Event Correlation for Root Cause Identification in IT Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional root cause analysis methods lack precision in differentiating between events requiring manual intervention and those that do not, leading to false alarms and inefficient troubleshooting in software services and enterprise IT departments, as they often rely on detecting the first or last error event during analysis, which may not be severe or temporary.
Innovation Solution
An automated system that correlates activity events with unique correlation identifiers, assigns them to event groups based on type, and identifies the root cause by focusing on event groups with unresolved failures, differentiating between local and external component issues, and prioritizing support tickets based on occurrence time and importance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional root cause analysis detects the first or last error event during analysis window execution, then error detection is achieved, but precision is reduced and false alarms occur
Solution Approach 1:
The patent segments error events into distinct event groups based on correlation identifiers, allowing differentiation between root cause events and subsequent symptom events. This segmentation enables precise identification of the actual root cause by analyzing the first event in each correlated group, rather than simply detecting any error event, thereby reducing false alarms while maintaining high precision.
2Measurement precision
If manual intervention is used for all error events, then thorough analysis is achieved, but operational costs increase
Solution Approach 1:
The patent implements automated root cause identification that self-distinguishes between events requiring manual intervention and those that do not. By automatically analyzing event groups, identifying root cause events, and determining whether events are severe or temporary, the system eliminates unnecessary manual intervention for non-critical events while maintaining thorough analysis for genuine root causes, thereby reducing operational costs without sacrificing analysis quality.
3Loss of information
If code path tracing is performed to understand failure reasons, then detailed understanding is achieved, but time consumption increases
Solution Approach 1:
The patent performs preliminary automated analysis of event groups and their correlations before manual troubleshooting is needed. By pre-identifying root cause events, determining their severity and resolution status, and organizing events into meaningful groups, the system provides detailed failure understanding in advance, significantly reducing the time required for manual code path tracing and troubleshooting.
Data Source
AI summary
Correlating activity events to identify a root cause of a process failure. Activity event data is received from a process executing on a computing device. The activity event data corresponds to a plurality of activity events. Each of the activity events has a correlation identifier, a resolution status, and an occurrence time value associated therewith. Each of the activity events are assigned to one of a plurality of event groups based on the correlation identifier of the activity event. Thereafter, at least one of the event groups is determined to have an activity event with a resolution status indicating failure of the process. One of the activity events within the determined event group is selected as a root cause activity event based on the occurrence time values. In some embodiments, the root cause activity event is identified to a user of the computing device.