Patent ID: 8484336

Claim:
A method, comprising: receiving a first set of events from a communication network, wherein the first set of events comprises a first particular event that indicates a problem in the network; wherein each individual event in the first set of events is emitted by a network element in the communication network in response to state changes of one or more entities within the network element; identifying, in the first set of events, a second set of events comprising candidate events for a root cause of the problem in the network; wherein identifying a second set of events includes: identifying a path between a source and a destination that are specified in the first particular event and related to the problem in the network; determining whether a second event in the first set of events is on the path; in response to determining that the event is not on the path, disqualifying the second event as a candidate event; identifying a particular time when the particular event occurred; determining whether a second time when a second event in the first set of events occurred was within a time window from the particular time; and in response to determining that the second time when the second event in the first set of events occurred was not within a time window from the particular time, disqualifying the second event as a candidate for the root cause of the problem by excluding the second event from the second set of events; for each candidate event in the second set of events: using a virtual network model of the network, determining a hop distance between a particular network element that generated the first particular event that indicated the problem and a second network element that generated the candidate event; and generating a score value for the candidate event based in part on the hop distance; wherein the score value represents a likelihood that the candidate event is the root cause of the problem in the network; and selecting, in the second set of events, one candidate event having a minimum score value among all the candidate events; wherein the method is performed by one or more computing devices comprising a processor.