A Proposal of Event Correlation for Distributed Network Fault Management and Its Evaluation

• KATO Nei

  Information Sciences, Graduate School of Tohoku University

• OHTA Kohei

  Cyber Solutions, Inc.

• IKA Tomohiro

  Information Sciences, Graduate School of Tohoku University

• MANSFIELD Glenn

  Cyber Solutions, Inc.

• NEMOTO Yoshiaki

  Information Sciences, Graduate School of Tohoku University

Abstract

In a distributed network management environment, a NMS (Network Management Station) interacts with several agents in different sub-networks. In the network fault management context, the NMS detects symptoms that indicate some abnormality e.g. a surge in ICMP traffic, which may be caused by some network malfunction or misuse. The occurrence of a symptom is an event. Large number of events may be detected by an NMS. The sheer number of these events makes it difficult, if not impossible, for an NMS to diagnose these events. Generally, a fault may have a cascading effect which may, in turn, give rise to a very large number of events. The sequence of events and their correlation play an important role in fault management and diagnosis. In the distributed environment of todays networks, the absence of any uniform time for reference makes this a challenging task. In the present network management framework of SNMP, a Manager maintains a notion of the clock of the agent it interacts with. But this mechanism is inadequate to determine the sequence of events and their correlation, more so, in a distributed environment which may involve several managers. In this paper we propose a mechanism for ordering and correlating events detected in large-scale network which is managed in a distributed manner within the SNMP framework. Our algorithm uses the concept of a Network Management Clock (NMC). The NMC is a virtual clock maintained by a manager based on sys Up Time readings from each SNMP agent. In this paper, the algorithm, its implementation and evaluation will be discussed.

Journal

• IEICE Trans. on Communication

  IEICE Trans. on Communication 82 (6), 859-867, 1999-06-25

  The Institute of Electronics, Information and Communication Engineers

Keywords

• event correlation
• distributed network management
• NMC (Network Management Clock)

Details

• CRID: 1571417127440881536
• NII Article ID: 110003218429
• NII Book ID: AA10826261
• ISSN: 09168516
• Text Lang: en
• Data Source:
  • CiNii Articles