SystemfortheManagementofaNationalData SystemArchitectureofaDistributedExpert??IoannisVlahavas1,NickBassiliades1,IliasSakellariou1,MartinMolina2, Network? 1DepartmentofInformatics,AristotleUniversityofThessaloniki,54006Thessaloniki SaschaOssowski2,IvanFuto3,ZoltanPasztor3,JanosSzeredi3,Igor Velbitskiy4,SergeyYershov4,SergeyGolub4,andIgorNetesin4 2DepartmentofArticialIntelligence,TechnicalUniversityofMadrid,28660 fvlahavas,nbassili,iliassg@csd.auth.gr fmmolina,ossowskig@isys.dia.fi.upm.es BoadilladelMonte,Madrid,Spain. Greece 3MLConsultingandComputingLtd,MLKft,H-1011Budapest,Gyorskocsiu.5-7., 4InternationalSoftwareTechnologyResearchCenterTechnosoft,44Glushkov fvel,yershov,golub,netesing@netman.ts.kiev.ua avenue,kiev,252187,ukraine. ffuto,szeredig@ml-cons.hu Hungary. Abstract.Themanagementoflargedatanetworks,likeanational tobeaverypromisingapproachforthedevelopmentofsuchtools.this WAN,iswithoutanydoubtacomplextask.Takingintoaccountthe constantlyincreasingsizeandcomplexityoftoday'stcp/ipbasednetworks,itbecomesobviousthatthereisademandingneedforbetterthan simplemonitoringmanagementtools.expertsystemtechnologyseems paperdescribesthesystemarchitectureofexpernet,adistributedexpertsystemforthemanagementofthenationalcomputernetworkof Ukraine,andtheimplementationofthetoolsusedforitsdevelopment. ExperNetisamultiagentsystembuiltinDEVICE,anactiveOODB enhancedwithhighlevelrules,thatusescs-prologiitoimplementthe communicationfacilitiesrequired.thesystememployshnms+andbig- Brother,twomodiedversionsofexistingnetworkmanagementtools,in tributedprolog. keywords:distributedexpertsystems,agents,networkmanagement,dis- ordertoobtainacompleteviewofthemonitorednetwork.??theorderinwhichtheauthorsappeardoesnotreecttheircontributiontothework?theworkdescribedinthispaperisfundedbytheeuinco-copernicusproject No960114 ExperNet:ADistributedExpertSystemfortheManagementofaNationalNetwork, describedinthispaper.
1Introduction TheexploitationofalargeWANcannotbeeectivelyachievedwithoutauserfriendlyandintelligentnetworkmanagementsoftware.Existingnetworkmanagementsoftwarecannotmeettherequirementsofsuchlarge-scalenetworks,mainly becauseitoers,inmostcases,onlymonitoringtools.oneofthemostimportantdirectionsforthepracticalapplicationofnetworkmanagementsoftware,is itsenhancementwithhigherleveldecisionsupportanddiagnosticservices. project.thedevelopmentofexpertsystemsforwanmanagementisonlyat researchandexperimentalstage.therearedicultiesintheformalizationof suchataskbecauseoftheincompletenessandlackofadequateinformationabout NetworkofUkraine,developedintheframeworkofajointEUfundedresearch ExperNetisadistributedexpertsystemforthemanagementoftheNational networkstate,thelargescaleofbehaviourcharacteristics,andthecontinuous evolutionofthenetworkenvironment.theabsenceofpracticalandveried expertsystemsforlarge,complexmoderntechnologicalsystemslikewans, demonstratesthecomplexityofthetaskandposeagreatchallengeahead. newgeneralconictdetectionandconictresolutionmechanisms,seemtoprovideafeasiblebutalsoanelegantsolutiontothewannetworkmanagement problem.suchadistributedexpertsystem,requiresansucientcommunicationfacilitiesandanecientexpertsystemshellthatisabletocopewithlarge Distributedexpertsystemsusingco-operativeproblemsolvingstrategieswith ofdeterminingthenetworkstateandcapturingimportantnetworkevents,in otherwordsanecientmonitoringschema.theimplementationofsuchafunctionalityhastobeinaccordancewiththeexistingnetworkmonitoringfacilities, namelyithastoadopttothesimplenetworkmanagementprotocol(snmp) inordertohavecontrolovertheexistingnetworkdevices. amountsofdataandoermultipleknowledgerepresentations.anotherimportantpointinthedesignofthesystemisthattheremustbeanecientway requirements,andpresentsthesystemcomponents. 2TheExperNetSystemArchitecture ThispaperdescribestheExperNetsystemarchitecture,thatfullstheabove AsthenetworkmanagementproblemoftheExperNetprojecthasturnedoutto beinherentlydistributed,weconceivetheexpernetarchitectureasmultiagent system.ateachmanagementnodethereisoneagent,specialisedinmanaging thenetworkareathatthenodeisresponsiblefor.inconsequence,thestructure ofthesystemarchitecturegoesinlinewiththestructureofthepre-existing monitoringlocalcomputerresources.theagentsaredevelopedindevice,and server;thelatterprovidesnecessaryinformationaboutthestateofthenetwork totheformer.additionalinformationisprovidedbybigbrother,atoolfor organisationoftheexperimentalzoneofthenetwork.theoverallarchitectureof communicationfacilitiesareprovidedbycs-prologii.allsystemcomponents, thesystemisshownatgure1.eachexpernetagentisattachedtoanhnms+ showninthegure,aredescribedintherestofthepaper.
0DQDJHPHQW1RGH +106 6HUYHU ([SHU1HW$JHQW 'HYLFH &63,,.QRZOHGJH %DVH,2 0RGXOH,2 0RGXOH '% PRGXOH +106 6HUYHU '% PRGXOH 6103 GHYLFH 6103 GHYLFH 6103 GHYLFH,2 0RGXOH 6103 GHYLFH ([SHU1HW$JHQW ([SHU1HW$JHQW %LJ%URWKHU 6103&RQQHFWLRQ +103&RQQHFWLRQ Fig.1.ExperNetSystemArchitecture Eachagentcomprisestwotypesofknowledge:localknowledgeforindividual problem-solving(i.e.forlocalnetworkmanagement)andsocialknowledgeforcoordination(i.e.forharmonisinglocalnetworkmanagementwiththeactivitiesof acquaintancenodes). 2.1LocalProblem-solving Inordertocharacterisetheknowledgemodelofeachagentwehaveappliedadvancedknowledgeengineeringtechniques.Theparticularcharacteristicsofthe domainofnetworkmanagementincludecomplexproblem-solvingtasks(classi- cation,diagnosis,planning,etc.)whichsuggeststousetheconceptofmodelbasedsystemdevelopment,thathasrecentlybecomepopularamongresearchers andknowledgeengineers,forthedevelopmentoflargeandcomplexknowledgebasedsystems.forinstance,somerecentmethodologiesandtoolssuchaskads [17],KSM[10],Protege-II[15],followthismodel-basedapproach.Accordingto this,wehavemodelledtheagents'problem-solvingcompetenceasathreestep process:(1)symptomdetection,whereadministratorswatchoutforsymptomsof undesirednetworkstatesandbehaviours(e.g.acertainservice-ftp,www,etc.- doesnotrespond,ahostisunreachable,over/under-utilisationoflinksorequipment,etc.);(2)diagnosis,whichisdonebydiscriminatinghypothesisofdierent degreesofprecisiononthebasisofnetworkdataandtheresultofexploratory
actionstondthecausesofsymptoms(e.g.inadequatecapacityforsomeresource,unbalanceofworkloadandresources,resourcemalfunctions,etc.)and (3)repair,whereasequenceofrepairactionsisproposedtosolvetheproblem. 0DQDJH1HWZRUN 'LDJQRVHDQG 5HSDLU $EVWUDFW 0DWFK 5HILQH +LSRWKHVLV 5HILQH 6HOHFW %HVW $FTXLUH 2EVHUY 6HOHFW 6SHFLDOLVW 'HWHUPLQH $SSOLFDE 3URSRVH 3ODQ 'HFRPSRVH 3ODQ &RPSRVH 3ODQ 'HWHFW 'LDJQRVH 5HSDLU +HXULVWLF &ODVVLILFDWLRQ (VWDEOLVK 5HILQH +LHUDUFKLFDO 3ODQQLQJ 3URSRVH 3DUWLDO3ODQ +LHUDUFKLFDO 3ODQQLQJ 3ODQ 6WUXFWXUH 5HILQHPHQW +HXULVWLF 3ODQV $SSOLFDE &RQGLWLRQV 3ODQ 6WUXFWXUH $FTXLVLWLRQ 0HWKRGV +\SRWKHVLV 9DOLGLW\ +\SRWKHVLV 7D[RQRP\ 1HWZRUN 0RGHO 3UREOHP 6FHQDU 1HWZRUN 0RGHO Fig.2.LocalProblemSolving Eachstepisrealisedbycustomisinggenericknowledgemodellingmethods [17].Theheuristicclassicationproblem-solvingmethod[8]constitutesatypical reasoningstructureforclassicationproblemsandisusedforsymptomdetection.itfollowsthreesteps(abstraction,matchingandrenement)which,inour model,aresupportedbytwotypesofknowledgebases:oneaboutthenetwork modelforabstractionandrenement,thatincludesadeclarativerepresentation ofthenetworkstructure,andanotherthatusesasetofproblemscenariosrelatingsymptomsandobservables.fordiagnosis,theestablishandrenemethodis used[7].thismethodcanbeconceivedasanabstractreasoningpatternbased onaheuristicsearchinataxonomyofhypothesesofproblems.ourparticular adaptationoftheestablishandrenemethodmakesuseofthreeprimitiveinferences:(1)reneproblemhypothesesusesaknowledgebaserepresentedbya taxonomyofhypothesisclassesusingtheis-arelation;(2)selectbesthypothesismakesuseofknowledgeaboutthevalidityofhypotheses(representedusing
acquireadditionalobservablesdeterminesthesequenceofexploratoryactionsto frames)toestablishwhetheranyoftheinputhypothesiscanbeproved,and(3) getadditionalobservablesbyusingaknowledgebaseaboutacquisitionmethods(representedbyrules).finally,thehierarchicalplanningmethodisusedfor planningmethodthatweuseinthenetworkmanagementdomain,makesuseof fourspecialists(toplevel,faultdetection,performancemanagementandconguration)andusesveprimitiveinferencessupportedbyfourtypesofknowledgiststhatareknowledgeableaboutpartialabstractplans,whicharedynamically composedduringthereasoning[5].theparticularinstanceofthehierarchical bases. 2.2SocialCo-ordination therepairtask.thismethodisbasedonasearchinahierarchyofspecial- acquisition,whenadditionalobservationsareneeded,whichareavailable(or caseofexpernet,threetypesofsituationsrequireco-ordination:(1)information canbeacquired)withintheagentsociety,butarenotaccessible(orcannotbe solving,butinco-ordinatingitsworkwithotheradministrators.intheparticular Animportantpartofanodeadministrator'stimeisnotspentinlocalproblem- acquired)bythenodeitself.(2)responsibilityconicts,whendierentagents intendtoperformsimilartasks.(3)interestconicts,whenoneagentdoesnot agreewithitsroleinacertainrepairplanorwiththeeectsthatsomeplanwill haveonitslocalsituation. tions[1],i.e.logicallycoherentsequencesofagentinteractions.conversations thatcopewithresponsibilityconictsareverysimple,astheyjustinvolveone receiver.weproposethreekindsofconversationsofthistype:diagnosisand interaction,transferringtheresponsibilityforsometaskfromthesendertothe Wemodeltheprocessofco-ordinationintheabovesituationsasconversasitionproblemsaremanagedbymeansoftheobservableacquisitionandtheplan repairdelegation,repairdelegationandisolationdelegation.informationacqui- renementconversations,inthecourseofwhichaneedyagentaskssometargetagentforacertainobservableorplan;thelattermayeitherreplywiththis informationorbynotifyingitsinability(orunwillingness)tofacilitateit.plan acceptanceconversationsmanageinterestconicts,whereallaectedagentsneed toagreeinorderthataproposedplanbeaccepted. networkmanagementmodelaswellastheirintendedeectonthereceiver. thereceiver[14].thetable1resumesthedierentmessagesthatareusedinthe Everymessagethatisexchangedduringsuchinteractionscanbeconsideredas SpeechActs,asbyemittingitthesenderwantstoinuencethebehaviourof Interactionswithinaconversationarebasedonamessage-passingmodel. andexperiencewithothernodesinthenetwork.itthusmaintainsagentmodels agents,astheyusuallymaychoosefromseveralbehaviouroptions(inthesimplestcasetoacceptortorejectarequest).anagent'schoiceisnotjustdeterminedbyinformationrespectingitslocalsituation,butalsobyitsknowledge Withinconversationstherearevariousdegreesoffreedomfortheinvolved
MessagetypesTable1.TypesofMessagesandInteractions ASKFORplanrenements ASKFORplanacceptance ASKFORobservable decidesaboutacceptance&informssender acquiresobservable&informssender Receiver'sintendedreaction ANSWERWITHobservable DOdiagnosisandrepair DOisolation DOrepair performsdiagnosisandrepairtasks renesplan&informssender ANSWERWITHplanacceptance ANSWERWITHplanrenements informsaboutplanrenements informsaboutplanacceptance performsproblemisolation informsaboutobservable performsrepairtask quaintancesthatitinteractswithincludingitself[11].thesemodelsendowthe agentacquireswithadditionalcapabilities:(1)probleminterest:checkswhether (thistypeofknowledgeisalsoreferedtoas"acquaintancemodel"[9])ofallac- involvedinitorbecauseitsside-eectsconcernthemodelledagent);(3)plan themodelledagentisbelievedtointerestedinbeingnotiedaboutaproblem rights:checkswhetherthereisaneedtoobtaintheagreementofthemodelled ordertokeepitseectsaslocalaspossible);(2)planinterest:checkswhether themodelledagentneedstobenotiedaboutagivenplan(eitherbecauseitis (e.g.becauseitisindirectlyaectedbythatproblemandwantstoisolateitin servable;(5)diagnosiscapability,determinesifthemodelledagentiscapable modelledagentisbelievedtobycapableofacquiringthevalueofagivenob- ofperformingdiagnosisforagivensymptom;(6)planrepaircapability,checks agentforenactingagivenplan;(4)observationcapability,checkswhetherthe problem. bility,analyseswhethertheagentmayreneagivenabstractplanforagiven whetheritcanelaborateaplanforagivenproblem;(7)planrenementcapa- agents. extended,leadingtothecontrolloopshowningure3,followedbyexpernet Onthisbasis,thethreesteplocalproblem-solvingcycleofanagentcanbe 1.Detectsymptoms. 2.Informagentsinterestedinthesymptoms,inordertodiagnosethem. 3.Diagnoseproblem(iftheagentisresponsible).Iftherearemissingobservables, 4.Informagentsinterestedinproblems,inordertoisolatethem. 5.Informagentsinterestedinproblems,inordertorepairthem. 6.Generatearepairplan(iftheagentisresponsible).Ifnecessary,asksagentsfor askagentsforacquiringthecorrespondingvalue. Fig.3.Structureofthemethodfollowedbyanagenttomanagethenetwork. planacceptance
3TheDeviceExpertSystemShell Fortheimplementationoftheknowledgemodel,theDEVICE[2,3]expertsystemshellisselected,sinceitpresentsanumberofinterestingfeatures,likemultipleruletypesupportandObjectOrientation.DEVICE(Data-driven&EVentdrivenruleIntegrationusingComplexEvents)isasequentialKnowledgeBased SystemthatrunsontopofADAMandEXACT.TheformerisanOODBbuilt inprolog,whilethelatterisanextensionofadamwitheventsandecarules (Figure4).DEVICEisinfact,anactiveOODBenhancedwithhigh-levelrule facilities.itprovidestheinfrastructureforthesmoothintegrationofproduction anddeductiverulesintoanactiveoodbthatgenericallysupportsevent-driven rulesonly.theintegrationisbasedonthecompilationoftheconditionofboth high-levelruletypesintoadiscriminationnetworkthatconsistsofsimpleand complexeventswhichrecordandcombinedatabasemodicationsthatcould possiblymakearulere. HYHQWPDQDJHU UXOH VFKHGXOLQJ UXOHPDQDJHU SDUVHU SUHFRPSLOHU RSWLPL]HU FRPSLOHU QRQPDWHULDOLVHG GHGXFWLYHUXOH PDQDJHU GHGXFWLYHUXOH PDQDJHU SURGXFWLRQ UXOHPDQDJHU FRPSOH[HYHQW QHWZRUN HYHQWREMHFW FUHDWLRQ FKHFNLQJ RFFXUUHQFH UXOHWUHH UXOHFUHDWLRQ XSGDWHV XSGDWHV ILULQJUXOH DFWLRQ LQKHULWV LQKHULWV LQKHULWV $'$0 FRPPDQGV 3URORJ $'$0 (;$& 7 '(9,&( 8VHU UXOHREMHFW FUHDWLRQ 22'% FODVVHV 3URORJ PRGXOHV Fig.4.ThearchitectureoftheDEVICEsystem. ArulebaseinDEVICE,canbeamixtureofECA,productionanddeductive rules.thetwolatterarehigh-levelrules,whoseintegrationintotheactiveoodb hasbeensmoothlyachievedindevice.backwardchainingorgoal-drivenrules arealsosupportedindeviceintheformofmethods.methodsarepiecesof Prologcode,thereforeabackwardchainingdeclarativelanguageisprovided.For theecientmatchingoftheproductionrules,devicesmoothlyintegratesa RETE-likediscriminationnetworkintoanactiveOODBsystemasasetofrst classobjectsbymappingeachnodeofthenetworkontoacomplexeventobjectof theactivedatabasesystem.inordertobringthefullfunctionalityofproduction systemsintoanactivedatabasesystem,heuristicconictresolutionstrategies
(OPS5approach),namelyrefractoriness,recencyandspecicity,havebeenincorporatedintotheruleselectionmechanismsoftheintegratedenvironment. TheproductioncycleofDEVICEispresentedingure5. USER Data modifications Active OODB meta-classes objects classes Discrimination Network Event signalling Event Manager complex events Rule matching Rule Selection Rule Manager Conflict set Theresultingsystemisaexible,yetecient,KBSthatgivestheuserthe Fig.5.TheproductioncycleofDEVICE. Action execution DEVICE abilitytoexpressknowledgeinavarietyofhigh-levelformsforadvancedproblem solvingindataintensiveapplications. adopttoexistingrepresentationsofnetworkmanagementinformation,suchas here,thattheooarchitectureanddatatypessupportedbydevicenaturally thedevelopmentoftheexpernetsystem,sincetheinformationinanywan concerningthestatusofthevariousnetworkdevicesislarge.ithastobenoted TheabilityofDEVICEtohandlelargecollectionsofdataisimportantfor DEVICEobjects.FortheneedsofExperNet,DEVICEhasbeenimplemented MIBandHNMS+MIB,providinganeasymappingofnetworkvariablesto incs-prolog-ii,alanguagewhich,amongothers,oersextendedcommunication facilities.thelatter,inconjunctionwiththeabilityofintegratingprologcode withproductionrulesinasimple,clearandrobustmanner,oersanexpert
4TheCS-PrologIISystem systemshellinwhichcommunicationcanbeeasilyimplemented,thusoeringa powerfulplatformforthedevelopmentofanyagentbasedsystem. Inthedevelopmentofanymultiagentsystem,acrucialissueistheimplementationofthecommunicationfacilitiesthatarerequiredfortheco-operationand co-ordinationoftheinvolvedagents.inexpernetthesefacilitiesaredeveloped usingcs-prologiiadistributedprologenhancedwithnetworkingfacilities. 4.1Generaloverview CS-PrologIIdistributedPrologsystemisbeingdevelopedfrom1995.Thesyntax andthebuilt-inproceduresofthelanguagearebasedonthestandardiso/iec rentprocessesarecontrolledbyatime-sharingscheduler.theinter-processcom- municationisensuredbyarendezvousmechanism(synchronousmessagepassing methodologyinaprologenvironment.onasingleprocessormachinetheconcur- modularity,multitasking,real-timeprogrammingandnetworkcommunication. 13211-1.Itisextendedwithfeaturesthatwerenotincludedinthestandard,like throughcommunicationchannels).processescanbacktrack,howevercommunicationisnotbacktrackable.thechannelbasedcommunicationhadrecentlybeen CS-PrologII,supportsthecommunicatingsequentialprocessprogramming providescommunicationwithforeign(noncs-prolog)applications,aninterfacetorelationaldatabasesystems,realtimeprogrammingmethodslikecyclic extendedwithnetworkingcapabilities.thismakespossiblemessagepassingbetweendierentcs-prologiiapplicationsacrosstheinternet.cs-prologiialso behaviour,reactiontopredenedevents,timedinterrupts,etc. runtimesystem.thecompilercontainsapre-processorsimilartowhatisfound inccompilers.theintegrateddevelopmentenvironmentisbasedonosf/motif andrunsonunixplatforms.themainadvantageofthisenvironmentisthe multi-windowtraceutilityinwhichthedebuggingmessagesofseparateprocesses Thesystemconsistsofthreemaincomponents:acompiler,alinkeranda appearinseparatewindows. nicationconceptuallyconsistsofunidirectionalmessagestreams.inorderto facilitatespeed-upofexternalcommunication,asynchronousmessagepassingis AsanaturalextensionofCS-PrologIIchannelconcept,theexternalcommu- 4.2Networkingfacilities theconditionforcontinuingexecutionistheavailabilityofsucientbuerspace introducedasanoption.sendoperationinthiscasestillremainsblockingbut insteadofthecommencementofthematchingreceiveoperation. homogenousaddressspace(community).allpartnerswillbeaccessedviachannelmessages.aseparatemechanismisintroducedforconnectingchannelsto ForthePrologprogrammerthecommunicationenvironmentappearsasa
externalpartners.themostimportantentityforthistaskistheso-calledport. bespeciedindicatingthesizeofmessagebuer. ceivingendofanyinternalchannel.atportcreation,abueringparametercan playtheroleofasenderforacs-prologiichannelspeciedatthetimeofport creation.theotherendofthechannelcanbeusedinthesamewayasthere- Portsrepresentincomingmessagesubstreams.Theyareexplicitlycreatedand therepresentationofanoutgoingmessagestream.itsattributesincludethelocal setatcreation.ifthevalueofthebueringattributeisgreaterthanzerothen channel,thepartner'snameandthepartner'sport(ifpartnerisnotforeign)to wherethestreamisdirected.itssizeoftheconnection'smessagebuercanbe AnotherimportantnotioninCS-PrologIIistheconnection.Aconnectionis siblyforeign)managerprogram,thefollowingtypesofpartnerscanappearfor morethanonemessagecanbestoredintheconnectionbuer,allowingseveral sendoperationstocompletewithoutblocking. aspeciccs-prologiiprogram: {Privatepartners;theiraddresseshavetobeavailableinadvanceforthe InacentralisedsubnetworkofCS-PrologIIapplicationsmanagedbya(pos- {Netpartners,whichhavesignedupatthemanager,andourprogramincludedtheminitslocalpictureofthenetwork.Theaddressofanetpartner isobtainedfromthemanager. {Latentpartners,whoareknownbymanager,butourprogramdidn'tinclude program(hardwiredintheprogram,obtainedfromale,e.t.c.). municationprotocol,inordertobeabletocommunicatewithanetpartner,a InthecurrentTCP/IPimplementationoftheCS-PrologIIlow-levelcom- theminitslocalnetworkpicture.theaddressofalatentpartner(andsome congurationprocesshastobeperformedasforprivatepartners.inotherwords otherattributestoo)canbeaskedfromthemanager. thepossibilityofcommunicatingwithpartnerswithknownaddresseswithout buildingaspecictransmissionpathtothem,theexplicitcongurationofnet partnerscanbeomitted. theprogramhastoaddexplicitlythispartnerusingspecialbuilt-inpredicate. InfutureCS-PrologIIversions,iftheunderlyingnetworklayerprovides full-edgeddatacollectionforexpernetintelligentagents.wehaveapproached ThesizeandcomplexityofNationalComputerNetworkofUkraineareofthe mostimportantissuesinitsmanagement[13],creatingproblemsintheareaof 5CapturingtheNetworkState lowing. MS)andBigBrothernetworkmonitoringtool,inthewaypresentedinthefol- thisproblembymodifyingthehierarchicalnetworkmanagementsystem(hnagementneedsthatarosebecauseofthecontinuinginstallationoflarge,high 5.1TheHNMS+System TheHNMSsystemprototypeversionwasdevelopedtocoverthenetworkman-
speedlocalandwide-areanetworksforthenumericalaerodynamicsimulation (NAS)FacultyattheNASAAmesResearchCenter[12].Thisprototypeversion ofhnmsisavailableontheinternet. ofglobaltopologyandstatusinformation.theuserinterface(ui)moduleresidesonworkstationswithgraphicscapabilitiesandprovidesaccesstoreal-timules,whichtypicallyresideonseparatehoststhroughoutthenetwork.theserver moduleisthehubforthenetworkdata;itprovidesacenterfordissemination TheprototypeversionoftheavailableHNMSconsistsoftwotypesofmod- orloggeddata.allinter-modulecommunicationisdoneusingthehierarchical NetworkManagementProtocol(HNMP)describedin[12].Theprotocolrequires theuseofnewhnmsmib,whichdenesasetofvariablesinadditiontostandardsnmpvariables[6,16].hnmsmibobjectsrepresentipnetworkelementagement:internet,network,subnet,interface,processor,site,equipment,administrator,oraddress. withinhnmssystem.eachobjectisidentiedbyauniquenumber,itshnms id,whichisassignedbytheserver.objectsbelongtooneofthefollowingclasses whichrepresentnetworkentitiesorotherusefulinformationaboutnetworkman- stateofanetworkelementusingacolourcode.thesediagramsareupdatedby theserver,reectingchangesoftheelement'sstatus.thewandiagramdepicts thestateoftheipnetworkandtheroutersoverageographicalreference(e.g. amapofukraine).thesitediagramrepresentsalllansthatareconnected HNMSprovidesfourtypesofstatusdiagrams,eachrepresentingtheviewof totheroutersatagivensite.thecustomdiagramallowstheusertoconstruct adiagramwithanysetofnetworkelementshewishestoobserve.finally,the ObjectdiagramisatextualdisplayoftheHNMSvariables. informationaboutthebehaviourofparticularsubnetworksthatarecompound tectureofhnms,theprototypeversiondidnotsupportmultipleiomodules, theimplementationofiomodulefunctionalitywasnecessarytocollectlocal andasaconsequence,therewasnotruehierarchyinitsstructure.therefore, AlthoughInput/Output(IO)moduleswerementionedinthegeneralarchi- partsofnationalnetworkofukraine.theiomodulesresideonhostslocatedat andhandleactualdatacollection.ouriomodulesusesnmp[6,16]protocol strategicpointswithinwan(regional,district,metropolitan-areasubnetwork) forlocaldatacollectionfromthesnmpagentsattachedontheactualnetwork devices.thesemodulespasslteredmanagementdata,uptotheservermodule. InaccordancewiththeoverallarchitectureofHNMS,dataaresentfromIOto serversonlywhentheirvalueschange.thusthehierarchicalinstallationofio modulesallowstoavoidoodingthenetworkwithmanagementtracandcreatingbottleneckswhenmanagementinformationisdirectedtoexpernetagentstemwhichfullysupportshnmsfunctionalityandextendsitwithnewfeatures. ThenewHNMSisnamedHNMS+anditisatruehierarchicaldistributedsys- SQLfront-endprocessthatstoresHNMS+MIBvariablevaluesinaPostgreSQL databasewithafrequencygivenbytheuser(usuallyapprox.1minute).the specication,thedatabasemodule,wasdeveloped.thedatabasemoduleisan Additionally,thefourthtypeofmodulementionedintheHNMSexternal
variablesoflocalserver/iomoduleschangeinordertoavoidnetworkoverloading databasemoduleinteractswiththehnms+server/iomodulestoreonlywhen bysqlrequests. tionaboutnetworktracandutilisationofthenetworkelements. KBIPmoduleisanapplicationthatobtains,throughHNMPprotocol,informa- incs-prologiiasaspecialknowledge-basedintelligentprocessing(kbip).the Finally,aninterfaceoftheExperNetagentswithHNMS+wasimplemented notiedbyhnms+aboutimportantnetworkevents. areabletoimmediatelydeterminethegeneralstateofthenetworkbutalsobe ceptionofthestateofnetwork.usingkbipmodules,expernetagentsnotonly OneachnodeHNMS+providestotheExperNetagentsanimmediateper- 5.2TheBigBrotherMonitoringSystem http,smtpandnntp),servicesreliabilityandlocalhostresourceslikecpu,disk Inordertosucientlymonitorthenetworkstateandservicesavailability,the informationobtainedbystandardsnmpagentsisnotenough.animportant issueistheevaluationofparticulartcp/ipnetworkservicesquality(likeftp, andsoon. connectivity(networkmonitororbb-network.sh)aswellasintra-machinecommunicationsprograms(bb,bbd,nettest).diskusage,cpuloading,ftp,smtpanitorlocalsystemconditions(localsystemmonitororbb-local.sh)andnetwork MacGuire[4].BigBrotherconsistsofsimpleshellscriptswhichperiodicallymon- BigBrotherisafreeWeb-basedUNIXSystemsmonitor,developedbySean httpservers,andimportantprocessescanbekepttrackof.theresultsofmonitoringarereportedinastatusmatrix(usingacolourcode)foreachsystem/area combination,whichisdisplayedonacentralmonitoringstation(displayserver) andpresentedthroughawebbaseduserinterface. ordertoachievemonitoringoftcp/ipservicesandremotecomputerresources bytheexpernetintelligentagents.hnms+mibwasextendedtoincorporate theadditionalmonitoringvaluesofthestatusmatrixofbigbrotherthatcorrespondtoallservices/resourcetypesincludedinthelatter.hnms+server FortheneedsofExperNet,wehaveintegratedHNMS+andBigBrotherin (oriomodule)analysesalocalloglecreatedbybigbrotherandllsoutthe previouslymentionedmibvariables. developedthatoersthepossibilityofremoteunixcommandinvocation.this wasnecessarysince,expernetintelligentagents,insomecases,requireinformationthatcannotbeobtaineddirectlyfromhnms+,butonlythroughcommand executiononthemonitoredremotehosts,asforexampleinformationobtained AdditionallytoexistingBigBrotherprocesses,aUNIXdaemon(module)was waspreferredsinceitoersthepossibilitytorestrictthesetofcommandsthat areallowed,throughappropriatecongurationofthemodule,thusleadingtoa moreexibleandsecuresystem. suchcasestheusual"rsh"unixcommandcouldbeused,theabovesolution bythe"traceroute"and"tcpdump"packetmonitoringutilities.althoughin
invocationthatallowsthesystemtobettermonitororevencontrolthenetwork. individualmonitoredhosts.italsooersarelativelysecureremotecommand telligentagentsthroughhnms+,notonlyaboutthestatusofthemostimpor- tanttcp/ipnetworkservices,butalsoabouttheoperationalparametersofthe Toconclude,themodiedBigBrotherprovidesinformationtoExperNetin- 6CurrentStatusandFutureWork Currentlythemajorpartoftheprojecthasbeensuccessfullycompleted.This partcomprisesthedesignoftheoverallsystem,aswellastheimplementationof thevariouscomponentsthathavebeendescribedinthepresentpaper.alarge arenowapproachingthenalphaseoftheimplementationwhichconsistsofthe partoftheknowledgebasehasbeenencodedinthelanguageofdevice.we istheenrichmentoftheknowledgebasesothatitwillbeabletohandlealarger setofnetworkfailures.currentlythesystemcoversaratherlimitednumberof developmentofagraphicaluserinterface,theinstallationofthenalsystemin suchcases,sinceourmaingoalwastohaveapilotsystemthatwillsuccessfully Ukraineandthevericationphase. demonstratetheapplicabilityofexpertsystemtechnologytothemanagement OnesimplebutyetveryimportantwayinwhichExperNetcanbeextended oflargenetworks. ofmuchoftheburdentheyhavetofaceintheireverydaypractice.takinginto servicesinlargerdatanetworksineuropeaswellasothercountries,andlead ofthenationalnetworkofukraine,thesystemcouldbeadoptedtoprovide toanimprovementoftheend-userservices,aswellasrelievetheadministrators DependingontheresultsoftheapplicationofExperNetinthemanagement constantlyincreasedcomplexity,suchfunctionalitymightnotonlybedesirable butalsoessentialinthenearfuture. accountthegrowthratesofthetcp/ipbasednetworksworld-wideandtheir References 2.BassiliadesN.andVlahavasI.:"DEVICE:CompilingProductionRulesinto 1.BarbuceanuM.,FoxS.:COOL:ALanguageforDescribingCoordinationinMulti 3.BassiliadesN.andVlahavasI:"ProcessingProductionRulesinDEVICE,an AgentSystems.Proc.ICMAS,1995 Event-DrivenRulesUsingComplexEvents",InformationandSoftwareTechnology,Vol.39(5),pp.331-342,ElsevierScience,1997. ActiveKnowledgeBaseSystem".Data&KnowledgeEngineering,Vol.24(2),pp. 117-155,ElsevierScience,1997. 4.BigBrother.AWeb-basedUnixNetworkMonitoringandNoticationSystem. 6.CaseJ.,FedorM.,SchostallM.,DavinJ.SimpleNetworkManagementProtocol, 5.Brown,D.andChandrasekaran,B.:DesignProblem-solving:KnowledgeStructuresandControlStrategies.MorganKaufman,1989 AvailableatURL:http://www.iti.qc.ca/users/sean/bb/bb.html forcomputerscience,1990. RFC1157,SNMPResearch,PerformanceSystemsInternational,MITLaboratory
9.Cockburn,D.andJennings,N.:ARCHON:ADistributedArticialIntelligence 8.ClanceyW.:HeuristicClassication.ArticialIntelligence27,1985 7.Chandrasekaran,B.,Johnson,T.,andSmith,J.:Task-StructureAnalysisfor KnowledgeModelling.CommunicationsoftheACM35(9),1992 10.CuenaJ.,MolinaM.:KSM:AnEnvironmentforKnowledgeOrientedDesignof pacts.informationprocessing94.vol2k.brunnsteinande.raubold(eds.). (eds.),wiley,1996 ApplicationsUsingStructuredKnowledgeArchitectures.ApplicationsandIm- SystemforIndustrialApplications,FoundationsofDAI.O'HareandJennings 11.CuenaJ.,OssowskiS.:DistributedModelsforDecisionSupport.ToappearinIntroductiontoDistributedArticialIntelligence.WeissandSen(eds.)AAAI/MIT Press,1998 12.GeorgeJudeA.,SchechtLeslieE.TheNASHierarhicalNetworkManagement Elsevier,1994.(seealso:http://www.isys.dia..upm.es/ksm). 14.Muller,H.-J.:NegotiationPrinciplesinFoundationsofDAI.O'HareandJennings 13.MatovAlexander.ThedevelopmentofInternet-likenetworksinUkraineNetworks andtelecommunications,kiev,no.2,1997.-pp.4-11. (Editors),ElsevierSciencePublishers,Amsterdam,1993. SystemIn"IntegratedNetworkmanagementIII",H.-G.HegeringandY.Yemini 15.PuertaA.R.,TuS.W.andMusenM.A.:ModellingTaskwithMechanisms.InternationalJournalonIntelligentSystems.Vol8,1993. Internets.Prentice-Hall,Inc.,NewJersey,1991. (eds.),wiley,1996 17.WielingaB.J.,SchreiberA.T.,BreukerJ.A.:"KADS:AModellingApproachto 16.RoseM.TheSimpleBook:AnIntroductiontoManagementofTCP/IP-based KnowledgeEngineering".KnowledgeAcquisition,1992.