Non-invasive diagnosis of configuration errors in distributed system

Patent metadata

Field	Value
Publication number	US-10644947-B2
Application number	US-201816144258-A
Country	US
Kind code	B2
Filing date	Sep 27, 2018
Priority date	Sep 27, 2018
Publication date	May 5, 2020
Grant date	May 5, 2020

Abstract

Techniques for non-invasive diagnosis of configuration errors in distributed system are disclosed including obtaining data packets from a network that include inflows and outflows associated with a given component of the network. The number of inflows and the number of outflows for the given component of the network are determined based on the obtained data packets. An intersection point corresponding to a predetermined number of inflows and a predetermined number of outflows is obtained and a score for the given component is determined based on a relationship between the intersection point and the determined number of inflows and outflows for the given component. Whether the score for the given component is greater than a predetermined threshold is determined, and the given component is identified as having a configuration error in response to determining that the score for the given component is greater than a predetermined threshold.

First claim

What is claimed is:

1. A computer-implemented method, the method comprising steps of:
obtaining data packets from a network, the data packets comprising inflows and outflows associated with a given component of the network;
determining (i) the number of inflows and (ii) the number of outflows for the given component of the network based on the obtained data packets;
obtaining an intersection point corresponding to (i) a predetermined number of inflows and (ii) a predetermined number of outflows;
determining a score for the given component based on a relationship between (i) the intersection point and (ii) the determined number of inflows and outflows for the given component;
determining that the score for the given component is greater than a predetermined threshold; and
identifying the given component as having a configuration error, in response to determining that the score for the given component is greater than the predetermined threshold,
wherein the steps are carried out by at least one computing device.

2. The computer-implemented method of claim 1 , wherein the relationship is a Euclidean distance from the intersection point to a data point defined by the determined number of inflows and outflows for the given component.

3. The computer-implemented method of claim 1 , wherein the relationship is an N dimensional eigen vector from the intersection point to a data point based on (i) the determined number of inflows and outflows for the given component and (ii) at least one additional dimension.

4. The computer-implemented method of claim 1 ,
wherein the obtained data packets comprise inflows and outflows for a plurality of components of the network including the given component; and
wherein said determining (i) the number of inflows and (ii) the number of outflows for the given component of the network based on the obtained data packets comprises determining a number of inflows and a number of outflows for each component of the network based on the obtained data packets.

5. The computer-implemented method of claim 4 ,
wherein a blame value is associated with each component of the network, and wherein the method comprises:
updating the blame value associated with (i) a first component of the network and (ii) a second component of the network in response to a detection of at least one abnormal condition associated with the first component and the second component based on the obtained data packets;
determining that the updated blame value associated with at least one of the first and second components is greater than a predetermined threshold; and
identifying the at least one of the first and second components as having a configuration error in response to determining that the updated blame value associated with the at least one of the first and second components is greater than the predetermined threshold.

6. The computer-implemented method of claim 5 , wherein the blame value associated with the first component is increased in response to each detection of an abnormal condition associated with the first component.

7. The computer-implemented method of claim 5 , comprising:
detecting the at least one abnormal condition by determining, based on the obtained data packets, that data packets transmitted between the first component and the second component only flow in a single direction.

8. The computer-implemented method of claim 4 , comprising:
detecting a flow having a first duration based on the obtained data packets, the flow associated with a first component of the network;
comparing the first duration to a second duration of a prior instance of the detected flow;
determining, based on the comparison, that the first duration does not correspond to the second duration; and
identifying the first component as having a configuration error in response to determining that the first duration does not correspond to the second duration.

9. The computer-implemented method of claim 1 , comprising:
automatically triggering a corrective action for the given component in response to the identification of the given component as having a configuration error.

10. The computer-implemented method of claim 9 , wherein the corrective action comprises an update to the configuration of the given component.

11. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computing device to cause the computing device to:
obtain data packets from a network, the data packets comprising inflows and outflows associated with a given component of the network;
determine (i) the number of inflows and (ii) the number of outflows for the given component of the network based on the obtained data packets;
obtain an intersection point corresponding to (i) a predetermined number of inflows and (ii) a predetermined number of outflows;
determine a score for the given component based on a relationship between (i) the intersection point and (ii) the determined number of inflows and outflows for the given component;
determine that the score for the given component is greater than a predetermined threshold; and
identify the given component as having a configuration error in response to determining that the score for the given component is greater than the predetermined threshold.

12. The computer program product of claim 11 , wherein the relationship is a Euclidean distance from the intersection point to a data point defined by the determined number of inflows and outflows for the given component.

13. The computer program product of claim 11 , wherein the relationship is an N dimensional eigen vector from the intersection point to a data point based on (i) the determined number of inflows and outflows for the given component and (ii) at least one additional dimension.

14. The computer program product of claim 11 ,
wherein the obtained data packets comprise inflows and outflows for a plurality of components of the network including the given component; and
wherein determining (i) the number of inflows and (ii) the number of outflows for the given component of the network based on the obtained data packets comprises determining a number of inflows and a number of outflows for each component of the network based on the obtained data packets.

15. The computer program product of claim 14 ,
wherein a blame value is associated with each component of the network, and wherein the program instructions are executable by a computing device to cause the computing device to:
update the blame value associated with (i) a first component of the network and (ii) a second component of the network in response to detection of at least one abnormal condition associated with the first component and the second component based on the obtained data packets;
determine that the updated blame value associated with at least one of the first and second components is greater than a predetermined threshold; and
identify the at least one of the first and second components as having a configuration error in response to determining that the updated blame value associated with the at least one of the first and second components is greater than the predetermined threshold.

16. The computer program product of claim 15 , wherein the blame value associated with the first component is increased in response to each detection of an abnormal condition associated with the first component.

17. The computer program product of claim 15 , the program instructions further executable by a computing device to cause the comp

Assignees

• IBM

Inventors

• Goel Seep
• GU Yu
• Verma Mudit
• Viswanathan Balaji

Classifications

• H04L43/0876

  Network utilisation, e.g. volume of load or congestion level · CPC title

• H04L41/142 Primary

  using statistical or mathematical methods · CPC title

• H04L47/2441

  relying on flow classification, e.g. using integrated services [IntServ] · CPC title

• H04L41/0631

  using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis · CPC title

• G06F11/0709

  in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems · CPC title