Determining dependent causes of a computer system event
Disclosed are methods and systems for determining combinations of system parameters that indicate a root cause of a system level experience deterioration (SLED). Some of the disclosed embodiments generate a decision tree from a first class of operational parameter datasets. Rules are derived from the decision tree. Filtered rule sets for feature parameters included in the system parameters are then determined. Pairs of features within a particular dataset that each satisfy their respective filtered rule sets are indicative of a root cause of the degradation, at least in some embodiments.
1. A method, comprising:
obtaining a plurality of datasets, each dataset comprising time correlated operational parameter values, the operational parameter values including values of feature parameters and values of target parameters;
classifying a portion of the datasets as either a first or second class of datasets based on a target parameter value indicated by each of the datasets;
generating a rule set from a decision tree based on the classifying;
identifying, from the plurality of datasets, a dataset of the first class that satisfies at least two sub-rules included in the rule set;
identifying a first feature parameter of the identified dataset based on a first sub-rule of the at least two sub-rules;
identifying a second feature parameter of the identified dataset based on a second sub-rule of the at least two sub-rules;
identifying a first remedial action based on the first feature parameter;
identifying a second remedial action based on the second feature parameter; and
performing one or more of the first remedial action or the second remedial action based on a first impact of the first remedial action and a second impact of the second remedial action, wherein determining the first impact is based on one or more of a number of users affected by the first remedial action, a priority of a device affected by the first remedial action, or a priority of network communication affected by the first remedial action.
2. The method of claim 1 , further comprising identifying a value of the first feature parameter is an outlier if the value of the first feature parameter does not satisfy threshold values of the first feature parameter, wherein the identifying of the first feature parameter is based on the identifying of the value of the first feature parameter as the outlier.
3. The method of claim 2 , further comprising determining quartile boundaries for the values of the feature parameters, wherein the identifying of the first feature parameter is based on determining that the value of the first feature parameter falls in a first quartile of the quartile boundaries or a fourth quartile of the quartile boundaries.
4. The method of claim 1 , wherein the classifying comprises a first classifying, wherein the first classifying of the portion as the first class includes evaluating the target parameter against a first predefined threshold, the method further comprising:
second classifying the plurality of datasets as either a third or fourth class of datasets based on a second threshold; and
wherein the rule set is further generated based on a second decision tree based on the second classifying.
5. The method of claim 1 , wherein the decision tree comprises:
one or more nodes assigned to the first class or the second class.
6. The method of claim 5 , wherein the generating of the rule set from the decision tree is based on the one or more nodes of the decision tree having at least a predefined number of ancestor nodes assigned to the first class.
7. The method of claim 1 , wherein the classifying comprises a first classifying, the method further comprising:
second classifying a second portion of the datasets as the first class of datasets based on a second target parameter value indicated by each of the datasets; and
generating the rule set based on a second decision tree based on the second classifying.
8. A system, comprising:
hardware processing circuitry;
one or more memories storing instructions that when executed configure hardware processing circuitry to perform operations comprising:
obtaining a plurality of datasets, each dataset comprising time correlated operational parameter values, the operational parameter values including values of feature parameters and values of target parameters;
classifying a portion of the datasets as either a first class or second class of datasets based on a target parameter value indicated by each of the datasets;
generating a rule set from a decision tree based on the classifying;
identifying, from the plurality of datasets, a dataset of the first class that satisfies at least two sub-rules included in the rule set;
identifying a first feature parameter of the identified dataset based on a first sub-rule of the at least two sub-rules;
identifying a second feature parameter of the identified dataset based on a second sub-rule of the at least two sub-rules;
identifying a first remedial action based on the first feature parameter;
identifying a second remedial action based on the second feature parameter; and
conditionally performing one or more of the first remedial action or the second remedial action based on a first impact of the first remedial action and a second impact of the second remedial action, wherein determining the first impact is based on one or more of a number of users affected by the first remedial action, a priority of a device affected by the first remedial action, or a priority of network communication affected by the first remedial action.
9. The system of claim 8 , the operations further comprising identifying a value of the first feature parameter is an outlier if the value falls outside a range between threshold values of the first feature parameter, wherein the identifying of the first feature parameter is based on the identifying of the value.
10. The system of claim 8 , wherein the classifying comprises a first classifying, wherein the first classifying of the portion as the first class includes evaluating the target parameter against a first predefined threshold, the operations further comprising:
second classifying the plurality of datasets as either a third or fourth class of datasets based on a second threshold; and
wherein the rule set is further generated based on a second decision tree based on the second classifying.
11. The system of claim 8 , wherein the classifying comprises a first classifying, the operations further comprising:
second classifying a second portion of the datasets as the first class of datasets based on a second target parameter value indicated by each of the datasets; and
generating the rule set based on a second decision tree based on the second classifying.
12. The system of claim 8 , wherein the classifying comprises a first classifying, wherein the first classifying of the portion of datasets of the first class is based on a first criterion, the operations further comprising:
second classifying a second portion of the datasets as the first class of datasets based on a second criterion; and
generating the rule set based on a second decision tree based on the second classifying.
13. The system of claim 12 , wherein the first criterion and second criterion reference a first predefined threshold and a second predefined threshold, respectively, the operations further comprising randomly determining the first predefined threshold and randomly determining the second predefined threshold.
14. The system of claim 8 , the operations further comprising:
determining a correlation of each feature parameter to the target parameter values of the first class; and
selecting a set of sub-rules based on the determined correlations, wherein the identifying of the dataset of the first class that satisfies at least the sub-rule identifies a dataset satisfying a sub-rule included in the set of sub-rules.
15. A non-transitory computer readable medium comprising instructions that when executed configure hardware processing circuitry to perform operations comprising:
obtaining a plurality of datasets, each dataset comprising time correlated operational parameter values, the operational parameter values including values of feature parameters and values of target parameters;
classifying a portion of the datasets as either a first or second class of datasets based on a target parameter value indicated by each of the datasets;
generating a rule set from a decision tree based on the classifying;
identifying, from the plurality of datasets, a dataset of the first class that satisfies at least two sub-rules included in the rule set;
identifying a first feature parameter based on a first sub-rule of the at least two sub-rules;
identifying a second feature parameter based on a second sub-rule of the at least two sub-rules;
identifying a first remedial action based on the first feature parameter;
identifying a second remedial action based on the second feature parameter; and
conditionally performing one or more of the first remedial action or the second remedial action based on a first impact of the first remedial action and a second impact of the second remedial action, wherein determining the first impact is based on one or more of a number of users affected by the first remedial action a priority of a device affected by the first remedial action, or a priority of network communication affected by the first remedial action.