[Spooky23]

Years ago I worked on an event system that correlated about 500k daily events to about 40 actionable daily events.

A big part of it used prolog to map artifacts to application to business and technical accountable individuals. So if a down storage device offlined a database and broke an app, the business user and storage guy would be called or paged.

My team does this with Splunk today. For probably 50x the compute and 10x the cost.

[shaism]

I see. Cool. So did you generate the inference / reasoning rules to map those 500k events to 40 by hand or are there solutions to automatically discover those rules based on past incidences?

[Spooky23]

This was almost 20 years ago now so yes and no!

We wired up the network monitoring systems which built out the hierarchy of network gear, then used a fairly lightweight filter/rules engine to dedupe and normalize events. For example a Cisco 6500 switch might throw 100 events when an interfere dropped. We could roll 90% of them with the filter. Another device would send a junk “interface down” alert periodically… except an attribute would say “is_down=false” lol

So we pulled in our business-artifact mapping system (this would be ServiceNow today), the on-call rosters, the network topology, runbook/kb, and some other goodies and grabbed the attention of the right person at the right time with specific guidance about what to do.

Basically if a switch, server or critical app failed, we immediately knew what system was impacted, the scope of the impact, who to inform and who to call to resolve. Eventually we expanded it to batch non-critical failures and schedule repairs during outage windows and identify specific dev teams for components of larger apps.

I left after that. It was a fun project and a big break for me, all because I was the only person who had heard of prolog in a happy hour conversation!

[shaism]

Thanks for sharing!

[ux266478]

> are there solutions to automatically discover those rules based on past incidences?

While it's not exactly what he did, the answer to this question is yes. That's called inductive logic programming. Essentially you provide background knowledge, positive examples and negative examples, and it spits out a logic program. It's where the frontier of symbolic AI has sat for a hot second now.

[shaism]

Thanks! There is something magical about those symbolic approaches. But in practice, they seem to often fall short of expectations. Wonder whether there will be another "symbolic AI summer" one day.