# US 2018/0026848 A9 · Isolation of problems in a virtual environment

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0026848 A9
- Document ID: US20180026848A9
- Status: Published application
- Kind: A9
- Application number: 14/815,701
- Filed: 2015-07-31
- Published: 2018-01-25
- Earliest claimed: 2013-01-28
- Assignees: Entit Software LLC
- Applicants: EntIT Software LLC
- Inventors: Assaf Dagan
- Web page: https://patentgrep.com/patent/US20180026848A9

## CPC

- H04L 41/12: Discovery or management of network topologies
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 11/1464: {for networked environments}
- G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)}
- G06F 11/3433: {for load management (allocation of a server based on load conditions G06F9/505; load rebalancing G06F9/5083; redistributing the load in a network by a load balancer H04L67/1029)}
- G06F 11/3452: {Performance evaluation by statistical analysis}
- G06F 11/3466: {Performance evaluation by tracing or monitoring}
- G06F 16/27: Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
- H04L 41/065: {involving logical or physical relationship, e.g. grouping and hierarchies}
- H04L 43/0823: Errors, e.g. transmission errors
- H04L 43/16: Threshold monitoring
- G06F 16/21: Design, administration or maintenance of databases
- G06F 16/215: Improving data quality; Data cleansing, e.g. de-duplication, removing invalid entries or correcting typographical errors
- G06F 16/285: {Clustering or classification}
- G06F 2009/45591: {Monitoring or debugging support}
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- G06F 2201/815: Virtual
- G06F 2201/84: Using snapshots, i.e. a logical point-in-time copy of the data
- H04L 41/122: of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
- H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Problem isolation in a virtual environment is described. In one example, a method (300) is provided for isolating problems in a virtual environment. The method includes maintaining (310) a topology of network devices in the virtual environment. The virtual environment can be monitored (320) using a performance module for network device operation irregularities exceeding a threshold. A network device operation irregularity can be identified (330) as well as a portion of the topology associated with the network device operation irregularity. Topology portions associated with network device operation irregularities can be grouped (340) together using a snapshot module to form a snapshot of a problem topology.

## Claims

### Claim at position 1

1-15. (canceled)

### Claim 16

A non-transitory machine-readable medium with instructions stored therein for isolating problems in a virtual environment, the instructions comprising:
maintaining a topology of network devices in the virtual environment;
monitoring the virtual environment for network device operation irregularities exceeding a threshold, wherein monitoring is performed on a problem isolation server;
identifying a network device operation irregularity;
identifying a portion of the topology associated with the network device operation irregularity using a processor; and
grouping topology portions associated with network device operation irregularities together to form a snapshot of a problem topology.

### Claim 17 (depends on 16)

A medium as in claim 16, further comprising creating a graph representing the snapshot, wherein the graph shows a relationship between the topology portions grouped together.

### Claim 18 (depends on 17)

A medium as in claim 17, wherein the relationship comprises a causal relationship.

### Claim 19 (depends on 17)

A medium as in claim 17, wherein the relationship comprises a chronological relationship.

### Claim 20 (depends on 16)

A medium as in claim 16, wherein grouping topology portions further comprises grouping topology portions associated with network device operation irregularities together when the network device operation irregularities occur within a predetermined time interval from one another.

### Claim 21 (depends on 16)

A medium as in claim 16, wherein grouping topology portions further comprises grouping topology portions associated with network device operation irregularities together when the network device operation irregularities are causally linked together.

### Claim 22 (depends on 16)

A medium as in claim 16, wherein the snapshot comprises a state of the problem topology existing at the time of the network device operation irregularity.

### Claim 23 (depends on 16)

A medium as in claim 16, further comprising storing the snapshot in a snapshot database on a problem isolation server.

### Claim 24 (depends on 16)

A medium as in claim 16, wherein the snapshot excludes configuration items not related to the network device operation metrics breaching the baseline.

### Claim 25 (depends on 16)

A medium as in claim 16, further comprising creating a graph representing the problem topology, wherein the graph shows a relationship between the configuration items.

### Claim 26

A system for isolating problems in a virtual environment, comprising:
a physical problem isolation server;
a performance management database on the problem isolation server to maintain a topology of configuration items representing networks in the virtual environment;
an operation monitor to monitor the virtual environment for network operation metrics breaching a baseline;
a breach detector to detect the network operation metrics breaching the baseline;
a breach identifier configured to identify configuration items related to the network operation metrics breaching the baseline; and
a snapshotter to group related configuration items together using a processor and to form a snapshot of a problem topology based on the topology.

### Claim 27 (depends on 26)

A system as in claim 26, wherein the snapshot comprises a partial topology.

### Claim 28 (depends on 26)

A system as in claim 26, further comprising a display to graphically represent the snapshot, including relationships of the related configuration items, for display on a user display.

### Claim 29 (depends on 26)

A system as in claim 26, further comprising an operation tracker to track normal network device operation to establish the baseline.

### Claim 30 (depends on 26)

A system as in claim 26, wherein the snapshotter is to enrich the snapshot with state information or expert advice regarding a potential cause of the network device operation metrics breaching the baseline based on information stored in the performance management database.

### Claim 31

A system for identifying problems in a virtual environment, comprising:
a problem isolation server;
a performance management database on the problem isolation server and configured to maintain a topology of configuration items representing network devices in the virtual environment;
an operation monitoring device operable to monitor the virtual environment for network device operation metrics breaching a baseline;
a breach identification module configured to identify configuration items related to the network device operation metrics breaching the baseline; and
a snapshot module configured to group related configuration items together using a processor and to form a snapshot of a problem topology based on the topology.

### Claim 32 (depends on 31)

A system as in claim 31, wherein the snapshot comprises a partial topology.

### Claim 33 (depends on 31)

A system as in claim 31, further comprising a display module configured to graphically represent the snapshot, including relationships of the related configuration items, for display on a user display device.

### Claim 34 (depends on 31)

A system as in claim 31, further comprising an operation tracking module configured to track normal network device operation to establish the baseline.

### Claim 35 (depends on 31)

A system as in claim 31, wherein the snapshot module is configured to enrich the snapshot with state information or expert advice regarding a potential cause of the network device operation metrics breaching the baseline based on information stored in the performance management database.