Cookbook, a recipe for fault localization

Commercial applications of fault localization typically utilize static models of the underlying system to identify root causes amongst the many monitored events. Fundamentally, the limitation of this approach arises from the practical challenges in building and maintaining this model. More recently, much attention has been paid to the use of data-driven algorithms as an alternative for identifying anomalous clusters of events and deducing the existence of a localized fault, as described by these events. In this paper we describe the characteristics of one approach that relies upon clustering of alerts by the similarity vector of configurable attributes of the alert. Using a simulation of a real world commercial application, we investigate the stability of this approach in the dynamic environments that characterize modern infrastructure. We are able to demonstrate that it is far superior to rules-based approaches.