Automatic root cause analysis using ternary fault scenario representation

1. A method, comprising:

accessing a potential fault scenario comprising a plurality of symptoms, wherein:

the potential fault scenario has at least one corresponding root cause;

the plurality of symptoms may include a mapped symptom, wherein the mapped symptom is based on a specified threshold value; and

a representation of each symptom of the plurality of symptoms comprises a ternary value;

generating an actual fault scenario from telemetry received from a monitored system;

in the event the plurality of symptoms includes the mapped symptom, mapping associated telemetry at least in part by using the specified threshold value;

ternary matching the actual fault scenario against a plurality of potential fault scenarios comprising the potential fault scenario; and

outputting one or more matched causes as one or more probable root cause failures of the monitored system.

2. The method of claim 1 , wherein the representation of the symptom comprising a value having three or more states comprises a “don't care” state.

3. The method of claim 1 , wherein a representation of the actual fault scenario comprises a ternary value having three states.

4. The method of claim 1 , wherein matching comprises a precise ternary matching.

5. The method of claim 1 , wherein matching comprises a precise ternary matching comprising quaternary matching.

6. The method of claim 1 , wherein matching of the actual fault scenario is performed without requiring contemporaneous updating of the actual fault scenario.

7. The method of claim 1 , wherein a representation of the actual fault scenario includes an unknown state.

8. The method of claim 1 , wherein the given potential fault scenario is automatically generated by a configuration system.

9. The method of claim 1 , wherein the monitored system includes at least one of the following: a network system; a refrigeration system; an imaging system, and/or an intrusion detection system.

10. The method of claim 1 , wherein the plurality of potential fault scenarios are arranged in a table comprising ternary values.

11. The method of claim 1 , wherein the plurality of potential fault scenarios are arranged in a hierarchical table structure.

12. The method of claim 11 , wherein the hierarchical table structure includes a higher level root cause table (RCT) with a reduced number of symptoms per node of a network.

13. The method of claim 11 , wherein the hierarchical table structure includes a higher level RCT with a coarse-grained root cause.

14. The method of claim 11 , wherein the hierarchical table structure includes a higher level RCT for common cases wherein equipment is performing correctly.

15. The method of claim 11 , wherein the hierarchical table structure includes a lower level RCT for detailed cases wherein equipment is not performing completely correctly.

16. The method of claim 1 , wherein the matching is performed on a plurality of processors in parallel.

17. The method of claim 1 , further comprising storing the given potential fault scenario in a ternary content addressable memory (T-CAM).

18. The method of claim 1 , further comprising storing each potential fault scenario of the plurality of potential fault scenarios into a same T-CAM.

19. The method of claim 1 , further comprising generating a second actual fault scenario from second telemetry received from a monitored system, wherein matching comprises: computing a first confidence of the actual fault scenario, computing a second confidence of the second actual fault scenario, and selecting between the actual fault scenario and the second actual fault scenario based at least in part on a comparison between the first confidence and the second confidence.

20. A system, comprising:

a processor configured to:

access a potential fault scenario comprising a plurality of symptoms, wherein:

the potential fault scenario has at least one corresponding root cause;

the plurality of symptoms may include a mapped symptom, wherein the mapped symptom is based on a specified threshold value; and

a representation of the symptom comprises a value having three or more states;

generate an actual fault scenario from telemetry received from a monitored system;

in the event the plurality of symptoms includes the mapped symptom, mapping associated telemetry at least in part by using the specified threshold value;

ternary match the actual fault scenario against a plurality of potential fault scenarios comprising the potential fault scenario; and

output one or more matched causes as one or more probable root cause failures of the monitored system; and

a memory coupled to the processor and configured to provide the processor with instructions.

21. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

accessing a potential fault scenario comprising a plurality of symptoms, wherein:

the potential fault scenario has at least one corresponding root cause;

the plurality of symptoms may include a mapped symptom, wherein the mapped symptom is based on a specified threshold value;

and a representation of each symptom of the plurality of symptoms comprises a ternary value;

generating an actual fault scenario from telemetry received from a monitored system;

in the event the plurality of symptoms includes the mapped symptom, mapping associated telemetry at least in part by using the specified threshold value;

ternary matching the actual fault scenario against a plurality of potential fault scenarios comprising the potential fault scenario; and

outputting one or more matched causes as one or more probable root cause failures of the monitored system.