PERFORMING ROOT CAUSE ANALYSIS ON DATA CENTER INCIDENTS

Described herein are technologies pertaining to identifying and applying association rules in connection with identifying a root cause of a problem in a computing system. The association rules are constrained such that one side of the association rules is unidimensional. Upon an incident report being received, association rules that are relevant to the incident report are identified and ranked, where a top threshold number of association rules is employed to identify a potential root cause of an incident represented by the incident report.

BACKGROUND

Performing root cause analysis with respect to incidents reported by a cloud computing system (e.g., in a data center that supports Software as a Service (SaaS), Platform as a Service (PaaS), storage as a service, etc.) is a difficult computational task, as a cloud computing system may include hundreds of thousands to millions of different, unique components, and an incident report may identify anywhere between one and thousands of components that correspond to an incident in the cloud computing system (e.g., where an incident may be a service disruption, a service slow down, or the like). Components of a cloud computing system include software and hardware computing components, as well as sensors that report statutes of one or more components in the cloud computing system. The components may be included in a core layer, an aggregation layer, and/or an access layer of the cloud computing system, where each of these layers includes different components.

For instance, the core layer provides a high-speed packet switching backplane for data flows going in and out of a data center of the cloud computing system. The core layer provides connectivity to multiple aggregation components, runs an interior routing protocol, and load balances traffic between different components of the data center. Components in the aggregation layer provide functions such as service module integration, domain definitions, spanning tree processing, default gateway redundancy, etc. Aggregation layer components may also provide services such as content switching, firewall, SSL offload, intrusion detection, network analysis, etc.

The access layer is where servers physically attach to a network. Server components in the access layer can include blade servers with integral switches, blade servers with pass-through cabling, clustered servers, mainframes, etc. Infrastructure of the access layer can include modular switches, integral blade server switches, etc. Components of all of these layers additionally include software components. Hence, it can be ascertained that a cloud computing system includes hundreds of thousands to millions of different components, some of which depend upon one another for proper functioning. Due to the large number of components, and co-dependencies between components, when an incident report is received, it is difficult to identify which component or set of components is the root cause of an incident represented in an incident report.

Conventional approaches for performing root cause analysis in a cloud computing system are either labor-intensive or computationally intensive. For example, the incident report can be provided to an engineer, and the engineer, based upon prior experience, checks on components that the engineer believes may be the root cause of an incident represented in the incident report. In another example, machine learning techniques have been employed in connection with identifying root causes of incidents in cloud computing systems. In these conventional machine learning techniques, however, a significant amount of training data must be collected, and training a deep neural network (DNN) is computationally expensive. Further, a machine learning model may become at least partially obsolete when components in the cloud computing environment are updated or changed, and the training process must be repeated.

SUMMARY

Described herein are various technologies relating to identifying a root cause of an incident represented in an incident report generated by a cloud computing system, where the incident may be a service disruption (for a specific service), a service slow down, or the like. With more particularly, association rule mining (ARM) is employed to identify association rules based upon components identified in incident reports generated by the cloud computing system over time, where the association rules are generated in a computationally-efficient manner. Each of the association rules includes a left-hand side (LHS) and a right-hand side (RHS), where items in the LHS of an association rule are mapped to a single item in the RHS of the association rule. With more particularity with respect to ARM, ARM is a rule-based machine learning method for discovering patterns in large data sets. For instance, there is a set l of n distinct items in a data set T of m transactions, where each transaction includes between two and n different items. Association rules are generated by, for each transaction, partitioning items into disjoint sets X and Y. An association rule based upon a transaction partitioned into disjoint sets X and Y is defined as a pattern that indicates that X, Y appears together with some frequency in T. When identifying association rules is constrained to the items in l being distinct and comparable, and Y being unidimensional, association rules can be identified in a computationally efficient manner.

More specifically, for a data set T that includes a relatively large number of transactions, where each transaction can potentially include a large number of items (where items represent components in a cloud computing system), all association rules represented in T, where Y is unidimensional, can be identified in P-time, which is a drastic improvement in computational efficiency over when Y may be multidimensional. Accordingly, for a large data set, thousands of association rules can be generated in a computationally efficient manner.

When an incident report is received, the association rules are searched based upon components identified in the incident report. Association rules that have items in a LHS (X) of the rules that at least partially overlap with items that represent components identified in the incident report are returned as potential association rules that may identify a root cause of an incident represented in the incident report. Identified association rules may then be ranked based upon values for a suitable metric corresponding to the association rules, where example metrics include, but are not limited to, confidence, support, lift, and conviction. In another example, a metric referred to herein as “relevance” for an association rule (based upon overlap between items in the LHS of the association rule and components identified in the incident report) can be computed and utilized in determining which of the association rules to identify and/or to position the identified association rules in a ranked list of association rules.

In response to identifying and ranking association rules based upon an incident report, a top threshold number of association rules are selected. In an example, the top threshold number of association rules are used to identify components that are potential root causes of the incident referenced in the incident report. For instance, identities of the component(s) are provided to an engineer in the cloud computing system, and the engineer inspects such components. In another example, identities of the components are provided to the cloud computing system, and such components are restarted automatically by the cloud computing system. Therefore, a root cause of an incident can be identified and addressed more quickly when compared to conventional approaches.

The technologies described herein exhibits various advantages over conventional approaches for performing root cause analysis with respect to components of a cloud computing system referenced in an incident report. Specifically, by mandating that Y (one of the disjoint sets created based upon items in a transaction) is unidimensional, association rules can be identified from a relatively large data set in a computationally-efficient manner (P-time). Further, all association rules represented in the data can be identified, rather than having to heuristically choose cutoffs to save computing resources. Moreover, a machine learned model need not be trained and executed to surface potential root causes of incident reports.

DETAILED DESCRIPTION

Various technologies pertaining to performing root cause analysis with respect to an incident represented in an incident report generated by a cloud computing system are described herein. As will be described in greater detail below, a database includes several transactions, where the transactions are representative of incident reports generated by the cloud computing system. Each transaction includes multiple items that are representative of components of the cloud computing system that are reporting information related to an incident that is captured in the incident report (where, for example, the incident is a service disruption, a service slowdown, or the like). The database may include thousands of such transactions, and transactions may include between two and tens of thousands of items. The technologies described herein include generating association rules based upon the transactions in the database, where each association rule includes a left-hand side (LHS) that comprises at least one item and a right-hand side (RHS) that has a single item. Put differently, each association rule maps one or more items to a respective single item. As will be described herein, the association rules are generated in a computationally-efficient manner (e.g., in P-time).

Once the association rules are generated, such rules can be employed in connection with identifying root causes corresponding to incident reports generated by the cloud computing system. For example, the cloud computing system emits an incident report, where the incident report includes identifiers of components of the cloud computing system that correspond to the incident. The association rules are searched based upon the components identified in the incident report, such that association rules having items in the LHS of such rules that at least partially overlap with items that represent identified components in the incident report are retrieved. The retrieved association rules are ranked based upon values computed for the association rules, where the values correspond to a metric, and further where the metric can be one or more of confidence, support, live, conviction, etc. In another example, the metric is relevance, which is indicative of an amount of overlap between items in the LHS of the rules and items that represent identified components in the incident report. Identities of components of the cloud computing system represented by items in the RHS of a threshold number of the most highly ranked association rules can be returned to a computing device operated by an engineer, who can then investigate the identified components to ascertain whether one or more of such components is the root cause of the incident represented in the incident report.

While the technologies described herein are set forth with respect to incident reports generated by cloud computing systems, such technologies can also be employed in other contexts where recommendations are to be presented. For example, the technologies described herein can be employed to predict a next webpage that will be visited by a user given some previous set of visited webpages. In another example, the technologies described herein are well suited to predict an item that will be purchased by a user given previous items purchased by the user.

With reference now toFIG.1, a functional block diagram of an example system100is illustrated, where the system100is configured to generate association rules and subsequently employ one or more generated association rules in connection with identifying a root cause of an incident represented in an incident report generated by a cloud computing system. The system100includes a cloud computing system102, where the cloud computing system102comprises several components104-106. The cloud computing system102may include thousands to millions of different components, where the components104-106include hardware components, software components, sensors, etc. For instance, one or more of the components104-106is a computing device, and one or more of the components104-106may be a software thread that is executing on such computing device. The cloud computing system102may include one or more data centers, and thus may include components typically found in such data centers. In still another example, the components104-106include a blade server, a thread executing on the blade server, an edge router, a network connection, a load balancer, etc.

Numerous computing devices108-110are in communication with the cloud computing system102by way of a network or networks. For example, the cloud computing system102offers one or more services, and the computing devices108-110access the cloud computing system102in connection with being provided the services.

When an incident occurs in the cloud computing system102, one or more computing devices of the cloud computing system102is configured to generate an incident report that is representative of an incident in the cloud computing system102. An incident can be a service disruption, a service slowdown, etc. The incident report includes several items that are representative of components from amongst the components104-106associated with the incident represented in the incident report. For instance, when a service provided by the cloud computing system102is detected as being slow, the incident report identifies the service and components amongst the components104-106that are associated with the service and/or that are reporting an error at the time of occurrence of the incident. Over time, the cloud computing system102may generate numerous incident reports (on the order of tens of thousands to millions of incident reports), where each incident report includes identifiers of numerous components that are associated with an incident.

The system100additionally includes a computing system112that is in communication with the cloud computing system102and receives incident reports generated by the cloud computing system102. The computing system112includes a data store114, where the data store114comprises a database of transactions116, where the transactions respectively correspond to incident reports generated by the cloud computing system102. Therefore, each transaction in the database of transactions116is representative of an incident report generated by the cloud computing system102. Each of the transactions in the database116includes numerous items that are representative of components from amongst the components104-106identified in an incident report.

The computing system112further includes a processor118and memory120, where the processor118executes instructions that are stored in the memory120. The memory120includes an association rules identifier system122and a rules applier system124, where such systems122and124will be described in greater detail below. Briefly, the association rules identifier system122generates association rules126based upon the transactions in the database116. The association rules identifier system122obtains a transaction from the database116, where the transaction includes several items that are not duplicative with respect one another. The association rules identifier system122then creates several pairs of disjoint sets of items, where one disjoint set in each pair of disjoint sets is unidimensional (e.g., one disjoint set in each pair includes a single item). The number of pairs of disjoint sets created for a transaction is equivalent to the number of items in the transaction.

The association rules identifier system122generates the association rules126based upon the pairs of disjoint sets. More specifically, the association rules identifier system122generates an association rule for each unique pair of disjoint sets created based upon the transactions in the database116. Each association rule in the association rules126includes a left-hand side (LHS) and a right-hand side (RHS), where the LHS of each association rule includes one or more items and the RHS of each association rule is unidimensional (e.g., includes a single item), where the association rule maps the one or more items in the RHS to the single item in the LHS (e.g., a set of items that comprises item(s) in the LHS of an association rule is also somewhat likely to include the item in the RHS of the association rule). As will be described in greater detail herein, because the RHS of each of the association rules126is unidimensional, the association rules identifier system122can generate the rules126in a computationally-efficient manner (e.g., in P-time), which is an improvement over conventional approaches for generating association rules based upon transactions that may include numerous items.

Referring briefly toFIG.2, a schematic that illustrates operation of the association rules identifier system122is illustrated. In the example shown inFIG.2, the association rules identifier system122receives a transaction from the database116that includes items A, B, C, and D. The association rules identifier system122generates four different pairs of disjoint sets of items, where these pairs include [A, BCD], [B, ACD], [C, ABD], and [D, ABC]. It is again noted that in each pair of disjoint sets, one set in a pair includes a single item. From these pairs of disjoint sets, the association rules identifier system122generates four association rules: 1) B,C,D→A; 2) A,C,D→B; 3) A,B,D→C; and 4) A,B,C→D.

Referring toFIG.3, another schematic illustrating operation of the association rules identifier system122is illustrated. In the example illustrated inFIG.3, the association rules identifier system122receives a transaction from the database116that includes the items A, B, C, D, and E. Based upon the transaction, the association rules identifier system122creates five pairs of disjoint sets of items, where each pair includes one set that is unidimensional. More specifically, the association rules identifier system122generates the following pairs of disjoint sets: [A, BCDE], [B, ACDE], [C, ABDE], [D, ABCE], and [E, ABCD]. From these five pairs of disjoint sets of items, the association rules identifier system122generates five association rules, where the RHS of each of the Association rules is unidimensional (as illustrated inFIG.3).

Returning toFIG.1, when a new incident report is generated by the cloud computing system102, the rules applier system124identifies rules that correspond to the incident represented in the incident report, where the rules applier system124identifies the rules based upon components of the cloud computing system102represented in the received incident report. The rules applier system124further ranks the identified rules based upon values assigned to the rules, where the values are for at least one metric. With more specificity, the rules applier system124receives the incident report, which includes identifiers for components from amongst the components104-106of the cloud computing system102that are associated with an incident represented by the incident report. The rules applier system124searches the rules126based upon the identifiers for the components included in the incident report, and identifies rules based upon such identifiers in the incident report. For example, the rules applier system124identifies each rule that has items in the LHS of the rule that at least partially overlap with items represented in the incident report. The rules applier system124may then rank the identified rules based upon values assigned to such rules, where a value assigned to a rule may be for a metric such as confidence, support, lift, conviction, and/or relevance (where relevance is described in greater detail below).

The rules applier system124may then select a top threshold number of rules from the ranked list of rules and, based upon the selected rules, transmit data to a computing device associated with the cloud computing system102. The data may identify components represented on the RHS of the selected rules, such that an engineer that is provided with such data can check the identified components in the cloud computing system102to ascertain whether such components (alone or in combination) are the root cause of the incident represented by the incident report. In another example, the data transmitted to the cloud computing system102causes the identified components to be restarted in connection with addressing the root cause of the incident referenced in the incident report.

Referring now toFIG.4, a schematic that illustrates operation of the rules applier system124is depicted. The rules applier system124includes an identifier module402and a ranker module404. The identifier module402identifies rules from the rules126that are potentially relevant to an incident report generated by the cloud computing system102. The ranker module404ranks the rules identified by the identifier module402based upon values assigned to such rules, wherein the values are for one or more metrics.

In the example shown inFIG.4, the rules applier system124receives an incident report406that includes a set of items408that represent components of the cloud computing system102, where the items are W, X, Y, and Z. The identifier module402searches the LHS of each rule in the rules126for overlap between the items408and items in the LHS of the rules.

As shown, the identifier module402identifies five association rules410from the rules126. The identifier module402identifies the rules410due to items in the LHS of the rules410at least partially overlapping with the items408in the incident report406. For instance, the identifier model402identifies a first rule due to the items408in the incident report406exactly matching the items in the LHS of the first rule (W,X,Y, Z). In another example, the identifier module402identifies a second rule (W, X, Z→P) due to W, X, and Z in the LHS of the second rule being included amongst the items408in the incident report406. In yet another example, the identifier module402identifies a third rule from the rules126based upon the third rule including the item W (along with A and C) in the LHS of the third rule, where W is also included in the items408in the incident report406. It can be ascertained that the rules126may include several thousand rules when the database116has a large number of transactions, and thus for a received incident report, the identifier module402may identify a relatively large number of rules.

The ranker module404ranks the rules identified by the identifier module402based upon values assigned to such rules. As indicated previously, and as described in greater detail below, values for confidence, support, lift, conviction, and/or relevance can be computed for rules in the identified set of rules410, and the ranker module404ranks rules in the rules410based upon one or more of the values for such metrics. The rules applier system124may then select a most highly ranked top threshold number (e.g., five) of rules from the identified rules based upon the ranking of the association rules performed by the ranker model404.

Additional detail pertaining to operation of the association rules identifier system122and the rules applier system124is now set forth. Association rule mining (ARM) performed by the association rules identifier system122is a rules-based machine learning method for discovering intersecting patterns in large data sets, such as the database of transactions116. Given a set l of n distinct items (e.g., the components104-106) and a data set T (the database of transactions116) of m transactions, where each of the transactions includes 2 to n different items, the association rules identifier system122can partition the items in a transaction into two disjoint sets X and Y. An association rule identified by the association rules identifier system122indicates that certain X, Y appear together with some frequency in T. Identifying all association rules represented in the database116(where an association rule is denoted as X→Y) is an NP hard problem, meaning that it is difficult to identify all the association rules within a reasonable amount of time and through use of a reasonable amount of computing resources.

When the association rules identifier system122identifies association rules with the constraints that the RHS of each of the rules is unidimensional and that items in1are distinct and comparable, then the association rules identifier system122can identify all association rules represented in the database116in P-time. More precisely, the data set T includes transactions T1, . . . Tm, with each transaction including two or more items from a distinct item set l. The association rules identifier system122can be configured to identify all patterns present in the transactions included in the database116given the constraints that the items in l are distinct and comparable and the RHS of the rules is unidimensional. The association rules identifier system122can partition items in a transaction Tiinto two disjoint sets Xiand Yi. The two disjoint sets Xiand Yiare considered as an association rule Xi→Yiwhen the following two conditions hold true:1. The pattern Xi∪Yiappears in T frequently enough, measured by the support s(Xi∪Yi)=|Xi∪Yi|/|T|=|Xi∪Yi|/m≥s. Here, 0<s≤l is a constant and called the minimum support; and2. The confidence of rule Xi⇒Yi, measured by c(Xi⇒Yi)=s(Xi∪Yi)/s(Xi)≥c. Here, 0<c≤l is a constant and called the minimum confidence. Confidence is an estimation of conditional probability of P(EYi|EXi)
When Y is constrained to be unidimensional, the problem is simplified in the following manner. A discrete item set l=l1, . . . ln, and a data set T has transactions T1, . . . , Tm=X1∪y1. . . Xm∪ym, where Xicontains 1 to n−1 items from l, Yicontains exactly one item from l, and Xi∩Yi=∅. Discovery of all association rules X→Y is the identification of all patterns, such as Xj→Yj, satisfying the following:

With open-zero as the minimums of support and confidence, the association rules identifier system122can identify all association rules represented in the database116, including those low probability rules that may have disproportional importance in some applications, in P-time. In an example, the association rules identifier system122trims rules from the rule set based upon needs of a particular application that may emphasize certain items in input or output, or size of the resultant rule set.

The association rules identifier system122can identify all rules represented in the transactions116in P-time when the item set l is discrete and comparable and the RHS of each rule is unidimensional. Further, the association rules identifier system122can compute support for all yigiven the constraints referenced above. This can be accomplished by representing all yiwith strings and performing a GROUP operation on such strings, resulting in worst time-complexity of O(m log m).

Since all items in each Xiare discrete and comparable, the items can be sorted and represented with strings. After such conversion, the association rules identifier system122can identify all patterns in the transactions database116through use of the nested GROUP-ing operations with an unchanged worst time complexity of O(m log m). After such step, the association rules identifier system122has grouped the transactions into patterns per items in LHS and RHS, where each pattern is a tuple (Xi, Yi).

The association rules identifier system122can calculate support for Xiby determining whether Xi⊂Yjfor all i≠j. Each such test, if Xi⊂Xj, can be performed by the association rules identifier system122by way of a SET operation with worst time complexity of O(n2). The association rules identifier system122performs such test m2times at most, and thus the worst time complexity is O(m·log m·n2). The m×m SET operation poses challenges to time and space capacities in calculation. To avoid two-dimensional space requirements, or if cross-join is not allowed, the association rules identifier system122can convert the cross-join to an inner-join on a pseudo join key:X extend dummy=1X join kind=inner X on dummy
Since the association rules identifier system122has computed support of X and y, as well as the confidence of X→y, the association rules identifier system122can compute two other widely used measurements, lift and conviction. Lift is related to the dependence of the LHS and RHS and is defined as follows:

Conviction is related to the implication of LHS and RHS and can be written as follows:

Based upon the foregoing, it can be ascertained that under the assumptions that the item set includes n discrete and comparable items, the database116includes m transactions, and the RHS is unidimensional, then the association rules identifier system122can compute the full association rule set X→y in worst-case time complexity O(m log mn2), thus in P-time.

With reference now to the rules applier system124, and referring again toFIG.4, once the full rule set X→y is obtained, the rules applier system124can receive a previously unseen input Xα. The identifier module402identifies rules where Xifully or partially matches Xα. Pursuant to an example, the identifier module402and ranker module404compute a measure of closeness of input Xαto Xi, referred to herein as relevance, as follows:

In an example, the identifier module402computes a relevance value for a rule and determines whether the rule is to be returned based upon the relevance value. The ranker module404can employ relevance, confidence (or lift, support, and/or conviction) to order the rules identified by the identifier module402and select k of such rules to predict the outcome, namely yα.

The association rules identifier system122and the rules applier system124were tested on a public cloud computing system, where the database116included 1.2 million transactions (incidents), with item set of a size 2,650. In the test, the association rules identifier system122identified 4,837 distinct X with lengths from 1 to 404 and 2,008 distinct y. The identified X and y resulted in identification of 9,555 separate rules.

Referring now toFIG.5, a plot500that illustrates a distribution of size of X is depicted. As illustrated in the plot500, many of the X's include several items, with a weighted median of 14.

FIG.6is a plot600that illustrates distribution of confidence scores. It can be ascertained from the plot600that a high number of rules in the test have confidence scores at either end of the interval (0, 1) with a median of 0.4576.

FIG.7is a plot700that identifies the relationship between lift and confidence. In the plot700, the vertical axis is scaled to log 10(lift).

FIG.8is a plot800that illustrates a relationship between conviction and confidence. In the plot800, the vertical axis is scaled to log 10(conviction).

The effectiveness of the association rules identifier system122and the rules applier system124was evidenced by a test that included 23 separate incidents. The test criterion was to check the fewest number of items (components) before pointing out a true responsible (root cause) for the incident. Overall, operation of the association rules identifier system122and the rules applier system compared favorably to an experienced engineer.

In addition, as referenced above, the technologies described herein can be employed in recommendation scenarios, such as in a scenario where a user has selected items that can be referenced as Xα, and the association rules identifier system122and the rules applier system124can identify and rank rules in connection with recommending a next item yαfor the user.

FIGS.9and10illustrate example methodologies relating to performing root cause analysis with respect to an incident referenced in an incident report generated by a cloud computing system. While the methodologies are shown and described as being a series of acts that are performed in a sequence, it is to be understood and appreciated that the methodologies are not limited by the order of the sequence. For example, some acts can occur in a different order than what is described herein. In addition, an act can occur concurrently with another act. Further, in some instances, not all acts may be required to implement a methodology described herein.

Now referring solely toFIG.9, a flow diagram illustrating an example method900for identifying association rules based upon transactions in a database is illustrated. The method900starts at902, and at904a transaction is obtained from a computer-readable database that includes numerous transactions. The transaction includes several items, where the items are representative of components in a computing system, where the computing system is accessible to multiple computing devices by way of network connections. Hence, the computing system may be a public cloud computing system.

At906, an item is selected from the several items to include in a first set, where the first set is unidimensional. At908, remaining items in the transaction are selected for inclusion in a second set, such that two disjoint sets are created.

At910, a determination is made as to whether there are more items in the transaction that have not been included in the first set. When there are more items that have not been included in the first set, the method900returns to906. When there are not more items included in the first set, the method900proceeds to912, where a determination is made as to whether there are additional transactions in the computer-readable database. When there are more transactions included in the computer-readable database, the method900returns to904. When there are no more transactions in the computer-readable database, the method900proceeds to914. At914, a plurality of association rules are identified based upon pairs of disjoint sets of items. Each association rule maps one item to at least one other item, and the association rules are used in connection with performing troubleshooting in the computing system. The method900completes at916.

With reference now toFIG.10, an example method1000for applying an association rule to an incident report is illustrated. The method1000starts at1002, and at1004an incident report is received, where the incident report includes at least one item that is representative of a component in a cloud computing system that has contributed to the incident report.

At1006, association rules are identified, where the LHS of each of the identified association rules at least partially overlaps with the at least one item in the incident report.

At1008, the association rules are ranked based upon scores assigned thereto. The scores may be scores for confidence, lift, conviction, support, relevance, or any suitable combination thereof.

It1010, data is transmitted to a computing device of the cloud computing system based upon the ranked association rules. As indicated previously, the data transmitted to the computing device can include identifiers of components for an engineer to check in the cloud computing system when performing root cause analysis with respect to the incident report. In another example, the data may cause one or more components to be restarted. The method1000completes at1012.

Referring now toFIG.11, a high-level illustration of an exemplary computing device1100that can be used in accordance with the systems and methodologies disclosed herein is illustrated. For instance, the computing device1100may be used in a system that supports identifying association rules from a database of transactions. By way of another example, the computing device1100can be used in a system that identifies rules based upon a received incident report. The computing device1100includes at least one processor1102that executes instructions that are stored in a memory1104. The instructions may be, for instance, instructions for implementing functionality described as being carried out by one or more components discussed above or instructions for implementing one or more of the methods described above. The processor1102may access the memory1104by way of a system bus1106. In addition to storing executable instructions, the memory1104may also store transactions, rules, etc.

The computing device1100additionally includes a data store1108that is accessible by the processor1102by way of the system bus1106. The data store1108may include executable instructions, transactions, incident reports, etc. The computing device1100also includes an input interface1110that allows external devices to communicate with the computing device1100. For instance, the input interface1110may be used to receive instructions from an external computer device, from a user, etc. The computing device1100also includes an output interface1112that interfaces the computing device1100with one or more external devices. For example, the computing device1100may display text, images, etc. by way of the output interface1112.

From the foregoing it is ascertained that aspects described herein relate to performance of root cause analysis with respect to incident reports generated by a cloud computing system in accordance with the examples set forth below.

(A1) Some embodiments include a method performed by a computing system that is configured to assist with troubleshooting incidents that occur in a cloud computing system. The method includes obtaining an incident report, where the incident report includes several items that are representative of components of the cloud computing system that are reporting incidents during a window of time. The method also includes identifying association rules from amongst several association rules based upon the incident report, wherein each association rule in the association rules maps a respective set of items to a respective single item, wherein sets of items in the several association rules include at least one item that is also included in the several items of the incident report. The method additionally includes transmitting, based upon the identified association rules, a notification to a computing device of a technician for the cloud computing system, where the notification identifies the single items in the identified association rules as potential causes of the incidents reported by the components of the cloud computing system.

(A2) In some embodiments of the method of (A1), there are between 100,000 and 200,000 association rules in the several association rules.

(A3) In some embodiments of at least one of the methods of (A1)-(A2), the method also includes generating the association rules based upon transactions in a database, where the transactions are representative of incident reports, and further wherein the transactions include items that are representative of numerous components of the cloud computing system.

(A4) In some embodiments of at least one of the methods of (A1)-(A3), generating the association rules includes a) obtaining a transaction from the database, where the transaction includes several items, and further wherein the several items are representative of several components in the cloud computing system; b) selecting an item from the several items to include in a first set, wherein the first set is unidimensional; c) selecting remaining items in the several items to include in a second set, such that two disjoint sets are created; d) repeating acts b) and c) until each item in the several items has been included in a unidimensional set, such that multiple disjoint sets are created for the transaction; and e) repeating acts a)-d) for multiple transactions in the computer-readable database, such that multiple disjoint sets are created for each transaction in the multiple transactions, and further such that a plurality of disjoint sets of items are created, wherein the association rules are generated based upon the plurality of disjoint sets of items.

(A5) In some embodiments of at least one of the methods of (A1)-(A4), the association rules are identified based upon support values computed for the association rules.

(A6) In some embodiments of at least one of the methods of (A1)-(A5), the association rules are identified based upon confidence values computed for the association rules.

(A7) In some embodiments of at least one of the methods of (A1)-(A6), the association rules are identified based upon lift scores computed for the association rules.

(A8) In some embodiments of at least one of the methods of (A1)-(A7), the association rules are identified based upon conviction values computed for the association rules.

(B1) In another aspect, some embodiments include a method for performing root cause analysis with respect to an incident report generated by a cloud computing system. The method includes a) obtaining a transaction from a computer-readable database, where the transaction includes several items, and further where the several items are representative of components in a computing system, the computing system is accessible to computing devices by way of network connections; b) selecting an item from the several items to include in a first set, where the first set is unidimensional; c) selecting remaining items in the several items to include in a second set, such that two disjoint sets are created; d) repeating acts b) and c) until each item in the several items has been included in a unidimensional set, such that multiple disjoint sets are created for the transaction; e) repeating acts a)-d) for multiple transactions in the computer-readable database, such that multiple disjoint sets are created for each transaction in the multiple transactions, and further such that a plurality of pairs of disjoint sets of items are created; f) identifying a plurality of association rules for use in troubleshooting in the computing system, the plurality of association rules identified based upon the plurality of disjoint sets of items, wherein each association rule maps one item to at least one other item; g) subsequent to identifying the plurality of association rules, receiving at least one item that is representative of a first component in the computing system; h) identifying an association rule from the association rules based upon the at least one item, where the association rule maps the at least one item to another item that is representative of a second component in the computing system; and i) transmitting data to a computing device based upon the identified association rule, where the data indicates that the second component in the computing system is a root cause of an error associated with the first component in the computing system.

(B2) In some embodiments of the method of (B1), the data transmitted to the computing device comprises a recommendation to an engineer to inspect the second component in the computing system.

(B3) In some embodiments of the method of at least one of (B1)-(B2), identifying the plurality of association rules includes computing a confidence value for the association rule. Identifying the plurality of association rules further includes comparing the confidence value with a threshold, where the association rule is included in the plurality of association rules based upon the confidence value being greater than the threshold.

(B4) In some embodiments of the method of at least one of (B1)-(B3), identifying the plurality of association rules includes computing a support value for the association rule. Identifying the plurality of association rules also includes comparing the support value with a threshold, where the association rule is included in the plurality of association rules based upon the confidence value being greater than the threshold.

(B5) In some embodiments of the method of (B4), the association rule is identified from the association rules based upon the support value computed for the association rule.

(B6) In some embodiments of the method of at least one of (B1)-(B5), the method further includes computing a value for lift for the association rule, where the association rule is identified from the association rules based upon the value for lift computed for the association rule.

(B7) In some embodiments of the method of at least one of (B1)-(B6), the method also includes computing a value for conviction for the association rule, where the association rule is identified from the association rules based upon the value for conviction computed for the association rule.

(B8) In some embodiments of the method of at least one of (B1)-(B7), the method also includes computing a value for relevance for the association rule, where the value for relevance is based upon the at least one item being included in the association rule, and further where the association rule is identified from the association rules based upon the value for relevance computed for the association rule.

(B9) In some embodiments of the method of at least one of (B1)-(B8), there are between 100,000 and 2,000,000 transactions in the multiple transactions.

(B10) In some embodiments of the method of at least one of (B1)-(B9), the data transmitted to the computing device causes the second component to be restarted.

(C1) In another aspect, some embodiments include a computing system that includes a processor and memory, where the memory stores instructions that, when executed by the processor, cause the processor to perform a method described herein (e.g., any of the methods of (A1)-(A8) and/or (B1)-(B10)).

(D1) In yet another aspect, some embodiments include a computer-readable storage medium that includes instructions that, when executed by a processor, cause the processor to perform a method described herein (e.g., any of the methods of (A1)-(A8) and/or (B1)-(B10)).