Distributed network service risk monitoring and scoring

• US 10,313,211 B1
• Filed: 08/24/2016
• Issued: 06/04/2019
• Est. Priority Date: 08/25/2015
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: Avi Networks, Inc. (Broadcom, Inc.)
• Inventors: Rastogi, Gaurav, Yadav, Sandeep, Basavaiah, Murali
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Ahmed, Mahabub S
• Application Number:
  US15/246,228
• Time in Patent Office: 1,014 Days
• Field of Search: 726 22
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0677 Localisation of faults
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A method for evaluating health of a distributed network service environment (DNSE) includes determining an application performance measurement (APM) based at least in part on performance metrics (PM) associated with sources, where the sources are associated with the DNSE. The sources include service engine(s) and servers. At least some of the servers are configured to provide a distributed application, and the service engine(s) are configured to provide the servers with a network service and collect at least a part of the PM. The method includes determining a health risk of the DNSE based at least in part on risk parameters obtained by the service engine(s). The method includes combining the APM and the health risk of the DNSE to determine a health indicator. If the indicator indicates a change of the DNSE, a notification of the change is generated. The method includes outputting the notification of the change.

Claims

1. A method of evaluating health of a distributed network service environment (DNSE), comprising:

determining, by a processor, an application performance measurement based at least in part on a plurality of performance metrics associated with a plurality of sources, wherein;

the plurality of sources are associated with the DNSE;

the plurality of sources includes one or more service engines and a plurality of servers;

at least some of the plurality of servers are configured to provide a distributed application; and

the one or more service engines are configured to provide the plurality of servers with a network service, including by cooperating to carry out a network function of the distributed application and collect at least a part of the plurality of performance metrics;

determining, by the processor, a health risk of the DNSE based at least in part on a plurality of risk parameters obtained by the one or more service engines;

combining, by the processor, the application performance measurement and the health risk of the DNSE to determine a health indicator indicating overall health of a stack, wherein the stack includes at least a service engine and at least one server;

in the event that the health indicator indicates a health change of the DNSE, generating, by the processor, a notification of the health change of the DNSE; and

outputting, by the processor, the notification of the health change of the DNSE.

2. The method of claim 1, wherein the health indicator is a single value.

3. The method of claim 1, wherein the health indicator indicates one or more of:

whether a service level agreement is met, whether resources are over-utilized, whether the DNSE is secure, and/or whether performance of the DNSE is predictable.

4. The method of claim 1, further comprising providing a notification of one or more factors that contributed to the health change of the DNSE.

5. The method of claim 1, wherein the outputting includes displaying the notification.

6. The method of claim 1, wherein the outputting includes outputting the notification in an application programming interface.

7. The method of claim 1, wherein the outputting includes outputting at least one reason for the health change.

8. The method of claim 1, wherein the plurality of performance metrics includes two or more of:

a client performance metric measuring performance of a client accessing the distributed application;

a server metric measuring performance of a server providing the distributed application;

a network metric measuring performance of a network link providing the distributed application; and

/or

a pool availability metric measuring performance of a pool of servers providing the distributed application.

9. The method of claim 1, wherein the plurality of performance metrics includes at least one apdex.

10. The method of claim 1, wherein the determination of the application performance measurement includes applying a function to the plurality of performance metrics.

11. The method of claim 10, wherein the function includes at least one of:

a minimum, a maximum, and an average.

12. The method of claim 1, wherein a performance metric in the plurality of performance metrics is determined by:

collecting samples associated with the performance metric;

classifying the samples relative to a benchmark; and

evaluating the performance metric based on classifications of the samples.

13. The method of claim 1, wherein at least some of the plurality of risk parameters are determined by the one or more service engines.

14. The method of claim 1, wherein the plurality of risk parameters measures a virtual server associated with at least one of the one or more service engines and at least one of the plurality of servers, the risk parameters including a security parameter, a resource parameter, and a consistency parameter.

15. The method of claim 14, wherein the resource parameter is based at least in part on resource utilization metrics.

16. The method of claim 14, wherein the security parameter is based at least in part on a combination of SSL configuration settings and attack measurements.

17. The method of claim 14, wherein the consistency parameter is based at least in part on a percentage of metrics that are anomalous as measured against a benchmark.

18. The method of claim 1, wherein the network service provided by the one or more service engines is a distributed network service.

19. A system for evaluating health of a distributed network service environment (DNSE), comprising:

a processor configured to;

determine an application performance measurement based at least in part on a plurality of performance metrics associated with a plurality of sources, wherein;

the plurality of sources are associated with the DNSE;

the plurality of sources includes one or more service engines and a plurality of servers;

at least some of the plurality of servers are configured to provide a distributed application; and

the one or more service engines are configured to provide the plurality of servers with a network service including by cooperating to carry out a network function of the distributed application and collect at least a part of the plurality of performance metrics;

determine a health risk of the DNSE based at least in part on a plurality of risk parameters obtained by the one or more service engines;

combine the application performance measurement and the health risk of the DNSE to determine a health indicating overall health of a stack, wherein the stack includes at least a service engine and at least one server;

in the event that the health indicator indicates a health change of the DNSE, generate a notification of the health change of the DNSE; and

output the notification of the health change of the DNSE; and

a memory coupled to the processor and configured to provide the processor with instructions.

20. A computer program product for evaluating health of a distributed network service environment (DNSE), the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

determining an application performance measurement based at least in part on a plurality of performance metrics associated with a plurality of sources, wherein;

the plurality of sources are associated with the DNSE;

the plurality of sources includes one or more service engines and a plurality of servers;

at least some of the plurality of servers are configured to provide a distributed application; and

the one or more service engines are configured to provide the plurality of servers with a network service including by cooperating to carry out a network function of the distributed application and collect at least a part of the plurality of performance metrics;

determining a health risk of the DNSE based at least in part on a plurality of risk parameters obtained by the one or more service engines;

combining the application performance measurement and the health risk of the DNSE to determine a health indicator indicating overall health of a stack, wherein the stack includes at least a service engine and at least one server;

in the event that the health indicator indicates a health change of the DNSE, generating a notification of the health change of the DNSE; and

outputting the notification of the health change of the DNSE.