# US 2017/0286200 A1 · Dynamic monitoring and problem resolution > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0286200 A1 - Document ID: US20170286200A1 - Status: Published application - Kind: A1 - Application number: 15/089,765 - Filed: 2016-04-04 - Published: 2017-10-05 - Earliest claimed: 2016-04-04 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Arunachalam Jayaraman - Web page: https://patentgrep.com/patent/US20170286200A1 ## CPC - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/0721: {within a central processing unit [CPU]} - G06F 11/0754: {by exceeding limits} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method, computer program product, and system for dynamic relational integrated intelligent monitoring and problem resolution of systems is provided. An IT environment is monitored for a first symptom. The first symptom is a malfunction of at least one component of a plurality of components. In response to determining a first measurement deviates from a reference value, a first component is determined to be the cause component. In response to determining a monitoring tier of the cause component is activated, a plurality of measurements is determined for the plurality of components. A component with the greatest number of activated monitoring tiers is identified and compared to the cause component. Probe data for the plurality of components is collected. A probe ripple is determined, based on one or more components affected by the malfunction. A root cause of the first symptom is reported. ## Claims ### Claim 1 A method comprising: monitoring, by one or more processors, an IT environment for a first symptom, wherein the IT environment comprises a plurality of components, and wherein the first symptom is based on a first measurement of an attribute of a first component of the plurality of components, and wherein the first symptom is a malfunction of the at least one component; in response to determining the first measurement deviates from a reference value, determining, by one or more processors, the first component is a cause of the first symptom based, at least in part, on the first measurement; in response to determining a monitoring tier of the cause component is activated, determining, by one or more processors, a plurality of measurements for the plurality of components; identifying, by one or more processors, a component of the plurality of components with the greatest number of activated monitoring tiers, based on the plurality of measurements; determining, by one or more processors, whether the component with the greatest number of activated monitoring tiers is the cause component; collecting, by one or more processors, probe data for the plurality of components; determining, by one or more processors, a probe ripple, wherein the probe ripple comprises one or more affected components of the plurality of components, wherein the one or more affected components are affected by the malfunction; and reporting, by one or more processors, a root cause of the first symptom based, at least in part, on the probe data and the probe ripple. ### Claim 2 (depends on 1) The method of claim 1, wherein each component of the plurality of components is expressed by a probe triangle, wherein the probe triangle defines a plurality of monitoring tiers, wherein each monitoring tier of the plurality of monitoring tiers comprises a condition and a degree of tolerance corresponding to the condition, and wherein a surface level attribute of each of the plurality of components is monitored at a first frequency. ### Claim 3 (depends on 1) The method of claim 1, further comprising: generating, by one or more processors, a three-dimensional probe ripple mesh, wherein the three-dimensional probe ripple mesh maps the relationship between the plurality of components in the IT environment. ### Claim 4 (depends on 3) The method of claim 3, wherein the relationship between each component of the plurality of components is selected from the list consisting of forward linear relational, backward linear relational, upward peer relational, and non-relational. ### Claim 5 (depends on 1) The method of claim 1, in response to determining the component with the greatest number of activated monitoring tiers is not the cause component: selecting, by one or more processors, a second cause component, wherein the second cause component is the component with the greatest number of activated monitoring tiers; collecting, by one or more processors, probe data for the plurality of components; determining, by one or more processors, a second probe ripple, wherein the second probe ripple is based on the second cause component wherein the second probe ripple comprises one or more affected components of the plurality of components, wherein the one or more affected components are affected by the malfunction; and reporting, by one or more processors, a root cause of the first symptom based, at least in part, on the probe data and the second probe ripple. ### Claim 6 (depends on 5) The method of claim 5, wherein the frequency of monitoring the surface level attribute is doubled in response to determining the next level probe of the cause component is activated. ### Claim 7 (depends on 6) The method of claim 6, wherein a next level attribute is monitored at the first frequency is response to determining the next level probe of the cause component is activated. ### Claim 8 A computer program product comprising: a computer readable storage medium and program instructions stored on the computer readable storage medium, the program instructions comprising: program instructions to monitor an IT environment for a first symptom, wherein the IT environment comprises a plurality of components, and wherein the first symptom is based on a first measurement of an attribute of a first component of the plurality of components, and wherein the first symptom is a malfunction of the at least one component; in response to determining the first measurement deviates from a reference value, program instructions to determine the first component is a cause of the first symptom based, at least in part, on the first measurement; in response to determining a monitoring tier of the cause component is activated, program instructions to determine a plurality of measurements for the plurality of components; program instructions to identify a component of the plurality of components with the greatest number of activated monitoring tiers, based on the plurality of measurements; program instructions to determine whether the component with the greatest number of activated monitoring tiers is the cause component; program instructions to collect probe data for the plurality of components; program instructions to determine a probe ripple, wherein the probe ripple comprises one or more affected components of the plurality of components, wherein the one or more affected components are affected by the malfunction; and program instructions to report a root cause of the first symptom based, at least in part, on the probe data and the probe ripple. ### Claim 9 (depends on 8) The computer program product of claim 8, wherein each component of the plurality of components is expressed by a probe triangle, wherein the probe triangle defines a plurality of monitoring tiers, wherein each monitoring tier of the plurality of monitoring tiers comprises a condition and a degree of tolerance corresponding to the condition, and wherein a surface level attribute of each of the plurality of components is monitored at a first frequency. ### Claim 10 (depends on 8) The computer program product of claim 8, further comprising: program instructions to generate a three-dimensional probe ripple mesh, wherein the three-dimensional probe ripple mesh maps the relationship between the plurality of components in the IT environment. ### Claim 11 (depends on 10) The computer program product of claim 10, wherein the relationship between each component of the plurality of components is selected from the list consisting of forward linear relational, backward linear relational, upward peer relational, and non-relational. ### Claim 12 (depends on 8) The computer program product of claim 8, in response to determining the component with the greatest number of activated monitoring tiers is not the cause component: program instructions to select a second cause component, wherein the second cause component is the component with the greatest number of activated monitoring tiers; program instructions to collect probe data for the plurality of components; program instructions to determine a second probe ripple, wherein the second probe ripple is based on the second cause component wherein the second probe ripple comprises one or more affected components of the plurality of components, wherein the one or more affected components are affected by the malfunction; and program instructions to report a root cause of the first symptom based, at least in part, on the probe data and the second probe ripple. ### Claim 13 (depends on 12) The computer program product of claim 12, wherein the frequency of monitoring the surface level attribute is doubled in response to determining the next level probe of the cause component is activated. ### Claim 14 (depends on 13) The computer program product of claim 13, wherein a next level attribute is monitored at the first frequency is response to determining the next level probe of the cause component is activated. ### Claim 15 A computer system comprising: one or more computer processors; one or more computer readable storage media; program instructions stored on the computer readable storage media for execution by at least one of the one or more processors, the program instructions comprising: program instructions to monitor an IT environment for a first symptom, wherein the IT environment comprises a plurality of components, and wherein the first symptom is based on a first measurement of an attribute of a first component of the plurality of components, and wherein the first symptom is a malfunction of the at least one component; in response to determining the first measurement deviates from a reference value, program instructions to determine the first component is a cause of the first symptom based, at least in part, on the first measurement; in response to determining a monitoring tier of the cause component is activated, program instructions to determine a plurality of measurements for the plurality of components; program instructions to identify a component of the plurality of components with the greatest number of activated monitoring tiers, based on the plurality of measurements; program instructions to determine whether the component with the greatest number of activated monitoring tiers is the cause component; program instructions to collect probe data for the plurality of components; program instructions to determine a probe ripple, wherein the probe ripple comprises one or more affected components of the plurality of components, wherein the one or more affected components are affected by the malfunction; and program instructions to report a root cause of the first symptom based, at least in part, on the probe data and the probe ripple. ### Claim 16 (depends on 15) The computer system of claim 15, wherein each component of the plurality of components is expressed by a probe triangle, wherein the probe triangle defines a plurality of monitoring tiers, wherein each monitoring tier of the plurality of monitoring tiers comprises a condition and a degree of tolerance corresponding to the condition, and wherein a surface level attribute of each of the plurality of components is monitored at a first frequency. ### Claim 17 (depends on 15) The computer system of claim 15, further comprising: program instructions to generate a three-dimensional probe ripple mesh, wherein the three-dimensional probe ripple mesh maps the relationship between the plurality of components in the IT environment. ### Claim 18 (depends on 17) The computer system of claim 17, wherein the relationship between each component of the plurality of components is selected from the list consisting of forward linear relational, backward linear relational, upward peer relational, and non-relational. ### Claim 19 (depends on 15) The computer system of claim 15, in response to determining the component with the greatest number of activated monitoring tiers is not the cause component: program instructions to select a second cause component, wherein the second cause component is the component with the greatest number of activated monitoring tiers; program instructions to collect probe data for the plurality of components; program instructions to determine a second probe ripple, wherein the second probe ripple is based on the second cause component wherein the second probe ripple comprises one or more affected components of the plurality of components, wherein the one or more affected components are affected by the malfunction; and program instructions to report a root cause of the first symptom based, at least in part, on the probe data and the second probe ripple. ### Claim 20 (depends on 19) The computer system of claim 19, wherein the frequency of monitoring the surface level attribute is doubled in response to determining the next level probe of the cause component is activated, and wherein a next level attribute is monitored at the first frequency is response to determining the next level probe of the cause component is activated.