Examples herein describe systems and methods for self-healing in a Telco network function virtualization cloud. KPI attributes for virtual network functions can be mapped to physical fault notifications to create synthesized alerts. The synthesized alerts can include information from both a virtual and physical layer, allowing a self-healing action framework to determine root causes of problems in the Telco cloud. Remedial actions can then be performed in either the virtual or physical layer of the Telco cloud. Remedial actions in one layer can be based on root causes identified in the other, which can allow for remediation before network downtime occurs.

Methods, apparatus, systems and articles of manufacture to attempt to establish a connection with a wireless network are disclosed. An example method includes determining a location of a field device. A frequency at which retry attempts to establish a connection with a wireless network are to be made is determined based on the location of the field device. Establishing the connection with the wireless network is attempted. In response to a failure to establish the connection with the wireless network, an indication of the failure to establish the connection and the location of the field device is stored, and the field device waits an amount of time based on the frequency.

In the method, a detection agent apparatus receives location information of a monitoring point on a service path that is sent by a detection control apparatus, where the detection agent apparatus is located in the NFV system; the detection agent apparatus obtains fault locating information from the monitoring point based on the location information of the monitoring point, where the fault locating information is information obtained by the monitoring point according to a filter criterion, and the fault locating information includes the location information of the monitoring point; and the detection agent apparatus sends the fault locating information to the detection control apparatus, where the detection control apparatus may determine a faulty monitoring point based on the fault locating information and a service model corresponding to the service path.

A method includes: sending, by a first service entity, a first request to a second service entity, where the first service entity is configured to manage a network slice instance, and the second service entity is configured to manage an alarm of a network function instance, where the first request includes identifier information of a VNF instance; the first request is used to request a virtualized resource alarm carrying the identifier information; and there is a correspondence between the VNF instance and a first network slice instance managed by the first service entity; and receiving, by the first service entity, a first response from the second service entity, where the first response carries the virtualized resource alarm.

A system includes a non-transitory memory and one or more hardware processors. The one or more hardware processors are configured to read instructions from the non-transitory memory to perform operations including generating a service mapping illustrating a plurality of tiles, wherein each of the plurality of tiles corresponds to one or more services in an enterprise network and one or more lines extending between the plurality of tiles, wherein the one or more lines correspond to connections between the plurality of services, wherein a first tile of the plurality of tiles corresponds to a first service comprising a plurality of sub-services not depicted in the service mapping, and displaying an alert on the first tile corresponding to the first service when one or more of the plurality of sub-services encounters an error.

In an exemplary embodiment, a computer system hosts a logical Key Performance Indicator (KPI) network to detect computer performance anomalies. Databases execute database KPI nodes, database edges, and database instance nodes of the logical KPI network to propagate database KPI data to a KPI server system. Application servers execute application server KPI nodes, application server edges, and application server instance nodes of the logical KPI network to propagate application server KPI data to the KPI server system. Web servers execute web server KPI nodes, web server edges, and web server instance nodes of the logical KPI network to propagate web server KPI data to the KPI server system. This KPI data indicates logical data path information for the propagated KPI data (instead of KPI values). The KPI server system processes the logical data path information to indicate the computer performance anomalies.

Approaches presented herein enable generation of a multi-dimensional tag metric in a cloud resource management environment. More specifically, a tagging namespace is provided for managing a resource in the cloud resource management environment. This namespace comprises at least two dimensions and a plurality of positions. A set of tags associated with the resource are received into the tagging namespace. A match of each tag of the set of tags to a position within the namespace into which that tag was received is verified and an alert is triggered in the case verification fails. Alternatively, in the case verification is successful, the tag-containing namespace is validated as a multi-dimensional tag metric.

Network alert detection utilizing trained edge classification models is described. An example of a computing system includes a processor and a memory storing instructions that cause the processor to train one or more classification models at a core for detection of signatures based on training data derived from a set of error codes; deploy the one or more trained classification models at an edge of a network; receive alerts from one or more nodes in one or more clusters of nodes in the network; detect one or more signatures by processing the received alerts at the one or more trained classification models; and perform one or more actions to address a signature that is detected by the one or more trained classification models.

Systems, methods, and related technologies for device monitoring are described. In certain aspects, network traffic data is analyzed to determine one or more devices associated with a network. The network may be a remote network. The network traffic data may further be used to determine one or more non-active devices associated with the network.

A processor retrieves alarm data associated with an operation support system. A processor filters the alarm data. A processor groups the filtered alarm data. A processor extracts cross-domain node and port information for the grouped alarm data. A processor generates a cross-domain topology of the operation support system based on the extracted cross-domain node and port information.