Argus - Alarm Aggregation and Correlation Tool
ARGUS is a tool for network element and measurement system alarm correlation. It is tailored for the Campus Network Management as a Service (CNaaS) use case in which an NREN monitors and manages multiple campus networks. With ARGUS, an NREN can track all the alarms coming from multiple campuses and can also find if there are any correlated events. The ARGUS tool was developed by the Norwegian NREN SIKT (formerly UNINETT) and is currently used in production in SIKT and SUNET, while DeIC is in the process of evaluating the system for their internal use.
ARGUS was presented at the Infoshare "Offering Campus Network Management as a Service: Challenges and Lessons Learnt" (October 2020), the Workshop on Network Monitoring and Management Tools (March 2021), the GÉANT Infoshare "Tools for Campus Network Management as a Service (CNaaS) (April 2021)", the 14th SIG-NOC meeting (June 2021) and the 25th STF meeting (February 2022).
Argus is a tool for NOCs and service centers to aggregate incidents from all their monitoring applications into a single, unified dashboard and notification system. Most NOCs will, out of necessity, use a myriad of applications to monitor their infrastructure and services. In turn, they need to contend with manually managing notification profiles and monitoring dashboards in each individual application. Argus mitigates these scenarios by providing the NOC with a singular overview of actionable incidents, and by providing a single point of notification configuration. Argus is agnostic of the details of each monitoring application, but instead provides a REST API to report new incidents, and to search, fetch or update the status of already registered incidents. Glue services for several source applications already exist, and more can be easily written using the documented API and/or existing API client libraries for Python. Incidents are associated with a source application and can be tagged with arbitrary metadata from the source application, including URLs to drill down into incident details in the source application. Metadata can be used to make arbitrary incident filters, which can be applied both in the dashboard UI and in notification profiles. Mechanisms also exist to add acknowledgements to incidents, and to link incidents with tickets in the NOC’s ticketing application. The data model even supports registering inter-relationships between incidents. Notifications via e-mail and SMS are supported, while more mediums are planned (such as Slack and Microsoft Teams).
Argus has been proven useful in providing a distinct interface between individual product teams and the organization’s NOC when it comes to defining which monitoring alerts should be handled by the NOC, and which ones the product teams will handle themselves.
