Alarms and Notifications

[John DeCarlo <jdecarlo@mitre.org>]

Hello,

The IETF Disman WG has just put out a new draft document, details at the 
bottom to get a copy.  I recall Andrea noting that there are contacts 
between the DMTF and Disman.  Here are some interesting parts re: WSDM:

o) "Managed objects are accessed via a virtual information store, termed
     the Management Information Base or MIB."

- Note that this does not tie the object to the MIB, allowing some of 
the types of things already discussed, such as aggregation, hierarchy, etc.

o) "In traditional SNMP management, problems are detected on an entity
    either through polling interesting MIB variables, waiting for the
    entity to send a Notification for a problem, or some combination of
    the two. This method is somewhat successful, but experience has
    shown some problems with this approach. Managers monitoring large
    number of entities cannot afford to be polling large numbers of
    objects on each device. Managers trying to ensure high-reliability
    are unable to accurately determine problems that may have occurred
    when they were not monitoring an entity. Finally, it can be time
    consuming for managers to try to understand the relationships
    between the various objects they poll, the Notifications they
    receive and the problems occurring on the entity and even after
    detailed analysis they may still be left with an incomplete picture
    of what problems are occurring. But, it is important for an operator
    to be able to determine current problems on a system, so they can be
    fixed."

- This is a clear statement of issues with scalability as well as being 
occasionally connected (distributed).

o) "3.1 Terminology

   Error
      A deviation of a system from normal operation.

   Fault
      Lasting error or warning condition.

   Event
      Something that happens which may be of interest to a management
      station. A fault, a change in status, crossing a threshold, or an
      external input to the system, for example.

   Notification
      Unsolicited transmissions of management information.

   Alarm
      Persistent indication of a fault.

   Alarm State
      A condition or stage in the existence of an alarm. As a minimum,
      alarms states are raise and clear. They could also
      include severity information such as defined by perceived severity
      in the ITU model - cleared, indeterminate, critical, major, minor
      and warning.

   Alarm Raise
      The initial detection of the fault indicated by an alarm or any
      number of alarm states later entered, except clear. A Notification
      SHOULD be sent on alarm raise.

   Alarm Clear
      The detection that the fault indicated by an alarm no longer
      exists.  A Notification SHOULD be sent on alarm clear.

   Active Alarm
      An alarm which has an alarm state that has been raised, but not
      cleared.

   Alarm Detection Point
       The entity that detected the alarm.

   Perceived Severity
      The severity of the alarm as determined by the alarm detection
      point using the information it has available."

- Not that these terms are perfect, but it is one of many potential 
starting points.

There is much more that covers some of the discussions we have had lately.

 >A New Internet-Draft is available from the on-line Internet-Drafts 
 >directories.
 >This draft is a work item of the Distributed Management Working Group 
 >of the IETF.
 >
 >	Title		: Alarm MIB
 >	Author(s)	: S. Chisholm, D. Romascanu
 >	Filename	: draft-ietf-disman-alarm-mib-13.txt
 >	Pages		: 66
 >	Date		: 2003-6-2
 >	
 >This memo defines a portion of the Management Information Base (MIB)
 >for use with network management protocols in the Internet community.
 >In particular, it describes management objects used for defining
 >and storing alarms.
 >
 >A URL for this Internet-Draft is:
 >http://www.ietf.org/internet-drafts/draft-ietf-disman-alarm-mib-13.txt

-- 

John DeCarlo, The MITRE Corporation, My Views Are My Own
email:      jdecarlo@mitre.org
voice:      703-883-7116
fax:        703-883-3383
DISA cube:  703-882-0593