Inferring Groups of Correlated Failures

We compare and evaluate different methods to infer groups of correlated failures. These methods try to group failure events occurring nearly simultaneously in clusters. Indeed if several failures occur nearly at the same moment in a network, it is possible that these failures have the same root cause. The input data of our algorithms are IP failure notifications that can be provided by several sources. We consider two sources: IS-IS Link State Packets (LSPs) and Syslog messages. Our first results on the Abilene and GÉANT networks show that the inference methods behave differently and that using IS-IS LSPs provides more accurate results than using Syslog messages.