Method and system for graph-based problem diagnosis and root cause analysis for IT operation

A computing system for a graph-based analysis for Information Technology (IT) operations, comprising:

• a graph construction module stored in a memory of the computing system, configured to generate a temporal graph extracted from operation data including operation objects, relations, and attributes of workloads distributed across a plurality of levels of the IT operations within a predetermined time window;
• an anomaly detection and error annotation module stored in a memory of the computing system, configured to detect anomalies and annotate corresponding objects in the temporal graph by highlighting the detected one or more anomalies in the temporal graph;
• an error propagation inference module stored in a memory of the computing system, configured to:
• determine a directional impact between corresponding objects on the temporal graph;
• refine the temporal graph based on the determined directional impact;
• search accessible paths in the temporal graph indicating error propagation;
• and
• identify one or more potential causes of the anomalies for one or more of the detected anomalies in the temporal graph;
• and
• a root cause ranking module stored in a memory of the computing system configured to generate a ranked list of the potential causes of the anomalies for each of the corresponding objects in the temporal graph.

A non-transitory computer readable storage medium tangibly embodying a computer readable program code having computer readable instructions that, when executed, causes a computer device to perform a method of attribute discovery for operation objects from operation data, the method comprising:

• generating a temporal graph by extracting one or more of operation objects, relations and attributes from operation data of workloads distributed across a plurality of levels of the IT operation within a predetermined time window;
• detecting one or more anomalies from the extracted operation data and annotating corresponding objects in the graph by highlighting the detected one or more anomalies within the graph;
• determining a directional impact between corresponding objects on the temporal graph;
• refining the temporal graph based on the determined directional impact;
• searching accessible paths in the temporal graph indicating error propagation;
• identifying potential causes for one or more of the detected anomalies in the temporal graph;
• and
• generating a list of the potential causes of the anomalies for each of the corresponding objects in the temporal graph.