Root Cause Analysis for Distributed Systems Using Tracing Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying the root cause of anomalies in distributed systems with multiple computing nodes is complex due to their distributed nature, making it difficult to track and analyze simultaneous executions, and existing solutions require extensive resources and customization for each system and application.
Innovation Solution
A system comprising a preprocessing module, signal splitting module, anomaly detection module, scoring module, and root cause identification module that analyzes tracing data to group operations, detect anomalies, calculate anomaly scores, and identify the root cause without prior knowledge of the system or application, using standard anomaly detection algorithms and relying on tracing data available in existing systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If distributed systems are used to scale applications, then functionality and performance are improved, but complexity of root cause analysis increases
Solution Approach 1:
The patent segments the complex distributed system execution into individual tracing spans, each representing a specific operation with documented properties. By dividing the monolithic execution trace into smaller, manageable spans grouped by operation type, the system makes root cause analysis tractable without sacrificing distributed system performance benefits
Solution Approach 2:
The patent introduces tracing data as an intermediary layer between the distributed system execution and the root cause analysis process. This tracing data captures operation properties and values, serving as a mediator that translates complex distributed execution states into analyzable structured information, thereby reducing analysis complexity while maintaining system scalability
2Reliability
If conventional root cause analysis methods are applied to distributed systems, then anomalies can be detected, but resource consumption and customization requirements increase
Solution Approach 1:
The patent creates a universal root cause analysis method that works across different distributed systems and applications without requiring system-specific customization. By focusing on operation properties and values captured in tracing spans rather than system-specific details, the methodology achieves broad applicability while reducing computational overhead from customization efforts
Solution Approach 2:
The patent uses tracing data as a simplified copy or representation of the actual distributed system execution. Instead of analyzing the full complexity of distributed system states directly, the method works with captured operation properties and values, reducing computational resources needed while maintaining anomaly detection effectiveness
3Loss of information
If tracing data is collected from multiple computing nodes, then root cause information becomes available, but data processing complexity increases
Solution Approach 1:
The patent merges tracing spans with identical operation properties and values into groups, combining information from multiple computing nodes into structured groups. This merging process reduces data processing complexity by organizing distributed execution information into comparable units while preserving all relevant execution details for root cause analysis
Data Source
AI summary
A system for identifying root cause of anomalies in execution of an application comprising a plurality of operations is provided. The system comprising a preprocessing module configured to receive tracing data comprising a plurality of tracing spans each documenting, for a corresponding operation of the application, a plurality of properties and corresponding values, a signal splitting module configured to group the plurality of tracing spans in a plurality of groups such that each of the plurality of groups comprises operations with identical properties and corresponding values, an anomaly detection module configured to determine anomalous operations for each of the plurality of tracing data spans, a scoring module configured to calculate a plurality of anomaly scores each indicating a level of anomaly within each of the plurality of groups and a root cause identification module configured to analyze the anomaly scores and identify root cause of the detected anomalies according to the analysis.