Performance logging using relative differentials and skip recording

• US 7,924,884 B2
• Filed: 12/20/2005
• Issued: 04/12/2011
• Est. Priority Date: 12/20/2005
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Kailash, Kailash, Annamalaisami, Saravanakumar
• Primary Examiner(s): Moe; Aung S
• Assistant Examiner(s): Louis; Vinncelas
• Application Number:
  US11/312,816
• Publication Number:
  US 20070140301A1
• Time in Patent Office: 1,939 Days
• Field of Search: 370/252, 370/253, 370401-402, 370/473, 370/509, 370/395.72, 370/412, 702/187, 714/746, 707/104.1, 707/3, 707/201, 709/220, 709/224, 709/202, 709/219, 379/32.01
• US Class Current: 370/498
• CPC Class Codes: H04L 43/024 by adaptive sampling

Abstract

The present invention is directed towards “skip” and “differential” recording techniques for recording values of network parameter to a log in a lossless manner while reducing storage resources used to record such values. The counter monitor of the present invention monitors and records values of counters at time intervals to generate a counter log provided via temporary or permanent storage. The counter monitor compares a reading of the value of the counter to a previously obtained value of the counter. If the value of the counter has not changed, the counter monitor records only the timestamp to the counter log, thereby “skipping” the recording of the unchanged value. If there is any change in the value of the counter, then the change in value of the counter, i.e., a “differential” value, along with the timestamp is stored in the counters log. To further reduce storage resource usage, the counter monitor also stores changes to the timestamps as differential changes in time values.

Claims

1. A method of monitoring network traffic, the method comprising the steps of:

(a) obtaining, by a counter monitor at a first timestamp of a timer of the counter monitor, a first reading of a value of a counter representing information related to network traffic;

(b) storing, by the counter monitor, the value of the first reading in association with the first timestamp of the timer to a storage unit providing a record of counter values over a time period;

(c) obtaining, by the counter monitor, at a second timestamp of the timer subsequent to the first timestamp, a second reading of the value of the counter;

(d) comparing the value of the counter at the second reading to the value of the counter at the first reading; and

(e) if the value of the counter is unchanged, storing the second timestamp of the timer to the storage unit without storing the value of the counter at the second reading, such that the stored second timestamp has no corresponding counter value in the record of counter values over the time period.

2. The method of claim 1, comprising storing the second timestamp of the timer and a second value representing a difference between the second reading and the first reading to the storage unit if the value of the counter has changed.

3. The method of claim 1, comprising storing the second timestamp of the timer as a value representing a difference in time between the first timestamp and the second timestamp.

4. The method of claim 1, providing one of the first timestamp or the second timestamp via a second counter comprising a timer.

5. The method of claim 1, comprising identifying, by a user, the counter in the network desired to be monitored.

6. The method of claim 1, wherein the value of the counter comprises one of a single value or multiple values.

7. The method of claim 1, comprising assigning a unique numeric identifier to the counter.

8. The method of claim 1, wherein the value of the counter represents one or more of the following parameters:

a bit rate, a MAC address, a source address, a destination address, a number of frames transmitted, a number of collisions, traffic delay data, data on packets dropped, data on frames per second, a frequency of occurrence of a particular protocol, an application level statistic and a metric used for network monitoring.

9. The method of claim 1, comprising executing the counter monitor in one of a bridge, a router, a switch, a load-balancer, a server, or a network interface card.

10. The method of claim 1, comprising setting a time interval between the first timestamp and the second timestamp of the timer at one of an equal or a variable time interval.

11. The method of claim 10, comprising setting the time interval based on one or more characteristics of the network traffic.

12. The method of claim 10, comprising setting the time interval to a rate of packet queuing in the network.

13. The method of claim 1, comprising processing a stored value of the counter in the storage unit, and storing the processed value in the storage unit in association with the counter.

14. The method of claim 1, further comprising the steps of:

(f) reading, by a counter processor, the record of counter values over the time period stored to the storage unit;

(g) identifying, by the counter processor, that the second timestamp is stored in the record without a corresponding value of the counter at the second reading;

(h) determining, by the counter processor and responsive to the identification, that the value of the counter did not change from the time of the first timestamp to the time of the second timestamp of the timer.

32. The method of claim 1, comprising generating the first timestamp on an initial value of the timer, and generating the second timestamp on the next incremented value of the timer.

15. An apparatus for recording values of monitored counters, the apparatus comprising:

a storage for storing a record of values over a time period for a counter representing information related to network traffic;

a timer;

a counter monitor for monitoring a value of the counter, the counter monitor obtaining at a first timestamp of the timer a first reading of the value of the counter, and at a second timestamp of the timer subsequent to the first timestamp, a second reading of the value of the counter;

the counter monitor storing the value of the first reading in association with the first timestamp to the storage;

a comparator for comparing the first reading of the value of the counter to the second reading of the value of the counter, and if the value of the counter is unchanged, storing by the counter monitor the second timestamp of the timer to the storage unit without storing the value of the counter at the second reading, such that the stored second timestamp has no corresponding counter value in the record of counter values over the time period.

16. The apparatus of claim 15, wherein the counter monitor stores the second timestamp of the timer and a second value representing a difference between the second reading and the first reading to the storage if the value of the counter has changed.

17. The apparatus of claim 15, comprising a controller for coordinating a timing sequence of timestamps and recording of the values.

18. The apparatus of claim 17, comprising a read only memory for storing one or more algorithms executed by the controller.

19. The apparatus of claim 15, wherein the network comprises one of the following:

a point to point network, a broadcast network, a wide area network, a local area network, a telecommunications network, a data communication network, a computer network, an ATM network, a SONET network, a SDH network, a wireless network and a wireline network.

20. The apparatus of claim 15, wherein the apparatus is located in one or more of the following locations in the network:

a load balancer, a bridge, a router, a switch, a server, or a network interface card.

21. The apparatus of claim 15, wherein the storage resides external to the apparatus and in one of a same or different network as the apparatus.

22. The apparatus of claim 15, wherein the counter monitor comprises a multiplexer, wherein the multiplexer multiplexes the values from multiple counters and sends aggregated values to the comparator.

23. The apparatus of claim 15, wherein the counter comprises one of a sequential counter or a non-sequential counter.

24. The apparatus of claim 15, wherein the timer provided a time interval between the first timestamp and the second timestamp of the timer at one of an equal or a variable time interval.

25. The apparatus of claim 24, wherein the time interval is set based on one or more characteristics of the network traffic.

26. The apparatus of claim 15, wherein the time interval is set to a rate of packet queuing in the network.

27. The apparatus of claim 15, wherein the counter monitor stores the second timestamp of the timer as a value representing a difference in time between the first timestamp and the second timestamp.

28. The apparatus of claim 15, wherein the value of the counter comprises one of a single value or multiple values.

29. The apparatus of claim 15, wherein the counter monitor assigns a unique numeric identifier to the counter.

30. The apparatus of claim 15, wherein the value of the counter represents one or more of the following parameters:

a bit rate, a MAC address, a source address, a destination address, a number of frames transmitted, a number of collisions, traffic delay data, data on packets dropped, data on frames per second, a frequency of occurrence of a particular protocol, an application level statistic and a metric used for network monitoring.

31. The apparatus of claim 15, comprising a processing circuit for processing a stored value of the counter in the storage unit.

33. A method of monitoring network traffic, the method comprising the steps of:

(a) obtaining, by a counter monitor at a first timestamp of a timer of the counter monitor, a first reading of a value of a counter representing information related to network traffic;

(b) storing to a storage unit, by the counter monitor, the value of the first reading with the first timestamp of the timer to a list of entries, the list of entries providing a record of timestamps of the timer and corresponding counter values over a time period;

(c) obtaining, by the counter monitor, at a subsequent timestamp of the timer, a second reading of the value of the counter;

(d) comparing the value of the counter at the second reading to the value of the counter at the first reading; and

(e) if the value of the counter is unchanged, storing the subsequent timestamp of the timer to the list of entries without storing the value of the counter at the second reading, such that the subsequent timestamp in the list of entries has no corresponding counter value in the list of entries.