Patent ID: 7783744

Claim:
A method of facilitating root cause analysis in a networked environment with respect to a problem attribute, said method comprising: specifying, by a user, an alarm rule to specify an association information including information that a set of causation attributes are associated with said problem attribute, wherein said alarm rule includes a definition of an abnormality defining a deviation threshold, wherein when said problem attribute exceeds said deviation threshold, said problem attribute is considered to have an abnormality; storing said alarm rule in a non-volatile memory; monitoring, by a monitoring system, a resource element to retrieve values for said problem attribute in said resource element, wherein the monitoring system monitors the resource element by repeatedly polling, at a first polling interval, the set of causation attributes indicated by the alarm rule, the monitoring system also monitoring the resource element for the values of said problem attribute; storing the values for said problem attribute and said causation attributes in said non-volatile memory; determining, by the monitoring system, that said abnormality has occurred with respect to said problem attribute in said resource element by examining said stored values, wherein the determination that said abnormality has occurred is performed based on said problem attribute exceeding the deviation threshold indicated by said alarm rule; polling the resource element for values of each of said set of causation attributes at a second polling interval upon determining that said abnormality has occurred based on said user having specified said alarm rule association information, wherein the second polling interval is less than the first polling interval; storing said polled values in said non-volatile memory; displaying said problem attribute to a user; receiving an indication that the user wishes to perform root cause analysis with respect to said displayed problem attribute; and retrieving and displaying said values of said set of causation attributes stored in said non-volatile memory in response to said user having specified said set of causation attributes in said alarm rule and receiving said indication, wherein said polled values from before the determination that said abnormality has occurred and said polled values from after the determination that said abnormality has occurred are accessible by said user to enable the user to detect any changes in a pattern of polled values of said set of causation attributes.