Managing network devices based on predictions of events

• US 8,769,349 B2
• Filed: 10/17/2011
• Issued: 07/01/2014
• Est. Priority Date: 01/26/2011
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Gotesdyner, Rony, Shurtleff, Mark, Ebtekar, Ali, Bruins, Barry
• Primary Examiner(s): BONZO, BRYCE P
• Application Number:
  US13/274,926
• Publication Number:
  US 20120192016A1
• Time in Patent Office: 988 Days
• Field of Search: 714/47.3
• US Class Current: 714/47.3
• CPC Class Codes: G06F 3/1254 Automatic configuration, e.g. by driver
• CPC Class Codes: H04L 12/6418 Hybrid transport

Abstract

In an embodiment, a data processing method comprises: a computer obtaining occurrence data representing one or more performance measurements collected for a network device and associated with one or more data metrics; monitoring the occurrence data; determining one or more current trends that are reflected in the occurrence data; determining one or more predicted trends for the network device; determining, based on the predicted trends, one or more future events that are predicted to occur at the network device at a future time; determining, by applying a site policy to the one or more future events, one or more preventive actions for the network device to prevent occurrence of the one or more of the future events.

Claims

1. A computer implemented data processing method, comprising:

monitoring occurrence data, the occurrence data representing one or more performance measurements collected for a network device in a network comprising a plurality of devices, and being associated with one or more data metrics;

determining one or more current trends that are reflected in the occurrence data;

determining one or more predicted trends for the network device;

determining, based on the predicted trends, one or more future events that are predicted to occur at the network device at a future time; and

determining, by applying a site policy to the one or more future events, one or more preventive actions for the network device to prevent occurrence of the one or more of the future events;

wherein the applying a site policy comprises determining whether execution of a preventive action, from the one or more preventive actions, is nontoxic to functionalities of each device in the network and the network as a whole.

2. The method of claim 1, further comprising:

causing execution of a particular preventive action at the network device in response to obtaining approval to perform the particular preventive action from the one or more preventive actions;

determining whether the execution of the particular preventive action prevents occurrence of the particular future event;

updating a device profile associated with the network device based on the occurrence data; and

based on the occurrence data, updating the one or more data metrics.

3. The method of claim 2, wherein the device profile comprises:

the site policy;

a function description of one or more functions that the network device is configured to perform;

a role description of one or more roles that the network device is configured to perform;

a resource description of a storage capacity and a processing capacity of the network device;

a configuration description of configuration parameters and settings for the network device; and

one or more data histograms generated from the occurrence data obtained for the network device.

4. The method of claim 2, further comprising:

displaying, on a display device, a graphical user interface that depicts the one or more data histograms in one or more display panels;

in response to receiving first user input selecting a first indicator from a first display panel, determining a first request for displaying a first data histogram, and displaying the first data histogram in a histogram panel;

in response to receiving second user input selecting a second indicator from a second display panel, determining a second request for displaying the one or more current trends, the one or more predicted trends, and the one or more preventive actions, displaying the one or more current trends, the one or more predicted trends in trend panels, and displaying the one or more preventive actions in an action panel; and

in response to receiving third user input selecting a third indicator from the action panel, requesting activation of the particular preventing action from the one or more preventive actions displayed in the action panel.

5. The method of claim 1, wherein the monitoring the occurrence data comprises at least one of:

monitoring service levels for applications executed on the network device;

monitoring infrastructure of the network device to ensure delivery of communications to and from the network device;

monitoring capacity issues of the network device;

monitoring usage of the network device;

monitoring changes in traffic patterns;

monitoring configuration issues; and

monitoring violations of a service level objective.

6. The method of claim 1, wherein the site policy comprises:

one or more rules to determine deviations from a service level agreement (SLA) for the network device;

rules to determine whether the one or more current trends exceed one or more threshold values;

rules to determine whether an absolute value in a first trend from the one or more trends exceeds a first threshold value;

rules to determine whether a relative trend change in a second trend from the one or more trends exceeds a second threshold value; and

rules to determine whether trend values in a third trend from the one or more trends are consistent with historical data.

7. The method of claim 1, wherein the one or more preventive actions to be executed on the network device comprise at least one of:

modifying the device profile to collect additional performance data;

activating one or more additional data metrics to store the additional performance data for the network device;

obtaining additional information about a status of the network device;

monitoring the one or more additional data metrics to determine any potential problems in carrying on functions of the network device;

opening a service call to service the network device;

opening a device reconfiguration request to reconfigure the network device;

generating an alarm to indicate a specific problem with the network device;

issuing a notification to indicate the specific problem with the network device;

indicating one or more applications that should not be executed on the network device; and

indicating one or more components of the network device that require servicing.

8. An internetworking device, comprising:

one or more processors;

a monitoring unit coupled to the one or more processors and configured to obtain occurrence data representing one or more performance measurements collected for a network device and associated with one or more data metrics, and to monitor the occurrence data;

a trend unit configured to determine one or more current trends reflected in the one or more data histograms;

a prediction unit configured to determine one or more predicted trends for the network device, and to determine, based on the predicted trends, one or more future events that are predicted to occur at the network device at a future time; and

a preventive action unit configured to determine, by applying a site policy to the one or more future events, one or more preventive actions for the network device to prevent occurrence of the one or more of the future events;

wherein the applying a site policy comprises determining whether execution of a preventive action, from the one or more preventive actions, is nontoxic to functionalities of each device in the network and the network as a whole.

9. The apparatus of claim 8, wherein the prediction unit is further configured to perform operations comprising:

in response to obtaining approval to perform a particular preventive action from the one or more preventive actions, executing the particular preventive action at the network device;

determining whether the execution of the particular preventive action prevents occurrence of the particular future event;

updating a device profile associated with the network device based on the occurrence data; and

based on the occurrence data, updating the one or more data metrics.

10. The apparatus of claim 9, wherein the device profile comprises:

the site policy;

a function description of one or more functions that the network device is configured to perform;

a role description of one or more roles that the network device is configured to perform;

a resource description of a storage capacity and a processing capacity of the network device;

a configuration description of configuration parameters and settings for the network device; and

one or more data histograms generated from the occurrence data obtained for the network device.

11. The apparatus of claim 9, further comprising a user interface unit configured to perform operations comprising:

displaying a graphical user interface that depicts the one or more data histograms in one or more display panels;

in response to receiving a first user input selecting a first indicator from a first display panel, determining a first request for displaying a first data histogram, and displaying the first data histogram in a histogram panel;

in response to receiving second user input selecting a second indicator from a second display panel, determining a second request for displaying the one or more current trends, the one or more predicted trends, and the one or more preventive actions, displaying the one or more current trends, the one or more predicted trends in trend panels, and displaying the one or more preventive actions in an action panel; and

in response to receiving third user input selecting a third indicator from the action panel, requesting activation of the particular preventing action from the one or more preventive actions displayed in the action panel.

12. The apparatus of claim 8, wherein the monitoring unit monitors the occurrence data in operations comprising at least one of:

monitoring service levels for applications executed on the network device;

monitoring infrastructure of the network device to ensure delivery of communications to and from the network device;

monitoring capacity issues of the network device;

monitoring usage of the network device;

monitoring changes in traffic patterns;

monitoring configuration issues; and

monitoring violations of a service level objective.

13. The apparatus of claim 8, wherein the site policy comprises:

one or more rules to determine deviations from a service level agreement (SLA) for the network device;

rules to determine whether the one or more current trends exceed one or more threshold values;

rules to determine whether an absolute value in a first trend from the one or more trends exceeds a first threshold value;

rules to determine whether a relative trend change in a second trend from the one or more trends exceeds a second threshold value; and

rules to determine whether trend values in a third trend from the one or more trends are consistent with historical data.

14. The apparatus of claim 8, wherein the one or more preventive actions to be executed on the network device comprise at least one of:

modifying the device profile to collect additional performance data;

activating one or more additional data metrics to store the additional performance data for the network device;

obtaining additional information about a status of the network device;

monitoring the one or more additional data metrics to determine any potential problems in carrying on functions of the network device;

opening a service call to service the network device;

opening a device reconfiguration request to reconfigure the network device;

generating an alarm to indicate a specific problem with the network device;

issuing a notification to indicate the specific problem with the network device;

indicating one or more applications that should not be executed on the network device; and

indicating one or more components of the network device that require servicing.

15. A non-transitory computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, cause the one or more processors to perform operations comprising:

obtaining occurrence data representing one or more performance measurements collected for a network device and associated with one or more data metrics;

monitoring the occurrence data;

determining one or more current trends that are reflected in the occurrence data;

determining one or more predicted trends for the network device;

determining, based on the predicted trends, one or more future events that are predicted to occur at the network device at a future time; and

determining, by applying a site policy to the one or more future events, one or more preventive actions for the network device to prevent occurrence of the one or more of the future events;

wherein the operations that cause applying a site policy comprise additional operations that cause determining whether execution of a preventive action, from the one or more preventive actions, is nontoxic to functionalities of each device in the network and the network as a whole.

16. The non-transitory computer-readable storage medium of claim 15, further storing instructions which, when executed, cause the one or more processors to perform operations comprising:

executing a particular preventive action at the network device in response to obtaining approval to perform the particular preventive action from the one or more preventive actions;

determining whether the execution of the particular preventive action prevents occurrence of the particular future event;

updating a device profile associated with the network device based on the occurrence data; and

based on the occurrence data, updating the one or more data metrics.

17. The non-transitory computer-readable storage medium of claim 16, wherein the device profile comprises at least one of:

the site policy;

a function description of one or more functions that the network device is configured to perform;

a role description of one or more roles that the network device is configured to perform;

a resource description of a storage capacity and a processing capacity of the network device;

a configuration description of configuration parameters and settings for the network device; and

one or more data histograms generated from the occurrence data obtained for the network device.

18. The non-transitory computer-readable storage medium of claim 15, wherein monitoring the occurrence data comprises at least one of:

monitoring service levels for applications executed on the network device;

monitoring infrastructure of the network device to ensure delivery of communications to and from the network device;

monitoring capacity issues of the network device;

monitoring usage of the network device;

monitoring changes in traffic patterns;

monitoring configuration issues; and

monitoring violations of a service level objective.

19. The non-transitory computer-readable storage medium of claim 15, wherein the site policy comprises at least one of:

rules to determine deviations from a service level agreement (SLA) for the network device;

rules to determine whether the one or more current trends exceed one or more threshold values;

rules to determine whether an absolute value in a first trend from the one or more trends exceeds a first threshold value;

rules to determine whether a relative trend change in a second trend from the one or more trends exceeds a second threshold value; and

rules to determine whether trend values in a third trend from the one or more trends are consistent with historical data.

20. The non-transitory computer-readable storage medium of claim 15, further storing instructions which, when executed, cause the one or more processors to perform operations comprising:

displaying a graphical user interface that depicts the one or more data histograms in one or more display panels;

receiving a first request for network management information, the first request identifying at least one of a user, a user device, or a user application; and

in response to the first request, displaying network management information on a graphical user interface (GUI) at the user interface device, the network management information including a first data histogram in a histogram panel.

21. The non-transitory computer-readable storage medium of claim 20, further storing instructions which, when executed, cause the one or more processors to perform operations comprising:

receiving a second request for the network management information, the second request identifying at least one of the user, the user device, or the user application; and

in response to the second request, displaying the network management information on the GUI at the user interface device, the network management information including one or more of;

the one or more current trends, the one or more predicted trends, and the one or more preventive actions.