System and method for automatic root cause detection

• US 9,747,193 B1
• Filed: 03/13/2013
• Issued: 08/29/2017
• Est. Priority Date: 03/13/2013
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Reiss, Andreas
• Primary Examiner(s): Chowdhury, Ziaul A
• Application Number:
  US13/800,576
• Time in Patent Office: 1,630 Days
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: G06F 11/3636 by tracing the execution of the program
• CPC Class Codes: G06F 11/3668 Software testing software testing in telephone exchanges H04M3/242, testing of hardware G06F11/22
• CPC Class Codes: G06F 9/44 Arrangements for executing specific programs

Abstract

A system, method, and computer-readable storage medium are provided to automatically detect a root cause for an error that occurred during execution of functionality in a system. When a request is executed, a log associated with the execution of the request may be stored at the storage. The log may include information associated with a component associated with the execution of the request. Logs related to the same type of request may be compared with the executed request. Specifically, information associated with a component of the executed request may be compared with information associated with a component of the identified stored requests. When information associated with a component of the executed request does not match information associated with a component of the identified stored requests, a root cause for an error is associated with the associated component of the executed request.

Claims

1. A method being implemented on a computer system comprising a physical processor, the method comprising:

monitoring execution of a first request involving an application;

storing a log associated with the first request, the log associated with the first request comprising information associated with a first parameter associated with a first component of the first request, a first value associated with the first parameter, information associated with a second parameter associated with a second component of the first request, and a second value associated with the second parameter, wherein the first component of the first request is associated with the application and the second component of the first request is associated with another application;

identifying a subset of one or more logs from a collection of logs as an identified log by comparing a plurality of attributes of the first request to a corresponding plurality of attributes of the log, each log of the collection of logs having information associated with a component of another request;

responsive to identification of the identified log, comparing information associated with a first component of the first request with information associated with a component of the identified log, wherein the information associated with the first component of the first request comprises an input parameter processed by the first component, a response time associated with the first component, a time of day associated with the first component, and/or a position of the first component in the order of the components of the first request; and

responsive to a determination that the information associated with the first component of the first request does not match information associated with the component of the identified log, determining that a root cause of an error that occurred in the application is associated with the first component of the first request.

2. The method of claim 1, wherein the first request comprises a transaction, an application call, a command to execute a program, or a system call.

3. The method of claim 1, further comprising storing, at the log associated with the first request, information associated with an entry point of the first request.

4. The method of claim 1, wherein identifying the identified log comprises identifying a plurality of logs of the collection of logs associated with requests similar to the first request as a plurality of identified logs.

5. The method of claim 4, wherein identifying the plurality of identified logs comprises identifying an individual log in the collection of logs wherein an attribute of the plurality of attributes of the individual log and the first request are similar, wherein the attributes comprise one or more selected from:

an entry point, a number of components, a scheduled order of components accessed, or a number of applications accessed.

6. The method of claim 4, further comprising:

comparing a first value associated with a first parameter of the first component of the first request with respective values associated with respective parameters of respective components of the plurality of identified logs;

responsive to a determination that the first value of the first request does not match a respective value of an individual log of the plurality of identified logs, determining that the root cause for the error is associated with the first component of the first request.

7. The method of claim 4, further comprising:

comparing a first value associated with a first parameter of the first component of the first request with respective values associated with respective parameters of respective components of the plurality of identified logs;

responsive to a determination that the first value of the first request is outside a threshold value associated with the respective parameters of the plurality of identified logs, determining that the root cause for the error is associated with the first component of the first request.

8. The method of claim 1, further comprising providing information related to the root cause responsive to the determination of the root cause for the error.

9. A system comprising:

a physical processing device;

a computer-readable storage medium comprising instructions that, when executed using the physical processing device, are configured to put into effect a plurality of modules including;

a monitoring module configured to monitor execution of a first request involving an application and configured to store a log associated with the first request, the log associated with the first request comprising information associated with a first parameter associated with a first component of the first request, a first value associated with the first parameter, information associated with a second parameter associated with a second component of the first request, and a second value associated with the second parameter, wherein the first component of the first request is associated with the application and the second component of the first request is associated with another application; and

an error identification module configured to;

identify a subset of one or more logs from a collection of logs as an identified log by comparing a plurality of attributes of the first request to a corresponding plurality of attributes of the logs, each log of the collection of logs having information associated with a component of another request;

responsive to identification of the identified log, compare information associated with a first component of the first request with information associated with a component of the identified log, wherein the information associated with the first component of the first request comprises an input parameter processed by the first component, a response time associated with the first component, a time of day associated with the first component, and/or a position of the first component in the order of the components of the first request; and

responsive to a determination that the information associated with the first component of the first request does not match information associated with the component of the identified log, determine that a root cause of an error that occurred in the application is associated with the first component of the first request.

10. The system of claim 9, wherein the first request comprises a transaction, an application call, a command to execute a program, or a system call.

11. The system of claim 9, wherein the monitoring module is further configured to store, at the log associated with the first request, information associated with an entry point of the first request.

12. The system of claim 9, wherein the error identification module is configured to identify the identified log by identifying a plurality of logs of the collection of logs associated with requests similar to the first request as a plurality of identified logs.

13. The system of claim 12, wherein the error identification module is configured to identify the plurality of identified logs by identifying an individual log in the collection of logs wherein an attribute of the plurality of attributes of the individual log and the first request are similar, wherein the attribute comprise one or more selected from:

an entry point, a number of components, a scheduled order of components accessed, or a number of applications accessed.

14. The system of claim 12, wherein the error identification module is further configured to:

compare a first value associated with a first parameter of the first component of the first request with respective values associated with respective parameters of respective components of the plurality of identified logs; and

responsive to a determination that the first value of the first request does not match a respective value of an individual log of the plurality of identified logs, determine that the root cause for the error is associated with the first component of the first request.

15. The system of claim 12, wherein the error identification module is further configured to:

compare a first value associated with a first parameter of the first component of the first request with respective values associated with respective parameters of respective components of the plurality of identified logs; and

responsive to a determination that the first value of the first request is outside a threshold value associated with the respective parameters of the plurality of identified logs, determine that the root cause for the error is associated with the first component of the first request.

16. The system of claim 9, wherein the error identification module is further configured to provide information related to the root cause responsive to the determination of the root cause for the error.

17. A computer program product comprising:

a non-transitory computer readable storage medium storing information, the stored information comprising;

instructions configured to cause a computing device to;

monitor execution of a first request involving an application;

store a log associated with the first request, the log associated with the first request comprising information associated with a first parameter associated with a first component of the first request, a first value associated with the first parameter, information associated with a second parameter associated with a second component of the first request, and a second value associated with the second parameter, wherein the first component of the first request is associated with the application and the second component of the first request is associated with another application;

identify a subset of one or more logs from a collection of logs as an identified log by comparing a plurality of attributes of the first request to a corresponding plurality of attributes of the logs, each log of the collection of logs having information associated with a component of another request;

responsive to identification of the identified log, compare information associated with a first component of the first request with information associated with a component of the identified log, wherein the information associated with the first component of the first request comprises an input parameter processed by the first component, a response time associated with the first component, a time of day associated with the first component, and/or a position of the first component in the order of the components of the first request; and

responsive to a determination that the information associated with the first component of the first request does not match information associated with the component of the identified log, determine that a root cause of an error that occurred in the application is associated with the first component of the first request.

18. The computer program product of claim 17, wherein the first request comprises a transaction, an application call, a command to execute a program, or a system call.

19. The computer program product of claim 17, wherein the instructions are further configured to cause the computing device to store, at the first log, information associated with an entry point of the first request.

20. The computer program product of claim 17, wherein the instructions are configured to cause the computing device to identify the identified log by identifying a plurality of logs of the collection of logs associated with requests similar to the first request as a plurality of identified logs.

21. The computer program product of claim 20, wherein the error identification module is configured to identify the plurality of identified logs by identifying an individual log in the collection of logs wherein an attribute of the plurality of attributes of the individual log and the first request are similar, wherein the attribute comprise one or more selected from:

an entry point, a number of components, a scheduled order of components accessed, or a number of applications accessed.

22. The computer program product of claim 20, wherein the instructions are further configured to cause the computing device to:

compare a first value associated with a first parameter of the first component of the first request with respective values associated with respective parameters of respective components of the plurality of identified logs;

responsive to a determination that the first value of the first request does not match a respective value of an individual log of the plurality of identified logs, determine that the root cause for the error is associated with the first component of the first request.

23. The computer program product of claim 20, wherein the instructions are configured to cause the computing device to:

compare a first value associated with a first parameter of the first component of the first request with respective values associated with respective parameters of respective components of the plurality of identified logs;

responsive to a determination that the first value of the first request is outside a threshold value associated with the respective parameters of the plurality of identified logs, determine that the root cause for the error is associated with the first component of the first request.

24. The computer program product of claim 17, wherein the instructions are further configured to cause the computing device to provide information related to the root cause responsive to the determination of the root cause for the error.