An ONAP event is an aggregation of a header and a message. Event messages may be published to a message broker by service instances, resource instances, or ONAP platform components. Service or resource instances may be in support of network infrastructure or customer services. Interested platforms may subscribe to events on the message broker (e.g. Centralized Testing Platform CTP) may see an event on a service VNF instance and perform an automated test as part of a closed loop management policy. Events are unique and distinguishable from one another.
ONAP event messages are serialized as a unicode ASCII character string which may be formatted as JSON, XML, etc... Appropriate schemas will be supplied.
Fields specific to fault events
Fields specific to heartbeat events
Fields specific to measurement events
Fields specific to mobility flow events
Fields specific to notification events
Fields specific to other types of events
Fields specific to pnfRegistration events
Fields specific to sipSignaling events
Fields specific to state change events
Fields specific to syslog events
Fields specific to threshold crossing alert events
Fields specific to voiceQuality events
Fields common to all events
Fields specific to fault events
Additional alarm information.
• Note1: for SNMP mapping to VES, for hash key use OID of varbind, for value use incoming data for that varbind).
• Note2: Alarm ID for 3GPP should be included (if applicable) in alarmAdditonalInformation as ‘alarmId’:’alarmIdValue’.
Could contain managed object instance as separate key:value; could add probable cause as separate key:value.
Short name of the alarm condition/problem, such as a trap name. Should not have white space (e.g., tpLgCgiNotInConfig, BfdSessionDown, linkDown, etc…)
Card, port, channel or interface name of the device generating the alarm. This could reflect managed object.
Event category, for example: ‘license’, ‘link’, ‘routing’, ‘security’, ‘signaling’
Event severity enumeration: ‘CRITICAL’, ‘MAJOR’, ‘MINOR’, ‘WARNING’, ‘NORMAL’. NORMAL is used to represent clear.
Examples: ‘card’, ‘host’, ‘other’, ‘port’, ‘portThreshold’, ‘router’, ‘slotThreshold’, ‘switch’, ‘virtualMachine’, ‘virtualNetworkFunction’. This could be managed object class.
Version of the faultFields block as “#.#” where # is a digit; see section 1 for the correct digits to use.
Description of the alarm or problem (e.g., ‘eNodeB 155197 in PLMN 310-410 with eNodeB name KYL05197 is lost’). 3GPP probable cause would be included in this field.
Virtual function status enumeration: ‘Active’, ‘Idle’, ‘Preparing to terminate’, ‘Ready to terminate’, ‘Requesting Termination’
The heartbeatFields datatype is an optional field block for fields specific to heartbeat events.
Additional expansion fields if needed.
Version of the heartbeatFields block as “#.#” where # is a digit; see section 1 for the correct digits to use.
Current heartbeatInterval in seconds.
commonEventHeader - Fields common to all events.
Event domain enumeration: ‘fault’, ‘heartbeat’, ‘measurement’, ‘mobileFlow’, ‘notification’, ‘other’, ‘pnfRegistration’, ‘sipSignaling’, ‘stateChange’, ‘syslog’, ‘thresholdCrossingAlert’, ‘voiceQuality’
Event key that is unique to the event source. The key must be unique within notification life cycle similar to EventID from 3GPP. It could be a sequential number, or a composite key formed from the event fields, such as domain_sequence. The eventId should not include whitespace. For fault events, eventId is the eventId of the initial alarm; if the same alarm is raised again for changed, acknowledged or cleared cases, eventId must be the same as the initial alarm (along with the same startEpochMicrosec but with a different sequence number). Note: see section 1.3 for eventId use case examples.
eventName - Unique event name.
To prevent naming collisions, eventName sent as part of the commonEventHeader, should conform to the following naming convention designed to summarize the purpose and type of the event, and to ensure the uniqueness of the eventName:
{DomainAbbreviation}_{NamingCode or ApplicationPlatform}_{DescriptionOfInfoBeingConveyed}
Domain abbreviations are derived from the ‘domain’ field in the commonEventHeader, as specified below:
‘Fault’ for the fault domain
‘Heartbeat’ for the heartbeat domain
‘Measurement’ for the measurements domain
‘MobileFlow’ for the mobileFlow domain
‘Other’ for the other domain
‘PnfReg’ for the pnfRegistration domain
‘SipSignaling’ for the sipSignaling domain
‘StateChange’ for the stateChange domain
‘Syslog’ for the syslog domain
‘Tca’ for the thresholdCrossingAlert domain
‘VoiceQuality’ for the voiceQuality domain
Unique event name
For example: ‘applicationNf’, ‘guestOS’, ‘hostOS’, ‘platform’
the latest unix time aka epoch time associated with the event from any component--as microseconds elapsed since 1 Jan 1970 not including leap seconds
Network function component type: 3 characters (aligned with vfc naming standards)
Network function type: 4 characters (aligned with vnf and pnf naming standards)
Network function vendor name
Processing priority enumeration: ‘High’, ‘Medium’, ‘Normal’, ‘Low’
reportingEntityId - UUID identifying the entity reporting the event or detecting a problem in another xnf/vm or pnf which is experiencing the problem.
Note: the AT&T internal enrichment process shall ensure that this field is populated. The reportingEntityId is an id for the reportingEntityName. See reportingEntityName for more information.
UUID identifying the entity reporting the event or detecting a problem in another vnf/vm or pnf which is experiencing the problem. (Note: the AT&T internal enrichment process shall ensure that this field is populated). The reportingEntityId is an id for the reportingEntityName. See ‘reportingEntityName’ for more information.
reportingEntityName - Name of the entity reporting the event or detecting a problem in another xnf/vm or pnf which is experiencing the problem. May be the same as the sourceName. For synthetic events generated by DCAE, it is the name of the app generating the event.
Name of the entity reporting the event or detecting a problem in another vnf/vm or pnf which is experiencing the problem. May be the same as the sourceName. For synthetic events generated by DCAE, it is the name of the app generating the event.
sequence - Ordering of events communicated by an event source instance (or 0 if not needed)
Ordering of events communicated by an event source instance (or 0 if not needed)
sourceId - UUID identifying the entity experiencing the event issue, which may be detected and reported by a separate reporting entity
Note: the AT&T internal enrichment process shall ensure that this field is populate). The sourceId is an id for the sourceName. See sourceName for more information.
UUID identifying the entity experiencing the event issue, which may be detected and reported by a separate reporting entity (note: the AT&T internal enrichment process shall ensure that this field is populated). The sourceId is an id for the sourceName. See ‘sourceName’ for more information.
sourceName - Name of the entity experiencing the event issue, which may be detected and reported by a separate reporting entity. The sourceName identifies the device for which data is collected. A valid sourceName must be inventoried in A&AI. If sourceName is a xNFC or VM, then the event must be reporting data for that particular xNFC or VM. If the sourceName is a xNF, comprised of multiple xNFCs, the data must be reported/aggregated at the xNF leveI. Data for individual xNFC must not be included in the xNF sourceName event.
Name of the entity experiencing the event issue, which may be detected and reported by a separate reporting entity. The sourceName identifies the device for which data is collected. A valid sourceName must be inventoried in A&AI. If sourceName is a xNFC or VM, then the event must be reporting data for that particular xNFC or VM. If the sourceName is a xNF, comprised of multiple xNFCs, the data must be reported/aggregated at the xNF leveI. Data for individual xNFC must not be included in the xNF sourceName event.
startEpochMicrosec - the earliest unix time aka epoch time associated with the event from any component--as microseconds elapsed since 1 Jan 1970 not including leap seconds. For measurements and heartbeats, where events are collected over predefined intervals, startEpochMicrosec shall be rounded to the nearest interval boundary (e.g., the epoch equivalent of 3:00PM, 3:10PM, 3:20PM, etc…).
For fault events, startEpochMicrosec is the timestamp of the initial alarm; if the same alarm is raised again for changed, acknowledged or cleared cases, startEpochMicrosec must be the same as the initial alarm (along with the same eventId and an incremental sequence number). For devices with no timing source (clock), the default value will be 0 and DCAE collector will replace it with Collector time stamp (when event is received).
the earliest unix time aka epoch time associated with the event from any component--as microseconds elapsed since 1 Jan 1970 not including leap seconds. For measurements and heartbeats, where events are collected over predefined intervals, startEpochMicrosec shall be rounded to the nearest interval boundary (e.g., the epoch equivalent of 3:00PM, 3:10PM, 3:20PM, etc…). For fault events, startEpochMicrosec is the timestamp of the initial alarm; if the same alarm is raised again for changed, acknowledged or cleared cases, startEpoch Microsec must be the same as the initial alarm (along with the same eventId and an incremental sequence number). For devices with no timing source (clock), the default value will be 0 and the VES collector will replace it with Collector time stamp (when the event is received)
Offset to GMT to indicate local time zone for device formatted as ‘UTC+/-hh:mm’; see https://en.wikipedia.org/wiki/List_of_time_zone_abbreviations for UTC offset examples
Version of the event header as “#.#” where # is a digit; see section 1 for the correct digits to use.
Version of the ves event listener api spec that this event is compliant with (as “#” or “#.#” or “#.#.#” where # is a digit; see section 1 for the correct digits to use).
Fields specific to measurement events
Additional measurement fields if needed.
Array of named hashMap if needed.
Array of Schema objects described by name, schema and other meta-information, if needed.
Peak concurrent sessions for the VM or VNF (depending on the context) over the measurementInterval.
Depending on the context over the measurementInterval: peak total number of users, subscribers, devices, adjacencies, etc., for the VM, or peak total number of subscribers, devices, etc., for the VNF
The hashMap key should identify the feature, while the value defines the number of times the identified feature was used.
Mean seconds required to respond to each request for the VM on which the VNFC reporting the event is running.
Version of the measurementFields block as “#.#” where # is a digit; see section 1 for the correct digits to use.
Interval over which measurements are being reported in seconds
Represents busy-ness of the network function from 0 to 100 as reported by the nfc.
Number of media ports in use.
Peak request rate per second, for the VM over the measurementInterval
Array of metrics on hugePages
Array of codecs in use
Usage of an array of CPUs
Usage of an array of disks
Filesystem usage of the VM on which the xNFC reporting the event is running
Array of intelligent platform management interface metrics
Array of integers representing counts of requests whose latency in milliseconds falls within per-xNF configured ranges; where latency is the duration between a service request and its fulfillment.
Array of system load metrics
Array of machine check exceptions
Memory usage of an array of VMs
Performance metrics of an array of network interface cards
Array of metrics on system processes
Fields specific to mobility flow events
additionalFields - Additional mobileFlow fields if needed.
applicationType - Application type inferred
applProtocolType - Application protocol.
applProtocolVersion - Application version.
cid - Cell Id.
connectionType - Abbreviation referencing a 3GPP reference point e.g., S1-U, S11, etc.
ecgi - Evolved Cell Global Id.
flowDirection - Flow direction, indicating if the reporting node is the source of the flow or destination for the flow.
gtpProtocolType - GTP protocol
gtpVersion - GTP protocol version.
httpHeader - HTTP request header, if the flow connects to a node referenced by HTTP.
imei - IMEI for the subscriber UE used in this flow, if the flow connects to a mobile device.
imsi - IMSI for the subscriber UE used in this flow, if the flow connects to a mobile device
ipProtocolType - IP protocol type e.g., TCP, UDP, RTP...
ipVersion - IP protocol version e.g., IPv4, IPv6
lac - Location area code.
mcc - Mobile country code.
mnc - Mobile network code.
mobileFlowFieldsVersion - Version of the mobileFlowFields block.
msisdn - MSISDN for the subscriber UE used in this flow, as an integer, if the flow connects to a mobile device.
otherEndpointIpAddress - IP address for the other endpoint, as used for the flow being reported on.
Note: current data type (String) may be changed to Common Resource Datatype L3AddressData. =[gh]=
otherEndpointPort - IP Port for the reporting entity, as used for the flow being reported on
otherFunctionalRole - Functional role of the other endpoint for the flow being reported on e.g., MME, S-GW, P-GW, PCRF...
rac - Routing area code
radioAccessTechnology - Radio Access Technology e.g., 2G, 3G, 4G and 5G. (GSM, UMTS, LTE, 5G)
reportingEndpointIpAddr - IP address for the reporting entity, as used for the flow being reported on.
Note: current data type (String) may be changed to Common Resource Datatype L3AddressData. =[gh]=
reportingEndpointPort - IP port for the reporting entity, as used for the flow being reported on.
sac - Service area code
samplingAlgorithm - Integer identifier for the sampling algorithm or rule being applied in calculating the flow metrics if metrics are calculated based on a sample of packets, or 0 if no sampling is applied.
tac - Transport area code
tunnelId - Tunnel identifier
vlanId - VLAN identifier used by this flow
Mobility GTP Protocol per flow metrics
Fields specific to notification events
Additional notification fields if needed.
arrayOfNamedHashMap - Array of named hashMaps
Identifier for a contact related to the change.
System or session identifier associated with the change.
Describes what has changed for the entity, for example: configuration changed, capability added, capability removed…
New state of the entity, for example: ‘inService’, ‘maintenance’, ‘outOfService’
Version of the notificationFields block as “#.#” where # is a digit; see section 1 for the correct digits to use.
Previous state of the entity.
For example: "inService", "outOfService", "maintenance"
Card or port name of the entity that changed state.
The otherFields datatype defines fields for events belonging to the 'other' domain of the commonEventHeader domain enumeration.
Array of named hashMaps
Array of name-value pairs.
Array of schema objects described by name, schema and other meta-information.
Version of the otherFields block as “#.#” where # is a digit; see section 1 for the correct digits to use.
The pnfRegistrationFields datatype defines fields for events belonging to the 'pnfRegistration' domain of the commonEventHeader domain enumeration; it consists of the following fields:
Additional pnfRegistration fields if needed
TS 32.692 dateOfLastService = date of last service; e.g. 15022017
MAC address of OAM interface of the unit
TS 32.692 dateOfManufacture = manufacture date of the unit; 24032016
TS 32.692 versionNumber = version of the unit from vendor; e.g. AJ02. Maps to AAI equip-model
IPv4 m-plane IP address to be used by the manager to contact the PNF
IPv6 m-plane IP address to be used by the manager to contact the PNF
Version of the registrationFields block as “#.#” where # is a digit; see section 1 for the correct digits to use.
TS 32.692 serialNumber = serial number of the unit; e.g. 6061ZW3
TS 32.692 swName = active SW running on the unit; e.g. 5gDUv18.05.201
TS 32.692 vendorUnitFamilyType = general type of HW unit; e.g. BBU
TS 32.692 vendorUnitTypeNumber = vendor name for the unit; e.g. Airscale
TS 32.692 vendorName = name of manufacturer; e.g. Nokia. Maps to AAI equip-vendor
sipSignalingFields - The sipSignalingFields datatype communicates information about SIP signaling messages, parameters and signaling state.
zdditionalInformation - Additional sipSignalling fields.
compressedSip - The full SIP request/response including headers and bodies.
correlator - Constant across all events on this call.
localIpAddress - IP address on VNF.
Note: current data type (String) may be changed to Common Resource Datatype L3AddressData. =[gh]=
localPort - Port on VNF.
remoteIpAddress - IP address of peer endpoint.
Note: current data type (String) may be changed to Common Resource Datatype L3AddressData. =[gh]=
remotePort - Port of peer endpoint
sipSignalingFieldsVersion - Version of the sipSignalingFields block as “#.#” where # is a digit; see section 1 for the correct digits to use.
summarySip - The SIP Method or Response (‘INVITE’, ‘200 OK’, ‘BYE’, etc).
Vendor, NF and nfModule names
Fields specific to state change events.
Additional stateChange fields if needed
New state of the entity: ‘inService’, ‘maintenance’, ‘outOfService’
Previous state of the entity: ‘inService’, ‘maintenance’, ‘outOfService’
Version of the stateChangeFields block as “#.#” where # is a digit; see section 1 for the correct digits to use.
Card or port name of the entity that changed state
Syslog’s can be classified as either Control or Session/Traffic. They differ by message content and expected volume:
• Control logs are generally free-form human-readable text used for reporting errors or warnings supporting the operation and troubleshooting of NFs. The volume of these logs is typically less than 2k per day.
• Session logs use common structured fields to report normal NF processing such as DNS lookups or firewall rules processed. The volume of these logs is typically greater than 1k per hour (and sometimes as high as 10k per second).
VES supports both classes of syslog, however VES is only recommended for control logs or for lower volume session logs, less than 60k per hour. High volume session logging should use a file-based transport solution.
Additional syslog fields if needed Ex: {“name1”: ”value1”, “name2: “value2” … }
Hostname of the device
Examples: ‘other’, ‘router’, ‘switch’, ‘host’, ‘card’, ‘port’, ‘slotThreshold’, ‘portThreshold’, ‘virtualMachine’, ‘virtualNetworkFunction’
0-32 char in format name@number,
i.e., ourSDID@32473
Numeric code from 0 to 23 for facility:
0 kernel messages
1 user-level messages
2 mail system
3 system daemons
4 security/authorization messages
5 messages generated internally by syslogd
6 line printer subsystem
7 network news subsystem
8 UUCP subsystem
9 clock daemon
10 security/authorization messages
11 FTP daemon
12 NTP subsystem
13 log audit
14 log alert
15 clock daemon (note 2)
16 local use 0 (local0)
17 local use 1 (local1)
18 local use 2 (local2)
19 local use 3 (local3)
20 local use 4 (local4)
21 local use 5 (local5)
22 local use 6 (local6)
23 local use 7 (local7 )
Version of the syslogFields block as “#.#” where # is a digit; see section 1 for the correct digits to use.
Syslog message
Hostname parsed from non-VES syslog message
0-192
Combined Severity and Facility (see rfc5424)
Identifies the application that originated the message
The process number assigned by the OS when the application was started
A <space> separated list of key=”value” pairs following the rfc5424 standard for SD-ELEMENT.
Deprecated
The entire rfc5424 syslogSData object, including square brackets [ ], SD-ID and list of SD-PARAMs
Level-of-severity text enumeration defined below:
Text Sev Description
Emergency 0 system is unusable
Alert 1 action must be taken immediately
Critical 2 critical conditions
Error 3 error conditions
Warning 4 warning conditions
Notice 5 normal but significant condition
Info 6 Informational messages
Debug 7 debug-level messages
Also known as MsgId. Brief non-spaced text indicating the type of message such as ‘TCPOUT’ or ‘BGP_STATUS_CHANGE’; ‘NILVALUE’ should be used when no other value can be provided
Timestamp parsed from non-VES syslog message
IANA assigned version of the syslog protocol specification:
0: VES
1: IANA RFC5424
The diskUsage datatype defines the usage of a disk device.
The number of bus resets in the performance interval.
Number of disk commands aborted over the measurementInterval.
Average number of commands per second over the measurementInterval.
Total flush requests of the disk cache over the measurementInterval.
Milliseconds spent on disk cache flushing over the measurementInterval.
Disk Identifier.
Milliseconds spent doing input/output operations over 1 sec; treat this metric as a device load percentage where 1000ms matches 100% load; provide the average over the measurement interval
Milliseconds spent doing input/output operations over 1 sec; treat this metric as a device load percentage where 1000ms matches 100% load; provide the last value measurement within the measurement interval.
Milliseconds spent doing input/output operations over 1 sec; treat this metric as a device load percentage where 1000ms matches 100% load; provide the maximum value measurement within the measurement interval
Milliseconds spent doing input/output operations over 1 sec; treat this metric as a device load percentage where 1000ms matches 100% load; provide the minimum value measurement within the measurement interval.
Number of logical read operations that were merged into physical read operations, e.g., two logical reads were served by one physical disk access; provide the average measurement within the measurement interval.
Number of logical read operations that were merged into physical read operations, e.g., two logical reads were served by one physical disk access; provide the last value measurement within the measurement interval.
Number of logical read operations that were merged into physical read operations, e.g., two logical reads were served by one physical disk access; provide the maximum value measurement within the measurement interval.
Number of logical read operations that were merged into physical read operations, e.g., two logical reads were served by one physical disk access; provide the minimum value measurement within the measurement interval.
Number of logical write operations that were merged into physical write operations, e.g., two logical writes were served by one physical disk access; provide the average measurement within the measurement interval
Number of logical write operations that were merged into physical write operations, e.g., two logical writes were served by one physical disk access; provide the last value measurement within the measurement interval.
Number of logical write operations that were merged into physical write operations, e.g., two logical writes were served by one physical disk access; provide the maximum value measurement within the measurement interval.
Number of logical write operations that were merged into physical write operations, e.g., two logical writes were served by one physical disk access; provide the minimum value measurement within the measurement interval.
Number of octets per second read from a disk or partition; provide the average measurement within the measurement interval.
Number of octets per second read from a disk or partition; provide the last measurement within the measurement interval
Number of octets per second read from a disk or partition; provide the maximum measurement within the measurement interval.
Number of octets per second read from a disk or partition; provide the minimum measurement within the measurement interval.
Number of octets per second written to a disk or partition; provide the average measurement within the measurement interval.
Number of octets per second written to a disk or partition; provide the last measurement within the measurement interval.
Number of octets per second written to a disk or partition; provide the maximum measurement within the measurement interval.
Number of octets per second written to a disk or partition; provide the minimum measurement within the measurement interval.
Number of read operations per second issued to the disk; provide the average measurement within the measurement interval.
Number of read operations per second issued to the disk; provide the last measurement within the measurement interval.
Number of read operations per second issued to the disk; provide the maximum measurement within the measurement interval.
Number of read operations per second issued to the disk; provide the minimum measurement within the measurement interval.
Number of write operations per second issued to the disk; provide the average measurement within the measurement interval.
Number of write operations per second issued to the disk; provide the last measurement within the measurement interval.
Number of write operations per second issued to the disk; provide the maximum measurement within the measurement interval.
Number of write operations per second issued to the disk; provide the minimum measurement within the measurement interval.
Queue size of pending I/O operations per second; provide the average measurement within the measurement interval.
Queue size of pending I/O operations per second; provide the last measurement within the measurement interval.
Queue size of pending I/O operations per second; provide the maximum measurement within the measurement interval.
diskPendingOperationsMin - Queue size of pending I/O operations per second; provide the minimum measurement within the measurement interval.
Average number of read commands issued per second to the disk over the measurementInterval.
Nanoseconds spent on disk cache reads/writes within the measurementInterval.
Milliseconds a read operation took to complete; provide the average measurement within the measurement interval.
Milliseconds a read operation took to complete; provide the last measurement within the measurement interval.
Milliseconds a read operation took to complete; provide the maximum measurement within the measurement interval.
Milliseconds a read operation took to complete; provide the minimum measurement within the measurement interval.
Milliseconds a write operation took to complete; provide the average measurement within the measurement interval.
Milliseconds a write operation took to complete; provide the last measurement within the measurement interval.
Milliseconds a write operation took to complete; provide the maximum measurement within the measurement interval.
Milliseconds a write operation took to complete; provide the minimum measurement within the measurement interval.
The average amount of time taken for a read from the perspective of a Guest OS. This is the sum of Kernel Read Latency and Physical Device Read Latency in milliseconds over the measurement interval.
The average amount of time taken for a write from the perspective of a Guest OS. This is the sum of Kernel Write Latency and Physical Device Write Latency in milliseconds over the measurement interval.
Measure in ms over 1 sec of both I/O completion time and the backlog that may be accumulating. Value is the average within the collection interval.
Measure in ms over 1 sec of both I/O completion time and the backlog that may be accumulating. Value is the last within the collection interval.
Measure in ms over 1 sec of both I/O completion time and the backlog that may be accumulating. Value is the maximum within the collection interval.
Measure in ms over 1 sec of both I/O completion time and the backlog that may be accumulating. Value is the minimum within the collection interval.
Average number of write commands issued per second to the disk over the measurementInterval
The codecsInUse datatype consists of the following fields describing the number of times an identified codec was used over the measurementInterval
Description of the codec.
Number of such codecs in use.
The thresholdCrossingAlertFields datatype consists of the following fields:
additionalFields - Additional pnfRegistration fields if needed.
Array of performance counters
Enumeration: ‘SET’, ‘CONT’, ‘CLEAR’
Unique short alert description (e.g., NE-CPUMEM)
Enumeration: ‘CARD-ANOMALY’, ‘INTERFACE-ANOMALY’, ELEMENT-ANOMALY’, ‘SERVICE-ANOMALY’
Calculated API value (if applicable)
List of eventIds associated with the event being reported
Time when the performance collector picked up the data; with RFC 2822 compliant format: ‘Sat, 13 Mar 2010 11:29:05 -0800’
Specific performance collector instance used
Type of network element (internal AT&T field)
Event severity or priority enumeration: ‘CRITICAL’, ‘MAJOR’, ‘MINOR’, ‘WARNING’, ‘NORMAL’
Time closest to when the measurement was made; with RFC 2822 compliant format: ‘Sat, 13 Mar 2010 11:29:05 -0800’
Physical or logical port or card (if applicable
Network name (internal AT&T field)
Reserved for future use
Version of the thresholdCrossingAlertFields block as “#.#” where # is a digit; see section 1 for the correct digits to use.
The voiceQuality class provides statistics related to customer facing voice products; consists of the following fields:
Additional voice quality fields
Callee codec for the call
Caller codec for the call
Constant across all events on this call
Phone number associated with the correlator
Base64 encoding of the binary RTCP data (excluding Eth/IP/UDP headers)
Version of the voiceQualityFields block as “#.#” where # is a digit; see section 1 for the correct digits to use.
End of call voice quality metric summaries
Vendor, NF and nfModule names
The cpuUsage datatype defines the usage of an identifier CPU and consists of the following fields:
The amount of time the CPU cannot run due to contention, in milliseconds over the measurementInterval
The total CPU time that the NF/NFC/VM could use if there was no contention, in milliseconds over the measurementInterval
CPU demand in MHz
CPU demand as a percentage of the provisioned capacity
CPU Identifier
Percentage of CPU time spent in the idle task
cpuDemandAvg - The total CPU time that the VNF/VNFC/VM could use if there is no contention, in milliseconds.
The overhead demand above available allocations and reservations, in milliseconds over the measurementInterval
Swap wait time, in milliseconds over the measurementInterval
Percentage of time spent servicing interrupts
Percentage of time spent running user space processes that have been niced
Percentage of time spent handling soft irq interrupts
Percentage of time spent in involuntary wait which is neither user, system or idle time and is effectively time that went missing
Percentage of time spent on system tasks running the kernel
Percentage of time spent running un-niced user space processes
Percentage of CPU time spent waiting for I/O operations to complete
Aggregate cpu usage of the virtual machine on which the xNFC reporting the event is running
The filesystemUsage datatype consists of the following fields:
Configured block storage capacity in GB.
Block storage input-output operations per second.
Used block storage capacity in GB.
Configured ephemeral storage capacity in GB.
Ephemeral storage input-output operations per second.
Used ephemeral storage capacity in GB.
File system name.
The hugePages datatype provides metrics on system hugePages
Number of free hugePages in bytes.
Number of used hugePages in bytes.
HugePages identifier
Number of free hugePages in percent.
Number of used hugePages in percent.
Number of free hugePages in numbers.
Number of used hugePages in numbers.
The ipmi (Intelligent Platform Management Interface) datatype provides intelligent platform management interface metrics; it consists of the following fields:
System fan exit air flow temperature in Celsius
Front panel temp in Celsius
Io module temp in Celsius
Airflow in cubic feet per minute (cfm)
Array of ipmiBaseboard Temperature objects
Array of ipmiBaseboard VoltageRegulator objects
Array of ipmiBattery objects
Array of ipmiFan objects
ipmi global aggregate temperature margin
Array of ipmiHsbp objects
Array of ipmiNic objects
Array of ipmiPowerSupply objects
Array of ipmiProcessor objects
The ipmiBaseboardTemperature datatype consists of the following fields which describe ipmi baseboard temperature metrics:
Field Type Required? Description
Baseboard temperature in celsius
Identifier for the location where the temperature is taken
The ipmiBaseboardVoltageRegulator datatype consists of the following fields which describe ipmi baseboard voltage regulator metrics:
Identifier for the baseboard voltage regulator
Voltage regulator temperature in celsius
The ipmiBattery datatype consists of the following fields which describe ipmi battery metrics:
Identifier for the battery
Type of battery
Battery voltage level
The ipmiFan datatype consists of the following fields which describe ipmi fan metrics:
Identifier for the fan
Fan speed in revolutions per minute (rpm)
The ipmiGlobalAggregateTemperatureMargin datatype consists of the following fields:
Temperature margin in Celsius relative to a throttling thermal trip point
Identifier for the ipmi global aggregate temperature margin metrics
The ipmiHsbp datatype provides ipmi hot swap backplane power metrics; it consists of the following fields:
Identifier for the hot swap backplane power unit
Hot swap backplane power temperature in celsius
The ipmiNic datatype provides network interface control care metrics; it consists of the following fields:
Identifier for the network interface control card
nic temperature in Celsius
The ipmiPowerSupply datatype provides ipmi power supply metrics; it consists of the following fields:
Current output voltage as a percentage of the design specified level
Identifier for the power supply
Input power in watts
Power supply temperature in Celsius
The ipmiProcessor datatype provides ipmi processor metrics
Io module temperatue in celsius
Front panel temperature in celsius
Array of processorDimmAggregate ThermalMargin objects
Identifier for the power supply
The latencyBucketMeasure datatype consists of the following fields which describe the number of counts falling within a defined latency bucket
Number of counts falling within a defined latency bucket
High end of bucket range (typically in ms)
Low end of bucket range (typically in ms)
The load datatype provides metrics on system cpu and io utilization obtained using /proc/loadavg
number of jobs in the run queue (state R, cpu utilization) or waiting for disk I/O (state D, io utilization) averaged over 15 minutes using /proc/loadavg
number of jobs in the run queue (state R, cpu utilization) or waiting for disk I/O (state D, io utilization) averaged over 5 minutes using /proc/loadavg
number of jobs in the run queue (state R, cpu utilization) or waiting for disk I/O (state D, io utilization) averaged over 1 minute using /proc/loadavg
The machineCheckException datatype describes machine check exceptions
Total hardware errors that were corrected by the hardware (e.g. data corruption corrected via ECC) over the measurementInterval. These errors do not require immediate software actions, but are still reported for accounting and predictive failure analysis
Total hardware errors that were corrected by the hardware over the last one hour
processIdentifier
Total uncorrected hardware errors that were detected by the hardware (e.g., causing data corruption) over the measurementInterval. These errors require a software response.
Total uncorrected hardware errors that were detected by the hardware over the last one hour
The memoryUsage datatype defines the memory usage of a virtual machine and consists of the following fields:
Kibibytes of temporary storage for raw disk blocks
Kibibytes of memory used for cache
Kibibytes of memory configured in the virtual machine on which the xNFC reporting the event is running
Host demand in kibibytes
Kibibytes of physical RAM left unused by the system
Percentage of time the VM is waiting to access swapped or compressed memory
Shared memory in kilobytes
The part of the slab that can be reclaimed such as caches measured in kibibytes
The part of the slab that cannot be reclaimed even when lacking memory measure in kibibytes
Amount of memory swapped-in from host cache in kibibytes
Rate at which memory is swapped from disk into active memory during the interval in kilobytes per second
Amount of memory swapped-out to host cache in kibibytes
Rate at which memory is being swapped from active memory to disk during the current interval in kilobytes per second
Space used for caching swapped pages in the host cache in kibibytes
Total memory minus the sum of free, buffered, cached and slab memory measured in kibibytes
Percentage of memory usage; value = (memoryUsed / (memoryUsed + memoryFree) x 100 if denomintor is nonzero, or 0, if otherwise.
Virtual Machine identifier associated with the memory metrics
The nicPerformance datatype consists of the following fields which describe the performance and errors of an of an identified virtual network interface card
Administrative state: enum: ‘inService’, ‘outOfService’
Network interface card identifier
Operational state: enum: ‘inService’, ‘outOfService’
Cumulative count of broadcast packets received as read at the end of the measurement interval
Count of broadcast packets received within the measurement interval
Cumulative count of discarded packets received as read at the end of the measurement interval
Count of discarded packets received within the measurement interval
Cumulative count of error packets received as read at the end of the measurement interval
Count of error packets received within the measurement interval
Cumulative count of multicast packets received as read at the end of the measurement interval
Count of multicast packets received within the measurement interval
Cumulative count of octets received as read at the end of the measurement interval
Count of octets received within the measurement interval
Percentage of discarded packets received; value = (receivedDiscardedPacketsDelta / receivedTotalPacketsDelta) x 100, if denominator is nonzero, or 0, if otherwise.
Percentage of error packets received; value = (receivedErrorPacketsDelta / receivedTotalPacketsDelta) x 100, if denominator is nonzero, or 0, if otherwise.
Cumulative count of all packets received as read at the end of the measurement interval
Count of all packets received within the measurement interval
Cumulative count of unicast packets received as read at the end of the measurement interval
Count of unicast packets received within the measurement interval
Percentage of utilization received; value = (receivedOctetsDelta / (speed x (lastEpochMicrosec - startEpochMicrosec))) x 100, if denominator is nonzero, or 0, if otherwise.
Speed configured in mbps.
Cumulative count of broadcast packets transmitted as read at the end of the measurement interval
Count of broadcast packets transmitted within the measurement interval
Cumulative count of discarded packets transmitted as read at the end of the measurement interval
Count of discarded packets transmitted within the measurement interval
Cumulative count of error packets transmitted as read at the end of the measurement interval
Count of error packets transmitted within the measurement interval
Cumulative count of multicast packets transmitted as read at the end of the measurement interval
Count of multicast packets transmitted within the measurement interval
Cumulative count of octets transmitted as read at the end of the measurement interval
Count of octets transmitted within the measurement interval
Percentage of discarded packets transmitted; value = (transmittedDiscardedPacketsDelta / transmittedTotalPacketsDelta) x 100, if denominator is nonzero, or 0, if otherwise.
Percentage of error packets received; value = (transmittedErrorPacketsDelta / transmittedTotalPacketsDelta) x 100, if denominator is nonzero, or 0, if otherwise.
Cumulative count of all packets transmitted as read at the end of the measurement interval
Count of all packets transmitted within the measurement interval
Cumulative count of unicast packets transmitted as read at the end of the measurement interval
Count of unicast packets transmitted within the measurement interval
Percentage of utilization transmitted; value = (transmittedOctetsDelta / (speed x (lastEpochMicrosec - startEpochMicrosec))) x 100, if denominator is nonzero, or 0, if otherwise.
Enumeration: ‘true’ or ‘false’. If ‘true’ then the vNicPerformance values are likely inaccurate due to counter overflow or other conditions.
The processorDimmAggregateThermalMargin datatype provides intelligent platform management interface (ipmi) processor dual inline memory module aggregate thermal margin metrics; it consists of the following fields:
identifier for the aggregate thermal margin metrics from the processor dual inline memory module
the difference between the DIMM's current temperature, in celsius, and the DIMM's throttling thermal trip point
The processStats datatype provides metrics on system processes; it consists of the following fields:
The number of threads created since the last reboot
processIdentifier
The number of processes in a blocked state
The number of processes in a paging state
The number of processes in a running state
The number of processes in a sleeping state
The number of processes in a stopped state
The number of processes in a zombie state
Average bit error rate
Average packet delay variation or jitter in milliseconds for received packets: Average difference between the packet timestamp and time received for all pairs of consecutive packets
Average delivery latency
Average receive throughput
Average transmit throughput
Duration of failed state in milliseconds, computed as the cumulative time between a failed echo request and the next following successful error request, over this reporting interval
Duration of errored state, computed as the cumulative time between a tunnel error indicator and the next following non-errored indicator, over this reporting interval
Endpoint activating the flow
Time the connection is activated in the flow (connection) being reported on, or transmission time of the first packet if activation time is not available
Integer microseconds for the start of the flow connection
Time the connection is activated in the flow being reported on, or transmission time of the first packet if activation time is not available; with RFC 2822 compliant format: ‘Sat, 13 Mar 2010 11:29:05 -0800’
Endpoint deactivating the flow
Time for the start of the flow connection, in integer UTC epoch time aka UNIX time
Integer microseconds for the start of the flow connection
Transmission time of the first packet in the flow connection being reported on; with RFC 2822 compliant format: ‘Sat, 13 Mar 2010 11:29:05 -0800’
Connection status at reporting time as a working / inactive / failed indicator value
Current connection state at reporting time
Current tunnel state at reporting time
Array of key: value pairs where the keys are drawn from the IP Type-of-Service identifiers which range from '0' to '255', and the values are the count of packets that had those ToS identifiers in the flow
Array of unique IP Type-of-Service values observed in the flow where values range from '0' to '255'
large packet round trip time
large packet threshold being applied
Maximum packet delay variation or jitter in milliseconds for received packets: Maximum of the difference between the packet timestamp and time received for all pairs of consecutive packets
maximum receive bit rate"
maximum transmit bit rate
array of key: value pairs where the keys are drawn from LTE QCI or UMTS class of service strings, and the values are the count of packets that had those strings in the flow
Array of unique LTE QCI or UMTS class-of-service values observed in the flow
Number of failed activation requests, as observed by the reporting node
number of errored bits
number of bytes received, including retransmissions
number of bytes transmitted, including retransmissions
number of received packets dropped due to errors per virtual interface
Number of Echo request path failures where failed paths are defined in 3GPP TS 29.281 sec 7.2.1 and 3GPP TS 29.060 sec. 11.2
Number of tunnel error indications where errors are defined in 3GPP TS 29.281 sec 7.3.1 and 3GPP TS 29.060 sec. 11.1
Http error count
number of tunneled layer 7 bytes received, including retransmissions
number of tunneled layer 7 bytes received, including retransmissions
number of tunneled layer 7 bytes received, including retransmissions
number of out-of-order packets
number of errored packets
number of packets received, excluding retransmission
number of packets received, including retransmission
number of packets transmitted, including retransmissions
number of packet retrie
number of packet timeouts
number of tunneled layer 7 bytes received, excluding retransmissions
Round Trip time
Array of key: value pairs where the keys are drawn from TCP Flags and the values are the count of packets that had that TCP Flag in the flow
Array of unique TCP Flags observed in the flow
Time in milliseconds between the connection activation and first byte received
Adjacency name
Endpoint average jitter
Enumeration: ‘Caller’, ‘Callee’
Endpoint maximum jitter
Endpoint RTP octets discarded
Endpoint RTP octets lost
Endpoint RTP octets received
Endpoint RTP octets sent
Endpoint RTP packets discarded
Endpoint RTP packets lost
Endpoint RTP packets received
Endpoint RTP packets sent
Local average jitter
Local average jitter buffer delay
Local maximum jitter
Local max jitter buffer delay
Local RTP octets discarded
Local RTP octets lost
Local RTP octets received
Local RTP octets sent
Local RTP packets discarded
Local RTP packets lost
Local RTP packets received
Local RTP packets sent
Decimal range from 1 to 5 (1 decimal place)
one-way path delay in milliseconds
Calculated percentage packet loss based on endpoint RTP packets lost (as reported in RTCP) and local RTP packets sent. Direction is based on endpoint description (Caller, Callee). Decimal (2 decimal places)
rFactor from 0 to 100
Round trip delay in milliseconds
vendorNfNameFields - The vendorNfNameFields provides vendor, nf and nfModule identifying information.
nfModuleName - Name of the nfModule generating the event.
nfName - Name of the network function generating the event
vendorName - Network function vendor name.
Additional key-value pairs if needed
Version of the perf3gpp event
3GPP measurement collection structure
The measDataCollection datatype defines a 3GPP measurement collection structure aligned with the 3GPP PM format
3GPP PM reporting file format version from pre-standard TS 28.550 v2.0.0
Granularity period for the PM report in seconds
Array of monitored object local distinguished name ids per 3GPP TS 32.300
Distinguished name per 3GPP TS 28.550
Software version for the NF providing the PM data as specified in 3GPP TS 28.550
User Definable name for the measured object per 3GPP TS 28.550
Array of monitored object local distinguished name ids per 3GPP TS 32.300
Name of the measurement job
Measurement group Identifier
Measurement group Identifier
Array of measurement identifiers associated with the measurement results expressed as integers for efficiency rather than strings
Array of measurement identifiers associated with the measurement results expressed as integers for efficiency rather than strings
Array of measValues
The measInfoIdInteger datatype provides an integer measurement group identifier;
Integer measurement group Identifier
The measInfoIdString datatype provides a string measurement group identifier;
String measurement group Identifier
The measTypesInteger datatype provides an array of integer measurement identifiers associated with the measurement results
Array of integer measurement identifiers associated with the measurement results
The measTypesString datatype provides an array of string measurement identifiers associated with the measurement results
Array of string measurement identifiers associated with the measurement results
The measValues datatype provides 3GPP measurement values
Additional key-value pairs if needed
Enumeration: ‘true’, ‘false’. Indicates if the values are suspect
VES 7.1 Spec has this attribute as a string.
Array of results
Array of results
Array of results
Array of results
The measResultInteger datatype provides an integer 3GPP PM measurement result;
Integer reference to the counter
Integer counter value
The measResultNull datatype provides a null 3GPP PM measurement result
Integer reference to the counter
Enumeration: ‘true’ or ‘false’
The VES 7.1 Spec has this attribute as a string.
The measResultNumber datatype provides a number 3GPP PM measurement result
Integer reference to the counter
Number counter value
The measResultString datatype provides a string 3GPP PM measurement result;
Integer reference to the counter
String counter value
The hashMap datatype is an ‘associative array’, which is an unordered collection of key-value pairs of the form “key”: “value”, where each key and value are strings. Keys must use camel casing to separate words and acronyms; only the first letter of each acronym shall be capitalized.
A given entry in the hashmap, which is a key/value pair.
Event severity enumeration: ‘CRITICAL’, ‘MAJOR’, ‘MINOR’, ‘WARNING’, ‘NORMAL’. NORMAL is used to represent clear.
Virtual function status enumeration: ‘Active’, ‘Idle’, ‘Preparing to terminate’, ‘Ready to terminate’, ‘Requesting Termination’
Array of named hashMaps
Array of named hashMaps
SchemaObject - The SchemaObject datatype provides an object schema, name and other meta-information along with one or more object instances that conform to the schema.
Note: The VES Spec has this as a Json based object.
objectInstances - Contains one or more instances of the SchemaObjectInstance object.
objectName - Name of the object.
objectSchema - schema for the object.
objectSchemaUrl - URL to the schema for the object.
nfSubscribedObjectName - Name of the object associated with the nfSubscriptionId.
nfSubscriptionId - Identifies an OpenConfig telemetry subscription on a network function, which configures the network function to send complex object data associated with the SchemaObject.
SchemaObjectInstance [ ] - The SchemabjectInstance datatype provides meta-information about an instance of a SchemaObject along with the actual object instance.
Note: The VES Spec has this as a Json based object.
SchemaObject - Optional recursive specification on SchemaObject
objectInstance - Contains an instance conforming to the SchemaObject schema
objectInstanceEpochMicrosec - the unix time, aka epoch time, associated with this objectInstance--as microseconds elapsed since 1 Jan 1970 not including leap seconds.
objectKeys - An ordered set of keys that identifies this particular instance of SchemaObject (e.g., that places it in a hierarchy).
domain - Event domain enumeration:
‘fault’, ‘heartbeat’, ‘measurementsForVfScaling’, ‘mobileFlow’, ‘other’, ‘sipSignaling’, ‘stateChange’, ‘syslog’, ‘thresholdCrossingAlert’, ‘voiceQuality’
Enumeration: ‘CRIT’, ‘MAJ’
Key is the name of the counter and value is the current value of the counter
Last threshold that was crossed
arrayOfSchemaObject - The arrayOfSchemaObject datatype provides an array of json objects, each of which is described by name, schema and other meta-information.
Note: The VES Spec has this as a Json based object.
arrayOfSchemaObject - arrayOfSchemaObject datatype provides an array of SchemaObjects, each of which is described by name, schema and other meta-information.
Possible alertActions within thresholdCrossingAlertFields
Possible values for ThresholdCrossingAlertFIelds alertType attribute.
namedHashMap [ ] - The namedHashmap datatype is a hashMap which is associated with and described by a name.
name - Name for the array of name-value pairs.
hashMap - One or more key:value pairs.
Note: in ATTServiceSpecification - VesEventListener v5.4.1 type = field [].
Level-of-severity text enumeration defined below:
Text Sev Description
Emergency 0 system is unusable
Alert 1 action must be taken immediately
Critical 2 critical conditions
Error 3 error conditions
Warning 4 warning conditions
Notice 5 normal but significant condition
Info 6 Informational messages
Debug 7 debug-level messages
system is unusable
0
action must be taken immediately
1
critical conditions
2
error conditions
3
warning conditions
4
normal but significant condition
5
Informational messages
6
debug-level messages
7
Numeric code from 0 to 23 for facility:
0 kernel messages
1 user-level messages
2 mail system
3 system daemons
4 security/authorization messages
5 messages generated internally by syslogd
6 line printer subsystem
7 network news subsystem
8 UUCP subsystem
9 clock daemon
10 security/authorization messages
11 FTP daemon
12 NTP subsystem
13 log audit
14 log alert
15 clock daemon (note 2)
16 local use 0 (local0)
17 local use 1 (local1)
18 local use 2 (local2)
19 local use 3 (local3)
20 local use 4 (local4)
21 local use 5 (local5)
22 local use 6 (local6)
23 local use 7 (local7
kernel messages
user-level messages
mail system
system daemons
security/authorization messages
messages generated internally by syslogd
line printer subsystem
network news subsystem
UUCP subsystem
clock daemon
security/authorization messages
FTP daemon
NTP subsystem
log audit
log alert
clock daemon
local use 0 (local0)
local use 1 (local1)
local use 2 (local2)
local use 3 (local3)
local use 4 (local4)
local use 5 (local5)
local use 6 (local6)
local use 7 (local7 )
Threshold Crossing Alert counter criticality - possible values of CRIT and MAJ.