Abstract: Techniques for resource monitoring and managed message reordering in a data center are described. In one example, a computing system comprises an ingress engine to receive a message from a network device in a data center comprising a plurality of network devices and the computing system; and in response to receiving the message from a network device in the data center, communicate the message to an appropriate collector application corresponding to the message's protocol type in compliance with at least one requirement for data stored in a message flow communicated from one or more network devices to the computing system.

Abstract: A computing system comprising a memory and processing circuitry may perform the techniques. The memory may store time series data comprising measurements of one or more performance indicators. The processing circuitry may determine, based on the time series data, an anomaly in the performance of the network system, and create, based on the time series data, a knowledge graph. The processing circuitry may determine, in response to detecting the anomaly, and based on the knowledge graph and a machine learning (ML) model trained with previous time series data, a causality graph. The processing circuitry may determine a weighting for each edge in the causality graph, determine, based on the edges in the causality graph, a candidate root cause associated with the anomalies, and determine a ranking of the candidate root cause based on the weighting. The analysis framework system may output at least a portion of the ranking.

Abstract: An alarm service can receive an alarm rule as an “intent” that defines a rule in a high level “natural language.” An alarm rule compiler can receive the intent and translate the high level intent into one or more lower level rules that can be programmatically processed by multiple alarm rule execution engines. Devices in a network system can be associated with alarm rule execution engines in a distributed manner. For example, devices in a network can be associated with different instances of an alarm rule execution engine, thus distributing the resource usage for obtaining telemetry data and processing alarms with respect to the devices in a network across multiple alarm rule execution engines.

Abstract: A system that permits or otherwise facilitates assessment of operational state of a computing component in a computing environment. In one example, this disclosure describes a method that includes collecting, by a server device that is executing within a server device cluster, metric information indicative of an operational state of the server device, wherein the metric information is associated with a plurality of virtual computing instances executing on the server device; analyzing, by the server device and based on the metric information, whether a first condition associated with a first virtual computing instance is satisfied; analyzing, by the server device and based on the metric information, whether a second condition associated with a second virtual computing instance is satisfied; and updating control information characterizing the operational state of the server device executing within the server device cluster.

Abstract: An alarm service can receive an alarm rule as an “intent” that defines a rule in a high level “natural language.” An alarm rule compiler can receive the intent and translate the high level intent into one or more lower level rules that can be programmatically processed by multiple alarm rule execution engines. Devices in a network system can be associated with alarm rule execution engines in a distributed manner. For example, devices in a network can be associated with different instances of an alarm rule execution engine, thus distributing the resource usage for obtaining telemetry data and processing alarms with respect to the devices in a network across multiple alarm rule execution engines.

Abstract: The disclosure describes techniques for network monitoring and fault localization. For example, a controller comprises one or more processors operably coupled to a memory configured to: receive a first one or more Quality of Experience (QoE) metrics measured by a first probe traversing a first path comprising one or more links; receive a second one or more QoE metrics measured by a second probe traversing a second path comprising one or more links; determine, from the first one or more QoE metrics, that the first path has an anomaly; determine, from the second one or more QoE metrics, that the second path has an anomaly; and determine, in response to determining the first path and the second path has an anomaly, based on the type of metrics and the type of links, that an intersection between the first path and the second path is a root cause of the anomaly.

Abstract: An alarm service can receive an alarm rule as an “intent” that defines a rule in a high level “natural language.” An alarm rule compiler can receive the intent and translate the high level intent into one or more lower level rules that can be programmatically processed by multiple alarm rule execution engines. Devices in a network system can be associated with alarm rule execution engines in a distributed manner. For example, devices in a network can be associated with different instances of an alarm rule execution engine, thus distributing the resource usage for obtaining telemetry data and processing alarms with respect to the devices in a network across multiple alarm rule execution engines.

Abstract: This disclosure describes techniques for monitoring, scheduling, and performance management for computing environments, such as virtualization infrastructures deployed within data centers. In one example, a method includes obtaining, by a policy controller, a first profile for an element of a virtualization infrastructure, the first profile comprising a first ruleset having one or more alarms; obtaining, by the policy controller, a second profile for a group of one or more elements including the element, the second profile comprising a second ruleset having one or more alarms; modifying, by the policy controller based at least on the element being a member of the group, the first profile to generate a modified first profile comprising the first ruleset and the second ruleset; and outputting, by the policy controller to a computing device, the modified first profile.

Abstract: The disclosure describes techniques for network monitoring and fault localization. For example, a controller comprises one or more processors operably coupled to a memory configured to: receive a first one or more Quality of Experience (QoE) metrics measured by a first probe traversing a first path comprising one or more links; receive a second one or more QoE metrics measured by a second probe traversing a second path comprising one or more links; determine, from the first one or more QoE metrics, that the first path has an anomaly; determine, from the second one or more QoE metrics, that the second path has an anomaly; and determine, in response to determining the first path and the second path has an anomaly, based on the type of metrics and the type of links, that an intersection between the first path and the second path is a root cause of the anomaly.

Abstract: The present invention addresses the need for improved virtualized cloud infrastructure policy implementation and management in order allow real-time monitoring and optimization of virtualized resources. It provides systems and methods for real-time cloud infrastructure policy implementation and management that include a plurality of host devices, a plurality of real-time probe agents associated with the plurality of host devices operating on each of the plurality of host devices, and a policy engine communicatively coupled to the plurality of host devices and containing a policy associated with an application program deployed in at least one of the plurality of host devices. The policy engine is programmed to monitor in real time changes in deployment of the application program across the plurality of host devices and to push the policy to the real-time probe agent operating on each host device on which the application program is deployed.

Abstract: An alarm service can receive an alarm rule as an “intent” that defines a rule in a high level “natural language.” An alarm rule compiler can receive the intent and translate the high level intent into one or more lower level rules that can be programmatically processed by multiple alarm rule execution engines. Devices in a network system can be associated with alarm rule execution engines in a distributed manner. For example, devices in a network can be associated with different instances of an alarm rule execution engine, thus distributing the resource usage for obtaining telemetry data and processing alarms with respect to the devices in a network across multiple alarm rule execution engines.

Abstract: A telemetry service can receive telemetry collection requirements that are expressed as an “intent” that defines how telemetry is to be collected. A telemetry intent compiler can receive the telemetry intent and translate the high level intent into abstract telemetry configuration parameters that provide a generic description of desired telemetry data. The telemetry service can determine, from the telemetry intent, a set of devices from which to collect telemetry data. For each device, the telemetry service can determine capabilities of the device with respect to telemetry data collection. The capabilities may include a telemetry protocol supported by the device. The telemetry service can create a protocol specific device configuration based on the abstract telemetry configuration parameters and the telemetry protocol supported by the device. Devices in a network system that support a particular telemetry protocol can be allocated to instances of a telemetry collector that supports the telemetry protocol.

Abstract: Techniques for resource monitoring and managed message reordering in a data center are described. In one example, a computing system comprises an ingress engine to receive a message from a network device in a data center comprising a plurality of network devices and the computing system; and in response to receiving the message from a network device in the data center, communicate the message to an appropriate collector application corresponding to the message's protocol type in compliance with at least one requirement for data stored in a message flow communicated from one or more network devices to the computing system.

Abstract: This disclosure describes techniques for analyzing information generated as a result of monitoring resources within computing environments. In one example, this disclosure describes a method that includes observing a plurality of alerts generated in response to monitoring resources associated with a plurality of connected elements within a network; determining a plurality of occurrence counts; determining a plurality of concurrent occurrence counts, wherein each of the plurality of concurrent occurrence counts represents a count of concurrent occurrences of two or more of the alerts in the set of historical alerts; and identifying one or more root cause alerts, wherein the one or more root cause alerts are determined based on the plurality of occurrence counts and the plurality of the concurrent occurrence counts, and wherein the one or more root cause alerts are a subset of the plurality of alerts.

Abstract: The present invention addresses the need for improved virtualized cloud infrastructure policy implementation and management in order allow real-time monitoring and optimization of virtualized resources. It provides systems and methods for real-time cloud infrastructure policy implementation and management that include a plurality of host devices, a plurality of real-time probe agents associated with the plurality of host devices operating on each of the plurality of host devices, and a policy engine communicatively coupled to the plurality of host devices and containing a policy associated with an application program deployed in at least one of the plurality of host devices. The policy engine is programmed to monitor in real time changes in deployment of the application program across the plurality of host devices and to push the policy to the real-time probe agent operating on each host device on which the application program is deployed.

Abstract: The present invention addresses the need for improved virtualized cloud infrastructure policy implementation and management in order allow real-time monitoring and optimization of virtualized resources. It provides systems and methods for real-time cloud infrastructure policy implementation and management that include a plurality of host devices, a plurality of real-time probe agents associated with the plurality of host devices operating on each of the plurality of host devices, and a policy engine communicatively coupled to the plurality of host devices and containing a policy associated with an application program deployed in at least one of the plurality of host devices. The policy engine is programmed to monitor in real time changes in deployment of the application program across the plurality of host devices and to push the policy to the real-time probe agent operating on each host device on which the application program is deployed.

Abstract: The present invention addresses the need for improved virtualized cloud infrastructure policy implementation and management in order allow real-time monitoring and optimization of virtualized resources. It provides systems and methods for real-time cloud infrastructure policy implementation and management that include a plurality of host devices, a plurality of real-time probe agents associated with the plurality of host devices operating on each of the plurality of host devices, and a policy engine communicatively coupled to the plurality of host devices and containing a policy associated with an application program deployed in at least one of the plurality of host devices. The policy engine is programmed to monitor in real time changes in deployment of the application program across the plurality of host devices and to push the policy to the real-time probe agent operating on each host device on which the application program is deployed.

Abstract: This disclosure describes techniques for analyzing information generated as a result of monitoring resources within computing environments. In one example, this disclosure describes a method that includes observing a plurality of alerts generated in response to monitoring resources associated with a plurality of connected elements within a network; determining a plurality of occurrence counts; determining a plurality of concurrent occurrence counts, wherein each of the plurality of concurrent occurrence counts represents a count of concurrent occurrences of two or more of the alerts in the set of historical alerts; and identifying one or more root cause alerts, wherein the one or more root cause alerts are determined based on the plurality of occurrence counts and the plurality of the concurrent occurrence counts, and wherein the one or more root cause alerts are a subset of the plurality of alerts.

Abstract: A system that permits or otherwise facilitates assessment of operational state of a computing component in a computing environment. In one example, this disclosure describes a method that includes collecting, by a server device that is executing within a server device cluster, metric information indicative of an operational state of the server device, wherein the metric information is associated with a plurality of virtual computing instances executing on the server device; analyzing, by the server device and based on the metric information, whether a first condition associated with a first virtual computing instance is satisfied; analyzing, by the server device and based on the metric information, whether a second condition associated with a second virtual computing instance is satisfied; and updating control information characterizing the operational state of the server device executing within the server device cluster.

Abstract: An assessment environment is provided to generate real-time or nearly real-time events and/or alarms based at least on operational state of a host device. An agent module executing in the host device can monitor some or all of the performance metrics that are available in the host device and can analyze the monitored information in order to generate operational information and/or intelligence associated with an operational state of the host device and/or a computing component (e.g., an application, a virtual machine, or a container) associated therewith. The monitoring and analysis can be performed locally at the host device in real-time or nearly real-time. Analysis of the monitored information can be utilized to update first control information indicative of occurrence of an event and/or second control information indicative of presence or absence of an alarm condition. The control information can be sent to a remote device.