Probable Cause Analysis

By gathering data from different sources and applying filters to rule out unrelated events, Infrastructure Management can determine the most likely causes for an event, such as an attribute that is outside the appropriate range. This process of automatically analyzing and filtering data to determine the cause for an event is called Probable Cause Analysis.

The Probable Cause Analysis process analyzes data and displays the relevant events and anomalies automatically. The more data that is provided about an event, the more accurate is the Probable Cause Analysis process.

For detailed information about Probable Cause Analysis, see Determining the probable cause for an event.

How Infrastructure Management performs Probable Cause Analysis on events

Probable Cause Analysis focuses on events and anomalies that are related to each other according to impact and grouping relationships. Events and anomalies that are not related are not included in an analysis. Therefore, the following events are not considered during probable cause analysis:

• Administrative events:
  Administrative events include all events that belong to specific event classes within the MC_CELL_EVENT class.
• VMware-related vMotion events:
  Events related to use of a virtual machine are handled differently from other events.
• Predictive events:
  Predictive events are early warning events that Infrastructure Management generates before a severe event occurs on an existing metric.
• Blackout events:
  Blackout events include all events that occur during a defined blackout period for an adapter.

The computation of Probable Cause Analysis in Infrastructure Management is useful in troubleshooting performance related issues, some of which are listed below.

• The service model is present and it is not possible to set or maintain meaningful thresholds on many or most metrics. In this case, Probable Cause Analysis can be very effective by looking at relevant abnormalities, external events, and configuration change events.
• A high-level service model is present, but many events are shown as impacting events. In this case, Probable Cause Analysis can be used to sort the events by score computation and by gauging various factors such as data correlation, time correlation, severity, and so on.
• The service model is not present.
• Impact computation is available only for open events. In this case, Probable Cause Analysis is used to find out the root cause after the occurrence of the event.
• To troubleshoot system resource related issues in virtual environments where BMC adapter for VMware is used for data collection

You can perform Probable Cause Analysis on internal events and external events. An internal event is an event that is generated by the BMC TrueSight Infrastructure Management Server. Internal events also are referred to as intelligent events.

External events are events that are received from an external source such as generated from a PATROL agent, a remote cell, or an event adapter. Because external events come from a source that is external to Infrastructure Management, unlike internal events, they do not have any data associated with them.

Internal and external events vary in the amount and type of data that they supply. Therefore, they are handled differently during the Probable Cause Analysis process.

Because internal events are supported with statistical data, these events go through more steps in the analysis process than external events. When Infrastructure Management is analyzing an internal event to determine whether it can be a probable cause for another event, it applies a series of filters to the internal event.

Because external events are not supported with statistical data as internal events are, the Probable Cause Analysis process for external events uses fewer filters.