Abstract: Methods, root cause analysis (RCA) engines, and monitoring systems for controlling monitoring systems based on RCA are provided. An RCA engine of a hardware computer receives an alarm on an entity. The RCA engine fetches correlation domains based on the correlation domains each having been associated with the entity and in which the alarm is part of a policy applied to the correlation domains. The RCA engine determines if the alarm is for a root cause of failure for an entity in one of the correlation domains and responsive to the alarm being for the root cause of failure: transmits a message to monitoring systems, the message comprising instructions for the registered monitoring systems to stop monitoring symptom conditions associated with the root cause of failure, and transmits, through the network, an indication of a failure of the one of the entities that is the root cause of failure.

Abstract: A system uses event correlation to identify components belonging to a same service or service domain. The system correlates events by generating covariance matrices or by performing sequence mining with temporal databases in order to discover event patterns that occur sequentially in a fixed time window. Components corresponding to the correlated events are identified as being part of a same service domain and can be indicated in a service domain data structure, such as a topology. The system utilizes the identified service domains during root cause analysis. The system can determine an anomalous event occurring a lowest layer component in a service domain as a root cause or can determine an anomalous event which occurs first in an identified event sequence of a service domain as a root cause. After identifying the root cause event, the system suppresses notifications of events occurring at other components in the service domain.

Abstract: A system uses event correlation to identify components belonging to a same service or service domain. The system correlates events by generating covariance matrices or by performing sequence mining with temporal databases in order to discover event patterns that occur sequentially in a fixed time window. Components corresponding to the correlated events are identified as being part of a same service domain and can be indicated in a service domain data structure, such as a topology. The system utilizes the identified service domains during root cause analysis. The system can determine an anomalous event occurring a lowest layer component in a service domain as a root cause or can determine an anomalous event which occurs first in an identified event sequence of a service domain as a root cause. After identifying the root cause event, the system suppresses notifications of events occurring at other components in the service domain.

Abstract: Methods, root cause analysis (RCA) engines, and monitoring systems for controlling monitoring systems based on RCA are provided. An RCA engine of a hardware computer receives an alarm on an entity. The RCA engine fetches correlation domains based on the correlation domains each having been associated with the entity and in which the alarm is part of a policy applied to the correlation domains. The RCA engine determines if the alarm is for a root cause of failure for an entity in one of the correlation domains and responsive to the alarm being for the root cause of failure: transmits a message to monitoring systems, the message comprising instructions for the registered monitoring systems to stop monitoring symptom conditions associated with the root cause of failure, and transmits, through the network, an indication of a failure of the one of the entities that is the root cause of failure.

Abstract: A method includes performing, by a processor: receiving a selection of a network service, determining a plurality of Virtual Network Functions (VNFs) and a plurality of Virtual Machines (VMs) based on the selection of the network service, the plurality of VNFs being configured to run on the plurality of VMs, generating a plurality of tuples, each of the plurality of tuples corresponding to a combination of one of the plurality of VNFs and one of the plurality of VMs where the one of the plurality of VNFs is configured to run on the one of the plurality of VMs, receiving a plurality of VNF performance parameters, estimating values for each of the plurality of VNF performance parameters for each of the plurality of tuples, respectively, processing the values for each of the plurality of VNF performance parameters to generate a plurality of scores for the plurality of tuples, respectively, generating a plurality of VNF Forwarding Graphs (FGs), each of the VNF FGs corresponding to a combination of ones of the plu

Abstract: An electronic device includes a processor and a memory coupled to the processor and storing computer readable program code that when executed by the processor causes the processor to perform operations including generating, at given time intervals, a plurality of topology graphs that correspond to a service chain that comprises a plurality of virtual network functions (VNFs) and that is operating in a software defined network (SDN)/network function virtualization (NFV) computing environment, each of the plurality of topology graphs corresponding to a different one of the time intervals. Operations may include comparing a first one of the plurality of topology graphs that is received at a first time to a second one of the plurality of topology graphs that is received at a second time that is after the first time to determine if the service chain has a fault.

Abstract: An electronic device includes a processor and a memory coupled to the processor and storing computer readable program code that when executed by the processor causes the processor to perform operations including generating, at given time intervals, a plurality of topology graphs that correspond to a service chain that comprises a plurality of virtual network functions (VNFs) and that is operating in a software defined network (SDN)/network function virtualization (NFV) computing environment, each of the plurality of topology graphs corresponding to a different one of the time intervals. Operations may include comparing a first one of the plurality of topology graphs that is received at a first time to a second one of the plurality of topology graphs that is received at a second time that is after the first time to determine if the service chain has a fault.

Abstract: A method includes performing, by a processor: receiving a selection of a network service, determining a plurality of Virtual Network Functions (VNFs) and a plurality of Virtual Machines (VMs) based on the selection of the network service, the plurality of VNFs being configured to run on the plurality of VMs, generating a plurality of tuples, each of the plurality of tuples corresponding to a combination of one of the plurality of VNFs and one of the plurality of VMs where the one of the plurality of VNFs is configured to run on the one of the plurality of VMs, receiving a plurality of VNF performance parameters, estimating values for each of the plurality of VNF performance parameters for each of the plurality of tuples, respectively, processing the values for each of the plurality of VNF performance parameters to generate a plurality of scores for the plurality of tuples, respectively, generating a plurality of VNF Forwarding Graphs (FGs), each of the VNF FGs corresponding to a combination of ones of the plu