Semantic Alarms

Stefan Wallin Tail-f, Ph DDirector Product Strategy

Johan Nordlander, Ph DAssistant ProfessorLuleå University of Technology

SEMANTIC ALARMS

?• SDN, OpenFlow, NFV• 2013

• Alarms• 1970…

Alarms, why bother?

2©2013 TAIL-F all rights reserved

• 1970…

• The alarm problem is unsolved• Alarm overload increasing• System and network complexity increasing

SEMANTIC ALARMS

Current Practice

Syntactical Alarm Syntactical Alarm

Alarm

Documentation

Not formalized

Correlation

3©2013 TAIL-F all rights reserved

Syntactical Alarm

Standards and Interfaces

(X.733, 3GPP)

Syntactical Alarm

Standards and Interfaces

(X.733, 3GPP)

Correlation

Inventory enrichment

…

…

Alarms at run-time

SEMANTIC ALARMS

SDN ?

OSS, BSS, Orchestration

SDNLogically centralized API, View

4©2013 TAIL-F all rights reserved

Multi-vendor, multi-technology network

SDN

SEMANTIC ALARMS

SDN – Alarms ?

OSS, BSS, Orchestration�Few manual actions, automation

SDNLogically centralized API, View�Synthesized Centralized

5©2013 TAIL-F all rights reserved

Multi-vendor, multi-technology network�Semantic Alarm Interfaces

SDN �Synthesized Centralized Alarm Status

SEMANTIC ALARMS

The SDN Control Loop

6©2013 TAIL-F all rights reserved

SDN Operational Data

Actual State

Configuration Data

Desired State

SEMANTIC ALARMS

The SDN Control Loop – Alarm ?

Desired State != Actual State

That requires Action

= ALARM

Escape out of the control loop

7©2013 TAIL-F all rights reserved

SDN Operational Data

Actual State

Configuration Data

Desired State

SEMANTIC ALARMS

Semantic Alarm ?

An Alarm signifies an undesired state that requires action.

Read the above again

8©2013 TAIL-F all rights reserved

Read the above again

• Digest…

• Undesired State!

• Requires Action!

• Bound to the data-model for the device

SEMANTIC ALARMS

Take Action ? !

Syntactic KnowledgeSyntactic Knowledge Syntactic ActionSyntactic Action

9©2013 TAIL-F all rights reserved

Semantic KnowledgeSemantic Knowledge Semantic ActionSemantic Action

SEMANTIC ALARMS

Take Action ? !

Syntactic KnowledgeSyntactic Knowledge Syntactic ActionSyntactic Action

Traps Trap Browser

10©2013 TAIL-F all rights reserved

Semantic KnowledgeSemantic Knowledge Semantic ActionSemantic Action

Alarms Automatic Actions

SEMANTIC ALARMS

Good Alarm (EEMUA 191) ?

11©2013 TAIL-F all rights reserved

SEMANTIC ALARMS

• Systems should publish the potential alarms• Semantic Alarm Model

• Allow for automation• Text-based grammar• YANG is the SDN data-modeling language for configuration,

equally useful for alarm models.

• No standard for doing this

A Semantic Alarm Model

12©2013 TAIL-F all rights reserved

• No standard for doing this

Syntactical Alarm

Standards and

Interfaces

(X.733, 3GPP)

Syntactical Alarm

Standards and

Interfaces

(X.733, 3GPP)

Alarms at run-time

Semantic Alarm ModelSemantic Alarm Model

Good

Alarms

SEMANTIC ALARMS

Modeling the Alarm Handling Game

enum Severity { Clear, Warning, Minor, Major, Critical }

Value operstatet (Path) may change with each time t

Severity alarmstatet (Path) may change with each time t

XPathExpr alarmpred (Path, Severity) static meaning of each alarm

14©2013 TAIL-F all rights reserved

XPathExpr alarmpred (Path, Severity) static meaning of each alarm

bool istruet (XPathExpr) depends on operstatet

Soundness of the alarmstate abstraction:

alarmstatet (p) = sev�

∀s≤sev : istruet(alarmpred(p,s)) & ∀s>sev : ~istruet(alarmpred(p,s))

SEMANTIC ALARMS

Modeling the Alarm Handling Game

Notifications sent up to time t (Time-Path-Severity triples):

notifs_sentt=

{ (c,p,s) | c ≤ t & alarmstatec(p) = s & alarmstatec-ɛ (p) ≠ s }

⊆

15©2013 TAIL-F all rights reserved

Notifications received up to time t (Time-Path-Severity triples):

notifs_recvdt ⊆ notifs_sentt

Safe interpretation of received notifications:

(c,p,sev) ∈ notifs_recvdt⇨

∀s≤sev : istruec(alarmpred(p,s)) & ∀s>sev : ~istruec(alarmpred(p,s))

SEMANTIC ALARMS

Summary

Less Alarms

Alarms are an

operational pain

16©2013 TAIL-F all rights reserved

Less Alarms

Less Manual Work

More Automation

Semantic Alarm ModelsWe need a standard to

express these

SEMANTIC ALARMS

• 3GPP TR 32.859 Study on Alarm Management• Tommy Berggren, TeliaSonera

• “Chasing a Definition of Alarm”• Stefan Wallin• Journal of Network and Systems Management• Volume 17 Issue 4, December 2009

• “The semantics of alarm definitions: enabling

See also….

17©2013 TAIL-F all rights reserved

• “The semantics of alarm definitions: enabling systematic reasoning about alarms”

• Stefan Wallin, Johan Nordlander, Viktor Leijon, Nicklas Bystedt

• International Journal of Network Management• Volume 22, Issue 3, pages 181–198, May/June 2012