System and method for dynamic management of network device data

• US 9,729,409 B2
• Filed: 02/26/2013
• Issued: 08/08/2017
• Est. Priority Date: 10/04/2012
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Wanser, Kelly, Antonopoulos, Andreas Markos
• Primary Examiner(s): Tiv, Backhean
• Application Number:
  US13/778,042
• Publication Number:
  US 20140101308A1
• Time in Patent Office: 1,624 Days
• Field of Search: 709224-226
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/085 Retrieval of network configuration; Tracking network configuration history
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/103 with adaptive polling, i.e. dynamically adapting the polling rate

Abstract

A method and apparatus of a device that dynamically changes how management data is managed in response to events detected in a network system is described. In an exemplary embodiment, the device detects an event occurring in the network system. The device further determines if the event triggers a system change in how the management data is reported on one or more of the managed nodes. If the event notification does trigger the system change, for each of the one or more of the managed nodes, the device determines a command for that manage node that represents a specific change in how frequent the management data is reported to the network management system. In addition, the device sends the command to that managed node, where the agent applies the command to the managed node and the applied command implements the specific change in how frequent the management data is reported to the network management system.

Claims

1. A method of managing management data communicated between a network management system and a network of a plurality of managed nodes, the method comprising:

detecting an event occurring in the network;

determining the event triggers a system change in how frequent the management data about two or more of the plurality of managed nodes is reported by the two or more of the plurality of managed nodes to the network management system, wherein the network management system is communicatively coupled to the plurality of managed nodes and manages the plurality of managed nodes; and

,

identifying the two or more of the plurality of managed nodes affected by the system change and for each of the two or more affected managed nodes,

determining, by the network management system, a command based on a rule matching that event from a set of rules for that managed node that represents a specific change in how frequent the management data is reported from that managed node to the network management system, and

sending the command from the network management system to an agent resident on that managed node, wherein the agent applies the command to that managed node and the applied command implements the specific change in how frequent the management data is reported from that managed node to the network management system.

2. The method of claim 1, wherein the detecting the event comprises:

detecting an event in a network database.

3. The method of claim 1, wherein the detecting the event comprises:

receiving an event from a user interface of the network management system.

4. The method of claim 3, wherein the event comprises an indication that a user has navigated the user interface to view one or more of the two or more of the plurality of managed nodes.

5. The method of claim 1, wherein the management data of a managed node of the two or more of the plurality of managed nodes comprises information that characterizes a functioning state of the managed node.

6. The method of claim 1, wherein the specific change comprises an increase in a reporting frequency of the management data to the network management system.

7. The method of claim 1, wherein the specific change further includes a change selected from one or more of a rate of collection of the management data by the agent, a window size of collected management data, and a rate of logging managed node information.

8. The method of claim 1, wherein a managed node of the two or more of the plurality of managed nodes comprises one or more of a network access element, a server, and storage.

9. The method of claim 8, wherein the managed node comprises a virtual managed node.

10. The method of claim 8, wherein the network element comprises a network access element, a network security device, or a device that processes networked data.

11. The method of claim 1, wherein the event triggers the system change affecting more than one of the plurality of managed nodes.

12. The method of claim 1, wherein the event is associated with a first one of the plurality of managed nodes and the specific change is associated with a second one of the plurality of managed nodes.

13. The method of claim 1, wherein the management data of a managed node of the two or more of the plurality of managed nodes comprises one or more of state information of the managed node, environment information of the managed node, and information about data being processed and flowing within the managed node.

14. A non-transitory machine-readable medium having executable instructions to cause one or more processing units to perform a method to manage management data communicated between a network management system and a network of a plurality of managed nodes, the method comprising:

detecting an event occurring in the network;

determining the event triggers a system change in a type of the management data that is collected by two or more of the plurality of managed nodes; and

identifying the two or more of the plurality of managed nodes affected by the system change and for each of the two or more affected managed nodes,

determining, by the network management system, a command based on a rule matching that event from a set of rules for that managed node that represents a specific change in the type of the management data that is collected by that managed node, and

sending the command from the network management system to an agent resident on that managed node, wherein the agent applies the command to that managed node and the applied command implements the specific change in the type of the management data that is collected by that managed node.

15. The non-transitory machine-readable medium of claim 14, wherein the detecting the event comprises:

detecting an event in a network database.

16. The non-transitory machine-readable medium of claim 14, wherein the detecting the event comprises:

receiving an event from a user interface of the network management system.

17. The non-transitory machine-readable medium of claim 16, wherein the event comprises an indication that a user has navigated the user interface to view one or more of the two or more of the plurality of managed nodes.

18. The non-transitory machine-readable medium of claim 14, wherein the management data of a managed node comprises information that characterizes a functioning state of the managed node.

19. The non-transitory machine-readable medium of claim 14, wherein the specific change further includes a change selected from one or more of a rate of collection of the management data by the agent, a window size of collected management data, and a rate of logging managed node information.

20. The non-transitory machine-readable medium of claim 14, wherein the event triggers the system change affecting more than one of the plurality of managed nodes.

21. The non-transitory machine-readable medium of claim 14, wherein the event is associated with a first one of the plurality of managed nodes and the specific change is associated with a second one of the plurality of managed nodes.

22. The non-transitory machine-readable medium of claim 14, wherein the specific change includes a turning on a collection of the type of the management data, wherein the type of management data is not currently being collected by that managed node.

23. The non-transitory machine-readable medium of claim 14, wherein the specific change includes a turning off of a collection of the type of the management data on that managed node.

24. A non-transitory machine-readable medium having executable instructions to cause one or more processing units to perform a method of managing management data communicated between a network management system and a network of a plurality of managed nodes, the method comprising:

detecting an event occurring in the network;

determining the event triggers a system change in how the management data about two or more of the plurality of managed nodes is reported by the two or more of the plurality of managed nodes to the network management system, wherein the network management system is communicatively coupled to the plurality of managed nodes and manages the plurality of managed nodes; and

identifying the two or more of the plurality of managed nodes affected by the system change and for each of the two or more affected managed nodes,

determining, by the network management system, a command based on a rule matching that event from a set of rules for that managed node that represents a specific change in how frequent the management data is reported from that managed node to the network management system, and

sending from the network management system the command to an agent resident on that managed node, wherein the agent applies the command to that managed node and the applied command implements the specific change in how frequent the management data is reported from that managed node to the network management system.

25. A system to manage management data communicated between a network management system and a network of a plurality of managed nodes, the system comprising:

the plurality of managed nodes, wherein each of the plurality of the managed nodes collects management data about that managed node and report the management data to the network management system; and

the network management system, coupled to the plurality of managed nodes, the network management system to receive the management data from the plurality of managed nodes, wherein the network management system includes,

a system analysis module to detect an event occurring in the network system, determine the event triggers a system change in the type of the management data that is collected by two or more of the plurality of managed nodes, identifying the two or more of the plurality of managed nodes affected by the system change and for each of the two or more affected managed nodes, the system analysis module further to determine a command based on a rule matching that event from a set of rules for that managed node that represents a specific change in the type of the management data that is collected by that managed node, and sends the command from the network management system to an agent resident on that managed node, wherein the agent applies the command to that managed node and the applied command implements the specific change in the type of the management data that is collected by that managed node.