IDENTIFYING ALARMS FOR A ROOT CAUSE OF A PROBLEM IN A DATA PROCESSING SYSTEM

摘要

Methods for monitoring a networked computing environment and for consolidating multiple alarms under a single root cause are described. In some embodiments, in response to detecting an alert corresponding with a performance issue in a networked computing environment, a root cause identification tool may aggregate a plurality of alarms from a plurality of performance management tools monitoring the networked computing environment. The root cause identification tool may then generate a failure graph associated with the performance issue based on the plurality of alarms, determine a first set of leaf nodes of the failure graph, determine a first chain of failures based on the first set of leaf nodes, suppress (or hide) alarms that are not associated with the first chain of failures, and output a consolidated alarm associated with the first chain of failures.

主权项

1. A method for monitoring a networked computing environment, comprising:
detecting an alert corresponding with a performance issue within the networked computing environment; aggregating data from a plurality of monitoring applications monitoring the networked computing environment, the aggregated data comprises a plurality of alarms; generating a failure graph based on the aggregated data, the failure graph comprises a plurality of nodes and a set of directed edges, each directed edge of the set of directed edges corresponds with a causal relationship between a pair of the plurality of nodes, the alert corresponds with a root node of the failure graph; identifying a first leaf node of the plurality of nodes, the first leaf node corresponds with a root cause of the performance issue; determining a first chain of failures corresponding with the first leaf node and the root node of the failure graph; and outputting a consolidated alarm corresponding with the first chain of failures.