Application-based Alerts

Feature Summary and Revision History

Summary Data

Table 1. Summary Data

Applicable Product(s) or Functional Area

SMF

Applicable Platform(s)

SMI

Feature Default Setting

Disabled - Configuration Required

Related Changes in this Release

Not Applicable

Related Documentation

Not Applicable

Revision History

Table 2. Revision History

Revision Details

Release

First introduced.

Pre-2020.02.0

Feature Description

When the system detects an anomaly, it generates an alert notification. The system statistics are the cause for these alert notifications. You can set an expression to trigger an alert when the expression becomes true.

How it Works

The Common Execution Environment (CEE) uses the Prometheus Alert Manager for alerting operations. The CEE YANG model - either through CLI or API - allows users to view the active alerts, silenced alerts, and alert history. Also, the applications can call the alert API directly to add or clear alerts. The Prometheus Alert Manager API (v2) is the standard API used.

The Prometheus Alerts Manager includes the following options:

  • Defining Alert Rules: This option defines the types of alerts that the Alert Manager should trigger. Use the Prometheus Query Language (PromQL) to define the alerts.

  • Defining Alert Routing: This option defines the action the Alert Manager should take after receiving the alerts. At present, the SNMP Trapper is supported as the outbound alerting. Also, the CEE provides an Alert Logger for storing the generated alerts.

Configuring Alert Rules

To configure the alert rules, use the following configuration:


configure 
   alerts rules group alert_group_name 
   interval-seconds seconds 
   rule rule_name 
      expression promql_expression 
      duration duration 
      severity severity_level 
      type alert-type 
      annotation annotation_name 
      value annotation_value 
      exit 
   exit

NOTES:

  • alerts rules : Specifies the Prometheus alerting rules.

  • group alert_group_name : Specifies the Prometheus alerting rule group. One alert group can have multiple lists of rules. alert-group-name is the name of the alert group. The alert-group-name must be a string in the range of 0–64 characters.

  • interval-seconds seconds : Specifies the evaluation interval of the rule group in seconds.

  • rule rule_name : Specifies the alerting rule definition. rule_name is the name of the rule.

  • expression promql_expression : Specifies the PromQL alerting rule expression. promql_expression is the alert rule query expressed in PromQL syntax.

  • duration duration : Specifies the duration of a true condition before it is considered true. duration is the time interval before the alert is triggered.

  • severity severity_level : Specifies the severity of the alert. severity-level is the severity level of the alert. The severity levels are critical, major, minor, and warning.

  • type alert_type : Specifies the type of the alert. alert_type is the user-defined alert type. For example, Communications Alarm, Environmental Alarm, Equipment Alarm, Indeterminate Integrity Violation Alarm, Operational Violation Alarm, Physical Violation Alarm, Processing Error Alarm, Quality of Service Alarm, Security Service Alarm, Mechanism Violation Alarm, or Time Domain Violation Alarm.

  • annotation annotation_name : Specifies the annotation to attach to the alerts. annotation_name is the name of the annotation.

  • value annotation_value : Specifies the annotation value. annotation_value is the value of the annotation.

The following example configures an alert, which is triggered when the percentage of Unified Data Management (UDM) responses is less than the specified threshold limit.

Example:

	configure terminal
		alerts rules group SMFUDMchk_incr
		interval-seconds 300
		rule SMFUDMchk_incr
		expression "sum(increase(smf_restep_http_msg_total{nf_type=\"udm\", message_direction=\"outbound\", response_status=~\"2..\"}[3m])) /  sum(increase(smf_restep_http_msg_total{nf_type=\"udm\", message_direction=\"outbound\"}[3m])) < 0.95"
		severity major
		type "Communications Alarm"
		annotation summary
		value "This alert is fired when the percentage of UDM responses is less than threshold“
		exit
	exit
exit

You can view the configured alert using the show running-config alerts command.

Example:

The following example displays the alerts configured in the running configuration:

	show running-config alerts
		interval-seconds 300
		rule SMFUDMchk_incr
		expression "sum(increase(smf_restep_http_msg_total{nf_type=\"udm\", message_direction=\"outbound\", response_status=~\"2..\"}[3m])) /  sum(increase(smf_restep_http_msg_total{nf_type=\"udm\", message_direction=\"outbound\"}[3m])) < 0.95"
		severity major
		type "Communications Alarm"
		annotation summary
		value "This alert is fired when the percentage of UDM responses is less than threshold“              
		exit
	exit
exit

Viewing Alert Logger

The Alert Logger stores all the generated alerts by default. You can view the stored alerts using the following show command.

show alert history [ filtering ]

You can narrow down the result using the following filtering options:

  • annotations: Specifies the annotations of the alert.

  • endsAt: Specifies the end time of the alert.

  • labels: Specifies the additional labels of the alert.

  • severity: Specifies the severity of the alert.

  • source: Specifies the source of the alert.

  • startsAt: Specifies the start time of the alert.

  • type: Specifies the type of the alert.

The following example displays the history of the alerts configured in the system:

Example:
show alerts history
alerts active SMFUDMchk_incr ac2a970ab621
state active
severity major
type "Communications Alarm"
startsAt 2019-11-15T08:26:48.283Z
source System
annotations [ "summary:This alert is fired when the percentage of UDM responses is less than threshold.” ]

You can view the active and silenced alerts with the show alerts active and show alerts active commands.

The following example displays the active alerts. The alerts remain active as long as the evaluated expression is true.

Example:
show alerts active
alerts active SMFUDMchk_incr ac2a970ab621
state active
severity major
type "Communications Alarm"
startsAt 2019-11-15T08:26:48.283Z
source System
annotations [ "summary:This alert is fired when the percentage of UDM responses is less than threshold.” ]

Call Flow Procedure Alerts

This section provides detail of commands that are required to configure alerts related to various call flow procedures.

4G PDN Modify

Use the following commands to configure alerts related to the 4G PDN Modify procedure. 

alerts rules group SMFPDN 
   interval-seconds 300 
   rule SMFPDNModify 
   expression “sum(smf_service_stats{procedure_type=~\”pdn_ho_location_changed|pdn_ho_rat_type_changed|pdn_inter_sgw_handover|pdn_mbr\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=~\”pdn_ho_location_changed|pdn_ho_rat_type_changed|pdn_inter_sgw_handover|pdn_mbr\” , status=\“attempted\”}) < 0.95” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 4G PDN Modify is below threshold” 
   exit 
exit

4G PDN Release Success

Use the following commands to configure alerts related to the 4G PDN Release Success procedure. 

alerts rules group SMFPDN 
   interval-seconds 300 
   rule SMFPDNRelease 
   expression “sum(smf_service_stats{procedure_type=~\“.*pdn_sess_rel\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=~\“.*pdn_sess_rel\” , status=\“attempted\”} < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 4G PDN Release is below threshold.” 
   exit 
exit

4G PDN Setup Success

Use the following commands to configure alerts related to the 4G PDN Setup Success procedure. 

alerts rules group SMFPDN 
   interval-seconds 300 
   rule SMFPDNSetup 
   expression “sum(smf_service_stats{procedure_type=\”pdn_sess_create\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=\”pdn_sess_create\” , status=\“attempted\”} < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 4G PDN Setup is below threshold.” 
   exit 
exit

4G to 5G HO Success

Use the following commands to configure alerts related to the 4G to 5G HO Success procedure. 

alerts rules group Handover 
   interval-seconds 300 
   rule 4gTo5gHOSuccess 
   expression “sum(smf_service_stats{procedure_type=~\“n26_4g_to_5g_handover|n26_4g_to_5g_im_mobility\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=~\“n26_4g_to_5g_handover|n26_4g_to_5g_im_mobility\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 4G to 5G HO is below threshold.” 
   exit 
exit

4G To WiFi HO Success

Use the following commands to configure alerts related to the 4G to WiFi HO Success procedure. 

alerts rules group Handover 
   interval-seconds 300 
   rule 4GtoWifiHOSuccess 
   expression “sum(smf_service_stats{procedure_type=\”enb_to_untrusted_wifi_handover\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=\“enb_to_untrusted_wifi_handover\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N4 responses sent is lesser than 95 %." 
   exit 
exit

5G N2 HO Success

Use the following commands to configure alerts related to the 5G N2 HO Success procedure. 

alerts rules group Handover 
   interval-seconds 300 
   rule N2HOSuccess 
   expression “sum(smf_service_stats{procedure_type=\“n2_handover\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=\“n2_handover\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 5G N2 HO is below threshold.” 
   exit 
exit

5G PDU Idle Success

Use the following commands to configure alerts related to the 5G PDU Idle Success procedure. 

alerts rules group SMFPDU 
   interval-seconds 300 
   rule SMFPDUIdleSuccess 
   expression “sum(smf_service_stats{procedure_type=~\“.*idle\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=~\“.*idle\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 5G PDU Idle is below threshold” 
   exit 
exit

5G PDU Modify Success

Use the following commands to configure alerts related to the 5G PDU Modify Success procedure. 

alerts rules group SMFPDU 
   interval-seconds 300 
   rule SMFSessionModifySuccess 
   expression “sum(smf_service_stats{procedure_type=~\“.*pdu_sess_mod\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=~\“.*pdu_sess_mod\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 5G PDU Modify is below threshold” 
   exit 
exit

5G PDU Release Success

Use the following commands to configure alerts related to the 5G PDU Release Success procedure. 

alerts rules group SMFPDU 
   interval-seconds 300 
   rule SMFSessionReleaseFailure 
   expression “sum(smf_service_stats{procedure_type=~\“.*pdu_sess_rel\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=~\“.*pdu_sess_rel\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 5G PDU Setup is below threshold” 
   exit 
exit

5G PDU Setup Success

Use the following commands to configure alerts related to the 5G PDU Setup Success procedure. 

alerts rules group SMFPDU 
   interval-seconds 300 
   rule SMFSessionSetupFailure 
   expression “sum(smf_service_stats{procedure_type=\”pdu_sess_create\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=\”pdu_sess_create\” , status=\“attempted\”} < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when failed to setup sessions is more than 5%” 
   exit 
exit

5G to 4G HO Success

Use the following commands to configure alerts related to the 5G to 4G HO Success procedure. 

alerts rules group Handover 
   interval-seconds 300 
   rule 5gTo4gHOSuccess 
   expression “sum(smf_service_stats{procedure_type=~\“pdn_5g_4g_handover|pdn_5g_4g_handover_dft|eps_fb_5g_4g_handover_dft|eps_fb_5g_4g_handover_idft|pdn_5g_4g_handover_idft\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=~\“pdn_5g_4g_handover|pdn_5g_4g_handover_dft|eps_fb_5g_4g_handover_dft|eps_fb_5g_4g_handover_idft|pdn_5g_4g_handover_idft\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 5G to 4G HO is below threshold.” 
   exit 
exit

5G To WiFi HO Success

Use the following commands to configure alerts related to the 5G to WiFi HO Success procedure. 

alerts rules group Handover 
   interval-seconds 300 
   rule 5GtoWifiHOSuccess 
   expression “sum(smf_service_stats{procedure_type=\”nr_to_untrusted_wifi_handover\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=\“nr_to_untrusted_wifi_handover\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N4 responses sent is lesser than 95 %." 
   exit 
exit

5G Xn HO Success

Use the following commands to configure alerts related to the 5G Xn HO Success procedure. 

alerts rules group Handover 
   interval-seconds 300 
   rule XnHOSuccess 
   expression “sum(smf_service_stats{procedure_type=\“xn_handover\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=\“xn_handover\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 5G Xn HO is below threshold.” 
   exit 
exit

PDN Session Create

Use the following commands to configure alerts related to the PDN Session Create procedure.

alerts rules group SMFProcStatus 
   interval-seconds 300 
   rule PDNSessCreate 
   expression "sum(increase(smf_service_stats{app_name=\"SMF\",procedure_type=\"pdn_sess_create\",status=\"success\”}[5m]))  / sum(increase(smf_service_stats{app_name=\"SMF\",procedure_type=\"pdn_sess_create\",status=\"attempted\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the success percentage of pdn_sess_create procedure is lesser threshold.” 
   exit 
exit

PDU Session Create

Use the following commands to configure alerts related to the PDU Session Create procedure.

alerts rules group SMFProcStatus 
   interval-seconds 300 
   rule PDUSessCreate 
   expression "sum(increase(smf_service_stats{app_name=\"SMF\",procedure_type=\"pdu_sess_create\",status=\"success\”}[5m]))  / sum(increase(smf_service_stats{app_name=\"SMF\",procedure_type=\"pdu_sess_create\",status=\"attempted\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the success percentage of pdu_sess_create procedure is lesser threshold.” 
   exit 
exit

PDU Session Modify

Use the following commands to configure alerts related to the PDU Session Modify procedure.

alerts rules group SMFProcStatus 
   interval-seconds 300 
   rule PDUSessModify 
   expression "sum(increase(smf_service_stats{app_name=\"SMF\",procedure_type=~\".*req_pdu_sess_mod\",status=\"success\”}[5m]))  / sum(increase(smf_service_stats{app_name=\"SMF\",procedure_type=~\”.*req_pdu_sess_mod\",status=\"attempted\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the success percentage of req_pdu_sess_mod procedure is lesser threshold.” 
   exit 
exit

PDU Session Release

Use the following commands to configure alerts related to the PDU Session Release procedure.

alerts rules group SMFProcStatus 
   interval-seconds 300 
   rule PDUSessRelease 
   expression "sum(increase(smf_service_stats{app_name=\"SMF\",procedure_type=~\".*req_pdu_sess_rel\",status=\"success\”}[5m]))  / sum(increase(smf_service_stats{app_name=\"SMF\",procedure_type=~\”.*req_pdu_sess_rel\",status=\"attempted\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the success percentage of req_pdu_sess_rel procedure is lesser threshold.” 
   exit 
exit

Interface Specific Alerts

This section provides detail of commands that are required to configure alerts related to various interfaces.

GTPC Peer Down

Use the following commands to configure alerts related to the GTPC Peer Down procedure. 

alerts rules group GTPCPeerDown 
   interval-seconds 300 
   rule GTPCPeerDown 
   expression nodemgr_gtpc_peer_status{gtpc_peer_status=\“gtpc_peer_path_down\”}) 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired when the GTPC Path failure detected for peer crosses threshold” 
   exit 
exit

N4 Message Success

Use the following commands to configure alerts related to the N4 Message Success procedure. 

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN4MessageSuccess 
   expression "sum(smf_protocol_udp_res_msg_total{message_direction=\"inbound\", status=\”accepted\”}) /  sum(smf_protocol_udp_res_msg_total{message_direction=\"inbound\”, status=~\”accepted|denied\”}) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N4 responses sent is lesser than 95 %." 
   exit 
exit

N4 UPF Association Down

Use the following commands to configure alerts related to the N4 UPF Association Down query by N4 address. 

alerts rules group N4Association 
   interval-seconds 300 
   rule SMFAssociationRelease 
   expression ”smf_proto_udp_res_msg_total{procedure_type=\“n4_association_release_res\”, message_direction= \“inbound\”, status=\“accepted\”}) ” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired when the N4 Association with UPF is released” 
   exit 
exit

N4 UPF Association Up

Use the following commands to configure alerts related to the N4 UPF Association Up query by N4 address. 

alerts rules group N4Association 
   interval-seconds 300 
   rule N4AssociationUP 
   expression ”smf_proto_udp_res_msg_total{procedure_type=\“n4_association_setup_res\”, message_direction= \“inbound\”, status=\“accepted\”}” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired when the N4 Association with UPF is established” 
   exit 
exit

N7 Interface Outbound

Use the following commands to configure alerts related to an outbound N7 interface.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN7Outbound 
   expression "sum(increase(smf_restep_http_msg_total{nf_type=\"pcf\", message_direction=\"outbound\", response_status=~\”2..\”}[5m])) /  sum(increase(smf_restep_http_msg_total{nf_type=\"pcf\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N7 responses received is lesser threshold.” 
   exit 
exit

N7 Interface Inbound

Use the following commands to configure alerts related to an inbound N7 interface.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN7Inbound 
   expression "sum(increase(smf_restep_http_msg_total{nf_type=\"pcf\", message_direction=\"inbound\", response_status=~\”2..\”}[5m])) /  sum(increase(smf_restep_http_msg_total{nf_type=\"pcf\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N7 responses sent is lesser threshold.” 
   exit 
exit

N7 Message Timed Out

Use the following commands to configure alerts related to the N7 Message Timed Out procedure. 

alerts rules group MessageTimeout 
   interval-seconds 300 
   rule SMFN7Timeout 
   expression ”sum(irate(smf_restep_http_msg_total{nf_type=\“pcf\”, message_direction=\”inbound\”, response_status=\”504\”}[5m])) > 5” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired when the increase in timeout for N7 messages toward PCF crosses threshold” 
   exit 
exit

N10 Interface

Use the following commands to configure alerts related to the N10 interface.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN10 
   expression "sum(increase(smf_restep_http_msg_total{nf_type=\"udm\", message_direction=\"outbound\", response_status=~\”2..\”}[5m])) /  sum(increase(smf_restep_http_msg_total{nf_type=\"udm\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N10 responses received is lesser threshold.” 
   exit 
exit

N11 Interface Inbound

Use the following commands to configure alerts related to an inbound N11 interface.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN11Inbound 
   expression "sum(increase(smf_restep_http_msg_total{nf_type=\"amf\", message_direction=\"inbound\", response_status=~\”2..\”}[5m])) /  sum(increase(smf_restep_http_msg_total{nf_type=\"amf\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N11 responses sent is lesser threshold.” 
   exit 
exit

N11 Interface Outbound

Use the following commands to configure alerts related to an outbound N11 interface.

alerts rules group SMFSvcStatus 
   interval-seconds 60 
   rule SMFN11Outbound 
   expression "sum(increase(smf_restep_http_msg_total{nf_type=\"amf\", message_direction=\"outbound\", response_status=~\”2..\”}[5m])) /  sum(increase(smf_restep_http_msg_total{nf_type=\"amf\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N11 responses received is lesser threshold.” 
   exit 
exit

N11 Message Timed Out

Use the following commands to configure alerts related to the N11 Message Timed Out procedure. 

alerts rules group MessageTimeout 
   interval-seconds 300 
   rule SMFN40Timeout 
   expression ”sum(irate(smf_restep_http_msg_total{nf_type=\“chf\”, message_direction=\”inbound\”, response_status=\”504\”}[5m])) > 5” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired when the increase in timeout for N11 messages toward AMF crosses threshold” 
   exit 
exit

N40 Interface Inbound

Use the following commands to configure alerts related to an inbound N40 interface.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN40Inbound 
   expression "sum(increase(smf_restep_http_msg_total{nf_type=\"chf\", message_direction=\"inbound\", response_status=~\”2..\”}[5m])) /  sum(increase(smf_restep_http_msg_total{nf_type=\"chf\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N40 responses sent is lesser threshold.” 
   exit 
exit

N40 Interface Outbound

Use the following commands to configure alerts related to an outbound N40 interface.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN40Outbound 
   expression "sum(increase(smf_restep_http_msg_total{nf_type=\"chf\", message_direction=\"outbound\", response_status=~\”2..\”}[5m])) /  sum(increase(smf_restep_http_msg_total{nf_type=\"chf\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N40 responses received is lesser threshold.” 
   exit 
exit

N40 Message Timed Out

Use the following commands to configure alerts related to the N40 Message Timed Out procedure. 

alerts rules group MessageTimeout 
   interval-seconds 300 
   rule SMFN11Timeout 
   expression ”sum(irate(smf_restep_http_msg_total{nf_type=\“chf\”, message_direction=\”inbound\”, response_status=\”504\”}[5m])) > 5” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired the increase in timeout for N40 messages toward CHF crosses threshold” 
   exit 
exit

NRF Discovery

Use the following commands to configure alerts related to the NRF Discovery procedure. 

alerts rules group NRF 
   interval-seconds 300 
   rule NRFDiscovery 
   expression “sum(nf_discover_messages_total{result=~\”success|failure\”,svc_name=\”nnrf-disc\”, service_name=\”smf-rest-ep\”}) < 0.95” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N4 responses sent is lesser than 95 %." 
   exit 
exit

SMF Service Start

Use the following commands to configure alerts related to the SMF Service Start procedure. 

alerts rules group SMFService 
   interval-seconds 300 
   rule SMFServiceStart 
   expression “irate(outgoing_response_msg_total{msg_type=\”NrfNfmRegistration\”}[5m])” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when SMF-Service starts upon registration with NRF” 
   exit 
exit

IP Pool

This section provides detail of commands that are required to configure alerts related to IP Pool.

IP Pool Used

Use the following commands to configure alerts related to the IP Pool used procedure. 

alerts rules group IPPool 
   interval-seconds 300 
   rule IPPool 
   expression “sum(IPAM_address_allocations_current) > THRESHOLD” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired when the percentage IP pool addresses used is above the threshold” 
   exit 
exit

Message Level Alerts

This section provides detail of commands that are required to configure alerts related to various messages.

N11 SM Create

Use the following commands to configure alerts related to N11 SM Create.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN11Success 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"amf_create_sm_context\", message_direction=\"inbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"amf_create_sm_context\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of amf_create_sm_context responses sent is lesser threshold.” 
   exit 
exit

N11 SM Update

Use the following commands to configure alerts related to N11 SM Update.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN11Update 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"amf_update_sm_context\", message_direction=\"inbound\", response_status=\"200\"}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"amf_update_sm_context\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of amf_update_sm_context responses sent is lesser threshold.” 
   exit 
exit

N11 SM Release

Use the following commands to configure alerts related to N11 SM Release.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN11Release 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"amf_release_sm_context\", message_direction=\"inbound\", response_status=\"204\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"amf_release_sm_context\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of amf_release_sm_context responses sent is lesser threshold.” 
   exit 
exit

N1 N2 Message Transfer

Use the following commands to configure alerts related to N1 N2 Message Transfer.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN1N2Transfer 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"amf_n1_n2_transfer\", message_direction=\"outbound\", response_status=\"200\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"amf_n1_n2_transfer\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of amf_n1_n2_transfer responses received is lesser threshold.” 
   exit 
exit

N11 EBI Assignment

Use the following commands to configure alerts related to N11 EBI Assignment.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN11EBI 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"amf_assign_ebi\", message_direction=\"outbound\", response_status=\"200\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"amf_assign_ebi\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of amf_assign_ebi responses received is lesser threshold.” 
   exit 
exit

N11 SM Status Notify

Use the following commands to configure alerts related to N11 SM Status Notify.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN11StatusNotify 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"amf_status_notify\", message_direction=\"outbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"amf_status_notify\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of amf_status_notify responses received is lesser threshold.” 
   exit 
exit

N11 SM Context Retrieve

Use the following commands to configure alerts related to N11 SM Context Retrieve.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN11ContextRetrieve 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"amf_retrieve_sm_context\", message_direction=\"inbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"amf_retrieve_sm_context\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of amf_retrieve_sm_context responses sent is lesser threshold.” 
   exit 
exit

N7 SM Policy Create

Use the following commands to configure alerts related to N7 SM Policy Create.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN7PolicyCreate 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_create\", message_direction=\"outbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_create\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of pcf_sm_policy_control_create responses received is lesser threshold.” 
   exit 
exit

N7 SM Policy Update

Use the following commands to configure alerts related to N7 SM Policy Update.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN7PolicyUpdate 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_update\", message_direction=\"outbound\", response_status=\"200\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_update\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of pcf_sm_policy_control_update responses received is lesser threshold.” 
   exit 
exit

N7 SM Policy Delete

Use the following commands to configure alerts related to N7 SM Policy Delete.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN7PolicyDelete 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_delete\", message_direction=\"outbound\", response_status=\"204\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_delete\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of pcf_sm_policy_control_delete responses received is lesser threshold.” 
   exit 
exit

N7 SM Policy Notify Update

Use the following commands to configure alerts related to N7 SM Policy Notify Update.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN7PolicyUpdateNotify 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_update_notify\", message_direction=\"inbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_update_notify\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of pcf_sm_policy_control_update_notify responses sent is lesser threshold.” 
   exit 
exit

N7 SM Policy Notify Terminate

Use the following commands to configure alerts related to N7 SM Policy Terminate.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN7PolicyTerminateNotify 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_terminate_notify\", message_direction=\"inbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_terminate_notify\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of pcf_sm_policy_control_terminate_notify responses sent is lesser threshold.” 
   exit 
exit

N10 UE Register

Use the following commands to configure alerts related to N10 UE Register.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN10UERegister 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"register_ue\", message_direction=\"outbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"register_ue\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of register_ue responses received is lesser threshold.” 
   exit 
exit

N10 UE DeRegister

Use the following commands to configure alerts related to N10 UE DeRegister.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN10UEDeRegister 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"deregister_ue\", message_direction=\"outbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"deregister_ue\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of deregister_ue responses received is lesser threshold.” 
   exit 
exit

N10 SM Subscription Fetch

Use the following commands to configure alerts related to N10 Subscription Fetch.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN10SubscriptionFetch 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"subscription_req\", message_direction=\"outbound\", response_status=\"200\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"subscription_req\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of subscription_req responses received is lesser threshold.” 
   exit 
exit

N10 SM Subscribe for Notification

Use the following commands to configure alerts related to N10 Subscribe for Notification.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN10SubscriptionNotification 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"sdm_subscription_req\", message_direction=\"outbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"sdm_subscription_req\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of sdm_subscription_req responses received is lesser threshold.” 
   exit 
exit

N10 Charging Data Request

Use the following commands to configure alerts related to N10 Charging Data Request.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN10ChargingRequest 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"chf_charging_data_request\", message_direction=\"outbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"chf_charging_data_request\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of chf_charging_data_request responses received is lesser threshold.” 
   exit 
exit

N10 Charging Data Notify

Use the following commands to configure alerts related to N10 Charging Data Notify.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN10ChargingDataNotify 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"chf_abort_notify\", message_direction=\"inbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"chf_abort_notify\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of chf_abort_notify responses sent is lesser threshold.” 
   exit 
exit

Policy Rule Alerts

This section provides detail of commands that are required to configure alerts related to various policy rules.

Addition of Dynamic PCC Rules

Use the following commands to configure alerts related to addition of dynamic PCC rules.

alerts rules group SMFPolicyStatus 
   interval-seconds 300 
   rule AddPCCRule 
   expression "sum(increase(policy_dynamic_pcc_rules_total{app_name=\"SMF\",event=\"success\",operation=\"install\”}[5m]))  / sum(increase(policy_dynamic_pcc_rules_total{app_name=\"SMF\",event=\"attempted\",operation=\"install\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of successful addition of dynamic pcc rules is lesser threshold.” 
   exit 
exit

Modification of Dynamic PCC Rules

Use the following commands to configure alerts related to modification of dynamic PCC rules.

alerts rules group SMFPolicyStatus 
   interval-seconds 300 
   rule ModifyPCCRule 
   expression "sum(increase(policy_dynamic_pcc_rules_total{app_name=\"SMF\",event=\"success\",operation=\"modify\”}[5m]))  / sum(increase(policy_dynamic_pcc_rules_total{app_name=\"SMF\",event=\"attempted\",operation=\"modify\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of successful modification of dynamic pcc rules is lesser threshold.” 
   exit 
exit

Removal of Dynamic PCC Rules

Use the following commands to configure alerts related to removal of dynamic PCC rules.

alerts rules group SMFPolicyStatus 
   interval-seconds 300 
   rule RemovePCCRule 
   expression "sum(increase(policy_dynamic_pcc_rules_total{app_name=\"SMF\",event=\"success\",operation=\"remove\”}[5m]))  / sum(increase(policy_dynamic_pcc_rules_total{app_name=\"SMF\",event=\"attempted\",operation=\"remove\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of successful removal of dynamic pcc rules is lesser threshold.” 
   exit 
exit

SMF Overload/Congestion

This section provides detail of commands that are required to configure alerts related to various SMF Overload/Congestion.

SMF Overload

Use the following commands to configure alerts related to the SMF Overload procedure. 

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFOverload 
   expression “sum by (component) (system_overload_status) == true” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when increase in events not processed due to system overload” 
   exit 
exit

SMF Sessions

This section provides detail of commands that are required to configure alerts related to various SMF sessions.

Session Release Rate

Use the following commands to configure alerts related to the Session Release Rate procedure. 

alerts rules group SMFSession 
   interval-seconds 300 
   rule SMFSessionReleaseRate 
   expression “sum(rate(smf_service_stats{procedure_type=~\“.*pdu_sess_rel|.*pdn_sess_rel\” , status=\“attempted\”}[5m])) >  THRESHOLD ” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired when the session release rate exceeds the threshold” 
   exit 
exit

Session Setup Failure

Use the following commands to configure alerts related to the Session Setup Failure procedure. 

alerts rules group SMFSession 
   interval-seconds 300 
   rule SMFSessionSetupFailure 
   expression “sum(smf_service_stats{procedure_type=~\”pdu_sess_create|pdn_sess_create\” , status=\“failures\”}) / sum(smf_service_stats{procedure_type=\”pdu_sess_create|pdn_sess_create\” , status=\“attempted\”}) >  0.05 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when failed to setup sessions is more than 5%” 
   exit 
exit

Session Setup Rate

Use the following commands to configure alerts related to the Session Setup Rate procedure. 

alerts rules group SMFSession 
   interval-seconds 300 
   rule SMFSessionSetupRate 
   expression “sum(rate(smf_service_stats{procedure_type=~\”pdu_sess_create|pdn_sess_create\” , status=\“attempted\”}[5m]))>  THRESHOLD ” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired when the session setup rate exceeds the threshold” 
   exit 
exit

Subscriber Limit

Use the following commands to configure alerts related to the Subscriber Limit procedure. 

alerts rules group SMFSession 
   interval-seconds 300 
   rule SMFSubscriberLimit 
   expression “sum(smf_session_counters{pdu_type=~\”ipv4v6|ipv4|ipv6\”}) > THRESHOLD” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the max number of subscribers is more than the threshold” 
   exit 
exit