Telemetry event aggregation
In one embodiment a network device includes multiple interfaces including at least one egress interface, which is configured to transmit packets belonging to multiple flows to a packet data network, control circuitry configured to generate event-reporting data-items, each including flow and event-type information about a packet-related event occurring in the network device, a memory, and aggregation circuitry configured to aggregate data of at least some of the event-reporting data-items into aggregated-event-reporting data-items aggregated according to the flow and event-type information of the at least some event-reporting data-items, store the aggregated-event-reporting data-items in the memory, and forward one aggregated-event-reporting data-item of the aggregated-event-reporting data-items to a collector node, and purge the one aggregated-event-reporting data-item from the memory.
1. A network device, comprising:
multiple interfaces including at least one egress interface, which is configured to transmit packets belonging to multiple flows to a packet data network;
control circuitry configured to generate event-reporting data-items, each including flow and event-type information about a packet-related event occurring in the network device;
a memory; and
aggregation circuitry configured to:
aggregate data of at least some of the event-reporting data-items into aggregated-event-reporting data-items aggregated according to the flow and event-type information of the at least some event-reporting data-items;
store the aggregated-event-reporting data-items in the memory; and
forward one aggregated-event-reporting data-item of the aggregated-event-reporting data-items to a collector node, and purge the one aggregated-event-reporting data-item from the memory.
2. The device according to claim 1 , wherein the aggregation circuitry is configured to forward the one aggregated-event-reporting data-item to the collector node, and purge the one aggregated-event-reporting data-item from the memory, responsively to the memory reaching a threshold for storage of the aggregated-event-reporting data-items.
3. The device according to claim 1 , wherein the aggregation circuitry is configured to assign the one aggregated-event-reporting data-item to an event-reporting queue queuing at least one of the aggregated-event reporting data-items waiting to be forwarded to the collector node over one of the multiple interfaces.
4. The device according to claim 1 , wherein the aggregation circuitry is configured to assign the aggregated-event-reporting data-items to different event-reporting queues, each queuing at least one of the aggregated-event reporting data-items waiting to be forwarded to the collector node over one of the multiple interfaces.
5. The device according to claim 1 , wherein the aggregation circuitry is configured to assign respective ones of the aggregated-event-reporting data-items to different priority event-reporting queues according to a respective count of events in the respective aggregated-event-reporting data-items.
6. The device according to claim 1 , wherein respective ones of the aggregated-event-reporting data-items include the flow and event-type information of the respective event-reporting data-items.
7. The device according to claim 1 , wherein the aggregation circuitry is configured to compute a respective signature of the flow information of respective ones of the aggregated-event-reporting data-items, wherein respective ones of the aggregated-event-reporting data-items include the respective computed signature and respective event-type information.
8. The device according to claim 7 , wherein the aggregation circuitry is configured to forward the respective computed signature and the flow information of a respective one of the aggregated-event-reporting data-items to the collector node responsively to the respective signature being computed an initial time from the flow information.
9. The device according to claim 1 , wherein respective ones of the aggregated-event-reporting data-items include a cumulative event-count and a cumulative byte-count of the respective event-reporting data-items.
10. The device according to claim 1 , wherein the aggregation circuitry is configured to compute a measure of event burstiness of the events aggregated in each of the aggregated-event-reporting data-items each time the data of another one of the event-reporting data-items is aggregated into a respective one of the aggregated-event-reporting data-items.
11. The device according to claim 10 , wherein the aggregation circuitry is configured to compute the measure of event burstiness of the events as a harmonic average.
12. The device according to claim 10 , wherein the measure of event burstiness of the events for one of the aggregated-event-reporting data-items includes, for each respective one of a plurality of time-difference ranges, a count of adjacent events having a time difference within the respective time-difference range.
13. The device according to claim 1 , further comprising an event reporting filter to prevent some of the event-reporting data-items from being input to the aggregation circuitry.
14. An event reporting method, comprising:
transmitting packets belonging to multiple flows to a packet data network;
generating event-reporting data-items, each including flow and event-type information about a packet-related event occurring in a network device;
aggregating, in the network device, data of at least some of the event-reporting data-items into aggregated-event-reporting data-items aggregated according to the flow and event-type information of the at least some event-reporting data-items;
storing the aggregated-event-reporting data-items in a memory; and
forwarding one aggregated-event-reporting data-item of the aggregated-event-reporting data-items to a collector node, and purging the one aggregated-event-reporting data-item from the memory.
15. The method according to claim 14 , wherein the forwarding and the purging is performed responsively to the memory reaching a threshold for storage of the aggregated-event-reporting data-items.
16. The method according to claim 14 , further comprising assigning the one aggregated-event-reporting data-item to an event-reporting queue queuing at least one of the aggregated-event reporting data-items waiting to be forwarded to the collector node.
17. The method according to claim 14 , further comprising assigning the aggregated-event-reporting data-items to different event-reporting queues, each queuing at least one of the aggregated-event reporting data-items waiting to be forwarded to the collector node.
18. The method according to claim 14 , further comprising assigning respective ones of the aggregated-event-reporting data-items to different priority event-reporting queues according to a respective count of events in the respective aggregated-event-reporting data-items.
19. The method according to claim 14 , wherein respective ones of the aggregated-event-reporting data-items include the flow and event-type information of the respective event-reporting data-items.
20. The method according to claim 14 , further comprising computing a respective signature of the flow information of respective ones of the aggregated-event-reporting data-items, wherein respective ones of the aggregated-event-reporting data-items include the respective computed signature and respective event-type information.
21. The method according to claim 20 , further comprising forwarding the respective computed signature and the flow information of a respective one of the aggregated-event-reporting data-items to the collector node responsively to the respective signature being computed an initial time from the flow information.
22. The method according to claim 14 , wherein respective ones of the aggregated-event-reporting data-items include a cumulative event-count and a cumulative byte-count of the respective event-reporting data-items.
23. The method according to claim 14 , further comprising computing a measure of event burstiness of the events aggregated in each of the aggregated-event-reporting data-items each time the data of another one of the event-reporting data-items is aggregated into a respective one of the aggregated-event-reporting data-items.
24. The method according to claim 23 , wherein the computing includes computing the measure of event burstiness of the events as a harmonic average.
25. The method according to claim 23 , wherein the measure of event burstiness of the events for one of the aggregated-event-reporting data-items includes, for each respective one of a plurality of time-difference ranges, a count of adjacent events having a time difference within the respective time-difference range.
26. The method according to claim 14 , further comprising preventing some of the event-reporting data-items from being input to the aggregating step.
27. A software product, comprising a non-transient computer-readable medium in which program instructions are stored, which instructions, when read by a central processing unit (CPU), cause the CPU to:
transmit packets belonging to multiple flows to a packet data network;
generate event-reporting data-items, each including flow and event-type information about a packet-related event occurring in a network device;
aggregate, in the network device, data of at least some of the event-reporting data-items into aggregated-event-reporting data-items aggregated according to the flow and event-type information of the at least some event-reporting data-items;
store the aggregated-event-reporting data-items in a memory; and
forward one aggregated-event-reporting data-item of the aggregated-event-reporting data-items to a collector node, and purging the one aggregated-event-reporting data-item from the memory.