372 results about "Root cause analysis" patented technology

A Managed Site (10), a logical network entity, is composed of a number of Sub Sites (20) in a one to many relationship. A Sub Site (20) is a logical component, which is composed of a number of Engines (30). Nodes (40) similarly relates to their Engine (30) in a many to one relationship. A Node (40) is a collection of Managed Elements (ME's) (50) (while being an ME (50) itself), which represent network state information. The subsite (20) consists of the engine (30) connected to server nodes (40). One or more clients (110) are connected to the management engine (30) and access management engine (30) information relating to managed elements (50) including nodes (40). The connected manager engines may communicate with one another so that, for example, in the event of a failure, one of the manager engines remaining on line commences monitoring of manage elements assigned to the failed manager engine. Upon accessing the manager engine (30), the client interface displays relationships among managed elements (50) using meaningful connectors and tree-like structures. In addition to basic managed element state monitoring functionality, the manager engine (30) provides a variety of automated tasks ensuring the health of the network and optimal failure correction in the event of a problem. For example, the manager engine (30) performs root cause analysis utilizing an algorithm tracing through manged element (50) relationships and indicating the source of the failure.

A network appliance for monitoring, diagnosing and documenting problems among a plurality of devices and processes (objects) coupled to a computer network utilizes periodic polling and collection of object-generated trap data to monitor the status of objects on the computer network. The status of a multitude of objects is maintained in memory utilizing virtual state machines which contain a small amount of persistent data but which are modeled after one of a plurality of finite state machines. The memory further maintains dependency data related to each object which identifies parent / child relationships with other objects at the same or different layers of the OSI network protocol model. A decision engine verifies through on-demand polling that a device is down. A root cause analysis module utilizes status and dependency data to locate the highest object in the parent / child relationship tree that is affected to determine the root cause of a problem. Once a problem has been verified, a “case” is opened and notification alerts may be sent out to one or more devices. A user interface allows all objects within the network to be displayed with their respective status and their respective parent / child dependency objects in various formats.

A method and system for identifying causes of performance metric changes in a network by selecting, from a pool of network event counters, a plurality of candidate counters relevant to a performance metric; grouping the candidate counters into clusters of similar counters; selecting, from each cluster, one or more representative counters; and fitting the selected representative counters to a model of the performance metric to determine thereby a set of representative counters most relevant to the performance metric.

A network appliance for monitoring, diagnosing and documenting problems among a plurality of devices and processes (objects) coupled to a computer network utilizes periodic polling and collection of object-generated trap data to monitor the status of objects on the computer network. The status of a multitude of objects is maintained in memory utilizing virtual state machines which contain a small amount of persistent data but which are modeled after one of a plurality of finite state machines. The memory further maintains dependency data related to each object which identifies parent / child relationships with other objects at the same or different layers of the OSI network protocol model. A decision engine verifies through on-demand polling that a device is down. A root cause analysis module utilizes status and dependency data to locate the highest object in the parent / child relationship tree that is affected to determine the root cause of a problem. Once a problem has been verified, a “case” is opened and notification alerts may be sent out to one or more devices. A user interface allows all objects within the network to be displayed with their respective status and their respective parent / child dependency objects in various formats.

A method of root cause analysis in a virtual machine environment includes receiving a plurality of events from a system monitoring the virtualized environment. The events may include alarms or alerts, such as alarms or alerts associated with a resource reaching or exceeding a threshold. The capacity manager consumes these events and performs event correlation to produce a set of correlated events. The capacity manager performs a root cause analysis on the set of correlated events to identify one or more root causes. The capacity manager further performs an impact analysis to determine how the root cause impacts the system, such as other virtual machines, hosts or resource in the virtual environment. Based on the root cause and impact analysis, the capacity manager makes one or more recommendations to address issues with or to improve the operations and / or performance of the virtualized environment.

A method for analyzing the root cause of system failures on one or more computers. An event is generated when a computer system detects a system failure. The cause of the failure is determined. The event, including the cause is transmitted from the computer system to a central repository. And the system failure is analyzed in the central repository.

An analyzer arrangement for provision of information about a facility by means of root cause analysis. Storage assembly stores a data model that associates with the facility. The data model contains information about possible events, hypotheses for the root causes of the possible events and symptoms for the hypotheses. A processor provides root cause analysis based on the data model. An input inputs additional information for use in root cause analysis. An adaptor modifies the data model based on the additional information.

In one aspect, it is realized that changes in routing configuration (and therefore network topology) may have an effect on how data is forwarded in a communication network. More particularly, it is realized the changes in the control plane have a statistical effect on information tracked in the data plane, and this relation may be used by a network manager in monitoring the network and determining a control plane cause of a data plane forwarding effect. For instance, a change in BGP routing information (control plane information) may affect the data forwarded by a router based on the changed BGP routing information (e.g., next hop data may be forwarded to a different BGP router attached to another physical port). A system and method are provided that correlate control plane and data plane information to support root cause analysis functions.

A system for providing receipt inspection reporting (RIR) allows for entry, modification, searching and reporting of RIR data. The RIR data is stored in a database and accessible online to facilitate tracking and analysis of defects and other problems. Searches and custom reports also may be generated to provide RIR tracking and analysis of problems. Logging and tracking of defects allows for root cause analysis using RIR data stored in a database to improve the RIR resolution process.

A network appliance for monitoring, diagnosing and documenting problems among a plurality of devices and processes (objects) coupled to a computer network utilizes periodic polling and collection of object-generated trap data to monitor the status of objects on the computer network. The status of a multitude of objects is maintained in memory utilizing virtual state machines which contain a small amount of persistent data but which are modeled after one of a plurality of finite state machines. The memory further maintains dependency data related to each object which identifies parent / child relationships with other objects at the same or different layers of the OSI network protocol model. A decision engine verifies through on-demand polling that a device is down. A root cause analysis module utilizes status and dependency data to locate the highest object in the parent / child relationship tree that is affected to determine the root cause of a problem. Once a problem has been verified, a “case” is opened and notification alerts may be sent out to one or more devices. A user interface allows all objects within the network to be displayed with their respective status and their respective parent / child dependency objects in various formats.

Multi-step statistical modeling in one embodiment of the present disclosure enables anomaly detection, forecasting and / or root cause analysis of the energy consumption for a portfolio of buildings using multi-step statistical modeling. In one aspect, energy consumption data associated with a building, building characteristic data associated with the building, building operation and activities data associated with the building, and weather data are used to generate a variable based degree model. A base load factor, a heating coefficient and a cooling coefficient associated with the building and an error term are determined from the variable based degree model and used to generate a plurality of multivariate regression models. A time series model is generated for the error term to model seasonal factors which reflect monthly dependence on energy use and an auto-regressive integrated moving average model (ARIMA) which reflects temporal dependent patterns of the energy use.

Anomalous behavior in a distributed system is automatically detected. Metrics are gathered for transactions, subsystems and / or components of the subsystems. The metrics can identify response times, error counts and / or CPU loads, for instance. Baseline metrics and associated deviation ranges are automatically determined and can be periodically updated. Metrics from specific transactions are compared to the baseline metrics to determine if an anomaly has occurred. A drill down approach can be used so that metrics for a subsystem are not examined unless the metrics for an associated transaction indicate an anomaly. Further, metrics for a component, application which includes one or more components, or process which includes one or more applications, are not examined unless the metrics for an associated subsystem indicate an anomaly. Multiple subsystems can report the metrics to a central manager, which can correlate the metrics to transactions using transaction identifiers or other transaction context data.

A system and method for coordinating product inspection, repair and product maintenance features a proactive, data-driven process where industry-wide maintenance baselines, problems, frequency-of-occurrence data and best-in-class repair processes are identified in a central, secure, structured database environment and thereby where the safety and operational and economic impact of a problem can be evaluated and acted upon. Using industry-wide data provided by users, the present system and method will link repair and inspection finds (non-routines), reason codes and severity data related to potential safety, reliability, cycle time and cost implications with the root cause analysis and certified best inspection / repair / preventative process instructions, materials, tools and / or equipment. This information, combined with a maintenance provider's, manufacturer's and OEM's information, will greatly improve safety, reliability, cycle time and budget performance on repair, maintenance and inspection of equipment utilizing the present system and method.

A root cause analysis engine uses event durations and gradual deletion of events to improve analysis accuracy and reduce the number of required calculations. Matching ratios of relevant rules are recalculated every time notification of an event is received. The calculation results are held in a rule memory in the analysis engine. Each event has a valid duration, and when the duration has expired, that event is deleted from the rule memory. Events held in the rule memory can be deleted without affecting other events held in the rule memory. The analysis engine can then re-calculate the matching ratio of each rule by only performing the re-calculation with respect to affected rules related to the deleted event. The calculation cost can be reduced because analysis engine processes events incrementally or decrementally. Analysis engine can determine the most possible conclusion even if one or more condition elements were not true.

A method for diagnosing network performance problems includes providing a graph representing a topology of a network including first nodes that are classified as providers of a resource, second nodes that are classified as consumers of the resource, and third nodes that are classified as mediators intervening between the providers and the consumers. Responsively to a report of a performance problem encountered by a given consumer in the network, at least one input / output (I / O) path is traced through the graph connecting the given consumer to one or more of the providers. One or more problematic nodes are identified along the at least one I / O path as possible causes of the performance problem.

A network monitoring and analysis system is configured to include a root cause analysis function that permits the automatic determination of performance problem locations in a network of a communication system comprising a plurality of endpoint devices. Test communications are generated in the system in accordance with a selected pattern, which may be based on a flow matrix, and end-to-end path measurement data is collected utilizing the generated test communications. The end-to-end path measurement data is transformed to produce a plurality of performance indicators comprising a performance indicator for each of a plurality of non-end-to-end paths defined at least in part by the selected pattern.

A method of providing data for root cause analysis. Data is transferred from a structured data model into a causally oriented data model. The causally oriented data model is complemented with information associated with conditional probabilities between at least two objects of the causally oriented data model.

A Managed Site (10), a logical network entity, is composed of a number of Sub Sites (20) in a one to many relationship. A Sub Site (20) is a logical component, which is composed of a number of Engines (30). Nodes (40) similarly relates to their Engine (30) in a many to one relationship. A Node (40) is a collection of Managed Elements (ME's) (50) (while being an ME (50) itself), which represent network state information. The subsite (20) consists of the engine (30) connected to server nodes (40). One or more clients (110) are connected to the management engine (30) and access management engine (30) information relating to managed elements (50) including nodes (40). The connected manager engines may communicate with one another so that, for example, in the event of a failure, one of the manager engines remaining on line commences monitoring of manage elements assigned to the failed manager engine. Upon accessing the manager engine (30), the client interface displays relationships among managed elements (50) using meaningful connectors and tree-like structures. In addition to basic managed element state monitoring functionality, the manager engine (30) provides a variety of automated tasks ensuring the health of the network and optimal failure correction in the event of a problem. For example, the manager engine (30) performs root cause analysis utilizing an algorithm tracing through manged element (50) relationships and indicating the source of the failure.

A method is provided of monitoring a packet-switched network via which real-time data is transmitted. Data packets containing real-time data are sniffed by a monitor subagent to monitor a quality-of-service parameter. A monitor agent is notified in response to a breach of the threshold of the quality-of-service parameter about the breach. A network node manager is notified about the breach, and a root cause analysis is performed.

An indication of a problem in at least one component of a computing system is obtained. A relevant change set associated with a directed dependency graph is analyzed. The computing system is configured to proactively overcome a root cause of the problem. The relevant change set includes a list of past changes to the computing system which are potentially relevant to the problem. The directed dependency graph includes dependency information regarding given components of the computing system invoked by transactions in the computing system. The analyzing includes identifying at least one of the past changes to the computing system that is the root cause of the problem.

Embodiments disclosed herein can significantly optimize a root cause analysis and substantially reduce the overall time needed to isolate the root cause or causes of service degradation in an IT environment. By building on the ability of an abnormality detection algorithm to correlate an alarm with one or more events, embodiments disclosed herein can apply data correlation to data points collected within a specified time window by data metrics involved in the generation of the alarm and the event(s). The level of correlation between the primary metric and the probable cause metrics may be adjusted using the ratio between theoretical data points and actual points. The final Root Cause Analysis score may be modified depending upon the adjusted correlation value and presented for user review through a user interface.

Programmatic root cause analysis of application performance problems is provided in accordance with various embodiments. Transactions having multiple components can be monitored to determine if they are exceeding a threshold for their execution time. Monitoring the transactions can include instrumenting one or more applications to gather component level information. For transactions exceeding a threshold, the data collected for the individual components can be analyzed to automatically diagnose the potential cause of the performance problem. Time-series analytical techniques are employed to determine normal values for transaction and component execution times. The values can be dynamic or static. Deviations from these normal values can be detected and reported as a possible cause. Other filters in addition to or in place of execution times for transactions and components can also be used.

In the system management server, an information processing apparatus that is an event-information acquisition target is registered as a monitored apparatus in configuration information; event information that complies with a rule stored in advance is identified from among a plurality of pieces of event information stored in the system management server; a server apparatus for a network service related to the event information is identified; and a message is displayed which indicates that the cause of the event that occurred in a client information processing apparatus which has generated event information is an event related to the network service, which occurred in the server apparatus.

A system (100) for analyzing a fault includes a fault object factory (110) constructed and arranged to receive fault data and create a fault object (112), and a fault diagnosis engine (101) constructed and arranged to perform root cause analysis of the fault object. The system may further include a fault detector (130) constructed and arranged to detect the fault data in a monitored entity, a fault repository (140) constructed and arranged to store and access the fault object; and a fault handler (150) constructed and arranged to be triggered by the fault diagnosis engine to analyze the fault object.

The present invention is directed to computer-based methods and system to perform root-cause analysis on an industrial process. The methods and system load process data for an industrial process from a historian database and build a hybrid first-principles and inferential model. The methods and system then executes the hybrid model to generate KPIs for the industrial process using the loaded process variables. The methods and system then selects a subset of the KPIs to represent an event occurring in the industrial process, and divides the data for the subset into multiple subset of time series. The system and methods select time intervals from the time series based on the data variability in the selected time intervals and perform a cross-correlation between the loaded process variables and the selected time interval, resulting in a cross-correlation score for each loaded process variable. The methods and system then select precursor candidates from the loaded process variables based on the cross-correlation scores and execute a parametric model for performing quantitative analysis of the selected precursor candidates, resulting in a strength of correlation score for each precursor candidate. The methods and system select root-cause variables from the selected precursor candidates based on the strength of correlation scores for analyzing the root-cause of the event.

A method, system, computer system, and computer-readable medium to perform root cause analysis of failure of an application program in a clustering environment. Upon the occurrence of a problem or event of interest, cluster configuration data can be obtained to provide a common context for events occurring at different software layers supporting an application. Diagnostic information produced by the different software layers can be obtained from various log files, which are typically in different formats and on different nodes in the cluster. The diagnostic information can be viewed in the context of the cluster and filtered to identify events related to the failure. The related events can be presented in a time-ordered sequence to assist in analysis of the event of interest. Patterns of events that led to the failure can be identified and documented for use in further problem analysis and for taking preventative and / or corrective measures.

Mechanisms for graph manipulation of transactional performance data are provided in order to identify and emphasize root causes of electronic business system transaction processing performance problems. A system transaction monitoring system, such as IBM Tivoli Monitoring for Transaction Performance™ (ITMTP) system, is utilized to obtain transaction performance data for a system. This transaction performance data is stored in a database and is utilized to present a graph of a given transaction or transactions. Having generated a graph of the transaction, and having identified problem conditions in the processing of the transaction(s), the present invention provides mechanisms for performing graph manipulation operations to best depict the root cause of the problems.

Significant changes in monitored and reported operational parameters and / or power outage events occurring in a utility's electrical power transmission / distribution grid are correlated with historical, current and / or forecast weather events based on potential root cause, geographic and temporal constraints. Operational event and outage information is collected and time-stamped using a communication network of devices and sources that monitor and report, among other things, equipment parameters, electric power availability and outages. A computer-implemented root cause analysis engine (RCA) operatively associated with a computer-implemented weather data correlation engine sorts and analyzes operational parameter / event information and identifies probable correlations to localized weather phenomenon. Operational parameters / events are then displayed using a graphic display device in a manner that enables user controllable and configurable viewing of a time-lapse evolution of weather phenomenon overlayed with graphics representing both weather-related and other relevant operational parameters / events depicted in relation to the utility's physical infrastructure.

Multi-step statistical modeling in one embodiment of the present disclosure enables anomaly detection, forecasting and / or root cause analysis of the energy consumption for a portfolio of buildings using multi-step statistical modeling. In one aspect, energy consumption data associated with a building, building characteristic data associated with the building, building operation and activities data associated with the building, and weather data are used to generate a variable based degree model. A base load factor, a heating coefficient and a cooling coefficient associated with the building and an error term are determined from the variable based degree model and used to generate a plurality of multivariate regression models. A time series model is generated for the error term to model seasonal factors which reflect monthly dependence on energy use and an auto-regressive integrated moving average model (ARIMA) which reflects temporal dependent patterns of the energy use.

In certain example embodiments of this invention, there is provided systems and / or methods for processing BAM-related data to predict when events of interest are about to happen and / or to identify the root causes of, or at least data correlated with, such events of interest. In certain example embodiments, key performance indicators (KPIs) are gathered and gardened. The gardening process may identify KPI values of interest (e.g., based on a Z-factor analysis thereof across one or more collection intervals). The gardened KPIs may be processed using a time-series transform (e.g., a Fast Fourier Transform), matched to one of a plurality of predefined waveforms, and fed into a dynamic Naïve Bayesian Network (NBN) for prediction. The gardened data also may be used to determine the relevance of the KPI for root causes of problems (e.g., based on a chi-square analysis).