Network event processing and prioritization

• US 9,350,601 B2
• Filed: 06/21/2013
• Issued: 05/24/2016
• Est. Priority Date: 06/21/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Jain, Navendu
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US13/924,452
• Publication Number:
  US 20140379895A1
• Time in Patent Office: 1,068 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/2025 using centralised failover control functionality
• CPC Class Codes: H04L 41/0609 based on severity or priority
• CPC Class Codes: H04L 41/0654 using network fault recovery ring fault isolation or reconfiguration in loop networks without recovery actions by a network management system H04L12/437
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

The described implementations relate to processing of electronic data. One implementation is manifest as a system that can include an event analysis component and one or more processing devices configured to execute the event analysis component. The event analysis component can be configured to obtain multiple events that are generated by network devices in a networking environment. The event analysis component can also be configured to identify impactful events from the multiple events. The impactful events can have associated device-level or link-level impacts. The event analysis component can also be configured to determine one or more failure metrics for an individual impactful event. The one or more failure metrics can include at least a first redundancy-related failure metric associated with redundant failovers in the networking environment.

Claims

1. One or more computer-readable storage devices storing instructions which, when executed by one or more processing devices, cause the one or more processing devices to perform acts comprising:

obtaining multiple events that are generated by network devices in a networking environment;

processing the multiple events to identify a subset of impactful events from the multiple events, the subset of impactful events having associated device-level or link-level impacts of traffic loss or latency inflation;

determining a device-level or link-level failure metric for individual impactful events in the identified subset of impactful events, the device-level or link-level failure metric being determined based on the traffic loss or latency inflation associated with the individual impactful events;

determining a redundancy-related failure metric for the individual impactful events, the redundancy-related failure metric being associated with individual network devices or links in the networking environment that are configured to perform redundant failovers; and

prioritizing the individual impactful events according to at least the device-level or link-level failure metric and the redundancy-related failure metric.

2. The one or more computer-readable storage devices of claim 1, the acts further comprising determining a data center failover metric for the individual impactful events that indicates whether a successful failover of an application occurs within a redundant group of data centers that host the application.

3. The one or more computer-readable storage devices of claim 2, the acts further comprising determining the data center failover metric by comparing aggregate application traffic loss across the redundant group of data centers before and after the individual impactful events.

4. The one or more computer-readable storage devices of claim 1, the acts further comprising determining a functional failure metric for the individual impactful events, the functional failure metric indicating whether the individual impactful events are associated with security threats or traffic rule violations in the networking environment.

5. The one or more computer-readable storage devices of claim 1, the acts further comprising generating a visualization that conveys, for a first one of the individual impactful events that was generated by a first network device, multiple other network devices that are directly connected to the first network device.

6. A system comprising:

an event analysis component configured to;

obtain multiple events that are generated by network devices in a networking environment,

identify impactful events from the multiple events, the impactful events having associated device-level or link-level impacts, and

determine one or more failure metrics for an individual impactful event, the one or more failure metrics including at least a first redundancy-related failure metric associated with redundant failovers in the networking environment, and

one or more processing devices configured to execute the event analysis component.

7. The system of claim 6, wherein the one or more failure metrics include a first device-level or link-level metric reflecting traffic loss or latency inflation associated with the individual impactful event.

8. The system of claim 7, wherein the first redundancy-related failure metric indicates whether a failover attempt within a redundant group of network devices or links is successful at handling the individual impactful event.

9. The system of claim 8, wherein the first device-level or link-level metric quantifies the traffic loss associated with the individual impactful event across an individual network device or individual link within the redundant group.

10. The system of claim 9, wherein the one or more failure metrics include a second device-level or link-level metric that quantifies the latency inflation associated with the individual impactful event for the individual network device.

11. The system of claim 10, wherein the one or more failure metrics include a second redundancy-related failure metric indicating whether the redundant group is at risk of an unsuccessful subsequent failover attempt.

12. The system of claim 11, wherein the second redundancy-related failure metric indicates whether another network device or another link within the redundant group is operating as a single point of failure.

13. A method implemented by at least one computing device, the method comprising:

obtaining multiple events that are generated by network devices in a networking environment;

identifying individual impactful events from the multiple events based on associated impacts to the networking environment or applications or services hosted thereon; and

prioritizing the individual impactful events using one or more policies having one or more criteria.

14. The method of claim 13, wherein the impacts to the networking environment include impacts on hardware performance of individual network devices or impacts caused by configuration changes in the networking environment.

15. The method of claim 13, wherein the one or more criteria include a first redundancy-related criterion relating to whether the redundant failover is successful.

16. The method of claim 15, wherein the impactful events are prioritized using the first redundancy-related criterion such that individual impactful events having unsuccessful failovers are prioritized above other individual impactful events having successful failovers.

17. The method of claim 13, wherein the one or more criteria include a hierarchy level criterion relating to levels of a networking environment hierarchy at which the individual impactful events occur or an affected application or service criterion relating to one or more of the applications or the services that are potentially affected by the individual impactful events.

18. The method of claim 17, wherein the impactful events are prioritized using the hierarchy level criterion such that individual impactful events closer to a root of the networking environment hierarchy are prioritized above other individual impactful events further away from the root of the networking environment hierarchy.

19. The method of claim 13, wherein the first redundancy-related criterion relates to whether a redundancy group is at risk of an unsuccessful failover.

20. The method of claim 19, wherein an individual policy specifies prioritizing the impactful events according to the first redundancy-related criterion such that individual impactful events associated with redundancy groups that are at risk for unsuccessful failovers are prioritized above other individual impactful events for other redundancy groups that are not at risk of unsuccessful failovers.