ROOT CAUSE ANALYSIS IN A SENSOR-ACTUATOR FABRIC OF A CONNECTED ENVIRONMENT

• US 20140129876A1
• Filed: 11/05/2012
• Published: 05/08/2014
• Est. Priority Date: 11/05/2012
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Addepalli, Sateesh K., Sudhaakar, Raghuram S., Lee, Kevin C., Vasseur, Jean-Philippe
• Granted Patent: US 9,037,896 B2
• Time in Patent Office: Days
• US Class Current: 714/37
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: H04L 41/064 involving time analysis
• CPC Class Codes: H04L 41/0677 Localisation of faults
• CPC Class Codes: Y04S 40/00 Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them

Abstract

In one embodiment, the techniques herein provide that a node may receive indicia of a fault state in one or more components of a computer network. Based on the indicia, the node may then identify a network dependency group including a plurality of network components that are hierarchically associated with the one or more components. The node may then receive, from a database, a time series of performance data values corresponding to the network dependency group, wherein the time series comprises performance data values from before and after the onset of the fault state. The node may then identify altered performance data values in the time series comprising values which differ before and after onset of the fault state, and then determine a root cause of the fault state by identifying one or more particular components within the network dependency group that are associated with the altered performance data values.

Claims

1. A method, comprising:

receiving, at a node, indicia of a fault state in one or more components of a computer network;

identifying, based on the indicia, a network dependency group comprising a plurality of network components hierarchically associated with the one or more components;

receiving, from a database, a time series of performance data values corresponding to the network dependency group, wherein the time series comprises performance data values from before and after onset of the fault state;

identifying altered performance data values in the time series comprising values which differ before and after onset of the fault state; and

determining a root cause of the fault state by identifying one or more particular components within the network dependency group associated with the altered performance data values.

2. The method as in claim 1, further comprising:

identifying, based on the root cause of the fault state, one or more affected nodes which need to respond to the fault; and

communicating to the one or more affected nodes a response message.

3. The method as in claim 2, further comprising:

determining a response for each of the one or more affected nodes; and

including the determined response in the response message.

4. The method as in claim 1, wherein the network dependency group comprises network components that are at an equivalent, or greater, level in the network component hierarchy.

5. The method as in claim 1, wherein determining further comprises:

constructing a matrix for one or more time-series of performance values;

optimizing the matrix by robust single value decomposition (SVD); and

applying a multiscale local subspace analysis to the matrix to determine the root cause.

6. The method as in claim 1, wherein the multiscale local subspace analysis comprises an iterative alternating direction method for scaling the matrix.

7. The method as in claim 1, wherein the time-series of performance data is based on information provided by sources selected from the group consisting of simple network management protocol management information bases (SNMP MIBs), device syslogs, and service-level statistics.

8. The method as in claim 1, wherein the computer network is a sensor-actuator fabric.

9. The method as in claim 1, wherein the node is a device selected from the group consisting of a low-power and lossy network border router (LBR), a network management system (NMS), a capable node, and any combination thereof.

10. An apparatus, comprising:

one or more network interfaces to communicate with a computer network;

a processor coupled to the network interfaces and adapted to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed operable to;

receive indicia of a fault state in one or more components of a computer network;

identify, based on the indicia, a network dependency group comprising a plurality of network components hierarchically associated with the one or more components;

receive, from a database, a time series of performance data values corresponding to the network dependency group, wherein the time series comprises performance data values from before and after onset of the fault state;

identify altered performance data values in the time series comprising values which differ before and after onset of the fault state;

correlate the altered performance data values with one or more components within the network dependency group; and

determine a root cause of the fault state.

11. The apparatus as in claim 10, wherein the process when executed is further operable to:

identify, based on the root cause of the fault state, one or more affected nodes which need to respond to the fault; and

communicate a response message to the one or more affected nodes.

12. The apparatus as in claim 11, wherein the process when executed is further operable to:

determine a response for each of the one or more affected nodes; and

include the determined response in the response message.

13. The apparatus as in claim 10, wherein the network dependency group comprises network components that are at an equivalent, or greater, level in the network component hierarchy.

14. The apparatus as in claim 10, wherein the process when executed is further operable to:

construct a matrix for one or more time-series of performance values;

optimize the matrix by robust single value decomposition (SVD); and

apply a multiscale local subspace analysis to the matrix to determine the root cause.

15. The apparatus as in claim 10, wherein the multiscale local subspace analysis comprises an iterative alternating direction method for scaling the matrix.

16. The apparatus as in claim 10, wherein the time-series of performance data is based on information provided by sources selected from the group consisting of simple network management protocol management information bases (SNMP MIBs), device syslogs, and service-level statistics.

17. A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor operable to:

receive indicia of a fault state in one or more components of a computer network;

identify, based on the indicia, a network dependency group comprising a plurality of network components hierarchically associated with the one or more components;

receive, from a database, a time series of performance data values corresponding to the network dependency group, wherein the time series comprises performance data values from before and after onset of the fault state;

identify altered performance data values in the time series comprising values which differ before and after onset of the fault state;

correlate the altered performance data values with one or more components within the network dependency group; and

determine a root cause of the fault state.

18. The computer-readable media as in claim 17, wherein the software when executed is further operable to:

identify, based on the root cause of the fault state, one or more affected nodes which need to respond to the fault; and

communicate to the one or more affected nodes a response message.

19. The computer-readable media as in claim 18, wherein the software when executed is further operable to:

determine a response for each of the one or more affected nodes; and

include the determined response in the response message.

20. The computer-readable media as in claim 17, wherein the software when executed is further operable to:

construct a matrix for one or more time-series of performance values;

optimize the matrix by robust single value decomposition (SVD); and

apply a multiscale local subspace analysis to the matrix to determine the root cause.