What happened in my network: mining network events from router syslogs

Router syslogs are messages that a router logs to describe a wide range of events observed by it. They are considered one of the most valuable data sources for monitoring network health and for troubleshooting network faults and performance anomalies. However, router syslog messages are essentially free-form text with only a minimal structure, and their formats vary among different vendors and router OSes. Furthermore, since router syslogs are aimed for tracking and debugging router software/hardware problems, they are often too low-level from network service management perspectives. Due to their sheer volume (e.g., millions per day in a large ISP network), detailed router syslog messages are typically examined only when required by an on-going troubleshooting investigation or when given a narrow time range and a specific router under suspicion. Automated systems based on router syslogs on the other hand tend to focus on a subset of the mission critical messages (e.g., relating to net...

• Type: Journal
• Year: 2010
• Where: IMC
• Authors: Tongqing Qiu, Zihui Ge, Dan Pei, Jia Wang, Jun Xu
• Keywords: IMC 2010, Internet Technology, Router Syslog Messages, Router Syslogs, Syslog Messages