Summary

The process of managing faults and errors can be summarized as follows:

• First, events must be collected. Usually, faults come in from a variety of sources through several different methods or protocols, such as SNMP notifications, syslog messages, entries in log files, or NMS events.

• Next, the events should be normalized to facilitate their processing. Normalizing means to format the events in a consistent way.

• Next, you must decide if the event can be filtered. Filtering means to identify events that don't need to be processed immediately, or ever. Because the volume of events to be processed can be very high, it is important to filter undesired events as early as possible.

• Next, the management system should correlate events and determine the faults that exist in the network. To correlate events means to look for relationships between them to help determine the root cause of a problem. Correlations can exist between duplicate events or between network and segment events; they can occur on the basis of technology or topology.

• Finally, the event and fault management system must take some sort of action on each of the faults. Possibilities include logging the fault, delivering it to the appropriate tracking application, immediately alerting key personnel of a critical fault, or implementing a repair of the network fault.

The next chapter discusses the statistics that a network manager may need to understand in the course of managing a network.