Correlation is not causation! Or is it?
summary
Compares clustering/ML (PCA, embeddings, kmeans) with a statistical pipeline that computes Bayesian likelihood ratios and relative risk from alert cooccurrence, showing fever|flu ≈ 60% and a likelihood ratio ≈ 2.58 while a relative risk example is ≈ 0.9. Builds a directed symptom graph that infers probable cause links without GPUs, requires negative examples and class balance, and on OpenShift alert logs splits conflated incidents (e.g., node membership failure vs port security noise) successfully on real data.
AI-written summary · about
chapters (16)
- 0:00Red Hat health data strategy
- 1:24Correlation in root cause analysis
- 3:11Clustering algorithms limits
- 4:36Rediscovering statistics
- 5:22Bayesian probabilities demo
- 8:43Alerts as symptoms
- 10:30Likelihood ratios for correlations
- 13:44Probabilities and causality limits
- 16:33Relative risk metrics
- 19:28Ratios and causality
- 21:12Quality balanced data
- 22:58Symptom graph visualization
- 24:26Causality arrows
- 25:30Stats vs ML
- 26:13Stats and ML combined
- 26:53Q&A
related talks
20mSpike Detection in Alert Correlation
30mReducing MTTR and False Escalations: Event...
34mML-Bound Anomaly Detection: Experiences Beyond Commodity Observability
25mSymptom-based Alerting for Machine Learning - What I Learned...
46mEvent Correlation: A Fresh Approach towards Reducing MTTR
37mWeathering the Storm: How Early Warnings Save the Farm
10mML-based Log Analysis for Faster Debugging
22mStable and Practical AS Relationship Inference with ProbLink