371 results about "Root cause analysis" patented technology

A network appliance for monitoring, diagnosing and documenting problems among a plurality of devices and processes (objects) coupled to a computer network utilizes periodic polling and collection of object-generated trap data to monitor the status of objects on the computer network. The status of a multitude of objects is maintained in memory utilizing virtual state machines which contain a small amount of persistent data but which are modeled after one of a plurality of finite state machines. The memory further maintains dependency data related to each object which identifies parent/child relationships with other objects at the same or different layers of the OSI network protocol model. A decision engine verifies through on-demand polling that a device is down. A root cause analysis module utilizes status and dependency data to locate the highest object in the parent/child relationship tree that is affected to determine the root cause of a problem. Once a problem has been verified, a “case” is opened and notification alerts may be sent out to one or more devices. A user interface allows all objects within the network to be displayed with their respective status and their respective parent/child dependency objects in various formats.

A method and system for identifying causes of performance metric changes in a network by selecting, from a pool of network event counters, a plurality of candidate counters relevant to a performance metric; grouping the candidate counters into clusters of similar counters; selecting, from each cluster, one or more representative counters; and fitting the selected representative counters to a model of the performance metric to determine thereby a set of representative counters most relevant to the performance metric.

A method of root cause analysis in a virtual machine environment includes receiving a plurality of events from a system monitoring the virtualized environment. The events may include alarms or alerts, such as alarms or alerts associated with a resource reaching or exceeding a threshold. The capacity manager consumes these events and performs event correlation to produce a set of correlated events. The capacity manager performs a root cause analysis on the set of correlated events to identify one or more root causes. The capacity manager further performs an impact analysis to determine how the root cause impacts the system, such as other virtual machines, hosts or resource in the virtual environment. Based on the root cause and impact analysis, the capacity manager makes one or more recommendations to address issues with or to improve the operations and/or performance of the virtualized environment.

A method for analyzing the root cause of system failures on one or more computers. An event is generated when a computer system detects a system failure. The cause of the failure is determined. The event, including the cause is transmitted from the computer system to a central repository. And the system failure is analyzed in the central repository.

An analyzer arrangement for provision of information about a facility by means of root cause analysis. Storage assembly stores a data model that associates with the facility. The data model contains information about possible events, hypotheses for the root causes of the possible events and symptoms for the hypotheses. A processor provides root cause analysis based on the data model. An input inputs additional information for use in root cause analysis. An adaptor modifies the data model based on the additional information.

A system for providing receipt inspection reporting (RIR) allows for entry, modification, searching and reporting of RIR data. The RIR data is stored in a database and accessible online to facilitate tracking and analysis of defects and other problems. Searches and custom reports also may be generated to provide RIR tracking and analysis of problems. Logging and tracking of defects allows for root cause analysis using RIR data stored in a database to improve the RIR resolution process.

Multi-step statistical modeling in one embodiment of the present disclosure enables anomaly detection, forecasting and/or root cause analysis of the energy consumption for a portfolio of buildings using multi-step statistical modeling. In one aspect, energy consumption data associated with a building, building characteristic data associated with the building, building operation and activities data associated with the building, and weather data are used to generate a variable based degree model. A base load factor, a heating coefficient and a cooling coefficient associated with the building and an error term are determined from the variable based degree model and used to generate a plurality of multivariate regression models. A time series model is generated for the error term to model seasonal factors which reflect monthly dependence on energy use and an auto-regressive integrated moving average model (ARIMA) which reflects temporal dependent patterns of the energy use.

Anomalous behavior in a distributed system is automatically detected. Metrics are gathered for transactions, subsystems and/or components of the subsystems. The metrics can identify response times, error counts and/or CPU loads, for instance. Baseline metrics and associated deviation ranges are automatically determined and can be periodically updated. Metrics from specific transactions are compared to the baseline metrics to determine if an anomaly has occurred. A drill down approach can be used so that metrics for a subsystem are not examined unless the metrics for an associated transaction indicate an anomaly. Further, metrics for a component, application which includes one or more components, or process which includes one or more applications, are not examined unless the metrics for an associated subsystem indicate an anomaly. Multiple subsystems can report the metrics to a central manager, which can correlate the metrics to transactions using transaction identifiers or other transaction context data.

A root cause analysis engine uses event durations and gradual deletion of events to improve analysis accuracy and reduce the number of required calculations. Matching ratios of relevant rules are recalculated every time notification of an event is received. The calculation results are held in a rule memory in the analysis engine. Each event has a valid duration, and when the duration has expired, that event is deleted from the rule memory. Events held in the rule memory can be deleted without affecting other events held in the rule memory. The analysis engine can then re-calculate the matching ratio of each rule by only performing the re-calculation with respect to affected rules related to the deleted event. The calculation cost can be reduced because analysis engine processes events incrementally or decrementally. Analysis engine can determine the most possible conclusion even if one or more condition elements were not true.

A method of providing data for root cause analysis. Data is transferred from a structured data model into a causally oriented data model. The causally oriented data model is complemented with information associated with conditional probabilities between at least two objects of the causally oriented data model.

A method is provided of monitoring a packet-switched network via which real-time data is transmitted. Data packets containing real-time data are sniffed by a monitor subagent to monitor a quality-of-service parameter. A monitor agent is notified in response to a breach of the threshold of the quality-of-service parameter about the breach. A network node manager is notified about the breach, and a root cause analysis is performed.

An indication of a problem in at least one component of a computing system is obtained. A relevant change set associated with a directed dependency graph is analyzed. The computing system is configured to proactively overcome a root cause of the problem. The relevant change set includes a list of past changes to the computing system which are potentially relevant to the problem. The directed dependency graph includes dependency information regarding given components of the computing system invoked by transactions in the computing system. The analyzing includes identifying at least one of the past changes to the computing system that is the root cause of the problem.

Embodiments disclosed herein can significantly optimize a root cause analysis and substantially reduce the overall time needed to isolate the root cause or causes of service degradation in an IT environment. By building on the ability of an abnormality detection algorithm to correlate an alarm with one or more events, embodiments disclosed herein can apply data correlation to data points collected within a specified time window by data metrics involved in the generation of the alarm and the event(s). The level of correlation between the primary metric and the probable cause metrics may be adjusted using the ratio between theoretical data points and actual points. The final Root Cause Analysis score may be modified depending upon the adjusted correlation value and presented for user review through a user interface.

Programmatic root cause analysis of application performance problems is provided in accordance with various embodiments. Transactions having multiple components can be monitored to determine if they are exceeding a threshold for their execution time. Monitoring the transactions can include instrumenting one or more applications to gather component level information. For transactions exceeding a threshold, the data collected for the individual components can be analyzed to automatically diagnose the potential cause of the performance problem. Time-series analytical techniques are employed to determine normal values for transaction and component execution times. The values can be dynamic or static. Deviations from these normal values can be detected and reported as a possible cause. Other filters in addition to or in place of execution times for transactions and components can also be used.

In the system management server, an information processing apparatus that is an event-information acquisition target is registered as a monitored apparatus in configuration information; event information that complies with a rule stored in advance is identified from among a plurality of pieces of event information stored in the system management server; a server apparatus for a network service related to the event information is identified; and a message is displayed which indicates that the cause of the event that occurred in a client information processing apparatus which has generated event information is an event related to the network service, which occurred in the server apparatus.

A system (100) for analyzing a fault includes a fault object factory (110) constructed and arranged to receive fault data and create a fault object (112), and a fault diagnosis engine (101) constructed and arranged to perform root cause analysis of the fault object. The system may further include a fault detector (130) constructed and arranged to detect the fault data in a monitored entity, a fault repository (140) constructed and arranged to store and access the fault object; and a fault handler (150) constructed and arranged to be triggered by the fault diagnosis engine to analyze the fault object.

The present invention is directed to computer-based methods and system to perform root-cause analysis on an industrial process. The methods and system load process data for an industrial process from a historian database and build a hybrid first-principles and inferential model. The methods and system then executes the hybrid model to generate KPIs for the industrial process using the loaded process variables. The methods and system then selects a subset of the KPIs to represent an event occurring in the industrial process, and divides the data for the subset into multiple subset of time series. The system and methods select time intervals from the time series based on the data variability in the selected time intervals and perform a cross-correlation between the loaded process variables and the selected time interval, resulting in a cross-correlation score for each loaded process variable. The methods and system then select precursor candidates from the loaded process variables based on the cross-correlation scores and execute a parametric model for performing quantitative analysis of the selected precursor candidates, resulting in a strength of correlation score for each precursor candidate. The methods and system select root-cause variables from the selected precursor candidates based on the strength of correlation scores for analyzing the root-cause of the event.

Mechanisms for graph manipulation of transactional performance data are provided in order to identify and emphasize root causes of electronic business system transaction processing performance problems. A system transaction monitoring system, such as IBM Tivoli Monitoring for Transaction Performance™ (ITMTP) system, is utilized to obtain transaction performance data for a system. This transaction performance data is stored in a database and is utilized to present a graph of a given transaction or transactions. Having generated a graph of the transaction, and having identified problem conditions in the processing of the transaction(s), the present invention provides mechanisms for performing graph manipulation operations to best depict the root cause of the problems.

In certain example embodiments of this invention, there is provided systems and/or methods for processing BAM-related data to predict when events of interest are about to happen and/or to identify the root causes of, or at least data correlated with, such events of interest. In certain example embodiments, key performance indicators (KPIs) are gathered and gardened. The gardening process may identify KPI values of interest (e.g., based on a Z-factor analysis thereof across one or more collection intervals). The gardened KPIs may be processed using a time-series transform (e.g., a Fast Fourier Transform), matched to one of a plurality of predefined waveforms, and fed into a dynamic Naïve Bayesian Network (NBN) for prediction. The gardened data also may be used to determine the relevance of the KPI for root causes of problems (e.g., based on a chi-square analysis).