Method and computing component for changing computing network information based on data store changes
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- HEWLETT PACKARD ENTERPRISE DEV LP
- Filing Date
- 2022-10-25
- Publication Date
- 2026-08-07
Smart Images
Figure CN116827751B_ABST
Abstract
Description
Background Technology
[0001] Data storage can refer to a repository used to store and manage collections of data. Examples of data storage include databases, routing tables, and storage files. Data storage can be composed of constituent elements (i.e., data storage elements). Examples of database elements can include table elements (i.e., elements within or associated with a data table). Examples of table elements can include rows, columns, lists, table indexes, database tables, etc.
[0002] Open vSwitch Database (OVSDB) can refer to a network-accessible database. In some networks, OVSDB serves as the primary repository for network-related data.
[0003] A Time Series Database (TSDB) can refer to a database that stores data associated with network events in a time-series format. TSDBs and their Time Series Database Data (TSDBD) are typically derived from network-related data stored in the network's OVSDB.
[0004] Network analytics components (NACs), such as HPE's Aruba Network Analytics Engine (NAE), can provide network operators with distributed analytics to troubleshoot and resolve issues affecting the network. These NACs can analyze network events to provide visibility into faults and anomalies. Existing NACs typically use TSDBDD to analyze network events. Attached Figure Description
[0005] This disclosure is described in detail below with reference to one or more different embodiments and the accompanying drawings. These drawings are provided for illustrative purposes only and depict only typical or exemplary cases.
[0006] Figure 1 An example of a system is shown, which includes computing components that monitor changes in data storage to help monitor the network.
[0007] Figure 2 An example is shown of a computing component and a process performed by the computing component to monitor the network by monitoring data storage.
[0008] Figure 3 An example of a process performed by a computing component to monitor a network by monitoring data storage is shown.
[0009] Figure 4 An example process is shown, performed by a computing component, to determine information about changes in data storage.
[0010] Figure 5 An example procedure is shown, executed by the computing component, for determining events related to changes in the data storage.
[0011] Figure 6 An example process is shown, executed by a computing component, for analyzing data and events related to changes in the data store.
[0012] Figure 7 An example process for comparing data and events related to data storage, performed by a computing component, is shown.
[0013] Figure 8 This illustrates an example process performed by a computing component to calculate statistics on data and events related to data storage.
[0014] Figure 9 Example computing components are shown that can be used to implement the various features of the examples described in this disclosure.
[0015] These accompanying drawings are not exhaustive and do not limit this disclosure to the exact form disclosed. Detailed Implementation
[0016] As mentioned above, existing network analysis components (NACs) rely on time-series database data (TSDBDs) to analyze network events and report anomalies. This reliance on TSDBDs comes at a cost. Specifically, building and storing TSDBDs can consume significant amounts of memory and computing power. Performing analysis on TSDBDs consumes even more memory / computing power. Therefore, deploying NACs that depend on TSDBDs becomes difficult due to the memory / computing power required for their operation.
[0017] In this context, examples of currently disclosed technologies reduce reliance on TSDBDs by performing analysis on network-related data closer to its source. Specifically, the examples investigate changes to a centralized network data store (e.g., OVSDB) from which TSDBDs are typically derived. By monitoring data related to changes to the centralized network data store (e.g., the insertion and deletion of data store elements), the examples can detect anomalies in network functionality. As the examples of currently disclosed technologies recognize, changes to the centralized network data store can indicate similar changes in the network. Therefore, when the examples detect anomalies related to changes in the centralized network data store, they can issue alerts or take corrective actions.
[0018] By performing analysis on the centralized network data store from which the TSDBDs are typically built / derived, the example can eliminate the need to build / store a large number of TSDBDs for network analysis-related purposes. By severing ties with the TSDBDs, the example can reduce the memory / computing power required to perform network-related analysis. Utilizing currently disclosed techniques, the NAC can reduce its reliance on TSDBDs when performing network-related analysis. Therefore, such an NAC may require less memory / computing power to operate, making large-scale deployment more feasible.
[0019] Examples of currently disclosed technologies may include an agent that monitors network traffic through network devices associated with or attached to the agent. Agent activity can be monitored by storing statistics about table entries to assist administrators in troubleshooting processes.
[0020] In some examples, "datastore probing" can facilitate monitoring the state behavior of a network (as used in this paper, datastore probing can refer to changes occurring in the data store and the analysis of these changes to detect changes in the network). The state of the network can include connectivity between network devices, paths available for sending messages, etc. Example devices and systems may include command-line interfaces or user interfaces to help debug the cause of alerts.
[0021] Some examples can collect Type I and Type II statistics. Type I statistics are statistics applied to multiple inserts / deletes or other types of changes to a table or database. In other words, Type I statistics can be captured across multiple changes (e.g., multiple inserts / deletes). An example of Type I statistics is minimum uptime. Minimum uptime can be the minimum uptime of a monitored row (or other database element) or a subgroup of monitored rows. Another example of Type I statistics is a count of the number of updates. This count can be the total number of updates to multiple rows between two events. Type II statistics apply to time windows. In some cases, Type II statistics may be the same as Type I statistics, except that Type II statistics are calculated based on a specific time window, while Type I statistics are not. Type II statistics can be useful when comparing a specific time of day to a specific time of another day. Similarly, Type II statistics can be used to compare activity at a specific time in a week (month, quarter, year, or decade) to the same time in other weeks (month, quarter, year, or decade, respectively).
[0022] An example could capture an existence probe. An existence probe includes information associated with a database element. An existence probe is maintained only if a specific element exists or is part of the database. For example, an existence probe could be information and statistics maintained to know how well a device or data path associated with a specific row is functioning. As another example, when a network device or data path fails or becomes inactive, the corresponding row can be deleted. Therefore, information about that row can be deleted because it may no longer be of interest. For example, a row's existence probe could include the values stored in that row, the values associated with that row, the status of the device or data path recorded in that row, or the count of items in that row. However, other information about the deleted row may exist, which can be maintained or included in aggregated information used to track network health. For example, after a row is deleted, column and window information associated with that row can be retained based on the identifier, index value, or hash value of a specified or uniquely identifiable column or window associated with that row.
[0023] Status behavior monitoring can include an observation window used to create a baseline for sampling statistical behavior. Deviations from this baseline can be monitored. Some baseline threshold patterns that can be used include thresholds configured before collecting statistics, which may be based on internal testing. For example, during route swings, a route may change from available to unavailable (or vice versa). If a route swings more than a threshold number within a given time period, an alert can be sent to the administrator based on internal testing indicating that the route should not fail or be inactive more frequently than the threshold. As more data is received, the baseline and thresholds can be automatically adjusted over time.
[0024] Examples can capture row, index, and column probing. Row, index, and column probing can include tracking the latest time of new inserts, updates, deletions, and other changes. The index can include a database indexed field or a partial index. Row, index, and column data are examples of "observable data." Observable data can be determined by observation without further calculation or inference. Observable events are calculated based on observable data. "Observable events" can include the uptime, inactivity time, and settling time of a row, index, or column. Observable events can include the number of inserts, deletions, updates, uptime, settling uptime, and update frequency. Aggregate probing can summarize probing of multiple rows, partial indexes, or Virtual Routing and Forwarding (VRF) tables. Aggregation can begin at the start of monitoring and can be continuously updated as monitoring continues, or it can be aggregated over a shorter period of time. Row probing can include presence, window, or aggregated data and events.
[0025] Some observable column data can include values or parameters associated with the column, the most recently updated value, the most recently updated state stored in the column, or the most recently updated count size of rows or other elements associated with the column. An example of a most recently updated value is a recent update of central processing unit (CPU) utilization. Another example is a recent update of the size of a list associated with the column. For example, this list could be a list of the number of next hops. "Observable measurements" can include comparing current values to past values, target values, or statistical values. Statistics can be calculated based on all insertions and deletions (or other database changes) of a column. Statistics can be performed based on values in fields within a column or values associated with the column.
[0026] Statistics can be calculated for state changes and state durations. Observable events associated with state changes can include the number of state updates, the frequency of state updates, the number of state changes between two events, and the number of updates to the list associated with the state. Observable measurements are not necessarily associated with any single event or data point. For example, the state of a node or data path can include whether the node or data path is congested, currently unavailable, or functioning well. The state of a specific node can include the connections and other nodes to which that specific node is connected. The state of a specific node can include the number of nodes to which that specific node is connected. The state of a node can include the node's power consumption and measurements of node activity. The state of a data path can include nodes that are part of the data path, the round-trip time of messages using the data path, and the latency associated with the data path. The state of a database element can include whether the database element is populated, the element's size, the element's storage capacity, the database element's activity level, and whether the element is allowed to be accessed. Updates or changes to any information associated with a state can be state changes.
[0027] Examples can also capture table probing. For instance, table probing can include the number of rows that are inserted, modified, updated, or deleted in a table. Table probing can include the number of references added to or deleted from a table. Some observable metrics for a table are the insertion rate, re-insertion rate, and deletion rate of elements within the table. Observable table statistics can be captured across inserts / updates / deletes within a time window. Observable table statistics can be captured across two or more windows.
[0028] Examples can include configurable thresholds to enable administrators to send alerts indicating anomalies in data or events compared to the administrator's baseline network operation. For example, the user interface could include tools for adjusting or customizing thresholds. As another example, an administrator could set up alerts for Open Shortest Path First (OSPF) type routes, triggered by a metric change exceeding a value of 10, as the administrator may have determined that large deviations in the network are unusual. Dynamic thresholds can be included to allow the system or administrator to learn from events as they occur. Dynamic thresholds can change automatically or manually. Dynamic thresholds can change in response to events. Administrators can also set the type of alert sent when a deviation exceeds a selected threshold. One example is that if any Border Gateway Protocol (BGP) route modification occurs, an administrator could set a dynamic threshold to cause a high alert notification. As another example, an administrator could set a dynamic threshold to cause a medium alert in the event of an OSPF modification. The system could allow users to select how much deviation from a desired value would trigger an alert. Administrators could be provided with the ability to query (polling) through a user interface to extract heuristic information. A user interface for executing scripts could be provided to administrators. Although database elements may be referred to as examples, the methods and systems described herein can be used with tables that store information related to networks that are not part of a database. The method may include operations (e.g., executed instructions or commands).
[0029] Figure 1 An example of a system 100 is shown, which includes computing components that monitor changes to database elements to aid in network monitoring. System 100 may include a local area network (LAN) 102. LAN 102 may include a network device 104. Network device 104 may be a router or other edge device. Network device 104 may include computing component 106, routing table 108, and user interface (UI) 110. LAN 102 may also include client devices 112, 114, and 116. Client devices 112, 114, and 116 may be any of a desktop computer, laptop computer, tablet computer, pocket computer, smartphone, or other network-enabled device. Client devices 112, 114, and 116 can send and receive messages via edge device 104. For example, network device 104 may be used to support connectivity and communication for client devices 112-116. System 100 may include a LAN 118. LANs 102 and 118 may be connected to a switch 120. LANs 102 and 118 are examples of edge networks.
[0030] Computing component 106 monitors changes to routing table 108. Information about events in LAN 102 or system 100 can be calculated based on data collected during the monitoring of routing table 108. Data and information can be analyzed by computing component 106. When computing component 106 detects an anomaly, it can send an alert to the administrator of LAN 102. The administrator of LAN 102 can use user interface (UI) 110 to determine the cause of the anomaly and take corrective action. UI 110 can be part of computing component 106. LAN 118 can be similar to LAN 102.
[0031] Networks typically include network switches, which are "edge" devices. Edge devices can provide Layer 2 connectivity. However, they may include components for monitoring changes to routing tables (e.g., routers), which could be useful for administrators of local networks such as network 102 when monitoring problems with network 102 and its connections to other networks.
[0032] Switch 120 can be used to connect LANs 102 and 118 to a server or wide area network (WAN), such as the Internet or network 132. Switch 120 may include data storage 122, computing component 124, NAC 126, agent 128, and UI 130. NAC 126 and agent 128 are optional. Switch 120 can be placed relatively close to LANs 102 and 118 to better support communication and connectivity from these LANs to network 132. Data storage 122 may be a database or OVSDB. Computing component 124 is similar to computing component 106. Switch 120 is just one example of an edge device in which computing component 124 may be included. Computing component 124 monitors changes to data storage 122. Information about events in LANs 102 and 118 or network 132 can be calculated based on data collected during monitoring of data storage 122. Data and information can be analyzed by computing component 124. When computing component 124 detects anomalies, it can send alerts to the administrator. The table monitored by computing components 106 or 124 can be a routing table, a forwarding table, or other network-related tables. The table monitored by computing components 106 or 124 can store data paths, costs associated with those paths, and information related to network devices within the network. For example, the table can store the length of a data path, the number of hops in the data path, or the time required for a message to traverse the data path. Computing components 124 and NAC 126 can be remotely managed to allow users such as network administrators to adaptively configure the functions performed when computing various network analyses associated with network information within data storage 122 or switch 120. Switch 120 can be replaced with any edge device.
[0033] The monitored "table" can also include information about the device itself (e.g., switch 120). A centralized database (e.g., data store 122) can be used to monitor, track, and count everything network-related that is observed, monitored, tracked, and counted by switch 120 (or another edge device or network device). Probing can involve the functionality of switch 120 itself.
[0034] NAC 126 can be configured to perform centralized network monitoring of LANs 102 and 118 or network 132. NAC 126 can automate network monitoring and troubleshooting. Some capabilities of NAC 126 can be supported by accessing data storage 122. When a problem occurs, agent 128 can provide notifications to relevant users, such as IT staff. Agent 128 can access the results of monitoring performed by computing component 124. Agent 128 can provide analysis results performed by NAC 126 or computing component 124. Furthermore, agent 128 can test conditions and take actions based on the test results. Agent 128 can send alerts based on analysis of computing component 126. Computing component 124 may be able to send alerts independently of agent 128. UI 130 can be similar to UI 110.
[0035] Computing components 106 or 124 may be located external to network device 104 and switch 120, respectively. In this case, computing components 106 or 124 may remotely access routing table 108 or data storage 122, respectively. Computing component 124 may be able to access or control NAC 126 or agent 128. Computing component 124 may be able to enable agent 128 to send alerts. UI 130 may be a network UI. UI 130 may allow administrators to access and control data storage 122, computing component 124, NAC 126, and agent 128. For example, UI 130 may provide access to data collected and analyzed by computing component 124. Alternatively, UI 130 may be part of computing component 124.
[0036] Figure 2 This illustration shows a computing component 200 and an example process executed by the computing component 200 for monitoring a network. The computing component 200 may be part of a network device, router, server computer, switch, network manager, network processing device, or any other similar computing component capable of processing data. Figure 2 In the example implementation, computing component 200 includes a hardware processor 202 and a machine-readable storage medium 204. Computing component 200 is Figure 1 Examples of computing components 106 or 124.
[0037] Hardware processor 202 may be one or more central processing units (CPUs), semiconductor-based microprocessors, and / or other hardware devices suitable for retrieving and executing instructions stored in machine-readable storage medium 204. Hardware processor 202 may retrieve, decode, and execute instructions, such as instructions 206-216, to control processes or operations for monitoring tables or database tables (or other database elements) storing network information. As an alternative to or supplement to retrieving and executing instructions, hardware processor 202 may include one or more electronic circuits comprising electronic components for the function of executing one or more instructions, such as field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), or other electronic circuits.
[0038] Machine-readable storage media, such as machine-readable storage media 204, can be any electrical, magnetic, optical, or other physical storage device that contains or stores executable instructions. Machine-readable storage media 204 can be, for example, random access memory (RAM), non-volatile RAM (NVRAM), electrically erasable programmable read-only memory (EEPROM), storage devices, optical discs, etc. In some examples, machine-readable storage media 204 can be a non-transient storage medium, where the term "non-transient" excludes transient propagation signals. As described in detail below, machine-readable storage media 204 can be encoded with executable instructions such as instructions 206-216.
[0039] Hardware processor 202 can execute instructions 206-216. In some examples, hardware processor 202 can execute instructions to monitor tables, database tables, or databases, which can be used to detect anomalies or diagnose problems in the operation of network devices or networks. Memory 204 can also store tables or database tables, such as routing table 108 or data storage 122.
[0040] Hardware processor 202 can execute instructions 206 to collect historical data by a device (e.g., computing component 200). The historical data includes the time of data storage events and the type of data storage events or table events. Data storage events or table events can include the type of change that occurred in a table or data storage table (e.g., routing table 108 or data storage 122) caused by changes in network information. Raw data can be collected / stored and then compared with historical data.
[0041] Hardware processor 202 can execute instruction 208 to calculate current information associated with the state of a network device or data path based on historical data. Raw data can be collected / stored and then compared with historical data. Hardware processor 202 can execute instruction 210 to perform analysis or statistical analysis by the device (e.g., computing component 200). Analysis or statistical analysis may include comparing current information with defined criteria or previous information associated with the state of a network device or data path. Hardware processor 202 can execute instruction 212 to detect anomalies by the device. Detected anomalies may be within the current information. Anomaly detection is based on analysis or statistical analysis (of operation 210). Hardware processor 202 can execute instruction 214 to send an alarm indicating the detection of an anomaly by the device. Hardware processor 202 can execute instruction 216 to identify network events that caused the anomalies. Identification of network events can be provided through a user interface on the device.
[0042] exist Figure 3 The discussion further elaborates on the operations and alternatives associated with executing instructions 206-216.
[0043] Figure 3 Method 300 is shown as an example process for monitoring a network, executed by computing component 200.
[0044] Operations (e.g., executed instructions) 302-306 can be performed as sub-operations of execution instruction 206 to collect historical data. Hardware processor 202 can execute instruction 302 to detect changes to database elements. For example, it can receive messages indicating a node failure or inactivity, or the presence of a new node, and in response, update the database. This node may be associated with a failed or inactive network device. The absence of a node can affect the availability of a data path, for example, by interrupting the data path. As another example, in operation 302, an external device can access computing component 300 and cause hardware processor 202 to modify the database.
[0045] Hardware processor 202 can execute instructions 304 to determine information about the change. For example, the type of change made can be determined. In operation 304, the type of change can be, for example, the deletion, insertion, re-insertion, or update of a database element. In executing instructions 304, for example, the database element being changed can be determined as a row, column, index, list, or table. Operation 304 may also involve determining values stored in or associated with the database element being changed.
[0046] Hardware processor 202 can execute instructions 306 to record changes detected during the execution of instructions 302. For example, historical data including the time and type of database events can be collected. Database events can include the type of change to a database element caused by changes in network information. An example of network information is routing information. Historical data can include the time of the change, recorded in association with the type of change or other details of the change.
[0047] The execution of instruction 308 may be an example of the calculation of current information following the execution of instruction 208. Hardware processor 202 may execute instruction 308 to determine the occurrence of an event. Executing instruction 308 may include observing, inferring, or calculating an event based on data recorded during operation 306. For example, executing instruction 308 may calculate current information associated with the state of a network device or data path based on historical data. In some cases, the change recorded in operation 306 may itself be an event, while in others it may be necessary to calculate that event.
[0048] The same event can be associated with multiple types and database elements. For example, deleting a row may change the size of multiple columns, lists, and indexes. Furthermore, deleting a column may change the number of attributes in many rows. Operation 306 may detect only one or some database elements affected by a specific change, or only some types of changes associated with a given change. Execution instruction 308 may include determining which additional database elements were changed and the type of changes occurring to these additional database elements based on the changes detected in operation 306 and the types of changes occurring to these additional database elements. Alternatively, operation 306 may detect all changed database elements and the types of changes of interest. Figure 5 Further discussion is provided on the types of events that may need to be calculated and how to calculate them.
[0049] Instruction 310 can be executed as part of an analysis performed when instruction 210 is executed. Hardware processor 202 can execute instruction 310 to analyze data recorded in operation 306 and events determined when instruction 308 is executed to determine how unusual the data and events are. For example, statistical analysis can be performed on the data recorded in operation 306 and the events calculated when instruction 308 is executed. Statistical analysis may include comparing current information with previous information associated with the state of the network device. Figures 5 to 8 The discussion further explores statistical analysis. As part of operations 308 and 310, the calculated analyses and statistics can be stored in association with time or timeframes.
[0050] The operation caused by executing instruction 312 can be part of a detection performed by executing instruction 212. Hardware processor 202 can execute instruction 312 to determine whether analysis of the execution of instruction 310 indicates the occurrence of an anomaly. Anomaly detection can be based on the determination of anomalous data or behavior. For example, as part of executing instruction 312, anomalies can be detected based on statistical analysis or other analyses performed in executing instruction 310. For example, hardware processor 202 can execute instruction 312 to determine whether the detection might involve a value that differs from the average or other desired value by a specified amount. If this is true, the value can be determined to be anomalous. Similarly, when executing instruction 312, for example, if the value is greater than a maximum value or less than a minimum value, the value can be determined to be anomalous. Figure 5 The execution of instruction 312 will be discussed further.
[0051] If no anomaly is determined during the execution of instruction 312, computing component 300 resumes execution of instructions 302-310. If an anomaly is determined during the execution of instruction 312, computing component 300 computes a response during the execution of instruction 314. This response may include any combination of the executions of the instructions, and may include any sub-operations of the execution of instruction 314. The sub-operation of executing instruction 316 may be an example of executing instruction 214. As an example of the execution of instruction 314, the response may include causing hardware processor 202 to issue an alarm (in the sub-operation associated with the execution of instruction 316). An alarm indicating an anomaly may be sent. The alarm may be sent to an administrator, allowing the administrator to diagnose the problem. The sub-operation associated with the execution of instruction 316 may involve causing hardware processor 202 to determine the type of alarm to send based on the specific circumstances of the anomaly. Depending on the type of alarm, different messages may be sent in the sub-operation associated with the execution of instruction 316. The sub-operation associated with the execution of instruction 316 may involve determining the severity of the alarm (e.g., low-level alarm, medium-level alarm, or high-level alarm). Sub-operations associated with the execution of instruction 316 may involve determining whether user-configurable criteria for sending an alarm are met.
[0052] Sub-operations 318 and 320 may be part of execution instruction 216, which identifies a network event that caused the anomaly. Hardware processor 202 may execute instruction 318 to send an administrator code or link to a user interface for diagnosing the problem. The code may be a machine instruction. The code may be used for, or the link may be pointed to, UI 110 or 130. For example, the link or code may be sent with an alert or may open automatically in a window of the administrator interface. The administrator may be able to diagnose the cause of the alert through the user interface. For example, the user interface may provide the administrator with data and analyses calculated and recorded in operations 306-310. Sub-operations associated with execution instruction 318 may include sending a link or code to configure criteria that cause an alert to be sent.
[0053] Hardware processor 202 can execute instruction 320 to perform alarm diagnostics to determine the cause of the anomaly or alarm. Sub-operations associated with executing instruction 320 may include identifying network events that caused the anomaly. Identification of network events can be achieved through a user interface provided on the device. Sub-operations associated with executing instruction 320 may include diagnosing the network or network components to determine if they are functioning correctly. A network component may be part of a network, data path, or network device. This diagnostic may be based in part on changes recorded in operation 306, events calculated during the execution of instruction 308, or analysis of the execution of instruction 310. The diagnostics of the sub-operations associated with executing instruction 320 can be performed by an administrator using the user interface of the sub-operations associated with executing instruction 318. Alternatively or additionally, the diagnostics can be performed automatically.
[0054] Hardware processor 202 can execute instructions 322 to take corrective actions. For example, an administrator can take corrective actions through a user interface. Some corrective actions can be performed automatically without administrator intervention. As an example of a corrective action, an administrator can repair network components through a user interface. As another example, network data or routing data can be updated automatically or manually to avoid sending messages through data paths that depend on the network components causing the anomaly.
[0055] Not all Figure 3 The execution of all instructions is necessary, but not all details of every operation are necessary. Figure 3 Different combinations of operations can form their own methods, which can be used as... Figure 3 Part of the method or alternative Figure 3 This can be achieved through methods. Furthermore, different operations can be combined to form a single operation. The above combination... Figure 3 The discussion does not require combination Figure 2All the details of the discussion. For example, in the analysis of operation 310, the statistical analysis performed by executing instruction 210 is only optional and not required. Although Figure 2 The methods include executing instructions 214 (send an alarm) and 216 (identify the reason for the alarm), but Figure 3 The execution of the corresponding instructions, and the execution of instructions 316-320, are optional.
[0056] Figure 4 A flowchart illustrating an example of a method (e.g., including the operation or instruction to be performed) that can be executed as part of execution instruction 304 is shown. Hardware processor 202 can execute instruction 402 to determine the type of change that has occurred. For example, executing instruction 402 may include determining whether the change is an insertion, deletion, update, value change, state change, or other change.
[0057] Hardware processor 202 can execute instruction 404 to determine modified database elements. Executing instruction 404 may involve determining modified rows, modified columns, modified database elements, modified lists, modified database schemas, or modified indexes.
[0058] Executing a combination of instructions 402 and 404 can result in a record describing the changes. For example, executing a combination of instructions 402 and 404 can record that the change to the database is a change to an element in a row of a table and that the type of change is an insert instruction.
[0059] Hardware processor 202 can execute instruction 406 to determine the timing of the change. Instructions 402-404 can be executed in any order or simultaneously.
[0060] Figure 5 A flowchart illustrating an example of a method that computing component 200 or method 300 can use when executing instruction 308 is shown. Figure 5 In the example, executing instruction 308 may include executing instructions 502-536. Execution of instructions 502-522 may involve determining an event based on the changes caused by operations 302-304. Execution of instructions 524-536 may involve calculating more information about the changes that occurred based on the changes recorded during operation 306.
[0061] Hardware processor 202 can execute instruction 502 to determine whether to calculate uptime or inactivity time. Uptime can be the duration during which elements of a network component or data store are started and running (e.g., the lifetime of a data element). Inactivity time can be the duration during which elements of a network component or data store are inactive and not running (e.g., the time during which a data element is not present in a table). For example, decisions made when executing instructions 502, 516, 524, and 528 can be based on the elapsed time of a specific time interval or the occurrence of a specific event. Regarding the execution of instruction 502, it may be desirable to update the uptime or inactivity time after inserting or deleting a database element. If, when executing instruction 502, it is determined that uptime or inactivity time should be updated, the method continues to execute at least those necessary instructions 504-508. If, when executing instruction 502, it is determined that uptime and inactivity time do not need to be updated, the method proceeds to execute instruction 516.
[0062] Hardware processor 202 can execute instruction 504 to determine the current time. Hardware processor 202 can execute instruction 506 to determine the latest deletion time of a database element. Hardware processor 202 can execute instruction 508 to determine the latest insertion time. Executing instructions 504-508 may involve retrieving times recorded during the most recent execution of instruction 306 or in a previous execution of instruction 306.
[0063] If only the current uptime of existing database elements is desired, the execution of instruction 506 can be skipped, as the latest deletion time is not required to calculate the current uptime. If only the current inactivity time of currently missing database elements is desired, the execution of instruction 508 can be skipped, as the latest insertion time is not required to calculate the current inactivity time. If only the settling time is of interest, the execution of instruction 504 can be skipped, as the current time is not required to calculate the settling time. Settling time is the amount of time that a network device's data storage elements remain unchanged.
[0064] Hardware processor 202 can execute instruction 510 to determine if a database element currently exists. If the database element currently exists, the method continues to execute instruction 512, which optionally causes hardware processor 202 to calculate the current uptime or other values of interest. If the database element currently does not exist, the method optionally continues to execute instruction 514, which causes the hardware processor to calculate the current inactivity time or other values of interest. The reason for executing instruction 510 is that if the database element currently does not exist, calculating the current uptime is meaningless, although it might be meaningful to calculate the most recent uptime. Similarly, if the database element currently exists, calculating the current inactivity time is meaningless, but the user may still want to calculate the most recent inactivity time.
[0065] Hardware processor 202 can execute instruction 512 to determine the current uptime according to the following formula: Current uptime = Current time - Last inserted time.
[0066] Alternatively or additionally, the hardware processor 202 may execute instruction 512 to calculate the latest inactivity time according to the following formula: Latest inactivity time = Latest insertion time - Latest deletion time.
[0067] Hardware processor 202 can execute instruction 512 to calculate the latest previous uptime according to the following formula: Latest previous uptime = Next newest deletion time - Previous insertion time. For example, hardware processor 202 can execute instruction 512 to calculate or estimate the uptime of a data path or network device based on the current time and insertion time of the row if the database element is a row.
[0068] If the device is currently inactive, the current inactivity time can be calculated. The execution of instruction 514 can cause the hardware processor 202 to calculate the current inactivity time according to the following formula: Current inactivity time = Current time - Last deletion time.
[0069] Alternatively or additionally, executing instruction 514 may cause hardware processor 202 to calculate the latest uptime according to the following formula: Latest uptime = Latest deletion time - Latest insertion time.
[0070] Hardware processor 202 can execute instruction 514 to calculate the latest previous inactivity time based on the operation performed when instruction 512 was executed, according to the following formula: Latest inactivity time = Latest insertion time - Latest deletion time. As an example of how to use the information derived from the execution of instruction 514, if the database element is a row, the inactivity time of a data path or network device can be calculated or estimated based on the deletion time of the row and the subsequent insertion time of that row. After executing instruction 512 or 514, the method continues to execute instruction 516.
[0071] Hardware processor 202 can execute instruction 516 to determine whether to calculate the settling time of a database element. If the element has been updated, a new latest settling time exists, and it may be necessary to calculate the settling time. If it is determined that the settling time should be calculated, the method continues to execute instruction 518. If it is determined that the settling time should not be calculated, the method continues to execute instruction 524. Hardware processor 202 can execute instruction 518 to determine or retrieve the latest update time of a database element. Hardware processor 202 can execute instruction 520 to determine or retrieve the previous update time of an update that occurred immediately before the latest update. Hardware processor 202 can execute instruction 522 to calculate the settling time, which can be calculated according to the following formula: Settling time = Latest update time - Previous update time.
[0072] Optionally, in addition to other types of updates, the update calculated by executing instruction 522 may also include the insertion and deletion of database elements. Alternatively, the update calculated by executing instruction 522 may not include the insertion or deletion of database elements. When executing instruction 522, the settling time of the data path or network device can be calculated or estimated based on the latest update time of the row and the second most recent update time of that row.
[0073] Hardware processor 202 can execute instruction 524 to determine whether to calculate the number of updates between the insertion and deletion of a row. In one example, if the row has just been deleted, the method can proceed to instruction 526. If no row has been deleted, the method can proceed to instruction 528. Hardware processor 202 can execute instruction 526 to calculate the number of updates between the insertion and deletion of a row (or another database element). The number of state changes can be the number of state changes between two events. If no deletion has occurred, instruction 526 can still be executed to continuously update (correct) the update number between the two events. This can be calculated by incrementing the previous update count since the last insertion by the newly counted update number. Alternatively, the number of updates between two other events can be calculated.
[0074] Hardware processor 202 can execute instructions 528 to determine whether to count the number of state changes for a device or data path. For example, rows in a table may include fields indicating the state of a device or data path. As another example, a database may include metadata indicating the state of database elements. The calculation of the number of state changes may be triggered by the occurrence of an event. For example, if the number of state changes between two events is to be counted, the occurrence of the second event may trigger the calculation of the number of state changes. Alternatively or additionally, the occurrence of a state change may typically trigger an update to the continuous calculation of the number of state changes. Hardware processor 202 can execute instructions 530 to increment a previous count of the number of state changes by a new count of state changes. As an example, executing instructions 530 may include calculating the number of state changes of a database element that occur between inserting and deleting a database element. Executing instructions 530 may also include calculating the frequency of state changes occurring for a given row, a given group of rows, or another database object.
[0075] Hardware processor 202 can execute instruction 532 to determine whether to count the number of list updates that have occurred. The number of list updates can be the number of list updates that have occurred in a given column during the lifetime of the given column or between two events. If the second of two other events has already occurred, the method can continue to execute instruction 534. Alternatively or additionally, if a list update has occurred, the method can continue to execute instruction 534. Hardware processor 202 can execute instruction 534 to increment the previous count of list updates by the new count of list updates. If the number of list updates does not need to be counted at present, the method continues to execute instruction 536. Optionally, executing instruction 534 can involve calculating the frequency of list updates. Hardware processor 202 can execute instruction 534 to determine the number of list updates that have occurred for a column.
[0076] The update frequency, the number of updates between insertions and deletions, the number of state changes, and the number of list updates can be additional indicators of the stability of network devices or data paths. The number of list updates can be an indicator of the stability of a portion of the network. Next, the hardware processor 202 can execute instruction 536 to store the results of the calculations performed during instruction 308.
[0077] Instructions 502-536 can be executed against any combination of rows, columns, indexes, and tables in the database. Instruction groups 502-514, 518-522, 524 and 526, 528 and 530, and 532 and 534 can be executed in any order relative to each other. Each of the above instruction groups can be executed independently of each other or as a separate process. Execution of any of the above instruction groups can be skipped. Instructions 504-508, 518, and 520 can be executed in any order (or simultaneously) relative to each other. The uptime and downtime of columns can correspond to the availability of specific types of data or capabilities of system 100.
[0078] Figure 6 An example of a method executed by computing component 200 or method 300 when executing instruction 310 is shown. Hardware processor 202 may execute instruction 604 to compare previous events with recently observed, measured, or calculated events. Hardware processor 202 may execute instruction 604 to compare previous data with recently observed or calculated data. The comparison performed when executing instruction 604 may involve statistical analysis or other forms of comparison.
[0079] Hardware processor 202 can execute instruction 606 to perform statistical analysis. Executing instruction 606 may include calculating statistics on changes associated with different database elements. Executing instruction 606 is optional. Executing instruction 608 may include performing statistical analysis on changes to rows (in the execution of instruction 610), columns (in the execution of instruction 612), and indexes (in the execution of instruction 614). Execution of any instruction 610-614 may be skipped. As examples of calculations that may be included in the statistical analysis, parameters such as mean, median, minimum, maximum, and / or standard deviation may be calculated. For example, these parameters may be calculated for the number of updates during uptime, inactive time, stable time, or a specific time interval. Similarly, the mean, median, minimum, maximum, and standard deviation may be calculated for the number of state changes and list updates during a given time interval. The time interval for performing the statistical analysis may be a fixed amount of time, the time between two events, or a continuous calculation that is adjusted as new events occur or new data is received. For example, a fixed time interval could be one second, one minute, fifteen minutes, half an hour, one hour, one day, or one month. For example, these two events could be the insertion of a database element and the subsequent deletion of a database element.
[0080] The hardware processor 202 can execute instruction 616 to compare statistical parameters with previously calculated statistical parameters. When executing instruction 616, it can be determined whether the deviation between the current statistical parameter and the previous statistical parameter is within each other's thresholds.
[0081] The threshold can be based on standard deviation. The threshold can be based on the deviation from the target value, mean, median, maximum, or minimum value, or other parameters calculated when executing instruction 614. For example, it can be determined whether the update frequency is within four standard deviations of the frequency of the updated mean. As another example, it can be determined whether the deviation is greater than 1 standard deviation, 1.5 standard deviations, 2 standard deviations, 2.5 standard deviations, 3 standard deviations, 3.5 standard deviations, or another standard deviation amount deviating from the mean. As another example, the threshold can be a previous maximum value, a previous minimum value, a percentage of a previous maximum value, or a percentage of a previous minimum value. The percentage of a previous maximum value or a previous minimum value can be greater than or less than 100%.
[0082] Hardware processor 202 can execute instruction 618 to update statistical parameters (or other parameters used for comparisons performed when instruction 616 is executed). As a result of executing instruction 618, the updated statistical parameters will be used as the previous statistical parameters when performing the comparison the next time instruction 616 is executed.
[0083] Alternatively or additionally, the hardware processor 202 may execute instruction 604 to establish parameters for a threshold based on, for example, industry standards, theoretical calculations, customer expectations, service quality, or other criteria, and to compare previous events with current events. Instructions 610-614 may be executed in any order relative to each other, and instructions 616 and 618 may be executed in any order relative to each other.
[0084] Figure 7 Another example of a method is shown that can be executed by computation component 200 or method 300 as part of execution instructions 210, 310, or 604. Hardware processor 202 can execute instruction 702 to establish a baseline value or retrieve a parameter and compare it to the current value of that parameter. The baseline and acceptable deviation for comparison with the parameter can be continuously updated and can change over time. For example, the baseline can be based on parameter values of other similar elements or on previous values of the same parameter of the same element. For example, the baseline can include the mean or median. For example, the deviation from the baseline can involve the standard deviation, maximum, or minimum value.
[0085] Hardware processor 202 can execute instruction 704 to perform a self-comparison, wherein a previous value is used as the baseline of the current value. Hardware processor 202 can execute instruction 704 to compare the parameter of an element with previous values of the parameter of the same element. For example, the average number of updates to a row during the most recent time window can be compared with the average number of updates over several previous windows. For example, it can be determined whether the current average of the most recent window is within 3 standard deviations from the previous averages of the most recent 10 windows. In the execution of instruction 704, the deviation can be based on a previous standard deviation from the previous average, or on a previous maximum or minimum value.
[0086] Hardware processor 202 can execute instruction 706 to compare a statistical parameter with a baseline based on peers of the same type. This comparison can be performed between elements and other peers, and can be performed on a per-peer basis (in the sub-operation associated with the execution of instruction 708) or over all peers (in the sub-operation associated with the execution of instruction 710). For example, hardware processor 202 can compare a given parameter of a given element with the value of that parameter of other elements of the same type on an element-by-element basis (in the sub-operation associated with the execution of instruction 708), or it can compare it with the average of that parameter based on all elements of the same type (in the sub-operation associated with the execution of instruction 710). As another example, the number of changes to one column during a time frame can be compared with the number of changes to other columns during the same time frame to determine if the difference is less than a threshold number of changes; this can be performed on a column-by-column basis (in the sub-operation associated with the execution of instruction 708), or the comparison can be performed with the average number of changes to all columns. As another example, the update frequency of a given row can be compared with the update frequency of other rows to determine whether the two values are within a given threshold difference from each other.
[0087] Similarly, hardware processor 202 can execute instruction 712 to compare statistical parameters to a baseline based on the group of elements. For example, the parameter of the current database element can be compared to the average of the same parameter calculated for a group of database elements (e.g., a peer group) (in the sub-operation associated with the execution of instruction 714), or by comparing the average of the parameter calculated for a different peer group to the average of the parameter calculated for another peer group (in the sub-operation associated with the execution of instruction 716). For example, the parameter could be the update frequency of rows, and the sub-operation associated with the execution of instruction 714 could cause hardware processor 202 to compare it to the average update frequency of a group of rows. As a similar example, the sub-operation associated with the execution of instruction 716 could cause hardware processor 202 to compare the average update frequency of one group of rows to the average update frequency of another group of rows or to the average frequency of all group of rows. Figure 7 The instructions can be executed in any order relative to each other. Figure 7 Any instruction can be executed simultaneously relative to each other. It can be skipped. Figure 7 The execution of any instructions.
[0088] In the execution of instructions 706-712, the deviation can be based on the standard deviation, maximum or minimum value of the group compared with the current parameter.
[0089] Figure 8 It shows how it can be performed. Figure 6 Examples of any of instructions 610-612. Hardware processor 202 can execute instruction 802 as part of a statistical calculation, while simultaneously executing instruction 604 at different time intervals. Figure 6 ) or execute instruction 702 ( Figure 7 Execution instruction 802 may include calculating Type I and Type II statistics. Hardware processor 202 may execute instruction 804 to calculate statistics (Type I statistics) for different time windows. Execution instruction 804 may include performing statistical analysis on a per-window basis on multiple data windows, where each data window includes data collected during different time windows. For example, a comparison associated with execution instruction 804 may include comparing statistical analysis of a first window with statistical analysis of a second window.
[0090] Optionally, when executing instruction 804, the first window and the second window can share common attributes. For example, the two windows can be the same time of day, the same time of week, the same time of month, or the same time of year. For example, statistics can be calculated for each hour of each day, so that statistics for a specific hour of a day can be compared with statistics for the same hour of other days. Time windows can include several quarters, months, or days of a year. Time windows can include quarter groups, month groups, and day groups. Windows can include time periods of 12 hours, 11 hours, 10 hours, 9 hours, 8 hours, 7 hours, 6 hours, 5 hours, 4 hours, 3 hours, 2 hours, half an hour, or other time intervals. One can expect that statistics for the same time of day on different days may share similar characteristics. Similarly, one can expect that statistics for the same time of day in different weeks, statistics for the same time of day in different months, statistics for the same part of a year in different years, or statistics for the same quarter in different years may share common characteristics. For example, the average number of rows updated between 1:00 AM and 2:00 AM on different days may be closer to each other than the average number of updates between 1:00 PM and 2:00 PM on the same day.
[0091] Hardware processor 202 can execute instruction 806 to calculate aggregated statistics. For example, aggregated statistics may include counts, totals, averages, medians, standard deviations, maximums, minimums, or any parameter calculation requiring multiple data points. The aggregated statistics calculated when executing instruction 806 may require more data points or a longer time period than the execution of other instructions. For example, executing instruction 806 may require aggregating parameters from multiple windows. Executing instruction 806 may include aggregating parameters from a specific number of recent windows. Executing instruction 806 may include aggregating parameters from data and events occurring after a specific time. Executing instruction 806 may aggregate parameters that the calculation component 200 or method 300 has been monitoring a given table or database for the entire time. The parameters of instruction 806 may be statistics or other parameters characterizing or summarizing the data and events of the execution of instructions 206, 208, 302-308, or the parameters of the execution of instructions 604 and 702. Hardware processor 202 can execute instruction 808 to calculate presence statistics. Figure 8 Instructions 804-808 can be executed in any order relative to each other. Figure 8 Instructions 804-808 can be executed simultaneously relative to each other. They can be skipped. Figure 8 The execution of any instructions.
[0092] Those skilled in the art will recognize that to monitor network functionality, it is necessary to monitor the devices and links that make up the network, not changes to the database. Therefore, monitoring a network by monitoring changes to database tables or other tables that store network or routing information is not obvious. Furthermore, computing component 200 or method 300 can provide a unique set of data in one location that is useful for manually or automatically diagnosing or repairing network problems. The value of having this unique set of data in one location in facilitating network diagnosis and repair has not been recognized in existing systems.
[0093] Figure 9 A block diagram of an example computer system 900 in which various examples described herein may be implemented is shown. The computing system 900 may include an edge device 140 or a switch 120. A computing component 200 or method 300 may be part of the computer system 900. The computer system 900 includes a bus 902 or other communication mechanism for transmitting information, and one or more hardware processors 904 coupled to the bus 902 for processing information. The hardware processors 904(multiple) have a description similar to that of hardware processors 202 or 302.
[0094] Computer system 900 also includes main memory 906, which has a description similar to machine-readable storage 204 or 304. Main memory 906 may be coupled to bus 902 and is used to store information and instructions to be executed by processor 904. Main memory 906 may store instructions for monitoring changes to the database and sending alerts. Main memory 906 may store routing table 108 and UI 110. Main memory 906 may store data storage 122, NAC 126, and UI 130. Main memory 906 may store information for implementing... Figure 2-8Machine instructions for associated methods. Main memory may store data and events characterizing changes to database elements. For example, main memory may store existence information, window information, aggregation information, and statistical analysis of changes to tables. Computer system 900 may be coupled to display 912, input device 914, and cursor control 916 via bus 902. Display 912 displays information to the computer user. Input device 914 may include a hardware user interface that transmits information and command selections to processor 904. Cursor control 916 may include a hardware user-operated device that transmits direction information and command selections to processor 904 and is used to control cursor movement on display 912. Input device 914 may be used by an administrator to interact with the user interface or network UI to analyze the causes of anomalies in data and events. Multiple network interfaces 918 may be used to connect computer system 900 to one or more networks, such as LANs 102 and 118 and network 132, to send and receive messages. Multiple network interfaces 918 allow users to access computer system 900 via UI 110 or 130.
[0095] Although databases and database elements have been discussed as examples, any data store or data store element can be used. For example, a table element that is not associated with a database can be used instead of a database element. The methods and systems described herein also work in other systems that store data in the form of databases, file systems, or data elements arranged in a manner that does not include tables (or can be used with another data store).
[0096] Generally, as used herein, the words “component,” “engine,” “system,” “database,” “data storage,” etc., can refer to logic implemented in hardware or firmware, or to a set of software instructions that may have entry and exit points. Unless otherwise expressly stated, the terms and phrases used in this document, and their variations, should be interpreted as open-ended rather than restrictive. Adjectives and terms with similar meanings such as “conventional,” “traditional,” “normal,” “standard,” “known,” etc., should not be interpreted as limiting the described item to a given time period or items available at a given time, but should be understood to include conventional, traditional, normal, or standard technologies that may be available or known at any time now or in the future. In some cases, the appearance of expansive words and phrases such as “one or more,” “at least,” “but not limited to,” or other similar phrases should not be interpreted as an intention or necessity to narrow the scope where such expansive phrases could be used.
Claims
1. A method for detecting anomalies, comprising: Based on changes in connections between network devices, determine the number of changes to one or more elements of historical data storage within a time window. The historical data storage includes the time and type of the data storage event. The data storage event includes the type of change that occurs in the data storage table due to changes in network information. The type of change includes one or more of the following: row deletion in the data storage table in response to inactive connections between network devices, and row insertion in response to active connections between network devices. Based on the current time and the insertion time of the row in the data storage table, determine the uptime associated with the connection between the network devices; Based on the deletion time of a row in the data storage table and the subsequent insertion time of that row, the inactivity time associated with the connection between the network devices is determined; Based on the number of changes to the one or more elements, the uptime, and the inactivity time, calculate current information associated with the changes to the connection between the network devices; Perform statistical analysis, which includes comparing the current information with previous information associated with the connection between the network devices; Based on the statistical analysis, anomalies are detected within the current information; Send an alert indicating the detection of the anomaly; as well as Provide the user interface with an identifier of the network event that caused the anomaly.
2. The method according to claim 1, wherein the type of the data storage event includes the update of an element of the data storage table.
3. The method according to claim 1, wherein the type of the data storage event includes the insertion of an element of the data storage table.
4. The method according to claim 1, wherein the type of the data storage event includes the deletion of an element of the data storage table.
5. The method of claim 1, wherein the network device comprises one or more of the following: a router and a switch, and wherein the data storage table comprises one or more of the following: a routing table and a forwarding table.
6. The method of claim 1, wherein the time window comprises the amount of time between the insertion of the element in the data storage table and the deletion of the element in the data storage table.
7. The method of claim 6, wherein the current information includes parameters, the parameters including one or more of the following: an average, median, minimum, maximum, or frequency of change calculated from the number of changes to the one or more elements determined within the time window, and wherein the method includes: Calculate the deviation between the parameter and the previous information; as well as Determine that the deviation is greater than the threshold. The anomaly is detected in response to the determination that the deviation is greater than the threshold.
8. The method of claim 1, wherein the change in the data storage table includes a change to the index of the data storage table.
9. The method according to claim 1, further comprising: The settling time of the data path is calculated based on the latest update time of the row and the second latest update time of the row.
10. A computing component, comprising: Hardware processor; as well as Non-volatile memory, the non-volatile memory storing one or more instructions, the one or more instructions causing the hardware processor, when executed by the hardware processor, to: Based on changes in connections between network devices, determine the number of changes to one or more elements of historical data storage within a time window. The historical data storage includes the time and type of the data storage event. The data storage event includes the type of change that occurs in the data storage table due to the changes in the connections between network devices. The type of change includes one or more of the following: row deletion in the data storage table in response to inactive connections between network devices, and row insertion in response to active connections between network devices. Based on the current time and the insertion time of the row in the data storage table, determine the uptime associated with the connection between the network devices; Based on the deletion time of a row in the data storage table and the subsequent insertion time of that row, the inactivity time associated with the connection between the network devices is determined; Based on the number of changes to the one or more elements, the uptime, and the inactivity time, calculate current information associated with the changes to the connection between the network devices; Perform statistical analysis, which includes comparing the current information with previous information associated with the connection between the network devices; Based on the statistical analysis, anomalies are detected within the current information; Send an alert indicating the detection of the anomaly; as well as Provide the user interface with an identifier of the network event that caused the anomaly.
11. The computing component of claim 10, wherein one or more instructions further cause the hardware processor to: When inserting a row, information about the row is collected; and When a row is deleted, the information collected about that row is discarded.
12. The computing component of claim 10, wherein: The statistical analysis, performed on a per-window basis, is carried out across multiple data windows, each including data collected during different time windows; and The comparison includes comparing the statistical analysis of the first window with the statistical analysis of the second window.
13. The computing component of claim 10, wherein the one or more instructions further cause the hardware processor to: establish baseline values for parameters of the one or more elements, the baseline values being based on a set of elements sharing common attributes, wherein the statistical analysis compares the average value of the parameters of the one or more elements with the baseline values.
14. The computing component of claim 10, wherein the time window includes the amount of time between the insertion of the element in the data storage table and the deletion of the element in the data storage table.
15. A computing component, comprising: Hardware processor; as well as Non-transient memory, which stores one or more instructions, which, when executed by the hardware processor, cause the hardware processor to: Based on changes in data paths, determine the number of changes to one or more elements of historical data storage within a time window. The historical data storage includes the time and type of the data storage event. The data storage event includes the type of change that occurs in the data storage table due to changes in network information. The type of change includes one or more of the following: row deletion in the data storage table in response to an inactive data path and row insertion in response to an active data path. Based on the current time and the insertion time of the row in the data storage table, determine the uptime associated with the data path; Based on the deletion time of a row in the data storage table and the subsequent insertion time of that row, determine the inactivity time associated with the data path; Based on the number of changes to the one or more elements, the uptime, and the inactivity time, calculate the current information associated with the changes to the data path; Perform analysis, which includes comparing the current information with defined criteria associated with the changes in the data path; Based on the analysis, anomalies are detected within the current information; as well as Send an alert indicating the detection of the anomaly.
16. The computing component of claim 15, wherein the comparison comprises: Calculate the deviation of the current information relative to previous information associated with the change in the data path; as well as Determine whether the deviation is greater than a threshold.
17. The computing component of claim 16, wherein one or more instructions further cause the hardware processor to: The threshold can be adjusted via the user interface.
18. The computing component of claim 15, wherein the change occurring in the data storage table includes a change to the list of elements.
Citation Information
Patent Citations
Method and system for monitoring control signal traffic over a computer network
US20030037136A1