A comparison of syslog and IS-IS for network failure analysis

Daniel Turner, Kirill Levchenko, Stefan Savage, Alex C. Snoeren

Research output: Chapter in Book/Report/Conference proceedingConference contribution


Accurate reporting and analysis of network failures has historically required instrumentation (e.g., dedicated tracing of routing protocol state) that is rarely available in practice. In previous work, our group has proposed that a combination of common data sources could be substituted instead. In particular, by opportunistically stitching together data from router configuration logs and syslog messages, we demonstrated that a granular picture of network failures could be resolved and verified with human trouble tickets. In this paper, we more fully evaluate the fidelity of this approach, by comparing with high-quality "ground truth" data derived from an analysis of contemporaneous IS-IS routing protocol messages. We identify areas of agreement and disparity between these data sources, as well as potential ways to correct disparities when possible.

Original languageEnglish (US)
Title of host publicationIMC 2013 - Proceedings of the 13th ACM Internet Measurement Conference
Number of pages7
StatePublished - 2013
Externally publishedYes
Event13th ACM Internet Measurement Conference, IMC 2013 - Barcelona, Spain
Duration: Oct 23 2013Oct 25 2013

Publication series

NameProceedings of the ACM SIGCOMM Internet Measurement Conference, IMC


Other13th ACM Internet Measurement Conference, IMC 2013


  • IS-IS
  • Measurement
  • Reliability
  • Syslog

ASJC Scopus subject areas

  • Software
  • Computer Networks and Communications


Dive into the research topics of 'A comparison of syslog and IS-IS for network failure analysis'. Together they form a unique fingerprint.

Cite this