Abstract
OpenStack has become the de-facto standard open source software for managing virtualized infrastructure for NFV, however, operators are facing increased complexity of fault management for OpenStack due to its black-box modular architecture and half-yearly version updates. This hinders operators from promptly identifying the root cause of failure or anomalies in OpenStack services. In this paper, we propose an anomaly detection framework for OpenStack in order to identify the root process of anomalies underlying OpenStack services. The framework utilizes a process relational graph and an anomaly detection technique with a centroid-based clustering algorithm. We demonstrate experiments with regards to two use cases and prove the framework to enable discovery of the root process that is responsible for the anomalous situation.