The trade-off between expressiveness and interpretability remains a core challenge when building human-centric models for classification and decision-making. While symbolic rules offer interpretability, they often lack expressiveness, whereas neural networks excel in performance but are known for being black boxes. This paper shows a combination of Large Language Models (LLMs) and symbolic programs can bridge this gap. In the proposed LLM-based Symbolic Programs (LSPs), the pretrained LLM with natural language prompts provides a massive set of interpretable modules that can transform raw input into natural language concepts. Symbolic programs then integrate these modules into interpretable decision rules. To train LSPs, we develop a divide-and-conquer approach to incrementally build the program from scratch, where the learning process of each step is guided by LLMs. To evaluate the effectiveness of LSPs in extracting interpretable and accurate knowledge from data, we introduce IL-Bench, a collection of diverse tasks, including both synthetic and real-world scenarios across different modalities. Empirical results demonstrate LSP's superior performance compared to traditional neurosymbolic programs and vanilla automatic prompt tuning methods. Moreover, as the knowledge learned by LSP is a combination of natural language descriptions and symbolic rules, it is easily transferable to humans (interpretable), and other LLMs, and generalizes well to out-of-distribution samples. Our code and benchmark will be released for future research.

Technology refresh is an important component in data-center management that needs to be properly justified because of its high cost and associated migration risk. The goal of this paper is to support the technology refresh decision process for small target IT environments with a statistical learning method that automatically identifies and ranks their servers with problematic behavior based on incident ticket and server attribute data. Since the IT environments are heterogeneous, in practice, a separate model is trained for each of them. To address the small sample sizes available for many IT environments, we develop a random forest transfer learning solution that leverages information from large IT environments in a selective manner. It trains a model for each target IT environment that uses properly derived resampling weights such that the distribution of the pool of all examples from the large accounts is matched to the target distribution of the small target IT environment. In this way, a tailored predictive model that uses the information available from many large IT environments provides good quality predictions for small IT environments. We demonstrate the superior prediction quality of our model on a large set of real data.

Failures of memory modules have been a concern for a long time, as they are costly both in terms of hardware replacement and service disruption. These failures can be preceded by correctable (soft) and then uncorrectable (hard) errors, which accumulate over time. Valuable large scale studies of DIMM errors in the wild [2, 1] analyze in depth hard and soft errors and their correlations with specific sensors. However, little has been reported on how these findings could be used to automatically predict future DIMM failures. We show that by understanding which factors drive such failures, we can build intelligent predictive models with off-the-shelf machine learning techniques to predict DIMM failures ahead of time with high accuracy. Such models not only provide early signs of failures, but also allow administrators to proactively replace DIMMs at risk weeks in advance, thus avoiding "memory loss" of their commodity hardware.

Disks are among the most frequently failing components in today's IT environments. Despite a set of defense mechanisms such as RAID, the availability and reliability of the system are still often impacted severely. In this paper, we present a highly accurate SMART-based analysis pipeline that can correctly predict the necessity of a disk replacement even 10-15 days in advance. Our method has been built and evaluated on more than 30000 disks from two major manufacturers, monitored over 17 months. Our approach employs statistical techniques to automatically detect which SMART parameters correlate with disk replacement and uses them to predict the replacement of a disk with even 98% accuracy.

Configuring enterprise database management systems is a notoriously hard problem. The combinatorial parameter space makes it intractable to run and observe the DBMS behavior in all scenarios. Thus, the database administrator has the difficult task of choosing DBMS configurations that potentially lead to critical incidents, thus hindering its availability or performance. We propose using machine learning to understand how configuring a DBMS can lead to such high risk incidents. We collect historical data from three IT environments that run both IBM DB2 and Oracle DBMS. Then, we implement several linear and non-linear multivariate models to identify and learn from high risk configurations. We analyze their performance, in terms of accuracy, cost, generalization and interpretability. Results show that high risk configurations can be identified with extremely high accuracy and that the database administrator can potentially benefit from the rules extracted to reconfigure in order to prevent incidents.

With the advancement of relational databases, the number of configuration parameters that control memory allocation, concurrency, cost of query plans, I/O optimization, logging, recovery or transaction consistency, increases. Users and even expert database administrators struggle to tune these parameters in order to ensure high availability and performance, and in many cases rely on their experience and some rules of thumb. Research on improving database manageability has shown that this is a critical, but hard problem. In this paper, we propose a highly accurate multivariate statistical model that identifies databases which are bound to raise high volumes of incidents over time. Moreover, we show that by adding detailed configuration parameters to the model, we can better link the problems reported in incident tickets to specific poor database configurations. Finally, we analyze trends of top-ranked parameters and compare their values between problematic and non-problematic databases, in order to suggest better configurations.

We present a novel technique that optimizes the dispatching of incident tickets to the agents in an IT Service Support Environment. Unlike the common skill-based dispatching, our approach also takes empirical evidence on the agent's speed from historical data into account. Our solution consists of two parts. First, a novel technique clusters historic tickets into incident categories that are discriminative in terms of agent's performance. Second, a dispatching policy selects, for an incoming ticket, the fastest available agent according to the target cluster. We show that, for ticket data collected from several Service Delivery Units, our new dispatching technique can reduce service time between $35\%$ and $44\%$.

A company's IT infrastructure delivers the basic hardware, networking, operating system, and middleware support to the business' applications. IT service providers perform incident and problem resolution, as well as user administration and change implementation required to maintain the availability and service provided for the business. As a result, they become increasingly challenged with delivering better, faster, and cheaper services to their customers. With the variety of incident tickets reported on a daily basis, understanding where and how much effort is spent to resolve them is critical. Moreover, analyzing the effort data identifies opportunities for self-service and automation, as well as what modernization strategies businesses should implement to reduce incident volumes and, by association, labor effort. In this paper, we conduct a large scale study on the incident and server factors that affect technician effort and quantify their impact. We show that the nature of the incidents and their complexity, the assigned support groups, as well as the underlying OS type play a major role in how much labor effort is spent towards resolving such tickets.

In today's commercial data centers, the computation density grows continuously as the number of hardware components and workloads in units of virtual machines increase. The service availability guaranteed by data centers heavily depends on the reliability of the physical and virtual servers. In this study, we conduct an analysis on 10K virtual and physical machines hosted on five commercial data centers over an observation period of one year. Our objective is to establish a sound understanding of the differences and similarities between failures of physical and virtual machines. We first capture their failure patterns, i.e., the failure rates, the distributions of times between failures and of repair times, as well as, the time and space dependency of failures. Moreover, we correlate failures with the resource capacity and run-time usage to identify the characteristics of failing servers. Finally, we discuss how virtual machine management actions, i.e., consolidation and on/off frequency, impact virtual machine failures.

In this paper, we introduce a novel approach for incident ticket classification that aims at minimizing the manual labelling effort while achieving good-quality predictions. To accomplish this, we devise a two-stage technique that employs hierarchical clustering using a combination of graph clustering (community finding) and topic modelling as first stage, followed by either another round of hierarchical clustering or an active learning approach as second stage. We evaluate the performance of our method in terms of manual labelling effort, prediction quality and efficiency on three real-world datasets and demonstrate that classical approaches to text classification are not well suited for incident ticket texts.

Technology refresh is an important component in data center management. The goal of this paper is to assess the impact of HW and OS currency on server availability based on a large set of incident tickets and server attributes data collected from several different IT environments. In order to achieve this we first identify the server failure incidents using a machine learning method for automatic ticket classification. Then we conduct the data analysis to inspect the impact of HW and OS type along with their currency on the rates of server failures. This can further be used to derive guidelines to support the technology refresh decisions in the data centers.

Today the decision of when to modernize which elements of the server HW/SW stack is often done manually based on simple business rules. In this paper we alleviate this problem by supporting the decision process with an automated approach based on incident tickets and server attributes data. As a first step we identify and rank servers with problematic behavior as candidates for modernization using a random forest classifier. Second, this predictive model is used to evaluate the impact of different modernization actions and suggest the most effective ones. We show that our chosen model yields high quality predictions and outperforms traditional linear regression models on a large set of real data.

This application track paper describes the Change Risk Expert (CRE) tool, which is designed to help reduce change failure rates. CRE assists Change Requesters to adequately plan changes by semi- automatically classifying change tickets, by informing about past failure rates and reasons, by systematically managing change risks, and by providing standard change implementation plans.