Semantic Alarms Stefan Wallin Tail-f, Ph D Director Product Strategy Johan Nordlander, Ph D Assistant Professor Luleå University of Technology
Semantic Alarms
Stefan Wallin Tail-f, Ph DDirector Product Strategy
Johan Nordlander, Ph DAssistant ProfessorLuleå University of Technology
SEMANTIC ALARMS
?• SDN, OpenFlow, NFV• 2013
• Alarms• 1970…
Alarms, why bother?
2©2013 TAIL-F all rights reserved
• 1970…
• The alarm problem is unsolved• Alarm overload increasing• System and network complexity increasing
SEMANTIC ALARMS
Current Practice
Syntactical Alarm Syntactical Alarm
Alarm
Documentation
Not formalized
Correlation
3©2013 TAIL-F all rights reserved
Syntactical Alarm
Standards and Interfaces
(X.733, 3GPP)
Syntactical Alarm
Standards and Interfaces
(X.733, 3GPP)
Correlation
Inventory enrichment
…
…
Alarms at run-time
SEMANTIC ALARMS
SDN ?
OSS, BSS, Orchestration
SDNLogically centralized API, View
4©2013 TAIL-F all rights reserved
Multi-vendor, multi-technology network
SDN
SEMANTIC ALARMS
SDN – Alarms ?
OSS, BSS, Orchestration�Few manual actions, automation
SDNLogically centralized API, View�Synthesized Centralized
5©2013 TAIL-F all rights reserved
Multi-vendor, multi-technology network�Semantic Alarm Interfaces
SDN �Synthesized Centralized Alarm Status
SEMANTIC ALARMS
The SDN Control Loop
6©2013 TAIL-F all rights reserved
SDN Operational Data
Actual State
Configuration Data
Desired State
SEMANTIC ALARMS
The SDN Control Loop – Alarm ?
Desired State != Actual State
That requires Action
= ALARM
Escape out of the control loop
7©2013 TAIL-F all rights reserved
SDN Operational Data
Actual State
Configuration Data
Desired State
SEMANTIC ALARMS
Semantic Alarm ?
An Alarm signifies an undesired state that requires action.
Read the above again
8©2013 TAIL-F all rights reserved
Read the above again
• Digest…
• Undesired State!
• Requires Action!
• Bound to the data-model for the device
SEMANTIC ALARMS
Take Action ? !
Syntactic KnowledgeSyntactic Knowledge Syntactic ActionSyntactic Action
9©2013 TAIL-F all rights reserved
Semantic KnowledgeSemantic Knowledge Semantic ActionSemantic Action
SEMANTIC ALARMS
Take Action ? !
Syntactic KnowledgeSyntactic Knowledge Syntactic ActionSyntactic Action
Traps Trap Browser
10©2013 TAIL-F all rights reserved
Semantic KnowledgeSemantic Knowledge Semantic ActionSemantic Action
Alarms Automatic Actions
SEMANTIC ALARMS
Good Alarm (EEMUA 191) ?
11©2013 TAIL-F all rights reserved
SEMANTIC ALARMS
• Systems should publish the potential alarms• Semantic Alarm Model
• Allow for automation• Text-based grammar• YANG is the SDN data-modeling language for configuration,
equally useful for alarm models.
• No standard for doing this
A Semantic Alarm Model
12©2013 TAIL-F all rights reserved
• No standard for doing this
Syntactical Alarm
Standards and
Interfaces
(X.733, 3GPP)
Syntactical Alarm
Standards and
Interfaces
(X.733, 3GPP)
Alarms at run-time
Semantic Alarm ModelSemantic Alarm Model
Good
Alarms
SEMANTIC ALARMS
Modeling the Alarm Handling Game
enum Severity { Clear, Warning, Minor, Major, Critical }
Value operstatet (Path) may change with each time t
Severity alarmstatet (Path) may change with each time t
XPathExpr alarmpred (Path, Severity) static meaning of each alarm
14©2013 TAIL-F all rights reserved
XPathExpr alarmpred (Path, Severity) static meaning of each alarm
bool istruet (XPathExpr) depends on operstatet
Soundness of the alarmstate abstraction:
alarmstatet (p) = sev�
∀s≤sev : istruet(alarmpred(p,s)) & ∀s>sev : ~istruet(alarmpred(p,s))
SEMANTIC ALARMS
Modeling the Alarm Handling Game
Notifications sent up to time t (Time-Path-Severity triples):
notifs_sentt=
{ (c,p,s) | c ≤ t & alarmstatec(p) = s & alarmstatec-ɛ (p) ≠ s }
⊆
15©2013 TAIL-F all rights reserved
Notifications received up to time t (Time-Path-Severity triples):
notifs_recvdt ⊆ notifs_sentt
Safe interpretation of received notifications:
(c,p,sev) ∈ notifs_recvdt⇨
∀s≤sev : istruec(alarmpred(p,s)) & ∀s>sev : ~istruec(alarmpred(p,s))
SEMANTIC ALARMS
Summary
Less Alarms
Alarms are an
operational pain
16©2013 TAIL-F all rights reserved
Less Alarms
Less Manual Work
More Automation
Semantic Alarm ModelsWe need a standard to
express these
SEMANTIC ALARMS
• 3GPP TR 32.859 Study on Alarm Management• Tommy Berggren, TeliaSonera
• “Chasing a Definition of Alarm”• Stefan Wallin• Journal of Network and Systems Management• Volume 17 Issue 4, December 2009
• “The semantics of alarm definitions: enabling
See also….
17©2013 TAIL-F all rights reserved
• “The semantics of alarm definitions: enabling systematic reasoning about alarms”
• Stefan Wallin, Johan Nordlander, Viktor Leijon, Nicklas Bystedt
• International Journal of Network Management• Volume 22, Issue 3, pages 181–198, May/June 2012