Scalable real time metrics management

Abstract

Managing performance metrics includes: obtaining a plurality of performance metrics associated with a plurality of sources on a network; aggregating, at a first rate, the plurality of performance metrics associated with the plurality of sources to generate a plurality of first aggregated results; maintaining at least some of the plurality of first aggregated results in one or more memories; aggregating, at a second rate, the plurality of first aggregated results to generate a plurality of second aggregated results, the second rate being a lower rate than the first rate; and maintaining at least some of the plurality of second aggregated results in the one or more memories.

What is claimed is: 
     
         1 - 21 . (canceled) 
     
     
         22 . A method of analyzing metric data sets associated with a set of elements in a network, the method comprising:
 aggregating, at a first rate, a plurality of metric data sets associated with the set of network elements to generate a plurality of first aggregated results;   aggregating, at a second rate, the plurality of first aggregated results to generate a plurality of second aggregated results, the second rate being a lower rate than the first rate; and   analyzing the plurality of second aggregated results in order to monitor the set of network elements,   said first and second aggregation operations performed to reduce amount of memory used to store metric data sets by producing aggregated results for said analyzing operation.   
     
     
         23 . The method of  claim 22  further comprising analyzing the plurality of first aggregated results in order to monitor performance of the set of network elements. 
     
     
         24 . The method of  claim 22 , wherein the pluralities of the first and second aggregated results are stored in memory, and the analyzing comprises performing fast analytical operations on the plurality of the second aggregated results stored in memory in order to monitor the set of network elements. 
     
     
         25 . The method of  claim 24 , wherein the analyzing further comprises performing fast event detection operations on the plurality of second aggregated results stored in memory in order to identify events associated with the set of network elements. 
     
     
         26 . The method of  claim 24  further comprising storing the pluralities of first and second aggregated results to one or more database for subsequent queries. 
     
     
         27 . The method of  claim 22 , wherein the analyzing comprises:
 performing an analytical operation on the plurality of second aggregated results to monitor the set of network elements; and   performing event detection operation on the plurality of second aggregated results to identify events associated with the set of network elements.   
     
     
         28 . The method of  claim 27 , wherein the analyzing comprises:
 performing an analytical operation on the plurality of first aggregated results to monitor the set of network elements; and   performing event detection operation on the plurality of first aggregated results to identify events associated with the set of network elements.   
     
     
         29 . The method of claim  21  further comprising collecting the plurality of metric data sets from a plurality of sources in the network that collect metric data at different rates. 
     
     
         30 . The method of claim  21  further comprising storing the pluralities of the first and second aggregated results in memory;
 aggregating, at a third rate, the plurality of second aggregated results to generate a plurality of third aggregated results, the third rate being a lower rate than the first and second rates; and 
 analyzing the plurality of third aggregated results in order to monitor the set of network elements. 
 
     
     
         31 . A non-transitory computer readable medium storing a program for analyzing metric data sets associated with a set of elements in a network, the program executable by a processing unit, the program comprising sets of instructions for:
 aggregating, at a first rate, a plurality of metric data sets associated with the set of network elements to generate a plurality of first aggregated results;   aggregating, at a second rate, the plurality of first aggregated results to generate a plurality of second aggregated results, the second rate being a lower rate than the first rate; and   analyzing the plurality of second aggregated results in order to monitor the set of network elements,   said first and second aggregation operations performed to reduce amount of memory used to store metric data sets by producing aggregated results for said analyzing operation.   
     
     
         32 . The non-transitory computer readable medium of  claim 31 , the program further comprising a set of instructions for analyzing the plurality of first aggregated results in order to monitor performance of the set of network elements. 
     
     
         33 . The non-transitory computer readable medium of  claim 31 , wherein the pluralities of the first and second aggregated results are stored in memory, and the set of instructions for analyzing comprises a set of instructions for performing fast analytical operations on the plurality of the second aggregated results stored in memory in order to monitor the set of network elements. 
     
     
         34 . The non-transitory computer readable medium of  claim 33 , wherein the set of instructions for analyzing further comprises a set of instructions for performing fast event detection operations on the plurality of second aggregated results stored in memory in order to identify events associated with the set of network elements. 
     
     
         35 . The non-transitory computer readable medium of  claim 33 , the program further comprising a set of instructions for storing the pluralities of first and second aggregated results to one or more database for subsequent queries. 
     
     
         36 . The non-transitory computer readable medium of  claim 31 , wherein the set of instructions for analyzing comprises sets of instructions for:
 performing an analytical operation on the plurality of second aggregated results to monitor the set of network elements; and   performing event detection operation on the plurality of second aggregated results to identify events associated with the set of network elements.   
     
     
         37 . The non-transitory computer readable medium of  claim 36 , wherein the set of instructions for analyzing comprises sets of instructions for:
 performing an analytical operation on the plurality of first aggregated results to monitor the set of network elements; and   performing event detection operation on the plurality of first aggregated results to identify events associated with the set of network elements.   
     
     
         38 . The non-transitory computer readable medium of  claim 31 , the program further comprising a set of instructions for collecting the plurality of metric data sets from a plurality of sources in the network that collect metric data at different rates. 
     
     
         39 . The non-transitory computer readable medium of  claim 31 , the program further comprising sets of instructions for:
 storing the pluralities of the first and second aggregated results in memory;   aggregating, at a third rate, the plurality of second aggregated results to generate a plurality of third aggregated results, the third rate being a lower rate than the first and second rates; and   analyzing the plurality of third aggregated results in order to monitor the set of network elements.