Method, computer product and system for correlating events in a network

• US 20050276217A1
• Filed: 05/25/2004
• Published: 12/15/2005
• Est. Priority Date: 05/25/2004
• Status: Active Grant

• Current Assignee: Nytell Software LLC (Intellectual Ventures LLC)
• Original Assignee: TTI Inventions A LLC (Intellectual Ventures LLC)
• Inventors: Natarajan, Narayanan, Gadgil, Shrirang
• Granted Patent: US 7,965,620 B2
• Time in Patent Office: Days
• US Class Current: 370/225
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0233 Object-oriented techniques, for representation of network management data, e.g. common object request broker architecture [CORBA]
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/22 Alternate routing
• CPC Class Codes: H04L 45/28 using route fault recovery

Abstract

In one aspect a method for correlating network events in a network comprises correlating the events relating to paths with events relating to links traversed by paths. In another aspect, the method includes correlating the events based on whether paths traversing the network share network resources, such as links. Preferably, the method is implemented in a network where paths traversing the network change dynamically in response to other network events and based on traffic engineering priorities.

Claims

1. A method for correlating events in a network, comprising:

receiving a plurality of network events from the network, each of the network events being associated with a service path through the network; and

correlating a first network event and a second network event among the plurality of network events based on a relationship between a first service path associated with the first network event and a second service path associated with the second network event.

2. The method of claim 1, wherein the step of correlating includes determining whether the second network event was caused by a status change on the first service path.

3. The method of claim 1, wherein the step of correlating includes determining whether the first service path shares a link with the second service path.

4. The method of claim 1, wherein the network is a multi-protocol label switching network.

5. The method of claim 4, wherein the multiprotocol label switching network is an internet protocol network.

6. The method of claim 4, wherein the multiprotocol label switching network is a generalized multiprotocol label switching optical network.

7. The method of claim 1, wherein the step of receiving comprises receiving a message indicating that a label switched path in a multiprotocol label switching network failed.

8. The method of claim 1, wherein the step of receiving comprises receiving a message indicating that a label switched path in a multiprotocol label switching network was restored to service.

9. The method of claim 1, wherein the step of receiving comprises receiving a message indicating that a label switched path in a multiprotocol label switching network was rerouted.

10. A method for correlating network events, comprising:

receiving a plurality of network events from the network;

tracking information relating to the current route of service paths through the network;

correlating the plurality of network events based on the tracked route information; and

representing the correlated events in the form of a directed acyclic graph.

11. The method of claim 10, wherein the step of representing the correlated events in the form of a directed acyclic graphs includes indicating whether a recorded event is caused by another recorded event from among the plurality of events.

12. The method of claim 10, wherein the tracked route information includes an association between a label switched path traversing the network and a link in the path.

13. The method of claim 10, wherein the step of correlating includes associating a network event on a path if the path traverses the link on which the network link failure event was detected.

14. A system for correlating events in a network, comprising:

a processor, data and instructions executable by the processor, the instructions including;

associating routes of paths traversing the network with links between devices in the network;

receiving a plurality of network events from the network;

correlating a first network event and a second network event from among the plurality of network events based on the association between the routes traversing the network and the links between devices in the network; and

representing the associated events in the form of a directed acyclic graph.

15. The method of claim 14 wherein the step of representing the associated events in the form of a directed acyclic graph includes indicating whether the first event is caused by the second event.

16. The system of claim 14 wherein the network is a multiprotocol label switching network.

17. The system of claim 14 wherein the route information includes one or more label switched paths in a multiprotocol label switching network.

18. The method of claim 17, wherein the multiprotocol label switching network is an internet protocol network.

19. The method of claim 17, wherein the multiprotocol label switching network is a generalized multiprotocol label switching optical network.

20. The system of claim 14 wherein the network events are in the form of Simple Network Management Protocol traps.