Method, computer product and system for correlating events in a network

• US 7,965,620 B2
• Filed: 05/25/2004
• Issued: 06/21/2011
• Est. Priority Date: 05/25/2004
• Status: Active Grant

• Current Assignee: Nytell Software LLC (Intellectual Ventures LLC)
• Original Assignee: Telcordia Licensing Co LLC (Telefonaktiebolaget LM Ericsson)
• Inventors: Natarajan, Narayanan, Gadgil, Shrirang
• Primary Examiner(s): Vu; Huy D
• Assistant Examiner(s): Hailu; Kibrom T
• Application Number:
  US10/853,083
• Publication Number:
  US 20050276217A1
• Time in Patent Office: 2,583 Days
• Field of Search: 370/216, 370/242, 370/248, 370/335, 370/356, 370/409, 370/389, 370/406, 370/392, 709/239, 709/242, 709/221, 709/226
• US Class Current: 370/216
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0233 Object-oriented techniques, for representation of network management data, e.g. common object request broker architecture [CORBA]
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/22 Alternate routing
• CPC Class Codes: H04L 45/28 using route fault recovery

Abstract

In one aspect a method for correlating network events in a network comprises correlating the events relating to paths with events relating to links traversed by paths. In another aspect, the method includes correlating the events based on whether paths traversing the network share network resources, such as links. Preferably, the method is implemented in a network where paths traversing the network change dynamically in response to other network events and based on traffic engineering priorities.

Claims

1. A method for determining a root cause of event messages on a network, the method comprising:

receiving a first plurality of event message from the network, the first event message being associated with a service path through the network and representative of a change in status in the network;

analyzing parameters of the first event message to determine if a first event associated with the first event message correlates to a second event;

examining a field of the first event message to determine if the field is set to one of label switch path (LSP) down, LSP reroute, and LSP up;

if the first event associated with the first event message correlates to the second event, assigning an impact level to the correlation between the first event and the second event, wherein the impact level assigned is one of a plurality of primary impact levels or one of a plurality of secondary impact levels; and

if the first event associated with the first event message does not correlate to the second event, storing the first event message as an uncorrelated event.

2. The method of claim 1, wherein the process of analyzing includes determining whether the first event message was caused by a status change on a service path.

3. The method of claim 1, wherein the process of analyzing step of correlating includes determining whether the service path associated with the first event message shares a link with a second service path associated with the second event.

4. The method of claim 1, further comprising determining if the first event associated with the first event message is a link event.

5. The method of claim 1, wherein the network is a generalized multiprotocol label switching optical network.

6. The method of claim 1, wherein the process of analyzing parameters of the first event message to determine if the first event associated with the first event message correlates to the second event comprises determining if a field of the first event message matches an entry in a list associated with the second event.

7. The method of claim 1, wherein each of the plurality of primary impact levels is associated with a LSP down event type, a LSP reroute event type, or a LSP up event type.

8. The method of claim 1, wherein each of the plurality of secondary impact levels is associated with a LSP down event type, a LSP reroute event type, or a LSP up event type.

9. The method of claim 1, further comprising representing the first event in the form of a directed acyclic graph including indicating whether the first event is caused by a change of status of a service path.

10. The method of claim 1, wherein the analyzing is based at least in part on a correlation matrix, and wherein the correlation matrix comprises a data structure that identifies impacts on the service path that are caused by a plurality of predetermined events.

11. The method of claim 1, wherein the primary impact level indicates that an event is a direct consequence of a network resource state change.

12. The method of claim 1, wherein the secondary impact indicates that an event is an indirect consequence of a network status change.

13. A method for monitoring a status of a network, the method comprising:

receiving a plurality of event traps from the network, wherein at least two event traps of the plurality of event traps are consequences of a network status change;

tracking information relating to the current route of service paths through the network, wherein at least one of said service paths is affected by said network status change;

analyzing parameters of the at least two event traps of the plurality of event traps to determine if a first event trap of the at least two event traps is caused by a second event trap of the at least two event traps;

examining a field of the first event trap message to determine if the field is set to one of label switch path (LSP) down, LSP reroute, and LSP up;

if the first event trap of the at least two event traps is caused by the second event trap of the at least two event traps, assigning an impact level, wherein the impact level assigned is one of a plurality of primary impact levels or one of a plurality of secondary impact levels; and

if the first event trap of the at least two event traps is not caused by the second event trap of the at least two event traps, storing the first event trap as an uncorrelated event.

14. The method of claim 13, further comprising representing the traps in the form of a directed acyclic graph including indicating whether the first event trap is caused by a change of status of said at least one of said service paths.

15. The method of claim 13, wherein the tracked route information includes an association between a label switched path traversing the network and a link in the path.

16. The method of claim 13, wherein the process of analyzing includes associating an event trap with a path if the path traverses the link on which the network link failure event was detected.

17. A system for monitoring a status of a network, the system comprising:

an interface;

a computing device; and

a computer-readable medium including instructions which, when executed, cause the computing device to perform the following operations;

associating routes of paths traversing the network with links between devices in the network;

receiving, via the interface, a plurality of network event traps from the network, wherein at least two of said network event traps are consequences of a change in the status of the paths or links on the network;

analyzing parameters of the at least two event traps of the plurality of network event traps to determine if a first network event trap is caused by a second network event trap;

examining a field of the first event trap to determine if the field is set to one of label switch path (LSP) down, LSP reroute, and LSP up;

if the first network event trap is caused by the second network event trap, assigning an impact level, wherein the impact level assigned is one of a plurality of primary impact levels or one of a plurality of secondary impact levels; and

if the first network event trap is not caused by the second event trap, storing the first network event trap as an uncorrelated event.

18. The system of claim 17, wherein the network is a multiprotocol label switching network.

19. The system of claim 17, wherein the route information includes one or more label switched paths in a multiprotocol label switching network.

20. The system of claim 19, wherein the multiprotocol label switching network is an internet protocol network.

21. The system of claim 19, wherein the multiprotocol label switching network is a generalized multiprotocol label switching optical network.

22. The system of claim 17, wherein the network event traps are in the form of Simple Network Management Protocol traps.

23. A tangible computer-readable medium having instructions stored thereon, the instructions comprising:

instructions for receiving a first of event message from the network, the first event message being associated with a service path through the network and representative of a change in status in the network;

instructions for analyzing parameters of the first event message to determine if a first event associated with the first event message correlates to a second event;

instructions for examining a field of the first event message to determine if the field is set to one of label switch path (LSP) down, LSP reroute, and LSP up;

instructions for, if the first event associated with the first event message correlates to the second event, assigning an impact level to the correlation between the first event and the second event, wherein the impact level assigned is one of a plurality of primary impact levels or one of a plurality of secondary impact levels; and

instructions for, if the first event associated with the first event message does not correlate to the second event, storing the first event message as an uncorrelated event.

24. The tangible computer-readable medium of claim 23, wherein the instructions for analyzing include instructions for determining whether the first event message was caused by a status change on a service path.

25. The tangible computer-readable medium of claim 23, wherein the instructions for analyzing include instructions for determining whether the service path associated with the first event message shares a link with a second service path associated with the second event.

26. The tangible computer-readable medium of claim 23, further comprising instructions for determining if the first event associated with the first event massage is a link event.

27. The tangible computer-readable medium of claim 26, wherein the network is a generalized multiprotocol label switching optical network.

28. The tangible computer-readable medium of claim 23, wherein the instructions for analyzing parameters of the first event message to determine if the first event associated with the first event message correlates to the second event include instructions for determining if a field of the first event message matches an entry in a list associated with the second event.

29. The tangible computer-readable medium of claim 23, wherein each of the plurality of primary impact levels is associated with a LSP down event type, a LSP reroute event type, or a LSP up event type.

30. The tangible computer-readable medium of claim 23, wherein each of the plurality of secondary impact levels is associated with a LSP down event type, a LSP reroute event type, or a LSP up event type.

31. The tangible computer-readable medium of claim 23, further comprising instructions for representing the first event in the form of a directed acyclic graph including indicating whether the first event is caused by a change of status of a service path.