Cisco Technology, Inc.

Petre Dini

Cosmin Nicu Dini

Manuela Ionelia Popescu

Masum Z Hasan

L Alexander Clemm

Mark Ammar Rayes

Jackson Shyu

Andrew George Harvey

Ludwig Alexander Clemm

Ralph Droms

Alexander Clemm

Shyyunn Lin

Kui Zhang

Fong Shen

Steve Chen-Lin Chang

Michael Cheung

Anurag Kahol

Kenneth John Roberts

Dragan Milosavljevic

Chris Riggins

Kurella Murty

Raji Sridar

Apparao Tayi

Cosmin Dini

Manuela Popescu

Techniques for system (syslog) messages are provided. As syslog messages are generated a dual sequence number is maintained for each syslog message. The first sequence number is consistent for each syslog message and represents a total number of syslog messages received. The second sequence number is maintained as a total message count for a specific session for which a syslog message is assigned.

Techniques for sequencing system log messages

A method and system to profile applications are provided. The system may include a capture module to capture resources consumption data for an application and a requirements generator to generate resources requirement data for the application. The resources requirement data may be generated by the requirements generator utilizing the resource consumption data. The system may further include a profile generator to generate a profile for the application. The profile may comprise the resources consumption data and the resources requirement data.

Method and system to generate execution-based scheduling signature for an application

Resource availability profiles are received, wherein each resource availability profile describes a resource associated with a server. Each resource is assigned a plurality of weights corresponding to a plurality of policies. The weights are determined by, for each of the plurality of the policies, determining a weight for each resource based a given policy and selected information in the resource availability profiles corresponding to the resources. The method further comprises determining a policy from the plurality of the policies corresponding to a given a context associated with a connection request. A first of the load-balanced servers is selected for the connection request based on the weights assigned to the plurality of resources for the policy for the given context.

Load balancing mechanism using resource availability profiles

A method and system for processing directives included in management events are disclosed. A method for handling management events includes detecting an event generated upon an occurrence relating to a device, such as a network device. The device related occurrence has a characteristic. A directive, appropriate to this characteristic, is included with the event format. The event is directed to a management entity, which interprets the directive and handles the event by processing it according to the directive. Such preprocessing directives included in the events allow recipients of the events to decide what to do with them, e.g., with the messages therein, and thus help prevent inadvertent loss of information conveyed in these events.

Method and system for processing directives included in management events

The real time availability of a group of network elements is determined based upon both a real time availability value for each of the network elements and cooperation relationships between the network elements. The cooperation relationships reflect both the topological relationships between the network elements, i.e., how the network elements are connected, and the extent to which network elements interact with each other effectively. For relatively small groups of network elements, where the cooperation relationships are not overly complex, the real time availability is determined directly from the real time availability value for each of the network elements and cooperation relationships between the network elements. Decomposition and recombination are used to determine the real time availability of large groups of network elements based on specific formulas for basic network element topology models.

Approach for determining the real time availability of a group of network elements

An approach for processing events generally involves receiving event data that specifies one or more attributes of an event that has occurred. A determination is made whether the event data satisfies one or more event cancellation criteria. If so, then event report data is provided to a recipient, such as an application layer. The event report data specifies at least one attribute of the event that occurred. If the event data does not satisfy the one or more event cancellation criteria, then the event data is not provided to the recipient and the event is canceled. The cancellation criteria may include policy-based rules that may specify event cancellation based upon, for example, event frequency, correlation window size, particular information associated with an event, or other management application rules. The particular cancellation criteria used may vary from application to application. Furthermore, the cancellation criteria used for any particular application may be dynamic and change over time.

Approach for canceling events

Event processing in rate limited network devices is described. An event receiver is notified of a backlog condition and may respond by increasing the rate limit for the network device. If an event queue on the network device overflows, event messages may be diverted to an event message overflow store or to a network location. Later, the messages may be retrieved after the overflow condition has cleared. As a result, critical messages or events such as Syslog messages are not lost when a rate limited network device cannot deliver the messages to a network management station.

Event processing in rate limited network devices

An approach is provided for characterizing the dynamic availability behavior of network elements using metrics that indicate patterns of availability of a network element over time. The metrics provide an indication of stability and instability of a network element and include one stability metric and three instability metrics. The stability metric is a stability order that indicates how long an operational state holds with respect to a prior operational state. The instability metrics include an instability order, a repeatability order and a multiplicity order. The instability order indicates how quickly a network element changes operational states. The repeatability order indicates short-term instability within a vicinity of a change in operational state. The multiplicity order indicates long-term instability. The metrics may be used alone, or in various combinations, by network management applications to better manage network elements.

Approach for characterizing the dynamic availability behavior of network elements

A uniquely configured data structure is used to store event information for each network entity, where logical and physical dependency relationships among entities are captured in the data structure. For each entity, the data structure is configured to store (a) a 'genuine event set', which includes a list of events that originated in association with the entity; and (b) a 'derived event set', which includes a list of records in which each record is associated with an event that originated in association with an entity that has a dependency relationship (e.g., layering or topological) with the entity. The derived event set may simply comprise references to the genuine event sets for entities that have a dependency relationship with the entity.

Method and apparatus for correlating events in a network

A method is disclosed for a method for measuring the availability of a network element or service. For each network element N, a current real availability value CRAVand a current time value CTVare associated with network element N. Additionally, for each network element N, an operational state value OSVis associated with network element N. At a later time, indicated by a new time value NTV, a new real availability value NRAVfor network element N is determined based on the current availability value CRAV, the current time value CTV, the new time value NTV, and the operational state value OSV. The new real availability value NRAVis stored. Thus, each separate network element N may be associated with a separate real availability value that accurately reflects the availability of network element N specifically, regardless of any availability approximated for network element N's type.

Method and apparatus for measuring the availability of a network element or service

An approach for determining compression intervals generally involves determining a compression interval based upon frequencies of event instances. According to the approach, event data is received that specifies instances of an event. The event data is analyzed and a compression interval is determined based upon frequencies of the instances of the event. The compression interval is selected to provide a balance between insufficient compression (under compression) and poor performance associated with over compression. Event compression may then be performed using the compression interval and report data may be generated that specifies the occurrence of the event.

Approach for determining compression intervals and performing event compression

An isolation approach for network users associated with elevated risk is disclosed for protecting networks. In one approach a method comprises the computer-implemented steps of determining a user identifier associated with a network device that has caused a security event in a network; causing the network device to receive a network address that is selected from a subset of addresses within a specified pool associated with suspected malicious network users; and configuring one or more security restrictions with respect to the selected network address.

Isolation approach for network users associated with elevated risk

A method of managing performance data and accounting data that are generated in a computer network comprises collecting performance data from the network using one or more collector blades that are installed into a data collection manager at a time when the data collection manager is executed; determining whether the performance data satisfies one or more thresholding rules, and if so, generating and sending one or more performance messages; filtering the performance data using one or more filters; aggregating the performance data; and correlating the performance data with other data received from one or more network management subsystems.

Method and apparatus for collecting network performance data

A method of providing performance trend information from a device in a packet-switched network to a network management station comprises maintaining in the device one or more state variables that store values associated with data processing functions of the device; storing in the device a trend indicator value and a trend tendency value, both associated with a particular state variable among the state variables; periodically sampling the particular state variable to obtain one or more sampled values; determining and updating the trend indicator value with a direction of change in the sampled values of the particular state variable over a particular time; determining and updating the trend tendency value with a rate of change in the one or more sampled values of the particular state variable over the particular time; and sending the trend indicator value and the trend tendency value to the network management station.

Method and apparatus for providing trend information from network devices

A method and mechanism for communicating an alarm in a computer network is provided. An alarm system enables a MSP to accurately determine which device within a computer network is associated to a received alarm. Initially, an event is detected on a device on the computer network. An alarm is propagated to an alarm identification component. The alarm identification component augmenting the alarm with identification information to result in creating an augmented alarm. Thereafter, the augmented alarm is transmitted to a network operations center for the computer network. The network operations center may process the alarm using the additional information in the alarm. Accordingly, using the augmented alarm, the MSP is able to accurately determine the identity of the originating device, regardless of whether the customer site of the originating device uses NAT or a private IP addressing scheme.

Growing community of inventors

San Jose, CA, United States of America

Petre Dini