A survey of fault localization techniques in computer networks
---
paper_title: Alarm correlation

paper_content:

The authors discuss the development of an alarm correlation model and a corresponding software support system that allow efficient specification of alarm correlation by the domain experts themselves. Emphasis is placed on the end-user orientation of IMPACT, the intelligent management platform for alarm correlation tasks which implements the proposed model. The desire was to lower the barrier between the network management application development process and the end user of the application, the network management personnel. IMPACT is a step towards this goal. The proposed alarm correlation model was used for three purposes: intelligent alarm filtering, alarm generalization and fault diagnosis. >
---
paper_title: High speed and robust event correlation

paper_content:

The authors describe a network management system and illustrate its application to managing a distributed database application on a complex enterprise network.
---
paper_title: A coding approach to event correlation

paper_content:

This paper describes a novel approach to event correlation in networks based on coding techniques. Observable symptom events are viewed as a code that identifies the problems that caused them; correlation is performed by decoding the set of observed symptoms. The coding approach has been implemented in SMARTS Event Management System (SEMS), as server running under Sun Solaris 2.3. Preliminary benchmarks of the SEMS demonstrate that the coding approach provides a speedup at least two orders of magnitude over other published correlation systems. In addition, it is resilient to high rates of symptom loss and false alarms. Finally, the coding approach scales well to very large domains involving thousands of problems.
---
paper_title: Composite events for network event correlation

paper_content:

With the increasing complexity of enterprise networks and the Internet, event correlation is playing an increasingly important role in network as well as integrated system management systems. Even though the timing of events often reveals important diagnostic information about event relationships and should therefore be represented in event correlation rules or models, most extant approaches lack a formal mechanism to define complex temporal relationships among correlated events. In this paper, we discuss the formal use of composite events for event correlation and present a composite event specification approach that can precisely express complex timing constraints among correlated event instances, for which efficient compilation and detection algorithms have been developed in Mok et al., (1997). A Java implementation of this approach, called Java Event Correlator (JECTOR), is described, and some preliminary experimental results of using JECTOR in an experimental network management environment are also discussed in the paper.
---
paper_title: The alarm information base: a repository for enterprise management

paper_content:

In a typical enterprise operations center, the effective processing of alarms is crucial to the successful management of an information technology environment. Service-affecting alarms can originate from many sources, including customer-premise and carrier networking elements, computing systems (hardware and software) and other managed equipment. Although alarms are often viewed simply as text strings and colored icons on an operations console, the definition and maintenance of alarm-related information within an enterprise has a distinct lifecycle which needs to be managed. One way of managing this lifecycle is through a repository called an alarm information base, which centrally captures information about the alarms raised and processed in an enterprise. In this paper, the motivation for such a repository and the benefits of its use are discussed. An alarm information base can be maintained in an open and extensible format, and should be viewed as a valuable corporate asset for enterprise management.
---
paper_title: Distributed fault identification in telecommunication networks

paper_content:

Telecommunications networks are often managed by a large number of management centers, each responsible for a logically autonomous part of the network. This could be a small subnetwork such as an Ethernet, a Token Ring or an FDDI ring, or a large subnetwork comprising many smaller networks. In response to a single fault in a telecommunications network, many network elements may raise alarms, which are typically reported only to the subarea management center that contains the network element raising the alarm. As a result, a particular management center has a partial view of the status of the network. Management Centers must therefore cooperate in order to correctly infer the real cause of the failure. The algorithms proposed in this paper outline the way these management centers could collaborate in correlating alarms and identifying faults.
---
paper_title: Schemes for fault identification in communication networks

paper_content:

A single fault in a large communication network may result in a large number of fault indications (alarms) making the isolation of the primary source of failure a difficult task. The problem becomes worse in cases of multiple faults. In this paper we present an approach for modelling the problem of fault diagnosis. We propose a graph based network model that takes into account the dependencies among the different objects in the telecommunication environment and a novel approach to estimate the domain of an alarm. Based on that model, we design an algorithm for fault diagnosis and analyze its performance with respect to the accuracy of the fault hypotheses it provides. We also propose and analyze a fault diagnosis algorithm suitable for systems for which an independent failure assumption is valid. Finally, we examine the importance of the information of dependency between objects for the fault diagnosis process.
---
paper_title: A Probabilistic Approach to Fault Diagnosis in Linear Lightwave Networks

paper_content:

The application of probabilistic reasoning to fault diagnosis in linear lightwave networks (LLNs) is investigated. The LLN inference model is represented by a Bayesian network (or causal network). An inference algorithm is proposed that is capable of conducting fault diagnosis (inference) with incomplete evidence and on an interactive basis. Two belief updating algorithms are presented which are used by the inference algorithm for performing fault diagnosis. The first belief updating algorithm is a simplified version of the one proposed by Pearl (1988) for singly connected inference models. The second belief updating algorithm applies to multiply connected inference models and is more general than the first. The authors also introduce a t-fault diagnosis system and an adaptive diagnosis system to further reduce the computational complexity of the fault diagnosis process. >
---
paper_title: Towards a practical alarm correlation system

paper_content:

A single fault in a telecommunication network frequently results in a number of alarms being reported to the network operator. This multitude of alarms can easily obscure the real cause of the fault. In addition, when multiple faults occur at approximately the same time, it can be difficult to determine how many faults have occurred, thus creating the possibility that some may be missed. A variety of solution approaches have been proposed in the literature, however, practically deployable, commercial solutions remain elusive. The experiences of the Network Fault and Alarm Correlator and Tester (NetFACT) project, carried out at IBM Research and described in this paper, provide some insight as to why this is the case, and what must be done to overcome the barriers encountered. Our observations are based on experimental use of the NetFACT system to process a live, continuous alarm stream from a portion of the Advantis physical backbone network, one of the largest private telecommunications networks in the world.
---
paper_title: Centralized vs Distributed Fault Localization

paper_content:

In this paper we compare the performance of fault localization schemes for communication networks. Our model assumes a number of management centers, each responsible for a logically autonomous part of the whole telecommunication network. We briefly present three different fault localization schemes: namely, “Centralized”, “Decentralized” and “Distributed” fault localization, and, we compare their performance with respect to the computational effort each requires and the accuracy of the solution that each provides.
---
paper_title: A scheduling-based event correlation scheme for fault identification in communications network

paper_content:

Communications network has increased dramatically in size and complexity in the past few years. A typical network may consist of hundreds of nodes from various manufacturers with different traffic and bandwidth requirements. The increasing complexity poses serious problems to network management and control. As faults are inevitable, quick detection, identification and recovery are crucial to make the systems more robust and their operation more reliable. This article proposes a novel event correlation scheme for fault identification in communications network. This scheme is based on the bi-level feedback queues scheduling policy. The causality graph model is used to describe the cause-and-effect relationships between network events. The use of scheduling policy makes the correlation process simple and fast. A simulation model is developed to verify the effectiveness and efficiency of the proposed scheme. From simulation results, we notice that this scheme not only identifies multiple problems at one time but also is insensitive to noise. As the time complexity of the correlation procedure is close to a function of n, where n is the number of observed symptoms, with order O(n); therefore, the on-line fault identification is easy to achieve.
---
paper_title: Alarm correlation and fault identification in communication networks

paper_content:

Presents an approach for modeling and solving the problem of fault identification and alarm correlation in large communication networks. A single fault in a large network may result in a large number of alarms, and it is often very difficult to isolate the true cause of the fault. This appears to be one of the most important difficulties in managing faults in today's networks. The problem may become worse in the case of multiple faults. The authors present a general methodology for solving the alarm correlation and fault identification problem. They propose a new alarm structure, propose a general model for representing the network, and give two algorithms which can solve the alarm correlation and fault identification problem in the presence of multiple faults. These algorithms differ in the degree of accuracy achieved in identifying the fault, and in the degree of complexity required for implementation. >
---
paper_title: Real-time telecommunication network management: extending event correlation with temporal constraints

paper_content:

Event correlation is becoming one of the most central techniques in managing the high volume of event messages. Practically, no network management system can ignore network surveillance and control procedures which are based on event correlation. The majority of existing network management systems use relatively simple ad hoc additions to their software to perform alarm correlation. In these systems, alarm correlation is handled as an aggregation procedure over sets of alarms exhibiting similar attributes. In recent years, several more sophisticated alarm correlation models have been proposed. In this paper, we will expand our knowledge-based event correlation model to capture temporal constraints.
---
paper_title: Dependency Analysis in Distributed Systems using Fault Injection: Application to Problem Determination in an e-commerce Environment

paper_content:

──────────────────────────────────────── Distributed networked applications that are being deployed in enterprise settings, increasingly rely on a large number of heterogeneous hardware and software components for providing end-to-end services. In such settings, the issue of problem diagnosis becomes vitally important, in order to minimize system outages and improve system availability. This motivates interest in dependency characterization among the different components in distributed application environments. A promising approach for obtaining dynamic dependency information is the Active Dependency Discovery technique in which a dependency graph of e-commerce transactions on hardware and software components in the system is built by individually “perturbing” the system components during a testing phase and collecting measurements corresponding to the external behavior of the system. In this paper, we propose using fault injection as the perturbation tool for dynamic dependency discovery and problem determination. We describe a method for characterizing dependencies of transactions on the system resources in a typical e-commerce environment, and show how it can aid in problem diagnosis. The method is applied to an application server middleware platform, running end-user activity composed of TPC-W transactions. Representative fault models for such an environment, that can be used to construct the fault injection campaign, are also presented.
---
paper_title: Artificial Life and the Animat Approach to Artificial Intelligence

paper_content:

Publisher Summary This chapter discusses the topic of artificial life (AL), with emphasis on animats. AL is a novel scientific pursuit that aims at studying manmade systems exhibiting behaviors that are characteristic of natural living systems. AL complements the traditional biological sciences concerned with the analysis of living organisms by attempting to synthesize life-like behaviors within computers or other artificial media. One particularly active area of artificial life is concerned with the conception and construction of artificial animals simulated by computers or by actual robots whose rules of behavior are inspired by those of animals. These simulations are known as Animats. Research in the field of standard artificial intelligence (AI) aims at simulating the most elaborate faculties of the human brain such as problem solving, natural language understanding, and logical reasoning. With the aim of explaining how peculiar human faculties might be inherited from the simplest adaptive abilities of animals, the animat approach is based on the conception or construction of simulated animals or robots capable of surviving in more or less unpredictable and threatening environments. The animat approach places emphasis on the characteristics neglected by standard AI. This approach is interested explicitly in the interactions between an animat and its environment and particularly stresses the aptitude of the animat to survive in unexpected environmental circumstances. Centered on the study of grounded and robust behaviors, research on the adaptive behavior of animats avoids the pitfalls of standard AI, improves our knowledge in those domains where standard AI has failed notoriously, and notably addresses the problems of perception, categorization, and sensorimotor control.
---
paper_title: Alarm correlation

paper_content:

The authors discuss the development of an alarm correlation model and a corresponding software support system that allow efficient specification of alarm correlation by the domain experts themselves. Emphasis is placed on the end-user orientation of IMPACT, the intelligent management platform for alarm correlation tasks which implements the proposed model. The desire was to lower the barrier between the network management application development process and the end user of the application, the network management personnel. IMPACT is a step towards this goal. The proposed alarm correlation model was used for three purposes: intelligent alarm filtering, alarm generalization and fault diagnosis. >
---
paper_title: Automated end-to-end system diagnosis of networked printing services using model based reasoning

paper_content:

distributed service management, client-server systems, automated end-to-end diagnostics, model-based reasoning, MBR, network printing, artificial intelligence Modern applications increasingly depend on services that are distributed across the infrastructure, for example, printing, mail and database services. This is especially so in mobile computing, where network access is used to compensate for the paucity of onboard resources. However, the increased dependence on distributed services poses a challenge to IT departments whose personnel and tools typically focus on individual components of the distributed service. This calls for IT management tools that have an end-to-end perspective on entire distributed services.
---
paper_title: Rule Discovery in Telecommunication Alarm Data

paper_content:

Fault management is an important but difficult area of telecommunication network management: networks produce large amounts of alarm information which must be analyzed and interpreted before faults can be located. So called alarm correlation is a central technique in fault identification. While the use of alarm correlation systems is quite popular and methods for expressing the correlations are maturing, acquiring all the knowledge necessary for constructing an alarm correlation system for a network and its elements is difficult. We describe a novel partial solution to the task of knowledge acquisition for correlation systems. We present a method and a tool for the discovery of recurrent patterns of alarms in databases; these patterns, episode rules, can be used in the construction of real-time alarm correlation systems. We also present tools with which network management experts can browse the large amounts of rules produced. The construction of correlation systems becomes easier with these tools, as the episode rules provide a wealth of statistical information about recurrent phenomena in the alarm stream. This methodology has been implemented in a research system called TASA, which is used by several telecommunication operators. We briefly discuss experiences in the use of TASA.
---
paper_title: Composite events for network event correlation

paper_content:

With the increasing complexity of enterprise networks and the Internet, event correlation is playing an increasingly important role in network as well as integrated system management systems. Even though the timing of events often reveals important diagnostic information about event relationships and should therefore be represented in event correlation rules or models, most extant approaches lack a formal mechanism to define complex temporal relationships among correlated events. In this paper, we discuss the formal use of composite events for event correlation and present a composite event specification approach that can precisely express complex timing constraints among correlated event instances, for which efficient compilation and detection algorithms have been developed in Mok et al., (1997). A Java implementation of this approach, called Java Event Correlator (JECTOR), is described, and some preliminary experimental results of using JECTOR in an experimental network management environment are also discussed in the paper.
---
paper_title: Alarm correlation engine (ACE)

paper_content:

Networks are growing in size and complexity, resulting in increased alarm volume and number of unfamiliar alarms. Often, there is no proportional increase in monitoring personnel and response time to faults suffers. GTE deployed Telephone Operations Network Integrated Control System (TONICS) in 1993 to support its network management operations. To stay competitive in the face of continued staff reductions, increase in network size, and monitoring complications related to deregulation of the telephone industry, GTE is introducing artificial intelligence techniques into TONICS. Alarm Correlation Engine (ACE), the system described in this paper, is part of the effort. ACE aids network management by correlating alarms on the basis of common cause to provide alarm compression, filtering, and suppression. In conjunction with its ability to carry out prescribed responses, it improves response times and increases productivity. ACE was developed with the following requirements: reliability, speed, versatility (handle alarms from different switches and networks), ease of knowledge engineering (field technicians must be able to construct, test, and modify correlation patterns), handle in real time multiple network problems, and finally, interface smoothly with GTE's TONICS system. ACE's strength lies in its domain specific correlation language which facilitates knowledge engineering and in its asynchronous processing core that enables integration into a real-time monitoring system.
---
paper_title: Investigation and practical assessment of alarm correlation methods for the use in GSM access networks

paper_content:

This paper compares and assesses several alarm correlation methods for their suitability and performance in global systems for mobile communications (GSM). The assessment criteria used reflect the special circumstances found in these networks. A high importance is given to the aspects related to a practical and feasible network management. Of the neural networks investigated, the cascade correlation learning algorithm performs best. This approach is compared with correlation techniques proposed in the literature: rule-based diagnosis, model based diagnosis and alarm correlation using codebooks. It is shown that for alarm correlation in a GSM access network the proposed cascade correlation approach is superior to the other correlation techniques.
---
paper_title: Pattern discovery and specification techniques for alarm correlation

paper_content:

Ever increasing amounts of alarm data threaten the stability of management systems in high speed telecommunications networks. As networks continue to develop, becoming larger, using substantially higher bandwidth links and using more complex equipment, so the danger of alarm inundation is increased. Alarm correlation systems have been seen to play a vital role in dealing with the problem. However, the question of what to correlate and how to recognise and specify related alarms has either been left largely unanswered or distinct from the physical correlation process. In this presentation, we describe a unifying framework which uses a purpose-designed language to specify alarm patterns and then use the results in a real-time correlation engine. In order to test the effectiveness of the solution, the language was translated onto an existing proprietary correlation system and fed with alarm data from an SDH network test-bed. Preliminary evaluation has indicated the system to be extremely fast, potentially robust to network dynamics and, importantly, resilient to a degree of input space error. Furthermore, it is easy to use, intuitive and may be extended through the incorporation of artificial intelligence modules.
---
paper_title: Designing expert systems for real-time diagnosis of self-correcting networks

paper_content:

The authors discuss design issues that they have encountered during an investigation of expert systems for network management that they believe to be generic to the real-time diagnosis of self-correcting networks. By real-time they mean that the diagnostic system must keep pace with a dynamic process, that is, the flow of alarms from intelligent network elements. The objective is to present the operator with a set of recommended actions rather than large volumes of raw alarm data. They outline the general requirements of such a system and then suggest how each can be addressed using an expert-system approach. >
---
paper_title: Real-time telecommunication network management: extending event correlation with temporal constraints

paper_content:

Event correlation is becoming one of the most central techniques in managing the high volume of event messages. Practically, no network management system can ignore network surveillance and control procedures which are based on event correlation. The majority of existing network management systems use relatively simple ad hoc additions to their software to perform alarm correlation. In these systems, alarm correlation is handled as an aggregation procedure over sets of alarms exhibiting similar attributes. In recent years, several more sophisticated alarm correlation models have been proposed. In this paper, we will expand our knowledge-based event correlation model to capture temporal constraints.
---
paper_title: Event correlation using rule and object based techniques

paper_content:

Today’s competitive market place has forced the telecommunications industry to improve their service and reliability. One step that telecommunications companies have taken to reduce network failures is the installation of operations centers to collect data from network elements. These centers are staffed by network managers who monitor network activity by correlating alarms across various operational disciplines (switch, facility, traffic) and relating them to a common cause. Accurate analysis is often difficult due to the volume of data and complexity of problems.
---
paper_title: Fault isolation and event correlation for integrated fault management

paper_content:

An algorithm for fault isolation and event correlation in integrated networks is presented. It reconstructs fault propagation during run-time by exploring relationships between managed objects and provides improved focus and efficiency compared to similar algorithms. The functionality of the algorithm is generic, straightforward, efficient, and applicable for different management architectures such as SNMP and TMN. Clearly defined interfaces allow parallel execution of problem investigation, integration of different management architectures and systems, and incorporation of other correlation techniques.
---
paper_title: Integrated Event Management: Event Correlation Using Dependency Graphs

paper_content:

Today’s fault management requires a sophisticated event management to condense events to meaningful fault reports. This severe practical need is addressed by event correlation which is an area of intense research in the scientific community and the industry. This paper introduces an approach for event correlation that uses a dependency graph to represent correlation knowledge. The benefit over existing approaches that are briefly classified here is that this approach is specifically well suited to instrument an existing management system for event correlation. It thereby deals with the complexity, dynamics and distribution of real–life managed systems. That is why it is considered to provide integrated event management. The basic idea is to connect the event correlator to a given management system and gain a dependency graph from it to model the functional dependencies within the managed system. The event correlator searches through the dependency graph to localize managed objects whose failure would explain a large number of management events received. The paper gives a short overview of existing approaches, introduces our approach and its application. It shows why dependency graphs are suitable, how they can be derived and finally presents the prototype developed so far.
---
paper_title: Towards a practical alarm correlation system

paper_content:

A single fault in a telecommunication network frequently results in a number of alarms being reported to the network operator. This multitude of alarms can easily obscure the real cause of the fault. In addition, when multiple faults occur at approximately the same time, it can be difficult to determine how many faults have occurred, thus creating the possibility that some may be missed. A variety of solution approaches have been proposed in the literature, however, practically deployable, commercial solutions remain elusive. The experiences of the Network Fault and Alarm Correlator and Tester (NetFACT) project, carried out at IBM Research and described in this paper, provide some insight as to why this is the case, and what must be done to overcome the barriers encountered. Our observations are based on experimental use of the NetFACT system to process a live, continuous alarm stream from a portion of the Advantis physical backbone network, one of the largest private telecommunications networks in the world.
---
paper_title: A Modeling Framework for Integrated Distributed Systems Fault Management

paper_content:

This paper describes a modeling framework for integrated fault management of distributed systems . The model integrates all different layers of distributed systems such as applica­ tion, system, and network layer in a single, consistent view. This enables generic manage­ ment applications to perform their tasks across layer boundaries of the distributed system without knowledge about the specific details. The focus is on fault management issues . Dependencies between resources critical for the availability of the distributed system are modeled using relationships. Generic fault management applications are hereby enabled to determine the root cause of a distributed system failure automatically. The SAP Rj3 application serves as an example to demonstrate the capabilities of the modeling framework.
---
paper_title: A Generic Model for Fault Isolation in Integrated Management Systems

paper_content:

Distributed systems in enterprises as well as telecommunication environments strongly demand more automated fault management. A single fault in these complex systems might cause a huge number of symptomatic error messages and side effects to occur. The common root faults for these symptoms have to be identified to start fault removal procedures as soon as possible and to decrease system down-time. This paper presents a methodology for fault isolation in integrated management systems. A generic model is described that unifies the view of the management system on the managed environment. It integrates the relevant aspects of network, system, and service management layers in order to perform integrated fault isolation. Our approach is based on a general dependency graph model. It captures the information that is required to determine the root cause of a fault on the one hand, and the set of fault affected services and customers on the other hand. The layered TMN architecture serves as an example for an integrated management environment throughout this paper.
---
paper_title: High speed and robust event correlation

paper_content:

The authors describe a network management system and illustrate its application to managing a distributed database application on a complex enterprise network.
---
paper_title: Fault isolation and event correlation for integrated fault management

paper_content:

An algorithm for fault isolation and event correlation in integrated networks is presented. It reconstructs fault propagation during run-time by exploring relationships between managed objects and provides improved focus and efficiency compared to similar algorithms. The functionality of the algorithm is generic, straightforward, efficient, and applicable for different management architectures such as SNMP and TMN. Clearly defined interfaces allow parallel execution of problem investigation, integration of different management architectures and systems, and incorporation of other correlation techniques.
---
paper_title: A coding approach to event correlation

paper_content:

This paper describes a novel approach to event correlation in networks based on coding techniques. Observable symptom events are viewed as a code that identifies the problems that caused them; correlation is performed by decoding the set of observed symptoms. The coding approach has been implemented in SMARTS Event Management System (SEMS), as server running under Sun Solaris 2.3. Preliminary benchmarks of the SEMS demonstrate that the coding approach provides a speedup at least two orders of magnitude over other published correlation systems. In addition, it is resilient to high rates of symptom loss and false alarms. Finally, the coding approach scales well to very large domains involving thousands of problems.
---
paper_title: End-to-end service failure diagnosis using belief networks

paper_content:

We present fault localization techniques suitable for diagnosing end-to-end service problems in communication systems with complex topologies. We refine a layered system model that represents relationships between services and functions offered between neighboring protocol layers. In a given layer, an end-to-end service between two hosts may be provided using multiple host-to-host services offered in this layer between two hosts on the end-to-end path. Relationships among end-to-end and host-to-host services form a bipartite probabilistic dependency graph whose structure depends on the network topology in the corresponding protocol layer. When an end-to-end service fails or experiences performance problems it is important to efficiently find the responsible host-to-host services. Finding the most probable explanation (MPE) of the observed symptoms is NP-hard. We propose two fault localization techniques based on Pearl's (1988) iterative algorithms for singly connected belief networks. The probabilistic dependency graph is transformed into a belief network, and then the approximations based on Pearl's algorithms and exact bucket tree elimination algorithm are designed and evaluated through extensive simulation study.
---
paper_title: Schemes for fault identification in communication networks

paper_content:

A single fault in a large communication network may result in a large number of fault indications (alarms) making the isolation of the primary source of failure a difficult task. The problem becomes worse in cases of multiple faults. In this paper we present an approach for modelling the problem of fault diagnosis. We propose a graph based network model that takes into account the dependencies among the different objects in the telecommunication environment and a novel approach to estimate the domain of an alarm. Based on that model, we design an algorithm for fault diagnosis and analyze its performance with respect to the accuracy of the fault hypotheses it provides. We also propose and analyze a fault diagnosis algorithm suitable for systems for which an independent failure assumption is valid. Finally, we examine the importance of the information of dependency between objects for the fault diagnosis process.
---
paper_title: Towards a practical alarm correlation system

paper_content:

A single fault in a telecommunication network frequently results in a number of alarms being reported to the network operator. This multitude of alarms can easily obscure the real cause of the fault. In addition, when multiple faults occur at approximately the same time, it can be difficult to determine how many faults have occurred, thus creating the possibility that some may be missed. A variety of solution approaches have been proposed in the literature, however, practically deployable, commercial solutions remain elusive. The experiences of the Network Fault and Alarm Correlator and Tester (NetFACT) project, carried out at IBM Research and described in this paper, provide some insight as to why this is the case, and what must be done to overcome the barriers encountered. Our observations are based on experimental use of the NetFACT system to process a live, continuous alarm stream from a portion of the Advantis physical backbone network, one of the largest private telecommunications networks in the world.
---
paper_title: A conceptual framework for network management event correlation and filtering systems

paper_content:

Event correlation is a key functionality of a network management system that is used to determine the root cause of faults in a network, and to filter out redundant and spurious events. A number of event correlation systems have been proposed. The event correlation systems generally combine causal and temporal correlation models with the topology of a network. The power and robustness of the models used and the algorithms developed vary from system to system. However, in the absence of a simple, uniform, and precise presentation of the event-correlation problem, it is impossible to compare their relative power or even analyze them for their properties. In general, causal and temporal-based correlation models have not been rigorously presented or thoroughly investigated. In this paper we formalize the concepts of causal and temporal correlation using a single conceptual framework. We characterize various properties of the framework. We can characterize existing systems based on the formal properties of our framework, and we consider one system as an illustrative example.
---
paper_title: Probabilistic fault diagnosis in communication systems through incremental hypothesis updating

paper_content:

This paper presents a probabilistic event-driven fault localization technique, which uses a probabilistic symptom-fault map as a fault propagation model. The technique isolates the most probable set of faults through incremental updating of a symptom-explanation hypothesis. At any time, it provides a set of alternative hypotheses, each of which is a complete explanation of the set of symptoms observed thus far. The hypotheses are ranked according to a measure of their goodness. The technique allows multiple simultaneous independent faults to be identified and incorporates both negative and positive symptoms in the analysis. As shown in a simulation study, the technique offers close-to-optimal accuracy and is resilient both to noise in the symptom data and to inaccuracies of the probabilistic fault propagation model.
---
paper_title: Alarm correlation and fault identification in communication networks

paper_content:

Presents an approach for modeling and solving the problem of fault identification and alarm correlation in large communication networks. A single fault in a large network may result in a large number of alarms, and it is often very difficult to isolate the true cause of the fault. This appears to be one of the most important difficulties in managing faults in today's networks. The problem may become worse in the case of multiple faults. The authors present a general methodology for solving the alarm correlation and fault identification problem. They propose a new alarm structure, propose a general model for representing the network, and give two algorithms which can solve the alarm correlation and fault identification problem in the presence of multiple faults. These algorithms differ in the degree of accuracy achieved in identifying the fault, and in the degree of complexity required for implementation. >
---
paper_title: Schemes for fault identification in communication networks

paper_content:

A single fault in a large communication network may result in a large number of fault indications (alarms) making the isolation of the primary source of failure a difficult task. The problem becomes worse in cases of multiple faults. In this paper we present an approach for modelling the problem of fault diagnosis. We propose a graph based network model that takes into account the dependencies among the different objects in the telecommunication environment and a novel approach to estimate the domain of an alarm. Based on that model, we design an algorithm for fault diagnosis and analyze its performance with respect to the accuracy of the fault hypotheses it provides. We also propose and analyze a fault diagnosis algorithm suitable for systems for which an independent failure assumption is valid. Finally, we examine the importance of the information of dependency between objects for the fault diagnosis process.
---
paper_title: Alarm correlation and fault identification in communication networks

paper_content:

Presents an approach for modeling and solving the problem of fault identification and alarm correlation in large communication networks. A single fault in a large network may result in a large number of alarms, and it is often very difficult to isolate the true cause of the fault. This appears to be one of the most important difficulties in managing faults in today's networks. The problem may become worse in the case of multiple faults. The authors present a general methodology for solving the alarm correlation and fault identification problem. They propose a new alarm structure, propose a general model for representing the network, and give two algorithms which can solve the alarm correlation and fault identification problem in the presence of multiple faults. These algorithms differ in the degree of accuracy achieved in identifying the fault, and in the degree of complexity required for implementation. >
---
paper_title: High speed and robust event correlation

paper_content:

The authors describe a network management system and illustrate its application to managing a distributed database application on a complex enterprise network.
---
paper_title: A coding approach to event correlation

paper_content:

This paper describes a novel approach to event correlation in networks based on coding techniques. Observable symptom events are viewed as a code that identifies the problems that caused them; correlation is performed by decoding the set of observed symptoms. The coding approach has been implemented in SMARTS Event Management System (SEMS), as server running under Sun Solaris 2.3. Preliminary benchmarks of the SEMS demonstrate that the coding approach provides a speedup at least two orders of magnitude over other published correlation systems. In addition, it is resilient to high rates of symptom loss and false alarms. Finally, the coding approach scales well to very large domains involving thousands of problems.
---
paper_title: Coding and information theory

paper_content:

1: Entropy. 2: Noisless Coding. 3: Noisy Coding. 4: General Remarks on Codes. 5: Linear Codes. 6: Some Linear Codes. 7: Finite Fields and Cyclic Codes. 8: Some Cyclic Codes.
---
paper_title: Identification of Faulty Links in Dynamic-Routed Networks

paper_content:

The authors present a maximum a posteriori method to identify faulty links in a communication network. A designated network node with management responsibilities determines a fault has occurred due to its inability to communicate with certain other nodes. Given this information as well as the information that it can communicate with another specified set of nodes, one would like to identify as quickly as possible a ranked list of the most probable failed network links. The authors also indicate how the method might be extended to the identification of most probable faulty network resources in a more abstract (higher level) model of a network, including, for example, an object-oriented model. >
---
paper_title: A Probabilistic Approach to Fault Diagnosis in Linear Lightwave Networks

paper_content:

The application of probabilistic reasoning to fault diagnosis in linear lightwave networks (LLNs) is investigated. The LLN inference model is represented by a Bayesian network (or causal network). An inference algorithm is proposed that is capable of conducting fault diagnosis (inference) with incomplete evidence and on an interactive basis. Two belief updating algorithms are presented which are used by the inference algorithm for performing fault diagnosis. The first belief updating algorithm is a simplified version of the one proposed by Pearl (1988) for singly connected inference models. The second belief updating algorithm applies to multiply connected inference models and is more general than the first. The authors also introduce a t-fault diagnosis system and an adaptive diagnosis system to further reduce the computational complexity of the fault diagnosis process. >
---
paper_title: Markov Monitoring with Unknown States

paper_content:

Pattern recognition methods and hidden Markov models can be effective tools for online health monitoring of communications systems. Previous work has assumed that the states in the system model are exhaustive. This can be a significant drawback in real-world fault monitoring applications where it is difficult if not impossible to model all the possible fault states of the system in advance. In this paper a method is described for extending the Markov monitoring approach to allow for unknown or novel states which cannot be accounted for when the model is being designed. The method is described and evaluated on data from one of the Jet Propulsion Laboratory's Deep Space Network antennas. The experimental results indicate that the method is both practical and effective, allowing both discrimination between known states and detection of previously unknown fault conditions. >
---
paper_title: High speed and robust event correlation

paper_content:

The authors describe a network management system and illustrate its application to managing a distributed database application on a complex enterprise network.
---
paper_title: End-to-end service failure diagnosis using belief networks

paper_content:

We present fault localization techniques suitable for diagnosing end-to-end service problems in communication systems with complex topologies. We refine a layered system model that represents relationships between services and functions offered between neighboring protocol layers. In a given layer, an end-to-end service between two hosts may be provided using multiple host-to-host services offered in this layer between two hosts on the end-to-end path. Relationships among end-to-end and host-to-host services form a bipartite probabilistic dependency graph whose structure depends on the network topology in the corresponding protocol layer. When an end-to-end service fails or experiences performance problems it is important to efficiently find the responsible host-to-host services. Finding the most probable explanation (MPE) of the observed symptoms is NP-hard. We propose two fault localization techniques based on Pearl's (1988) iterative algorithms for singly connected belief networks. The probabilistic dependency graph is transformed into a belief network, and then the approximations based on Pearl's algorithms and exact bucket tree elimination algorithm are designed and evaluated through extensive simulation study.
---
paper_title: Combinatorial designs in multiple faults localization for battlefield networks

paper_content:

We present an application of combinatorial designs and variance analysis to correlating events in the midst of multiple network faults. The network fault model is based on the probabilistic dependency graph that accounts for the uncertainty about the state of network elements. Orthogonal arrays help reduce the exponential number of failure configurations to a small subset on which further analysis is performed. The preliminary results show that statistical analysis can pinpoint the probable causes of the observed symptoms with high accuracy and significant level of confidence. An example demonstrates how multiple soft link failures are localized in MIL-STD 188-220's datalink layer to explain the end-to-end connectivity problems in the network layer This technique can be utilized for the networks operating in an unreliable environment such as wireless and/or military networks.
---
paper_title: Schemes for fault identification in communication networks

paper_content:

A single fault in a large communication network may result in a large number of fault indications (alarms) making the isolation of the primary source of failure a difficult task. The problem becomes worse in cases of multiple faults. In this paper we present an approach for modelling the problem of fault diagnosis. We propose a graph based network model that takes into account the dependencies among the different objects in the telecommunication environment and a novel approach to estimate the domain of an alarm. Based on that model, we design an algorithm for fault diagnosis and analyze its performance with respect to the accuracy of the fault hypotheses it provides. We also propose and analyze a fault diagnosis algorithm suitable for systems for which an independent failure assumption is valid. Finally, we examine the importance of the information of dependency between objects for the fault diagnosis process.
---
paper_title: An automated fault diagnosis system using hierarchical reasoning and alarm correlation

paper_content:

A slight fault may even cause critical disruptions or remediless damages to the network while a network manager is lost in a large number of alarms. Therefore, the development of a practical and effective system for network fault diagnosis becomes an urgent job. We develop a hierarchical domain-oriented reasoning mechanism suitable for the delegated management architecture. It is based on the causality graph of the sensibly-reduced network fault propagation model from the result of our empirical study. An automated fault diagnosis system called ACView (Alarm Correlation View) for isolating network faults in a multidomain environment is proposed according to the hierarchical reasoning mechanism. This diagnosis system provides not only the process of automated alarm collection and correlation, but also the function of efficient fault localization and identification.
---
paper_title: Probabilistic fault diagnosis in communication systems through incremental hypothesis updating

paper_content:

This paper presents a probabilistic event-driven fault localization technique, which uses a probabilistic symptom-fault map as a fault propagation model. The technique isolates the most probable set of faults through incremental updating of a symptom-explanation hypothesis. At any time, it provides a set of alternative hypotheses, each of which is a complete explanation of the set of symptoms observed thus far. The hypotheses are ranked according to a measure of their goodness. The technique allows multiple simultaneous independent faults to be identified and incorporates both negative and positive symptoms in the analysis. As shown in a simulation study, the technique offers close-to-optimal accuracy and is resilient both to noise in the symptom data and to inaccuracies of the probabilistic fault propagation model.
---
paper_title: The new software paladins

paper_content:

Many people have yet to hear of application service providers, but this new breed of company is already seeking to transform the world of corporate software. Industry watchers, in fact, are saying that the providers are the next step in the evolution of the information technology business and that their success will in the future alter the way all companies obtain and use software, whether enterprise resource management packages, spreadsheets, or even word-processing applications.
---
paper_title: End-to-end service failure diagnosis using belief networks

paper_content:

We present fault localization techniques suitable for diagnosing end-to-end service problems in communication systems with complex topologies. We refine a layered system model that represents relationships between services and functions offered between neighboring protocol layers. In a given layer, an end-to-end service between two hosts may be provided using multiple host-to-host services offered in this layer between two hosts on the end-to-end path. Relationships among end-to-end and host-to-host services form a bipartite probabilistic dependency graph whose structure depends on the network topology in the corresponding protocol layer. When an end-to-end service fails or experiences performance problems it is important to efficiently find the responsible host-to-host services. Finding the most probable explanation (MPE) of the observed symptoms is NP-hard. We propose two fault localization techniques based on Pearl's (1988) iterative algorithms for singly connected belief networks. The probabilistic dependency graph is transformed into a belief network, and then the approximations based on Pearl's algorithms and exact bucket tree elimination algorithm are designed and evaluated through extensive simulation study.
---
paper_title: Virtual Private Networks

paper_content:

A system and method of automatically configuring virtual private networks is provided. The virtual private networks disclosed, include multiple routers selectively connectable to the shared network, such that each of the routers is assigned at least one: shared network address, private network address and virtual private network identifier. Each router includes a controller configured to communicate a router configuration message over the shared network to other members of the same virtual private network. The router configuration message informs the other members of the virtual private network the address of the router and what devices are connected to the router.
---
paper_title: Event modeling with the MODEL language

paper_content:

Event modeling is an essential component of event correlation systems; this paper introduces the MODEL language, which comprises the event modeling component of SMARTS’ InChargeTM event correlation system. We demonstrate the features of the MODEL language through examples from the multimedia Quality of Service (QoS) domain. In addition, we provide a comparison of MODEL with the event modeling capabilities of other event correlation systems; we demonstrate that MODEL generalizes the capabilities of other systems and is more flexible.
---
paper_title: Layered model for supporting fault isolation and recovery

paper_content:

The primary objective of our research is to efficiently support the manual and automated steps needed to perform network fault management (detection, isolation, and recovery). This paper introduces a layered model and an implementation scheme for enhancing the level of automation in fault isolation and recovery. This complements earlier fault management work that has mostly focussed on automating the fault detection and isolation aspects. Our model allows the use of network information, which is typically available to the network designers, in a form more suitable to the network operators. The model supports the use of fault analysis rules that are defined for the network functions, protocols and services at the various network layers. These rules can capture dependency, availability, redundancy, switchover and hierarchical status information with respect to the network services provided by a network.
---
paper_title: The GRID: Blueprint for a New Computing Infrastructure

paper_content:

Edited by Tianruo Yang Kluwer Academic Publisher, Dordrech, Netherlands, 1999, 248 pp. ISBN 0-7923-8588-8, $135.00 This book contains a selection of contributed and invited papers presented and the workshop Frontiers of Parallel Numerical Computations and Applications, in the IEEE 7th Symposium on the Frontiers on Massively Parallel Computers (Frontiers '99) at Annapolis, Maryland, February 20-25, 1999. Its main purpose is to update the designers and users of parallel numerical algorithms with the latest research in the field. A broad spectrum of topics on parallel numerical computations, with applications to some of the more challenging engineering problems, is covered. Parallel algorithm designers and engineers who use extensively parallel numerical computations, as well as graduate students in Computer Science, Scientific Computing, various engineering fields and applied mathematics should benefit from reading it. The first part is addressed to a larger audience and presents papers on parallel numerical algorithms. Two new libraries are presented: PSPASSES and PoLAPACK. PSPASSES is a collection of parallel direct solvers, for sparse symmetric positive definite linear systems, which are characterized by high performance and good scalability. PoLAPACK library contains LU and QR codes based on a new blocking strategy that guarantees good performance regardless of the physical block size. Next, an efficient approach to solving stiff ordinary differential equations by diagonal implicitly iterated Runge-Kutta (DIIRK) method is described. DIIRK renders a fast parallel implementation due to a reduced number of function evaluation and an automatic stepsize control mechanism. Finally, minimization of sufficiently smooth non-linear functionals is sought via parallel space decomposition. Here, a theoretical background of the problem and two equivalent algorithms are presented. New research directions for classical solvers are treated in the next three papers: first, reduction of the global synchronization in the biconjugate gradient method, second, a new more efficient Jacobi ordering for the multiple-port hypercubes, and finally, an analysis of the theoretical performance of an improved version of the Quasi-minimal residual method. Parallel numerical applications constitute the second part of the book, with results from fluid mechanics, material sciences, applications to signal and image processing, dynamic systems, semiconductor technology and electronic circuits and systems design. With one exception, the authors expose in detail parallel implementations of the algorithms and numerical results. First, a 3D-elasticity problem is solved using an additive overlapping domain decomposition algorithm. Second, an overlapping mesh technique is used in a parallel solver for the compressible flow problem. Then, a parallel version of a complex numerical algorithm to solve a lubrication problem studied in tribology is introduced. Next, a timid approach to parallel computing of the cavity flow by the finite element method is presented. The problem solved is rather small for today's needs and only up to 6 processors are used. This is also the only paper that does not present results from numerical experiments. The remaining applications discussed in the subsequent chapters are: large scale multidisciplinary design optimization problem with application to the design of a supersonic commercial aircraft, a report on progress in parallel solution of an electromagnetic scattering problem using boundary integral methods and an optimal solution to the convection-diffusion equation modeling the concentration of a pollutant in the air. The book is of definite interest to readers who keep up-to-date with the parallel numerical computation research. The main purpose, to present the novel ideas, results and work in progress and advancing state-of-the-art techniques in the area of parallel and distributed computing for numerical and computational optimization problems in scientific and engineering application is clearly achieved. However, due to its content it cannot serve as a textbook for a computer science or engineering class. Overall, is a reference type book to be kept by specialists and in a library rather than a book to be purchased for self-introduction to the field. Most of the papers presented are results of ongoing research and so they rely heavily on previous results. On the other hand, with only one exception, the results presented in the papers are a great source of information for the researchers currently involved in the field. Michelle Pal, Los Alamos National Laboratory
---
paper_title: High speed and robust event correlation

paper_content:

The authors describe a network management system and illustrate its application to managing a distributed database application on a complex enterprise network.
---
paper_title: Composite events for network event correlation

paper_content:

With the increasing complexity of enterprise networks and the Internet, event correlation is playing an increasingly important role in network as well as integrated system management systems. Even though the timing of events often reveals important diagnostic information about event relationships and should therefore be represented in event correlation rules or models, most extant approaches lack a formal mechanism to define complex temporal relationships among correlated events. In this paper, we discuss the formal use of composite events for event correlation and present a composite event specification approach that can precisely express complex timing constraints among correlated event instances, for which efficient compilation and detection algorithms have been developed in Mok et al., (1997). A Java implementation of this approach, called Java Event Correlator (JECTOR), is described, and some preliminary experimental results of using JECTOR in an experimental network management environment are also discussed in the paper.
---
paper_title: Schemes for fault identification in communication networks

paper_content:

A single fault in a large communication network may result in a large number of fault indications (alarms) making the isolation of the primary source of failure a difficult task. The problem becomes worse in cases of multiple faults. In this paper we present an approach for modelling the problem of fault diagnosis. We propose a graph based network model that takes into account the dependencies among the different objects in the telecommunication environment and a novel approach to estimate the domain of an alarm. Based on that model, we design an algorithm for fault diagnosis and analyze its performance with respect to the accuracy of the fault hypotheses it provides. We also propose and analyze a fault diagnosis algorithm suitable for systems for which an independent failure assumption is valid. Finally, we examine the importance of the information of dependency between objects for the fault diagnosis process.
---
paper_title: A conceptual framework for network management event correlation and filtering systems

paper_content:

Event correlation is a key functionality of a network management system that is used to determine the root cause of faults in a network, and to filter out redundant and spurious events. A number of event correlation systems have been proposed. The event correlation systems generally combine causal and temporal correlation models with the topology of a network. The power and robustness of the models used and the algorithms developed vary from system to system. However, in the absence of a simple, uniform, and precise presentation of the event-correlation problem, it is impossible to compare their relative power or even analyze them for their properties. In general, causal and temporal-based correlation models have not been rigorously presented or thoroughly investigated. In this paper we formalize the concepts of causal and temporal correlation using a single conceptual framework. We characterize various properties of the framework. We can characterize existing systems based on the formal properties of our framework, and we consider one system as an illustrative example.
---
paper_title: Real-time telecommunication network management: extending event correlation with temporal constraints

paper_content:

Event correlation is becoming one of the most central techniques in managing the high volume of event messages. Practically, no network management system can ignore network surveillance and control procedures which are based on event correlation. The majority of existing network management systems use relatively simple ad hoc additions to their software to perform alarm correlation. In these systems, alarm correlation is handled as an aggregation procedure over sets of alarms exhibiting similar attributes. In recent years, several more sophisticated alarm correlation models have been proposed. In this paper, we will expand our knowledge-based event correlation model to capture temporal constraints.
---
paper_title: Centralized vs Distributed Fault Localization

paper_content:

In this paper we compare the performance of fault localization schemes for communication networks. Our model assumes a number of management centers, each responsible for a logically autonomous part of the whole telecommunication network. We briefly present three different fault localization schemes: namely, “Centralized”, “Decentralized” and “Distributed” fault localization, and, we compare their performance with respect to the computational effort each requires and the accuracy of the solution that each provides.
---
paper_title: Multi-domain Diagnosis of End-to-End Service Failures in Hierarchically Routed Networks

paper_content:

This paper investigates an approach to improving the scalability and feasibility of probabilistic fault localization in communication systems by exploiting the domain semantics of computer networks. The proposed technique divides the computational effort and system knowledge among multiple, hierarchically organized managers. Each manager performs fault localization in the domain it manages and requires only the knowledge of its own domain. Since failures propagate among domains, domain managers cooperate with each other to find a consensus explanation of the observed disorder. We show through simulation that the proposed approach increases the effectiveness of probabilistic diagnosis and makes it feasible in networks of considerable size 1.
---
paper_title: Contract-driven creation and operation of virtual enterprises

paper_content:

This paper examines the support needed for dynamically creating and managing contract-driven virtual enterprises. Our approach to virtual enterprises views contracts as the central theme that runs throughout the enterprises' life cycle and touches upon all major aspects thereof. ::: A Contract Framework integrates the concepts and entities necessary for the contract-centred support. A combination of Virtual Market technology and an advanced Matchmaking Engine (MME) facilitates the creation of service markets where matching business partners can find each other. The market facilitates the deferment of business partner selection and contract signing to the point when the need for the service arises. A set of pre-prepared Internal Enactment Specifications (IESs) provides the mapping of the contract to an organisational blueprint, specified in terms of the internal language, resources and infrastructure of each organisation. The blueprint provides a way of automating the configuration of the Contract Enactment Infrastructure (CEI) for the respective organisations. This complements the deferred selection of a business partner. Advanced CEI technology allows business processes to cross organisational boundaries while providing the consumer with a considerable degree of monitoring and control capability over the contracted service. ::: The integration of our proposed framework and approach supports the creation and management of highly dynamic service markets with automated, fine-grained interaction between organisations, thereby fulfilling the flexibility and efficiency requirements of modern e-business. The approach was used to implement a number of example scenarios and the conclusions drawn from this experience are presented.
---
paper_title: Dynamic e-business: Trends in web services

paper_content:

In the last couple of years, the concept of a web service (WS) has emerged as an important paradigm for general application integration in the internet environment. More particularly, WS is viewed as an important vehicle for the creation of dynamic e-business applications and as a means for the J2EE and .NET worlds to come together. Several companies, including Microsoft, have been collaborating in proposing new WS standards. The World Wide Web Consortium has been the forum for many WS-related standardization activities. Many traditional concepts like business process management, security, directory services, routing and transactions are being extended for WS. This extended abstract traces some of the trends in the WS arena. After the TES2002 workshop is over, more information could be found in the presentation material at http://www.almaden.ibm.com/u/mohan/WebServices_TES2002_Slides.pdf
---
paper_title: Classification and Computation of Dependencies for Distributed Management

paper_content:

This paper addresses the role of dependency analysis in distributed management. The identification of dependencies becomes increasingly important in today's networked environments because applications and services rely on a variety of supporting services which might be outsourced to a service provider. However, service dependencies are not made explicit in today's systems, thus making the task of problem determination particularly difficult. Solving this problem requires the determination and computation of the dependencies between services and applications. A key contribution of the paper is a methodology for making IP-based services and applications manageable that have not been designed to include management instrumentation (which is the case today for almost every application and service). Unlike other approaches, it is not necessary to modify the application code. Instead our approach yields a technique that enumerates the characteristics and interdependencies of applications and services, thus permitting the derivation of appropriate management information.
---
paper_title: Large-scale fault isolation

paper_content:

Of the many distributed applications designed for the Internet, the successful ones are those that have paid careful attention to scale and robustness. These applications share several design principles. In this paper, we illustrate the application of these principles to common network monitoring tasks. Specifically, we describe and evaluate 1) a robust distributed topology discovery mechanism and 2) a mechanism for scalable fault isolation in multicast distribution trees. Our mechanisms reveal a different design methodology for network monitoring-one that carefully trades off monitoring fidelity (where necessary) for more graceful degradation in the presence of different kinds of network dynamics.
---
paper_title: Auto-Discovery Capabilities for Service Management: An ISP Case Study

paper_content:

Auto-discovery is one of the key technologies that enables management systems to be quickly customized to the environments that they are intended to manage. As Internet services have grown in complexity in recent years, it is no longer sufficient to monitor and manage these services in isolation. Instead, it is critical that management systems discover dependencies that exist among Internet services, and use this knowledge for correlation of measurement resutls, so as to determine the root-causes of problems. While most existing management systems have focused on discovery of host, servers, and network elements in isolation, in this paper we describe auto-discovery techniques that discover relationships among services. Since new Internet services and service elements are being deployed at a rapid pace, it is essential that the discovery methodologies be implemented in an extensible manner, so that new discovery capabilities can be incrementally added to the management system. In this paper, we present an extensible architecture for auto-discovery and describe a prototype implementation of this architecture and associated auto-discovery techniques. We also highlight experiences from applying these techniques to discover real-world ISP systems. Although described in the context of ISP systems, the concepts described in this paper are applicable for the discovery of services and inter-service relationships in enterprise systems as well.
---
paper_title: Gulfstream - a system for dynamic topology management in multi-domain server farms

paper_content:

This paper describes GulfStream, a scalable distributed software system designed to address the problem of managing the network topology in a multi-domain server farm. In particular, it addresses the following core problems: topology discovery and verification, and failure detection. Un-like most topology discovery and failure detection systems which focus on the nodes in a cluster, GulfStream logically organizes the network adapters of the server farm into groups. Each group contains those adapters that can directly exchange messages. GulfStream dynamically establishes a hierarchy for reporting network topology and availability of network adapters. We describe a prototype implementation of GulfStream on a 55 node heterogeneous server farm interconnected using switched fast Ethernet.
---
paper_title: Topology discovery for large ethernet networks

paper_content:

Accurate network topology information is important for both network management and application performance prediction. Most topology discovery research has focused on wide-area networks and examined topology only at the IP router level, ignoring the need for LAN topology information. Recent work has demonstrated that bridged Ethernet topology can be determined using standard SNMP MIBs; however, these algorithms require each bridge to learn about all other bridges in the network. Our approach to Ethernet topology discovery can determine the connection between a pair of the bridges that share forwarding entries for only three hosts. This minimal knowledge requirement significantly expands the size of the network that can be discovered. We have implemented the new algorithm, and it has accurately determined the topology of several different networks using a variety of hardware and network configurations. Our implementation requires access to only one endpoint to perform the queries needed for topology discovery.
---
paper_title: Topology discovery in heterogeneous IP networks

paper_content:

Knowledge of the up-to-date physical topology of an IP network is crucial to a number of critical network management tasks, including reactive and proactive resource management, event correlation, and root-cause analysis. Given the dynamic nature of today's IP networks, keeping track of topology information manually is a daunting (if not impossible) task. Thus, effective algorithms for automatically discovering physical network topology are necessary. Earlier work has typically concentrated on either: (a) discovering logical (i.e., layer-3) topology, which implies that the connectivity of all layer-2 elements (e.g., switches and bridges) is ignored; or (b) proprietary solutions targeting specific product families. In this paper, we present novel algorithms for discovering physical topology in heterogeneous (i.e., multi-vendor) IP networks. Our algorithms rely on standard SNMP MIB information that is widely supported by modern IP network elements and require no modifications to the operating system software running on elements or hosts. We have implemented the algorithms presented in this paper in the context of a topology discovery tool that has been tested on Lucent's own research network. The experimental results clearly validate our approach, demonstrating that our tool can consistently discover the accurate physical network topology in time that is roughly quadratic in the number of network elements.
---
paper_title: Heuristics for Internet map discovery

paper_content:

Mercator is a program that uses hop-limited probes-the same primitive used in traceroute-to infer an Internet map. It uses informed random address probing to carefully exploring the IP address space when determining router adjacencies, uses source-route capable routers wherever possible to enhance the fidelity of the resulting map, and employs novel mechanisms for resolving aliases (interfaces belonging to the same router). This paper describes the design of these heuristics and our experiences with Mercator, and presents some preliminary analysis of the resulting Internet map.
---
paper_title: Managing Dynamic Service Dependencies

paper_content:

We anticipate that software development will be service-centric in the near future. Applications will be created from ::: existing services that are distributed throughout a network. Sure enough, management of those components will be ::: mandatory. While service management is usually service-specific, a few areas can be identified that can be addressed ::: in a generic way. One of these areas is the management of dependencies between services. Despite its genericity, this ::: problem is currently mostly addressed in a service-specific way. This paper details the need for a generic dependency ::: management approach, identifies the key properties of dependencies as well as the requirements for dependency management ::: schemes, describes the model derived from the requirements, and presents an implementation using the Jini ::: connection technology.
---
paper_title: An active approach to characterizing dynamic dependencies for problem determination in a distributed environment

paper_content:

We describe a methodology for identifying and characterizing dynamic dependencies between system components in distributed application environments such as e-commerce systems. The methodology relies on active perturbation of the system to identify dependencies and the use of statistical modeling to compute dependency strengths. Unlike more traditional passive techniques, our active approach requires little initial knowledge of the implementation details of the system and has the potential to provide greater coverage and more direct evidence of causality for the dependencies it identifies. We experimentally demonstrate the efficacy of our approach by applying it to a prototypical e-commerce system based on the TPC-W Web commerce benchmark, for which the active approach correctly identifies and characterizes 41 of 42 true dependencies out of a potential space of 140 dependencies. Finally, we consider how the dependencies computed by our approach can be used to simplify and guide the task of root-cause analysis, an important part of problem determination.
---
paper_title: Dependency Analysis in Distributed Systems using Fault Injection: Application to Problem Determination in an e-commerce Environment

paper_content:

──────────────────────────────────────── Distributed networked applications that are being deployed in enterprise settings, increasingly rely on a large number of heterogeneous hardware and software components for providing end-to-end services. In such settings, the issue of problem diagnosis becomes vitally important, in order to minimize system outages and improve system availability. This motivates interest in dependency characterization among the different components in distributed application environments. A promising approach for obtaining dynamic dependency information is the Active Dependency Discovery technique in which a dependency graph of e-commerce transactions on hardware and software components in the system is built by individually “perturbing” the system components during a testing phase and collecting measurements corresponding to the external behavior of the system. In this paper, we propose using fault injection as the perturbation tool for dynamic dependency discovery and problem determination. We describe a method for characterizing dependencies of transactions on the system resources in a typical e-commerce environment, and show how it can aid in problem diagnosis. The method is applied to an application server middleware platform, running end-user activity composed of TPC-W transactions. Representative fault models for such an environment, that can be used to construct the fault injection campaign, are also presented.
---

Title: A Survey of Fault Localization Techniques in Computer Networks

Section 1: Introduction
Description 1: Introduce the basic concepts of fault management in network systems, emphasizing the importance of fault diagnosis.

Section 2: Expert-system techniques for fault localization
Description 2: Discuss expert systems in fault localization, including rule-based reasoning, model-based systems, and their advantages and limitations.

Section 3: Model traversing techniques
Description 3: Explain model traversing techniques and how they utilize formal system representations for fault localization.

Section 4: Graph-theoretic techniques
Description 4: Describe graph-theoretic techniques, including dependency and causality graphs, and their application in fault localization.

Section 5: Divide and conquer algorithm
Description 5: Detail the divide and conquer algorithm, its methodology, and examples of its application in fault localization.

Section 6: Context-free grammar
Description 6: Present how context-free grammar can be used to model fault dependencies in network systems, along with relevant algorithms.

Section 7: Codebook technique
Description 7: Introduce the codebook technique and describe how fault propagation patterns are represented and utilized for fault localization.

Section 8: Belief-network approach
Description 8: Explain the belief-network approach for fault localization and discuss its algorithms and application scenarios.

Section 9: Bipartite causality graphs
Description 9: Discuss bipartite causality graphs and their usage in fault localization, including relevant techniques and examples.

Section 10: Open research problems
Description 10: Outline the current open research questions and challenges in the field of fault localization, highlighting areas needing further development.

Section 11: Conclusions
Description 11: Summarize the survey findings, highlighting the complications in fault localization and the need for continuous research in this domain.