Techniques are described in which a network management system (NMS) is configured to determine a root cause of degraded network performance based on SLE metrics and the locations associated with network devices providing the SLE metrics. The NMS can determine service level experience (SLE) metrics associated with each client device on a network and location data for each client device of the plurality of client devices. The NMS can generate a time series of parameter vectors, where each parameter vector includes SLE metrics corresponding to each client device of the plurality of client devices. Each parameter vector is associated with the location of the client device corresponding to the SLE metrics. The NMS can determine, based on the time series of parameter vectors and associated locations, a root cause for a degradation in SLE metrics associated with the one or more of the client devices.

This disclosure describes systems, devices, and techniques for determining a root cause of anomalous events in a networked computing environment. A node detects an alert corresponding to an anomalous event during a time period. The alert is correlated with previously detected alerts occurring within the time period and a causal relationship associated with nodes in the networked computing environment. The node may then recursively identify a root cause of the anomalous event detected in the networked computing environment based on a set of correlated alerts. An incident ticket may then be sent to the node identified as the root cause of the anomalous event, and the node may notify other nodes in the network having a causal relationship with the node of the anomalous event.

Example methods and systems for logical network health check. One example may comprise obtaining network configuration information and network realization information associated with a logical network; processing the network configuration information and the network realization information to determine the following: (a) network configuration health information specifying a network configuration issue and a first remediation action; and (b) network realization health information specifying a network realization issue and a second remediation action; and providing, to a user device, multiple user interfaces (UIs) specifying the first health information and the second health information along with a visualization of the logical network. In response to detecting an instruction initiated by the user device using at least one of the multiple UIs, the first remediation action or the second remediation action may be performed.

The disclosed technology is directed towards automatically detecting failure states and the cause of the failure. For a network, the technology collects status messages from equipment and customers into batches as they occur. The technology groups and aggregates messages, then transforms the aggregations to the frequency domain. Anomalies induce detectable changes in the particle distribution of a trained particle filter, from which an anomalous spectrogram is generated. The status messages of each device are iteratively removed from the larger set of messages, resulting in reduced subsets that are each aggregated, transformed into a modified spectrogram and compared against the anomalous spectrogram to obtain a distance score. The distance score for each device is used to rank the devices with respect to being the cause of the failure.

Methods, systems, and computer-readable media are disclosed herein that monitor and improve network performance and reliability of a plurality of devices and nodes. In aspects, alert types are categorized based on the role, model, and operating system of a device or node within the network for which the alert was generated. A command set that is responsive to the alert and that is specially configured for the role, model, and operating system of the device or node is automatically selected to address the alert. The command set can be executed against the device or node (or neighboring device/node) in order to investigate the cause or source of the alert. Based on the results returned by the command set's execution, remediation actions can be selected and implemented to improve the technological performance (e.g., memory, CPU, connectivity) of the device or node in the network.

An agent interfaces with a sending computing device and a receiving computing device to automatically adjust one-way or two-way real-time audio and real-time video transmission parameters responsive to changing network conditions and/or application requirements. The agent incorporates a reinforcement learning model that adjusts transmission parameters to maximize an expected value of a sum of future rewards; the expected value of the sum of future rewards is based on a current state of the sending computing, a current action (e.g. a current set of transmission parameters) at the sending computing device and a reward provided by the receiving computing device. The reward is representative of a user-perceived quality of experience at the receiving computing device.

A computer implemented method of monitoring and controlling a target system, such as a communication network or an industrial process. The method includes receiving information about anomalies in operation of the target system detected by an automated anomaly detection mechanism; automatically determining certainty characteristics of the detected anomalies; submitting detected anomalies to expert evaluation in priority order determined based on the certainty characteristics; and adjusting the determination of certainty characteristics of the detected anomalies and/or the automated anomaly detection mechanism based on results of the expert evaluation.

A method of managing alerts in a client instance associated with a configuration management database (CMDB) platform is disclosed. The method includes: receiving a request identifying a particular CI and a particular alert; identifying related CIs from a plurality of CIs associated with the client instance based on the particular CI and the particular alert; identifying alerts, incidents (INTs), changes (CHGs), and problems (PRBs) of the client instance that are associated with either the particular CI or the related CIs; determining frequency data for the alerts, INTs, CHGs, and PRBs associated with the particular CIs and frequency data for the alerts, INTs, CHGs, and PRBs associated with the related CIs; and sending a response that includes the frequency data for the alerts, INTs, CHGs, and PRBs associated with the particular CIs to be presented alongside the frequency data for the alerts, INTs, CHGs, PRBs associated with the related CIs.

Example aspects include techniques for implementing peer group evaluation for comparative anomaly. These techniques may include determining a candidate group including a plurality of component metrics, and determining that the plurality of component metrics are a peer group based at least in part on a cluster profile of the candidate group and the candidate group exhibiting peer-like behavior of a period of time. In addition, the techniques may include detecting anomalous activity based at least in part on first performance information of a component metric deviating from second performance information for the peer group, and providing a notification of the anomalous activity.

The claimed system and method describes a root cause analysis system for a radio access network. Some aspects include automatic identification of possible causes for network issues, their ranking, determination of the root (main) cause and execution of related best actions, alerts and reporting in order to automatically identify, mitigate or eliminate the problem.