IT Incident Root Cause Analysis via Change Lifetime and Risk Profiling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IT systems face challenges in efficiently identifying the root cause of incidents due to their complexity and the rapid pace of software updates, which often result in misconfigured or omitted configuration parameters, leading to prolonged mean time to resolution (MTTR) and potential economic damage.
Innovation Solution
A system and method that collect configuration items and system parameters, calculate change lifetimes, estimate risk profiles, and sort changes based on probability values to quickly identify the most likely root cause of incidents, using agents to monitor key performance indicators and store changes in a database for analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If configuration items are collected and stored in a CMDB to track changes, then the ability to detect configuration changes is improved, but the time required to analyze hundreds or thousands of changes to detect the source of a problem increases
Solution Approach 1:
The patent segments the large set of configuration changes into smaller meaningful groups or categories. Instead of analyzing all individual configuration changes separately, the system groups related changes together and analyzes them as units, significantly reducing the analysis workload while maintaining detection accuracy.
Solution Approach 2:
The patent extracts and focuses analysis on the most relevant configuration changes that are likely to be the root cause of the incident. By using filtering criteria and prioritization algorithms, the system extracts a small subset of critical changes from the overwhelming number of total changes, enabling rapid root cause identification.
2Loss of time
If periodic snapshots of computer systems are recorded to compare current state with prior states, then the number of changes that need to be checked is reduced, but the ability to pinpoint the exact root cause change is weakened
Solution Approach 1:
The patent applies local quality by examining different types of changes with different levels of detail and applying different analysis methods to different categories of changes. Critical configuration changes are analyzed in greater detail while less important changes are reviewed more briefly, optimizing both speed and accuracy of root cause identification.
Solution Approach 2:
The patent adds temporal dimension to the analysis by examining not just what changes occurred but when they occurred and for how long they were active. By analyzing the lifetime and timing of each change relative to the incident occurrence, the system can prioritize changes that were active during the critical period, improving root cause pinpointing accuracy.
Data Source
AI summary
A method of incident root cause analysis in an information technology (IT) system, wherein upon occurrence of an incident collecting changes to configuration items and/or system parameters on computer stations during a predetermined time prior to the incident, calculating a change lifetime for each of the collected changes, comparing the change lifetime to the time of occurrence of the incident to determine if the lifetime of the change is still valid, marking a probability value of zero for occurrence of the incident as a result of the change for changes with an expired lifetime value at the time of the incident, otherwise estimating a risk profile and calculating from it a probability value for occurrence of the incident as a result of the change, sorting the changes according to the probability value, and selecting a predetermined number of changes having the highest probability values for root cause analysis.