Correlating failures with asynchronous changes for root cause analysis in enterprise environments

In enterprise environments, it is critical to find the root cause of performance failures as quickly as possible. More often, root cause for these failures are the change events that are done deliberately by system administrator to fix existing problems in the system. However, these changes may themselves manifest as faults with the change in operating conditions over time. Hence, time lag between the changes that manifest themselves as faults and resulting failures may be unbounded. Most existing approaches fail to find such root cause faults as they consider only time correlated symptom events and real root cause event(s) are not even considered. In this paper we present a novel approach to identify such changes, from the set of changes done over the time, which may be the root cause of current failures. Our system automatically associates failures with these changes without any time window constraint. The approach presented in this paper does not require existence of any baseline model. As per our understanding, ours is a first system that associates changes with current failures without these assumptions. We have implemented this system in a real life test bed and it shows promising results.