NETWORK EVENT CORRELATION

• US 20200136904A1
• Filed: 10/25/2018
• Published: 04/30/2020
• Est. Priority Date: 10/25/2018
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Powell, John A., Santos, David L., Dawson, Devon L.
• Granted Patent: US 11,502,902 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/0663 Performing the actions predefined by failover planning, e.g. switching to standby network elements
• CPC Class Codes: H04L 41/0677 Localisation of faults
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events

Abstract

Examples disclosed herein relate to a method comprising collecting, by a network monitoring tool, network data from a first device on a network. The method comprises identifying, by the network monitoring tool, a potential issue from the network data, wherein the potential issue corresponds to one aspect of the network and transmitting, by the network monitoring tool, the potential issue to a network management tool. The method also comprises identifying, by the network management tool, a first network configuration that the potential issue relates to and creating, by the network management tool, a second network configuration for the network to fix the potential issue.

Claims

1. ) A method comprising:

collecting, by a network monitoring tool, network data from a first device on a network;

identifying, by the network monitoring tool, a potential issue from the network data, wherein the potential issue corresponds to one aspect of the network;

transmitting, by the network monitoring tool, the potential issue to a network management tool;

identifying, by the network management tool, a first network configuration that the potential issue relates to; and

creating, by the network management tool, a second network configuration for the network to fix the potential issue.

2. ) The method of claim 1 wherein the first network configuration is a network configuration change made to the network using the network management tool within a predetermined period of time.

3. ) The method of claim 1 wherein the potential issue corresponds to the first device on the network.

4. ) The method of claim 1 wherein the network monitoring tool is executed on the first device on the network.

5. ) The method of claim 1 wherein the network data is time series data corresponding to the first device that is stored in a time series database on the first device.

6. ) The method of claim 1 comprising:

determining that a value in the network data matches a potential issue criteria; and

collecting, from a database on the first device, second network data related to the potential issue.

7. ) The method of claim 6 comprising:

collecting, from a second database on a second device on the network, third network data related to the potential issue.

8. ) The method of claim 1 comprising:

determining, by the network management tool, a number of network configuration changes on the first device that exceed a threshold number.

9. ) The method of claim 1 comprising:

determining, by the network management tool, that more than a threshold number of configuration changes of a certain type have been made on devices in the network.

10. ) The method of claim 1 comprising:

determining, by the network management tool, that an update for the first device includes a fix for the potential issue.

11. ) A non-transitory machine-readable storage medium encoded with instructions, the instructions executable by a processor of a system to cause the system to:

collect, by a network monitoring tool, network data from a plurality of devices on a network;

determine, by the network monitoring tool, a plurality of potential issues from the network data, wherein the plurality of potential issues correspond to one aspect of the network;

transmit, by the network monitoring tool, the potential issue to a network management tool;

determine, by the networking management tool, that a subgroup of the potential issues from the plurality of potential issues are related; and

identify, by the network management tool, a plurality of network configuration changes made to the network using the network management tool that relate to the aspect of the network corresponding to the plurality of potential issues.

12. The non-transitory computer-readable storage medium of claim 11, the instructions executable by a processor of a system to cause the system to:

determine that a value in the network data matches a potential issue criteria; and

collecting, from a database on a first device, second network data related to the potential issue.

13. The non-transitory computer-readable storage medium of claim 11, the instructions executable by a processor of a system to cause the system to:

collecting, from a second database on a second device on the network, third network data related to the potential issue.

14. The non-transitory computer-readable storage medium of claim 11, the instructions executable by a processor of a system to cause the system to:

determining, by the network management tool, a number of network configuration changes on the first device that exceed a threshold number.

15. The non-transitory computer-readable storage medium of claim 11, the instructions executable by a processor of a system to cause the system to:

determining, by the network management tool, that more than a threshold number of configuration changes of a certain type have been made on devices in the network.

16. A system comprising:

a network data collector to collect, by a network monitoring tool, network data from a first device on a network;

a potential issue identifier to identify, by the network monitoring tool, a potential issue from the network data, wherein the potential issue corresponds to one aspect of the network;

a potential issue transmitter to transmit, by the network monitoring tool, the potential issue to a network management tool;

a network configuration identifier to identify, by the network management tool, a first network configuration that the potential issue relates to.

17. ) The system of claim 16 wherein the first network configuration is a network configuration change made to the network using the network management tool within a predetermined period of time.

18. ) The system of claim 16 wherein the potential issue corresponds to the first device on the network.

19. ) The system of claim 16 wherein the network monitoring tool is executed on the first device on the network.

20. ) The system of claim 16 wherein the network data is time series data corresponding to the first device that is stored in a time series database on the first device.