Algorithms for root cause analysis

1. A system for identifying a root cause of a performance issue in a monitored entity, including:

a processor;

a memory; and

one or more modules stored in the memory and executable by a processor to perform operations including:

detect a performance issue with the monitored entity in a monitored environment of networked entities;

receive a plurality of different datatypes and associated data for each entity of the networked entities, wherein the plurality of datatypes include metrics, events, logs, snapshots, and configurations;

provide a dashboard user interface to display the different datatypes and associated data for each entity as user selectable items;

receive user input through the dashboard user interface that indicate a selection of at least two datatypes of the plurality of received datatypes for performing correlation analysis;

perform the correlation analysis using the received user selection of the at least two datatypes, wherein the correlation analysis identifies words or phrases using a logs based analysis of log messages associated with the at least two datatypes;

identify a candidate root cause of the performance issue based on the correlation analysis using the identified words or phrases from the logs based analysis; and

display the identified candidate root cause through the dashboard user interface.

2. The system of claim 1 , wherein:

the monitored entity includes a business transaction;

the user input indicative of the selection of the two of the datatypes include a selection of events and metrics; and

the selection of metrics including a selection one of a plurality of metrics time-series for each entity.

3. The system of claim 2 , wherein the one or more modules are executable by a processor to perform operations including:

assign an anomaly score for each data point in the selected one of the plurality of metrics time-series for each entity;

determine a correlation between the assigned anomaly score and the events to perform the correlation; and

identify one or more of the events as the candidate root cause based on the correlation between the assigned anomaly score and the events.

4. The system of claim 1 , wherein:

the user input indicative of the selection of the two of the datatypes include a selection of logs and metrics; and

the selection of metrics including a selection one of a plurality of metrics time-series for each entity.

5. The system of claim 4 , wherein the one or more modules are executable by a processor to perform operations including:

assign an anomaly score for each data point in the selected one of the plurality of metrics time-series for each entity;

determine a correlation between the assigned anomaly score and words or phrases in the logs to perform the correlation; and

identify one or more of the words or phrases in the logs as the candidate root cause based on the correlation between the assigned anomaly score and the words or phrases in the logs.

6. The system of claim 1 , wherein:

the user input indicative of the selection of the two of the datatypes include a selection of configurations and metrics; and

the selection of metrics including a selection one of a plurality of metrics time-series for each entity.

7. The system of claim 6 , wherein the one or more modules are executable by a processor to perform operations including:

assign an anomaly score for each data point in the selected one of the plurality of metrics time-series for each entity;

determine a correlation between the assigned anomaly score and the configurations to perform the correlation; and

identify one or more of the configurations as the candidate root cause based on the correlation between the assigned anomaly score and the configurations.

8. A method for identifying a root cause of a performance issue in a monitored business transaction, including:

detecting a performance issue with the business transaction running in a monitored environment of networked entities;

receiving a plurality of different datatypes and associated data for each entity of the networked entities, wherein the plurality of datatypes include metrics, events, logs, snapshots, and configurations;

providing a dashboard user interface to display the different datatypes and associated data for each entity as user selectable items;

receiving user input through the dashboard user interface that indicate a selection of at least two datatypes of the plurality of received datatypes for performing correlation analysis;

performing the correlation analysis using the received user selection of the at least two datatypes, wherein the correlation analysis identifies words or phrases using a logs based analysis of log messages associated with the at least two datatypes;

identifying a candidate root cause of the performance issue based on the correlation analysis using the identified words or phrases from the logs based analysis; and

displaying the identified candidate root cause through the dashboard user interface.

9. The method of claim 8 , wherein:

the monitored entity includes a business transaction;

the user input indicative of the selection of the two of the datatypes include a selection of events and metrics; and

the selection of metrics including a selection one of a plurality of metrics time-series for each entity.

10. The method of claim 9 , including:

assigning an anomaly score for each data point in the selected one of the plurality of metrics time-series for each entity;

determining a correlation between the assigned anomaly score and the events to perform the correlation; and

identifying one or more of the events as the candidate root cause based on the correlation between the assigned anomaly score and the events.

11. The method of claim 8 , wherein:

the user input indicative of the selection of the two of the datatypes include a selection of logs and metrics; and

the selection of metrics including a selection one of a plurality of metrics time-series for each entity.

12. The method of claim 11 , including:

assigning an anomaly score for each data point in the selected one of the plurality of metrics time-series for each entity;

determining a correlation between the assigned anomaly score and words or phrases in the logs to perform the correlation; and

identifying one or more of the words or phrases in the logs as the candidate root cause based on the correlation between the assigned anomaly score and the words or phrases in the logs.

13. The method of claim 8 , wherein:

the user input indicative of the selection of the two of the datatypes include a selection of configurations and metrics; and

the selection of metrics including a selection one of a plurality of metrics time-series for each entity.

14. The method of claim 13 , including:

assigning an anomaly score for each data point in the selected one of the plurality of metrics time-series for each entity;

determining a correlation between the assigned anomaly score and the configurations to perform the correlation; and

identifying one or more of the configurations as the candidate root cause based on the correlation between the assigned anomaly score and the configurations.

15. A non-transitory computer readable medium embodying instructions when executed by a processor to cause operations to be performed including:

detecting a performance issue with the business transaction running in a monitored environment of networked entities;

receiving a plurality of different datatypes and associated data for each entity of the networked entities, wherein the plurality of datatypes include metrics, events, logs, snapshots, and configurations;

providing a dashboard user interface to display the different datatypes and associated data for each entity as user selectable items;

receiving user input through the dashboard user interface that indicate a selection at least two of the datatypes of the plurality of received datatypes for performing correlation analysis for performing correlation analysis;

performing the correlation analysis using the received user selection of the at least two datatypes, wherein the correlation analysis identifies words or phrases using a logs based analysis of log messages associated with the at least two datatypes;

identifying a candidate root cause of the performance issue based on the correlation analysis using the identified words or phrases from the logs based analysis; and

displaying the identified candidate root cause through the dashboard user interface.

16. The non-transitory computer readable medium claim 15 , wherein: the monitored entity includes a business transaction;

the user input indicative of the selection of the two of the datatypes include a selection of events and metrics; and

the selection of metrics including a selection one of a plurality of metrics time-series for each entity.

17. The non-transitory computer readable medium of claim 16 , wherein the operations include:

assigning an anomaly score for each data point in the selected one of the plurality of metrics time-series for each entity;

determining a correlation between the assigned anomaly score and the events to perform the correlation; and

identifying one or more of the events as the candidate root cause based on the correlation between the assigned anomaly score and the events.

18. The non-transitory computer readable medium of claim 15 , wherein:

the user input indicative of the selection of the two of the datatypes include a selection of logs and metrics; and

the selection of metrics including a selection one of a plurality of metrics time-series for each entity.

19. The non-transitory computer readable medium of claim 18 , wherein the operations include:

assigning an anomaly score for each data point in the selected one of the plurality of metrics time-series for each entity;

determining a correlation between the assigned anomaly score and words or phrases in the logs to perform the correlation; and

identifying one or more of the words or phrases in the logs as the candidate root cause based on the correlation between the assigned anomaly score and the words or phrases in the logs.

20. The non-transitory computer readable medium of claim 15 , wherein the operations include:

the user input indicative of the selection of the two of the datatypes include a selection of configurations and metrics; and

the selection of metrics including a selection one of a plurality of metrics time-series for each entity.

21. The non-transitory computer readable medium of claim 20 , wherein the operations include:

assigning an anomaly score for each data point in the selected one of the plurality of metrics time-series for each entity;

determining a correlation between the assigned anomaly score and the configurations to perform the correlation; and

identifying one or more of the configurations as the candidate root cause based on the correlation between the assigned anomaly score and the configurations.