Using Entuity for root cause analysis

Entuity root cause analysis monitors the end-to-end delivery of IT as a service, whilst at the same time monitoring each component of the infrastructure that together make up that service. By integrating these monitoring capabilities, IT operations are able to isolate infrastructure problems at the same time as understanding their impact on business activity.

Root cause analysis extends the network monitoring capabilities of Entuity by alarming on both component and service failures. Entuity raises stateful alarms to the operator which automatically track ongoing problems through to resolution. Focusing on availability and latency (round trip response time) of devices and applications:

• Entuity ICMP availability monitoring pings IP addresses and maps these addresses to managed devices and ports so events and incidents are raised against devices and ports rather than IP addresses. Where Entuity does not manage the IP address, Entuity associates it with the first managed port that is downstream of that IP address and indicates that the actual cause of the failure is upstream of the port.
  
  • For every network outage that is identified, Entuity uses data derived from its ICMP availability monitoring (traceroute) to identify the layer 3 network object closest to the Entuity server involved in the outage. Entuity can then raise Network Outage incidents and events on the object.
• Entuity monitors application availability by testing the response of defined applications to its TCP connect request. Entuity considers an application as available if it can connect to the application’s open socket. By default, Entuity attempts to connect to monitored applications every two minutes.

If a managed object becomes unavailable, Entuity can use the discovered route to determine at what point the network failed or degraded and then raise the appropriate events and incidents. Entuity can potentially raise these events and incidents:

• after pinging of the IP address which occurs every two minutes:
  
  • AvailMonitor High Latency and AvailMonitor Normal Latency.
  • Network Outage. Entuity raises Network Outage events against three different network
    objects:
    
    • devices, when all of the IP addresses on the device are not responding (node
      down).
    • ports, when Entuity determines that the outage is on a managed port.
    • IP addresses, when Entuity determines that the outage is at a point in the
      traceroute path not managed by the Entuity server.
      When Entuity raises a Network Outage event, Impacted displays a breakdown of how
      many devices, servers and applications are impacted by the root cause of the outage.
• after the TCP connect to an application which occurs every two minutes:
  
  • AvailMonitor Application Unavailable and AvailMonitor Application Available.
  • AvailMonitor High Latency Reaching Application and AvailMonitor High Latency Reaching Application Cleared.
• on hourly rolled up data and so can only be raised hourly. They also require thresholds
  to be set:
  
  • AvailMonitor Falling Average Latency.
  • AvailMonitor Low View Device Reachability and AvailMonitor Normal View Device
    Reachability.
  • AvailMonitor Rising Average Latency.
  • AvailMonitor Rising Trend in Average Latency.

 Please see the following articles for information regarding specific circumstances: 

• application failure.
• device and port availability state change.
• identify failures in the network cloud.
• identifying upstream availability.
• running traceroute from the Entuity server.
• troubleshooting network availability.