NETWORK MONITORING AND DIAGNOSTICS

• US 20140006871A1
• Filed: 03/14/2013
• Published: 01/02/2014
• Est. Priority Date: 06/27/2012
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Brocade Communications Systems, Inc. (Broadcom, Inc.)
• Inventors: Lakshmanan, Subramanian, Gnanasekaren, Sathish
• Granted Patent: US 9,213,590 B2
• Time in Patent Office: Days
• US Class Current: 714/37
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/064 involving time analysis
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies

Abstract

Techniques are provided for monitoring and diagnosis of a network comprising one or more devices. In some embodiments, techniques are provided for gathering network information, analyzing the gathered information to identify correlations, and for diagnosing a problem based upon the correlations. The diagnosis may identify a root cause of the problem. In certain embodiments, a computing device may be configurable to determine a first event from information, allocate a first event to a first cluster, the first cluster is from one or more clusters of events, based on a set of attributes for the first event, and determine a set of attributes for the first cluster, and rank the first cluster against the other clusters from the one or more clusters of events based on the set of attributes for the first cluster. The set of attributes may be indicative of the relationship between events in the cluster. In some embodiments, one or more recommendations may be provided for taking preventative or corrective actions for the problem.

Claims

1. A computing device comprising one or more processing units configurable to:

determine a first event from information;

allocate a first event to a first cluster, the first cluster is from one or more clusters of events, based on a set of attributes for the first event, the set of attributes comprising;

location information indicative of a location in a network where a first event occurred; and

time information indicative of a time when the first event occurred in a network; and

determine a set of attributes for the first cluster; and

rank the first cluster against the other clusters from the one or more clusters of events based on the set of attributes for the first cluster.

2. The computing device of claim 1, wherein the set of attributes for the first cluster are indicative of a relationship between a plurality of events from the first cluster.

3. The computing device of claim 2, wherein the relationship between the plurality of events from the first cluster is unknown prior to a formation of the relationship.

4. The computing device of claim 1, wherein the set of attributes for the first event further comprises one or more categories indicating information associated with the first event, wherein the one or more categories comprises one or more of a hardware error category, a software error category, a performance category, a permissions category and/or a topology category.

5. The computing device of claim 1, wherein the first event is one of a raw event, a derived event or a topology event.

6. The computing device of claim 1, wherein the network comprises a topology of one or more network level nodes in a network topology and/or device level nodes in a device topology.

7. The computing device of claim 1, wherein the one or more processing units are configurable to:

determine a distance between the first event and the first cluster, wherein the distance determined between the first event and the first cluster is indicative of a probability that the first event and the first cluster are directly related to each other; and

allocate the first event to the first cluster if the distance is below a distance threshold.

8. The computing device of claim 7, wherein the determining the distance between the first event and the first cluster comprises:

determining, by the one or more processing units, a shortest distance between the first event and each of one or more events from the first cluster based upon a set of attributes associated with the first event and each event of the one or more events from the first cluster.

9. The computing device of claim 8, wherein the one or more events from the first cluster are the events that occurred in a past pre-determined period of time.

10. The computing device of claim 1, wherein determining a set of attributes for a first cluster comprises determining, by the one or more processors, a goodness of the first cluster, the determining the goodness of the first cluster indicates how closely related the events of the first cluster are to each other;

and

ranking the first cluster against the other clusters from the one or more clusters of events is based on determining, by the one or more processors, a ranking vector for the first cluster based on a number of events in the cluster and the goodness of the first cluster.

11. The computing device of claim 1, wherein the ranking of the one or more clusters of events comprises ranking, by the one or more processors, the one or more clusters of events for each severity level associated with the one or more events from the one or more clusters of events.

12. The computing device of claim 1, further comprises providing one or more events from the first cluster for displaying, by the one or more processors, through a user interface, if the first cluster is ranked amongst a pre-determined number of cluster of events to be displayed.

13. The computing device of claim 1, wherein the first cluster comprises a most significant event in the cluster, wherein the most significant event in the first cluster is an event with an earliest timestamp amongst the events of the first cluster.

14. The computing device of claim 1, wherein the one or more attributes of each cluster comprises a timestamp of a last event added to the cluster.

15. The computing device of claim 14, wherein the first cluster is removed from memory if the timestamp of the last event added to the cluster is older than a time threshold.

16. A method comprising:

determining a first event from information;

allocating a first event to a first cluster, the first cluster is from one or more clusters of events, based on a set of attributes for the first event, the set of attributes for the first event comprising;

location information indicative of a location in a network where a first event occurred; and

time information indicative of a time when the first event occurred in a network; and

determining a set of attributes for the first cluster;

ranking the first cluster against the other clusters from the one or more clusters of events based on the set of attributes for the first cluster.

17. The method of claim 16, wherein the set of attributes for the first cluster are indicative of a relationship between a plurality of events from the first cluster.

18. The method of claim 17, wherein the relationship between the plurality of events from the first cluster is unknown prior to a formation of the relationship.

19. The method of claim 16, wherein the set of attributes for the first event further comprises one or more categories indicating information associated with the first event, wherein the one or more categories comprises one or more of a hardware error category, a software error category, a performance category, a permissions category and/or a topology category.

20. The method of claim 16, wherein the method comprises:

determining a distance between the first event and the first cluster, wherein the distance determined between the first event and the first cluster is indicative of a probability that the first event and the first cluster are directly related to each other; and

allocating the first event to the first cluster if the distance is below a distance threshold.