公开(公告)号：US10756951B2

公开(公告)日：2020-08-25

申请号：US15662112

申请日：2017-07-27

Applicant: Cisco Technology, Inc.

Inventor： Parthibhan Paramaguru ,  Prashant Anand ,  Vasudevan Visvanathan ,  Sundar Ramakrishnan ,  Dharmarajan Subramanian ,  Rohit Kumar Gupta ,  Abhishek Chaudhary

IPC: H04L12/24

Abstract: Techniques for use in network incident identification are described. In response to an occurrence of an unknown network incident, a plurality of log messages (e.g. syslog messages) are received from a plurality of network components in one or more networks. In one illustrative example, a plurality of relationships between interfaces and events are derived from the received log messages and characterized as a plurality of graphical component relationships. One or more groups of connected components are determined from the graphical component relationships and network component connection data which indicate interface relationships of the network components. Here, groups of connected components may be logically joined based on the network component connection data indicating one or more interface relationships. A network incident may then be identified based on at least one of the determined groups of connected components being associated with at least one identified set of events that has the closest or substantial match with at least one predetermined set of events associated with the network incident.

公开(公告)号：US20180287855A1

公开(公告)日：2018-10-04

申请号：US15662112

申请日：2017-07-27

Applicant: Cisco Technology, Inc.

Inventor： Guru Parthibhan Paramaguru ,  Prashant Anand ,  Vasudevan Visvanathan ,  Sundar Ramakrishnan ,  Dharmarajan Subramanian ,  Rohit Kumar Gupta ,  Abhishek Chaudhary

IPC: H04L12/24

Abstract: Techniques for use in network incident identification are described. In response to an occurrence of an unknown network incident, a plurality of log messages (e.g. syslog messages) are received from a plurality of network components in one or more networks. In one illustrative example, a plurality of relationships between interfaces and events are derived from the received log messages and characterized as a plurality of graphical component relationships. One or more groups of connected components are determined from the graphical component relationships and network component connection data which indicate interface relationships of the network components. Here, groups of connected components may be logically joined based on the network component connection data indicating one or more interface relationships. A network incident may then be identified based on at least one of the determined groups of connected components being associated with at least one identified set of events that has the closest or substantial match with at least one predetermined set of events associated with the network incident.