Network Device Audit Logs Using Pointer-Based Configuration Storage

Solution Overview

Problem

Existing network management systems face challenges in efficiently storing and managing large volumes of network events due to high storage requirements and limitations on the number of events, leading to loss of critical information and inconsistent availability, which hampers network diagnosis and debugging.

Innovation Solution

A network management system (NMS) stores event information with pointers to network information, reducing duplication and storage needs, and uses a separate time series store for configuration data, allowing for extended event logging and improved query capabilities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of information

If network management systems store complete event information including network information in event stores, then event information is readily available for queries, but storage space requirements increase significantly

Engineering Contradiction:

Improveevent information availabilityVSAvoidstorage space utilization

Core Design Contradiction:

Loss of informationVSVolume of stationary object

Solution Approach 1:

The patent extracts network information from event stores and places it in a separate time series store. Event stores only store pointers to network information, not the actual network information. This separation allows event stores to remain lightweight while still providing access to comprehensive event data through the time series store.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces a time series store as an intermediary between event stores and network information. The time series store maintains historical network information in a structured format, and event stores reference this stored information through pointers. This intermediary layer enables efficient storage and retrieval without duplication.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Loss of information

If network management systems increase the quantity of stored event information, then more historical data is available for diagnosis, but resource utilization increases

Engineering Contradiction:

Improvehistorical event data availabilityVSAvoidresource utilization

Core Design Contradiction:

Loss of informationVSQuantity of substance

Solution Approach 1:

The patent extracts network information from event stores and places it in a separate time series store. Event stores only store pointers to network information, not the actual network information. This separation allows event stores to remain lightweight while still providing access to comprehensive event data through the time series store.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent changes the storage parameter from storing complete event data to storing only pointers and metadata. This parameter change allows the system to maintain a much larger quantity of historical events while using significantly less storage resources, as only the pointers and event metadata are stored in the event store.

Inventive Principle:

Principle #35Parameter changes

3Duration of action of stationary object

If network management systems store events for longer periods, then more diagnostic information is available, but storage capacity is consumed

Engineering Contradiction:

Improveevent retention periodVSAvoidstorage capacity

Core Design Contradiction:

Duration of action of stationary objectVSVolume of stationary object

Solution Approach 1:

The patent extracts network information from event stores and places it in a separate time series store. Event stores only store pointers to network information, not the actual network information. This separation allows event stores to remain lightweight while still providing access to comprehensive event data through the time series store.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent segments the storage system into two distinct parts: event stores for storing event metadata and pointers, and a time series store for storing historical network information. This segmentation allows independent scaling and retention policies for each component, enabling long-term retention without proportional increase in overall storage capacity.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS20250219903A1Audit-log for managing network devices

Publication Date: 2025.07.03 JUNIPER NETWORKS INC

AI summary

A system includes computer-readable media configured to store an event store associated with a network. Processing circuitry, in response to a determination that an event associated with the network device has occurred stores, at a time series store, configuration information for a network device in the network and stores, at the event store, event information comprising a pointer to the configuration information and an indication of a time that the event occurred. In response to receiving a request for data corresponding to the event, the processing circuitry determines, using the event information in the event store, the pointer to the network information for the event, obtains, from the time series store, the configuration information for the event using the pointer, generates a response to the request based on the configuration information obtained from the time series store, and outputs the response to the request.