NetEye - Network Monitoring, Zabbix implementation

Trabajo de presentación en formato PowerPoint del TFC NetEye- Zabbix, network monitoring implementation.

NetEye - Network Monitoring, Zabbix implementation

Con este proyecto se pretende implementar en un entorno real la herramienta Zabbix de monitoring de red. La idea es realizar un estudio de las necesidades, instalar la plataforma base, comprobar con ejemplos reales que la plataforma cumple con las necesidades corporativas y por último diseñar el plan de acción para el despliegue final a la organización.

Improving social capital : a social network monitoring system. 'Mejorar el capital social : un sistema de red de control social'.

Resumen tomado del autor

Robust automatic mapping algorithms in a network monitoring scenario

Automatically generating maps of a measured variable of interest can be problematic. In this work we focus on the monitoring network context where observations are collected and reported by a network of sensors, and are then transformed into interpolated maps for use in decision making. Using traditional geostatistical methods, estimating the covariance structure of data collected in an emergency situation can be difficult. Variogram determination, whether by method-of-moment estimators or by maximum likelihood, is very sensitive to extreme values. Even when a monitoring network is in a routine mode of operation, sensors can sporadically malfunction and report extreme values. If this extreme data destabilises the model, causing the covariance structure of the observed data to be incorrectly estimated, the generated maps will be of little value, and the uncertainty estimates in particular will be misleading. Marchant and Lark [2007] propose a REML estimator for the covariance, which is shown to work on small data sets with a manual selection of the damping parameter in the robust likelihood. We show how this can be extended to allow treatment of large data sets together with an automated approach to all parameter estimation. The projected process kriging framework of Ingram et al. [2007] is extended to allow the use of robust likelihood functions, including the two component Gaussian and the Huber function. We show how our algorithm is further refined to reduce the computational complexity while at the same time minimising any loss of information. To show the benefits of this method, we use data collected from radiation monitoring networks across Europe. We compare our results to those obtained from traditional kriging methodologies and include comparisons with Box-Cox transformations of the data. We discuss the issue of whether to treat or ignore extreme values, making the distinction between the robust methods which ignore outliers and transformation methods which treat them as part of the (transformed) process. Using a case study, based on an extreme radiological events over a large area, we show how radiation data collected from monitoring networks can be analysed automatically and then used to generate reliable maps to inform decision making. We show the limitations of the methods and discuss potential extensions to remedy these.

Design and Development of Network Monitoring Strategies in P4-enabled Programmable Switches

Network monitoring is of paramount importance for effective network management: it allows to constantly observe the network’s behavior to ensure it is working as intended and can trigger both automated and manual remediation procedures in case of failures and anomalies. The concept of SDN decouples the control logic from legacy network infrastructure to perform centralized control on multiple switches in the network, and in this context, the responsibility of switches is only to forward packets according to the flow control instructions provided by controller. However, as current SDN switches only expose simple per-port and per-flow counters, the controller has to do almost all the processing to determine the network state, which causes significant communication overhead and excessive latency for monitoring purposes. The absence of programmability in the data plane of SDN prompted the advent of programmable switches, which allow developers to customize the data-plane pipeline and implement novel programs operating directly in the switches. This means that we can offload certain monitoring tasks to programmable data planes, to perform fine-grained monitoring even at very high packet processing speeds. Given the central importance of network monitoring exploiting programmable data planes, the goal of this thesis is to enable a wide range of monitoring tasks in programmable switches, with a specific focus on the ones equipped with programmable ASICs. Indeed, most network monitoring solutions available in literature do not take computational and memory constraints of programmable switches into due account, preventing, de facto, their successful implementation in commodity switches. This claims that network monitoring tasks can be executed in programmable switches. Our evaluations show that the contributions in this thesis could be used by network administrators as well as network security engineers, to better understand the network status depending on different monitoring metrics, and thus prevent network infrastructure and service outages.

WCDMA HSPA performance counters for monitoring 3G-radio access network

The objective of this project was to gather all the counters which are used on HSPA performance monitoring. The main purpose was to create a compact packet of HSPA performance counters and radio network monitoring which Ericsson's employees can then use in their daily work. The study includes a short introduction to the architecture of the 3G-radio access network. The HSPA technology and HSPA performance are presented including a functional description of performance counters and KPIs, which are used for performance management and monitoring. The theory part of the study also covers an overview of performance management in OSS-RC. The final part of the study covers an overview of the performance management tools, in-troducing how the counters are represented in these interfaces. MOShell and OSS-RC are tools used in this study. Tools were selected because the MOShell is Ericsson's inter-nal management tool and OSS-RC is a tool designed for customers.

An epistemic event -based correlation scheme for pervasive network management

Computer networks produce tremendous amounts of event-based data that can be collected and managed to support an increasing number of new classes of pervasive applications. Examples of such applications are network monitoring and crisis management. Although the problem of distributed event-based management has been addressed in the non-pervasive settings such as the Internet, the domain of pervasive networks has its own characteristics that make these results non-applicable. Many of these applications are based on time-series data that possess the form of time-ordered series of events. Such applications also embody the need to handle large volumes of unexpected events, often modified on-the-fly, containing conflicting information, and dealing with rapidly changing contexts while producing results with low-latency. Correlating events across contextual dimensions holds the key to expanding the capabilities and improving the performance of these applications. This dissertation addresses this critical challenge. It establishes an effective scheme for complex-event semantic correlation. The scheme examines epistemic uncertainty in computer networks by fusing event synchronization concepts with belief theory. Because of the distributed nature of the event detection, time-delays are considered. Events are no longer instantaneous, but duration is associated with them. Existing algorithms for synchronizing time are split into two classes, one of which is asserted to provide a faster means for converging time and hence better suited for pervasive network management. Besides the temporal dimension, the scheme considers imprecision and uncertainty when an event is detected. A belief value is therefore associated with the semantics and the detection of composite events. This belief value is generated by a consensus among participating entities in a computer network. The scheme taps into in-network processing capabilities of pervasive computer networks and can withstand missing or conflicting information gathered from multiple participating entities. Thus, this dissertation advances knowledge in the field of network management by facilitating the full utilization of characteristics offered by pervasive, distributed and wireless technologies in contemporary and future computer networks.

An Epistemic Event-based Correlation Scheme for Pervasive Network Management

Computer networks produce tremendous amounts of event-based data that can be collected and managed to support an increasing number of new classes of pervasive applications. Examples of such applications are network monitoring and crisis management. Although the problem of distributed event-based management has been addressed in the non-pervasive settings such as the Internet, the domain of pervasive networks has its own characteristics that make these results non-applicable. Many of these applications are based on time-series data that possess the form of time-ordered series of events. Such applications also embody the need to handle large volumes of unexpected events, often modified on-the-fly, containing conflicting information, and dealing with rapidly changing contexts while producing results with low-latency. Correlating events across contextual dimensions holds the key to expanding the capabilities and improving the performance of these applications. This dissertation addresses this critical challenge. It establishes an effective scheme for complex-event semantic correlation. The scheme examines epistemic uncertainty in computer networks by fusing event synchronization concepts with belief theory. Because of the distributed nature of the event detection, time-delays are considered. Events are no longer instantaneous, but duration is associated with them. Existing algorithms for synchronizing time are split into two classes, one of which is asserted to provide a faster means for converging time and hence better suited for pervasive network management. Besides the temporal dimension, the scheme considers imprecision and uncertainty when an event is detected. A belief value is therefore associated with the semantics and the detection of composite events. This belief value is generated by a consensus among participating entities in a computer network. The scheme taps into in-network processing capabilities of pervasive computer networks and can withstand missing or conflicting information gathered from multiple participating entities. Thus, this dissertation advances knowledge in the field of network management by facilitating the full utilization of characteristics offered by pervasive, distributed and wireless technologies in contemporary and future computer networks.

Sistema de correlação de eventos e notificações - SCEN

Mestrado em Engenharia Electrotécnica e de Computadores

Plataforma remota de gestão de um parque de GateBoxes

A monitorização de redes é um aspeto de elevada importância, principalmente em redes de média ou grande dimensão. A necessidade de utilização de uma ferramenta para realização dessa gestão facilita o trabalho e proporciona de uma forma mais rápida e eficaz a identificação de problemas na rede e nos seus sistemas. Neste sentido, o presente trabalho tem como objetivo o desenvolvimento de uma solução para a monitorização de GateBoxes, um dos produtos desenvolvidos e comercializados pela empresa NextToYou. A necessidade de monitorização das GateBoxes, por parte da NextToYou, é essencial para que possa detetar falhas no seu funcionamento ou realizar notificações aquando da deteção de problemas para uma rápida resolução. Neste contexto a empresa decidiu implementar uma ferramenta para a referida monitorização e propôs, no âmbito da tese, o desenvolvimento de uma aplicação que satisfizesse esses propósitos. Disponibilizou então, para o desenvolvimento uma plataforma, a WebForge, e definiu alguns requisitos funcionais dessa ferramenta, tais como, a monitorização remota de informação, gestão de alarmes, geração de avisos e notificações. Para a elaboração deste trabalho foram realizados estudos teóricos sobre o tema da gestão e monitorização remotas, realizando-se posteriormente o desenvolvimento de uma aplicação para a monitorização de GateBoxes. Após a implementação efetuou-se a validação do trabalho realizado através da execução de testes e demonstrações, de forma a poder validar e verificar o desempenho do sistema.

Sistema de monitorização da qualidade e consumo de energia elétrica

A racionalização do consumo de energia elétrica é um tema que assume uma importância crescente nos dias de hoje. O elevado consumo de energia, principalmente a nível comercial/industrial, tem motivado o aparecimento de questões políticas, económico-sociais e ambientais que visam a sensibilização dos consumidores para a gestão eficiente dos seus recursos. Neste sentido, as empresas e instituições têm demonstrado interesse em encontrar soluções de gestão nas suas instalações elétricas que permitam a monitorização de indicadores e a previsão de falhas cuja ocorrência acarreta elevados custos de reparação/substituição, de paragem de produção, entre outros. O estudo aqui apresentado surge no âmbito de um projeto académico, cuja finalidade se prende com a implementação de um sistema de monitorização da qualidade e consumo de energia elétrica no Instituto Superior de Engenharia do Porto (ISEP). Baseado numa rede de dispositivos analisadores de parâmetros de energia elétrica, estes equipamentos de medição dispõem de software próprio, o GridVis, que permite o acesso remoto, através de uma rede Ethernet, aos parâmetros de energia (grandezas físicas elétricas). O sistema desenvolvido é capaz de identificar parâmetros de consumo de energia anómalos e emitir alertas, pré-programados em linguagem C++ e diagrama de blocos. Permite, por exemplo, detetar um consumo instantâneo excessivo de energia e alertar a sua ocorrência. As páginas de acesso aos parâmetros medidos por cada dispositivo são acessíveis através de uma interface gráfica desenvolvida em Adobe Flash que inclui, de uma forma simples e organizada, a informação relativa à distribuição dos dispositivos de medição. Num contexto de expansão deste projeto para outros edifícios do ISEP, a solução desenvolvida encontra-se preparada para ser adaptada em qualquer local, desde que reúna certos requisitos.

Kytkentäisen lähiverkon palvelutason mittaaminen

Tässä diplomityössä tutkittiin yrityksen Ethernet-lähiverkon palvelutasoa, palveluiden saatavuuden näkökulmasta. Tutkimus pohjautui käytännön tarpeeseen. Palvelun saatavuuteen verkon osalta vaikuttavat sen käyttöaste, virheet ja viiveet. Työssä käytettiin valmiita kaupallisia ohjelmia verkon hallintaan ja verkkostatistiikan keräämiseen. Työssä selvitettiin teoriapohjaa laitteiden, kytkentätekniikoiden, palvelulaatuprotokollien (QoS), tietoliikenneprotokollien, RMON:in, SNMP:in ja VLAN:in osalta, jotka yhdessä muodostavat kytkentäisen lähiverkon palvelutason. Työn tuloksena todettiin mittauskohteena olevan lähiverkon palvelutason olevan hyvällä tasolla. Työn tuloksista pääteltiin tulevaisuuden suurimpana haasteena olevan lähiverkkoja yhdistävien yhteyksien nostaminen selvästi paremmalle suoritustasolle. Lähiverkkojen teoreettinen suorituskyky onkin useimmiten riittävä, mutta lähiverkkojen hallinnassa on parantamisen varaa. Työssä toteutettiin seurantajärjestelmä, jolla on helppo seurata lähiverkon palvelutason kehitystä jatkossa.

Hajautettujen asiakasverkkoyhteyksien valvonta

Tässä diplomityössä tutkitaan kuinka verkonvalvonta voidaan toteuttaa hajautetussa järjestelmässä. Työssä perehdytään tavallisten tietojärjestelmien ja hajautettujen järjestelmien eroihin, kyseisten järjestelmien ominaispiirteisiin sekä käsitellään mitä verkonvalvonta on yleisellä tasolla ja miten se on yleensä toteutettu tavallisissa tietojärjestelmissä. Tutkitaan tarkemmin kuinka verkonvalvonta voidaan toteuttaa tehokkaasti hajautetussa järjestelmässä sekä mitä vaatimuksia ja haasteita verkonvalvonnassa esiintyy. Tutkimukseen valittiin myös kaksi hajautetun järjestelmän verkonvalvontaan kehitettyä valvontaohjelmistoa sekä yksi laitteistopohjainen ratkaisu joita tutkitaan ja vertaillaan tarkemmin.Selvitetään onko yrityksen kannattavaa ja valvonnan kannalta tehokasta ottaa tämänkaltaista järjestelmää käyttöön. Lopputuloksena työssä on esiteltyinä kuinka verkonvalvonta voidaan toteuttaa hajautetussa järjestelmässä ja miten olemassa olevat haasteet voidaan ratkaista. Toteutusvaihtoehdot tutkittiin ja niistä valittiin paras vaihtoehto (perfSONAR) toteutustavaksi kohdeorganisaation asiakasverkkoyhteyksien valvontaan. Lopuksi esitellään toteutussuunnitelma yrityksen asiakasyhteyksien valvomiseen tarkoitetulle verkonvalvonnalle.