Identifying a root cause of alerts within virtualized computing environment monitoring system
This disclosure describes techniques for analyzing information generated as a result of monitoring resources within computing environments. In one example, this disclosure describes a method that includes observing a plurality of alerts generated in response to monitoring resources associated with a plurality of connected elements within a network; determining a plurality of occurrence counts; determining a plurality of concurrent occurrence counts, wherein each of the plurality of concurrent occurrence counts represents a count of concurrent occurrences of two or more of the alerts in the set of historical alerts; and identifying one or more root cause alerts, wherein the one or more root cause alerts are determined based on the plurality of occurrence counts and the plurality of the concurrent occurrence counts, and wherein the one or more root cause alerts are a subset of the plurality of alerts.
1. A method comprising:
observing, by a computing system and over a plurality of time bins, a plurality of alerts generated in response to monitoring resources associated with a plurality of connected elements within a network, wherein the plurality of alerts includes a first alert and a second alert, and wherein each of the plurality of alerts occurs within one or more of the plurality of time bins;
determining, by the computing system, an occurrence count for each of the plurality of alerts, wherein the occurrence count represents a count of the time bins in which a respective alert occurs;
determining, by the computing system, a concurrent occurrence count for each pair of alerts within the plurality of alerts, wherein the concurrent occurrence count represents a count of the time bins during which both alerts within the corresponding pair of alerts occurs;
identifying, by the computing system and based on the occurrence count for each of the plurality of alerts and the concurrent occurrence count for each pair of alerts, a root cause alert included within the plurality of alerts, wherein identifying the root cause alert includes:
identifying an edge weight for the first alert by dividing the concurrent occurrence count for the first alert and the second alert by the occurrence count for the first alert, and
identifying an edge weight for the second alert by dividing the concurrent occurrence count for the first alert and the second alert by the occurrence count for the second alert; and
outputting, by the computing system, a user interface identifying the root cause alert included in the plurality of alerts.
2. The method of claim 1 , wherein identifying the root cause alert further includes:
calculating an impact score for the first alert by summing edge weights associated with the first alert; and
calculating an impact score for the second alert by summing edge weights associated with the second alert.
3. The method of claim 2 , wherein identifying the root cause alert further includes:
determining that the impact score for the first alert is greater than the impact score for the second alert; and
identifying, based on determining that the impact score for the first alert is greater than the impact score for the second alert, the first alert as the root cause alert.
4. The method of claim 1 , wherein the plurality of alerts includes a first alert and a second alert, and wherein outputting the user interface includes:
presenting information about each of plurality of alerts, including the first alert and the second alert; and
responsive to detecting input, presenting information identifying the first alert as the root cause alert.
5. The method of claim 4 , wherein presenting information about each of plurality of alerts includes:
presenting, for each of the plurality of alerts, information relating to one or more of an alert module, an alert name, an alert severity, an amount of time since an alert was triggered, an alert state, an alert metric, and an alert instance.
6. The method of claim 1 , wherein identifying the root cause alert includes:
generating element dependency information for the plurality of connected elements within the network;
generating, based on the first alert and the second alert, an alert dependency graph, wherein the alert dependency graph includes a node for each of the first alert and the second alert; and
identifying, based on the element dependency information, pairs of related nodes.
7. A system comprising:
a storage system; and
processing circuitry having access to the storage device and configured to:
observe, over a plurality of time bins, a plurality of alerts generated in response to monitoring resources associated with a plurality of connected elements within a network, wherein the plurality of alerts includes a first alert and a second alert, and wherein each of the plurality of alerts occurs within one or more of the plurality of time bins,
determine an occurrence count for each of the plurality of alerts, wherein the occurrence count represents a count of the time bins in which a respective alert occurs,
determine a concurrent occurrence count for each pair of alerts within the plurality of alerts, wherein the concurrent occurrence count represents a count of the time bins during which both alerts within the corresponding pair of alerts occurs,
identify, based on the occurrence count for each of the plurality of alerts and the concurrent occurrence count for each pair of alerts, a root cause alert included within the plurality of alerts, wherein to identify the root cause alert, the processing circuitry is configured to:
identify an edge weight for the first alert by dividing the concurrent occurrence count for the first alert and the second alert by the occurrence count for the first alert, and
identify an edge weight for the second alert by dividing the concurrent occurrence count for the first alert and the second alert by the occurrence count for the second alert, and
output a user interface identifying the root cause alert included in the plurality of alerts.
8. The system of claim 7 , wherein to identify the root cause alert, the processing circuitry is further configured to:
calculate an impact score for the first alert by summing edge weights associated with the first alert; and
calculate an impact score for the second alert by summing edge weights associated with the second alert.
9. The system of claim 8 , wherein to identify the root cause alert, the processing circuitry is further configured to:
determine that the impact score for the first alert is greater than the impact score for the second alert; and
identify, based on determining that the impact score for the first alert is greater than the impact score for the second alert, the first alert as the root cause alert.
10. The system of claim 7 , wherein the plurality of alerts includes a first alert and a second alert, and wherein to output the user interface, the processing circuitry is further configured to:
present information about each of plurality of alerts, including the first alert and the second alert; and
responsive to detecting input, present information identifying the first alert as the root cause alert.
11. The system of claim 10 , wherein to present information about each of plurality of alerts, the processing circuitry is further configured to:
present, for each of the plurality of alerts, information relating to one or more of an alert module, an alert name, an alert severity, an amount of time since an alert was triggered, an alert state, an alert metric, and an alert instance.
12. The system of claim 8 , wherein to identify the root cause alert, the processing circuitry is further configured to:
generate element dependency information for the plurality of connected elements within the network;
generate, based on the first alert and the second alert, an alert dependency graph, wherein the alert dependency graph includes a node for each of the first alert and the second alert; and
identify, based on the element dependency information, pairs of related nodes.
13. A non-transitory computer-readable storage medium comprising instructions that, when executed, configure processing circuitry of a computing system to:
observe, over a plurality of time bins, a plurality of alerts generated in response to monitoring resources associated with a plurality of connected elements within a network wherein the plurality of alerts includes a first alert and a second alert, and wherein each of the plurality of alerts occurs within one or more of the plurality of time bins;
determine an occurrence count for each of the plurality of alerts, wherein the occurrence count represents a count of the time bins in which a respective alert occurs;
determine a concurrent occurrence count for each pair of alerts within the plurality of alerts, wherein the concurrent occurrence count represents a count of the time bins during which both alerts within the corresponding pair of alerts occurs;
identify, based on the occurrence count for each of the plurality of alerts and the concurrent occurrence count for each pair of alerts, a root cause alert included within the plurality of alerts, wherein to identify the root cause alert, the processing circuitry is configured to:
identify an edge weight for the first alert by dividing the concurrent occurrence count for the first alert and the second alert by the occurrence count for the first alert, and
identify an edge weight for the second alert by dividing the concurrent occurrence count for the first alert and the second alert by the occurrence count for the second alert; and
output a user interface identifying the root cause alert included in the plurality of alerts.
14. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions that configure the processing circuitry to identify the root cause alert include instructions that further configure the processing circuitry to:
calculate an impact score for the first alert by summing edge weights associated with the first alert; and
calculate an impact score for the second alert by summing edge weights associated with the second alert.
15. The non-transitory computer-readable storage medium of claim 14 , wherein the instructions that configure the processing circuitry to identify the root cause alert include instructions that further configure the processing circuitry to:
determine that the impact score for the first alert is greater than the impact score for the second alert; and
identify, based on determining that the impact score for the first alert is greater than the impact score for the second alert, the first alert as the root cause alert.
16. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions that configure the processing circuitry to identify the root cause alert include instructions that further configure the processing circuitry to:
generate element dependency information for the plurality of connected elements within the network;
generate, based on the first alert and the second alert, an alert dependency graph, wherein the alert dependency graph includes a node for each of the first alert and the second alert; and
identify, based on the element dependency information, pairs of related nodes.
17. The non-transitory computer-readable storage medium of claim 13 , wherein the plurality of alerts includes a first alert and a second alert, and wherein the instructions that configure the processing circuitry to output the user interface include instructions that further configure the processing circuitry to:
present information about each of plurality of alerts, including the first alert and the second alert; and
responsive to detecting input, present information identifying the first alert as the root cause alert.