Log file processing for root cause analysis of a network fabric
AssigneeCisco Technology, Inc.
InventorsAshutosh Kulshreshtha, Andy Sloane, Navindra Yadav, Oliver Kempe, Uday Krishnaswamy Chettiar, Vimal Jeyakumar
Life of this patent
Estimating the term…
Abstract
The disclosed technology relates to log file processing techniques for root cause analysis of a network fabric. A system may be configured to identify a feature of interest in a log file and calculating an abnormal level for the feature of interest. The system is further configured to detect that a performance event has occurred during a time period, determine whether the feature of interest is at the abnormal level during the time period, and identify a correlation between the feature of interest and the performance event based on the determining.
Claims20
A computer-implemented method comprising:
- receiving a number of log files from at least one network sensor distributed across a network environment;
- identifying a feature of interest in the number of log files;
- calculating an abnormal level for the feature of interest based on text data in the number of log files;
- detecting that a performance event has occurred during a time period;
- determining whether the feature of interest is at the abnormal level during the time period, wherein the abnormal level comprises a frequency value for the feature of interest or an average value for the feature of interest;
- and
- identifying a correlation between the feature of interest and the performance event based on the determining.
A non-transitory computer-readable medium comprising instructions which, when executed by a computing system, cause the computing system to:
- identify a feature of interest in a log file, wherein the feature of interest is identified based on a pattern, and wherein the pattern is specified by a regular expression specifying the pattern;
- calculate an abnormal level for the feature of interest based on text data in the log file;
- detect that a performance event has occurred during a time period;
- determine whether the feature of interest is at the abnormal level during the time period, wherein the abnormal level comprises a frequency value for the feature of interest or an average value for the feature of interest
- identify a correlation between the feature of interest and the performance event based on the determining whether the feature of interest is at the abnormal level.
A system comprising:
- one or more processors;
- and
- at least one non-transitory computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to:
- receive a number of log files from one or more host entities distributed across a network environment;
- identify a feature of interest in the number of log files;
- calculate an abnormal level for the feature of interest based on text data in the number of log files;
- detect that a performance event has occurred during a time period;
- and
- determine whether the feature of interest is at the abnormal level during the time period, wherein the abnormal level comprises a frequency value for the feature of interest or an average value for the feature of interest;
- and
- identify a correlation between the feature of interest and the performance event based the determining whether the feature of interest is bcing at the abnormal level during the time period.
Dependencies are inferred from the claim text.