cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Do "eventType" of dynatrace API and statements on RootCause correspond to each other?

ksaito
Organizer

Hi,

I'm making an investigation into dynatrace API for an external reporting system.

Then I found that returned JSON files have fields such as "hasRootCause", "rankedEvents", "isRootCause" and "eventType" when I fetched the full details of a problem via making GET requests, like this:

https://{id}.live.dynatrace.com/api/v1/problem/det...

c.f.) https://www.dynatrace.com/support/help/dynatrace-a...

Here my understandings about these fields are as follows.

  • hasRootCause
    This is a field for each "Problem".
    If this value is "true", this "Problem" has at least one root cause.
    If this value is "false", this "Problem" has no root causes.
  • rankedEvents
    This is a field for each "Problem".
    This nests some affected entities in descending order in the point of view of impacts.
  • isRootCause
    This is a field for each "Entity". of "rankedEvents"
    If this value is "true", this "Entity" is recognized as one of root causes for this "Problem".
    If this value is "false", this "Entity" is NOT recoginized as root cause.
  • eventType
    This is a field for each "Entity".
    This indicates what types of event had impacts on this "Entity".

Based on the above, "eventType" is categorized and it explains the statement of "RootCause" to some extent, as is viewed on dynatrace console page.

Here, for example, I mean the statement "Long garbage-collection time" or "Memory resources exhausted"

When I fetch the details of this problem, there are two entities recognized as root cause, which means that their "isRootCause" have "true".


One of them has "HIGH_GC_ACTIVITY" in "eventType" field and the other has "MEMORY_RESOURCES_EXHAUSTED".
And I feel that they correspond to each RootCause statement.


In other words, "HIGH_GC_ACTIVITY" seems to mean "Long garbage-collection time" and "MEMORY_RESOURCES_EXHAUSTED" seems to mean "Memory resources exhausted"

Then I assume this "eventType" defines the statement of each root cause.

Is this understanding correct?

If so and possible, can I see something like the list or the table that shows correspondence between "eventType" and statements of root causes?

(I wonder if there are such things..)

Best Regards,

Kohei Saito


6 REPLIES 6

wolfgang_beer
Dynatrace Champion
Dynatrace Champion

Hi,

Yes your observations are completely correct. A problem is a container of events where each event sits on an entity. In case that the event is part of the root-cause we mark it as 'isRootCause' and the overall 'hasRootCuase' attributes if a root-cause was found for a given problem.

The confusing part is in the Web UI where multiple event findings such as Garbage collection event and memory event on the same entity are grouped into one entity card, shown in your screenshot. Those detailed information are exported as list of single events within the UI.

In general the root-cause within the problem details card should pinpoint the entity rather than the events on the entity because that's where you navigate deeper to find some code-level information.

The root-cause entity is the more important info to focus on.

Best regards,

Wolfgang


ksaito
Organizer

@Wolfgang B.

Thank you for your comment!

>The root-cause entity is the more important info to focus on.
Sure, I also strongly agree with you.
The more important for analysis of root cause is which entity is influenced.

In addition, let me confirm another.


When I fetch the details of a problem and get "EventType", this "EventType" leads the unique statement of "RootCause" on Web UI?

I mean, I'd like to know whether it is possible that one EventType has multiple presentations or not.
For example, this time, EventType:"HIGH_GC_ACTIVITY" is shown as "Long garbage-collection time" on Web UI and I wonder whether this presentation is always the same or not.

Best Regards,

Kohei


wolfgang_beer
Dynatrace Champion
Dynatrace Champion

In case of GC event thats true. In case of service slowdowns it can be that the 50th percentile did open an event as well as the 90th percentile, or that multiple service transactions (e.g.: login.aspx, payment.aspx.) raise independent single events. Those single events are grouped into a single service tile within the UI but the REST export does show all these single event details.


ksaito
Organizer

I'm sorry but I don't understand well yet...

As for GC event, it seems that "HIGH_GC_ACTIVITY" of "EventType" in the REST export always shows "Long garbage-collection time", doesn't it?

In addition, I'm looking at the following page when I say "EventType".

https://www.dynatrace.com/support/help/shortlink/a...

I guess that many values of this EventType list have something to do with "RootCause" tile of UI.

So I think that I can find what statement is shown on "RootCause" of WebUI if I know which "EventType" the entity recognized as one of root causes has.

Is this assumption correct..?

(I'm sorry if I can't convey what I want to tell you.. )


wolfgang_beer
Dynatrace Champion
Dynatrace Champion

I would not try to pinpoint the exact root-cause to a single event on a component. Its more likely that you pinpoint the root-cause component (such as a process or a host) and that more than one events is sitting on that root-cause component. There can be multiple events of various types on the root-cause component, such as long garbage collection time and then a process crash. Both events recorded for the same process component.


ksaito
Organizer

OK, I finally got what you pointed out.

I'm sorry for confusing you.

When I fetch the full details of a problem and "hasRootCause" of this problem has "true", I can make the following observations:

(1). A problem has one or more root-causes.
(2). A root-cause is composed of information about one or more entities.

(3). One of entities recognized as root-causes has one or more events.

Here, let me consider an example shown in the following image.

(1) This problem has one root-cause and it is "Root cause1".

(2) "Root cause1" is composed of one entity and it is "entity1".

(3) "entity1" has two events and they are "event1" and "event2".

I think what you were pointing out is (3).

I didn't think of it until you said, as the above, certainly a single root-cause can be related to multiple events.

However in fact, what I really want to ask you is whether "eventType" has the unique event presentation or not.


Taking the previous example, I used "event presentation" or "statement" as a meaning of the context surrounded by the yellow box.
When I got the REST export about this problem, I found "entity1" in the exported JSON and this have some events which are related with "event1" and "event2".

"event1" have "HIGH_GC_ACTIVITY" in "eventType" field and "event2" have "MEMORY_RESOURCES_EXHAUSTED".


I wonder whether it is always shown as "Long garbage-collection time" in WebUI when "eventType" is "HIGH_GC_ACTIVITY" or not.

This is just an example , and to make it simple, my question is whether "eventType" defines uniquely "event presentation" on WebUI or not.

Does it make sense..?

Kohei