Event root cause identification for computing environments
AssigneeCitrix Systems, Inc.
InventorsArjun Ashok Kumar, Maanusri Balasubramanian
Life of this patent
Estimating the term…
Abstract
Systems and apparatuses for identifying root causes of events within an computing environment described herein. A causality network may be generated based on detected events in the computing environment. The causality network may be nodes for the events and directed edges showing the casual relations between the nodes. Conditional probability tables (CPTs) for the nodes may show the strength of the causal relations. When an event occurs, computing device may identify the node for the event in the causal network and traverse the causal network until a root cause node is identified. The computing device may output the root cause node and the path of traversal.
Claims20
A method comprising:
- receiving, by a computing device, data indicative of a first event of a computing environment;
- identifying, by using natural language processing, a first data point, within a collection of data points, by comparing text associated with the first data point with text associated with the first event, wherein the collection of data points indicate events occurring in the computing device;
- determining a root cause of the first event by beginning an analysis of the collection of data points from the first data point and ending at a last data point of the collection of data points, wherein no other causal relations exist between the last data point and other data points of the collection of data points, and wherein the analysis comprises a determination to proceed from the first data point to a second data point, of the collection of data points, based on a probability that the second data point represents a second event causing the first event and an existence of a direct causal relation between the first data point and the second data point;
- generating an output indicating the root cause;
- and
- using the root cause to mitigate problems associated with the first event or the root cause.
A method comprising:
- receiving, by a computing device, data indicative of a first event of a computing environment;
- identifying, by using natural language processing, a first data point, within a collection of data points, by comparing text associated with the first data point with text associated with the first event, wherein the collection of data points indicate events occurring in the computing device;
- determining a root cause of the first event by traversing the collection of data points from the first data point until a second data point, with no parent data points, is reached, wherein the traversing is based on conditional probabilities of child data point and parent data point pairs in a path of the traversing;
- outputting a second event, represented by the second data point, as the root cause of the first event;
- and
- using the root cause to mitigate problems associated with the first event or the root cause.
A method comprising:
- receiving, by a computing device, a plurality of data instances from a computing environment;
- identifying, by using natural language processing, a plurality of events from the data instances;
- associating a first event, of the plurality of events, with a second event, of the plurality of events, to indicate a causal relation between the first event and the second event;
- in response to determining that the causal relation is a new relation:
- generating a first data point representing the first event and a second data point representing the second event;
- generating an edge from the first data point to the second data point;
- appending the edge, the first data point, and the second data point to a collection of data;
- and
- calculating conditional probability tables for at least one of the first data point and the second data point;
- deploying the collection of data to identify a root cause of a first event;
- and
- using the root cause to mitigate problems associated with the first event or the root cause.
Dependencies are inferred from the claim text.