METHODS, APPARATUS AND ARTICLES OF MANUFACTURE TO PERFORM ROOT CAUSE ANALYSIS FOR NETWORK EVENTS

• US 20130185591A1
• Filed: 03/06/2013
• Published: 07/18/2013
• Est. Priority Date: 03/19/2010
• Status: Active Grant

• Current Assignee: ServiceNow Incorporated
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: GE, Zihui, Pei, Dan, Yates, Jennifer, Yan, He
• Granted Patent: US 8,761,029 B2
• Time in Patent Office: Days
• US Class Current: 714/26
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis

Abstract

Example methods, apparatus and articles of manufacture to perform root cause analysis for network events are disclosed. An example method includes retrieving a symptom event instance from a normalized set of data sources based on a symptom event definition; generating a set of diagnostic events from the normalized set of data sources which potentially cause the symptom event instance, the diagnostic events being determined based on dependency rules; and analyzing the set of diagnostic events to select a root cause event based on root cause rules.

Claims

1. A method of determining a root cause of a network problem, comprising:

identifying a symptom event from a set of events based on a symptom event definition;

classifying an event from the set of events as a diagnostic event that potentially caused the symptom event, the diagnostic event classified based on a dependency rule, the dependency rule including a spatial model to classify the event as the diagnostic event when the event is spatially related to the symptom event; and

analyzing the diagnostic event to determine whether the diagnostic event is a root cause event based on a root cause rule.

2. The method of claim 1, wherein the root cause rule is a reasoning rule.

3. The method of claim 1, wherein the root cause rule defines a likelihood of the diagnostic event being the root cause event.

4. The method of claim 1, wherein the dependency rule is a member of a set of dependency rules, the root cause rule is a member of a set of root cause rules, and further comprising:

correlating the root cause event and the symptom event to propose new dependency and root cause rules;

adding the new dependency rule to the set of dependency rules; and

adding the new root cause rule to the set of root cause rules.

5. The method of claim 4, further comprising validating the new dependency and root cause rules prior to updating the sets of the dependency and root cause rules.

6. The method of claim 1, further comprising storing the set of events in a distributed database.

7. The method of claim 1, wherein classifying the event further comprises comparing a first timestamp of the event from the set of events with a second timestamp of the symptom event to determine if the event should be classified as the diagnostic event.

8. An apparatus comprising:

a processor; and

a memory storing machine readable instructions that, when executed by the processor, cause the processor to perform the operations comprising;

gathering data related to network events;

normalizing the network events to form a normalized set;

identifying a set of diagnostic events joined to a symptom network event within the normalized set, the diagnostic events having a physical location related to the symptom network event identified using a spatial model; and

identifying a root cause event of the symptom network event based on the set of diagnostic events.

9. The apparatus as defined in claim 8, wherein the set of diagnostic events is created as a symptom event graph.

10. The apparatus as defined in claim 9, wherein the symptom event graph comprises a central node identifying the symptom event, and at least one leaf node identifying the diagnostic event.

11. The apparatus as defined in claim 8, wherein the processor is further to perform the operations comprising determining which of the network events should be included in the set of diagnostic events by comparing the location of the network events.

12. The apparatus as defined in claim 11, wherein the locations are physical locations.

13. The apparatus as defined in claim 8, wherein the processor is further to perform the operations comprising determining which of the network events should be included in the set of diagnostic events by comparing timestamps of the network events.

14. A tangible machine-readable medium storing instructions which, when executed, cause a machine to perform a method comprising:

identifying a symptom event from a set of events based on a symptom event definition;

classifying an event from the set of events as a diagnostic event that potentially caused the symptom event, the diagnostic event classified based on a dependency rule, the dependency rule including a spatial model to classify the event as the diagnostic event when the event is spatially related to the symptom event; and

analyzing the diagnostic event to determine whether the diagnostic event is a root cause event based on a root cause rule.

15. The tangible machine-readable medium of claim 14, wherein the root cause rule is a reasoning rule.

16. The tangible machine-readable medium of claim 14, wherein the root cause rule defines a likelihood of the diagnostic event being the root cause event.

17. The tangible machine-readable medium of claim 16, wherein the dependency rule is a member of a set of dependency rules, the root cause rule is a member of a set of root cause rules, and wherein the method further comprises:

correlating the root cause event and the symptom event to propose new dependency and root cause rules;

adding the new dependency rule to the set of dependency rules; and

adding the new root cause rule to the set of root cause rules.

18. The tangible machine-readable medium of claim 17, wherein the method further comprises validating the new dependency and root cause rules prior to updating the sets of the dependency and root cause rules.

19. The tangible machine-readable medium of claim 14, wherein the method further comprises storing the set of events in a database.

20. The tangible machine-readable medium of claim 14, wherein the method further comprises comparing a first timestamp of the event from the set of events with a second timestamp of the symptom event to determine if the event should be classified as the diagnostic event.