Cross silo time stiching
First Claim
1. Apparatus includinga network monitoring device coupleable to a computer network;
- the network monitoring device coupleable to one or more of;
first types of device, second types of device, wherein the first types of device and the second types of device each interact in association with operation of said network, wherein the first types of device can include one or more of;
reporting devices coupled to the network, virtual machines operating on a network device;
wherein the network monitoring device includesan input port receiving network status data from the first types of device and the second types of device;
one or more individual storage records, each storage individual record segregating first network status data reported by the first types of device from second network status data reported by the second types of device, each individual storage record associating a time order with associated network status data;
a unitary in-order time storage record coupled to the input port, the unitary in-order time storage record coordinating the network status data with respect to the first types of device and the second types of device, the unitary in-order time storage record maintaining a selected number of locations, each one location associated with first network status data for a time when that first network status data would have been received in time order, each one location associated with second network status data for a time when that second network status data would have been received in time order, only when there are still locations available to maintain that second network status data;
an alert responsive to a selected combination of status data from said first type and said second type of device; and
wherein the unitary in-order time storage record coordinating the network status data with respect to the first types of device and the second types of device includesselecting a CDF (cumulative distribution function) or PDF (probability distribution function) representing a model of the amount of status data that can arrive;
dividing the network status data among a plurality of clock ticks in response to the selected CDF or PDF.
9 Assignments
0 Petitions
Accused Products
Abstract
A monitoring device responds to status data pushed from a network device, and also manages a link with another network device, the link allowing the monitoring device to pull status data from the second network device. The monitoring device receives packets including status, the data indicating activity for one or more clock ticks. The monitoring device can compute statistical measures, rather than the network device. The monitoring device maintains the status data in a buffer. The monitoring device lags actual activity, but has is more likely to capture delayed packets. The network device sends packets as wrappers, each wrapper indicating sets of status information. When the information in a wrapper crosses a clock tick boundary, the monitoring device allocates reported activity among clock ticks, assuming that activity follows a uniform distribution.
-
Citations
11 Claims
-
1. Apparatus including
a network monitoring device coupleable to a computer network; -
the network monitoring device coupleable to one or more of;
first types of device, second types of device, wherein the first types of device and the second types of device each interact in association with operation of said network, wherein the first types of device can include one or more of;
reporting devices coupled to the network, virtual machines operating on a network device;wherein the network monitoring device includes an input port receiving network status data from the first types of device and the second types of device; one or more individual storage records, each storage individual record segregating first network status data reported by the first types of device from second network status data reported by the second types of device, each individual storage record associating a time order with associated network status data; a unitary in-order time storage record coupled to the input port, the unitary in-order time storage record coordinating the network status data with respect to the first types of device and the second types of device, the unitary in-order time storage record maintaining a selected number of locations, each one location associated with first network status data for a time when that first network status data would have been received in time order, each one location associated with second network status data for a time when that second network status data would have been received in time order, only when there are still locations available to maintain that second network status data; an alert responsive to a selected combination of status data from said first type and said second type of device; and wherein the unitary in-order time storage record coordinating the network status data with respect to the first types of device and the second types of device includes selecting a CDF (cumulative distribution function) or PDF (probability distribution function) representing a model of the amount of status data that can arrive; dividing the network status data among a plurality of clock ticks in response to the selected CDF or PDF.
-
-
2. Apparatus including
a network monitoring device coupleable to a computer network; -
the network monitoring device responsive to network status data from one or more of;
reporting devices coupled to the network, virtual machines operating on a network device, the reporting devices and virtual machines providing the network status data with respect to more than one function to be performed by network devices;wherein the network monitoring device includes an input port receiving the network status data with respect to the more than one function; one or more individual storage records, each individual storage record segregating first network status data for a first function from second network status data for a second function; a unitary in-order time storage record coupled to the input port, the unitary in-order time storage record coordinating the network status data with respect to more than one function, the unitary in-order time storage record maintaining a selected number of locations, each one location associated with first network status data for a time when that first network status data would have been received in time order, each one location associated with second network status data for a time when that second network status data would have been received in time order, only when there are still locations available to maintain that second network status data; an alert responsive to a selected combination of status data from said first and said second network status data; and wherein the unitary in-order time storage record coordinating the network status data with respect to more than one function includes selecting a CDF (cumulative distribution function) or PDF (probability distribution function) representing a model of the amount of status data that can arrive; dividing the network status data among a plurality of clock ticks in response to the selected CDF or PDF. - View Dependent Claims (3, 4, 5, 6)
-
-
7. Apparatus including
a network monitoring device coupleable to a computer network; -
the network monitoring device responsive to network status data from one or more of;
reporting devices coupled to the network, virtual machines operating on a network device, the reporting devices and virtual machines providing the network status data with respect to more than one function to be performed by network devices;wherein the network monitoring device includes an input port receiving the network status data with respect to the more than one function; one or more individual storage records, each individual storage record segregating first net-work status data for a first function from second network status data for a second function; a unitary in-order time storage record coupled to the input port, the unitary in-order time storage record coordinating the network status data with respect to more than one function, the unitary in-order time storage record maintaining a selected number of locations, each one location associated with first network status data for a time when that first network status data would have been received in time order, each one location associated with second network status data for a time when that second network status data would have been received in time order, only when there are still locations available to maintain that second network status data; an alert responsive to a selected combination of status data from said first and said second network status data; an output port disposed to request information from one or more of the reporting devices or virtual machines in response to the unitary in-order time storage record; and wherein the unitary in-order time storage record coordinating the network status data with respect to more than one function into the unitary in-order time record includes selecting a CDF (cumulative distribution function) or PDF (probability distribution function) representing a model of the amount of status data that can arrive; dividing the network status data among a plurality of clock ticks in response to the selected CDF or PDF. - View Dependent Claims (8, 9, 10, 11)
-
Specification