Detailed Diagnosis in Enterprise Networks

Summary

This paper describes and automated system for determining potential causes of errors in machines and applications in a network. The authors propose building a dependency graph of which components may impact one another. This is done using templates such as "a machine depends on its processes and its configuration" and "an application process depends on its configurations, its NbrSet, its host machine and the configuration of the machine." Using these heuristics a graph of dependent components is built. When a problem is encountered the system searches for the potential cause. To do this the authors assume that correlation implies causation. They calculate the probability of the erroneous outcome given the state of each of its dependencies. This is done using historical data collected during normal operation. This probability determines the weight, w, of the corresponding edge in the dependency graph, implying that this edge has a potential impact of w. Finally, the potential causes are ranked based on the total weight of the path from the cause to the error combined with a measure of the abnormality of each component in that path. Components that are highly impacting more abnormal components will have a higher score.

Thoughts

This is a neat high-level way to diagnose problems, but I am surprised that it works as well as they claim. I am concerned that this approach may be limited to a small set of problems. Also, using correlation to imply causation will not work well in all cases even if the authors found it to be accurate for a set of problems. Specifically, this can be a problem when interactions become more complex and an unknown factor causes both correlated outcomes.