Facilitating root cause analysis for abnormal behavior of systems in a networked environment

A computer readable storage medium storing instructions for causing a monitoring system to facilitate root cause analysis for an abnormality with respect to a problem attribute of interest, which when executed by a processor causes the processor to perform actions comprising:

• specifying, by a user, an alarm rule to specify an association information including information that a set of causation attributes are associated with said problem attribute,
• wherein said alarm rule includes a definition of an abnormality defining a deviation threshold,
• wherein when said problem attribute exceeds said deviation threshold, said problem attribute is considered to have an abnormality;
• storing said alarm rule in a non-volatile memory;
• monitoring, by a monitoring system, a resource element to retrieve values for said problem attribute in said resource element,
• wherein the monitoring system monitors the resource element by repeatedly polling, at a first polling interval, the set of causation attributes indicated by the alarm rule, the monitoring system also monitoring the resource element for the values of said problem attribute;
• storing the values for said problem attribute and said causation attributes in said non-volatile memory;
• determining, by the monitoring system, that said abnormality has occurred with respect to said problem attribute in said resource element by examining said stored values,
• wherein the determination that said abnormality has occurred is performed based on said problem attribute exceeding the deviation threshold indicated by said alarm rule;
• polling the resource element for values of each of said set of causation attributes at a second polling interval upon determining that said abnormality has occurred based on said user having specified said alarm rule association information,
• wherein the second polling interval is less than the first polling interval such that more detailed information is available upon occurrence of said abnormality;
• storing said polled values in said non-volatile memory;
• displaying said problem attribute to a user;
• receiving an indication that the user wishes to perform root cause analysis with respect to said displayed problem attribute;
• and
• retrieving and displaying said values of said set of causation attributes stored in said non-volatile memory in response to said user having specified said set of causation attributes in said alarm rule and receiving said indication,
• wherein said polled values from before the determination that said abnormality has occurred and said polled values from after the determination that said abnormality has occurred are accessible by said user to enable the user to detect any changes in a pattern of polled values of said set of causation attributes.

A system comprising:

• a memory;
• a processor to retrieve one or more instructions from said memory and to execute said one or more instructions to cause said system to facilitate root cause analysis in a networked environment with respect to a problem attribute by performing a set of actions, said set of actions comprising:
• specifying, by a user, an alarm rule to specify an association information including information that a set of causation attributes are associated with said problem attribute,
• wherein said alarm rule includes a definition of an abnormality defining a deviation threshold,
• wherein when said problem attribute exceeds said deviation threshold, said problem attribute is considered to have an abnormality;
• storing said alarm rule in a non-volatile memory;
• monitoring, by a monitoring system, a resource element to retrieve values for said problem attribute in said resource element,
• wherein the monitoring system monitors the resource element by repeatedly polling, at a first polling interval, the set of causation attributes indicated by the alarm rule, the monitoring system also monitoring the resource element for the values of said problem attribute;
• storing the values for said problem attribute and said causation attributes in said non-volatile memory;
• determining, by the monitoring system, that said abnormality has occurred with respect to said problem attribute in said resource element by examining said stored values,
• wherein the determination that said abnormality has occurred is performed based on said problem attribute exceeding the deviation threshold indicated by said alarm rule;
• polling the resource element for values of each of said set of causation attributes at a second polling interval upon determining that said abnormality has occurred based on said user having specified said alarm rule association information,
• wherein the second polling interval is less than the first polling interval such that more detailed information is available upon occurrence of said abnormality;
• storing said polled values in said non-volatile memory;
• displaying said problem attribute to a user;
• receiving an indication that the user wishes to perform root cause analysis with respect to said displayed problem attribute;
• and
• retrieving and displaying said values of said set of causation attributes stored in said non-volatile memory in response to said user having specified said set of causation attributes in said alarm rule and receiving said indication,
• wherein said polled values from before the determination that said abnormality has occurred and said polled values from after the determination that said abnormality has occurred are accessible by said user to enable the user to detect any changes in a pattern of polled values of said set of causation attributes.