System and method for using real-time packet data to detect and manage network issues

A method for analyzing and remediating network incidents, the method comprising:

• executing performance calculations on collected network data to compute performance metrics;
• detecting a network incident by using the computed performance metrics to correlate with a sequence of other metrics that are associated with symptoms related to network incidents,
• wherein using the computed performance metrics comprises detecting a proportion of performance metric values crossing a threshold;
• identifying a root cause of the detected network incident;
• and
• identifying, and providing for display, remediation of the identified root cause of the detected network incident.

A method for analyzing and remediating network incidents, the method comprising:

• executing performance calculations on collected network data to compute performance metrics;
• detecting a network incident by using the computed performance metrics to correlate with a sequence of other metrics that are associated with symptoms related to network incidents,
• wherein detecting the network incident comprises identifying deviations in historical time-series data computed based on network incidents over a duration of time;
• identifying changes in the computed historical time-series data and identifying factors contributing to these changes, wherein the identified factors comprise at least two of configuration changes, topology changes, changes and upgrades of the network elements in the network;
• identifying a root cause of the detected network incident;
• and
• identifying, and providing for display, remediation of the identified root cause of the detected network incident.

A method for analyzing and remediating network incidents, the method comprising:

• executing performance calculations on collected network data to compute performance metrics;
• detecting a network incident by using the computed performance metrics to correlate with a sequence of other metrics that are associated with symptoms related to network incidents;
• identifying a root cause of the detected network incident;
• and
• identifying, and providing for display, remediation of the identified root cause of the detected network incident,
• wherein identifying remediation comprises assigning a priority to the detected network incident, wherein the priority is determined based on at least two of a percentage of affected entities, relative deviation from the historical baseline, and presence of important entities within the affected entities.

A non-transitory machine readable medium storing a program which when executed by at least one processing unit analyzes and remediates network incidents, the program comprising sets of instructions for:

• executing performance calculations on collected network data to compute performance metrics;
• detecting a network incident from the performance calculations on the network data by using the computed performance metrics to correlate with a sequence of other metrics that are associated with symptoms related to network incidents;
• identifying a root cause of the detected network incident,
• wherein the set of instructions for identifying the root cause comprises a set of instructions for aggregating correlations of symptoms across a plurality of network incidents over a duration of time and mapping a set of symptom correlations to root causes;
• and
• identifying, and providing for display, remediation of the identified root cause of the detected network incident.

A non-transitory machine readable medium storing a program which when executed by at least one processing unit analyzes and remediates network incidents, the program comprising sets of instructions for:

• executing performance calculations on collected network data to compute performance metrics;
• detecting a network incident from the performance calculations on the network data by using the computed performance metrics to correlate with a sequence of other metrics that are associated with symptoms related to network incidents;
• wherein using the computed performance metrics comprises detecting a proportion of performance metric values crossing a threshold;
• identifying a root cause of the detected network incident;
• and
• identifying, and providing for display, remediation of the identified root cause of the detected network incident.

A non-transitory machine readable medium storing a program which when executed by at least one processing unit analyzes and remediates network incidents, the program comprising sets of instructions for:

• executing performance calculations on collected network data to compute performance metrics;
• detecting a network incident from the performance calculations on the network data by correlating a sequence of performance metrics with other composite metrics that define relevant symptoms,
• wherein detecting the network incident comprises identifying deviations in historical time-series data computed based on network incidents over a duration of time,
• wherein detecting the network incident further comprises identifying changes in the computed historical time-series data and identifying factors contributing to these changes, wherein the identified factors comprise at least two of configuration changes, topology changes, changes and upgrades of the network elements in the network;
• identifying a root cause of the detected network incident;
• and
• identifying, and providing for display, remediation of the identified root cause of the detected network incident.

A non-transitory machine readable medium storing a program which when executed by at least one processing unit analyzes and remediates network incidents, the program comprising sets of instructions for:

• executing performance calculations on collected network data to compute performance metrics;
• detecting a network incident from the performance calculations on the network data by correlating a sequence of performance metrics with other composite metrics that define relevant symptoms;
• identifying a root cause of the detected network incident;
• and
• identifying, and providing for display, remediation of the identified root cause of the detected network incident,
• wherein the set of instructions for identifying remediation comprises a set of instructions for assigning a priority to the detected network incident, wherein the priority is determined based on at least two of a percentage of affected entities, relative deviation from the historical baseline, and presence of important entities within the affected entities.