Root Cause Effects (RCE/RCA)

After an incident, the question is which fault caused it, and most of the answers here model the system as a graph. The page starts with a survey, then graph models of industrial processes and equipment faults, then causality graphs for networks and distributed systems, and ends with a root-cause engine for time series, with deprecated addresses kept at the end.

The same notes are in Graph Theory and Knowledge Graphs.

The map of the field is the Survey on Models and Techniques for Root-Cause Analysis, arXiv paper 1701.08546. A first graph idea from network operations is Towards an Approximate Graph Entropy Measure for Identifying Incidents in Network Event Data.

Industrial processes get the same graph treatment. Process connectivity and fault diagnosis, hazard assessment is Signed directed graph based modeling and its validation..., which fuses process data with process connectivity for fault diagnosis and process hazard assessment; the Signed Directed Graph (SDG) captures process topology and the causal relationships between process variables and has been widely used in root cause analysis. For equipment rather than processes, Fault root cause tracing of complicated equipment in fault graph is the fault-graph version. Signed directed graph modeling of industrial processes and their validation.. is the same signed-directed-graph line validated by data-based methods.

Beyond one plant, the graph can carry the questions themselves. Answering Who/When, What, How, Why through Constructing Data Graph, Information Graph, Knowledge Graph and Wisdom Graph is from Hainan University's College of Information Science and Technology. In networks, Identifying Suspicious Activities through DNS Failure Graph Analysis comes from the University of Minnesota and Bell Laboratories, Alcatel-Lucent.

Distributed systems are where causality graphs do the most work. CauseInfer: Automatic and Distributed Performance Diagnosis with Hierarchical Causality Graph in Large Distributed Systems starts from cloud-based applications with many components and complex interactions, vulnerable to performance or availability problems from resource hogs, configuration changes, and software bugs. GRANO: Interactive Graph-based Root Cause Analysis for Cloud-Native Distributed Data Platform is the interactive, cloud-native take. For big network data, ScienceDirect has An enhanced Graph Analytics Platform (GAP) providing insight in Big Network Data, and, for software dependability, Causal Mechanism Graph ─ A new notation for capturing cause-effect knowledge in software dependability. Mining Causality Graph For Automatic Web-based Service Diagnosis is from Tsinghua University and Baidu Inc.

The same graph traversal also traces threats, bugs, and power failures. Who Controls the Internet? Analyzing Global Threats using Property Graph Traversals applies property graph traversals to global threats. A Novel Technique for Call Graph Reduction for Bug Localization reduces the call graph to localize bugs. Integrated System Model Reliability Evaluation and Prediction for Electrical Power Systems: Graph Trace Analysis Based Solutions is Danling Cheng's dissertation, a new approach to evaluating the reliability of electrical systems by applying Graph Trace Analysis to integrated system models.

The last two turn diagnosis into queries. : A Graph Processing System for Diagnosing Distributed Systems is G2, which works on execution graphs that model runtime events and their correlations; each diagnosis is a series of queries in a high-level declarative language with relational and graph-based operators. ExplainIt!– A declarative root-cause analysis engine for time series data is a declarative, unsupervised engine that uses time series monitoring data from large complex systems such as data centres and lets operators succinctly specify a large number of causal hypotheses to search for causes of interesting events.

Deprecated links

These links and images no longer work. The original wording is kept here. A same-resource copy, when one was checked, is used above.

• Process connectivity and fault diagnosis, hazard assessment. This address no longer opens: https://content.sciendo.com/configurable/contentpage/journals$002famcs$002f22$002f1$002farticle-p41.xml

• Identifying Suspicious Activities through DNS Failure Graph Analysis. This address no longer opens: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.366.4779&rep=rep1&type=pdf