Identifying root causes of failures in a deployed distributed application using historical fine grained machine state data

1. A method of identifying root causes of system failures in a distributed system, said method comprising:

utilizing at least one processor to execute computer code that performs the steps of:

recording, in a storage device, collected machine state data, wherein the collected machine state data are added to historical machine state data;

creating, based on the historical machine state data, a healthy map model;

detecting at least one failed machine state in the distributed system;

comparing the failed machine state against the healthy map model;

identifying, based on the comparison, at least one root cause of the failed machine state; and

displaying, on a display device, a ranked list comprising the at least one root cause.

2. The method according to claim 1 , wherein the machine state data comprise at least one of: a process, a connection, a configuration setting, an application metric, a resource attribute, a disk attribute, a processor attribute, and a memory attribute.

3. The method according to claim 1 , wherein the machine state data is collected at predetermined intervals; and the historical machine state data are updated when the machine state data is collected.

4. The method according to claim 1 , further comprising:

identifying dependencies between interconnected entities within the distributed system; and

creating a property graph representation based on the identified dependencies.

5. The method according to claim 4 , further comprising creating the healthy map model by aggregating a plurality of property graph representations, wherein each property graph relates to a particular snapshot of machine state data.

6. The method according to claim 4 , further comprising:

determining a failure time, wherein the failure time is associated with a machine state failure; and

determining a healthy time, wherein the healthy time is associated with a healthy state of the machine state and its dependencies prior to the failure time.

7. The method according to claim 6 , further comprising:

categorizing the machine state data collected between the healthy time and the failure time;

wherein the categorizing comprises determining if a machine state is at least one of new, missing, changed, and unchanged.

8. The method according to claim 7 , further comprising generating at least one seed-anomaly score, using an inference algorithm for machine states within the categorized machine state data.

9. The method according to claim 8 , further comprising modifying the at least one seed-anomaly score, based on an iterative graph convergence algorithm;

wherein the ranked list is based on the modified at least one seed-anomaly score.

10. An apparatus for identifying root causes of system failures in a distributed system apparatus comprising:

at least one processor; and

a computer readable storage medium having computer readable program code embodied therewith and executable by the at least one processor, the computer readable program code comprising:

computer readable program code that records, in a storage device, collected machine state data, wherein the collected machine state data are added to historical machine state data;

computer readable program code that creates, based on the historical machine state data, a healthy map model;

computer readable program code that detects at least one failed machine state in the distributed system;

computer readable program code that compares the failed machine state against the healthy map model;

computer readable program code that identifies, based on the comparison, at least one root cause of the failed machine state; and

computer readable program code that displays, on a display device, a ranked list comprising the at least one root cause.

11. A computer program product for identifying root causes of system failures in a distributed system, said computer program product comprising:

a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:

computer readable program code that records, in a storage device, collected machine state data, wherein the collected machine state data are added to historical machine state data;

computer readable program code that creates, based on the historical machine state data, a healthy map model;

computer readable program code that detects at least one failed machine state in the distributed system;

computer readable program code that compares the failed machine state against the healthy map model;

computer readable program code that identifies, based on the comparison, at least one root cause of the failed machine state; and

computer readable program code that displays, on a display device, a ranked list comprising the at least one root cause.

12. The computer program product according to claim 11 , wherein the machine state data comprise at least one of: a process, a connection, a configuration setting, an application metric, a resource attribute, a disk attribute, a processor attribute, and a memory attribute.

13. The computer program product according to claim 11 , wherein the machine state data is collected at predetermined intervals; and the historical machine state data are updated when the machine state data is collected.

14. The computer program product according to claim 11 , wherein the computer readable program code comprises:

computer readable program code that identifies dependencies between interconnected entities within the distributed system; and

creates a property graph representation based on the identified dependencies.

15. The computer program product according to claim 14 , wherein the computer readable program code comprises:

computer readable program code that creates the healthy map model by aggregating a plurality of property graph representations, wherein each property graph relates to a particular snapshot of machine state data.

16. The computer program product according to claim 15 , wherein the computer readable program code comprises:

computer readable program code that determines a failure time, wherein the failure time is associated with a machine state failure; and

determines a healthy time, wherein the healthy time is associated with a healthy state of the machine state and its dependencies prior to the failure time.

17. The computer program product according to claim 16 , wherein the computer readable program code comprises:

computer readable program code that categorizes the machine state data collected between the healthy time and the failure time;

wherein the categorizing comprises determining if a machine state is at least one of new, missing, changed, and unchanged.

18. The computer program product according to claim 17 , wherein the computer readable program code comprises: computer readable program code that generates at least one seed-anomaly score, using an inference algorithm for machine states within the categorized machine state data.

19. The computer program product according to claim 18 , wherein the computer readable program code comprises: computer readable program code that modifies the at least one seed-anomaly score, based on an iterative graph convergence algorithm;

wherein the ranked list is based on the modified at least one seed-anomaly score.

20. A method comprising:

recording, in a storage device, collected machine state data, wherein the collected machine state data are added to historical machine state data;

creating, based on the historical machine state data, a healthy map model;

detecting at least one failed machine state in the distributed system;

determining a failure time, wherein the failure time is associated with the at least one machine state failure;

determining a healthy time, wherein the healthy time is associated with a healthy state of the machine state and its dependencies prior to the failure time;

generating at least one seed-anomaly score, using an inference algorithm, for machine states between the healthy time and the failure time; and

modifying the at least one seed-anomaly score, based on an iterative graph convergence algorithm;

generating a ranked list of root causes of the at least one failed machine state, wherein the ranked list is based on the modified at least one seed-anomaly score.