A Comparison of Syslog and IS-IS for Network Failure Analysis
Accurate reporting and analysis of network failures has historically required instrumentation (e.g., dedicated tracing of routing protocol state) that is rarely available in practice. In previous paper, the authors' group has proposed that a combination of common data sources could be substituted instead. In particular, by opportunistically stitching together data from router configuration logs and syslog messages, they demonstrated that a granular picture of network failures could be resolved and verified with human trouble tickets. In this paper, they more fully evaluate the fidelity of this approach, by comparing with high-quality \"Ground truth\" data derived from an analysis of contemporaneous IS-IS routing protocol messages.