Knowledge Graph Root Cause Analysis for Mainframe Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In mainframe computing systems, distinguishing between root cause and victim error log messages is challenging, leading to prolonged root cause analysis times, as errors propagate across nodes and multiple log messages are written, making it difficult for administrators to identify the primary cause of failures.
Innovation Solution
A graph-based approach is implemented, constructing a knowledge graph from log messages using semantic and statistical relationships, detecting anomalous messages, and calculating deviation scores to determine the root cause of errors, thereby localizing potential causes without manual inference or deep domain knowledge.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a graph-based approach with knowledge graphs and deviation scores is implemented, then root cause analysis accuracy is improved, but system complexity increases
Solution Approach 1:
The patent introduces a knowledge graph as an intermediary structure that models relationships between log messages, error types, and system components. This graph serves as a mediator between raw log data and root cause determination, enabling accurate analysis without requiring complex real-time computation. The knowledge graph pre-stores semantic relationships and propagation patterns, allowing the system to leverage this structured knowledge for precise root cause identification.
Solution Approach 2:
The system performs preliminary action by pre-construction of the knowledge graph containing error propagation sequences and relationships before actual root cause analysis occurs. Expected log message sequences are predetermined and stored in the knowledge graph, allowing rapid comparison against actual sequences during error analysis. This pre-computation reduces on-the-fly complexity while maintaining high accuracy.
2Measurement precision
If manual inference and deep domain knowledge are required, then analysis thoroughness is improved, but analysis time increases
Solution Approach 1:
The knowledge graph enables self-service by automatically capturing and representing error propagation patterns from historical log data. The system autonomously builds the graph structure and expected sequences without requiring manual domain expertise for each analysis case. Once constructed, the knowledge graph serves itself to rapidly determine root causes by comparing actual sequences against pre-stored expected sequences, eliminating the need for manual inference while maintaining thoroughness.
Solution Approach 2:
The patent creates a simplified copy of the complex system behavior through the knowledge graph, which replicates error propagation patterns in an easily queryable format. Instead of requiring analysts to manually trace through complex system interactions, the knowledge graph provides a copied representation of these relationships that can be quickly searched and compared, dramatically reducing analysis time while preserving analytical thoroughness.
Data Source
AI summary
Aspects of the invention include constructing a knowledge graph by writing a plurality of data structures to connect correlated log messages in a system log. Detecting an anomalous log message based on the knowledge graph, wherein the anomalous log message is connected to a plurality of candidate root cause error log messages. Determining respective sequences from each of the plurality of candidate root cause error log messages to the anomalous log message. Calculating a deviation score for each respective sequence based on a deviation of an expected sequence for each candidate root cause error log message and the determined sequence. Determining a root cause log error message based on the calculated deviation scores.