Automatic root cause analysis using ternary fault scenario representation
A plurality of potential fault scenarios are accessed, wherein a given potential fault scenario of the plurality of potential fault scenarios has at least one corresponding root cause, and a representation of the given potential fault scenario comprises a don't care value. An actual fault scenario from telemetry received from a monitored system is generated. The actual fault scenario is matched against the plurality of potential fault scenarios. One or more matched causes are output as one or more probable root cause failures of the monitored system.
1. A method, comprising:
accessing a potential fault scenario comprising a plurality of symptoms, wherein the potential fault scenario has at least one corresponding root cause, and a representation of the symptom comprises a value having three or more states comprising a “don't care” state;
generating an actual fault scenario from telemetry received from a monitored system;
matching the actual fault scenario against a plurality of potential fault scenarios comprising the potential fault scenario; and
outputting one or more matched causes as one or more probable root cause failures of the monitored system.
2. The method of claim 1 , wherein a representation of the actual fault scenario comprises a ternary value having three states.
3. The method of claim 1 , wherein matching comprises a precise ternary matching.
4. The method of claim 1 , wherein matching comprises a precise ternary matching comprising quaternary matching.
5. The method of claim 1 , wherein matching of the actual fault scenario is performed without requiring contemporaneous updating of the actual fault scenario.
6. The method of claim 1 , wherein a representation of the actual fault scenario includes an unknown state.
7. The method of claim 1 , wherein the given potential fault scenario is automatically generated by a configuration system.
8. The method of claim 1 , wherein the monitored system includes at least one of the following: a network system; a refrigeration system; an imaging system, and/or an intrusion detection system.
9. The method of claim 1 , wherein the plurality of potential fault scenarios are arranged in a table comprising ternary values.
10. The method of claim 1 , wherein the plurality of potential fault scenarios are arranged in a hierarchical table structure.
11. The method of claim 10 , wherein the hierarchical table structure includes a higher level root cause table (RCT) with a reduced number of symptoms per node of a network.
12. The method of claim 10 , wherein the hierarchical table structure includes a higher level RCT with a coarse-grained root cause.
13. The method of claim 10 , wherein the hierarchical table structure includes a higher level RCT for common cases wherein equipment is performing correctly.
14. The method of claim 10 , wherein the hierarchical table structure includes a lower level RCT for detailed cases wherein equipment is not performing completely correctly.
15. The method of claim 1 , wherein the matching is performed on a plurality of processors in parallel.
16. The method of claim 1 , further comprising storing the given potential fault scenario in a ternary content addressable memory (T-CAM).
17. The method of claim 1 , further comprising storing each potential fault scenario of the plurality of potential fault scenarios into a same T-CAM.
18. The method of claim 1 , further comprising generating a second actual fault scenario from second telemetry received from a monitored system, wherein matching comprises:
computing a first confidence of the actual fault scenario, computing a second confidence of the second actual fault scenario, and selecting between the actual fault scenario and the second actual fault scenario based at least in part on a comparison between the first confidence and the second confidence.
19. A system, comprising:
a processor configured to:
access a potential fault scenario comprising a plurality of symptoms, wherein the potential fault scenario has at least one corresponding root cause, and a representation of the symptom comprises a value having three or more states comprising a “don't care” state;
generate an actual fault scenario from telemetry received from a monitored system;
match the actual fault scenario against a plurality of potential fault scenarios comprising the potential fault scenario; and
output one or more matched causes as one or more probable root cause failures of the monitored system; and
a memory coupled to the processor and configured to provide the processor with instructions.
20. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
accessing a potential fault scenario comprising a plurality of symptoms, wherein the potential fault scenario has at least one corresponding root cause, and a representation of the symptom comprises a value having three or more states comprising a “don't care” state;
generating an actual fault scenario from telemetry received from a monitored system;
matching the actual fault scenario against a plurality of potential fault scenarios comprising the potential fault scenario; and
outputting one or more matched causes as one or more probable root cause failures of the monitored system.