Localization and correlation: A better understanding of dependencies

Locations: From devices to their context

In a distributed infrastructure, simply knowing that a device is down is not always enough to understand the incident. To determine its cause, you also need to know where the device is located, which components are associated with it and which services may be affected. A server, router, switch or pod does not operate in isolation. It belongs to an environment: a site, a region, a data center or a part of the infrastructure. This information may seem merely descriptive, but it becomes invaluable during an incident analysis.

When multiple events occur simultaneously, their location can help determine whether they share a common context. Incidents affecting equipment associated with the same data center, for example, may warrant an investigation at that location. Conversely, similar events spread across multiple locations may point the analysis toward a shared dependency or service.

Location alone does not constitute proof of a common cause. It provides additional context that can be linked to events, detected dependencies and relationships between components. It offers both geographic and operational context. When combined with dependency detection and incident correlation, it helps teams move from a list of alerts to a more coherent view of the event: which elements are affected, how they are connected and where to look for a potential root cause.

Defining locations in ServicePilot

The Location & Data Centers configuration interface allows you to create rules that associate hosts with a location. A rule can specify, for example, a country, a data center name and its geographic coordinates.

The affected devices can include servers, routers, switches, pods or other infrastructure components. Once the rules are configured, the location information can help contextualize these devices and correlate them with the rest of the infrastructure.

The configuration is based primarily on the host field and the associated location information:

• IP addresses to include or exclude: A rule can target one or more IP addresses or IP address patterns.
• Country: The two-letter country code is used to associate the rule with a country.
• Data center: This field specifies the name of the data center associated with the corresponding addresses.
• Latitude and longitude: These coordinates are used to locate the data center on the GeoMap.

The country, data center and coordinates fields describe the associated location. The IP field defines the addresses to which this location applies.

Targeting IP addresses

To simplify the configuration of multiple addresses, the Host field accepts a list of patterns separated by the | character. The wildcard character * can be used to represent a sequence of characters. This allows you to target a set of addresses that share the same portion, rather than entering each address individually.

For example, the following values illustrate the different available syntaxes:

10.20.1.15|10.20.1.16

This list targets two IP addresses.

10.20.*

The wildcard character * allows you to target addresses that share the specified prefix.

The field can also function as an exclusion. If its first value begins with !, the corresponding addresses are excluded. Finally, when the pattern begins and ends with /, it is interpreted as a regular expression.

These options allow you to tailor the rules to the network structure: specific addresses, a set of addresses sharing a common pattern or a selection defined using a regular expression. It is recommended that you choose a syntax that matches the desired scope and verify that the pattern accurately describes the targeted addresses.

Viewing data centers on the GeoMap

The latitude and longitude coordinates specified in a location rule are used to position the corresponding data center on the GeoMap. This representation transforms the location information configured in ServicePilot into a geographic view of the infrastructure’s locations.

The map provides a visual complement to the descriptive information for each rule. The data center’s name identifies its location, while its coordinates indicate where it is situated. Equipment associated with location rules can then be placed in their geographic context, rather than being viewed solely as isolated entities within the platform.

This view is useful when the infrastructure is spread across multiple sites or data centers. It allows you to quickly gain an overview of the geographic distribution of the configured locations and better pinpoint the affected equipment when an event occurs. During an investigation, this perspective can help determine whether multiple events are affecting equipment associated with the same site or whether they involve different locations.

The GeoMap depends on the quality of the information provided in the configuration. Accurate coordinates and consistent data center names make it easier to identify the locations represented. By entering this information into the location rules, teams build a more actionable map of their infrastructure.

Correlating events with dependencies

In an infrastructure, components are interconnected: a piece of equipment can contribute to the operation of a service and a failure can have repercussions beyond the component on which it was detected. When an incident occurs, it is therefore important to examine not only the initial alert, but also the relationships between the affected components and services.

Dependency management and detection in ServicePilot have been improved to better correlate events with infrastructure elements. Detection algorithms help identify these relationships. Location information provides additional context by linking devices to specific locations.

This information serves complementary purposes: location data indicates where the affected devices are located, while dependencies help understand how they are connected to other components and services. Combining these elements gives teams more information to analyze an event, assess its scope and determine which lines of investigation are most relevant.

Correlation is particularly useful when multiple incidents occur within the same time period. Some may be linked to a common cause, while others may be unrelated. By linking events to dependencies and the infrastructure context, ServicePilot helps build a more coherent view of the situation, rather than treating each alert in isolation.

This correlation aids analysis: it highlights possible links between events and components, but the root cause must still be interpreted based on the available context. Geographical information and relationships between elements provide reference points to guide this investigation.

From incident grouping to problem view

An event affecting the infrastructure can trigger multiple incidents, sometimes across different devices or services. A list of incidents examined separately does not always immediately reveal that they may be part of the same situation. It can then be difficult to assess the scope of the event or to distinguish its cause from its consequences.

ServicePilot introduces the concept of a problem, which allows multiple incidents to be grouped within a single view. This grouping helps users examine related incidents together and better understand the situation as a whole. It complements the detailed review of each incident with a more holistic perspective.

The two concepts then address different needs:

• An incident describes an event observed on a given component.
• A problem groups together several related incidents to represent a broader situation.

This distinction helps teams move from observing a specific symptom to analyzing the event that may link it to other symptoms. By considering incidents within the context of a problem, it becomes easier to examine the affected components, their relationships and the potential impact on services.

This grouping is part of the correlation process: associated incidents can be analyzed using available dependency and location information. This provides several complementary perspectives for understanding the event: the observed symptoms, the affected equipment, their relationships within the infrastructure and their location.

Considering layers 4 and 7

Correlation takes into account different levels of the infrastructure, particularly layers 4 and 7 of the network model. This approach makes it possible to link the context of network communications with that of services and application exchanges, rather than limiting the analysis to a single level.

Layer 4 deals with the transport of network communications. Layer 7 corresponds to the application layer, where services and related interactions take place. These layers provide different perspectives on the same situation: an event related to a service can be examined by taking into account the infrastructure components involved in its operation.

By linking elements from these layers to detected dependencies, ServicePilot provides a broader context for investigation. Teams can then examine possible relationships between network events, infrastructure components and the affected services. Geolocation complements this analysis by indicating the locations associated with the equipment.

This cross-functional view helps better distinguish symptoms from potential causes. An alert visible at the service level can be put into context with its associated components and dependencies, while location information helps pinpoint the affected equipment. The analysis then benefits from a view that combines events, relationships between elements, network and application layers and the geographic context of the infrastructure.

An example of analysis

Let’s imagine that several incidents are detected on different pieces of equipment. An analysis limited to the list of alerts shows each event separately, without necessarily highlighting their connections.

With location rules and dependencies, the investigation can be guided by several questions:

• Which devices are involved? IP rules allow them to be associated with a country or a data center.
• Do the events share a location? Location provides a geographic context for comparing incidents.
• Are the devices linked to other components or services? Dependencies help examine relationships within the infrastructure.
• Do multiple incidents appear to be related to the same event? Grouping them into a single issue provides a consolidated view of related incidents.
• Which levels of the infrastructure are affected? Correlation can take into account Layers 4 and 7 to expand the analysis to communications and services.

These elements do not automatically identify a root cause in every case. However, they help organize the investigation and identify the leads to prioritize.

A more cohesive view of the infrastructure

Geolocation makes it possible to link equipment to identifiable locations and to map data centers. Dependency detection, correlation between Layers 4 and 7 and the grouping of incidents into problems add an operational dimension to this geographic context.

Together, these mechanisms help teams better understand the relationships between components, assess the scope of an event and identify a potential root cause. ServicePilot then provides a more comprehensive view of incidents: not only the observed events, but also the locations, dependencies and services that may be associated with them.