Virtual Instruments Worldwide, Inc.

Xangati, Inc

Other

Virtual Instruments Corporation

Derek Sanders

Rosanna Lee

Rangaswamy Jagannathan

Kishor Kakatkar

Xiaohong Pan

Jing Liu

Hong Zhu

Roy Nakashima

Rangaswamy Jaganathan

David Messina

A monitoring device responds to status data to detect storms, analysis, and to attempt to remediate those storms. The monitoring device several types of storms, for each of which it has a technique for analysis of the storm. The monitoring device can determine if the storm is due to resource contention, excess or unbalanced performance activity, or network degradation. Once analyzed, the monitoring device analyzes the storm, and attempts to remediate the cause of the storm.

Storm detection, analysis, remediation, and other network behavior

A monitoring device responds to status data pushed from a network device, and also manages a link with another network device, the link allowing the monitoring device to pull status data from the second network device. The monitoring device receives packets including status, the data indicating activity for one or more clock ticks. The monitoring device can compute statistical measures, rather than the network device. The monitoring device maintains the status data in a buffer. The monitoring device lags actual activity, but has is more likely to capture delayed packets. The network device sends packets as wrappers, each wrapper indicating sets of status information. When the information in a wrapper crosses a clock tick boundary, the monitoring device allocates reported activity among clock ticks, assuming that activity follows a uniform distribution.

Cross silo time stitching

Push pull data collection

For example, as indicated in the Incorporated Disclosures, rapid change from relatively little use of network bandwidth, to heavy overuse of network bandwidth (combined with a large number of endpoints attempting to access that network bandwidth) can often indicate an email virus or other maladjusted use of the system. In such cases, it could be appropriate to generate an alert, and bring the change to the attention of a human expert, or otherwise escalate the problem. In this Application, the phrase 'best practices,' and variants thereof, can generally refer to business preferences (and to business rules imposed by management, or law or regulation), such as high utilization preferences often expressed by management. In such cases, one or more operators can enter descriptors of rules the system that it is desired the system follow, such as 'processor cycle utilization &#x3e;90%.' When these best practices are not followed, it could be appropriate to generate an alert, bring the change to the attention of a human expert, or otherwise escalate the problem. In this Application, the phrase &#x201c;profiling and alerting,&#x201d; and variants thereof, can generally refer to maintaining a profile of how the system normally behaves, absent stressors, and to identify any substantial changes from that profile. When a profile is seriously violated, it could be appropriate to generate an alert, bring the change to the attention of a human expert, or otherwise escalate the problem. In such cases, it can be appropriate to escalate the severity of the alert with increased severity of violation, increased time duration of the violation, and increased trajectory in the direction of further violation. In this Application, the phrase &#x201c;absolute capacity,&#x201d; and variants thereof, can refer to an objective measure of system capacity, such as whether the system has 1 TB or 4 TB of memory. The phrase &#x201c;relative capacity,&#x201d; and variants thereof, can refer to a subjective measure of system capacity, such as when the system has 4 TB of physical memory, but 3.5 TB of that memory are allocated to a high-priority task whose interruption or pause would be untoward.

Self-learning and best-practice profiling and alerting with relative and absolute capacity

Network monitoring views can be recorded, replayed and shared. A monitoring system receives monitoring data, in response to which a monitoring view can be constructed. The monitoring data is maintained in memory or mass storage. One or more monitoring views can later be constructed in response to user preferences, even if those users would not have known to select those particular preferences or construct those particular monitoring views at the time. The monitoring views constructed in response to that monitoring data can be presented to users in a simulation of the problem, as if it were occurring at that time. Users can send particular monitoring views to others, with both the effects that the monitoring view can be preserved as part of a trouble report, and the persons receiving the monitoring view can have useful insight into what problem the user has pointed to.

Recording, replay, and sharing of live network monitoring views

A network monitoring device responds to network status data (whether 'pushed' from the network device or 'pulled' from the network device) to maintain a buffer of saved status data. The network status data is reordered, manipulated, and presented to users of the network monitoring device in order. The monitoring device can provide a status report of the network environment. When network status data is delayed too long, the monitoring device can discard the network status data, or reduce its weighted consideration. The monitoring device attempts to balance accuracy and latency by adjusting wait time for network status data. The monitoring device maintains a record of the amount of network status data it receives and processes from each network device and each network device's ability to provide accurate and complete information to operators and users in a distributed network monitoring environment.

Enhanced flow processing

One network monitoring system maintains both information regarding historical activity and emergent activity of the network. Comparison of recent activity of the network with historical activity allows the system to determine whether recent network activity is within the realm of normal. The system maintains data structures representing a p.d.f. for observable values of network parameters. Such data structures are maintained both for historical and for emergent activity of the network. Recent activity can be compared with the p.d.f. for historical activity to aid in determining whether that recent activity is within the realm of normal. Network activity not within the realm of normal can include values of observable network parameters too high or too low to be consistent with historical activity of the network, or other values too unlikely to be consistent with historical activity at the network. Another network monitoring device includes data structures for maintaining information regarding historical activity of a network and emergent activity of a network. Those data structures include multiple types of observable values as well as multiple types of combinations of multiple observable values. The network monitoring device maintains those data structures including information regarding historical activity of a network and emergent activity of a network only for those source/destination pairs, and only for those nodes, for which maintaining that information would be substantially meaningful. Yet another network monitoring system includes data structures for maintaining information regarding historical activity of a network and emergent activity of a network. Those data structures include observable values for multiple profile dimensions, including source/destination address, application, location, and time. The data structures also include observable values for combinations of more than one of those multiple profile dimensions, including, e.g., (source address)&#xd7;(application), and the like. It is expected that only a relatively sparse set of combinations of more than one of those multiple profile dimensions would have meaningful information associated therewith. The network monitoring system maintains those data structures only for those combinations of more than one of those multiple profile dimensions for which maintaining that information would be substantially meaningful.

Symptom detection using behavior probability density, network monitoring of multiple observation value types, and network monitoring using orthogonal profiling dimensions

For example, as indicated in the Incorporated Disclosures, rapid change from relatively little use of network bandwidth, to heavy overuse of network bandwidth (combined with a large number of endpoints attempting to access that network bandwidth) can often indicate an email virus or other maladjusted use of the system. In such cases, it could be appropriate to generate an alert, and bring the change to the attention of a human expert, or otherwise escalate the problem. Best practices In this Application, the phrase 'best practices,' and variants thereof, can generally refer to business preferences (and to business rules imposed by management, or law or regulation), such as high utilization preferences often expressed by management. In such cases, one or more operators can enter descriptors of rules the system that it is desired the system follow, such as 'processor cycle utilization &#x3e;90%.' When these best practices are not followed, it could be appropriate to generate an alert, bring the change to the attention of a human expert, or otherwise escalate the problem. Profiling and alerting In this Application, the phrase &#x201c;profiling and alerting,&#x201d; and variants thereof, can generally refer to maintaining a profile of how the system normally behaves, absent stressors, and to identify any substantial changes from that profile. When a profile is seriously violated, it could be appropriate to generate an alert, bring the change to the attention of a human expert, or otherwise escalate the problem. In such cases, it can be appropriate to escalate the severity of the alert with increased severity of violation, increased time duration of the violation, and increased trajectory in the direction of further violation. Relative and absolute capaci-ty In this Application, the phrase &#x201c;absolute capacity,&#x201d; and variants thereof, can refer to an objective measure of system capacity, such as whether the system has 1 TB or 4 TB of memory. The phrase &#x201c;relative capacity,&#x201d; and variants thereof, can refer to a subjective measure of system capacity, such as when the system has 4 TB of physical memory, but 3.5 TB of that memory are allocated to a high-priority task whose interruption or pause would be untoward.

Cross silo time stiching

One network monitoring system maintains information regarding historical activity and emergent activity of the network. Comparison of recent with historical activity allows the system to determine whether recent activity is within the realm of normal. The system maintains data structures representing a p.d.f. for observable values of network parameters. Another network monitoring device includes data structures for maintaining information regarding historical and emergent activity of a network. This network monitoring device maintains those data structures including information regarding historical and emergent activity of a network only for those source/destination pairs, and only for those nodes, for which maintaining that information would be substantially meaningful. Yet another network monitoring system includes data structures for maintaining information regarding historical and emergent activity of a network that maintains those data structures only for those combinations of more than one of those multiple profile dimensions for which maintaining that information would be substantially meaningful.

A network monitoring device responds to a network status data (whether 'pushed' from the network device or 'pulled' from the network device), maintaining a buffer of saved status data. The status data is reordered, manipulated, and presented to users in order. The monitoring device can thus report an accurate momentary report of the status of the network environment. When status data is delayed too long, the monitoring device can discard it, or reduce its weighted consideration. The monitoring device adjusts its wait for status data, either as an average or individually per device, attempting to balance accuracy and latency. The monitoring device also records of how much status data it is required to process, in response to the amount it can process reliably, and maintains a sampling rate for status data, somewhere between evaluating all of the status data, and evaluating only a small portion of the status data, when capable, attempting to balance the degree of sampling, against both error and latency.

Enhanched flow processing

A network monitoring device includes a flow processing element, disposed to receive flow information relating to network flows, and to generate a set of virtual packets, each representing a portion of a network flow. The virtual packets are maintained in a time-sequential order, and read by elements of the network monitoring device to generate information relating to network traffic, such as symptoms affecting the communication network, problems affecting the communication network, and otherwise. The network monitoring device randomly samples virtual packets, with at least one of two effects: (1) flow information from traffic reporting devices that are themselves sampling a differing rates can be equalized, with the effect of standardizing information from all of them; (2) the network monitoring device itself can restrict its attention to a fraction of all virtual packets, with the effect of keeping up with a relatively large number of virtual packets.

Network monitoring using virtual packets

A network monitoring device includes a data structure for maintaining information about endpoints involved in network flows. Each endpoint, either a source or a destination for a network flow, has information maintained in a modified binary trie, having a branch for each bit of the source or destination address, but with interior nodes having only a single child node elided. A pruning thread is given a limited amount of time for operation, with the effect that the data structure is maintained available for use except for only that limited amount of time. In the event that the pruning thread is unable to prune the entire data structure, it maintains a marker indicating where last it left off, and returns to that location in the data structure at a later pruning operation.

Growing community of inventors

Saratoga, CA, United States of America

Derek Sanders