How Event‑Flow Diagrams Transform Network Fault Monitoring

Overview

Operations visualization aims to present the status of services, resources, and devices, as well as ongoing events, through visual means, guiding operators and developers to make correct decisions. Higher visualization reduces operational complexity and improves efficiency.

Real‑time monitoring is crucial for fault detection and diagnosis. This article uses an internal network monitoring scenario to illustrate the importance of visualization. “Internal network” refers to a company's internal LAN, including data‑center networks.

Abnormal Event Visualization

When an engineer detects a system failure, checking network connectivity is a standard step. Engineers need to know the data‑center and network paths involved, so they expect the internal monitoring system to provide an overview of network faults for selected time periods.

Displaying faults in a table shows each event with columns for data‑center, start‑end time, and severity, but this approach has three drawbacks: it’s hard to see severity at a glance, duration is not intuitive, and simultaneous faults across data‑centers are unclear.

When many events span long periods, tables become unwieldy. To address these issues, we need a visualization that simultaneously shows data‑center, time, and severity. An event‑flow diagram can serve this purpose.

Figure 1: Event‑flow diagram uses a river metaphor, split into colored bands where each band represents a category of events. The width of a band indicates the number of events at a given moment.

To expose individual event details, we modified the diagram: each fault is a rectangle whose horizontal edges correspond to start and end times; color encodes severity; rectangles for the same data‑center share the same vertical level; overlapping events expand the vertical space.

Figure 2 shows the customized event‑flow diagram with three data‑centers. Data‑center 1 has a severe long‑duration fault (red), data‑center 2 has four short‑duration minor faults (yellow), and data‑center 3 has twelve minor faults, three of which are long‑duration. Hovering reveals detailed information for each fault, offering a far more intuitive view than a table.

Conclusion

The event‑flow diagram visualizes faults across data‑center, time, and severity dimensions, enabling engineers to quickly assess abnormal conditions. The same approach can visualize change events or combine changes with faults to trace root causes. We will continue to introduce other visualization components and framework details in future posts.