The technology disclosed relates to building ensemble analytic rules for reusable operators and tuning an operations monitoring system. In particular, it relates to analyzing a metric stream by applying an ensemble analytical rule. After analysis of the metric stream by applying the ensemble analytical rule, quantized results are fed back for expert analysis. Then, one or more type I or type II errors are identified in the quantized results, and one or more of the parameters of the operators are automatically adjusted to correct the identified errors. The metric stream is further analyzed by applying the ensemble analytical rule with the automatically adjusted parameters.

In one embodiment, a supervisory service for a software-defined wide area network (SD-WAN) obtains telemetry data from one or more edge devices in the SD-WAN. The service trains, using the telemetry data as training data, a machine learning- based model to predict tunnel failures in the SD-WAN. The service receives feedback from the one or more edge devices regarding failure predictions made by the trained machine learning-based model. The service retrains the machine learning-based model, based on the received feedback.

A network monitoring device responds to a network status data (whether pushed from the network device or pulled from the network device), maintaining a buffer of saved status data. The status data is reordered, manipulated, and presented to users in order. The monitoring device can thus report an accurate momentary report of the status of the network environment. When status data is delayed too long, the monitoring device can discard it, or reduce its weighted consideration. The monitoring device adjusts its wait for status data, either as an average or individually per device, attempting to balance accuracy and latency. The monitoring device also records of how much status data it is required to process, in response to the amount it can process reliably, and maintains a sampling rate for status data, somewhere between evaluating all of the status data, and evaluating only a small portion of the status data, when capable, attempting to balance the degree of sampling, against both error and latency.

A computer-implemented method for recommending a monitoring interval in provided. A non-limiting example of the computer-implemented method includes receiving, by a processor, monitoring data at an initial monitoring interval and calculating, by the processor, a set of aggregation data from the monitoring data including a first subset of aggregation data at a first interval of the initial monitoring interval. The method calculates, by the processor, a first density score for the first subset of aggregation data and a first indicator score for the first subset of aggregation data and provides, by the processor, the first interval as a recommended interval when the first density score does not exceed a density threshold and the first indicator threshold does not exceed an indicator threshold.

A non-transitory computer-readable storage medium having stored therein a program, the program executing a process include storing an object that is a unit obtained by sectioning received data by a certain size, the object including a plurality of sessions; calculating a value related to an acquisition time for each of a plurality of data acquisition methods that include a first method that acquires the data in a unit of the session and a second method that acquires the data in a unit of the object; determining the data acquisition method based on the value related to the calculated acquisition time; performing the data acquisition with the determined data acquisition method; periodically acquiring the data with the data acquisition method other than the determined data acquisition method; updating the value related to the acquisition time; and determining the data acquisition method based on the value related to the acquisition time.

Accelerating monitoring of network traffic by: configuring a first network chip of a non-accelerated line card with a VOQ associated with an internal interface that is connected to a second network chip of a first accelerated line card; receiving, at the first network chip, a data unit; selecting, by the first network chip, the data unit based on a traffic sampling rate; adding information identifying the data unit as having been selected for sampling to obtain a selected data unit; and sending the selected data unit from the first network chip to the second network chip using the VOQ and the internal interface. The second network chip identifies the selected data unit and, based on the identification, appends a sampling header to the data unit to obtain a sampled data unit, and transmits the sampled data unit to the sampling engine of the first accelerated line card.

A sampling frequency recommendation method, apparatus, and device, and a storage medium relating to the field of communications technologies are disclosed. The sampling frequency recommendation method includes: obtaining a network key performance indicator of a to-be-analyzed data stream; sampling the network key performance indicator based on a plurality of different sampling frequencies to obtain an experience quality sequence corresponding to each sampling frequency, where the plurality of different sampling frequencies include one standard sampling frequency and at least two to-be-tested sampling frequencies, and the standard sampling frequency is greater than each to-be-tested sampling frequency; and determining a matching degree between an experience quality sequence corresponding to each to-be-tested sampling frequency and a standard experience quality sequence, and determining a recommended sampling frequency based on the matching degree between the experience quality sequence corresponding to each to-be-tested sampling frequency and the standard experience quality sequence.

A method samples a stream of data items. Each data item has an associated timestamp. The method assigns a priority value to each data item. Each data item is represented as a point on a two-dimensional graph whose axes are time and priority. A sliding window covers a predetermined length of time t.sub.span and uses a backward probability decay curve to specify what priority values are included in the sliding window. This defines, for a current time t.sub.c, a current data sample consisting of data items whose timestamps t fall within the time span t.sub.ct.sub.spantt.sub.c and have priority values below the decay curve. The data sample is stored in a buffer. The process iteratively moves the sliding window forward by a time increment, creating a provisional data sample. When the size of the provisional data sample is too large or too small, the process scales the decay curve.

A method for online monitoring of a physical environment using a variable data sampling rate is implemented by a computing device. The method includes sampling, at the computing device, at least one data set using at least one sampling rate. The method also includes processing the at least one data set with condition assessment rules. The method further includes determining whether the at least one data set indicates a change in state of the physical environment. The method additionally includes updating the at least one sampling rate.

A method is disclosed for performing a performance measurement on a packet flow transmitted along a path through a packet switched communication network. At least two measurement points implemented on the path calculate a sampling signature for each packet of the flow by applying a hash function to a mask of bits of the packet, and identify a sub-flow of measurement samples as those packets whose sampling signatures are equal to a certain value H*. The measurement points then provide measurement parameters for the measurement samples, which are used for providing performance measurement for the whole packet flow. Tailoring the length of the sampling signature allows the sampling rate to be statistically controlled so as to balance the risk of reception sequence errors between measurement samples and the computational effort on one hand, and the accuracy of the measurements provided on the other hand.