Method, system, and program for identifying problem graphs in networks

Abstract

A method and system for identifying a problem graph in an information technology infrastructure network includes selecting a set of nodes in a topology, where the nodes of the topology represent resources in the information technology infrastructure network, querying historical time series data for the selected nodes, where the time series data records changes in state of the resources represented by the nodes, analyzing the time series data for the selected nodes over a problem period to develop a set of historical directionality rules that define one or more historical problem graphs, and searching the historical problem graph for currently problem state nodes to determine nodes that may be causing and / or affected by the current problem.

Description

[Technical Field]

[0001] The present invention relates to the management of information technology (IT) systems, and more particularly to identifying a problem graph from which a problem tree can be obtained in an IT infrastructure network. [Background technology]

[0002] As information technology (IT) infrastructures expand, managing IT systems has become an increasingly complex problem for large organizations. Many organizations employ network operations centers (NOCs), where trained operators utilize IT operations management software to diagnose and remediate problems, known as incidents, in real time within the IT infrastructure. Incidents are typically caused by problems with physical or virtual devices within the IT infrastructure. These resources often have one or more other resources, known as child resources, depending on them, which may themselves have children depending on them. Thus, an incident can consist of alerts from multiple resources, each potentially indicating a localized problem.

[0003] An incident typically has a single root cause problem on a single problematic resource. Each resource in an IT infrastructure typically has a variety of problem states, each with a unique set of impacts on child resources. Often, an operator can diagnose the root cause problem by determining the impact on child resources through an examination of the alerts associated with a given incident.

[0004] Similar to resources, dependencies between resources can also be represented as virtual or physical links, such as a microservice application relying on a virtual container runtime or a bare metal server relying on a physical connection to a network switch.

[0005] These relationships can be represented using an extended IT network topology graph, which represents the IT network as a graph with resources modeled as nodes and connections between resources modeled as edges.

[0006] During an incident, alerts occur throughout the extended IT network topology graph. Typically, an incident is triggered by one or more resources going into a problem state, which may cascade down to child resources to form a problem graph, or in fact, one or more child resources may go into a problem state and cascade upstream to form this problem graph.

[0007] Currently, operators utilize their domain knowledge to manually identify the problem graph. The operator aims to diagnose the root cause problem by inspecting the network topology and manually identifying patterns presented by the problem graph to find the root cause. This allows the operator to collect related events in the identified graph to simplify the complexity of the incident, thus reducing the mean time to know (MTTK). Summary of the Invention

[0008] According to one aspect of the present invention, there is provided a computer-implemented method for identifying a problem graph in an information technology infrastructure network, the method including: selecting a set of nodes in a topology, the nodes of the topology representing resources in an information technology (IT) infrastructure network; querying historical timeseries data of the selected nodes, the time series data recording changes in state of the resources represented by the nodes; and analyzing the time series data of the selected nodes over a problem period to create a set of historical directional rules that define one or more historical problem graphs.

[0009] This allows for problem graphs to be inferred based on historical patterns over time from historical state change data, without the need for heuristic rules, and allows for the discovery of relationships that might otherwise be ignored.

[0010] Each rule in the set of history direction rules may identify an indicative problem subgraph and a consequent problem subgraph formed from a subset of node-state pairs that have a direction dependency.

[0011] Analyzing the time series data of the selected nodes may include identifying problem time periods in which adjacent or nearby nodes are changing problem states indicating causal relationships, and applying an association rule mining algorithm to determine whether the causal relationships emerge consistently.

[0012] Analyzing the time series data of the selected nodes may include creating transactions based on problem time periods, performing association rule mining on the transactions to identify a subset of items in the form of node-state pairs that typically co-appear across multiple transactions and directional dependencies between the node-state pairs, and creating a set of historical directional rules that define a historical problem graph based on the subset of node-state pairs and the directional dependencies of the node-state pairs. Creating transactions based on problem time periods may include defining a quiet period threshold for defining a single problem time period and defining a distance threshold for nodes related to the same problem.

[0013] The method may include assigning a confidence score to each edge of the historical problem graph based on the scores generated for the historical directional rules.

[0014] The method may include searching a historical problem graph for a current problem state node to determine nodes that may be the cause of the current problem and nodes that may be affected by the current problem. The method may also include ordering the historical problem graph, reading the historical problem graph to find root nodes and / or child nodes away from the problem node to determine the root cause of the problem and / or predict affected resources. The ordering of the graph may be based on a combination of confidence scores assigned to each edge of the historical problem graph based on the scores created for each historical directionality rule. The prediction of the root node and / or child nodes may be based on confidence scores assigned to edges in the historical problem graph.

[0015] The method may define a topology of an information technology infrastructure network, where nodes represent virtual or physical resources with connectivity defined by edges in the topology, and include labeling nodes for delineating domains and defining subtopologies. Selecting a set of nodes in the topology may include selecting the nodes by their labeled domains. The method may include periodically collecting state data from resources represented by the nodes and storing the state data in a time-series graph data store suitable for queries. The method may include configuring a time interval and a problem time period for the time-series data.

[0016] According to another aspect of the present invention, there is provided a computer-implemented method for identifying problem graphs in an information technology infrastructure network, the method including: detecting a set of nodes in a topology with a current problem state, where the nodes of the topology represent resources in the information technology infrastructure network; searching for the problem state node in one or more historical problem graphs; ordering the historical problem graphs in order of prevalence; reading one or more of the ordered historical problem graphs to find root nodes and / or child nodes away from the problem node; and obtaining a problem tree with state changes of the problem node to create an ordered list of potentially causal nodes and / or an ordered list of potentially affected nodes.

[0017] The method has the advantage that the historical problem graph can be used when evaluating similar problem operational events in the IT infrastructure network and matching them with anomalous topology patterns, and the historical problem graph can be used to predict root cause problem nodes and / or predict affected nodes by loading a problem tree based on the historical problem graph.

[0018] According to a further aspect of the present invention, there is provided a system for identifying a problem graph in an information technology infrastructure network, the system including a processor and a memory configured to provide computer program instructions to the processor to perform the functions of components: a node selection component for selecting a set of nodes in a topology, the nodes of the topology representing resources in the information technology infrastructure network; a state change data query component for querying historical time series data of the selected nodes, the time series data recording changes in state of the resources represented by the nodes; and an analysis component for analyzing the time series data of the selected nodes over a problem period to create a set of historical directional rules that define one or more historical problem graphs.

[0019] The analysis component may include a rules component for creating a set of historical directional rules that define a historical problem graph, each rule in the set of historical directional rules identifying an indicative problem subgraph and a consequent problem subgraph formed from a subset of node-state pairs that have directional dependencies.

[0020] The analysis component may further include a problem period component for identifying problem time periods during which adjacent or nearby nodes are changing problem states indicating causal relationships, and an association rule mining component for determining whether causal relationships emerge consistently by applying an association rule mining algorithm.

[0021] The analysis component may include a transaction component for creating transactions based on the problem time period, and an association rule mining component may perform association rule mining on the transactions to identify a subset of items in the form of node-state pairs that typically co-appear across multiple transactions and directional dependencies between the node-state pairs, and create a set of historical directional rules that define a historical problem graph based on the subset of node-state pairs and the directional dependencies of the node-state pairs.

[0022] The Transactions component can create transactions based on problem time periods, including defining a quiet period threshold to define a single problem time period, and defining a distance threshold for nodes related to the same problem.

[0023] The system may further include a current problem analysis component for searching the past problem graph for current problem state nodes to determine nodes that may be causing and affected by the current problem.

[0024] The system may include a topology definition component for defining a topology of the information technology infrastructure network, wherein nodes represent virtual or physical resources having connectivity defined by edges in the topology, and a labeling node for delineating domains and defining subtopologies. A node selection component for selecting a set of nodes in the topology may select the nodes by the labeled domains.

[0025] The system may include a state data collection component for periodically collecting state data from resources represented by the nodes and storing the state data in a time series graph data store suitable for querying. The system may include a configuration component for configuring time intervals and problem time periods for the time series data.

[0026] According to a further aspect of the present invention, there is provided a system for identifying problem graphs in an information technology infrastructure network, the system including a processor and a memory configured to provide computer program instructions to the processor to perform functions of components: a node detection component for detecting a set of nodes in a topology with a current problem state, the nodes of the topology representing resources in the information technology infrastructure network; a node lookup component for searching for problem state nodes in one or more historical problem graphs; a problem graph ordering component for ordering the historical problem graphs by occurrence rate; a problem graph reading component for reading one or more of the ordered historical problem graphs to find root nodes and / or child nodes away from the problem node; and a reporting component for obtaining a problem tree with state changes of the problem node and creating an ordered list of potentially causal nodes and / or an ordered list of potentially affected nodes.

[0027] According to a further aspect of the present invention, there is provided a computer program product for identifying problem graphs in an information technology infrastructure network, the computer program product comprising a computer-readable storage medium having program instructions embodied thereon, the program instructions being executable by the processor to cause the processor to: select a set of nodes in a topology, the nodes of the topology representing resources in the information technology infrastructure network; query historical time series data of the selected nodes, the time series data recording changes in state of the resources represented by the nodes; and analyze the time series data of the selected nodes over a problem period to create a set of historical directional rules that define one or more historical problem graphs.

[0028] The computer program product may include program instructions executable by a processor to cause the processor to: detect a set of nodes in a topology with a current problem state, where the nodes of the topology represent resources in an information technology infrastructure network; search for the problem state node in one or more historical problem graphs; order the historical problem graphs by occurrence rate; read one or more of the ordered historical problem graphs to find a root node and / or child nodes away from the problem node; and obtain a problem tree with state changes of the problem node to create an ordered list of potentially causing nodes and / or an ordered list of potentially affected nodes.

[0029] In some embodiments of the present invention, the computer-readable storage medium is a non-transitory computer-readable storage medium, and the computer-readable program code is executable by a processing circuit (or a set of processors). [Brief explanation of the drawings]

[0030] [Figure 1] 1 is a schematic diagram of an exemplary embodiment of one aspect of the method according to the present invention; [Figure 2A] FIG. 1 illustrates a sub-topology used in aspects of the present invention. [Figure 2B] FIG. 1 illustrates a sub-topology used in aspects of the present invention. [Figure 3A] 1 is a flow chart of an exemplary embodiment of one aspect of a method according to the present invention. [Figure 3B] 3B is a schematic flow diagram illustrating an example of the method of FIG. 3A. [Figure 4A] 4 is a flow chart of an exemplary embodiment of another aspect of the method according to the present invention. [Figure 4B] 4B is a schematic flow diagram illustrating an example of the method of FIG. 4A. [Figure 5] 1 is a block diagram of an exemplary embodiment of a system according to the present invention. [Figure 6] FIG. 1 is a block diagram of one embodiment of a computer system or cloud server in which the present invention may be implemented. [Figure 7] 1 is a schematic diagram of a cloud computing environment in which the present invention may be implemented. [Figure 8] 1 is a diagram of an abstraction model layer of a cloud computing environment in which the present invention is implemented. DETAILED DESCRIPTION OF THE INVENTION

[0031] It will be understood that for simplicity and clarity of illustration, elements shown in the figures have not necessarily been drawn to scale. For example, the dimensions of some of the elements may be exaggerated relative to other elements for clarity. Further, where considered appropriate, reference numerals may be repeated among the figures to indicate corresponding or analogous features.

[0032] A method and system are provided for automatically identifying problem graphs by utilizing historical relationships between network resources over time and their changes in state over time to infer rules for predicting the root cause of future similar incidents. Rule mining identifies the problem graph, which is then used to identify problem trees during operational events.

[0033] In this description, the following definitions are used: A "network topology" is a representation of an IT network as a graph with resources modeled as nodes and connections between resources modeled as edges. A "network subtopology" is a subgraph of the graph representing the IT network. A "problem graph" is a network subtopology that contains only nodes that are in problem states. A "problem tree" is a node in the problem graph with only edges representing problem causal relationships that describe the flow of problem states through the network subtopology.

[0034] The described method isolates relevant areas of connected topology components and creates node-state pairs that represent the state of the nodes during a given time interval. These pairs are then bucketed with pairs from other nodes in the associated topology during the same time interval. Association rule learning is performed on these buckets to identify relationships over time between node-state pairs in the form of rules. These rules are used to construct one or more problem graphs for a given topology. When these node-state pairs later occur in a production environment, they can be used to determine or predict a problem tree for a given incident.

[0035] The described method enables automatic identification of problem graphs regardless of the problem context, thereby reducing the operator domain knowledge required to diagnose the problem graph. By applying a rule mining algorithm over a time period, problem graphs can be identified within existing stateful network topologies.

[0036] To help operators quickly resolve incidents, the problem graph is used to identify the root cause of a problem using rules defined by previous incidents. This identification is done using both the structure of the network topology in the form of a static graph and historical instances of problem state changes within this network topology. The connected topology is used as a basis to create a basic structure that guides the rule mining algorithm and applies to future equivalent topology structures.

[0037] The method combines the topology connectivity of network resources and their state changes over time to infer rules for predicting the root cause of future similar incidents. The method uses the state changes over time in combination with the connectivity to determine the problem graph associated with the root cause, allowing the system to mine rules without external influence.

[0038] The ultimate goal may be to show the operator the likely root cause of the issue and the resources that are affected.

[0039] The method rigorously matches anomalous topological patterns using previous similar events and structures, thus providing a robust method for identifying anomalous topological patterns in established topological structures.

[0040] The described method helps operators find the root cause of a given issue without the need to prepare heuristic rules. Inferring a problem graph through rule mining on historical data allows discovering relationships between components in a system that may have otherwise been ignored as a result of an event.

[0041] Referring to FIG. 1, a schematic diagram 100 illustrates an exemplary embodiment of a method for collecting data for use in the presently described method for identifying the root cause of a problem in an IT infrastructure network.

[0042] The method defines 101 a topology 120 of an IT infrastructure network, including delineated domains used to define subtopologies. The topology represents the IT infrastructure network, and nodes represent physical and virtual entities within the infrastructure with connections through entities defined in the topology. The topology graph may be stable with respect to the nodes, or it may change over time, for example, as nodes are replaced by other nodes of the same or similar type. In some cases, the resources represented by the nodes may change significantly, requiring further training to update existing discovered rules.

[0043] In a defined topology graph, the state of its nodes changes over time as a result of incidents, and these changes over time are used in the described method. The concept of incidents as identified fault states adds another dimension to the data monitored by the topology graph.

[0044] In this example, topology 120 has three nodes: server 121, disk 122, and central processing unit (CPU) 123. In reality, the topology may be a larger network spanning multiple domains. The states of the nodes are: high I / O wait for server 121, disk failure for disk 122, and online state for CPU 123.

[0045] Status data about each node is periodically collected 102 from the operational sub-topology 120 by probes 111, 112, 113 that monitor the environment, and this is persisted in a graph database, such as via a central discovery service.

[0046] Historical topology status data is compiled 103 in a time-series format into a time-series graph data store 110 suitable for querying. This data allows problem graphs to be modeled as state changes across a given set of nodes. The graph data store may allow subtopologies to be queried at will.

[0047] While the described method applies to complete topologies, topologies are often composed of subgraphs representing subtopologies delineated by domain concepts such as business owners, applications, or management teams. Incidents and their associated problem graphs are also often examined in light of these delineations, and thus a topology system may have a way to label and separate subtopologies using these delineations, and may distinguish problem graphs within these subtopologies rather than the graph as a whole. Figure 2A shows a diagram of a subtopology 200, and Figure 2B shows a problem graph 210 within subtopology 200.

[0048] Referring to FIG. 3A, a flow diagram 300 illustrates an exemplary embodiment of the presently described method for identifying a problem graph of resources in an IT infrastructure network.

[0049] As described in connection with Figure 1, a defined topology 120 of a static information technology infrastructure network is referenced, with nodes representing virtual or physical resources with connections defined by edges in the topology. An associated time series graph data store 110 is also referenced, with intervals and sample periods as configurable parameters. The collection and storage of time series data is performed as a separate process independent of the historical problem graph identification described in flowchart 300 of Figure 3A.

[0050] The method may query 301 the historical time series data store 110 generated by the method of FIG. 1 for the topology 120 to obtain historical time series data for a selected set of nodes. The set of nodes may be the entire topology or a subtopology of interest within the topology, such as a subtopology of a given domain or subset of a domain. The set of nodes may be referred to as a subtopology. A selected set of nodes in a topology has states associated with it stored in the historical time series data at equal time intervals.

[0051] The existing time-series graph data store 110 of topology data can be freely queried to obtain data over a given time period about connected topology components. These queries also provide data about each node in the graph, including but not limited to the name, method of unique identification, and the current state of the device represented by a given node.

[0052] Each subtopology graph is thus collected, containing state information at each time interval, to identify past problem periods within each subtopology.

[0053] For each sub-topology, an analysis is performed 302 on the time interval data to identify problem periods within the sub-topology where adjacent or nearby nodes enter, transition between, or exit problem states at similar times. These problem periods may indicate direct or transitive causal relationships.

[0054] To determine whether these causal relationships are clear, we determine whether they emerge consistently. We perform this task using known association rule mining techniques over the time period in question to identify a subset of node-state pairs across the time period in question (303).

[0055] To utilize association rule mining, the method first forms so-called "transactions," which are standardized inputs for association rule mining. This method is described in the following pseudocode:

[0056] In association rule mining, a transaction represents an instance of a set of items. Association rule mining algorithms typically identify subsets of items that co-occur across multiple transactions, as well as directional dependencies between items. Support and confidence hyperparameters allow tuning the algorithm's behavior to set the minimum number of rule occurrences and the likelihood of co-occurrence, respectively.

[0057] Association rule mining is performed on transactions of a set of node-state pair items, where each transaction is one of the problems from the previous step. This produces a set of directional association rules. Each association rule consists of a premise and a conclusion. The premise is a set of node-state pairs that represent an initial problem subgraph in the environment. The conclusion is a set of node-state pairs that represent a predicted problem graph, typically identified as co-occurring with the problem subgraph in the premise.

[0058] The method may create a set of history directionality rules that define a problem graph based on the subset of node-state pairs and the directional dependencies of the node-state pairs 304. Each rule in the set of history directionality rules may identify an indicative problem subgraph and a consequent problem subgraph formed from the subset of node-state pairs that have directional dependencies.

[0059] Each association rule represents two parts of a problem graph: an antecedent (or instruction) problem subgraph and a conclusion problem subgraph, which together form a complete problem graph that can be used to identify and predict the problem graphs of production incidents.

[0060] The output of the association rule mining process is a set of historical directional rules, where each rule represents an edge between two nodes, and all connected rules together form a historical problem graph.

[0061] The corresponding edge of the historical problem graph may be assigned a confidence score for each rule produced by the association rule mining algorithm (305).

[0062] The method further described in flowcharts 400 and 410 of Figures 4A and 4B, respectively, may use the identified historical problem graph to predict and identify a problem tree for an operational incident 306. A network topology problem tree may be obtained from the problem graph that has only edges that indicate the flow of problem states, and therefore is a tree rather than a graph because it does not have cycles (loops).

[0063] The described application of association rule mining creates transactions from a historical subtopology graph based on problem periods encountered by neighboring resources. Each transaction consists of an item representing a node-state pair in the graph.

[0064] Example pseudocode

[0065] The pseudocode provided below outlines an exemplary method for forming association rules mining transactions for node-state pairs based on problem periods in historical subtopology data.

[0066] At this stage, two additional hyperparameters are introduced.

[0067] QUIET_PERIOD_THRESHOLD - The quiet period threshold is a configurable time period that acts as an upper limit between resource state changes that are considered candidates to represent the same problem.

[0068] MAX_DIST_THRESHOLD - The maximum distance threshold represents the maximum distance between resources to be considered as candidates representing the same problem. This distance is calculated by a given distance function, denoted "dist", which can be either the number of hops between resources in the graph, a standard distance metric based on the number of hops between problem resources, or a more complex metric that encodes domain knowledge.

[0069] Pseudocode: INPUT: res_pairs # Subtopology (resource, state) pairs at each time interval. intervals # List of sampled interval times. # Create an empty list of problem periods and active problem periods. problems = [] active_problems = [] # Iterate over each time interval t. for t in intervals: # Get the (resource, state) pair at time t of the subtopology. sub_topo_t = res_pairs[t] # Iterate over each (resource, state) pair in the time interval. for (res, state) in sub_topo_t: # Create an empty array of issues this resource is associated with. merge_problems = [] # Iterate over the active issues. for curr_problem_period in active_problems: # As determined by the active_t of the current problem # If the issue is no longer active (outside the quiet period threshold), # Remove the question from the active list and skip to the next question. if t - curr_problem_period.active_t> QUIET_PERIOD_THRESHOLD: problems.add(curr_problem_period) active_problems.remove(curr_problem_period) continue # Iterate over the nodes in the problem. for p_node incurr_problem_period.nodes: # Check if the problem already contains this resource. ifres == p_node.res: # If the node is no longer in the problem state, # Mark as resolved and skip to the next node. if not isProblemState(state): p_node.resolved = True continue # Otherwise, update the node with the new state and time, then # Add that node to the array of problems encountered. p_node.state = state p_node.t = t merge_problems.add(curr_problem_period) continue # If the nodes are different, check if the current node is in a problem state, # Whether two nodes are within the distance threshold and in a problem state within the quiet period Check the #. if isProblemState(state)and t - p_node.t <= QUIET_PERIOD_THRESHOLD and dist(res, p_node.res) <= MAX_DIST_THRESHOLD: # If applicable, add the current node to the issues and return a list of the issues encountered. # Update. curr_problem_period.nodes().put({res, state, t, resolved: False}) curr_problem_period.active_t = t merge_problems.add(curr_problem_period) # After iterating over the active issues, this resource # Check if it is associated with two or more issues. if len(merge_problems)>1: # Where applicable, they should be merged into a single connected issue. new_problem ={active_t: t, nodes: []} active_problems.add(new_problem)

[0070] Referring to FIG. 3B, a schematic flow chart 310 further illustrates the method of FIG. 3A.

[0071] The time series data of a selected sub-topology 321-323 of a selected set of nodes is queried 311. At each time interval of the time series, some nodes in the sub-topology 321-323 may be in a problem state (denoted by an X next to the node).

[0072] A problem period is identified as a duration of time in the time series data during which one or more nodes are in a problem state (312). In this figure, the time period from the sub-topology state shown at 322 to the sub-topology state shown at 323 is considered to be the problem time period. It is assumed that these problem states may be related.

[0073] An association rule mining algorithm is run on the nodes 324, represented as node-state pairs in the problem state, to identify relationships, defined as rules between node-state pairs on different nodes 313. For example, a rule of the form "when node A is in error state 1, node B tends to be in error state 2" may be identified.

[0074] In FIG. 3B, the identified node state rules 313 indicate the following: An error condition on the virtual network indicates an error condition on the virtual machine, An error condition on the virtual machine indicates an error condition on the baseband unit, An error condition on a virtual machine indicates an error condition on the virtual CPU, An error condition on the baseband unit indicates an error condition on the virtual network, An error condition in the baseband unit indicates an error condition on the remote radio head, An error condition on a virtual machine indicates an error condition on the virtual storage.

[0075] The rules are used as edges in a new graph defined (at 314) called the past problem graph 325, which represents the expected flow of the problem through the sub-topology selected based on the node-state pair rules identified (313). The problem graph 325 may be thought of as representing all the possible routes that a problem may cascade through the network.

[0076] Once the historical problem graph 325 is defined (314), it may be used in the future when a new live problem 331 occurs on the selected sub-topology 330. The historical problem graph 325 is used to identify and predict error conditions that will unfold in real time, which are identified (315) by a problem tree 326. In the problem tree 326, the symbol (X) is used to indicate a node 327 that is in a problem state, and the symbol (!) is used to indicate a node 328 that is predicted to enter a problem state.

[0077] In the illustrated example, virtual network node 327 is shown to be in an error state. By examining past problem graph 325, it can be seen that this graph typically indicates problems with virtual machines, which in turn indicate problems with virtual CPUs and virtual storage. Thus, a user can predict that nodes 328, which represent virtual machines, virtual CPUs, and virtual storage, will likely soon enter an error / problem state.

[0078] Referring to FIG. 4A, a flow diagram 400 illustrates an exemplary embodiment of a method for identifying a problem tree for state changes of a working node.

[0079] Given a historical problem graph of an IT infrastructure network constructed using the method described in connection with Figures 3A and 3B, when the state of several nodes changes to a problem state, the method automatically identifies the associated problem graph, and thereby the problem tree, which enables an operator to better find the cause of this problem state and to predict which resources may be affected by this problem.

[0080] We assume that the topology of the IT infrastructure network is provided with significant historical data, and that the historical problem graph is constructed from association rules generated from this historical data.

[0081] The method may detect 401 that some nodes in the network have entered a problem state. This detection may trigger 402 a search for the given problem state node in a historical problem graph. One or more historical problem graphs are found, and if multiple graphs are found, they are ordered in terms of frequency of occurrence 403. The graphs may be ordered by obtaining a graph score for each graph by combining the confidence scores assigned to the graph edges, where the confidence score is created by an association rule mining algorithm for each rule corresponding to the graph edges.

[0082] The method may read 404 a top-ranked problem graph, which may have a root node and possibly child nodes off the problem node. A given problem state node may be the antecedent of multiple association rules for predicting likely affected child nodes. A given problem state node may additionally or alternatively be the conclusion of an association rule for predicting a likely problem root node. The edge confidence scores may be used to determine weightings for predicted affected child nodes and / or predicted likely problem root nodes.

[0083] In some embodiments, several highest ranking problem graphs may be loaded to obtain multiple possible predictions.

[0084] The method may present the user with a problem tree with state changes of the problem node, along with an ordered list of potentially causative nodes (the root of the problem graph) and an ordered list of nodes potentially affected by this problem (child nodes of the problem node in the problem graph) 405. In some embodiments, the problem tree itself is not presented to the operator, but rather a simple list of possible root nodes and potentially affected nodes may be provided.

[0085] The proposed method may be used to assist operators in both Root Cause Analysis (RCA) and predictive analysis from the same computed problem graph.

[0086] Referring to FIG. 4B, a schematic flow chart 410 further illustrates the method of FIG. 4A.

[0087] The method detects 411 working nodes in a problem state, as shown in sub-topology 420 with problem nodes indicated by a symbol (X). In this example, in working sub-topology 420, virtual network 421 and virtual machine 422 are in an error state.

[0088] Using the past problem graph 430 for matching, we find 412 child nodes 433, 434 away from problem nodes 431, 432. This predicts that virtual CPU 433 and virtual storage 434 are likely to enter an error state (highlighted in gray) because they are child nodes away from virtual machine 432. This prediction is made because there is a causal edge 435 in problem graph 430 between virtual machine 432 and both virtual CPU 433 and virtual storage 434.

[0089] The operator may be presented with a problem tree 440 (413) showing problem nodes 441, 442 and predicted affected nodes 443, 444.

[0090] In another scenario where virtual machine network 421 is not in an operational problem state but virtual machine 422 is in a problem state, machine network 421 may be predicted to be the root cause node in the displayed problem tree.

[0091] Referring to FIG. 5, a block diagram illustrates an exemplary embodiment of a computer system 500 including a problem graph identification system 510.

[0092] The computer system 500 includes at least one processor 501, circuitry for performing the functions of the described components, which may be a hardware module or a software unit running on the at least one processor. Multiple processors running parallel processing threads may be provided to allow some or all of the functions of the components to be processed in parallel. The memory 502 may be configured to provide the at least one processor 501 with computer instructions 503 for performing the functions of the components.

[0093] The problem graph identification system 510 includes a topology definition component 511 for defining a topology 505 of a static information technology infrastructure network, where nodes represent virtual or physical resources with connectivity defined by edges in the topology and including labeling nodes for delineating domains and defining sub-topologies, and a state data collection component 512 for periodically collecting state data from the resources represented by the nodes and storing the state data in a time series graph data store suitable for querying.

[0094] The problem graph identification system 510 may include a node selection component 513 for selecting a set of nodes in a topology, where the nodes of the topology represent resources in an information technology infrastructure network, and the node selection component 513 may select the set of nodes in the topology by labeled domain.

[0095] The problem graph identification system 510 includes a state change data query component 514 for querying historical time series data for a selected node, the time series data recording changes in state of the resource represented by the node. A configuration component 515 may configure the time intervals and problem time periods for the time series data.

[0096] The problem graph identification system 510 includes an analysis component 520 for analyzing time series data for selected nodes over a problem period to create a set of historical directional rules that define the historical problem graph, and a rules component 516 for creating the set of historical directional rules that define the historical problem graph. Each rule in the set of historical directional rules identifies an instruction problem subgraph and a conclusion problem subgraph formed from a subset of resource-state pairs that have directional dependencies. The rules component 516 may assign a confidence score to each edge of the historical problem graph based on the scores created for the historical directional rules.

[0097] The analysis component 520 may include a problem period component 521 for identifying problem time periods during which adjacent nodes are changing problem states that indicate causal relationships, and an association rule mining component 523 for determining whether causal relationships emerge consistently by applying an association rule mining algorithm.

[0098] The analysis component 520 may include a transaction component (basket component 522) for creating transactions based on the problem time period component 521, and the association rule mining component 523 performs association rule mining on the transactions to identify a subset of items, typically in the form of resource-state pairs, that appear together across multiple transactions, and directional dependencies between the resource-state pairs, and creates a set of historical directional rules that define a problem graph based on the subset of resource-state pairs and the directional dependencies of the node-state pairs. The transaction component may create transactions based on problem time periods, including defining a quiet period threshold for defining a single problem time period and defining a distance threshold for nodes related to the same problem.

[0099] A current problem analyzing system 530 may be provided for analyzing resources of a network with a current problem state by searching past problem graphs for current problem state nodes to determine nodes that may be causing and affected by the current problem.

[0100] The current problem analysis system 530 includes a node detection component 531 for detecting a set of nodes in a topology with a current problem state, where the nodes of the topology represent resources in an information technology infrastructure network; a node search component 532 for searching for problem state nodes in a historical problem graph; a problem graph ordering component 533 for ordering the historical problem graph by occurrence rate; a problem graph reading component 534 for reading the historical problem graph to find root nodes and child nodes away from the problem node; and a reporting component 535 for indicating state changes of the problem node with an ordered list of potentially causing nodes and an ordered list of potentially affected nodes.

[0101] Figure 6 illustrates a block diagram 600 of computing system components that may be used in computing system 500, in accordance with one embodiment of the present invention. It should be appreciated that Figure 6 is intended as an illustration of one implementation and is not intended to suggest any limitations with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made.

[0102] Some embodiments of the present invention provide a computer-implemented method for identifying problem graphs in an information technology infrastructure network. The method operates as follows (not necessarily in the following order): (i) find a set of nodes in a topology with a current problem state, where the nodes in the topology represent resources in the information technology infrastructure network; (ii) search for the problem state node in one or more historical problem graphs; (iii) order the historical problem graphs by occurrence rate; (iv) read one or more of the ordered historical problem graphs to find a root node and / or child nodes away from the problem node; and (v) obtain a problem tree with state changes of the problem node to create an ordered list of potentially causing nodes and / or an ordered list of potentially affected nodes.

[0103] Some embodiments of the present invention include the following features, characteristics, or advantages, or combinations thereof: (i) assigning a confidence score to each edge of a historical problem graph based on scores created for historical directional rules; (ii) defining a topology of an information technology infrastructure network, wherein nodes represent virtual or physical resources with connections defined by edges in the topology, and including labeling nodes for delineating domains and defining sub-topologies; and (iii) selecting a set of nodes in the topology by labeled domains.

[0104] The computing system may include one or more processors 602, one or more computer-readable RAMs 604, one or more computer-readable ROMs 606, one or more computer-readable storage media 608, device drivers 612, read / write drives or interfaces 614, and network adapters or interfaces 616, all interconnected through a communications fabric 618. The communications fabric 618 may be implemented using any architecture designed to pass data and / or control information between processors (such as microprocessors, communications and network processors), system memory, peripheral devices, and any other hardware components in the system.

[0105] One or more operating systems 610 and application programs 611, such as problem graph identification system 510 and current problem analysis system 530, are stored in one or more computer-readable storage media 608 for execution by one or more of processors 602 through one or more of their respective RAMs 604 (which typically include cache memory). In the illustrated embodiment, each of computer-readable storage media 608 may be an internal hard drive magnetic disk storage device, a CD-ROM, a DVD, a memory stick, magnetic tape, a magnetic disk, an optical disk, a semiconductor storage device such as RAM, ROM, EPROM, flash memory, or any other computer-readable storage medium capable of storing computer programs and digital information according to embodiments of the present invention.

[0106] The computing system may also include a R / W drive or interface 614 for reading from and writing to one or more portable computer-readable storage media 626. Application programs 611 on the computing system may be stored on one or more portable computer-readable storage media 626 and read via the respective R / W drive or interface 614 and loaded into the respective computer-readable storage media 608.

[0107] The computing system may also include a network adapter or interface 616, such as a TCP / IP adapter card or a wireless communication adapter. Application programs 611 on the computing system may be downloaded to the computing device from an external computer or external storage device via a network (e.g., the Internet, a local area network, or other wide area network or wireless network) and the network adapter or interface 616. The programs may be loaded into the computer-readable storage medium 608 from the network adapter or interface 616. The network may include copper wire, optical fiber, wireless transmissions, routers, firewalls, switches, gateway computers, and edge servers.

[0108] The computing system may also include a display screen 620, a keyboard or keypad 622, and a computer mouse or touchpad 624. The device driver 612 interfaces to the display screen 620 for imaging and to the keyboard or keypad 622, computer mouse or touchpad 624, and / or display screen 620 for alphanumeric entry and pressure sensing of user selections. The device driver 612, R / W drive or interface 614, and network adapter or interface 616 may comprise hardware and software stored in the computer readable storage medium 608 and / or ROM 606.

[0109] The present invention may be a system, method, or computer program product, or a combination thereof, at any possible level of integration of technical details. The computer program product may include a computer-readable storage medium (or multiple computer-readable storage media) having computer-readable program instructions for causing a processor to implement aspects of the present invention.

[0110] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions for use by an instruction-execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, punch cards, or mechanically encoded devices such as raised structures in grooves with instructions recorded thereon, and any suitable combination of the above. As used herein, computer-readable storage media should not be construed as being ephemeral signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses through fiber optic cable), or electrical signals transmitted over electrical wires.

[0111] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium within the respective computing / processing device.

[0112] Computer-readable program instructions for carrying out the operations of the present invention may be either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for integrated circuits, or source or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk®, C++, and procedural programming languages ​​such as the "C" programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer as a standalone software package, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, to carry out aspects of the present invention, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may execute computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the electronic circuitry.

[0113] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0114] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to produce a machine, such that the instructions, when executed by the processor of the computer or other programmable data processing apparatus, produce means for performing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may also be stored on a computer-readable medium, such that the computer-readable storage medium on which the instructions are stored comprises an article of manufacture containing instructions that implement aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams, and can direct a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner.

[0115] The computer-readable program instructions may also be loaded into a computer, other programmable data processing apparatus, or other device to create a computer-implemented process that causes the computer, other programmable apparatus, or other device to perform a series of operational steps, such that the instructions, which execute on the computer, other programmable apparatus, or other device, perform the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0116] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may actually be accomplished as a single step, or may be executed concurrently, substantially concurrently, partially, or entirely in a time-overlapping manner, or in some cases, the blocks may be executed in the reverse order, depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, are implemented by a dedicated hardware-based system that performs the specified functions or actions or a combination of dedicated hardware and computer instructions.

[0117] Cloud Computing

[0118] Although this disclosure includes detailed descriptions of cloud computing, it should be understood that implementation of the teachings described herein is not limited to cloud computing environments. Rather, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0119] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that are rapidly provisioned and released with minimal management effort or interaction with the service provider. This cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0120] The features are as follows:

[0121] On-Demand Self-Service: Cloud consumers can unilaterally provision computing capabilities, such as server time and network storage, automatically as needed, without the need for human interaction with the service provider.

[0122] Broad network access: Functionality is available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0123] Resource Pooling: Provider computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically allocated and reallocated as required. Consumers generally have no control or knowledge of the exact location of the provided resources, although there is location independence in that it may be possible to identify the location at a higher level of abstraction (e.g., country, state, or data center).

[0124] Rapid Flexibility: Capabilities can be quickly and flexibly provisioned, sometimes automatically, to rapidly scale out and quickly release to rapidly scale in. To the consumer, the capabilities available for provisioning often appear unlimited and can be purchased at any time and in any quantity.

[0125] Service Metering: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services they utilize.

[0126] The service model is as follows:

[0127] Software as a Service (SaaS): The ability to offer consumers the use of a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). With the possible exception of limited user-specific application configuration settings, the consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or individual application functions.

[0128] Platform as a Service (PaaS): The capability offered to consumers to deploy applications they create or acquire, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, such as the network, servers, operating systems, or storage, but does control the deployed applications and, in some cases, the application hosting environment configuration.

[0129] Infrastructure as a Service (IaaS): The capability offered to consumers to provision processing, storage, network, and other basic computing resources on which they can deploy and run any software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but they do control the operating systems, storage, deployed applications, and sometimes have limited control over selected network components (e.g., host firewalls).

[0130] The deployment model is as follows:

[0131] Private Cloud: Cloud infrastructure is operated exclusively for an organization. This cloud infrastructure may be managed by the organization or a third party and may reside on-premises or off-premises.

[0132] Community Cloud: Cloud infrastructure is shared by multiple organizations to support a specific community of shared interests (e.g., mission, security requirements, policies, and compliance considerations). This cloud infrastructure may be managed by the organization or a third party and may reside on-premises or off-premises.

[0133] Public Cloud: Cloud infrastructure is available to the general public or large industry groups and is owned by organizations that sell cloud services.

[0134] Hybrid Cloud: A cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are tied together by standardized or proprietary technologies that allow for data and application portability (e.g., cloud bursting for load balancing between clouds).

[0135] Cloud computing environments are service-oriented with an emphasis on statelessness, low coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0136] Referring now to FIG. 7, an exemplary cloud computing environment 50 is shown. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers, such as, for example, a personal digital assistant (PDA) or mobile phone 54A, a desktop computer 54B, a laptop computer 54C, or an automobile computer system 54N, or any combination thereof, can communicate. The nodes 10 may communicate with each other. They may be physically or virtually grouped in one or more networks, such as a private cloud, a community cloud, a public cloud, or a hybrid cloud, or any combination thereof, as described herein above (not shown). This enables the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service without the cloud consumer having to maintain resources on their local computing device. It should be understood that the types of computing devices 54A-54N shown in FIG. 7 are intended to be exemplary only, and that the computing node 10 and cloud computing environment 50 can communicate with any type of computerized device over any type of network and / or network-addressable connection (e.g., using a web browser).

[0137] Referring now to Figure 8, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 7) is shown. It should be understood that the components, layers, and functions shown in Figure 8 are intended to be illustrative only, and embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0138] Hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframes 61, RISC (reduced instruction set computer) architecture-based servers 62, servers 63, blade servers 64, storage devices 65, and networks and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0139] The virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities may be provided: virtual servers 71, virtual storage 72, virtual networks including virtual private networks 73, virtual applications and operating systems 74, and virtual clients 75.

[0140] In one example, the management layer 80 may provide the following functions: Resource provisioning 81 provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, as well as protection for data and other resources. User portal 83 provides consumers and system administrators with access to the cloud computing environment. Service level management 84 provides allocation and management of cloud computing resources such that requested service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides pre-allocation and procurement of cloud computing resources anticipated for future requests according to SLAs.

[0141] The workload tier 90 provides examples of functions for which cloud computing environments are utilized. Examples of workloads and functions provided by this tier include mapping and navigation 91, software development and lifecycle management 92, virtual classroom instruction delivery 93, data analytics processing 94, transaction processing 95, and root cause analysis and problem graph identification processing 96.

[0142] The computer program product of the present invention comprises one or more computer-readable hardware storage devices having computer-readable program code stored thereon, said program code being executable by one or more processors to perform the methods of the present invention.

[0143] The computer system of the present invention comprises one or more processors, one or more memories, and one or more computer-readable hardware storage devices, wherein the one or more hardware storage devices are executable by the one or more processors via the one or more memories to implement the methods of the present invention.

[0144] The description of various embodiments of the present invention has been presented for illustrative purposes and is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terms used herein have been selected to best explain the principles of the embodiments, practical applications, or technical improvements over technologies found in the market, or to enable those skilled in the art to understand the embodiments disclosed herein.

[0145] Improvements and modifications can be made to the above without departing from the scope of the present invention.

Claims

1. A method for computer information processing, comprising: selecting a set of nodes in a topology, the nodes of the topology representing resources in an information technology infrastructure network; querying historical time series data for each node of the selected set of nodes, the time series data recording changes in state of the resource represented by the node; analyzing the time series data for each node of the selected set of nodes over a problem period to create a set of historical directional rules that define one or more historical problem graphs; Including, analyzing the time series data, Identifying a problem time period during which an adjacent or proximate node is changing a problem state that indicates a causal relationship; creating a transaction based on the problem time period; performing association rule mining on the transactions to identify a subset of items in the form of node-state pairs that typically co-occur across multiple transactions, and directional dependencies between the node-state pairs; creating the set of history directionality rules that define a history problem graph based on the subset of node-state pairs and the directional dependencies of the node-state pairs; Including, method.

2. The method described in claim 1, wherein each rule in the set of history directionality rules identifies an instruction problem subgraph and a conclusion problem subgraph formed from a subset of node-state pairs that have directional dependencies.

3. analyzing the time series data, Applying association rule mining algorithms to determine whether causal relationships emerge consistently The method of claim 1 further comprising:

4. 2. The method of claim 1, wherein creating transactions based on problem time periods includes defining a quiet period threshold for defining a single problem time period and defining a distance threshold for nodes related to the same problem.

5. 2. The method of claim 1, further comprising searching the past problem graph for current problem state nodes to determine nodes that may be causing and / or affected by the current problem.

6. 6. The method of claim 5, further comprising: ordering the historical problem graphs in order of occurrence; reading one or more of the ordered historical problem graphs to find root nodes and / or child nodes away from the problem state node to determine a root cause of the problem and / or predict affected resources; and wherein the ordering is based on a combination of confidence scores assigned to each edge of the historical problem graphs based on scores created for each historical directional rule.

7. 10. The method of claim 1, comprising periodically collecting state data from resources represented by the nodes and storing the state data in a time-series graph data store suitable for querying, wherein the periodically collecting and storing comprises configuring time intervals for the time-series data.

8. 1. A system for identifying a problem graph in an information technology infrastructure network, comprising: a processor; Components, i.e. a node selection component for selecting a set of nodes in a topology, the nodes of the topology representing resources in an information technology infrastructure network; a state change data query component for querying historical time series data for each node in the selected set of nodes, the time series data recording changes in state of the resource represented by the node; and an analysis component for analyzing the time series data for each node of the selected set of nodes over a problem period to create a set of historical directional rules that define one or more historical problem graphs; a memory configured to provide said processor with computer program instructions to cause said processor to perform the functions of Including, the analysis component: a problem period component for identifying a problem time period during which adjacent or proximate nodes are changing a causally related problem state; a transaction component for creating transactions based on the problem time period; An association rule mining component to determine whether causal relationships emerge consistently by applying an association rule mining algorithm; Including, the association rule mining component performs association rule mining on the transactions to identify a subset of items in the form of node-state pairs that typically co-occur across multiple transactions, and directional dependencies between the node-state pairs, and creates the set of historical directional rules that define a historical problem graph based on the subset of node-state pairs and the directional dependencies of the node-state pairs; system.

9. The system of claim 8 , wherein the analysis component includes a rules component for creating a set of historical directional rules that define a historical problem graph.

10. A system as described in claim 8 or 9, wherein each rule in the set of history directional rules identifies instruction problem subgraphs and conclusion problem subgraphs formed from a subset of node-state pairs that have directional dependencies.

11. the analysis component: An association rules mining component to determine whether causal relationships emerge consistently by applying an association rules mining algorithm The system of claim 10 further comprising:

12. The system described in claim 8, wherein creating transactions based on the problem time period includes defining a quiet period threshold for defining a single problem time period and defining a distance threshold for nodes related to the same problem.

13. 10. The system of claim 8, further comprising a current problem analysis component for searching the past problem graph for current problem state nodes to determine nodes that may be causing and affected by a current problem.

14. A problem graph ordering component for ordering the past problem graphs in order of occurrence rate; a problem graph reading component for reading one or more of the ordered past problem graphs to find root nodes and / or child nodes away from the problem state node; and a reporting component for obtaining a problem tree with state changes of the problem state node and creating an ordered list of potentially causing nodes and / or an ordered list of potentially affected nodes. The system of claim 13 further comprising:

15. 10. The system of claim 8, further comprising: a topology definition component for defining a topology of an information technology infrastructure network, wherein nodes represent virtual or physical resources having connectivity defined by edges in the topology, and including labeling nodes for delineating domains and defining sub-topologies.

16. 10. The system of claim 8, further comprising a state data collection component for periodically collecting state data from resources represented by the nodes and storing the state data in a time series graph data store suitable for queries.

17. The system of claim 8 , further comprising a configuration component for configuring a time interval of the time series data and the problem period.

18. A computer program causing a computer to execute the method according to any one of claims 1 to 7.

19. 20. A computer-readable storage medium storing the computer program of claim 18.

Images