Delta state tracking for event stream analysis

Abstract

Systems and methods for delta state tracking for event stream analysis. Events at a device are tracked and stored locally or forwarded to a server. The events collectively form an event stream. When an event of interest occurs, the precise configuration of a device at the time of the event of interest can be determined by applying the event stream in chronological or reverse chronological order to a snapshot of the device's configuration. Thus, the snapshot can be taken at any time. Tracking the deltas to the device's configuration enables the precise configuration at the time of the event of interest to be determined.

What is claimed is: 
     
         1 . A method, comprising:
 receiving, by a server comprising a processor, event data representative of events associated with a network device, wherein the events comprise failure events and delta events, wherein the failure events correspond to problems associated with the network device, and wherein the delta events comprise respective changes in configuration of the network device, respective metrics applicable to the respective changes, and respective times of the respective changes; and   in response to identifying a failure event of interest of the failure events based on the respective metrics:
 identifying, by the server, a snapshot of the configuration of the network device at a time closest to occurrence of the failure event of interest, and 
 reconstructing, by the server, based on the snapshot and the delta events in the event data, a prior configuration of the network device with which the network device was configured prior to the failure event of interest. 
   
     
     
         2 . The method of  claim 1 , further comprising receiving, by the server, snapshot data comprising the snapshot of the configuration of the network device. 
     
     
         3 . The method of  claim 2 , wherein the snapshot data further comprises snapshots of configuration of the network device taken at different times. 
     
     
         4 . The method of  claim 1 , wherein the event data identifies a chronological relationship between the events associated with the network device. 
     
     
         5 . The method of  claim 1 , wherein the snapshot was captured prior to the failure event of interest, and reconstructing the prior configuration comprises applying to the snapshot, in forward chronological order, a portion of the delta events from a time range between a first time associated with the snapshot and a second time associated with the failure event of interest. 
     
     
         6 . The method of  claim 1 , wherein the snapshot was captured after the failure event of interest, and reconstructing the prior configuration comprises undoing, in reverse chronological order, a portion of the delta events from a time range between a first time associated with the snapshot and a second time prior to the failure event of interest. 
     
     
         7 . The method of  claim 1 , wherein the configuration is a portion of an entire configuration of the network device. 
     
     
         8 . A system, comprising:
 a processor; and   a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising:
 obtaining a stream of event data representative of events associated with a mobile device, wherein the events comprise failure events and delta events, wherein the failure events correspond to issues associated with the mobile device, and the delta events comprise respective changes in configuration of the mobile device, respective metrics applicable to the respective changes, and respective times associated with the respective changes; and 
 in response to detecting a failure event of interest of the failure events based on the respective metrics:
 identifying, by the server, a snapshot of the configuration of the mobile device at a time nearest to a failure time associated with the failure event of interest, and 
 reconstructing, by the server, based on the snapshot and the delta events in the event data, a prior configuration of the mobile device with which the mobile device was configured prior to the failure time associated with the failure event of interest. 
 
   
     
     
         9 . The system of  claim 8 , wherein the operations further comprise obtaining snapshot data comprising the snapshot of the configuration of the mobile device. 
     
     
         10 . The system of  claim 9 , wherein the snapshot data further comprises snapshots of the configuration of the mobile device recorded at different times. 
     
     
         11 . The system of  claim 8 , wherein the event data identifies a chronological relationship between the events associated with the mobile device. 
     
     
         12 . The system of  claim 8 , wherein the snapshot was recorded prior to the failure time associated with the failure event of interest, and reconstructing the prior configuration comprises applying to the snapshot, in forward chronological order, a portion of the delta events from a time range between a snapshot time associated with the snapshot and the failure time associated with the failure event of interest. 
     
     
         13 . The system of  claim 8 , wherein the snapshot was recorded after the failure time associated with the failure event of interest, and reconstructing the prior configuration comprises undoing, in reverse chronological order, a portion of the delta events from a time range between a first time associated with the snapshot and a second time prior to the failure time associated with the failure event of interest. 
     
     
         14 . The system of  claim 8 , wherein the configuration is a portion of an entire configuration of the mobile device. 
     
     
         15 . A non-transitory machine-readable medium, comprising executable instructions that, when executed by a processor of a server device, facilitate performance of operations, comprising:
 receiving event data representative of events associated with a client device, wherein the events comprise failure events and delta events, wherein the failure events correspond to issues associated with the client device, and the delta events comprise respective changes in configuration of the client device, respective metrics applicable to the respective changes, and respective times of the respective changes; and   in response to detecting a failure event of interest of the failure events based on the respective metrics:
 identifying, by the server, a snapshot of the configuration of the client device at a time relative to the failure event of interest, and 
 reconstructing, by the server, based on the snapshot and the delta events in the event data, a prior configuration of the client device with which the client device was configured prior to the failure event of interest. 
   
     
     
         16 . The non-transitory machine-readable medium of  claim 15 , wherein the operations further comprise obtaining snapshot data comprising the snapshot of the configuration of the client device. 
     
     
         17 . The non-transitory machine-readable medium of  claim 16 , wherein the snapshot data further comprises snapshots of the configuration of the client device taken at different times. 
     
     
         18 . The non-transitory machine-readable medium of  claim 15 , wherein the event data identifies a chronological relationship between the events associated with the client device. 
     
     
         19 . The non-transitory machine-readable medium of  claim 15 , wherein the snapshot was taken prior to the failure event of interest, and reconstructing the prior configuration comprises applying to the snapshot, in forward chronological order, a portion of the delta events from a time range between a first time associated with the snapshot and a second time associated with the failure event of interest. 
     
     
         20 . The non-transitory machine-readable medium of  claim 15 , wherein the snapshot was taken after the failure event of interest, and reconstructing the prior configuration comprises undoing, in reverse chronological order, a portion of the delta events from a time range between a first time associated with the snapshot and a second time prior to the failure event of interest.