Programmable diagnosis model for correlation of network events

Patent metadata

Field	Value
Publication number	US-11533215-B2
Application number	US-202016821745-A
Country	US
Kind code	B2
Filing date	Mar 17, 2020
Priority date	Jan 31, 2020
Publication date	Dec 20, 2022
Grant date	Dec 20, 2022

Abstract

Network management techniques are described. A controller device of this disclosure manages a device group of a network. The controller device includes processing circuitry in communication with the memory, the processing circuitry being configured to receive, using a programmable diagnosis service executed by the processing circuitry, a programming input, to form, using the programmable diagnosis service, based on the programming input, a resource definition graph that models interdependencies between a plurality of resources supported by the device group, to detect, using the programmable diagnosis service, an event affecting a first resource of the plurality of resources, and to identify, using the programmable diagnosis service, based on the interdependencies modeled in the resource definition graph formed based on the programming input, a root cause event that caused the event affecting the first resource, the root cause event occurring at a second resource of the plurality of resources.

First claim

What is claimed is:

1. A method of monitoring a device group of a network, the method comprising:
receiving, by a programmable diagnosis service running on a controller device that manages the device group, a programming input;
forming, by the programmable diagnosis service, based on the programming input, a resource definition graph that models interdependencies between a plurality of resources supported by the device group, the plurality of resources including services provided by devices of the device group and components of the devices of the device group, and the resource definition graph including interdependencies between the services and the components of the devices involved in providing the services;
initializing, by the programmable diagnosis service, one or more telemetry rules that enable the controller device to perform one or more of:
monitoring state information for one or more components of the device group; or
instigating one or more alarms in response to detecting threshold events occurring within the plurality of resources,

wherein initializing the one or more telemetry rules comprises configuring, by the programmable diagnosis service, based on the programming input, first cause-and-effect relationships between device resources supported by the device group, and second cause-and-effect relationships between service resources supported by the device group;
detecting, by the programmable diagnosis service, using a detected packet loss between two or more of the devices of the device group, an event affecting a first resource of the plurality of resources; and
identifying, by the programmable diagnosis service, based on the interdependencies modeled in the resource definition graph formed based on the programming input, a root cause event that caused the event affecting the first resource, the root cause event occurring at a second resource of the plurality of resources.

2. The method of claim 1 , wherein identifying the root cause event that caused the event affecting the first resource comprises:
applying, by the programmable diagnosis service, the resource definition graph to at least a subset of the plurality of resources to generate one or more inference rules with respect to the plurality of resources; and
performing, by the programmable diagnosis service, a forward-chained root cause analysis (RCA) by applying the one or more inference rules to a plurality of events detected over the plurality of resources.

3. The method of claim 1 , wherein forming the resource definition graph that models the interdependencies between the plurality of resources supported by the device group comprises applying, by the programmable diagnosis service, one or more temporal constraints to the modeled interdependencies.

4. The method of claim 3 , wherein the one or more temporal constraints include a constraint according to which the event affecting the first resource occurs after the root cause event occurring at the second resource.

5. The method of claim 3 , wherein the one or more temporal constraints include a constraint according to which the event affecting the first resource occurs before the root cause event occurring at the second resource.

6. The method of claim 1 , wherein the plurality of resources comprises one or more network resources, the method further comprising configuring, by the programmable diagnosis service, at least a subset of the one or more network resources.

7. The method of claim 1 , wherein the plurality of resources comprises one or more service resources, the method further comprising configuring, by the programmable diagnosis service, at least a subset of the one or more service resources.

8. The method of claim 1 , wherein the plurality of resources comprises one or more device resources, the method further comprising configuring, by the programmable diagnosis service, at least a subset of the one or more device resources.

9. A controller device for managing a device group of a network, the controller device comprising:
a network interface;
a memory; and
processing circuitry in communication with the memory, the processing circuitry being configured to:
receive, using a programmable diagnosis service executed by the processing circuitry, a programming input;
form, using the programmable diagnosis service, based on the programming input, a resource definition graph that models interdependencies between a plurality of resources supported by the device group, the plurality of resources including services provided by devices of the device group and components of the devices of the device group, and the resource definition graph including interdependencies between the services and the components of the devices involved in providing the services;
initialize, using the programmable diagnosis service, one or more telemetry rules that enable the controller device to perform one or more of:
monitoring state information for one or more components of the device group; or
instigating one or more alarms in response to detecting threshold events occurring within the plurality of resources,

wherein to initialize the one or more telemetry rules, the processing circuitry is configured to use the programmable diagnosis service to configure, based on the programming input, first cause-and-effect relationships between device resources supported by the device group, and second cause-and-effect relationships between service resources supported by the device group;
detect, using the programmable diagnosis service, using a detected packet loss between two or more of the devices of the device group, an event affecting a first resource of the plurality of resources; and identify, using the programmable diagnosis service, based on the interdependencies modeled in the resource definition graph formed based on the programming input, a root cause event that caused the event affecting the first resource, the root cause event occurring at a second resource of the plurality of resources.

10. The controller device of claim 9 , wherein to identify the root cause event that caused the event affecting the first resource, the processing circuitry is configured to:
apply, using the programmable diagnosis service, the resource definition graph to at least a subset of the plurality of resources to generate one or more inference rules with respect to the plurality of resources; and
perform, using the programmable diagnosis service, a forward-chained root cause analysis (RCA) by applying the one or more inference rules to a plurality of events detected over the plurality of resources.

11. The controller device of claim 9 , wherein to form the resource definition graph that models the interdependencies between the plurality of resources supported by the device group, the processing circuitry is configured to apply, using the programmable diagnosis service, one or more temporal constraints to the modeled interdependencies.

12. The controller device of claim 11 , wherein the one or more temporal constraints include a constraint according to which the event affecting the first resource occurs after the root cause event occurring at the second resource.

13. The controller device of claim 11 , wherein the one or more temporal constraints include a constraint according to which the event affecting the first resource occurs before the root cause event occurring at the second resource.

14. The controller device of claim 9 , wherein the plurality of resources comprises one or more network resources, and wherein the processing circuitry is further configured to use the programmable diagnosis service to configure a

Assignees

• Juniper Networks Inc

Inventors

• R Jayanthi
• A Chandrasekhar
• Antich Javier
• Mallipudi Sri Sampath
• N Premchandar
• Lakshmikanth Harsha
• Sidebottom Gregory A
• Fang Zhifei

Classifications

• H04L41/0631 Primary

  using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis · CPC title

• H04L41/16

  using machine learning or artificial intelligence · CPC title

• H04L41/0604

  using filtering, e.g. reduction of information by using priority, element types, position or time · CPC title

• H04L43/0823

  Errors, e.g. transmission errors · CPC title

• H04L41/0806

  for initial configuration or provisioning, e.g. plug-and-play · CPC title