Automatic root cause analysis using ternary fault scenario representation

Abstract

A plurality of potential fault scenarios are accessed, wherein a given potential fault scenario of the plurality of potential fault scenarios has at least one corresponding root cause, and a representation of the given potential fault scenario comprises a don't care value. An actual fault scenario from telemetry received from a monitored system is generated. The actual fault scenario is matched against the plurality of potential fault scenarios. One or more matched causes are output as one or more probable root cause failures of the monitored system.

What is claimed is: 
     
         1 . A method, comprising:
 accessing a potential fault scenario comprising a plurality of symptoms, wherein the potential fault scenario has at least one corresponding root cause, and a representation of the symptom comprises a ternary value;   generating an actual fault scenario from telemetry received from a monitored system;   ternary matching the actual fault scenario against a plurality of potential fault scenarios comprising the potential fault scenario; and   outputting one or more matched causes as one or more probable root cause failures of the monitored system.   
     
     
         2 . The method of  claim 1 , wherein a ternary value comprising a value having three or more states comprises a “don't care” state. 
     
     
         3 . The method of  claim 1 , wherein a representation of the actual fault scenario comprises an actual fault ternary value. 
     
     
         4 . The method of  claim 1 , wherein ternary matching comprises a precise ternary matching. 
     
     
         5 . The method of  claim 1 , wherein ternary matching comprises a precise ternary matching comprising quaternary matching. 
     
     
         6 . The method of  claim 1 , wherein ternary matching of the actual fault scenario is performed without requiring contemporaneous updating of the actual fault scenario. 
     
     
         7 . The method of  claim 1 , wherein a representation of the actual fault scenario includes an unknown state. 
     
     
         8 . The method of  claim 1 , wherein the potential fault scenario is automatically generated by a configuration system. 
     
     
         9 . The method of  claim 1 , wherein the monitored system includes at least one of the following: a network system; a refrigeration system; an imaging system, and/or an intrusion detection system. 
     
     
         10 . The method of  claim 1 , wherein the plurality of potential fault scenarios are arranged in a table comprising ternary values. 
     
     
         11 . The method of  claim 1 , wherein the plurality of potential fault scenarios are arranged in a hierarchical table structure. 
     
     
         12 . The method of  claim 11 , wherein the hierarchical table structure includes a higher level root cause table (RCT) with a reduced number of symptoms per node of a network. 
     
     
         13 . The method of  claim 11 , wherein the hierarchical table structure includes a higher level RCT with a coarse-grained root cause. 
     
     
         14 . The method of  claim 11 , wherein the hierarchical table structure includes a higher level RCT for common cases wherein equipment is performing correctly. 
     
     
         15 . The method of  claim 11 , wherein the hierarchical table structure includes a lower level RCT for detailed cases wherein equipment is not performing completely correctly. 
     
     
         16 . The method of  claim 1 , wherein the ternary matching is performed on a plurality of processors in parallel. 
     
     
         17 . The method of  claim 1 , further comprising storing the given potential fault scenario in a ternary content addressable memory (T-CAM). 
     
     
         18 . The method of  claim 1 , further comprising storing each potential fault scenario of the plurality of potential fault scenarios into a same T-CAM. 
     
     
         19 . The method of  claim 1 , further comprising generating a second actual fault scenario from second telemetry received from a monitored system, wherein matching comprises: computing a first confidence of the actual fault scenario, computing a second confidence of the second actual fault scenario, and selecting between the actual fault scenario and the second actual fault scenario based at least in part on a comparison between the first confidence and the second confidence. 
     
     
         20 . A system, comprising:
 a processor configured to:
 access a potential fault scenario comprising a plurality of symptoms, wherein the potential fault scenario has at least one corresponding root cause, and a representation of the symptom comprises a ternary value; 
 generate an actual fault scenario from telemetry received from a monitored system; 
 ternary match the actual fault scenario against a plurality of potential fault scenarios comprising the potential fault scenario; and 
 output one or more matched causes as one or more probable root cause failures of the monitored system; and 
   a memory coupled to the processor and configured to provide the processor with instructions.   
     
     
         21 . A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
 accessing a potential fault scenario comprising a plurality of symptoms, wherein the potential fault scenario has at least one corresponding root cause, and a representation of the symptom comprises a ternary value;   generating an actual fault scenario from telemetry received from a monitored system;   ternary matching the actual fault scenario against a plurality of potential fault scenarios comprising the potential fault scenario; and   outputting one or more matched causes as one or more probable root cause failures of the monitored system.