Node Failure Scoring for Cross-Layer Alert Root Cause Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In information processing systems, identifying the root cause of alerts is challenging due to the complex interdependencies among nodes across different layers, such as communication devices, physical machines, and applications, where abnormalities in one node can propagate and affect others, making it difficult to pinpoint the actual cause of failures.
Innovation Solution
An information processing apparatus calculates base scores based on caller-callee relationships within layers and incorporates propagation scores based on dependency relationships across layers, using PageRank to determine failure scores for each node, thereby identifying nodes likely to be the cause of alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional monitoring methods are used to track node status in information processing systems, then system monitoring coverage is achieved, but the ability to identify root cause nodes deteriorates due to complex interdependencies across layers
Solution Approach 1:
The patent segments the complex system into distinct layers (communication devices, physical machines, virtual machines, applications) and calculates failure scores independently for each node within these segments. By dividing the monolithic system into manageable layers, the patent enables precise root cause identification without being overwhelmed by overall system complexity.
Solution Approach 2:
The patent introduces a new dimensional approach by calculating failure scores based on multi-dimensional factors including base scores (node-specific metrics), propagation scores (influence from adjacent nodes), and layer-specific weight coefficients. This dimensional expansion transforms the problem from simple alert detection to multi-factor failure probability assessment, improving root cause identification accuracy.
2Measurement precision
If failure scores are calculated for all nodes to identify root causes, then identification accuracy improves, but calculation time and processing load increase
Solution Approach 1:
The patent performs preliminary actions by pre-calculating and storing base scores for each node based on their specific metrics and characteristics before failure analysis is needed. When a failure occurs, the system only needs to calculate propagation scores and combine them with pre-computed base scores, significantly reducing real-time calculation time while maintaining accuracy.
Solution Approach 2:
The patent implements dynamic calculation where failure scores are updated based on current system state and alert information. The system dynamically adjusts which nodes require full calculation versus which can use cached values, optimizing the balance between accuracy and calculation time based on real-time conditions.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
It is possible to enable appropriate identification of a node that is the cause of an alert. A processing unit 12 calculates a base score coefficient indicating a weight for each node, based on caller-callee relationship between nodes in the same layer, the caller-callee relationship being indicated in configuration information. The processing unit 12 calculates a base score for each node, based on alert information and the base score coefficients, the base score being based on an alert. The processing unit 12 calculates, for each pair of a node and its adjacent node identified based on the configuration information, a propagation score by multiplying the base score of the adjacent node by a propagation score coefficient based on dependency relationship between the node and the adjacent node. The processing unit 12 calculates, for each of the plurality of nodes, a failure score by summing the base score of the node and the propagation score corresponding to a pair of the node and its adjacent node. The processing unit 12 identifies one or more nodes that are candidates for the cause of the alert among the plurality of nodes, based on the failure scores of the plurality of nodes.