Self-learning and best-practice profiling and alerting with relative and absolute capacity
View Patent ↗For example, as indicated in the Incorporated Disclosures, rapid change from relatively little use of network bandwidth, to heavy overuse of network bandwidth (combined with a large number of endpoints attempting to access that network bandwidth) can often indicate an email virus or other maladjusted use of the system. In such cases, it could be appropriate to generate an alert, and bring the change to the attention of a human expert, or otherwise escalate the problem. Best practices In this Application, the phrase “best practices,” and variants thereof, can generally refer to business preferences (and to business rules imposed by management, or law or regulation), such as high utilization preferences often expressed by management. In such cases, one or more operators can enter descriptors of rules the system that it is desired the system follow, such as “processor cycle utilization >90%.” When these best practices are not followed, it could be appropriate to generate an alert, bring the change to the attention of a human expert, or otherwise escalate the problem. Profiling and alerting In this Application, the phrase “profiling and alerting,” and variants thereof, can generally refer to maintaining a profile of how the system normally behaves, absent stressors, and to identify any substantial changes from that profile. When a profile is seriously violated, it could be appropriate to generate an alert, bring the change to the attention of a human expert, or otherwise escalate the problem. In such cases, it can be appropriate to escalate the severity of the alert with increased severity of violation, increased time duration of the violation, and increased trajectory in the direction of further violation. Relative and absolute capaci-ty In this Application, the phrase “absolute capacity,” and variants thereof, can refer to an objective measure of system capacity, such as whether the system has 1 TB or 4 TB of memory. The phrase “relative capacity,” and variants thereof, can refer to a subjective measure of system capacity, such as when the system has 4 TB of physical memory, but 3.5 TB of that memory are allocated to a high-priority task whose interruption or pause would be untoward.
1. Apparatus including
a network monitoring device, the network monitoring device responsive to network status data from one or more reporting devices coupled to a distributed network monitoring environment, the one or more reporting devices providing the network status data with respect to more than one function to be performed by network devices, the distributed network monitoring environment including a plurality of endpoints coupled thereto and disposed to access resources available using the distributed network monitoring environment;
the network monitoring device including one or more automated processes that provide, in response to the network status data, a profile of normal activity of the distributed network monitoring environment, wherein a rapid deviation from normal activity of the distributed network monitoring environment provides a reliable indicator of changes in use of the distributed network monitoring environment, the automated processes providing the profile of normal activity of the distributed network monitoring environment using self learning in response to the network status data;
the network monitoring device being coupled to business rules defining a set of best practices of operation of the distributed network monitoring environment, wherein the best practices rules are described by a scripting language in response to management;
the network monitoring device providing an alert to one or more operators in response to the network status data indicating that the distributed network monitoring environment falls outside the profile of normal activity, either with respect to the total capacity of the distributed network management environment, or with respect to the relative capacity of the distributed network management environment;
the network monitoring device providing an alert to one or more operators in response to the network status data indicating that the distributed network monitoring environment falls outside the set of best practices of operation, either with respect to the total capacity of the distributed network management environment, or with respect to the relative capacity of the distributed network management environment.
2. Apparatus as in claim 1 ,
wherein the rapid deviation from normal activity includes one or more of:
rapid change in number of database requests, combined with rapid change in number of endpoints making database requests;
rapid change in data storage usage, combined with allocation of data storage usage to a small number of endpoints occupying the bulk of the data storage usage;
rapid change in usage of network bandwidth, combined with rapid change in number of endpoints attempting to access network bandwidth;
rapid change in processor usage, combined with rapid change in number of endpoints attempting to access processor usage;
rapid change in virtual desktop usage, combined with allocation of virtual desktop usage to a small number of endpoints occupying the bulk of the virtual desktop usage;
rapid change in virtual machine usage, combined with allocation of virtual desktop usage to a small number of endpoints occupying the bulk of the virtual desktop usage.
3. Apparatus as in claim 1 ,
wherein the set of best practices includes one or more of:
rules imposed by management,
rules imposed by law or regulation.
4. Apparatus as in claim 1 ,
wherein the set of best practices includes one or more of:
a rule requiring utilization of a selected resource to be less than a selected threshold;
a rule requiring utilization of a selected resource to fall within a selected range;
a rule requiring utilization of a selected resource to exceed a selected threshold.
5. Apparatus as in claim 4 ,
wherein the selected resource includes one or more of:
database usage, data storage usage, network bandwidth usage, processor usage, virtual desktop usage, virtual machine usage.
6. Apparatus as in claim 4 ,
wherein the utilization distinguishes between absolute capacity and relative capacity.
7. A method of operating a network monitoring device, the method including steps of
coupling the network monitoring device to network status data from one or more reporting devices coupled to a distributed network monitoring environment, the one or more reporting devices providing the network status data with respect to more than one function to be performed by network devices, the distributed network monitoring environment including a plurality of endpoints coupled thereto and disposed to access resources available using the distributed network monitoring environment;
performing, by the network monitoring device, one or more automated processes that provide, in response to the network status data, a profile of normal activity of the distributed network monitoring environment, wherein a rapid deviation from normal activity of the distributed network monitoring environment provides a reliable indicator of changes in use of the distributed network monitoring environment, the automated processes providing the profile of normal activity of the distributed network monitoring environment using self learning in response to the network status data;
coupling the network monitoring device to business rules defining a set of best practices of operation of the distributed network monitoring environment, wherein the best practices rules are described by a scripting language in response to management;
first providing an alert to one or more operators in response to the network status data indicating that the distributed network monitoring environment falls outside the profile of normal activity, either with respect to the total capacity of the distributed network management environment, or with respect to the relative capacity of the distributed network management environment;
second providing an alert to one or more operators in response to the network status data indicating that the distributed network monitoring environment falls outside the set of best practices of operation, either with respect to the total capacity of the distributed network management environment, or with respect to the relative capacity of the distributed network management environment.
8. A method as in claim 7 ,
wherein the rapid deviation from normal activity includes one or more of:
rapid change in number of database requests, combined with rapid change in number of endpoints making database requests;
rapid change in data storage usage, combined with allocation of data storage usage to a small number of endpoints occupying the bulk of the data storage usage;
rapid change in usage of network bandwidth, combined with rapid change in number of endpoints attempting to access network bandwidth;
rapid change in processor usage, combined with rapid change in number of endpoints attempting to access processor usage;
rapid change in virtual desktop usage, combined with allocation of virtual desktop usage to a small number of endpoints occupying the bulk of the virtual desktop usage;
rapid change in virtual machine usage, combined with allocation of virtual desktop usage to a small number of endpoints occupying the bulk of the virtual desktop usage.
9. A method as in claim 7 ,
wherein the set of best practices includes one or more of:
rules imposed by management,
rules imposed by law or regulation.
10. A method as in claim 7 ,
wherein the set of best practices includes one or more of:
a rule requiring utilization of a selected resource to be less than a selected threshold;
a rule requiring utilization of a selected resource to fall within a selected range;
a rule requiring utilization of a selected resource to exceed a selected threshold.
11. A method as in claim 10 ,
wherein the selected resource includes one or more of:
database usage, data storage usage, network bandwidth usage, processor usage, virtual desktop usage, virtual machine usage.
12. A method as in claim 10 ,
wherein the utilization distinguishes between absolute capacity and relative capacity.
13. A non-transitory memory maintaining instructions directing a network monitoring device to perform steps of
coupling the network monitoring device to network status data from one or more reporting devices coupled to a distributed network monitoring environment, the one or more reporting devices providing the network status data with respect to more than one function to be performed by network devices, the distributed network monitoring environment including a plurality of endpoints coupled thereto and disposed to access resources available using the distributed network monitoring environment;
performing, by the network monitoring device, one or more automated processes that provide, in response to the network status data, a profile of normal activity of the distributed network monitoring environment, wherein a rapid deviation from normal activity of the distributed network monitoring environment provides a reliable indicator of changes in use of the distributed network monitoring environment, the automated processes providing the profile of normal activity of the distributed network monitoring environment using self learning in response to the network status data;
coupling the network monitoring device to business rules defining a set of best practices of operation of the distributed network monitoring environment, wherein the best practices rules are described by a scripting language in response to management;
first providing an alert to one or more operators in response to the network status data indicating that the distributed network monitoring environment falls outside the profile of normal activity, either with respect to the total capacity of the distributed network management environment, or with respect to the relative capacity of the distributed network management environment;
second providing an alert to one or more operators in response to the network status data indicating that the distributed network monitoring environment falls outside the set of best practices of operation, either with respect to the total capacity of the distributed network management environment, or with respect to the relative capacity of the distributed network management environment.
14. A memory as in claim 13 ,
wherein the rapid deviation from normal activity includes one or more of:
rapid change in number of database requests, combined with rapid change in number of endpoints making database requests;
rapid change in data storage usage, combined with allocation of data storage usage to a small number of endpoints occupying the bulk of the data storage usage;
rapid change in usage of network bandwidth, combined with rapid change in number of endpoints attempting to access network bandwidth;
rapid change in processor usage, combined with rapid change in number of endpoints attempting to access processor usage;
rapid change in virtual desktop usage, combined with allocation of virtual desktop usage to a small number of endpoints occupying the bulk of the virtual desktop usage;
rapid change in virtual machine usage, combined with allocation of virtual desktop usage to a small number of endpoints occupying the bulk of the virtual desktop usage.
15. A memory as in claim 13 ,
wherein the set of best practices includes one or more of:
rules imposed by management,
rules imposed by law or regulation.
16. A memory as in claim 13 ,
wherein the set of best practices includes one or more of:
a rule requiring utilization of a selected resource to be less than a selected threshold;
a rule requiring utilization of a selected resource to fall within a selected range;
a rule requiring utilization of a selected resource to exceed a selected threshold.
17. A memory as in claim 16 ,
wherein the selected resource includes one or more of:
database usage, data storage usage, network bandwidth usage, processor usage, virtual desktop usage, virtual machine usage.
18. A memory as in claim 16 ,
wherein the utilization distinguishes between absolute capacity and relative capacity.
19. A method as in claim 7 ,
wherein the steps of coupling to network status data from one or more reporting devices include the one or more reporting devices providing the network status data with respect to one or more of: virtual machines, virtual desktops, or virtual desktop implementations.
20. A method as in claim 7 ,
wherein the steps of performing one or more automated processes include self-learning techniques by which the network monitoring device can determine when one or more of: the defined absolute capacity, or the defined absolute capacity relative capacity, procedures of the network are being violated.