit and indicates a maximum number of events per a unit of time to be accepted for processing. Subsequent events are accepted at a new rate obtained from the base throttle.

Updating and utilizing external cached variables in an event management system is disclosed. A unique endpoint is automatically generated for an external cached variable. The unique endpoint enables updates to the external cached variable by an external system that is separate from the event management system. The external cached variable is updated by receiving from the external system via the unique endpoint an updated value for the external cached variable and storing the updated value in a storage location accessible by an event orchestration sub-system of the event management system. Processing events includes receiving an event to be processed according to an orchestration rule that uses the external cached variable in a conditional, retrieving the updated value of the external cached variable in response to receiving the event, and executing the orchestration rule based on the updated value of the external cached variable.

A tree data structure that includes an exponential root node and a plurality of regular child nodes arranged in hierarchical levels is generated. A number of the hierarchical levels corresponds to a specified precision value. A numerical data value is received. The numerical data value is truncated according to the specified precision value to generate a truncated value. Portions of the truncated value are stored in the tree data structure by storing an exponent of the truncated value in the exponential root node, and storing each significant digit of the truncated value in a respective regular child node based on significance level. Statistical information is computed for each node storing a portion of the truncated value. The statistical information is provided in response to a query.

An event management bus is configured to ingest events from a plurality of monitoring tools at a defined acceptance rate. Events received in excess of the acceptance rate are rejected, and a rejection notification is transmitted. For an ingested event, an incident is triggered. A machine-learning model, selected based on a determined incident type, initiates a process to identify a resolution for the incident. An action determined as a result of the process is executed by an action execution tool. Feedback data indicating the effectiveness of the executed action in resolving the incident is received. The machine-learning model is then retrained using the feedback data.

A hash function is applied to word sequences extracted from an event message to generate hash key values. A message vector is constructed having components, where each component corresponding to a hash key value is set to a non-zero value. Similarity scores are computed between the message vector and group vectors, where each group vector represents previously grouped events. It is determined that a similarity score between the message vector and a first group vector exceeds a threshold. In response to determining that the similarity score between the message vector and the first group vector exceeds the threshold, the event message is associated with a first event group corresponding to the first group vector. The first group vector is then updated by adding the message vector to the first group vector.

A relationship network graph is constructed, where nodes represent entities and edges represent interactions between the entities, and wherein at least some of the entities represent respective persons, teams, or organizations of people. A dependency strength is determined from the relationship network graph between a first service associated with a first entity and a second service associated with a second entity. A first alert associated with the first service is received. In response to the first alert, and based on the dependency strength meeting a predefined threshold, a second alert associated with the second service is paused for a predefined pause period. It is determined whether the first alert remains unresolved after expiration of the pause period. If the first alert remains unresolved, the second alert is resumed.

Operations events received from different monitoring systems are transformed into a common event format having standardized fields including a source origin identifier, a source component identifier, a creation time, and event data. Frequency-time analysis is performed on the transformed Operations events by segmenting time-domain data into time bins and determining source origin counts for each time bin. Event clusters are identified based on time-frequency-space envelopes determined from the frequency-time analysis. Each event cluster is associated with resolution metrics including a time-to-resolve value and a number of responders required for resolution. A predictive model is trained using the event clusters and their associated resolution metrics. New incoming Operations events are grouped into a new event cluster. The trained predictive model is applied to the new event cluster to predict resolution requirements, and a remediation action is initiated based on the predicted resolution requirements.

In one embodiment, a computer-implemented method executed using one or more processors of an incident management system comprises receiving a notification of an incident associated with a computer system, and in response to receiving the notification: extracting an error message from the notification; reading a set of computer program code changes that have been implemented in the computer system; matching the error message to the set of computer program code changes and outputting a set of one or more candidate code changes that may correspond to the error message; based on the set of candidate code changes, generating an automatic remediation for the incident; and using the one or more processors of the incident management system, executing the automatic remediation on the computer system.

A computer-implemented method executed using one or more processors of an incident management system, the computer-implemented method comprising accessing one or more data sets of information associated with an incident event corresponding to an incident associated with a computer system; generating a prompt based on the one or more data sets of information, wherein generating the prompt comprises generating a plurality of sub-prompts to be provided to a machine-learning model for generating a report of the incident event in accordance with a predetermined criteria; inputting the prompt into a machine-learning model that has been trained to generate a report of the incident event based on the prompt; outputting, by the machine-learning model, the report of the incident event, wherein the report comprises an analysis of the incident event; transmitting the report to one or more computing devices associated with the computer system.

A machine learning model is applied to extract keywords from an event associated with network operations. A keyword vector is constructed where each keyword extracted is represented as a unique dimension in the keyword vector. The keyword vector is compared against event category vectors associated with event categories to identify potential matches. A relevance score is calculated for each category based on the comparing. The event is classified into one or more categories based on the relevance scores exceeding a predetermined threshold. A user interface configured to visually display and obtain feedback regarding the classifying is generated. At least one of the event categories is updated based on a user feedback received via the user interface and machine learning retraining.