K. Houck, S. Calo, and A. Finkel. Towards a practical alarm correlation system. In IM'95 [20], pp. 226--237.  Home/Search   Document Not in Database   Summary   Related Articles   Check

.... multiple alarms by a device for a single fault, 4) detection of and issuing a notification about the same network fault by many objects (hardware or software network components) simultaneously, and (5) error propagation to other network objects causing them to fail and generate additional alarms [15]. It may be argued that typical networked systems provide plenty of information necessary to infer the existence of faults [41] The following paragraphs present some common problems that have to be addressed by a fault localization technique. Fault evidence may be ambiguous, inconsistent and ....

....the underlying system. They constitute a class of expert systems that are the most widely used for fault diagnosis. The system model provides information on network topology [41] and on how a failure condition or alarm in one component is related to failure conditions or alarms in other components [15]. The model based approaches differ with regard to the technology used to define the system model. Thanks to representing deep knowledge of the network connectivity and operation, model based approaches have the potential to solve novel problems and their knowledge may be organized in an ....

[Article contains additional citation context not shown here]

K. Houck, S. Calo, and A. Finkel. Towards a practical alarm correlation system. In IM'95 [20], pp. 226--237.

....unwanted rule side effects and decrease the overall number of correlation rules. Another group of approaches incorporate an explicit representation of the structure and function of the system being diagnosed. The representation provides information about dependencies between network components [11, 13, 14, 15, 16] or about cause effect relationships between network events [9, 21] The fault isolation process explores the network model to verify correlation between events. Model based reasoning systems [13, 21] utilize inference engines controlled by a set of correlation rules, which contain model ....

....[13, 21] utilize inference engines controlled by a set of correlation rules, which contain model exploration predicates. Modeltraversal techniques recursively search the dependency graph towards the failing object in an event driven fashion starting from the component that symptoms refer to [11, 14, 15]. Fault propagation models [9, 16] provide heuristic symptom explanation algorithms aimed at satisfying some optimality criteria. Event correlation systems based on a formal representation of network dependencies and structure represent an improvement over early rule based systems by having the ....

[Article contains additional citation context not shown here]

K. Houck, S. Calo, and A. Finkel. Towards a practical alarm correlation system. In A. S. Sethi, Y. Reynaud, and F. FaureVincent, editors, Integrated Network Management IV, pages 226--237, Santa Barbara, CA, May 1995. Chapman and Hall.

....establish the underlying problem or condition that produced the events. Successful implementation of an event correlation system can increase revenue since problems can be identified faster, resulting in a quicker restoration of service. In this paper, we define the process of alarm correlation [2,3,7] in the telecommunications network domain and go on to briefly outline some of the correlation systems which have been proposed by academic and industrial research establishments. This will provide sufficient context for the new, artificial neural network paradigm to be presented which solves some ....

K.Houck, S.Calo, A.Finkel, "Towards a Practical Alarm Correlation System", Integrated Network Management - proceedings of the fourth international symposium on integrated network management

....aspects: i) We deal with QoS requirements and not security; ii) None of the existing work deals with fault isolation. The implication being that the action specified in the policy will be enough. This is not the case for QoS requirements. 6. 3 Fault Isolation and Diagnosis A literature survey [1, 17, 8, 11, 7, 18, 16, 15] has shown that appropriate techniques exist for specific areas of fault management especially at the network layer. We use a a combination of the approaches presented in the related work, but we focus on the application layer. In addition, most of the existing work focusses on availability issues ....

K. Houck, S. Calo, and A. Finkel. Towards a practical alarm correlation system. In Proceedings 4th IFIP/IEEE International Symposium on Integrated Nework Management, pages 519--530, 1995.

....aspects: i) We deal with QoS requirements and not security; ii) None of the existing work deals with fault isolation. The implication being that the action specified in the policy will be enough. This is not the case for QoS requirements. Fault Isolation and Diagnosis A literature survey [1, 17, 8, 11, 7, 18, 16, 15, 13] has shown that appropriate techniques exist for specific areas of fault management especially at the network layer. We use a a combination of the approaches presented in the related work, but we focus on the application layer. In addition, most of the existing work focusses on availability issues ....

K. Houck, S. Calo, and A. Finkel. Towards a practical alarm correlation system. In Proceedings 4th IFIP/IEEE International Symposium on Integrated Nework Management, pages 519--530, 1995.

....unfeasible [Nygate, 1995] Besides that, many of the received notifications do not contain original information. In fact, the occurrence of a single fault in the supervised network sometimes results in the reception of multiple notifications. Several factors contribute to this situation [Houck et al. 1995]: 2 A trunk is named killer if it systematically accepts the calls that are offered to it and releases them (kills them) soon after. 11 1. A device may generate several alarms due to a single fault; 2. A fault may be intrinsically intermittent, which implies in the sending of a notification ....

....management of telecommunications networks. Besides the inherent complexity to any NP complete problem, the project and the development of the algorithms necessary to make the correlation, assuming that the mentioned barriers are surpassed, must take into account the following additional aspects [Houck et al. 1995]: ffl Noises, constituted by meaningless information, redundant information, streaming alarms, occasional spikes, frequent oscilations and repeated occurrences; ffl Hidden Dependencies. Very often the strategy adopted in the correlation demands the construction of a model of the managed network. ....

[Article contains additional citation context not shown here]

K. Houck, S. Calo, and A. Finkel. Towards a practical alarm correlation system. In IFIP/IEEE International Symposium on Integrated Network Management, IV (ISINM'95) [1995], pages 226--237.

....or at least to partially reduce information redundancy. IMPACT [7, 8] adopts a model based approach, where a network element class hierarchy is used as the structure model and a message class hierarchy, a correlation class hierarchy and correlation rules are used as the behavior model. NetFACT [6] also has an object oriented model to describe the connectivity, dependency and containment relationships among network elements. Events are correlated based on these relationships. In EXCpert [15] the cause effect relationships among events are modelled with correlation tree skeletons as the ....

K. Houck, S. Calo, and A. Finkel. Towards a practical alarm correlation system. In the 4th IEEE/IFIP Symposium on Integrated Network Management, 1995.

....faults. A fault may cause several alarms in the network, and several faults may coexist at the same time leading to a cascade of alarms. Mapping alarms to faults is a challenging problem. Several approaches have been suggested e.g. use of coding techniques[KLI95] network configuration information[HOU95][GLN96] etc. Yet the basic requirements of network fault management[DUP89] STA93] are far from being realized. Alarms are generated by entities in the network when they sense an abnormality. For example, an agent may be configured to generate an alarm when it sees too many 2 Divide and Conquer ....

K. Houck et.al "Towards a Practical Alarm Correlation System ", Proceedings , Fourth International Symposium on Integrated Network Management, 1995.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC