Recording, replay, and sharing of live network monitoring views
Network monitoring views can be recorded, replayed and shared. A monitoring system receives monitoring data, in response to which a monitoring view can be constructed. The monitoring data is maintained in memory or mass storage. One or more monitoring views can later be constructed in response to user preferences, even if those users would not have known to select those particular preferences or construct those particular monitoring views at the time. The monitoring views constructed in response to that monitoring data can be presented to users in a simulation of the problem, as if it were occurring at that time. Users can send particular monitoring views to others, with both the effects that the monitoring view can be preserved as part of a trouble report, and the persons receiving the monitoring view can have useful insight into what problem the user has pointed to.
1. A method of monitoring network data, the method comprising:
during a first period of time:
receiving, in real-time, a set of network monitoring data from a plurality of endpoints of a network including one of a processing and storage device, the processing and storage device being capable of sending or receiving network traffic through the network;
mapping the received set of network monitoring data to a plurality of entities of the network;
presenting, in real-time, to a user, one or more monitoring views, the one or more monitoring views identifying a subset of the plurality of entities of the network and identifying changes in operation of the network based on the set of network monitoring data;
analyzing, after presenting the one or more monitoring views during the first period of time, at least a subset of the set of network monitoring data;
identifying an alarm condition based on analyzing the at least the subset of the set of network monitoring data, the alarm condition occurring at a particular time within the first period of time, the alarm condition not being indicated within the presentation;
during a second period of time, the second period of time beginning after an end of the first period of time:
receiving a request for a first simulation of the network using the at least the subset of the set of network monitoring data;
simulating at least a portion of the first simulation of the network using the at least the subset of the set of network monitoring data and the first simulation including the alarm condition, the alarm condition being indicated during the first simulation when simulating the particular time within the first period of time; and
presenting the at least the portion of the first simulation of the network, the presenting including the alarm condition when simulating the particular time within the first period of time.
2. The method as in claim 1 , wherein the set of network monitoring data including measures of network traffic such as bit rate and packet rate of the network traffic.
3. The method as in claim 1 , wherein parameters of the network include a bit rate of the network traffic, a packet rate of the network traffic, an interaction rate, and burstiness, the interaction rate being a measure of a particular endpoint of the network with other entities of the network, the burstiness being a measure of a rate of change of bit rate for the particular endpoint of the network.
4. The method as in claim 1 , wherein the analyzing includes analyzing an exponential moving average of one or more parameters of the network.
5. The method as in claim 4 , wherein the analyzing includes comparing the exponential moving average with user-defined thresholds.
6. The method as in claim 1 , wherein the entities of the network include: endpoints of the network, an application of the network, a location of the network, or a flow interface of the network.
7. The method as in claim 1 , wherein the identifying the alarm condition did not occur during the first period of time.
8. The method as in claim 1 , wherein simulating the at least the portion of the first simulation includes simulating the alarm condition at a point in time where the alarm condition takes place as if the alarm condition was occurring in real-time.
9. A method, including steps of:
receiving, during a first period of time, a set of network monitoring data from a plurality of endpoints of a network including one of a processing and storage device, the processing and storage device being capable of sending or receiving network traffic through the network;
mapping the received set of network monitoring data to one or more entities of the network;
presenting, in real-time, one or more live network monitoring views, the one or more live network monitoring views identifying a subset of the one or more entities of the network and identifying changes in operation of the set of network monitoring data;
analyzing, after presenting the one or more live network monitoring views during the first period of time, at least a subset of the set of network monitoring data, the analyzing being based at least on maximum and minimum values of one or more parameters of the network;
identifying an alarm condition based on analyzing the at least the subset of the set of network monitoring data, the alarm condition occurring at a particular time within the first period of time, the alarm condition not being indicated within the presentation;
receiving, from a user during a second period of time, a request for a first simulation of the network using the at least the subset of the set of network monitoring data, the first simulation of the network including the one or more live network monitoring views, the second period of time beginning after an end of the first period of time;
simulating at least a portion of the first simulation of the network using the at least the subset of the set of network monitoring data and the first simulation including the alarm condition, the alarm condition being indicated during the first simulation when simulating the particular time within the first period of time;
presenting the at least the portion of the first simulation of the network, the presenting including the alarm condition when simulating the particular time within the first period of time;
receiving, during the presenting, an indication to change one or more parameters associated with a particular behavior of the network, the one or more parameters being associated with the alarm condition;
dynamically adjusting, in real-time, the first simulation, based on the indication to change the one or more parameters, the first simulation substituting the one or more parameters during the first simulation, a relationship of the particular behavior with the one or more parameters not having been computed during the first period of time; and
presenting, in real-time, the first simulation after the dynamic adjustment.
10. The method as in claim 9 , wherein the set of network monitoring data includes measures of network traffic such as bit rate and packet rate of the network traffic.
11. The method as in claim 9 , wherein the set of network monitoring data includes measures of network traffic such as bit rate and packet rate of the network traffic.
12. The method as in claim 9 , wherein the parameters of the network include a bit rate of the network traffic, a packet rate of the network traffic, an interaction rate, and burstiness, the interaction rate being a measure of a particular endpoint of the network with other entities of the network, the burstiness being a measure of a rate of change of bit rate for the particular endpoint of the network.
13. The method as in claim 9 , wherein the analyzing includes analyzing an exponential moving average of one or more parameters of the network.
14. The method as in claim 13 , wherein the analyzing includes comparing the exponential moving average with user-defined thresholds.
15. The method as in claim 9 , wherein the entities of the network include: endpoints of the network, an application of the network, a location of the network, or a flow interface of the network.
16. The method as in claim 9 , wherein the identifying the alarm condition did not occur during the first period of time.
17. The method as in claim 9 , wherein simulating the at least the portion of the first simulation includes simulating the alarm condition at a point in time where the alarm condition takes place as if the alarm condition was occurring in real-time.