Identifying a root cause of alerts within virtualized computing environment monitoring system
This disclosure describes techniques for analyzing information generated as a result of monitoring resources within computing environments. In one example, this disclosure describes a method that includes observing a plurality of alerts generated in response to monitoring resources associated with a plurality of connected elements within a network; determining a plurality of occurrence counts; determining a plurality of concurrent occurrence counts, wherein each of the plurality of concurrent occurrence counts represents a count of concurrent occurrences of two or more of the alerts in the set of historical alerts; and identifying one or more root cause alerts, wherein the one or more root cause alerts are determined based on the plurality of occurrence counts and the plurality of the concurrent occurrence counts, and wherein the one or more root cause alerts are a subset of the plurality of alerts.
1. A method comprising:
observing, by a computing system, a plurality of alerts generated in response to monitoring resources associated with a plurality of connected elements within a network;
determining, by the computing system and based on a set of historical alerts previously generated for at least some of the connected elements, a plurality of occurrence counts, wherein the set of historical alerts are organized into a plurality of time bins, wherein the plurality of occurrence counts includes an occurrence count for each of the plurality of alerts, and wherein each of the plurality of occurrence counts represents a count of the time bins in which a respective alert occurs;
determining, by the computing system, a plurality of concurrent occurrence counts, each concurrent occurrence count corresponding to a pair of alerts within the plurality of alerts, and wherein each of the plurality of concurrent occurrence counts represents a count of the time bins during which both alerts within the corresponding pair of alerts occurs in the set of historical alerts; and
identifying, by the computing system, one or more root cause alerts, wherein the one or more root cause alerts are identified based on an edge weight for each of the pairs of alerts, wherein the edge weight is calculated by dividing each of the concurrent occurrence counts by one of the occurrence counts, wherein the one or more root cause alerts has a total calculated edge weight greater than other edge weights, and wherein the one or more root cause alerts are a subset of the plurality of alerts.
2. The method of claim 1 , wherein identifying one or more root cause alerts includes:
generating element dependency information for the plurality of connected elements within the network;
generating, based on the plurality of alerts and the set of historical alerts, at least one alert dependency graph, wherein the at least one alert dependency graph includes a node for each of the plurality of alerts; and
identifying, based on the element dependency information, pairs of related nodes.
3. The method of claim 2 , wherein generating the at least one alert dependency graph includes:
calculating the edge weight for at least some of the pairs of related nodes.
4. The method of claim 1 , wherein identifying one or more root cause alerts further includes:
calculating an impact score for each of the plurality of alerts by summing, for each of the alerts, the edge weights associated with that alert; and
identifying, based on the largest impact scores, the one or more root cause alerts.
5. The method of claim 1 , wherein the one or more root cause alerts consists of a single root cause alert.
6. A computing system comprising:
a storage device; and
processing circuitry having access to the storage device and configured to:
observe a plurality of alerts generated in response to monitoring resources associated with a plurality of connected elements within a network, wherein the plurality of alerts includes a first alert and a second alert,
determine, based on a set of historical alerts previously generated for at least some of the connected elements, a first occurrence count, wherein the set of historical alerts are organized into a plurality of time bins, wherein the plurality of occurrence counts includes an occurrence count for each of the plurality of alerts, and wherein the first occurrence count represents a count of the time bins in which the first alert occurs,
determine, based on the set of historical alerts, a second occurrence count, wherein the second occurrence count represents a count of the time bins in which the second alert occurs in the set of historical alerts,
determine a concurrent occurrence count, wherein the concurrent occurrence count represents a count of time bins during which both the first alert and the second alert occur in the set of historical alerts, and
identify a root cause alert, wherein the root cause alert is identified based on an edge weight for the first alert and an edge weight for the second alert, wherein the edge weight for the first alert is calculated by dividing the concurrent occurrence count by the first occurrence count, wherein the edge weight for the second alert is calculated by dividing the concurrent occurrence count by the second occurrence count, wherein the root cause alert has an edge weight greater than other edge weights, and wherein the root cause alert is one of the plurality of alerts.
7. The computing system of claim 6 , wherein to identify the root cause alert, the processing circuitry is further configured to:
generate element dependency information for the plurality of connected elements within the network;
generate, based on the plurality of alerts and the set of historical alerts, at least one alert dependency graph, wherein the at least one alert dependency graph includes a node corresponding to each of the plurality of alerts; and
identify, based on the element dependency information, pairs of related nodes.
8. The computing system of claim 7 , wherein to generate at least one alert dependency graph, the processing circuitry is further configured to:
calculate the edge weight for at least some of the pairs of related nodes.
9. The computing system of claim 6 , wherein to identify the root cause alert, the processing circuitry is further configured to:
calculate an impact score for each of the plurality of alerts by summing, for each of the alerts, edge weights associated with that alert; and
identify, based on the largest impact score, the root cause alert.
10. A computer-readable storage medium comprising instructions that, when executed, configure processing circuitry of a computing system to:
observe a plurality of alerts generated in response to monitoring resources associated with a plurality of connected elements within a network;
determine, based on a set of historical alerts previously generated for at least some of the connected elements, a plurality of occurrence counts, wherein the set of historical alerts are organized into a plurality of time bins, wherein the plurality of occurrence counts includes an occurrence count for each of the plurality of alerts, and wherein each of the plurality of occurrence counts represents a count of the time bins in which a respective alert occurs;
determine a plurality of concurrent occurrence counts, each concurrent occurrence count corresponding to a pair of alerts within the plurality of alerts, and wherein each of the plurality of concurrent occurrence counts represents a count of the time bins during which both alerts within the corresponding pair of alerts occurs in the set of historical alerts; and
identify one or more root cause alerts, wherein the one or more root cause alerts are identified based on an edge weight for each of the pairs of alerts, wherein the edge weight is calculated by dividing each of the concurrent occurrence counts by one of the occurrence counts, wherein the one or more root cause alerts has a total calculated edge weight greater than other edge weights, and wherein the one or more root cause alerts are a subset of the plurality of alerts.
11. The computer-readable storage medium of claim 10 , wherein the instructions that configure the processing circuitry to identify one or more root cause alerts include instructions that, when executed, configure the processing circuitry to:
generate element dependency information for the plurality of connected elements within the network;
generate, based on the plurality of alerts and the set of historical alerts, at least one alert dependency graph, wherein the at least one alert dependency graph includes a node for each of the plurality of alerts; and
identify, based on the element dependency information, pairs of related nodes.
12. The computer-readable storage medium of claim 11 , wherein the instructions that configure the processing circuitry to generate the at least one alert dependency graph include instructions that, when executed, configure the processing circuitry to:
calculate the edge weight for at least some of the pairs of related nodes.
13. The computer-readable storage medium of claim 10 , wherein the instructions that configure the processing circuitry to identify one or more root cause alerts include instructions that, when executed, configure the processing circuitry to:
calculate an impact score for each of the plurality of alerts by summing, for each of the alerts, the edge weights associated with that alert; and
identify, based on the largest impact scores, the one or more root cause alerts.
14. The computer-readable storage medium of claim 10 , wherein the one or more root cause alerts consists of a single root cause alert.