I am planning to use the apriori or fp tree for root cause analysis of issues. I know the event which indicates the system reboot. I picked the last 5 minutes data prior to the system reboot. For example, the data is like reboot1 : e1,e2,e3,e4....e15 reboot2 : s1,s2,s3,....s15 reboot3 : t1,t2,t3,......t15
I tried to get the itemsets with support > 0.7 and lift >0.7. But there are lot of frequent item sets and rules generated with lift=1 and support=1. So i cannot conclude the list of events which are resulting in the system reboot
Please clarify the following queries 1. Let me know if i should consider the combination of good and bad events in the dataset for identifying the events resulting in the issue and not present in good working condition 2. Is there any other way of filtering the events after the FP tree analysis 3. Is there any other appropriate way of identifying the root cause.