[an error occurred while processing this directive] As you will find out, this page is under development. Suggestions are welcome.

Event Correlation

A severe, practical problem of today's network, systems and application management is the inappropriate management of events. If a problem in the managed system occurs, e.g. a fault or a performance bottleneck, the administrator often is flooded by a burst of more or less meaningless events indicating some symptoms of the problem. Classical event filtering mechanisms had little impact on this. The aim of the event correlator we are developing is to reduce the number and enrich the meaning of the events shown to the administrator. Ideally the event correlator is able to condense the received events to a single event directly indicating the problem in the managed system. Our work is focussed on the methods to gain a dependency graph of the managed system, which is needed by a powerful event correlator.

Event correlation is also known as alarm correlation. This definition of "alarm filtering" basically means the same. However, I would replace "network device" by "managed object". I use the term "event filtering" to describe a mechanism separating relevant from irrelevant events and the term "event correlation" to describe a mechanism condensing relevant events to even more relevant events.

Products

Some of the products are specialized on telecommunication or datacommunication. Many but not all of them are tools for fault management. "Event correlator in the narrow sense" describes a product sold as "event correlator". Many event correlators are integrated into or bundled with products for wider application.

Disclaimer: The information listed here is taken from the web. I did not verify most of it.

Event Correlators in the narrow sense

Seagate's event correlator Nerve Center define "behaviour models" - state machines and filter patterns - to perform event correlation. It is usually combined with a management platform. Solstice uses the same technology. Micromuse has a comparison with their Netcool/OMNIbus.
System Management ARTS (linked with Columbia University and IBM) has an event correlator called InCharge. Its technology is based on Codebook Event Correlation as explained in High Speed & Robust Event Correlation by Yemini/Kliger et al..

Expert Systems

ToDo: Alcatel NM-Expert as described here
Gensym's G2 / Fault Expert is an expert system for fault management. Its rule base includes rules for event correlation. Is it the same as the Operations Assistant?
ILOG's ILOG Rules is a rule-based expert system that has been applied for fault management.
Talarian's expert system RTie was applied to correlate alarms. See RTworks Real-Time Software Tools for Advanced Alarm Correlation. Used by MCI, also see IBM NetView TMN Support Facility and RTie
ToDo: BIM Networks NetCortex (with Solstice)

Fault Management Tools

Computer Associates's Unicenter TNG has a event automation component called Unicenter TNG Automation Point Option, which includes rule-based event correlation capabilities. Extensible agents built with CA-Unicenter/AgentFactory are also intended to do some event correlation close to the components. See the technical white paper on Unicenter TNG for details.
MAXM's MAX/Enterprise is a rule-based event management system for automating the whole process of fault detection, localization and repair.
Stanford Telecom's NetCoach Fault Manager is a fault management tool for ATM devices including event correlation capabilities.

Management Platforms

Advent's Web NMS lets you specify your correlation rules in Java.
In Bull's ISM/OpenMaster management suite a rule-based event correlator called ISM Event Processor is mentioned in this technical whitepaper. But I couldn't find a real product description.
Cabletron's Spectum has an add-on called SpectroRx Resolution Expert, which uses case-based reasoning to localize faults. Another add-on, the Spectrum Alarm Notification Manager, provides filtering of events. Third-party products with event correlation capabilities include Spectrum and Seagate Nerve Center Pro and Spectrum and MAX/Enterprise and for security management Spectrum and OmniGuard / IntruderAlert (ITA).
In Linmor's Nebula - Network Management System object-oriented repository a MO's depended objects are stored. Event correlation is done by walking along the dependencies (see the white paper).
In MegaSys's Telenium event categories are defined to classify the impact of a fault to a MO. Model-based event correlation is enabled by relational information stored in the database. See here.
For Digital's TeMIP Framework for Digital Unix there is the TeMIP Fault and Trouble Management for Digital UNIX, which includes an event correlator. Events can be correlated by comibining filters, especially filters considering time aspects.
For HP's OpenView platform there are the Event Correlation Services (ECS) for IT/Operations. In ECS you program "correlation circuits" to define the processing of events. The manuals and an article about ECS from the HP-Journal are online. Internally ECS uses ECDL, a functional programming language. The HP OpenView Telecom version is simply called Event Correlation Services. There is another approach implemented for the telecommunications area within the HP OpenView Fault Management Platform (FMP) which is part of the HP OpenView Element Management Framework (OEMF). Here the user provides rules describing a root-cause relation. See the HP-Journal article for details. This approach can be combined with ECS.
Siemens Nixdorf Informationssysteme has a rule-based event correlator called Transview EventCenter. The user's guide is online.
Sun Microsystems's Solstice has an event correlator called Nerve Center within the Solstice Enterprise Manager. Using the Request Designer one can program "request templates". A request template is structured as a finite state machine. A state transition occurs when a certain condition is true. Conditions are programmed in the Request Condition Language (RCL), a imperative programming language. See the online manuals for details. Seagate's NerveCenter uses the same technology.
Tivoli's ("an IBM company") TME 10 Management Environment has a rule-based event correlation engine in its TME 10 Enterprise Console (TEC).

Other

Axent's tool for security management OmniGuard / IntruderAlert (ITA) detects intruders by analyzing events using its rule-based inference engine.
There still is Digital's Polycenter Manager on NetView. What about it after this? It is not mentioned here.
ToDo: BMC
Italtel ("a Stet and Siemens company") has solved (among other) the issue of event correlation for TMN-environments :-). I don't know how its SALT/SSRN does it.
Micromuse's event manager Netcool/OMNIbus has rule-based event correlation capabilities. Within their ObjectServer one can define "Trigger" to watch for certain types of events or certain conditions to occur. They compared it with NerveCenter.
OSI's NetExpert Network Fault Manager (no URL?)
ToDo: Peer Networks
ToDo: AT&T Total Network Management.According to IF Computer their IF/Prolog interpreter is used by AT&T's TNM. See here and here.
ToDo: GTE's Enterprise Management System (GEMS) for the telecommunications area has a rule-based event correlator (see "Problem Resolution"). Some technical information can be found here. Is it still called "Impact"?

Event Management Standardisation Activities

Object Management Group (OMG):
- Telecommunications Domain Task Force: Notification Service (Request For Proposal)
- however not Management specific the "CORBAservices - Event Management Service" (ps, pdf) is also relevant
OpenGroup (the join of Open Software Foundation (OSF) and X-Open):
- Systems Management: Event Management Service (XEMS) (preliminary specification) [local mirror @ mnmteam]
- Joint Inter-Domain Management (JIDM): Specification Translation [local mirror @ mnmteam]; provides a mapping between CMIP Notifications and CORBA Events and between SNMP Traps and CORBA Events)
Network Management Forum (NMF): Generic Alarm Monitoring
Internet Engineering Task Force (IETF)
- SNMPv2 Framework: RFC1902-1908 (draft standard) [mirror @ leo]
- Distributed Management WorkingGroup (disman):
  - Event MIB (internet draft) [mirror @ leo]
  - Notification MIB (internet draft) [mirror @ leo]
  - Disman Meeting Aug97@Munich (minutes)
- SNMP Version 3 WorkingGroup (snmpv3):
  - Message Processing and Dispatching for the Simple Network Management Protocol (SNMP) (internet draft) [mirror @ leo]
- WWW Distributed Authoring and Versioning (webdav) Note: The terminology complies to the Corba Event Service:
  - Requirements for Event Notification Protocol (internet draft, 16-Apr-98)
  - Requirements for Event Notification Protocol (internet draft, 05-May-98)
Java Management API (JMAPI):
- Architecture / Section Event Notification
- Programmer's Guide / Section Event Management
Web-based Enterprise Management (WBEM): HMMP Events (still not a internet draft)
Telecommunications Information Networking Architecture Consortium (TINA-C):
- Network Resource Architecture / Section 6: Fault Management
- Engineering Modelling Concepts (DPE Architecture) / Section 6.5: Notification Service
TMN Management Functions - function set group "Alarm Surveillance" - function set "Alarm Correlation", ITU-M.3400 (content not online for free)

Online Resources

High Speed & Robust Event Correlation by Yemini/Kliger et al.
various product analyses (found on the Cabletron server)
The Section Alarm Correlation in Network Management - What it is and what it isn't. by Douglas W. Stevenson (duplicated here and here)
In the current Web-based Enterprise Management Proposal there is a paragraph called "Event Correlation and Forwarding" stating that WBEM knows OSI-like discriminator objects. Event correlation and event forwarding is not the same :-)
Archive of comp.dcom.net-management
ToDo: search in techweb.cmp.com
Journal of Network and Systems Management: Vol. 5, No. 2, 2 June 1997 Special issue: Fault Management in Communication Networks
A comparison between Micromuse's Netcool/OMNIbus and Seagate's NerveCenter Pro (from Micromuse's webserver)

Literature

abstract online: A.T. Bouloutas et. al. Schemes for Distributed Fault Identification in Communication Networks, Journal of Network and Systems Management Vol. 3, No. 3, September 1995
abstract online in german: Alexander Pohl Event Correlation, Diplomarbeit, Universität Stuttgart - Institut für Parallele und Verteilte Höchstleistungsrechner - Abteilung für Verteilte Systeme
fully online: Peter Fröhlich, Wolfgang Nejdl, Klaus Jobmann und Hermann Wietgrefe Model-based Alarm Correlation in Cellular Phone Networks, Fifth International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems (MASCOTS), January 1997
fully online: Hermann Wietgrefe, Klaus-Dieter Tuchs, Klaus Jobmann, Guido Carls, Peter Fröhlich, Wolfgang Nejdl, Sebastian Steinfeld Using Neural Networks for Alarm Correlation in Cellular Phone Networks, International Workshop on Applications of Neural Networks in Telecommunications, 1997
K. Houck, S. Calo, A. Finkel Towards a Practical Alarm Correlation System, IFIP/IEEE ISINM '95
S. Kliger, S. Yemini, Y. Yemini, D. Ohsie, S. Stolfo, A Coding Approach to Event Correlation
Y.A. Nygate Event Correlation using Rule and Object Based Techniques, IFIP/IEEE ISINM '95
G. Jakobson, M. Weissman Real-Time Telecommunication Network Management: Extending Event Correlation with Temporal Constraints, IFIP/IEEE ISINM '95

Jobs

Event correlation is a hot topic. There are even job offers mentioning event correlation!

MNM's Event Correlation Research Prototype

Sorry, online access requires a password due to security reasons.

Release 0.1 (1997/08/17)
Release 0.2 (1997/11/02)
Release 0.3 (1998/01/11)
Release 0.4 (1998/06/24)
Release 0.5 (1998/11/15)

Internals

Questions? Complaints? Comments about this page? contact me

[an error occurred while processing this directive]