Towards a Practical Alarm Correlation System

Abstract

A single fault in a telecommunication network frequently results in a number of alarms being reported to the network operator. This multitude of alarms can easily obscure the real cause of the fault. In addition, when multiple faults occur at approximately the same time, it can be difficult to determine how many faults have occurred, thus creating the possibility that some may be missed. A variety of solution approaches have been proposed in the literature, however, practically deployable, commercial solutions remain elusive. The experiences of the Network Fault and Alarm Correlator and Tester (NetFACT) project, carried out at IBM Research and described in this paper, provide some insight as to why this is the case, and what must be done to overcome the barriers encountered. Our observations are based on experimental use of the NetFACT system to process a live, continuous alarm stream from a portion of the Advantis physical backbone network, one of the largest private telecommunications networks in the world.The NetFACT software processes the incoming alarm stream and determines the faults from the alarms. It attempts to narrow down the likely root causes of each fault, to the greatest extent possible, given the available information. To accomplish this, NetFACT employs a novel combination of diagnostic techniques supported by an object-oriented model of the network being managed. This model provides an abstract view of the underlying network of heterogeneous devices. A number of issues were explored in the project including the extensibility of the design to other types of networks, and impact of the practical realities that must be addressed if prototype systems such as NetF ACT are to lead to commercial products.

Clustering intrusion detection alarms to support root cause analysis

“…In network fault management [Bouloutas et al 1994;Houck et al 1995;Weissman 1993, 1995;Lewis 1993;Nygate 1995;Ohsie 1998;Yemini et al 1996], alarms indicate problems in a network's operation, such as hardware or software failures, performance degradations, or misconfigurations. As network components are highly inter dependent, a problem in one component propagates to all transitively dependent components.…”

Chasing a Definition of “Alarm”

“…The focus of alarm correlation is to interpret alarm notifications and give (new) meaning to them [45]. Alarm correlation research efforts address several underlying problems: correlation of notifications relating to the same underlying fault, repeated alarm notifications, the same fault as identified by several components, and fault propagation [46]. Our definition of alarms would ease the alarm correlation effort since the input to the correlation engine would from the beginning be qualified as an undesirable state.…”

Correlating Business Events for Event-Triggered Rules

“…The fault discovery process explores the network model to verify correlations between events. NetFACT [7] uses an object-oriented model to describe the connectivity, dependency and containment relationships among network elements. Events are correlated based on these relationships.…”