Cross silo time stitching
A monitoring device responds to status data pushed from a network device, and also manages a link with another network device, the link allowing the monitoring device to pull status data from the second network device. The monitoring device receives packets including status, the data indicating activity for one or more clock ticks. The monitoring device can compute statistical measures, rather than the network device. The monitoring device maintains the status data in a buffer. The monitoring device lags actual activity, but has is more likely to capture delayed packets. The network device sends packets as wrappers, each wrapper indicating sets of status information. When the information in a wrapper crosses a clock tick boundary, the monitoring device allocates reported activity among clock ticks, assuming that activity follows a uniform distribution.
1. Apparatus including:
a network monitoring device coupleable to a communication network, said communication network coupleable to at least one first type of device and at least one second type of device, said first type and second type of device interacting in association with operation of said network and providing network status data to said network monitoring device;
said network monitoring device coordinating the network status data into an in-order time record by (A) associating network status data from the first type of device with locations in a data structure associated with times that network status data would have been received in order, (B) discarding network status data from the second type of device when received after there are no locations in the data structure associated with times that network status data would have been received in order;
said network monitoring device providing an alert in response to a selected combination of status data from said first type and said second type of device.
2. An apparatus as in claim 1 , wherein the in-order time record includes a unitary in-order time record.
3. An apparatus as in claim 1 , wherein the network status data relates at least to interaction between elements in the communication network.
4. An apparatus as in claim 1 , wherein the communication network includes one or more of: network devices, computing devices, virtual machines, virtual desktop implementations, or databases.
5. An apparatus as in claim 1 , wherein the network status data includes one or more message packets.
6. An apparatus as in claim 4 , wherein the network monitoring device duplicates the message packets and adjusts their values to indicate computed measures for each separate message packet.
7. An apparatus as in claim 1 , wherein the network monitoring device determines a start time and an end time for the network status data.
8. An apparatus as in claim 1 , wherein the network monitoring device parcels out the network status data responsive to clock ticks.
9. An apparatus as in claim 7 , wherein the network monitoring device advances the clock ticks so that new network status data can be maintained at new clock ticks.
10. An apparatus as in claim 1 , wherein the network monitoring device examines the network status data to determine the type of the at least one first type of device and the at least one second type of device.
11. A method including network monitoring, comprising:
coupling a network monitoring device to a communication network;
coupling the communication network to at least one first type of device and at least one second type of device, said first type and second type of device interacting in association with operation of said network and providing network status data to said network monitoring device;
coordinating the network status data into an in-order time record, including one or more of: (A) associating network status data from the first type of device with locations in a data structure associated with times that network status data would have been received in order, or (B) discarding network status data from the second type of device when received after there are no locations in the data structure associated with times that network status data would have been received in order;
providing an alert in response to a selected combination of status data from said first type and said second type of device.
12. A method as in claim 11 , wherein the in-order time record includes a unitary in-order time record.
13. A method as in claim 11 , wherein the network status data relates at least to interaction between elements in the communication network.
14. A method as in claim 11 , wherein the communication network includes one or more of: network devices, computing devices, virtual machines, virtual desktop implementations,
or databases.
15. A method as in claim 11 , wherein the network status data includes one or more message packets.
16. A method as in claim 15 , including steps of duplicating the message packets and adjusting their values to indicate computed measures for each separate message packet.
17. A method as in claim 11 , including steps of determining a start time and an end time for the network status data.
18. A method as in claim 11 , including steps of parceling out the network status data responsive to clocks ticks.
19. A method as in claim 18 , including steps of advancing the clock ticks so that new network status data can be maintained at new clock ticks.
20. A method as in claim 11 , including steps of examining the network status data to determine the type of the at least one first type of device and the at least one second type of device.