Log file processing for root cause analysis of a network fabric

Patent metadata

Field	Value
Publication number	US-10756949-B2
Application number	US-201715834865-A
Country	US
Kind code	B2
Filing date	Dec 7, 2017
Priority date	Dec 7, 2017
Publication date	Aug 25, 2020
Grant date	Aug 25, 2020

Abstract

The disclosed technology relates to log file processing techniques for root cause analysis of a network fabric. A system may be configured to identify a feature of interest in a log file and calculating an abnormal level for the feature of interest. The system is further configured to detect that a performance event has occurred during a time period, determine whether the feature of interest is at the abnormal level during the time period, and identify a correlation between the feature of interest and the performance event based on the determining.

First claim

The invention claimed is:

1. A computer-implemented method comprising:
receiving a number of log files from at least one network sensor distributed across a network environment;
identifying a feature of interest in the number of log files;
calculating an abnormal level for the feature of interest based on text data in the number of log files;
detecting that a performance event has occurred during a time period;
determining whether the feature of interest is at the abnormal level during the time period, wherein the abnormal level comprises a frequency value for the feature of interest or an average value for the feature of interest; and
identifying a correlation between the feature of interest and the performance event based on the determining.

2. The computer-implemented method of claim 1 , further comprising:
providing the correlation to a network administrator as a potential root cause for the performance event.

3. The computer-implemented method of claim 2 , further comprising:
transmitting the correlation to a client device associated with the network administrator.

4. The computer-implemented method of claim 1 , wherein identifying the feature of interest comprises identifying, based on configuration data, a log file from the number of log files, wherein the feature of interest is identified in the log file, and wherein the configuration data comprises at least one known location for the log file or a known file name associated with the log file.

5. The computer-implemented method of claim 1 , wherein identifying the feature of interest comprises identifying a log file from the number of log files containing the feature of interest, the method further comprising:
identifying the log file by determining that a machine accessed the log file, determining that a size of the log file has increased, and determining that the log file contains text data.

6. The computer-implemented method of claim 1 , wherein identifying the feature of interest comprises identifying a log file from the number of log files, wherein the feature of interest is identified in the log file, and wherein the log file is identified by tracking an entropy of the log file or words in the log file over a period of time the abnormal level is a frequency value for a feature of interest.

7. The computer-implemented method of claim 1 , wherein the performance event comprises a monitored metric exceeding a threshold level.

8. The computer-implemented method of claim 1 , wherein the feature of interest is identified based on a pattern, and wherein the pattern is specified by a regular expression specifying the pattern.

9. A non-transitory computer-readable medium comprising instructions which, when executed by a computing system, cause the computing system to:
identify a feature of interest in a log file, wherein the feature of interest is identified based on a pattern, and wherein the pattern is specified by a regular expression specifying the pattern;
calculate an abnormal level for the feature of interest based on text data in the log file;
detect that a performance event has occurred during a time period;
determine whether the feature of interest is at the abnormal level during the time period, wherein the abnormal level comprises a frequency value for the feature of interest or an average value for the feature of interest
identify a correlation between the feature of interest and the performance event based on the determining whether the feature of interest is at the abnormal level.

10. The non-transitory computer-readable medium of claim 9 , wherein the instructions further cause the computing system to:
receive, from a remote network sensor, the log file.

11. The non-transitory computer-readable medium of claim 9 , wherein the instructions further cause the computing system to:
provide the correlation to a remote client device associated with a network administrator as a potential root cause for the performance event.

12. The non-transitory computer-readable medium of claim 9 , wherein the instructions further cause the computing system to:
identify the log file based on configuration data comprising at least one known location for the log file or a known file name associated with the log file.

13. The non-transitory computer-readable medium of claim 9 , wherein the instructions further cause the computing system to:
identify the log file based by determining that a machine accessed the log file, determining that a size of the log file has increased, and determining that the log file contains text data.

14. A system comprising:
one or more processors; and
at least one non-transitory computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to:
receive a number of log files from one or more host entities distributed across a network environment;
identify a feature of interest in the number of log files;
calculate an abnormal level for the feature of interest based on text data in the number of log files;
detect that a performance event has occurred during a time period; and
determine whether the feature of interest is at the abnormal level during the time period, wherein the abnormal level comprises a frequency value for the feature of interest or an average value for the feature of interest; and
identify a correlation between the feature of interest and the performance event based the determining whether the feature of interest is bcing at the abnormal level during the time period.

15. The system of claim 14 , further comprising a network interface configured to provide the correlation to a network administrator as a potential root cause for the performance event.

16. The system of claim 14 , wherein the feature of interest is identified in a log file from the number of log files, the at least one non-transitory computer-readable storage medium stores instructions which, when executed by the one or more processors, cause the one or more processors to identify the log file based on configuration data comprising at least one known location for the log file or a known file name associated with the log file.

17. The system of claim 14 , wherein the feature of interest is identified in a log file from the number of log files, the at least one non-transitory computer-readable storage medium stores instructions which, when executed by the one or more processors, cause the one or more processors to identify the log file by determining that a machine accessed the log file, determining that a size of the log file has increased, and determining that the log file contains text data.

18. The system of claim 14 , wherein the at least one non-transitory computer-readable storage medium stores instructions which, when executed by the one or more processors, cause the one or more processors to provide performance data for the one or more host entities to an analytics engine, and wherein the performance event is detected based on the performance data.

19. The system of claim 14 , wherein the feature of interest is identified based on a pattern provided by a network administrator.

20. The system of claim 14 , wherein the feature of interest is identified based on analysis of the text data in the number of log files.

Assignees

• Cisco Tech Inc

Inventors

• Kulshreshtha Ashutosh
• Sloane Andy
• Yadav Navindra
• Kempe Oliver
• Chettiar Uday Krishnaswamy
• Jeyakumar Vimal

Classifications

• H04L41/0631 Primary

  using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis · CPC title

• H04L41/069

  using logs of notifications; Post-processing of notifications · CPC title

• H04L41/5009

  Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF] · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L41/0622

  based on time · CPC title