Context-aware automated root cause analysis in managed networks

Patent metadata

Field	Value
Publication number	US-11296922-B2
Application number	US-202016845269-A
Country	US
Kind code	B2
Filing date	Apr 10, 2020
Priority date	Apr 10, 2020
Publication date	Apr 5, 2022
Grant date	Apr 5, 2022

Abstract

Configuration management persistent storage contains entries representing configuration items and relationships between pairs of the configuration items. Event management persistent storage contains entries representing alert records. Change request persistent storage contains change records respectively referring to changes made to the configuration items. One or more processors may be configured to: extract, from a particular alert, a particular configuration item referred to therein that is associated with a particular problem; determine, by way of the relationships, a set of configuration items within a topological distance of the particular configuration item; identify, by way of the change records, one or more change requests that refer to any of the set of configuration items; and calculate root cause scores for the one or more change requests, wherein the root cause scores respectively represent estimations of impacts that the changes of the one or more change requests had on causing the particular alert.

First claim

What is claimed is:

1. A system comprising:
configuration management persistent storage containing entries representing configuration items and relationships between pairs of the configuration items, wherein the configuration items specify units of computing hardware deployed on a managed network and units of software hosted by the units of computing hardware;
event management persistent storage containing entries representing alert records, wherein the alert records respectively refer to problems detected on the configuration items;
change request persistent storage containing change records, wherein the change records respectively refer to changes made to the configuration items; and
one or more processors configured to:
extract, from a particular alert of the alert records, a particular configuration item referred to therein that is associated with a particular problem;
determine, by way of the relationships, a set of configuration items within a pre-determined topological distance from the particular configuration item, wherein the pre-determined topological distance is based on a number of hops from a unit of computing hardware or software represented by the particular configuration item;
identify, by way of the change records, one or more change requests that refer to any of the set of configuration items;
calculate root cause scores for the one or more change requests, wherein the root cause scores respectively represent estimations of impacts that the changes of the one or more change requests had on causing the particular alert; and
provide the root cause scores in decreasing order of the estimations of impacts.

2. The system of claim 1 , wherein the configuration management persistent storage, the event management persistent storage, and the change request persistent storage are implemented in separate databases.

3. The system of claim 1 , wherein the configuration management persistent storage, the event management persistent storage, and the change request persistent storage are implemented using different sets of tables within a common database.

4. The system of claim 1 , wherein the system is part of a remote network management platform that is physically distinct from the managed network.

5. The system of claim 1 , wherein the alert records were generated by one or more of the configuration items.

6. The system of claim 1 , wherein the alert records are respectively associated with creation times, wherein the change records that have been completed are respectively associated with completion times, and wherein identifying the one or more change requests comprises determining that the one or more change requests have completion times within a predefined threshold duration before a particular creation time of the particular alert.

7. The system of claim 1 , wherein the alert records are respectively associated with creation times, wherein the change records that have been completed are respectively associated with completion times, and wherein the root cause scores are based on differences between the completion times of the change requests and a particular creation time of the particular alert.

8. The system of claim 1 , wherein the root cause scores are based on respective topological distances between the particular configuration item and the set of configuration items.

9. The system of claim 1 , wherein the pre-determined topological distance is one hop or two hops.

10. The system of claim 1 , wherein the one or more processors are further configured to:
identify, by way of the alert records, one or more alerts that refer to any of the set of configuration items, wherein the root cause scores also respectively represent estimations of relevance that the one or more alerts have to the particular alert, and wherein the root cause scores are provided in decreasing order of the estimations of impacts and the estimations of relevance.

11. The system of claim 1 , further comprising:
an incident persistent storage containing entries representing incident reports, wherein the incident reports respectively refer to configuration items suspected of being related to incidents observed in the managed network, wherein the one or more processors are further configured to:
identify, by way of the incident reports, one or more incident reports that refer to any of the set of configuration items; and
calculate the root cause scores also for the one or more incident reports, wherein the root cause scores respectively represent estimations of relevance that the incidents of the one or more incident reports have to the particular alert.

12. A computer-implemented method comprising:
extracting, from a particular alert, a particular configuration item referred to therein that is associated with a particular problem, wherein the particular alert is from an event management persistent storage that contains entries representing alert records, and wherein the alert records respectively refer to problems detected on the configuration items;
determining, by way of relationships between pairs of configuration items, a set of configuration items within a pre-determined topological distance from the particular configuration item, wherein a configuration management persistent storage contains entries representing the configuration items and the relationships between pairs of the configuration items, wherein the configuration items specify units of computing hardware deployed on a managed network and units of software hosted by the units of computing hardware, and wherein the pre-determined topological distance is based on a number of hops from a unit of computing hardware or software represented by the particular configuration item;
identifying, by way of change records, one or more change requests that refer to any of the set of configuration items, wherein a change request persistent storage contains the change records, wherein the change records respectively refer to changes made to the configuration items;
calculating root cause scores for the one or more change requests, wherein the root cause scores respectively represent estimations of impacts that the changes of the one or more change requests had on causing the particular alert; and
providing the root cause scores in decreasing order of the estimations of impacts.

13. The computer-implemented method of claim 12 , wherein the alert records are respectively associated with creation times, wherein the change records that have been completed are respectively associated with completion times, and wherein identifying the one or more change requests comprises determining that the one or more change requests have completion times within a predefined threshold duration before a particular creation time of the particular alert.

14. The computer-implemented method of claim 12 , wherein the alert records were generated by one or more of the configuration items.

15. The computer-implemented method of claim 12 , wherein the alert records are respectively associated with creation times, wherein the change records that have been completed are respectively associated with completion times, and wherein the root cause scores are based on differences between the completion times of the change requests and a particular creation time of the particular alert.

16. The computer-implemented method of claim 12 , wherein the root cause scores are based on respective topological distances between the particular configuration item and the set of configuration items.

17. The computer-implemented method of claim 12 , wherein the pre-determined topologic

Assignees

• Servicenow Inc

Inventors

• Leibkowiz Yair
• Rimar Yuval
• Tzur Rani
• Wigelman Maayan
• Miron Dov
• Makovsky Bnayahu

Classifications

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L41/0895

  Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements · CPC title

• H04L41/069

  using logs of notifications; Post-processing of notifications · CPC title

• G06F16/2358

  Change logging, detection, and notification (replication G06F16/27) · CPC title

• H04L41/0631 Primary

  using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis · CPC title