Correlation of network alarm messages based on alarm time
First Claim
Patent Images
1. A method comprising:
- receiving, by a device and from network devices in a network, alarm messages that indicate a detection of an error condition in the network;
clustering, by the device, two or more of the alarm messages that occur within a sliding time window into a cluster of alarm messages,the sliding time window indicating a time when the two or more of the alarm messages, included in the cluster of the alarm messages, were generated;
determining, by the device, a set of circuits in the network for the cluster of alarm messages,each circuit in the set of circuits being associated with at least one alarm message in the cluster of alarm messages;
determining, by the device, an overlap of two or more circuits in the set of circuits;
identifying a potential problem in the network based on the overlap; and
outputting, by the device, an indication of the potential problem.
1 Assignment
0 Petitions
Accused Products
Abstract
Problems in a network may be diagnosed based on alarm messages received from devices in the network and based on logical circuit path information of the network. In one implementation, a device may log alarm messages, in which each of the logged alarm messages may identify a network device that generated the alarm message and each of the alarm messages are associated with a time value. The device may group the alarm messages in the log of alarm messages based on the time values of the alarm messages to obtain one or more alarm message clusters and analyze the alarm message clusters to locate potential causes of the logged alarm messages.
12 Citations
20 Claims
-
1. A method comprising:
-
receiving, by a device and from network devices in a network, alarm messages that indicate a detection of an error condition in the network; clustering, by the device, two or more of the alarm messages that occur within a sliding time window into a cluster of alarm messages, the sliding time window indicating a time when the two or more of the alarm messages, included in the cluster of the alarm messages, were generated; determining, by the device, a set of circuits in the network for the cluster of alarm messages, each circuit in the set of circuits being associated with at least one alarm message in the cluster of alarm messages; determining, by the device, an overlap of two or more circuits in the set of circuits; identifying a potential problem in the network based on the overlap; and outputting, by the device, an indication of the potential problem. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A device comprising:
-
a memory; and one or more processors to; log alarm messages, received from network devices in a network, indicating detection of an error condition in the network, the alarm messages identifying the network devices that generated the alarm messages, and the alarm messages being associated with time values, assign, based on the time values, two or more of the alarm messages that occur within a sliding time window to an alarm message cluster, analyze the two or more of the alarm messages, included in the alarm message cluster, to determine a potential cause of the alarm messages, and output the potential cause of the alarm messages. - View Dependent Claims (11, 12, 13, 14, 15, 16, 17, 18)
-
-
19. A non-transitory computer-readable storage medium containing instructions, the instructions comprising:
-
one or more instructions, executable by one or more processors, to store alarm messages that indicate an error condition detected in a network that is being monitored; one or more instructions, executable by the one or more processors, to include, in a cluster of alarm messages, two or more of the alarm messages that occur within a sliding time window, the sliding time window indicating a time during which the two or more of the alarm messages were generated; and one or more instructions, executable by the one or more processors, to determine a set of circuits for the cluster of alarm messages, each circuit in the set of circuits being associated with at least one alarm message in the cluster of alarm messages, and one or more instructions, executable by the one or more processors, to determine an overlap of two or more circuits in the set of circuits; one or more instructions, executable by the one or more processors, to identify a potential problem in the network based on the overlap; and one or more instructions, executable by the one or more processors, to output an indication of the potential problem. - View Dependent Claims (20)
-
Specification