Real-Time Syslog

Multi-vendor-Real-Time-Syslog

Introduction

While there are numerous real-time monitoring tools for metrics, real-time log analysis software and tools, and specifically syslog, is an area underinvested in by tools vendors. Working with customers, Augtera recognized that syslog contains both stand-alone insights as well as information relevant to incident correlation, along with other data sources such as SNMP, sFlow, OpenConfig, agent data, and more.

Syslog is often used as a historical source of forensic information, which the Augtera platform also supports, including powerful meta-information assisted searches. For example, search on a specific message in a specified part of the network.

Creating a real-time syslog capability for anomaly detection required significant new engineering investment including the ability to process hundreds of millions of streaming messages per hour and billions per day. To detect semantically new messages which could be new anomalies, also required lossless processing, because any message lost could be the symptom of a new anomaly.

The result was an industry first Real-Time natural language processing (NLP) for syslog, and Zero Day anomalies for syslog. See announcement at this link. In addition to these recently introduced capabilities are the ability of customers to define and quickly add classifiers, without requiring a software update. The Augtera platform also supports rate change anomalies: detecting and reporting significant changes in the rate of a syslog message type, which could be the symptom of an anomaly.

May 6th 2022, Network Field Day 28 presentation of Real-Time Syslog presented by Bhupesh Kothari, Co-Founder, John Heintz, Director of Sales Engineering, and Jim Meehan, Head of Product

Real-time Syslog Classifiers

For solutions developed by network operations teams, detecting patterns can take laborious amounts of work, leading to a low yield. When rules are identified, it can take months for a software update to be created to implement the rule.

Augtera’s syslog classifiers are patterns that have been learned by the Augtera platform across the customer base. This network learning is disseminated to all deployments.

Classifiers allow an operations team to specify many actions, including labeling, changing severity level, mirroring the event to a Kafka destination, and more.

Real-Time Syslog Machine Learning

The Augtera platform makes extensive use of machine learning, leveraging Augtera-developed, networking-specific algorithms. One aspect that is relevant to Real-Time Syslog is the identification of Rate Change anomalies. When the rate of a syslog message changes, that my indicate an anomaly.

Real-Time Syslog Natural Language Processing (NLP)

Augtera announced in April 2022 an industry-first, the use of natural language processing to analyze streaming syslog messages at high rates, billions of messages a day, without loss. This provides the Augtera Platform to compare different messages in a more sophisticated way than simple text comparisons. This technology can understand the difference between common and variable parts of a message, and other semantic differences, to identify truly unique and new messages. Other innovations from this technology will be in future releases of the platform.

Real-Time Syslog Anomalies

The Augtera platform identifies three classes of anomalies:

  • Classifier-based anomalies
  • Rate change anomalies
  • Zero Day Anomalies

Classifier-based anomalies are rule-like anomalies. Rate change anomalies detect changes in the rate at which message types are received. Zero Day Anomalies are new types of messages that have not been detected before and therefore may be symptoms of new anomalies. If so, classifiers can quickly be created and implemented for subsequent identification.

Conclusion

Syslog is now a Real-Time resource. A wealth of information that can be leveraged at the speed of streaming data and used in correlation with other data types as well as for anomaly detection. The integration of natural language processing provides an understanding of syslog messages not previously available in operations tools.

The result is high-fidelity, real-time signals to trouble ticketing systems, automation systems, and NetOps teams.

For more information:

Links to related information and commentary on Augtera’s Real-Time Syslog