# US 2021/0243068 A1 · Programmable diagnosis model for correlation of network events > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243068 A1 - Document ID: US20210243068A1 - Status: Published application - Kind: A1 - Application number: 16/821,745 - Filed: 2020-03-17 - Published: 2021-08-05 - Earliest claimed: 2020-01-31 - Assignees: Juniper Networks, Inc. - Applicants: Juniper Networks, Inc. - Inventors: Jayanthi R; Chandrasekhar A; Javier Antich; Sri Sampath Mallipudi; Premchandar N; Harsha Lakshmikanth - Web page: https://patentgrep.com/patent/US20210243068A1 ## CPC - H04L 41/0631: using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis - H04L 41/0604: using filtering, e.g. reduction of information by using priority, element types, position or time - H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play - H04L 41/0893: Assignment of logical groups to network elements - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 41/16: using machine learning or artificial intelligence - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 43/0823: Errors, e.g. transmission errors - H04L 43/16: Threshold monitoring - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Network management techniques are described. A controller device of this disclosure manages a device group of a network. The controller device includes processing circuitry in communication with the memory, the processing circuitry being configured to receive, using a programmable diagnosis service executed by the processing circuitry, a programming input, to form, using the programmable diagnosis service, based on the programming input, a resource definition graph that models interdependencies between a plurality of resources supported by the device group, to detect, using the programmable diagnosis service, an event affecting a first resource of the plurality of resources, and to identify, using the programmable diagnosis service, based on the interdependencies modeled in the resource definition graph formed based on the programming input, a root cause event that caused the event affecting the first resource, the root cause event occurring at a second resource of the plurality of resources. ## Claims ### Claim 1 A method of monitoring a device group of a network, the method comprising: receiving, by a programmable diagnosis service running on a controller device that manages the device group, a programming input; forming, by the programmable diagnosis service, based on the programming input, a resource definition graph that models interdependencies between a plurality of resources supported by the device group; detecting, by the programmable diagnosis service, an event affecting a first resource of the plurality of resources; and identifying, by the programmable diagnosis service, based on the interdependencies modeled in the resource definition graph formed based on the programming input, a root cause event that caused the event affecting the first resource, the root cause event occurring at a second resource of the plurality of resources. ### Claim 2 (depends on 1) The method of claim 1, wherein identifying the root cause event that caused the event affecting the first resource comprises: applying, by the programmable diagnosis service, the resource diagnosis graph to at least a subset of the plurality of resources to generate one or more inference rules with respect to the plurality of resources; and performing, by the programmable diagnosis service, a forward-chained root cause analysis (RCA) by applying the one or more inference rules to a plurality of events detected over the plurality of resources. ### Claim 3 (depends on 1) The method of claim 1, further comprising: initializing, by the programmable diagnosis service, one or more telemetry rules that enable the controller device to perform one or more of: monitoring state information for one or more components of the device group; or instigating one or more alarms in response to detecting threshold events occurring within the plurality of resources. ### Claim 4 (depends on 3) The method of claim 3, wherein initializing the one or more telemetry rules comprises configuring, by the programmable diagnosis service, based on the programming input, first cause-and-effect relationships between device resources supported by the device group, and second cause-and-effect relationships between service resources supported by the device group. ### Claim 5 (depends on 1) The method of claim 1, wherein forming the resource definition graph that models the interdependencies between the plurality of resources supported by the device group comprises applying, by the programmable diagnosis service, one or more temporal constraints to the modeled interdependencies. ### Claim 6 (depends on 5) The method of claim 5, wherein the one or more temporal constraints include a constraint according to which the event affecting the first resource occurs after the root cause event occurring at the second resource. ### Claim 7 (depends on 5) The method of claim 5, wherein the one or more temporal constraints include a constraint according to which the event affecting the first resource occurs before the root cause event occurring at the second resource. ### Claim 8 (depends on 1) The method of claim 1, wherein the plurality of resources comprises one or more network resources, the method further comprising configuring, by the programmable diagnosis service, at least a subset of the one or more network resources. ### Claim 9 (depends on 1) The method of claim 1, wherein the plurality of resources comprises one or more service resource models, the method further comprising configuring, by the programmable diagnosis service, at least a subset of the one or more service resources. ### Claim 10 (depends on 1) The method of claim 1, wherein the plurality of resources comprises one or more device resource models, the method further comprising configuring, by the programmable diagnosis service, at least a subset of the one or more device resources. ### Claim 11 A controller device for managing a device group of a network, the controller device comprising: a network interface; a memory; and processing circuitry in communication with the memory, the processing circuitry being configured to: receive, using a programmable diagnosis service executed by the processing circuitry, a programming input; form, using the programmable diagnosis service, based on the programming input, a resource definition graph that models interdependencies between a plurality of resources supported by the device group; detect, using the programmable diagnosis service, an event affecting a first resource of the plurality of resources; and identify, using the programmable diagnosis service, based on the interdependencies modeled in the resource definition graph formed based on the programming input, a root cause event that caused the event affecting the first resource, the root cause event occurring at a second resource of the plurality of resources. ### Claim 12 (depends on 11) The controller device of claim 11, wherein to identify the root cause event that caused the event affecting the first resource, the processing circuitry is configured to: apply, using the programmable diagnosis service, the resource diagnosis graph to at least a subset of the plurality of resources to generate one or more inference rules with respect to the plurality of resources; and perform, using the programmable diagnosis service, a forward-chained root cause analysis (RCA) by applying the one or more inference rules to a plurality of events detected over the plurality of resources. ### Claim 13 (depends on 11) The controller device of claim 11, wherein the processing circuitry is further configured to: initialize, using the programmable diagnosis service, one or more telemetry rules that enable the controller device to one or more of: monitor state information for one or more components of the device group; or instigate one or more alarms in response to detecting threshold events occurring within the plurality of resources. ### Claim 14 (depends on 13) The controller device of claim 13, wherein to initialize the one or more telemetry rules, the processing circuitry is configured to use the programmable diagnosis service to configure, based on the programming input, first cause-and-effect relationships between device resources supported by the device group, and second cause-and-effect relationships between service resources supported by the device group. ### Claim 15 (depends on 11) The controller device of claim 11, wherein to form the resource definition graph that models the interdependencies between the plurality of resources supported by the device group, the processing circuitry is configured to apply, using the programmable diagnosis service, one or more temporal constraints to the modeled interdependencies. ### Claim 16 (depends on 15) The controller device of claim 15, wherein the one or more temporal constraints include a constraint according to which the event affecting the first resource occurs after the root cause event occurring at the second resource. ### Claim 17 (depends on 15) The controller device of claim 15, wherein the one or more temporal constraints include a constraint according to which the event affecting the first resource occurs before the root cause event occurring at the second resource. ### Claim 18 (depends on 11) The controller device of claim 11, wherein the plurality of resources comprises one or more network resources, and wherein the processing circuitry is further configured to use the programmable diagnosis service to configure at least a subset of the one or more network resources. ### Claim 19 (depends on 11) The controller device of claim 11, wherein the plurality of resources comprises one or more service resource models, and wherein the processing circuitry is further configured to use the programmable diagnosis service to configure at least a subset of the one or more service resources. ### Claim 20 (depends on 11) The controller device of claim 11, wherein the plurality of resources comprises one or more device resource models, and wherein the processing circuitry is further configured to use the programmable diagnosis service to configure at least a subset of the one or more device resources. ### Claim 21 A non-transitory computer-readable medium encoded with instructions that, when executed, cause processing circuitry of a controller device for managing a device group of a network to: receive, using a programmable diagnosis service executed by the processing circuitry, a programming input; form, using the programmable diagnosis service, based on the programming input, a resource definition graph that models interdependencies between a plurality of resources supported by the device group; detect, using the programmable diagnosis service, an event affecting a first resource of the plurality of resources; and identify, using the programmable diagnosis service, based on the interdependencies modeled in the resource definition graph formed based on the programming input, a root cause event that caused the event affecting the first resource, the root cause event occurring at a second resource of the plurality of resources.