Mining Web Logs to Debug Wide-Area Connectivity Problems

• US 20080209030A1
• Filed: 02/28/2007
• Published: 08/28/2008
• Est. Priority Date: 02/28/2007
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Platt, John C., Goldszmidt, Moises, Maltz, David A., Kiciman, Emre M.
• Application Number:
  US11/680,483
• Publication Number:
  US 20080209030A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/064 involving time analysis
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/5067 Customer-centric QoS measurements
• CPC Class Codes: H04L 41/5074 Handling of user complaints or trouble tickets
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/091 Measuring contribution of individual network components to actual service level
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Internet service providers and their clients communicate by transmitting messages across one or more networks and infrastructure components. At various points between the service provider and the clients, inclusively, records may be created of each messages occurrence and status. These records may be read and analyzed to determine the effects of the networks and infrastructure components on the provided quality of service. User-effecting incidents (e.g., failures) occurring at networks may also be identified and described.

Claims

1. An analysis system comprising:

one or more computers to infer an impact of one or more infrastructure component(s) on service quality experienced by clients of a service provider based on an analysis of records of messages sent between the clients and the service provider, said records of messages either explicitly or implicitly representing effects of a plurality of the infrastructure components on the message'"'"'s achieved quality of service, and wherein at least some of the infrastructure components are external to an administrative domain of the service provider.

2. The system of claim 1, wherein the one or more computers further comprise means for distinguishing between problems in components internal to the service provider'"'"'s administrative domain and components external to the service provider'"'"'s administrative domain.

3. The system of claim 1, wherein all the infrastructure components are external to the administrative domain of the service provider.

4. The system of claim 1, wherein the records of messages are gathered from one or more vantage points.

5. The system of claim 1, wherein the records are records of one or more message types, wherein the message types are selected from a group comprising:

hyper text transport protocol (HTTP) requests and responses, instant messenger connections, instant messenger messages, instant messenger interactions, video streaming messages, and remote procedure calls.

6. The system of claim 1, wherein the one or more computers infer properties of an impact of one or more infrastructure components, wherein the properties include one or more properties from a group comprising:

a positive or negative impact of the component on the service quality experienced by the clients over time, a frequency, duration, and recurrence of negative and positive impacts, and the significance of the impact in comparison to other impacts according to a predetermined metric.

7. The system of claim 1 wherein the computer identifies boundaries of time periods of anomalous service quality.

8. A method comprising:

analyzing records of messages sent between a service provider and its clients'"'"' via a network comprising one or more components, wherein each record represents a result of the components'"'"' effect on a message'"'"'s status or a quality of service gathered from one or more vantage points; and

determining from the analyzing one or more determinations from a group of determinations comprising;

whether a problem is occurring internal or external to an administrative domain of the service provider,

which of the one or more components external to the service provider'"'"'s administrative domain are healthy or not healthy, or

an impact of the healthy and unhealthy components on the quality of service experienced by clients.

9. The method of claim 8 wherein the service provider includes infrastructure components;

and wherein all the infrastructure components are external to an administrative domain of the service provider.

10. The method of claim 8 wherein the records are records of one or more types of messages, wherein the types of messages are selected from a group comprising:

hyper text transport protocol (HTTP) requests and responses, instant messenger connections, instant messenger messages, instant messenger interactions, video streaming messages, and remote procedure calls.

11. A computer readable medium comprising computer-executable instructions that, when executed by one or more processors, perform acts comprising:

reading a plurality of records of messages sent between a service provider and its clients through a network or set of cooperating networks, including a set of infrastructure components; and

determining from original or preprocessed records of messages using analysis, effects of the networks or the infrastructure components on a quality of service achieved by the original messages.

12. The computer readable medium as recited in claim 11 further comprising preprocessing the plurality of records of messages to create a set of preprocessed records of messages.

13. The computer readable medium as recited in claim 11 wherein the one or more acts are executed in sequence or in parallel.

14. The computer readable medium as recited in claim 12 wherein one or more of the set of preprocessing acts comprises inferring missing records of messages between a service provider and its client that did not reach a vantage point.

15. The computer readable medium as recited in claim 11 wherein determining the effects includes a determination of a group comprising:

an occurrence of user-affecting incidents at one or more of the plurality of networks and infrastructure components;

when user-affecting incidents at one or more of the plurality of networks and infrastructure components have begun or ended;

a failure rate of one or more of the plurality of networks and infrastructure components;

a prioritization of the effects of one or more of the plurality of networks and infrastructure components or the user-effecting incidents occurring therein; and

a relationship between the effects of two or more of the plurality of networks and infrastructure components or the user-effecting incidents occurring therein.

16. A server comprising:

a read module to read a plurality of records of messages transferred between a service provider and its clients through a network or set of cooperating networks, including a set of infrastructure components;

an analysis module to determine from said records user-affecting incidents occurring at one or more of the plurality of networks and infrastructure components, and properties of said incidents; and

an alarm module to indicate one or more determined user-affecting incidents of the networks and infrastructure components.

17. The server as recited in claim 16 further comprising an infer module to infer missing records of messages records of messages between the service provider and its client that did not reach a vantage point.

18. The server as recited in claim 16, wherein the records of messages comprise a listing of hyper text transfer protocol (HTTP) requests to the service provider from a plurality of client electronic devices, and wherein the records of messages indicate whether or not such request was successful.

19. The server as recited in claim 16, wherein the analysis module determines a beginning or end of a user-affecting incident occurring in one or more of the plurality of networks and the infrastructure components, and wherein the alarm module generates an automated alarm in response to the occurrence of the incident.

20. The server as recited in claim 16, wherein the alarm module transmits indications selected from one or more of a group of indications comprising:

an electronic message, generate a report, or activate visual and/or aural signals to alert an operator of a network or infrastructure component at which a user-effecting incident is occurring.