Distributed Event Monitoring for Software Defined Networks

Software defined network separates data and control planes that facilitate network management functions, especially enabling programmable network control functions. Event monitoring is a fault management function involved in collecting and filtering event notification messages from network devices. This study presents an approach of distributed event monitoring for software defined network. Monitoring events usually deals with a large amount of event log data, log collecting and filtering processes thus require a high degree of automation and efficiency. This approach takes advantage of the OpenFlow and syslog protocols to collect and store log events obtained from network devices on a syslog server. It also uses the adaptive semantic filtering method to filter and present non-trivial events for system administrators to take further actions. We have evaluated this approach on a network simulation platform and provided some log collection and filtering results with analysis.