Performing ML-based root cause isolation of an impacted service

As an operator, you can view the service details and perform ML-based root cause isolation of the impacted services.

Related topics

Services and service topology

Service health score, impact score, and metrics

ML-based root cause isolation

To view the details of a service

Do one of the following actions to view the service details page:
- Click the Overview tab, and from the Services widget, click any of the impacted services whose details you want to view.
- Click Entities and on the Services page, click an individual service tile.
  - Service name, severity, incident ID associated with the service, service impact score in percentage, and the date and time when the service was last updated.
  - Top 3 impacted entities (business services) that are associated with the service. In this example, Banking Zone Service the impacted business service associated with the Banking Core Servers service.
  - Pie chart displaying the count of open events impacting the service. The events are categorized by event status. The pie chart does not consider the INFO and OK events while displaying the event count.
  - Health score for the selected time range. Hover over a time slot to view the health score. For more information, see Service health score, impact score, and metrics.
  - Legends to indicate incidents, events, and change requests on the health timeline. Hover over an event, incident, or change request to view the details. For more information, see Total incident count and mean time to resolve (MTTR) indicators for a reliable incidence-response process. The health timeline does not display the INFO and OK events.

To view the ML-based root causes of an impacted service

Do one of the following to view the root causes of an impacted service:
- Click the Overview tab, and from the Services widget, click any of the impacted services whose details you want to view.
- Click Entities and on the Services page, click an individual service tile.
  Service details page appears.
To view the causal event details by causal nodes or situations, in the Root Cause Isolation tab, click View By and select one of the following options:
- Causal Nodes: Displays the top 3 causal nodes impacting the service. Click a causal node and perform the following actions to view the event and change request details:
  - To view the event details:
  1. - Click Events to view top causal events.
    - Hover over the score to view the score calculation details for the event.
    - Click on an event to view event details.
      Performance View tab for event details
      Performance View tab displays only for an alarm class event. It contains the time-series data collected from key attributes of the causal events.
  - To view the change details:
    - Select Changes to view top three change requests.
    - Hover-over the score to view the score calculation details for the change.
    - Click on a change to view change details.
  View all events or all changes
  - Click Show all events or Show all changes link to view all events or all changes for a particular causal node.
  - You can switch back to view only the top events or top changes, by clicking the Show top causal events or Show top causal changes link.
- Situations: Displays the top 3 situations impacting the service. Click a situation to view the associated events. Click an event to view its details.
  Launch the situation details page on the Situations tab
  - If there are no situations associated with the service, the ViewBy option is not enabled.
  - Optionally, you can click theicon to launch the situation details page on the Situations tab. For more information, see Investigating ML-based situations.

To view the service topology

Do one of the following to view the service details page:
- Click the Overview tab, and from the Services widget, click any of the impacted services whose details you want to view.
- Click Entities and on the Services page, click an individual service tile.
Click Topology. To know how to view and understand the service topology and its components, see:
Visualizations toolset
Information, zoom and undo/redo controls
Note: The impacted node and the downstream path is marked in red color. Any non-impacted node is greyed out as shown in this image.
Click a node to view the node details as shown in this image.
(Optional) Click the Events, Incidents, or Changes tabs to view events, incidents, or changes associated with the service.

To view the metrics of the causal node

Do one of the following to view the service details page:
- Click the Overview tab, and from the Services widget, click any of the impacted services whose details you want to view.
- Click Entities and on the Services page, click an individual service tile.
Click Metrics to view the metrics chart for the top attributes of the causal node. If there are more than three metrics, only the top three trending metrics are displayed.
Based on the metric data and its trend, you can take action to resolve the issue. For more information, see Service health score, impact score, and metrics.

Visualizations toolset

The following table lists the options you can use to manipulate a visualization and perform modeling tasks.

The visualization views show a dynamic, pictorial view of the relevant part of your IT infrastructure and services, focusing on software and communication between items of software and shows some details of the hosts and load balancers involved.

Note

Visualizations are supported for modern, standards-compliant web browsers only. The view works best in recent versions of Google Chrome and Mozilla Firefox, and Microsoft Edge. See Supported browsers for more information.

Click Topology to view the visualization.

When you view a single node or multiple node groups, a Visualize / Model button is shown.

Make the visualization occupy the full browser window by clicking the maximize icon in the top right corner. Exit full window mode by clicking the minimize icon in the top right corner
You can manipulate the image using the tools provided. For more information, see the visualizations tool set.

Topology view tools set

The following table lists the options you can use to manipulate a visualization and perform modeling tasks.

When you have saved the model, you can also export a model definition. Exported model definitions can be imported using the Model > Services & Applications page.

Icon		Description
Drag and select modes	Toggles the mode in which the visualization can be displayed. Use the mouse scroll wheel to zoom in and out, and drag on the background to move around. On a touch device, pinch to zoom. Double-click inside the view to recenter and zoom the display to fit the window.
	Drag mode	Drag the background to move the whole diagram. Drag individual icons to rearrange the view.
	Select mode	Click a node to select it alone. Previously selected nodes are deselected. Shift-click a node to add it to previously selected nodes. Control-click a node to deselect an icon where multiple icons are selected. Click the background and drag around nodes to lasso-select a group of nodes. Hold Shift while dragging the background to add to the current selection with a lasso-select. Hold Control while dragging the background to remove from the current selection with a lasso-select.
Display	Enables you to change the following: Focus of the visualization Background shading to indicate locations and cloud regions Indicators and labels for model definitions and manual groups
	Focus Enables you to change between the Visualize - Software - Connected, Visualize - Software, and the Visualize - Infrastructure views. In each view, the node that represents the object you are looking at is highlighted. Click a node to view its details panel.
	Software - Connected	The Software-Connected view focuses on software and communication between items of software and shows some details of the hosts and load balancers involved.
	Software	In the Software focus, the node that represents the object you are looking at is highlighted. The Software view focuses on software and communication between items of software running on a host, and is particularly useful for understanding what is running on a host.
	Infrastructure	In the Infrastructure focus, the node that represents the object you are looking at is highlighted. The Infrastructure view focuses on the connectivity to network and storage components. It shows the switches a host is connected to, underlying storage for host filesystems, VMs on VM servers, or if the given host is a VM, the server on which it is hosted.
	Model Definitions and Manual Groups Provides options for viewing information node membership of manual groups and model definitions. When you choose to show indicators or labels, the Groups icon is displayed next to the help icon in the top right of the visualization. Click this to see a key to reconcile labels, indicators and groups.
	Do not show	Do not show any group or model definition labels or indicators.
	Show indicators	Show indicators. Indicators are small color-coded shapes next to the node icon, a different colored one for each group. Model definitions are shown as triangles; manual groups are shown as circles. Hover the mouse pointer over an indicator to see the name of the model definition or group.
	Show labels	Show colored labels containing the group name.
Layout	Displays the ways in which the object nodes can be arranged. Once a layout has been calculated, you can further manipulate the view by dragging nodes, and by expanding and collapsing collections. Choosing the same layout again recalculates the layout, and can lead to a clearer view. The following options are available under Layout:
	Layout Provides options for laying out the nodes. Experimenting with the layouts can reveal structure in the model.
	Force-directed	Spreads nodes using a balance of attracting and repelling forces.
	Impact	Shows impacting nodes at lower levels on the view than impacted nodes. For example, a host container impacts a contained host, which impacts a software instance. Arrows on the view show the direction of impact. When you select and use the Impact layout, arrow controls are provided that enable you to select the direction of impact. Impact direction Place the impacted node at the top. Impact direction is to the top. Place the impacted node at the right. Impact direction is to the right. Place the impacted node at the bottom. Impact direction is to the bottom. Place the impacted node at the left. Impact direction is to the left.
	Root at top	Arranges nodes into a tree view with a root node at the top.
	Relationship routing Provides graphical options for routing the relationships between nodes.
	Direct	Gently curved lines link nodes. The nodes are arranged for clarity, subject to the selected layout.
	Orthogonal	Lines link nodes using horizontal and vertical section joined by right angle curves.
	Avoid nodes	Straight lines link nodes where possible. The lines are curved to avoid crossing nodes.
	Choose the node kinds to show. Select the node kinds to show or hide from the list of node kinds shown in the model. Depending on the application that you are modeling, you may see the structure more clearly by hiding certain nodes such as hosts.
	You can export or print the current view for review at any stage. The images are produced without the associated tools and menus. When you have saved the model you can export it as a model definition
	Print Visualization	To print an image of the current view, click Print Visualization and select a paper size from the drop-down list. The browser print dialog is displayed. You must choose the same paper size in the print dialog.
	Export as SVG	To export an SVG image of the current view, click Export and choose SVG.
	Export as PNG	To export a PNG image of the current view, click Export and choose PNG.

Information, zoom and undo/redo controls

Information, zoom and undo/redo controls are provided at the top right of the screen.

Icon	Description
Undo/Redo	Enables you to undo or redo recent operations. Where no operation can be undone, the undo icon is disabled. Where no operation can be redone, the redo icon is disabled. Using the keyboard, Control-Z is undo; Control-Y is redo. When you save removal rules, the Undo/Redo queue is cleared.
Models and Groups	Provides information on any application models and manual groups to which nodes in the view belong. The Models and Groups icon is only displayed when show indicators or show labels is selected.
Key	Shows a key for the symbols used in views.
Zoom slider	Click + to zoom in and - to zoom out. Or drag the slider up or down respectively. The mouse scroll-wheel can be used to zoom in and out. To zoom using the keyboard, press '+' or '=' to zoom in, and '-' to zoom out.
Zoom to fit	Click the zoom to fit control to fit the image to the window.

Context sensitive menu options

The following options are available from the context sensitive menu, accessed by right-clicking in the visualization window.

Menu option	Description
Stop layout updates	Prevents any further layout updates. Sometimes with a large or complex model, the layout may take a long time to stabilize. Select this option to stop the updates.
Select all	Selects all nodes in the view.
Clear selection	Deselects all selected nodes.
Invert selection	Inverts the current selection. Nodes previously not selected are selected, and the reverse.
Undo action	For example, Undo extend model. If you have performed an action, undo it and return to the previous state. You can also use the Undo arrow at the top right of the visualization, or via the keyboard with Control-Z.
Redo action	If you have undone an action, redo it. You can also use the Redo arrow at the top right of the visualization, or via the keyboard with Control-Y.
Select node	Select a selected node. Available when right-clicking a node that is not selected.
Deselect node	Deselect a selected node. Available when right-clicking a selected node.
Add to selection	Add the node to the current selection. Available when right-clicking a node which is not currently selected.
Show impact flow / Show selection impact flow	Shows the impact flow into and from the selected node. Nodes whose outage would affect the selected node, and nodes that would be affected by an outage of the selected node are highlighted by dimming other connections. The arrows show the direction of impact. Also operates on multiple node selections (Show selection impact flow). See Impact flow for an illustration of the use of the impact flow controls.
Show outgoing impacts / Show selection outgoing impacts	Shows the impact flow from the selected node. Nodes that would be affected by an outage of the selected node are highlighted by dimming other connections. The arrows show the direction of impact. Also operates on multiple node selections (Show selection outgoing impacts).
Show incoming impacts / Show selection incoming impacts	Shows the impact flow into the selected node. Nodes whose outage would affect the selected node are highlighted by dimming other connections. The arrows show the direction of impact. Also operates on multiple node selections (Show selection incoming impacts).
Keep only impact flow	The nodes and relationships that are not highlighted are discarded from the visualization.
Clear impact display	Clears the highlighting to show the rest of the visualization,
Expand collection	A collection is an automatically created group of closely related items. Expand collection expands the selected collection so that the individual nodes are visible in the view. The nodes from the expanded collection are highlighted. You can see what is contained in the collection using Preview collection.
Collapse back into collection	Collapses the nodes from an expanded collection back into the collection. Available when right-clicking a node that was expanded from a collection.
Hide highlighting of collection	Hides the highlighting of the named expanded collection.
Hide all highlighting	Hides all highlighting that shows the nodes from an expanded collection.
Remove link	Deletes the selected link. Available when you right-click a link between two nodes.

Impact flow

The show impact flow controls enable you to visualize the root causes of outages and understand outage chains by highlighting the impact flow into or from a selected node. The following sequence of screenshots demonstrates the impact flow controls.

	Description	Example
1	A visualization.
2	Select a node
3	Right click and select Show selection impact flow.
4	The visualization now shows upstream and downstream impacts.
5	Right click and select Show selection outgoing impacts.
6	The visualization now shows outgoing (downstream) impacts.
7	Right click and select Show selection incoming impacts.
8	The visualization now shows incoming (upstream) impacts.
9	Right click and select Show selection impact flow.
10	Right click and select Keep only impact flow.
11	The other nodes and relationships are discarded from the visualization leaving only the upstream and downstream impacts.

Keyboard Controls

The following keyboard controls are available when manipulating the visualizations:

Key	Description
+ =	Zoom in
-	Zoom out
Escape	In select mode, return to drag mode When viewing the context menu, close the menu When viewing a dialog, close the dialog
Control-Z	Undo the previous action
Control-Y	Redo the previous action