Pod communication graph
A logical graph is generated using at least a portion of log data received from a set of agents executing on one or more nodes in one or more data centers. The logical graph is augmented using data obtained from one or more agents executing in containerized environments, including by representing communications between pods within the logical graph. The augmented logical graph is used to detect an anomaly.
1. A system, comprising:
a processor configured to:
generate a logical graph, comprising a set of nodes and a set of edges, using at least a portion of log data received from a set of agents executing on one or more machines in one or more data centers;
augment the logical graph using data obtained from one or more agents executing in containerized environments, including by representing a communication made from a first pod instance to a second pod instance within the logical graph;
determine, using the augmented logical graph, that a new edge has been added to the set of edges; and
in response to determining that the new edge has been added to the set of edges, automatically generate an alert that an anomaly in the network environment associated with the new edge has occurred; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 , wherein the logical graph comprises a process communication graph, wherein the process communication graph clusters processes into nodes based on communications they make with other processes.
3. The system of claim 2 , wherein detecting the anomaly includes detecting a change to a pod cluster.
4. The system of claim 2 , wherein the processor is further configured to use a namespace to assign a persistent cluster name.
5. The system of claim 1 , wherein augmenting the logical graph includes performing a join.
6. The system of claim 1 , wherein the augmented logical graph clusters pods together.
7. The system of claim 6 , wherein the clustering is based at least in part on containers executing inside the pods.
8. The system of claim 6 , wherein at least two nodes clustered together in a process communication graph are split across two different pod clusters.
9. The system of claim 6 , wherein at least two nodes clustered into two different clusters in a process communication graph are clustered together in a single pod cluster.
10. The system of claim 1 , wherein at least a portion of the augmented logical graph is displayed in an interface in response to a user input.
11. The system of claim 1 , wherein the augmented logical graph comprises a hierarchical topology of pods and containers.
12. A method, comprising:
generating a logical graph, comprising a set of nodes and a set of edges, using at least a portion of log data received from a set of agents executing on one or more machines in one or more data centers;
augmenting the logical graph using data obtained from one or more agents executing in containerized environments, including by representing a communication made from a first pod instance to a second pod instance within the logical graph;
determining, using the augmented logical graph, that a new edge has been added to the set of edges; and
in response to determining that the new edge has been added to the set of edges, automatically generate an alert that an anomaly in the network environment associated with the new edge has occurred.
13. The method of claim 12 , wherein the logical graph comprises a process communication graph, wherein the process communication graph clusters processes into nodes based on communications they make with other processes.
14. The method of claim 13 , wherein detecting the anomaly includes detecting a change to a pod cluster.
15. The method of claim 13 , further comprising using a namespace to assign a persistent cluster name.
16. The method of claim 12 , wherein augmenting the logical graph includes performing a join.
17. The method of claim 12 , wherein the augmented logical graph clusters pods together.
18. The method of claim 17 , wherein the clustering is based at least in part on containers executing inside the pods.
19. The method of claim 17 , wherein at least two nodes clustered together in a process communication graph are split across two different pod clusters.
20. The method of claim 17 , wherein at least two nodes clustered into two different clusters in a process communication graph are clustered together in a single pod cluster.
21. The method of claim 12 , wherein at least a portion of the augmented logical graph is displayed in an interface in response to a user input.
22. The method of claim 12 , wherein the augmented logical graph comprises a hierarchical topology of pods and containers.
23. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
generating a logical graph, comprising a set of nodes and a set of edges, using at least a portion of log data received from a set of agents executing on one or more machines in one or more data centers;
augmenting the logical graph using data obtained from one or more agents executing in containerized environments, including by representing a communication made from a first pod instance to a second pod instance within the logical graph;
determining, using the augmented logical graph, that a new edge has been added to the set of edges; and
in response to determining that the new edge has been added to the set of edges, automatically generate an alert that an anomaly in the network environment associated with the new edge has occurred.