System and method for dynamic management of network device data

• US 10,404,555 B2
• Filed: 05/22/2017
• Issued: 09/03/2019
• Est. Priority Date: 10/04/2012
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Wanser, Kelly, Antonopoulos, Andreas Markos
• Primary Examiner(s): Tiv, Backhean
• Application Number:
  US15/601,920
• Publication Number:
  US 20170264509A1
• Time in Patent Office: 834 Days
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/085 Retrieval of network configuration; Tracking network configuration history
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/103 with adaptive polling, i.e. dynamically adapting the polling rate

Abstract

A method and apparatus of a device that dynamically changes how management data is managed in response to events detected in a network system is described. In an exemplary embodiment, the device detects an event occurring in the network system. The device further determines if the event triggers a system change in how the management data is reported on one or more of the managed nodes. If the event notification does trigger the system change, for each of the one or more of the managed nodes, the device determines a command for that manage node that represents a specific change in how frequent the management data is reported to the network management system. In addition, the device sends the command to that managed node, where the agent applies the command to the managed node and the applied command implements the specific change in how frequent the management data is reported to the network management system.

Claims

1. A method comprising:

detecting, by a network management system (NMS) associated with a private network and communicatively coupled to a plurality of nodes managed by the NMS, an occurrence of an event associated with a network management user interface of a user device through which a system administrator interacts with the NMS, wherein the event is indicative of navigation by the system administrator within the network management user interface to view a particular managed node of the plurality of nodes managed by the NMS or a particular component of the particular managed node;

determining, by the NMS, the event triggers a change in how management data is one or more of (i) collected by the particular managed node and (ii) reported by the particular managed node, wherein the management data includes information that characterizes a functioning state of the particular managed node or the particular component or information regarding network traffic being processed by the particular managed node or the particular component;

determining, by the NMS, a command based on a rule matching the event from a set of rules for the particular managed node that represents a directive to the particular managed node to implement a specific change in how the management data is collected by the particular managed node or reported by the particular managed node to the NMS; and

causing an agent resident on the particular managed node to implement the specific change by sending, by the NMS, the command to the agent resident on the particular managed node.

2. The method of claim 1, wherein the specific change comprises an increase in a reporting frequency of the management data to the NMS.

3. The method of claim 1, wherein the specific change comprises a change in a type of management data that is collected and reported to the NMS.

4. The method of claim 1, wherein the specific change comprises a change selected from one or more of a rate of collection of the management data by the agent, a window size of collected management data, and a rate of logging of the management data.

5. The method of claim 1, wherein the particular managed node comprises one or more of a network access element or a network security device in virtual or physical form.

6. The method of claim 1, wherein the particular managed node comprises a switch and the management data comprises a number of packets received or transmitted by the switch during a particular time period.

7. The method of claim 6, wherein the management data further comprises a number of packets dropped by the switch during the particular time period and characterization of packets traversing the switch.

8. The method of claim 1, wherein the particular component comprises a port of the particular managed node.

9. The method of claim 8, wherein the specific change comprises a change selected from one or more of a first level of detail of management data including a first set of statistics and a second level of detail of management data including a second set of statistics to be reported to the NMS, wherein the second set of statistics includes the first set of statistics and one or more additional statistics.

10. The method of claim 1, wherein the particular component comprises a service of the particular managed node.

11. A non-transitory machine-readable medium having embodied thereon executable instructions to cause one or more processors of a network management system (NMS) associated with a private network and communicatively coupled to a plurality of nodes managed by the NMS to perform a method comprising:

detecting an occurrence of an event associated with a network management user interface of a user device through which a system administrator interacts with the NMS, wherein the event is indicative of navigation by the system administrator within the network management user interface to view a particular managed node of the plurality of nodes managed by the NMS or a particular component of the particular managed node;

determining the event triggers a change in how management data is one or more of (i) collected by the particular managed node and (ii) reported by the particular managed node, wherein the management data includes information that characterizes a functioning state of the particular managed node or the particular component or information regarding network traffic being processed by the particular managed node or the particular component;

determining a command based on a rule matching the event from a set of rules for the particular managed node that represents a directive to the particular managed node to implement a specific change in how the management data is collected by the particular managed node or reported by the particular managed node to the NMS; and

causing an agent resident on the particular managed node to implement the specific change by sending the command to the agent resident on the particular managed node.

12. The non-transitory machine-readable medium of claim 11, wherein the specific change comprises an increase in a reporting frequency of the management data to the NMS.

13. The non-transitory machine-readable medium of claim 11, wherein the specific change comprises a change in a type of management data that is collected and reported to the NMS.

14. The non-transitory machine-readable medium of claim 11, wherein the specific change comprises a change selected from one or more of a rate of collection of the management data by the agent, a window size of collected management data, and a rate of logging of the management data.

15. The non-transitory machine-readable medium of claim 11, wherein the particular managed node comprises one or more of a network access element or a network security device in virtual or physical form.

16. The non-transitory machine-readable medium of claim 11, wherein the particular managed node comprises a switch and the management data comprises a number of packets received or transmitted by the switch during a particular time period.

17. The non-transitory machine-readable medium of claim 16, wherein the management further data comprises a number of packets dropped by the switch during the particular time period and characterization of packets traversing the switch.

18. The non-transitory machine-readable medium of claim 11, wherein the particular component comprises a port of the particular managed node.

19. The non-transitory machine-readable medium of claim 18, wherein the specific change comprises a change selected from one or more of a first level of detail of management data including a first set of statistics and a second level of detail of management data including a second set of statistics to be reported to the NMS, wherein the second set of statistics includes the first set of statistics and one or more additional statistics.

20. The non-transitory machine-readable medium of claim 11, wherein the particular component comprises a service of the particular managed node.