Sentinet³ Core · Analysis

Behavioural Learning and Root Cause Analysis

Read how metrics evolve, suggest better-fitting thresholds and correlate events to trace failures back to their cause.

Behavioural Learning Engine

Thresholds that follow the real behaviour of the infrastructure

The Behavioural Learning Engine studies monitoring data and supports operators with suggestions on the thresholds to apply to checks.

Observing trends helps to distinguish recurring conditions from anomalies and to spot hosts or services whose monitoring configuration no longer fits the infrastructure. By relating events to one another, the engine offers three capabilities:

Behavioral Thresholding: check thresholds suggested by the real behaviour of metrics
Dependency Model detection: identification of dependencies between components
Trend Prediction: forecasting of metric trends

Behavioural Learning Engine graphs and indicators showing metric trends over time — Behaviour graphs and indicators for interpreting changes over time.

The big picture

From individual observations to overall indicators

The ability to aggregate results enables a reading of the entire environment or of its subsets. The information feeds statistical views and Situation Analysis, keeping the link between the individual observation of metrics and the overall indicators.

Correlation and Root Cause Analysis

Correlate events to find the root cause

Sentinet³ Root Cause Analysis is an event correlation engine: rules based on AND and OR operators relate multiple events and generate proactive alerts and events. The root cause identified by the correlator can be viewed in the Root Cause Analysis console.

Diagnosis is not limited to the number of alerts generated: a device shared by several services can explain multiple simultaneous alarms, while the hierarchical view helps to tell symptoms apart from the origin of the outage.

Several events appear within the same interval.
AND/OR rules correlate them with states and relationships between systems.
The correlation generates a proactive alert or event and highlights the common element, for example a device on which several services depend.
In the Root Cause Analysis console, troubleshooting focuses on the systems responsible.

Root Cause Analysis console with correlated events grouped together and their states — Root Cause Analysis console: correlated events grouped with their states.

The root cause of an application service

The same analysis applies to services made up of several components: for an eCommerce service the console shows the status of the reverse proxy, application server, database, mail service, storage and security, to understand which component caused the problem.

Root Cause Analysis of an eCommerce service with the ReverseProxy, ApplicationServer, Database, MailService, Storage and Security components — Root Cause Analysis of an application service and its components.

Two complementary functions in day-to-day management