Incremental causal discovery and root cause localization for online system fault diagnosis
A computer-implemented method for identifying root cause failure and fault events is provided. The method includes detecting a trigger point, converting, via an encoder, previous system state data, new batch data in a next system state, and a causal graph to system state-invariant embeddings and system state-dependent embeddings, generating a learned causal graph, via a graph generation layer, by integrating state-invariant and state-dependent information, and predicting, by a prediction layer, future time-series data on the learned causal graph.
1. A computer-implemented method for identifying root cause failure and fault events, the method comprising:
detecting a trigger point;
converting, via an encoder, previous system state data, new batch data in a next system state, and a causal graph to system state-invariant embeddings and system state-dependent embeddings;
generating a learned causal graph, via a graph generation layer, by integrating state-invariant and state-dependent information; and
predicting, by a prediction layer, future time-series data on the learned causal graph.
2. The computer-implemented method of claim 1 , wherein, when the learned causal graph and a root cause list converge, a root causes report for system recovery is generated.
3. The computer-implemented method of claim 1 , wherein a state-invariant decoder is employed to learn invariant causal relations across two system states.
4. The computer-implemented method of claim 3 , wherein a state-dependent decoder is employed to learn new causal relations introduced by the new batch data.
5. The computer-implemented method of claim 4 , wherein the state-invariant decoder produces a state-invariant causal graph and the state-dependent decoder produces a state-dependent causal graph.
6. The computer-implemented method of claim 5 , wherein the graph generation layer fuses the state-invariant causal graph with the state-dependent causal graph.
7. The computer-implemented method of claim 1 , wherein the learned causal graph is input into a root cause analysis algorithm to output top pods as root causes of system failures.
8. A computer program product for identifying root cause failure and fault events, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:
detecting a trigger point;
converting, via an encoder, previous system state data, new batch data in a next system state, and a causal graph to system state-invariant embeddings and system state-dependent embeddings;
generating a learned causal graph, via a graph generation layer, by integrating state-invariant and state-dependent information; and
predicting, by a prediction layer, future time-series data on the learned causal graph.
9. The computer program product of claim 8 , wherein, when the learned causal graph and a root cause list converge, a root causes report for system recovery is generated.
10. The computer program product of claim 8 , wherein a state-invariant decoder is employed to learn invariant causal relations across two system states.
11. The computer program product of claim 10 , wherein a state-dependent decoder is employed to learn new causal relations introduced by the new batch data.
12. The computer program product of claim 11 , wherein the state-invariant decoder produces a state-invariant causal graph and the state-dependent decoder produces a state-dependent causal graph.
13. The computer program product of claim 12 , wherein the graph generation layer fuses the state-invariant causal graph with the state-dependent causal graph.
14. The computer program product of claim 8 , wherein the learned causal graph is input into a root cause analysis algorithm to output top pods as root causes of system failures.
15. A computer processing system for identifying root cause failure and fault events, comprising:
a memory device for storing program code; and
a processor device, operatively coupled to the memory device, for running the program code to:
detect a trigger point;
convert, via an encoder, previous system state data, new batch data in a next system state, and a causal graph to system state-invariant embeddings and system state-dependent embeddings;
generate a learned causal graph, via a graph generation layer, by integrating state-invariant and state-dependent information; and
predict, by a prediction layer, future time-series data on the learned causal graph.
16. The computer processing system of claim 15 , wherein, when the learned causal graph and a root cause list converge, a root causes report for system recovery is generated.
17. The computer processing system of claim 15 , wherein a state-invariant decoder is employed to learn invariant causal relations across two system states.
18. The computer processing system of claim 17 , wherein a state-dependent decoder is employed to learn new causal relations introduced by the new batch data.
19. The computer processing system of claim 18 , wherein the state-invariant decoder produces a state-invariant causal graph and the state-dependent decoder produces a state-dependent causal graph.
20. The computer processing system of claim 19 , wherein the graph generation layer fuses the state-invariant causal graph with the state-dependent causal graph.