Identifying problem graphs in an information technology infrastructure network

A system for identifying problem graphs in an information technology infrastructure network, the system comprising:

• a processor and a memory configured to provide computer program instructions to the processor to execute functions of a set of components:
• a node selecting component for selecting a set of nodes in a topology, wherein the nodes of the topology represent resources in an information technology infrastructure network;
• a state change data querying component for querying historical timeseries data for the selected nodes, wherein the timeseries data records changes in state of the resources represented by the nodes;
• and
• an analyzing component for analyzing the timeseries data for the selected nodes across problem time periods to produce a set of historical directional rules defining one or more historic problem graph, and with the analyzing component including:
• a transaction component for producing transactions based on the problem time periods by:
• defining a quiet period threshold to define a single-problem time period where one problem is present, and
• defining a distance threshold for nodes relating to the one problem, with the distance threshold defining a maximum distance between nodes to be considered as candidates that are relating to the one problem, and with the distance threshold being calculated by a first distance function;
• a problem periods component for identifying problem time periods in which neighboring or close nodes change problem state indicative of causality relationships, and
• an association rule mining component for determining if causality relationships consistently occur by applying an association rule mining algorithm to the transactions.

A computer program product for identifying problem graphs in an information technology infrastructure network, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:

• select a set of nodes in a topology, wherein the nodes of the topology represent resources in an information technology infrastructure network;
• query historical timeseries data for the selected nodes, wherein the timeseries data records changes in state of the resources represented by the nodes;
• and
• analyze the timeseries data for the selected nodes across problem time periods to produce a set of historical directional rules defining one or more historic problem graph, with the analysis including:
• producing transactions based on the problem time periods by:
• defining a quiet period threshold to define a single-problem time period where only one problem is present, and
• defining a distance threshold for nodes relating to the one problem, with the distance threshold defining a maximum distance between nodes to be considered as candidates that are relating to the one problem, and with the distance threshold being calculated by a first distance function;
• identifying problem time periods in which neighboring or close nodes change problem state indicative of causality relationships, and
• determining if causality relationships consistently occur by applying an association rule mining algorithm to the transactions.