Transaction Fingerprinting for IT Infrastructure Root Cause Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network management systems lack a holistic view of the interdependencies among IT infrastructure components, making it difficult to identify the root cause of problems in complex, dynamically interdependent systems.
Innovation Solution
A system and method that generates and uses 'problem fingerprints' by analyzing end-to-end metrics and events to capture the transaction topology before a problem occurs, allowing for real-time monitoring and alerting of potential issues by matching current activity against previously identified patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If element monitoring tools are used to monitor individual components, then monitoring coverage of individual elements is improved, but the ability to identify root causes in interdependent systems deteriorates
Solution Approach 1:
The patent segments the monitoring function into two layers: element-level monitoring (existing tools) and transaction-level monitoring (new fingerprinting system). Each layer serves a specific purpose, with the transaction layer analyzing sequences of element events to identify root causes, thus resolving the contradiction between comprehensive element monitoring and effective root cause detection
Solution Approach 2:
The patent introduces transaction fingerprints as an intermediary that bridges element-level monitoring data and root cause analysis. The fingerprint captures the sequence and correlation of events across multiple elements, enabling the system to trace problems back to their source without sacrificing detailed element-level monitoring capability
2Loss of information
If comprehensive monitoring of all IT infrastructure components is implemented, then system visibility is improved, but system complexity and cost increase
Solution Approach 1:
The patent extracts only the critical information needed for root cause analysis from the vast amount of monitoring data. Instead of analyzing all element events in detail, it captures transaction fingerprints that represent the essential sequence and correlation of events, reducing data processing complexity while maintaining comprehensive system visibility
Solution Approach 2:
The transaction fingerprinting system serves multiple functions simultaneously: it monitors system state, captures event sequences, identifies correlations, and enables root cause analysis. This multi-functionality reduces the need for separate specialized tools, thereby reducing overall system complexity while maintaining comprehensive visibility
3Loss of time
If reactive problem detection is used, then immediate problem identification is achieved, but preventive capability is lost
Solution Approach 1:
The patent performs preliminary action by capturing transaction fingerprints continuously in the normal operating state, before problems occur. These fingerprints establish a baseline of healthy system behavior and capture early signs of degradation. When anomalies are detected, the system can quickly compare against these pre-captured fingerprints to identify problems in their incipient stages, enabling preventive rather than purely reactive response
Data Source
AI summary
A system and method is provided for capturing and using problem fingerprints in an Information Technology (IT) infrastructure for integrity management. A fingerprint of the transaction topology in an IT infrastructure is automatically captured at various time intervals prior to the occurrence of an event leading to a problem, such as a failure, hard threshold violation, defined transaction violation or user-provided occurrence. The fingerprint provides an indication of the activity and operation of the IT infrastructure immediately preceding the problem event. The captured fingerprint is then used to monitor real-time data in the IT infrastructure operation and activity to look for activity that matches a captured fingerprint to provide an indication of a pending problems before the problems occur. When it is determined that there is sufficient probability a problem event will occur based upon real-time data matching a previously generated problem fingerprint, an alert is generated to provide sufficient notification prior to the occurrence of problem event.