Two-phase root cause analysis

A program storage device, readable by a programmable control device, comprising instructions stored on the program storage device for causing the programmable control device to:

• receive an event notification from a first node, said first node one of a plurality of nodes in an enterprise-specific fault model;
• perform an up-stream analysis of the fault model beginning at the first node;
• identify a second node, the second node having a status value modified during the up-stream analysis to indicate a failed status;
• perform a down-stream analysis of the fault model beginning at the second node;
• identify those nodes in a contiguous path between the second node and the first node in the fault model whose impact values indicate an impacted performance condition in accordance with the down-stream analysis;
• report the second node as a root cause of the received event notification;
• and
• report at least one of the identified nodes as impacted by the root cause of the received event notification and not as mat causes of the received event notification.

An enterprise including a plurality of operatively coupled monitored components, hereinafter referred to as nodes, comprising:

• a first node adapted to generate an event notification message, said first node one of a plurality of nodes in an enterprise-specific fault model;
• and
• a monitor agent operatively coupled to the first node and adapted to receive the event notification message, the monitor agent further adapted to:
• perform an up-stream analysis of the fault model beginning at the first node;
• identify a second node, the second node having a status value modified during the up-stream analysis to indicate a failed status;
• perform a down-stream analysis of the fault model beginning at the second node;
• identify those nodes in a contiguous path between the second node and the first node in the fault model whose impact values indicate an impacted performance condition in accordance with the down-stream analysis;
• report the second node as a root cause of the received event notification;
• and
• report at least one of the identified nodes as impacted by the root cause of the received event notification and not as root causes of the received event notification.

A fault analysis method, wherein at least a portion of a system is represented by a system-specific fault model having a plurality of nodes, comprising:

• receiving an event notification for a first node in the fault model;
• performing an up-stream analysis of the fault model beginning at the first node;
• identifying a second node, the second node having a status value modified during the up-stream analysis to indicate a failed status;
• performing a down-stream analysis of the fault model beginning at the second node;
• identifying those nodes in a contiguous path between the second node and the first node in the fault model whose impact values indicate an impacted performance condition in accordance with the down-stream analysis;
• reporting the second node as a root cause of the received event notification;
• and
• reporting at least one of the identified nodes as impacted by the root cause of the received event notification and not as root causes of the received event notification.

A fault analysis method, wherein at least a portion of a system is represented by a fault model having a plurality of nodes, comprising:

• receiving an event notification associated with a first node in the fault model;
• performing an up-stream analysis of the fault model beginning at the first node;
• identifying a second node having a status value that was modified during the up-stream analysis to indicate a failed status;
• performing a down-stream analysis of the fault model beginning at the second node;
• identifying nodes in a contiguous path between the second node and the first node in the fault model whose impact values indicate an impacted performance condition in accordance with the down-stream analysis;
• and
• indicating the second node as a root cause of the received event notification.