While there are numerous real-time monitoring tools for metrics, syslog is an area underinvested in by tools vendors. Working with customers, Augtera recognized that syslog contains both stand-alone insights as well as information relevant to incident correlation, along with other data sources such as SNMP, sFlow, OpenConfig, agent data, and more.
Syslog is often used as a historical source of forensic information, which the Augtera platform also supports, including powerful meta-information assisted searches. For example, search on a specific message in a specified part of the network.
Creating a real-time syslog capability for anomaly detection required significant new engineering investment including the ability to process hundreds of millions of streaming messages per hour and billions per day. To detect semantically new messages which could be new anomalies, also required lossless processing, because any message lost could be the symptom of a new anomaly.
The result was an industry first Real-Time natural language processing (NLP) for syslog, and Zero Day anomalies for syslog. See announcement at this link. In addition to these recently introduced capabilities are the ability of customers to define and quickly add classifiers, without requiring a software update. The Augtera platform also supports rate change anomalies: detecting and reporting significant changes in the rate of a syslog message type, which could be the symptom of an anomaly.
Real-time Syslog Classifiers
For solutions developed by network operations teams, detecting patterns can take laborious amounts of work, leading to a low yield. When rules are identified, it can take months for a software update to be created to implement the rule. Not all vendor solutions are significantly better.
The Augtera platform comes installed with numerous classifiers based on work with customers. In addition, customers can quickly create and implement new classifiers without requiring a software update. New classifiers can be in response to Zero Day Anomalies or in response to other identified patterns.
Classifiers allow an operations team to specify many actions, including labeling, changing severity level, mirroring the event to a Kafka destination, and more.
Real-Time Syslog Machine Learning
The Augtera platform makes extensive use of machine learning, leveraging Augtera-developed, networking-specific algorithms. One aspect that is relevant to Real-Time Syslog is the identification of Rate Change anomalies. When the rate of a syslog message changes, that my indicate an anomaly.
Real-Time Syslog Natural Language Processing (NLP)
Augtera announced in April 2022 an industry-first, the use of natural language processing to analyze streaming syslog messages at high rates, billions of messages a day, without loss. This provides the Augtera Platform to compare different messages in a more sophisticated way than simple text comparisons. This technology can understand the difference between common and variable parts of a message, and other semantic differences, to identify truly unique and new messages. Other innovations from this technology will be in future releases of the platform.
Real-Time Syslog Anomalies
The Augtera platform identifies three classes of anomalies:
- Classifier-based anomalies
- Rate change anomalies
- Zero Day Anomalies
Classifier-based anomalies are rule-like anomalies. Rate change anomalies detect changes in the rate at which message types are received. Zero Day Anomalies are new types of messages that have not been detected before and therefore may be symptoms of new anomalies. If so, classifiers can the quickly created and implemented for subsequent identification.
Syslog is now a Real-Time resource. A wealth of information that can be leveraged at the speed of streaming data and used in correlation with other data types as well as for anomaly detection. The integration of natural language processing provides an understanding of syslog messages not previously available in operations tools.
The result is high-fidelity, real-time signals to trouble ticketing systems, automation systems, and NetOps teams.
For more information:
Links to related information and commentary on Augtera’s Real-Time Syslog
- Press Release: Augtera’s NLP Marks a New Era in Real-Time Action from Streaming Log Data
- Augtera blog: Real-time NLP: A New Era in Anomaly Detection for Logs
- Tech Field Day/Networking Field Day 28 video presentation: Augtera Real-Time Syslog