rfc9940v2.txt   rfc9940.txt 
skipping to change at line 221 skipping to change at line 221
* Network Observability is the process of enabling behavioral * Network Observability is the process of enabling behavioral
assessment of a network through Network Analytics. assessment of a network through Network Analytics.
3.2. Core Terms 3.2. Core Terms
The terms in this section are presented in an order that is intended The terms in this section are presented in an order that is intended
to flow such that it is possible to gain understanding reading top to to flow such that it is possible to gain understanding reading top to
bottom. The figures and explanations in Section 4 may aid bottom. The figures and explanations in Section 4 may aid
understanding the terms set out here. understanding the terms set out here.
Resource: An element of a network system. Resource: A Resource is an element of a network system.
* Resource is a recursive concept so that a Resource may be a * Resource is a recursive concept so that a Resource may be a
collection of other Resources (for example, a network node collection of other Resources (for example, a network node
comprises a collection of network interfaces). comprises a collection of network interfaces).
Characteristic: Observable or measurable aspect or behavior Characteristic: A Characteristic is an observable or measurable
associated with a Resource. aspect or behavior associated with a Resource.
* A Characteristic may be considered to be built on facts (see * A Characteristic may be considered to be built on facts (see
"Value", below) and the contexts and descriptors that identify "Value", below) and the contexts and descriptors that identify
and give meaning to the facts. and give meaning to the facts.
* The term "Metric" (see "metric" in [RFC9417]) is another word * The term "Metric" (see "metric" in [RFC9417]) is another word
for a measurable Characteristic, which may also be thought of for a measurable Characteristic, which may also be thought of
as analogous to a "variable". as analogous to a "variable".
Value: A measure of a Characteristic associated with a Resource. It Value: A Value is a measure of a Characteristic associated with a
may be in the form of a categorization (e.g., high or low), an Resource. It may be in the form of a categorization (e.g., high
integer (e.g., a count or gauge), or a reading of a continuous or low), an integer (e.g., a count or gauge), or a reading of a
variable (e.g., an analog measurement), etc. continuous variable (e.g., an analog measurement), etc.
Change: In the context of Network Monitoring, the variation in the Change: In the context of Network Monitoring, a Change is the
Value of a Characteristic associated with a Resource. A Change variation in the Value of a Characteristic associated with a
may arise over a period of time. Resource. A Change may arise over a period of time.
* Not all Changes are noteworthy (i.e., they do not have * Not all Changes are noteworthy (i.e., they do not have
Relevance). Relevance).
* Perception of Change depends upon Detection, the sampling * Perception of Change depends upon Detection, the sampling
rate/accuracy/detail, and perspective. rate/accuracy/detail, and perspective.
* It may be helpful to qualify this as "Value Change" because the * It may be helpful to qualify this as "Value Change" because the
English word "change" is often heavily used. English word "change" is often heavily used.
Event: The variation in Value of a Characteristic of a Resource at a Event: An Event is the variation in Value of a Characteristic of a
distinct moment in time (i.e., the period is negligible). Resource at a distinct moment in time (i.e., the period is
negligible).
* Compared with a Change, which may be over a period of time, an * Compared with a Change, which may be over a period of time, an
Event happens at a distinct moment in time. Thus, an Event may Event happens at a distinct moment in time. Thus, an Event may
be the observation of a Change. be the observation of a Change.
Condition: An interpretation of the Values of a set of one or more Condition: A Condition is an interpretation of the Values of a set
Characteristics of a Resource (with respect to working order or of one or more Characteristics of a Resource (with respect to
some other aspect relevant to the Resource purpose/application) -- working order or some other aspect relevant to the Resource
for example, "low available memory". Thus, it is the output of a purpose/application) -- for example, "low available memory".
function applied to a set of one or more variables. Thus, it is the output of a function applied to a set of one or
more variables.
State: A particular Condition that a Resource has (i.e., it is in a State: A State is a particular Condition that a Resource has (i.e.,
State) at a specific time. For example, a router may report the it is in a State) at a specific time. For example, a router may
total amount of memory it has and how much is free. These are the report the total amount of memory it has and how much is free.
Values of two Characteristics of a Resource. These Values can be These are the Values of two Characteristics of a Resource. These
interpreted to determine the Condition of the Resource, and that Values can be interpreted to determine the Condition of the
may determine the State of the router, such as shortage of memory. Resource, and that may determine the State of the router, such as
shortage of memory.
* While a State may be observed at a specific moment in time, it * While a State may be observed at a specific moment in time, it
is actually determined by summarizing measurement over time in is actually determined by summarizing measurement over time in
a process sometimes called State compression. a process sometimes called State compression.
* It may be helpful to qualify this as "Resource State" to make * It may be helpful to qualify this as "Resource State" to make
clear the distinction between this and other uses of "state" clear the distinction between this and other uses of "state"
such as "protocol state". such as "protocol state".
* This term may be contrasted with "operational state" as used in * This term may be contrasted with "operational state" as used in
[RFC8342]. For example, the state of a link might be up/down/ [RFC8342]. For example, the state of a link might be up/down/
degraded, but the operational state of the link would include a degraded, but the operational state of the link would include a
collection of Values of Characteristics of the link. collection of Values of Characteristics of the link.
Detect (hence Detected, Detection): To notice the presence of Detect (hence Detected, Detection): To Detect is to notice the
something (State, Change, Event, activity, etc.) presence of something (State, Change, Event, activity, etc.)
* Also to notice a Change (from the perspective of an observer * Also to notice a Change (from the perspective of an observer
such as a monitoring system). such as a monitoring system).
Relevance: Consideration of an Event, State, or Value (through the Relevance: Relevance is the consideration of an Event, State, or
application of policy, relative to a specific perspective or Value (through the application of policy, relative to a specific
intent, and in relation to other Events, States, and Values) to perspective or intent, and in relation to other Events, States,
determine whether it is of note to the system that controls or and Values) to determine whether it is of note to the system that
manages the network. Note, for example, that not all Changes are controls or manages the network. Note, for example, that not all
Relevant. Changes are Relevant.
* This term may also be used as "Relevant Event", "Relevant * This term may also be used as "Relevant Event", "Relevant
State", or "Relevant Value". State", or "Relevant Value".
Occurrence: A Relevant Event or a particular Relevant Change. Occurrence: An Occurrence is a Relevant Event or a particular
Relevant Change.
* An Occurrence may be an aggregation or abstraction of multiple * An Occurrence may be an aggregation or abstraction of multiple
fine-grained Events or Changes. fine-grained Events or Changes.
* An Occurrence may occur at any macro or micro scale because * An Occurrence may occur at any macro or micro scale because
Resources are a recursive concept. An Occurrence may be Resources are a recursive concept. An Occurrence may be
perceived, depending on the scope of observation (i.e., perceived, depending on the scope of observation (i.e.,
according to the level of Resource recursion that is examined). according to the level of Resource recursion that is examined).
That is, Occurrences, themselves, are a recursive concept. That is, Occurrences, themselves, are a recursive concept.
Fault: An Occurrence (i.e., an Event or a Change) that is not Fault: A Fault is an Occurrence (i.e., an Event or a Change) that is
desired/required (as it may be indicative of a current or future not desired/required (as it may be indicative of a current or
undesired State). Thus, a Fault happens at a moment in time. A future undesired State). Thus, a Fault happens at a moment in
Fault can potentially be associated with a Cause. See [RFC8632] time. A Fault can potentially be associated with a Cause. See
for a more detailed discussion of network faults. [RFC8632] for a more detailed discussion of network faults.
* Note that there is a distinction between a Fault and a Problem * Note that there is a distinction between a Fault and a Problem
that depends on context. For example, in a connectivity that depends on context. For example, in a connectivity
service where redundancy is present, a link down is a Problem, service where redundancy is present, a link down is a Problem,
but from the perspective of managing the network resources, a but from the perspective of managing the network resources, a
link down is a Fault. Likewise, for example, in a router with link down is a Fault. Likewise, for example, in a router with
two power supplies, if the backup power supply fails leaving two power supplies, if the backup power supply fails leaving
the primary unprotected, this is a Problem. the primary unprotected, this is a Problem.
Problem: A State that is undesirable and that may require remedial Problem: A Problem is a State that is undesirable and that may
action. A Problem cannot necessarily be associated with a Cause. require remedial action. A Problem cannot necessarily be
The resolution of a Problem does not necessarily act on the thing associated with a Cause. The resolution of a Problem does not
that has the Problem. necessarily act on the thing that has the Problem.
* Note that there is a historic aspect to the concept of a * Note that there is a historic aspect to the concept of a
Problem. The current State may be operational, but there could Problem. The current State may be operational, but there could
have been a Fault that is unexplained, and the fact of that have been a Fault that is unexplained, and the fact of that
unexplained recent Fault is a Problem. unexplained recent Fault is a Problem.
* Note that while a Problem is unresolved it may continue to * Note that while a Problem is unresolved it may continue to
require attention. A record of resolved Problems may be require attention. A record of resolved Problems may be
maintained in a log. maintained in a log.
skipping to change at line 359 skipping to change at line 363
operational once more) but may leave the Problem as unresolved operational once more) but may leave the Problem as unresolved
(because the loss of light has not been explained). Further, (because the loss of light has not been explained). Further,
in this example, there could be another development (the reason in this example, there could be another development (the reason
for the temporary loss of light is traced to a microbend in the for the temporary loss of light is traced to a microbend in the
fiber that is repaired) resulting in that unresolved Problem fiber that is repaired) resulting in that unresolved Problem
now being resolved. But, in this example, this still leaves a now being resolved. But, in this example, this still leaves a
further Problem unresolved (a microbend occurred, and that further Problem unresolved (a microbend occurred, and that
Problem is not resolved until it is understood how it occurred Problem is not resolved until it is understood how it occurred
and a remedy is put in place to prevent recurrence). and a remedy is put in place to prevent recurrence).
Cause: The Events (Detected or otherwise) that gave rise to a Fault/ Cause: A Cause is the Events (Detected or otherwise) that gave rise
Problem. to a Fault/Problem.
Incident: Also referred to as "Network Incident". An Incident is an Incident: Also referred to as "Network Incident". An Incident is an
undesired Occurrence such as an unexpected interruption of a undesired Occurrence such as an unexpected interruption of a
network service, degradation of the quality of a network service, network service, degradation of the quality of a network service,
or the below-target performance of a network service. An Incident or the below-target performance of a network service. An Incident
results from one or more Problems, and a Problem may give rise to results from one or more Problems, and a Problem may give rise to
or contribute to one or more Incidents. Greater discussion of or contribute to one or more Incidents. Greater discussion of
Network Incident relationships, including Customer Incidents and Network Incident relationships, including Customer Incidents and
Incident management, can be found in [Net-Incident-Mgmt-YANG]. Incident management, can be found in [Net-Incident-Mgmt-YANG].
Symptom: An observable Value, Change, State, Event, or Condition Symptom: A Symptom is an observable Value, Change, State, Event, or
considered as an indication of a Problem or potential Problem. Condition considered as an indication of a Problem or potential
Problem.
Anomaly: Also referred to as "Network Anomaly". An Anomaly is an Anomaly: Also referred to as "Network Anomaly". An Anomaly is an
unusual or unexpected Event or pattern in network data in the unusual or unexpected Event or pattern in network data in the
forwarding plane, control plane, or management plane that deviates forwarding plane, control plane, or management plane that deviates
from the normal, expected behavior. See [Net-Anomaly-Arch] for from the normal, expected behavior. See [Net-Anomaly-Arch] for
more details. more details.
Alert: An indication of a Fault. Alert: An Alert is an indication of a Fault.
Alarm: As specified in [RFC8632], signifies an undesirable State in Alarm: As specified in [RFC8632], an Alarm signifies an undesirable
a Resource that requires corrective action. From a management State in a Resource that requires corrective action. From a
point of view, an Alarm can be seen as a State in its own right management point of view, an Alarm can be seen as a State in its
and the transition to this State may result in an Alert being own right and the transition to this State may result in an Alert
issued. The receipt of this Alert may give rise to a continuous being issued. The receipt of this Alert may give rise to a
indication (to a human operator) highlighting the potential or continuous indication (to a human operator) highlighting the
actual presence of a Problem. potential or actual presence of a Problem.
3.3. Other Terms 3.3. Other Terms
Three other terms may be helpful: Three other terms may be helpful:
Intermittent: A State that is not continuous but that keeps Intermittent: A State that is not continuous but that keeps
recurring in some time frame. recurring in some time frame.
Transient: A State that is not continuous and that occurs once in Transient: A State that is not continuous and that occurs once in
some time frame. some time frame.
 End of changes. 16 change blocks. 
53 lines changed or deleted 58 lines changed or added

This html diff was produced by rfcdiff 1.48.