Clustering IT Events around Common Root Causes

This paper focuses on clustering alerts around common root causes at the lower levels of the event management chain. The aim is to enable root-cause identification from a mixed event stream and to offer aggregated information for holistic problem solving. This end-to-end investigation spans feature selection and similarity assessment, clustering on heterogeneous feature maps, and evaluation of results. We compare feature values based on network information, user-defined similarity matrices, and textual analysis, and capture aspects of feature correlation in the event similarity function. Spectral clustering partitions the stream and serves to learn a more general similarity metric from a reference partitioning. Finally, we introduce two novel result visualization techniques and make a case study on one identified root-cause for which this framework outperforms both a time-pressured human operator and baseline clustering algorithms.