Method And System For Automatic Real-Time Causality Analysis Of End User Impacting System Anomalies Using Causality Rules And Topological Understanding Of The System To Effectively Filter Relevant Monitoring Data

A computer-implemented method for monitoring performance in a distributed computing environment, comprising:

• a) receiving, by a causality estimator, a triggering event, where the triggering event indicates an abnormal operating condition in the distributed computing environment;
• b) retrieving, by the causality estimator, a causality rule for the triggering event from a repository, where the causality rule includes applicability criteria that must be met by a given event in order to apply the causality rule, and acceptance criteria that must be met for there to be a causal relationship between the given event and another event;
• c) identifying a topology entity upon which the triggering event was observed, and retrieving a candidate topology entity from a topology model, where the acceptance criteria in the retrieved causality rule specifies a relationship between the identified topology entity and a candidate topology entity, and the retrieved candidate topology entity matches the relationship specified by the acceptance criteria in the retrieved causality rule, wherein the topology model includes topology entities which collectively describe the distributed computing environment and defines relationships between the topology entities;
• d) evaluating observation data for the candidate topology entity in relation to the acceptance criteria in the retrieved causality rule;
• and
• e) in response to the observation data for the candidate topology entity matching the acceptance criteria in the retrieved causality rule, indicating the occurrence of an additional event on the candidate topology entity that is causally related to the triggering event.

A computer-implemented system for monitoring performance in a distributed computing environment, comprising:

• a rule repository that stores causality rules, where each causality rule includes applicability criteria that must be met by a given event in order to apply the causality rule, and acceptance criteria that must be met for there to be a causal relationship between the given event and another event;
• a causality estimator is configured to receive a triggering event and, in response to receiving the triggering event, retrieves a causality rule for the triggering event from the rule repository, where the triggering event indicates an abnormal operating condition in the distributed computing environment;
• wherein the causality estimator identifies a topology entity upon which the triggering event was observed, and retrieves a candidate topology entity from a topology model, where the acceptance criteria in the retrieved causality rule specifies a relationship between the identified topology entity and a candidate topology entity, and the retrieved candidate topology entity matches the relationship specified by the acceptance criteria in the retrieved causality rule, wherein the topology model includes topology entities which collectively describe the distributed computing environment and defines relationships between the topology entities;
• for each candidate topology entity, the causality estimator evaluates observation data for the candidate topology entity in relation to the acceptance criteria in the retrieved causality rule;
• and in response to the observation data for the candidate topology entity matching the acceptance criteria in the retrieved causality rule, indicates the occurrence of an additional event on the candidate topology entity that is causally related to the triggering event, wherein the causality estimator is implemented by computer executable instructions executed by a computer processor.