Back to results
US 12,748,780 B2Granted
Observability data relationship graphs
AssigneeCisco Technology, Inc.
InventorsAshish Kundu, Ramana Rao V. R. Kompella
Life of this patent
Estimating the term…
Abstract
According to one or more embodiments of the disclosure, an example process herein may comprise: obtaining observability data for a computer system for a given time period; determining observability entities from the observability data; converting the observability entities into contextual vertices having associated vertex attributes; determining relationships among the contextual vertices based on correlation of the observability data; selecting a subset of the relationships to be edges based on a quality of the relationships, the edges having associated edge attributes; and generating an observability graph for the observability data for the computer system for the given time period by connecting the contextual vertices via corresponding edges.
Claims18
A method, comprising:
- obtaining, by a device, observability data for a computer system for a given time period, wherein the observability data comprises telemetry data and metrics, events, logs, and traces (MELT) data;
- determining, by the device, observability entities from the observability data;
- converting, by the device, the observability entities into contextual vertices having associated vertex attributes;
- determining, by the device, relationships among the contextual vertices based on correlation of the observability data;
- selecting, by the device and by using machine learning, a subset of the relationships as edges based on a quality of the relationships, the edges having associated edge attributes;
- generating, by the device, an observability graph for the observability data for the computer system for the given time period by connecting the contextual vertices via corresponding edges;
- modifying, by the device, the observability graph based on a semantic consistency policy applied to the observability data to generate a modified observability graph, wherein the semantic consistency policy specifies semantic state requirements for the contextual vertices and the corresponding edges of the observability graph, and wherein modifying comprises analyzing the observability graph and determining that at least one of a contextual vertex or a corresponding edge has an inconsistent semantic state relative to the semantic state requirements specified by the semantic consistency policy, and pruning, in response to making the determination, the at least one of the contextual vertex or the corresponding edge to bring the modified observability graph into compliance with the semantic state requirements;
- presenting, by the device, the modified observability graph to a user interface of a display, wherein the modified observability graph is dynamically updated by the device with new observability data for subsequent time periods;
- detecting, by the device, an anomalous subgraph pattern within the modified observability graph as dynamically updated, the anomalous subgraph pattern being associated with a system condition affecting performance or security of the computer system;
- and
- performing, by the device, a remediation operation to correct the system condition in response to detecting the anomalous subgraph pattern.
8 more elements
A tangible, non-transitory, computer-readable medium having computer-executable instructions stored thereon that, when executed by a processor on a computer, cause the computer to perform a method comprising:
- obtaining observability data for a computer system for a given time period, wherein the observability data comprises telemetry data and metrics, events, logs, and traces (MELT) data;
- determining observability entities from the observability data;
- converting the observability entities into contextual vertices having associated vertex attributes;
- determining relationships among the contextual vertices based on correlation of the observability data;
- selecting, by using machine learning, a subset of the relationships as edges based on a quality of the relationships, the edges having associated edge attributes;
- generating an observability graph for the observability data for the computer system for the given time period by connecting the contextual vertices via corresponding edges;
- modifying the observability graph based on a semantic consistency policy applied to the observability data to generate a modified observability graph, wherein the semantic consistency policy specifies semantic state requirements for the contextual vertices and the corresponding edges of the observability graph, and wherein modifying comprises analyzing the observability graph and determining that at least one of a contextual vertex or a corresponding edge has an inconsistent semantic state relative to the semantic state requirements specified by the semantic consistency policy, and pruning, in response to making the determination, the at least one of the contextual vertex or the corresponding edge to bring the modified observability graph into compliance with the semantic state requirements;
- presenting the modified observability graph to a user interface of a display, wherein the modified observability graph is dynamically updated by the computer with new observability data for subsequent time periods;
- detecting an anomalous subgraph pattern within the modified observability graph as dynamically updated, the anomalous subgraph pattern being associated with a system condition affecting performance or security of the computer system;
- and
- performing a remediation operation to correct the system condition in response to detecting the anomalous subgraph pattern.
8 more elements
An apparatus, comprising:
- one or more network interfaces to communicate with a network;
- a processor coupled to the one or more network interfaces and configured to execute one or more processes;
- and
- a memory configured to store a process that is executable by the processor, the process, when executed, configured to:
- obtain observability data for a computer system for a given time period, wherein the observability data comprises telemetry data and metrics, events, logs, and traces (MELT) data;
- determine observability entities from the observability data;
- convert the observability entities into contextual vertices having associated vertex attributes;
- determine relationships among the contextual vertices based on correlation of the observability data;
- select, by using machine learning, a subset of the relationships as edges based on a quality of the relationships, the edges having associated edge attributes;
- generate an observability graph for the observability data for the computer system for the given time period by connecting the contextual vertices via corresponding edges;
- modify the observability graph based on a semantic consistency policy applied to the observability data to generate a modified observability graph, wherein the semantic consistency policy specifies semantic state requirements for the contextual vertices and the corresponding edges of the observability graph, and wherein modifying comprises analyzing the observability graph and determining that at least one of a contextual vertex or a corresponding edge has an inconsistent semantic state relative to the semantic state requirements specified by the semantic consistency policy, and pruning, in response to making the determination, the at least one of the contextual vertex or the corresponding edge to bring the modified observability graph into compliance with the semantic state requirements;
- present the modified observability graph to a user interface of a display, wherein the modified observability graph is dynamically updated by the apparatus with new observability data for subsequent time periods;
- detect an anomalous subgraph pattern within the modified observability graph as dynamically updated, the anomalous subgraph pattern being associated with a system condition affecting performance or security of the computer system;
- and
- perform a remediation operation to correct the system condition in response to detecting the anomalous subgraph pattern.
12 more elements
Dependencies are inferred from the claim text.