Centralized resource usage visualization service for large-scale network topologies

• US 9,674,042 B2
• Filed: 11/25/2013
• Issued: 06/06/2017
• Est. Priority Date: 11/25/2013
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Lissack, Avichai Mendle
• Primary Examiner(s): Mejia, Anthony
• Application Number:
  US14/089,230
• Publication Number:
  US 20150149611A1
• Time in Patent Office: 1,289 Days
• Field of Search: 709224
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/5083 Techniques for rebalancing the load in a distributed system
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0896 Bandwidth or capacity management, i.e. automatically increasing or decreasing capacities flow or congestion control using dynamic resource allocation, e.g. in-call renegotiation, H04L47/76
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00

Abstract

Methods and apparatus for supporting customer-directed networking limits in distributed systems are disclosed. A client request is received via a programmatic interface, indicating a particular lower resource usage limit to be imposed on at least one category of network traffic at a particular instance of a network-accessible service. Resource usage metrics for one or more categories of network traffic at the particular instance are obtained. In response to a determination that resource usage at the particular instance has reached a threshold level, one or more responsive actions are initiated.

Claims

1. A system, comprising:

one or more computing devices configured to;

obtain metrics from a plurality of sources, including network traffic metrics collected from a set of nodes implementing at least one multi-tenant network-accessible service accessible to a plurality of client accounts of a provider network;

determine a network topology indicative of at least (a) a relationship between a first client account to which a first node of the set of nodes is assigned and a second client account to which a second node of the set of nodes is assigned, and (b) one or more network links between the first node assigned to the first client account and the second node assigned to the second client account;

generate, based at least on the collected network traffic metrics, a representation of a plurality of networking performance indicators of the network topology, comprising respective networking performance indicators for network traffic of the first node assigned to the first client account and network traffic of the second node assigned to the first client account; and

provide the respective networking performance indicators of the network traffic of the first node assigned to the first client account and the network traffic of the second node assigned to the second client account for inclusion in a customizable resource heat map displayed in response to a request received via a programmatic interface.

2. The system as recited in claim 1, wherein the networking performance indicator of the first node comprises an indication of a ratio between a measured network traffic rate at the first node and a bandwidth limit determined for the first node by a networking configuration server configured for the multi-tenant network-accessible service.

3. The system as recited in claim 1, wherein the request comprises an indication of a traffic filtering criterion, in accordance with which the networking performance indicator of the first node is determined for a particular category of a plurality of categories of network traffic at the first node, wherein the particular category differs from another category of the plurality of categories in at least one of:

(a) an endpoint address, (b) a client account associated with an endpoint address, or (c) an application on behalf of which the network traffic is generated.

4. The system as recited in claim 1, wherein the one or more computing devices are further configured to:

receive an indication of a selected granularity for one or more metrics to be displayed in the customizable resource heat map, comprising one of;

(a) a port-level granularity, (b) a network-interface level granularity, (c) a virtual machine level granularity, (d) a host-level granularity, (e) a rack-level granularity, (f) a data center room-level granularity, (g) a data-center level granularity, (h) an availability container-level granularity, or (i) a geographical region level granularity; and

aggregate, based at least in part on the selected granularity, the one or more collected metrics for inclusion in the customizable heat map.

5. The system as recited in claim 1, wherein in response to the request received via the programmatic interface, the one or more computing devices are further configured to:

obtain an authorization setting of a submitter of the request;

select, based at least in part on the authorization setting, a subset of collected resource metrics to be represented in the customizable resource heat map.

6. A method, comprising:

performing, by one or more computing devices;

obtaining metrics from a plurality of sources of a provider network, including network traffic metrics collected from a set of nodes implementing a network-accessible service on behalf of one or more client accounts of the provider network;

generating a network topology representing one or more relationships between a first node of the set of nodes that is assigned to a first client account and a second node of the set of nodes that is assigned to a second client account; and

providing respective networking performance indicators for network traffic of the first node assigned to the first client account and network traffic of the second node assigned to the second client account to be included in a resource heat map corresponding to the network topology, wherein the respective networking performance indicators are derived at least in part from a portion of the network traffic metrics.

7. The method as recited in claim 6, wherein the networking performance indicator of the first node comprises an indication of a ratio between a measured network traffic rate at the first node and a bandwidth limit set for the first node.

8. The method as recited in claim 6, wherein the resource heat map comprises one of:

(a) a processor performance indicator of the first node, or (b) a storage performance indicator of the first node, or (c) a memory performance indicator of the first nodes.

9. The method as recited in claim 6, wherein the networking performance indicator of the first node comprises an indication of a ratio between a measured network latency and an upper bound on network latency for traffic associated with the first node.

10. The method as recited in claim 6, wherein the resource heat map is generated in response to a request, wherein the request comprises an indication of a traffic filtering criterion in accordance with which the networking performance indicator of the first node is determined for a particular category of a plurality of categories of network traffic at the first node, wherein the particular category differs from another category of the plurality of categories in at least one of:

(a) an endpoint address, (b) a client account associated with an endpoint address, or (c) an application on behalf of which the network traffic is generated.

11. The method as recited in claim 10, further comprising performing, by the one or more computing devices:

implementing a different programmatic interface enabling a client to define one or more categories of network traffic; and

receiving, via the different programmatic interface, a definition of the particular category.

12. The method as recited in claim 6, further comprising performing, by the one or more computing devices:

receiving an indication of a selected granularity for one or more metrics to be displayed via the resource heat map, comprising one of;

(a) a port-level granularity, (b) a network-interface level granularity, (c) a virtual machine level granularity, (d) a host-level granularity, (e) a rack-level granularity, (f) a data center room-level granularity, (g) a data-center level granularity, (h) an availability container-level granularity, or (i) a geographical region level granularity; and

aggregating, based at least in part on the selected granularity, the one or more metrics for inclusion in the resource heat map.

13. The method as recited in claim 6, further comprising performing, by the one or more computing devices:

receiving an indication of a selected collection time period for one or more metrics to be displayed via the resource heat map; and

aggregating, based at least in part on the selected collection time period, the one or more metrics for inclusion in the resource heat map.

14. The method as recited in claim 6, wherein the plurality of sources comprise one or more of:

(a) a network interface card, (b) a networking component of a virtualization software stack installed at a virtualization host, (c) a networking component of a compute instance of a virtualized computing service, (d) a network tap device, (e) a switch, (f) a router, (g) a gateway, or (h) a load balancer.

15. The method as recited in claim 6, wherein the network-accessible service comprises one of:

(a) a virtual computing service, (b) a storage service, or (c) a database service.

16. A non-transitory computer-accessible storage medium storing program instructions that when executed on one or more processors:

obtain metrics from a plurality of sources, including network traffic metrics collected from a set of nodes implementing at least one network-accessible service on behalf of a plurality of client accounts;

generate a network topology representing at least one of (a) a relationship between a first client account to which a first node of the set of nodes is assigned and a second client account to which a second node of the set of nodes is assigned, or (b) one or more network links between the first node assigned to the first client account and the second node assigned to the second client account; and

provide respective networking performance indicators for network traffic of the first node assigned to the first client account and network traffic of the second node assigned to the second client account for inclusion in a resource heat map corresponding to the network topology wherein the respective performance indicators are derived at least in part from a portion of the network traffic metrics.

17. The non-transitory computer-accessible storage medium as recited in claim 16, wherein the networking performance indicator of the first node comprises an indication of a ratio between a measured network traffic rate at the first node and a bandwidth limit set for the first node.

18. The non-transitory computer-accessible storage medium as recited in claim 16, wherein the instructions when executed on the one or more processors:

receive an indication of a traffic filtering criterion, in accordance with which the networking performance indicator of the first node is determined for a particular category of a plurality of categories of network traffic at the first node, wherein the particular category differs from another category of the plurality of categories in at least one of;

(a) an endpoint address, (b) a client account associated with an endpoint address, or (c) an application on behalf of which the network traffic is generated.

19. The non-transitory computer-accessible storage medium as recited in claim 16, wherein the instructions when executed on the one or more processors:

receive an indication of a selected granularity for one or more metrics to be displayed via the resource heat map, comprising one of;

(a) a port-level granularity, (b) a network-interface level granularity, (c) a virtual machine level granularity, (d) a host-level granularity, (e) a rack-level granularity, (f) a data center room-level granularity, (g) a data-center level granularity, (h) an availability container-level granularity, or (i) a geographical region level granularity; and

aggregate, based at least in part on the selected granularity, the one or more metrics for inclusion in the resource heat map.

20. The non-transitory computer-accessible storage medium as recited in claim 16, wherein the instructions when executed on the one or more processors:

implement a programmatic interface enabling a client of the network-accessible service to request at least a subset of the metrics;

receive a metric request from a particular client via the programmatic interface;

and in response to a determination that the particular client is authorized to obtain one or more metrics indicated in the metric request, provide the one or more metrics to the particular client.