Aviz Networks NCP Troubleshooting Agent automates datacenter triage

The NCP Troubleshooting Agent automates datacenter network triage by running device commands, parsing CLI output, collecting evidence, classifying a failure domain, and assigning confidence scores, turning 15–20 minute sessions into about 2-minute diagnoses. The update targets repeatable incident workflows for NetOps teams that otherwise correlate outputs manually.

Research Overview

The post frames manual troubleshooting as a repeated process where engineers SSH to devices, execute a consistent checklist, correlate results by hand, and determine the failure location. It argues that the cost comes from human repetition and variability rather than from command selection alone.

It also provides a comparison between manual triage steps and automated execution, including SSH navigation, command chains, output correlation, and failure-domain decisioning. The post states that automation removes variance between engineers by applying the same workflow every time.

Key Findings

The agent is described as supporting datacenter network triage based on two inputs: a device name and a destination IP. It returns a structured diagnosis report that includes a classified failure domain and a confidence score.

The post states that the workflow prioritizes reachability checks first and, when reachability fails, proceeds through layered validation such as interface health, VLAN and trunk conditions, SVI and gateway state, ARP, routing, BGP, logs, and ACL denials. It adds that the agent collects all checks before classifying, so it does not stop at the first failure.

Technical Breakdown

The architecture is presented as separated layers where an “agent” layer takes user input and selects a mode, a workflow layer executes the triage logic, and tool and parser layers handle command execution and output normalization. The transport layer performs SSH using Paramiko and maintains command mappings per supported OS.

The post lists five output-handling responsibilities for reliability, including collecting evidence before classification, distinguishing timeouts from missing entries, reporting only what was confirmed, and attaching confidence scores to each result. It further describes parsers as converting raw CLI output into JSON and handling differences across NX-OS, Catalyst, Arista, and SONiC formats.

Operational Impact

The workflow is described as a 9-step sequence that begins with a ping reachability test, then checks interface health, Layer-2 forwarding conditions, SVI and gateway state, ARP, routing, BGP, logs, and ACL hits. The post claims early exit when ping succeeds to avoid running unnecessary checks.

It also addresses operational edge cases in multi-tenant environments by allowing an optional “vrf=” parameter for specific checks such as ARP and routing lookups. The post explains that querying the global table in multi-tenant datacenters can return empty results and that passing the VRF name enables correct answers.

Leadership Perspective

The post emphasizes that the agent’s design separates “diagnosis” from SSH handling, which it presents as making the system testable and easier to extend. It also states that the evidence collection approach is intended to support classification from a full picture rather than from a single missing datapoint.

For incident handling, it provides an example report that includes the device, destination, failure domain, confidence level, probable cause, and an evidence list covering checks across the stack. It also states that next actions appear as explicit command suggestions tied to the diagnosis.

Overall, the blog describes a structured automation pipeline for datacenter network troubleshooting that executes commands, normalizes CLI output, collects evidence, classifies failure domains, and scores confidence, with a stated reduction in troubleshooting time. This “Blog Signals brief” is a fact-based summary of the vendor blog.