Grey failure detection on network operating system
Systems, methods, and computer-readable media are provided for detecting grey failures on a network. An example method can include receiving, by a network controller, event data for a network node, generating, by the network controller, a first metric and a second metric based on the event data, determining, by the network controller, a first pattern of growth of the first metric and a second pattern of growth of the second metric over a sliding window, determining, by the network controller, a correlation across the first metric and the second metric based on the first pattern and the second pattern, and determining, by the network controller, a grey failure of the network node based on the correlation.
1 . A method for detecting grey failures on a network, the method comprising:
receiving, by a network controller, event data for a network node, the event data including a collection of independent parameters associated with performance of the network;
generating, by the network controller, a first metric and a second metric based on the event data, wherein the first metric is associated with a first network parameter received as part of the event data and the second metric is associated with a second network parameter received as part of the event data, the first network parameter being independent of the second network parameter;
determining, by the network controller, a first pattern of growth of the first metric and a second pattern of growth of the second metric over a sliding window, wherein determining the first pattern of growth and the second pattern of growth comprises identifying a growth curve for each respective metric over the sliding window;
determining, by the network controller, a correlation across the first metric and the second metric based on the first pattern and the second pattern, wherein determining the correlation comprises determining that the growth curve of the first metric and the growth curve of the second metric exhibit similar trends within the sliding window; and
determining, by the network controller, a grey failure of the network node based on the correlation.
2 . The method of claim 1 , wherein,
the first metric is a number of drop packet captures per flow, and
determining the first pattern of growth of the first metric includes determining that an output rate of the network node is less than an input rate of the network node for a flow during the sliding window.
3 . The method of claim 1 , wherein the first metric includes an in/out packet counter per network node, and wherein the first pattern of growth indicates a network node traffic delta.
4 . The method of claim 1 , further comprising:
receiving, by the network controller, a selection by a user to track the first network parameter.
5 . The method of claim 1 , wherein determining the correlation includes an analysis based on one or more relation functions, sampled network parameter data, threshold classifications, and historical event data.
6 . The method of claim 1 , wherein the event data is hierarchically sent from the network node to the network controller through a network of the network controller and the network node.
7 . The method of claim 6 , wherein the network node is a leaf network node of the network.
8 . One or more non-transitory computer-readable media comprising computer-readable instructions stored thereon, wherein the computer-readable instructions, when executed by one or more processors of a network controller, cause the one or more processors to:
receive event data for a network node, the event data including a collection of independent parameters associated with performance of the network;
generate a first metric and a second metric based on the event data, wherein the first metric is associated with a first network parameter received as part of the event data and the second metric is associated with a second network parameter received as part of the event data, the first network parameter being independent of the second network parameter;
determine a first pattern of growth of the first metric and a second pattern of growth of the second metric over a sliding window, wherein determining the first pattern of growth and the second pattern of growth comprises identifying a growth curve for each respective metric over the sliding window;
determine a correlation across the first metric and the second metric based on the first pattern and the second pattern, wherein determining the correlation comprises determining that the growth curve of the first metric and the growth curve of the second metric exhibit similar trends within the sliding window; and
determine a grey failure of the network node based on the correlation.
9 . The one or more non-transitory computer-readable media of claim 8 , wherein,
the first metric is a number of drop packet captures per flow, and
execution of the computer-readable instructions, by the one or more processors, cause the network controller to determine the first pattern of growth of the first metric includes determining that an output rate of the network node is less than an input rate of the network node for a flow during the sliding window.
10 . The one or more non-transitory computer-readable media of claim 8 , wherein the first metric includes an in/out packet counter per network node, and wherein the first pattern of growth indicates a network node traffic delta.
11 . The one or more non-transitory computer-readable media of claim 8 , wherein execution of the computer-readable instructions, by the one or more processors, cause the network controller to:
receive a selection by a user to track the first network parameter.
12 . The one or more non-transitory computer-readable media of claim 8 , wherein execution of the computer-readable instructions, by the one or more processors, cause the network controller to determine the correlation by analyzing, based on one or more relation functions, sampled network parameter data, threshold classifications, and historical event data.
13 . The one or more non-transitory computer-readable media of claim 8 , wherein the event data is hierarchically sent from the network node to the network controller through a network of the network controller and the network node.
14 . The one or more non-transitory computer-readable media of claim 13 , wherein the network node is a leaf network node of the network.
15 . A network controller comprising:
one or more processors; and
one or more memories configured to store computer-readable instructions thereon, which when executed by the one or more processors, cause the one or more processors to:
receive event data for a network node, the event data including a collection of independent parameters associated with performance of the network;
generate a first metric and a second metric based on the event data, wherein the first metric is associated with a first network parameter received as part of the event data and the second metric is associated with a second network parameter received as part of the event data, the first network parameter being independent of the second network parameter;
determine a first pattern of growth of the first metric and a second pattern of growth of the second metric over a sliding window, wherein determining the first pattern of growth and the second pattern of growth comprises identifying a growth curve for each respective metric over the sliding window;
determine a correlation across the first metric and the second metric based on the first pattern and the second pattern, wherein determining the correlation comprises determining that the growth curve of the first metric and the growth curve of the second metric exhibit similar trends within the sliding window; and
determine a grey failure of the network node based on the correlation.
16 . The network controller of claim 15 , wherein,
the first metric is a number of drop packet captures per flow, and
the one or more processors are configured to execute the computer-readable instructions to determine the first pattern of growth of the first metric by determining that an output rate of the network node is less than an input rate of the network node for a flow during the sliding window.
17 . The network controller of claim 15 , wherein the first metric includes an in/out packet counter per network node, and wherein the first pattern of growth indicates a network node traffic delta.
18 . The network controller of claim 15 , wherein the one or more processors are configured to execute the computer-readable instructions to:
receive a selection by a user to track the first network parameter.
19 . The network controller of claim 15 , wherein the one or more processors are configured to execute the computer-readable instructions to determine the correlation by analyzing, based on one or more relation functions, sampled network parameter data, threshold classifications, and historical event data.
20 . The network controller of claim 15 , wherein the event data is hierarchically sent from the network node to the network controller through a network of the network controller and the network node.