Method and system for performing root cause analysis

Abstract

A root cause analysis engine uses event survival times and gradual deletion of events to improve analysis accuracy and reduce the number of required calculations. Certainty factors of relevant rules are recalculated every time notification of an event is received. The calculation results are held in a rule memory in the analysis engine. Each event has a survival time, and when the time has expired, that event is deleted from the rule memory. Events held in the rule memory can be deleted without affecting other events held in the rule memory. The analysis engine can then re-calculate the certainty factor of each rule by only performing the re-calculation with respect to affected rules that are related with the deleted event. The calculation cost can be reduced because analysis engine processes events incrementally or decrementally. Analysis engine can determine the most possible conclusion even if one or more condition elements were not true, because analysis engine can calculate the certainty factor of rule even if one or more events were not notified to analysis engine.

What is claimed: 
     
         1 . A method for monitoring a system, the method comprising:
 managing a plurality of events which occur in the system, each of the plurality of events having a validation duration, wherein a first type event of the plurality of events has a first validation duration and a second type event of the plurality of the events has a second validation duration which is different from the first validation duration; and   executing a root cause analysis based on one or more events, of the plurality of events, whose validation durations have not expired.   
     
     
         2 . A method according to  claim 1 ,
 wherein a validation duration of an event is defined at least based on an event type of the event.   
     
     
         3 . A method according to  claim 1 ,
 wherein a validation duration of an event is defined based on a combination of an event type of the event and a node in the system where the event occurs.   
     
     
         4 . A method according to  claim 1 ,
 wherein the system includes a server in which the first type event occurs and a storage in which the second type event occurs, and   wherein the first validation duration is shorter than the second validation duration.   
     
     
         5 . A method according to  claim 1 ,
 wherein a weight of an event in the root cause analysis is decreased based on an attrition rate of the event.   
     
     
         6 . A method according to  claim 1 ,
 wherein the attrition rate is a rate per certain time to reduce the weight of the event in the root cause analysis.   
     
     
         7 . A method according to  claim 4 ,
 wherein a first attrition rate of the first type event is different from a second attrition rate of the second type event.   
     
     
         8 . A method according to  claim 4 ,
 wherein the attrition rate of the event is defined at least based on an event type of the event.   
     
     
         9 . A method according to  claim 4 ,
 wherein the attrition rate of the event is defined based on a combination of an event type of the event and a node in the system where the event occurs.