Root cause analysis of non-deterministic performance anomalies

A non-transitory machine readable medium storing a program for execution by a set of processing units of a set of one or more servers, the program for performing root cause analysis to identify performance degradation in a network comprising a plurality of components, the program comprising sets of instructions for:

• collecting, through the network, data regarding operation of a set of components, the collected data comprising deterministic data that provides a definitive value regarding operational states of a first subset components, and non-deterministic data that provides non-definite values regarding operational state of a second subset of components;
• performing a first analysis on the collected data to filter out data that is not relevant for the root cause analysis and to store data that remains after the filtering operation in a storage;
• retrieving data from the storage to perform a second analysis on the collected, filtered data to identify an instance in time when one or more components, while still operational, are potentially suffering from performance degradation;
• generating, from the collected, filtered data, a digital signature representing an operational performance of the set of components at the identified instance in time, said generated signature comprising deterministic and non-deterministic symptom values each of which is associated with a component in the set of components, each deterministic value specifying whether its associated component is operational or has failed, and each non-deterministic symptom value specifying whether its associated component is operating normally or anomalously;
• and
• performing a third analysis that compares the generated signature with a plurality of pre-tabulated signatures each of which is associated with at least one particular root cause for performance degradation of one component, in order to identify a root cause of a performance degradation of at least one component in the network,
• wherein at least two of the collecting, performing the first analysis, the retrieving, the generating the digital signature, and performing the third analysis are performed in parallel.