Extending a knowledge-based network to support temporal event reasoning

While the polling or request/response paradigm adopted by many network and systems management approaches form the backbone of modern monitoring and management systems, the most important and interesting events, faults, alerts and log messages arrive at the management agent in a push-based asynchronous manner. However, in the management infrastructure itself, at the point where events are initially processed and matched to subscribers, there have been few attempts to identify relationships or dependencies between events. This means that most of this burden is placed on the management application, or indeed the managers themselves. This research investigates enhancing the expressiveness of a knowledge-based networking middleware with the addition of three temporal operators to be used in subscriptions to select matching events. A prototype design is presented and a number of implementations are compared. The approach is also motivated using two scenarios for temporal correlation of warnings and faults in managed networks. The effect on the scalability of the extended knowledge-based network system is also evaluated.