Network appliance health monitor

Patent metadata

Field	Value
Publication number	US-2017288955-A1
Application number	US-201615083409-A
Country	US
Kind code	A1
Filing date	Mar 29, 2016
Priority date	Mar 29, 2016
Publication date	Oct 5, 2017
Grant date	—

Abstract

Systems and methods for monitoring failures of network devices and identifying potential sources of the failures by a device health monitor are provided. A device monitor receives a usage log of a network device over a network connection and analyzes an abnormal usage of the network device from the usage log. The device health monitor further retrieves environment information of the network device and analyzes a defect of the environment information of the network device by associating the abnormal usage with the environment information. The device health monitor sends a message regarding the defect of the environment information to an administrator of the network device.

First claim

What is claimed is:

1 . A method comprising:
receiving, by a network device health monitor, a usage log of a network device over a network connection; determining, by the network device health monitor, based on an analysis of the usage log whether an abnormal usage issue has occurred within the network device; retrieving, by the network device health monitor, environment information of the network device; identifying, by the network device health monitor, a cause or potential cause of the abnormal usage issue by detecting a potential defect within the environment information and associating the abnormal usage issue with potential defect within the environment information; and causing, by the network device health monitor, an administrator of the network device to be notified regarding the abnormal usage issue and the potential defect.

2 . The method of claim 1 , further comprising collecting, by the network device health monitor, the environment information of the network device during registration of the network device with the network device health monitor.

3 . The method of claim 1 , further comprising collecting, by the network device health monitor, the environment information of the network device responsive to an update to the environment information of the network device.

4 . The method of claim 1 , wherein the abnormal usage issue of the network device comprises an abnormal hardware usage issue.

5 . The method of claim 4 , wherein the abnormal hardware usage issue comprises one or more of:
excessive disk write operations; high-CPU usage over an extended time period; high kernel CPU usage; and high network usage.

6 . The method of claim 1 , wherein the abnormal usage issue comprises an abnormal software usage issue.

7 . The method of claim 6 , wherein the abnormal software usage issue comprises one or more of:
a daemon crash; a kernel crash; a memory leak; and memory usage in conserve mode.

8 . The method of claim 1 , wherein the environment information of the network device comprises software environment information of the network device.

9 . The method of claim 8 , wherein the software environment information of the network device comprises one or more of:
a version of an operating system running within the network device; a software update log; and a network security policy configuration.

10 . The method of claim 1 , further comprising:
determining, by the network device health monitor, whether the abnormal usage issue is common among a plurality of network devices of a private network; responsive to determining the common abnormal usage issue, determining, by the network device health monitor, whether the plurality of network devices have common environment information; and wherein said identifying, by the network device health monitor, a cause or potential cause of the abnormal usage issue comprises detecting a potential defect within the common environment information and associating the common abnormal usage issue with potential defect within the common environment information.

11 . A computer system comprising:
non-transitory storage device having embodied therein instructions representing a device health monitoring application; and one or more processors coupled to the non-transitory storage device and operable to execute the health monitoring application to perform a method comprising:
receiving a usage log of a network device over a network connection;
determining based on an analysis of the usage log whether an abnormal usage issue has occurred within the network device;
retrieving environment information of the network device;
identifying a cause or potential cause of the abnormal usage issue by detecting a potential defect within the environment information and associating the abnormal usage issue with potential defect within the environment information; and
causing an administrator of the network device to be notified regarding the abnormal usage issue and the potential defect.

12 . The computer system of claim 11 , wherein the method further comprises collecting the environment information of the network device during registration of the network device with the network device health monitor.

13 . The computer system of claim 11 , wherein the method further comprises collecting the environment information of the network device responsive to an update to the environment information of the network device.

14 . The computer system of claim 11 , wherein the abnormal usage issue of the network device comprises an abnormal hardware usage issue.

15 . The computer system of claim 14 , wherein the abnormal hardware usage issue comprises one or more of:
excessive disk write operations; high-CPU usage over an extended time period; high kernel CPU usage; and high network usage.

16 . The computer system of claim 11 , wherein the abnormal usage issue comprises an abnormal software usage issue.

17 . The computer system of claim 16 , wherein the abnormal software usage issue comprises one or more of:
a daemon crash; a kernel crash; a memory leak; and memory usage in conserve mode.

18 . The computer system of claim 11 , wherein the environment information of the network device comprises software environment information of the network device.

19 . The computer system of claim 18 , wherein the software environment information of the network device comprises one or more of:
a version of an operating system running within the network device; a software update log; and a network security policy configuration.

20 . The computer system of claim 11 , wherein the method further comprises:
determining, by the network device health monitor, whether the abnormal usage issue is common among a plurality of network devices of a private network; responsive to determining the common abnormal usage issue, determining, by the network device health monitor, whether the plurality of network devices have common environment information; and wherein said identifying, by the network device health monitor, a cause or potential cause of the abnormal usage issue comprises detecting a potential defect within the common environment information and associating the common abnormal usage issue with potential defect within the common environment information.

Assignees

• Fortinet Inc

Inventors

• Yin Jun

Classifications

• H04L41/0695 Primary

  the faulty arrangement being the maintenance, administration or management system · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L43/0817

  by checking functioning · CPC title

• H04L43/08

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title