Y. A. Nygate. Event correlation using rule and object based techniques. In Proc. IFIP/IEEE International Symposium on Integrated Network Management, pages 278--289, May 1995.  Home/Search   Document Not in Database   Summary   Related Articles   Check

....Since fault propagation generates alarm propagation, techniques for alarm correlation are relevant to the third step in our program detecting activation of a generic propagation mechanism. There is a large body of literature on alarm correlation. Some examples include [JW93] JW95] KS95] [N95], YK 96] HSV99] among others. We also note that in the MAGDA Project [FBJ 00] the interaction of network elements in fault propagation is modeled using Petri nets. In this paper, we focus on a single example of a generic propagation mechanism: overload propagation in the control plane caused ....

Y. A. Nygate, "Event correlation using rule and object based techniques," IEEE/IFIP Symposium on Integrated Network Management, 1995.

....system configuration changes. Rule based systems are also unable to deal with inaccurate information and get convoluted if timing constraints are included in the reasoning process. Also, rule interactions may result in unwanted side effects, difficult to verify and change. Model based approaches [5, 9, 22, 35] incorporate deep knowledge in the form of a model of the underlying system. They constitute a class of expert systems that are the most widely used for fault diagnosis. The system model provides information on network topology [41] and on how a failure condition or alarm in one component is ....

Y. A. Nygate. Event correlation using rule and object based techniques. In IM'95 [20], pp. 278--289.

.... Techniques to tune threshold values Threshold violations and system bottleneck prediction Support for uncertainty and lost events 13 6 Related work In the past various event correlation techniques were proposed including rule based systems [18, 26] model based reasoning systems [13, 21], model traversing techniques [14, 15] case based systems [17] fault propagation models [9, 16] and the code book approach [27] Rule based systems are composed of rules (productions) of the form conclusion if condition. The condition part is a logical combination of propositions about the ....

....about the current set of received alarms and the system state [18, 26] the conclusion determines the state of correlation process. The operation of the system is controlled by an inference engine, which in fault management applications typically uses a forward chaining inference mechanism [18, 21]. Rule based systems are believed to lack scalability, to be difficult to maintain, and to have difficult to predict outcomes due to unforeseen rule interactions. Most of these difficulties are a result of hard coded network connectivity information within the rules. Yemanja s scenarios contain ....

[Article contains additional citation context not shown here]

Y. A. Nygate. Event correlation using rule and object based techniques. In A. S. Sethi, Y. Reynaud, and F. Faure-Vincent, editors, Integrated Network Management IV, pages 278--289, Santa Barbara, CA, May 1995. Chapman and Hall.

....perform fault localization iteratively in real time. In the past, fault diagnosis efforts concentrated mostly on detecting, isolating, and correcting faults related to network connectivity [9, 18, 33, 35] The diagnosis focused on lower layers of the protocol stack (physical and data link layers) [24, 35], and its major goal was to isolate faults related to the availability of network resources, such as broken cable, inactive interface, etc. Modern enterprise environments increasingly demand support for quality of service (QoS) guarantees. This paper, in addition to dealing with resource ....

.... 10 20 30 40 50 60 time [sec] Graph size one fault two faults three faults four faults Figure 9: Fault localization time with Algorithm 7 Related work In the past, various event correlation techniques were proposed including rule based systems [22, 34] model based reasoning systems [15, 24], model traversing techniques [16] case based systems [21] fault propagation models [12, 18] and the codebook approach [35] Most of the above approaches utilize deterministic reasoning. This paper focuses on non deterministic event correlation which is unavoidable in fault diagnosis related to ....

Y. A. Nygate. Event correlation using rule and object based techniques. In Sethi et al. [27], pp. 278--289.

....therefore a promising model for nondeterministic fault localization, yielding high accuracy even for approximate probability input data. IX. RELATED WORK In the past, various event correlation techniques were proposed including rule based systems [22] 23] model based reasoning systems [24] [25], model traversing techniques [26] case based systems [27] fault propagation models [6] 7] and 0 7803 7476 2 02 17.00 (c) 2002 IEEE. 0.55 0.6 0.65 0.7 0.75 0.8 0.85 0.9 0.95 1 rate Network size exact three confidence levels two confidence levels one confidence level Fig. 10. ....

Y. A. Nygate, "Event correlation using rule and object based techniques," In Sethi et al. [32], pp. 278--289.

....establish the underlying problem or condition that produced the events. Successful implementation of an event correlation system can increase revenue since problems can be identified faster, resulting in a quicker restoration of service. In this paper, we define the process of alarm correlation [2,3,7] in the telecommunications network domain and go on to briefly outline some of the correlation systems which have been proposed by academic and industrial research establishments. This will provide sufficient context for the new, artificial neural network paradigm to be presented which solves some ....

Nygate, Y.A., "Event Correlation using Rule and Object Based Techniques", Integrated Network Management - proceedings of the fourth international symposium on integrated network management

....time. It makes no sense to consider the same fault involving the same network elements twice at the same time (although it can occur repeatedly) It is pointed out that in telecommunication networks faults could appear simultaneously, i.e. multiple faults occur, which are then concurrent (see e.g. [18]) Moreover, several faults could combine themselves to produce others faults (And, Or dependencies in Fig. 4) and one single fault could result in several other faults (Simultaneous, Exclusive dependencies in Fig. 4) An alarm pattern could then be defined by a set of alarms (and their ....

Y.A. Nygate. Event Correlation using Rule and Object Based Techniques. In Sethi, Raynaud, and Faure-Vincent, editors, Integrated Network Management, number 4, pages 278--289. IFIP, Chapman and Hall, may 1995.

....as an alarm) If all of these alarms are reported to an NM station without analysis, then the operator will be overwhelmed and may not be able to detect the real cause, as the number of alarms generated may be very large. If the various relationships between events (an example taken from [Nyg95] is shown in Figure 2.5 where the causal relationship between alarms generated from a switch is shown) and the network configuration information are known, then the alarm(s) that have to be taken care of can be quickly isolated. The other intermediary alarms can just be ignored. Events may also ....

....are not overwhelmed with the alarms. The correlators use an event model to analyze the alarms. The event model represents knowledge of various events and their causal relationships. The correlator determines the common problems that caused the observed alarms. The ECXpert system described in [Nyg95] is an expert system that correlate events based on causal relationship between events. The users specify the causality between CHAPTER 2. NETWORK MANAGEMENT SYSTEMS 29 events and groups related events into a correlation group. The causality between events defines a tree called a correlation tree ....

[Article contains additional citation context not shown here]

Y. A. Nygate. Event correlation using rule and object based techniques. In A.S. Sethi, Y. Raynaud, and F. Faure-Vincent, editors, Proceedings of the IEEE/IFIP Fourth International Symposium on Integrated Network Management, pages 278--289. Chapman and Hall, May 1995.

....monitoring interface. A distributed architecture for event filtering and generation can be implemented at significantly less cost compared to configuring and installing centralized event filtering systems. There has been a significant amount of work in the field of composite event generation [NYG95, HAY96, MAN97]. Our event architecture uses the services of READY, an event processing and notification system [GRU97] to generate composite events. This section describes the overall model for producing and consuming events in our environment and the structure of event objects. We distinguish between 4 ....

N.Y. Nygate, "Event Correlation using Rule and Object Based Techniques", in Integrated Network Management IV, Chapman and Hall, 1995.

....monitoring interface. A distributed architecture for event filtering and generation can be implemented at significantly less cost compared to configuring and installing centralized event filtering systems. There has been a significant amount of work in the field of composite event generation [NYG95, HAY96, MAN97]. Our event architecture uses the services of READY, an event processing and notification system [GRU97] to generate composite events. This section describes the overall model for producing and consuming events in our environment and the structure of event objects. We distinguish between 4 ....

N.Y. Nygate, "Event Correlation using Rule and Object Based Techniques", in Integrated Network Management IV, Chapman and Hall, 1995.

....investigated ( DR95] for example. A recent proposal from [WTJ 97] is to use a neural network to define similarity. The outcome of case based approaches obviously heavily depends on the quality of the case database. The other group of approaches ( GH98] WBE 98] OMK 97] MSS97] Nyg95] JW95] and [BBM 93] and most products define some programming (or specification) language that enables an expert to enter his knowledge thereby building up the event correlator s knowledge base. A popular programming style is rule based: If event X and event Y arrive, then emit event Z ....

Y. A. Nygate. Event correlation using rule and object based techniques. In Sethi et al. [SRFV95], pages 278--289.

....network events and consequently the algorithms used in their correlation engines. Often the models and algorithms are only implicitly given via the software frameworks that are used in the systems which themselves vary widely. For example, systems such as GTE IMPACT [9] and other similar ones [12, 5, 14, 2] are rule based systems in which the network event relationships are specified using AI rule languages and the correlation engine is then defined by the execution of the rule engine on the specified set of rules. The To appear in Proceedings of the Sixth IFIP IEEE International Symposium on ....

Y. A. Nygate. Event correlation using rule and object based techniques. In A.S. Sethi, Y. Raynaud, and F. Faure-Vincent, editors, Proceedings of the IEEE/IFIP Fourth International Symposium on Integrated Network Management, pages 278--289. Chapman and Hall, May 1995.

....time. It makes no sense to consider the same fault involving the same network elements twice at the same time (although it can occur repeatedly) It is pointed out that in telecommunication networks faults could appear simultaneously, i.e. multiple faults occur, which are then concurrent (see e.g. [22]) Moreover, several faults could combine themselves to produce others faults (And, Or dependencies in figure 4) and one single fault could result in several other faults (Simultaneous, Exclusive dependencies in figure 4) PI n1117 8 Armen Aghasaryan, Ren ee Boubour, Eric Fabre, Claude Jard, ....

Y.A. Nygate. Event Correlation using Rule and Object Based Techniques. In Sethi, Raynaud, and Faure-Vincent, editors, Integrated Network Management, number 4, pages 278--289. IFIP, Chapman and Hall, may 1995.

.... As a matter of fact, with the growth of the managed plant, associated to the implementation of modern management systems, there has been a great increase in the volume of information received in the management centers, rendering it practically unfeasible to manually process all of them [Nygate, 1995]. So, it is the interest of the operators of public telecommunications services to develop solutions to process the management information rendered available to the network management systems, so as to deliver to the human operators only the most relevant information for them to make decisions. ....

....of telecommunications networks. As it reduces the necessary time for the identification of faults causing alarms, allowing a quick restoration of the affected services, the implementation of alarm correlation in a typical American operation center may yield annual benefits of up to US 1 million [Nygate, 1995]. The importance of this subject is acknowledged by ITU T, which classifies the alarm correlation as one of the problems to be solved so that a telecommunications management system produces the results expected from it. In spite of this importance, the ITU T has not yet defined its position ....

[Article contains additional citation context not shown here]

Y. A. Nygate. Event correlation using rule and object based techniques. In IFIP/IEEE International Symposium on Integrated Network Management, IV (ISINM'95) [1995], pages 278--289.

....how to show the data to the users so that the appropriate decisions can be made. To alleviate the risk of overlooking important alarms or misinterpreting them, filtering and correlation methods are used to reduce the number of messages shown and to improve their information content (see, e.g. [6, 7, 9, 10, 11, 18]) For this one needs knowledge about the alarms and their interrelationships, and filtering and correlation systems are often implemented as expert systems with carefully hand crafted knowledge bases. The required knowledge can in principle be obtained from the designers of individual components ....

Y. A. Nygate. Event correlation using rule and object based techniques. In Integrated Network Management IV, pages 278 -- 289. Chapman & Hall, London, 1995.

....amount of redundant information to be analyzed (filtering) and try to automatically reason about the alarm traffic observed so as to indicate possible root causes of the problems. Most work on this particular subject is driven by particular needs and is targeted for specific NM applications. In [8, 3, 12, 18] topological information stored in the correlation software plays a primary role in isolating and identifying the root causes of faults. A very detailed description of the network (with varying degrees of abstraction) plus some heuristics is used to automating the process of isolating a fault. ....

Y. A. Nygate. Event correlation using rule and object based techniques. In A. S. Sethi, Y. Raynaud, and F. Faure-Vincent, editors, Integrated Network Management IV, page 278. Chapman & Hall, 1995.

....14] use a similar mechanism, but our event evaluation tree maintains a hierarchical history which allows us to deal with out of order event arrivals in an efficient manner. A number of systems use a centralised correlation approach to filter and analyse events generated from distributed sources [3, 20, 21]. The problem with this approach is that all events have to be sent to the correlation server, which can cause considerable network traffic in large systems. Our approach allows filtering and composition of events to be distributed and take place close to the source of these events and so it ....

Nygate, Y. A. (1995) Event Correlation using Rule and Object Based Techniques, In Proceedings of the Fourth Symposium on Integrated Network Management, Santa Barbara, California, USA, Chapman & Hall, pp. 290--301.

....approach to event correlation. There are two groups of approaches developed DB Switch Router Switch PC Workstation PC Event Correlator Events Knowledge Base Server Figure 1: Design of an Event Correlator so far. The first group including [GH98] WBE 98] OMK 97] MSS97] Cam96] Nyg95] JW95] and [BBM 93] and most products define some programming (or specification) language. A human expert is expected to tell the correlator whether and how events are related and what event to forward to the administrator by writing a corresponding program. Some products 1 customize ....

Y. A. Nygate. Event correlation using rule and object based techniques. In Sethi et al. [SRFV95], pages 278--289.

....try to limit the amount of redundant information to be analyzed (filtering) and try to automatically reason about the alarm traffic observed so as to indicate possible root causes. Most work on this particular subject is driven by particular needs and is targeted for specific NM applications. In [8, 3, 10, 14] topological information stored in the correlation software plays a primary role in isolating and identifying the root causes of faults. A detailed description of the network (with varying degrees of abstraction) plus some heuristics, is used to automate the process of isolating a fault. Not much ....

Y. A. Nygate. Event correlation using rule and object based techniques. In A. S. Sethi, Y. Raynaud, and F. Faure-Vincent, editors, Integrated Network Management IV, page 278. Chapman & Hall, 1995.

....network. Event correlation is the process of automatically grouping related events based on their underlying common, thereby compressing the event stream and identifying underlying hidden problems. NetFACT [Houck et al. 1995] SINERGIA [Brugnoni et al. 1993] IMPACT [Jakobson et al. 1995] ECXpert [Nygate 1995] and the authors own DECS [IEEE96] are all examples of such systems. An event correlation system consists of two basic components: an event definition and propagation model (or simply event model) and reasoning algorithm. The event model describes the underlying system, while the reasoning ....

....methodology, as the size of a SINERGIA rule increases exponentially as the number of components involved. IMPACT [Jakobson et al. 1995] also uses a rule based approach to define when a correlation rule matches the network topology; thus it stands in the same relation to MODEL as SINERGIA. ECXpert [Nygate 1995] uses rules to define when an incoming event can be correlated with an event or set of events which were previously received. Thus an ECXpert rule is similar to a MODEL propagate statement, in that it specifies the relationships between events, rather an entire topology of events in a single ....

Y. A. Nygate, Event correlation using rule and object based techniques. IEEE ISINM'95 (International Symposium on Integrated Network Management).

....hierarchy, a correlation class hierarchy and correlation rules are used as the behavior model. NetFACT [6] also has an object oriented model to describe the connectivity, dependency and containment relationships among network elements. Events are correlated based on these relationships. In EXCpert [15], the cause effect relationships among events are modelled with correlation tree skeletons as the bases for correlation. InCharge [18] represents the causal relationships among events with a causality graph and uses a codebook approach to quickly correlate events to their root causes. However, ....

Y.A. Nygate. Event correlation using rule and object based techniques. In the 4th IFIP Symposium on Integrated Network Management, 1995.

No context found.

Y. A. Nygate. Event correlation using rule and object based techniques. In Proc. IFIP/IEEE International Symposium on Integrated Network Management, pages 278--289, May 1995.

No context found.

Y. A. Nygate, Event correlation using rule and object based techniques, Integrated Network Management IV, Chapman and Hall, London, pp. 278289, 1995.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC