Context-aware automated root cause analysis in managed networks
Configuration management persistent storage contains entries representing configuration items and relationships between pairs of the configuration items. Event management persistent storage contains entries representing alert records. Change request persistent storage contains change records respectively referring to changes made to the configuration items. One or more processors may be configured to: extract, from a particular alert, a particular configuration item referred to therein that is associated with a particular problem; determine, by way of the relationships, a set of configuration items within a topological distance of the particular configuration item; identify, by way of the change records, one or more change requests that refer to any of the set of configuration items; and calculate root cause scores for the one or more change requests, wherein the root cause scores respectively represent estimations of impacts that the changes of the one or more change requests had on causing the particular alert.
1. A system comprising:
persistent storage containing (i) configuration items specifying computing hardware and software hosted by the computing hardware, (ii) alert records referring to problems detected on the configuration items, and (iii) change records referring to changes made to the configuration items; and
one or more processors configured to:
extract, from an alert of the alert records, a configuration item referred to therein that is associated with a problem;
determine a set of related configuration items related to the configuration item associated with the problem by traversing configuration item relationships associated with the configuration items;
identify, by way of the change records, one or more changes made to any of the set of the related configuration items; and
provide representations of the one or more changes as probable root causes of the problem.
2. The system of claim 1 , wherein the configuration items, the alert records, and the change records are stored in one of: (i) separate databases, or (ii) different sets of tables within a common database.
3. The system of claim 1 , wherein the computing hardware is disposed upon a network that is physically distinct from the system.
4. The system of claim 1 , wherein the alert records were generated by one or more of the configuration items.
5. The system of claim 1 , wherein the alert records are respectively associated with creation times, wherein the change records referring to changes that have been completed are respectively associated with completion times, and wherein identifying the one or more changes comprises determining that the one or more changes are from a subset of the change records referring to changes that have completion times within a predefined threshold duration before a creation time of the alert.
6. The system of claim 1 , wherein the one or more processors are further configured to:
calculate root cause scores for the one or more changes, wherein the root cause scores respectively represent estimations of impacts that each of the one or more changes had on causing the alert, and wherein providing the representations of the one or more changes comprises providing the root cause scores with each of the one or more changes.
7. The system of claim 6 , wherein the alert records are respectively associated with creation times, wherein the change records referring to changes that have been completed are respectively associated with completion times, and wherein the root cause scores are based on differences between the completion times and a creation time of the alert.
8. The system of claim 6 , wherein the configuration item relationships between the configuration items are used to formulate the configuration items into a graph, and wherein the root cause scores are based on respective distances between the configuration item associated with the problem and the set of the related configuration items in the graph.
9. The system of claim 8 , wherein determining the set of the related configuration items related to the configuration item associated with the problem comprises determining that the respective distances between the configuration item associated with the problem and the set of the related configuration items in the graph is two hops or less.
10. The system of claim 6 , wherein the one or more processors are further configured to:
identify, by way of the alert records, one or more alerts that refer to any of the set of the related configuration items, wherein the root cause scores also respectively represent estimations of relevance that the one or more alerts have to the alert.
11. The system of claim 6 , wherein the persistent storage further contains incident reports, wherein the incident reports respectively refer to suspect configuration items specified as being related to incidents observed amongst the configuration items, and wherein the one or more processors are further configured to:
identify, by way of the incident reports, one or more incident reports that refer to any of the set of the related configuration items; and
calculate the root cause scores also for the one or more incident reports, wherein the root cause scores respectively represent estimations of relevance that the incidents of the one or more incident reports have to the alert.
12. A computer-implemented method comprising:
maintaining in persistent storage: (i) configuration items specifying computing hardware and software hosted by the computing hardware, (ii) alert records referring to problems detected on the configuration items, and (iii) change records referring to changes made to the configuration items;
extracting, from an alert of the alert records, a configuration item referred to therein that is associated with a problem;
determining a set of related configuration items related to the configuration item associated with the problem by traversing configuration item relationships associated with the configuration items;
identifying, by way of the change records, one or more changes made to any of the set of the related configuration items; and
providing representations of the one or more changes as probable root causes of the problem.
13. The computer-implemented method of claim 12 , wherein the alert records are respectively associated with creation times, wherein the change records referring to changes that have been completed are respectively associated with completion times, and wherein identifying the one or more changes comprises determining that the one or more changes are from a subset of the change records referring to changes that have completion times within a predefined threshold duration before a creation time of the alert.
14. The computer-implemented method of claim 12 , further comprising:
calculating root cause scores for the one or more changes, wherein the root cause scores respectively represent estimations of impacts that each of the one or more changes had on causing the alert, and wherein providing the representations of the one or more changes comprises providing the root cause scores with each of the one or more changes.
15. The computer-implemented method of claim 14 , wherein the alert records are respectively associated with creation times, wherein the change records referring to changes that have been completed are respectively associated with completion times, and wherein the root cause scores are based on differences between the completion times and a creation time of the alert.
16. The computer-implemented method of claim 14 , wherein the configuration item relationships between the configuration items are used to formulate the configuration items into a graph, and wherein the root cause scores are based on respective distances between the configuration item associated with the problem and the set of the related configuration items in the graph.
17. The computer-implemented method of claim 16 , wherein determining the set of the related configuration items related to the configuration item associated with the problem comprises determining that the respective distances between the configuration item associated with the problem and the set of the related configuration items in the graph is two hops or less.
18. The computer-implemented method of claim 14 , further comprising:
identifying, by way of the alert records, one or more alerts that refer to any of the set of the related configuration items, wherein the root cause scores also respectively represent estimations of relevance that the one or more alerts have to the alert.
19. An article of manufacture including a non-transitory computer-readable medium, having stored thereon program instructions that, upon execution by a computing system, cause the computing system to perform operations comprising:
maintaining in persistent storage: (i) configuration items specifying computing hardware and software hosted by the computing hardware, (ii) alert records referring to problems detected on the configuration items, and (iii) change records referring to changes made to the configuration items;
extracting, from an alert of the alert records, a configuration item referred to therein that is associated with a problem;
determining a set of related configuration items related to the configuration item associated with the problem by traversing configuration item relationships associated with the configuration items;
identifying, by way of the change records, one or more changes made to any of the set of the related configuration items; and
providing representations of the one or more changes as probable root causes of the problem.
20. The system of claim 1 , wherein the set of related configuration items that relate to the configuration item associated with the problem are within a pre-determined topological distance from the configuration item associated with the problem, wherein the pre-determined topological distance is based on a number of hops from a unit of computing hardware or software represented by the configuration item associated with the problem.