Version: 1.1.0
Virtual Event Streaming (VES) Collector is RESTful collector for processing JSON messages. The collector verifies the source and validates the events against VES schema before distributing to DMAAP MR topics
| Path | Operation | Description |
|---|---|---|
| /eventListener/v5 | POST | |
| /eventListener/v5/eventBatch | POST |
HTTP Basic Authentication. Works over HTTP and HTTPS
uri for posting VES event objects
application/json
application/json
VES Event Accepted.
Bad request provided
Unauthorized request
Service Unavailable
| basicAuth |
uri for posting VES batch event objects
application/json
application/json
VES Event Accepted.
Bad request provided
Unauthorized request
Service Unavailable
| basicAuth |
number of times an identified codec was used over the measurementInterval
command from an event collector toward an event source
fields common to all events
the eventing domain associated with the event
event key that is unique to the event source
unique event name
for example - applicationVnf, guestOS, hostOS, platform
the latest unix time aka epoch time associated with the event from any component--as microseconds elapsed since 1 Jan 1970 not including leap seconds
3 character network function component type, aligned with vfc naming standards
4 character network function type, aligned with vnf naming standards
processing priority
UUID identifying the entity reporting the event, for example an OAM VM; must be populated by the ATT enrichment process
name of the entity reporting the event, for example, an EMS name; may be the same as sourceName
ordering of events communicated by an event source instance or 0 if not needed
UUID identifying the entity experiencing the event issue; must be populated by the ATT enrichment process
name of the entity experiencing the event issue
the earliest unix time aka epoch time associated with the event from any component--as microseconds elapsed since 1 Jan 1970 not including leap seconds
version of the event header
performance counter
usage of an identified CPU
cpu identifer
percentage of CPU time spent in the idle task
percentage of time spent servicing interrupts
percentage of time spent running user space processes that have been niced
percentage of time spent handling soft irq interrupts
percentage of time spent in involuntary wait which is neither user, system or idle time and is effectively time that went missing
percentage of time spent on system tasks running the kernel
percentage of time spent running un-niced user space processes
percentage of CPU time spent waiting for I/O operations to complete
aggregate cpu usage of the virtual machine on which the VNFC reporting the event is running
usage of an identified disk
disk identifier
milliseconds spent doing input/output operations over 1 sec; treat this metric as a device load percentage where 1000ms matches 100% load; provide the average over the measurement interval
milliseconds spent doing input/output operations over 1 sec; treat this metric as a device load percentage where 1000ms matches 100% load; provide the last value measurement within the measurement interval
milliseconds spent doing input/output operations over 1 sec; treat this metric as a device load percentage where 1000ms matches 100% load; provide the maximum value measurement within the measurement interval
milliseconds spent doing input/output operations over 1 sec; treat this metric as a device load percentage where 1000ms matches 100% load; provide the minimum value measurement within the measurement interval
number of logical read operations that were merged into physical read operations, e.g., two logical reads were served by one physical disk access; provide the average measurement within the measurement interval
number of logical read operations that were merged into physical read operations, e.g., two logical reads were served by one physical disk access; provide the last value measurement within the measurement interval
number of logical read operations that were merged into physical read operations, e.g., two logical reads were served by one physical disk access; provide the maximum value measurement within the measurement interval
number of logical read operations that were merged into physical read operations, e.g., two logical reads were served by one physical disk access; provide the minimum value measurement within the measurement interval
number of logical write operations that were merged into physical write operations, e.g., two logical writes were served by one physical disk access; provide the average measurement within the measurement interval
number of logical write operations that were merged into physical write operations, e.g., two logical writes were served by one physical disk access; provide the last value measurement within the measurement interval
number of logical write operations that were merged into physical write operations, e.g., two logical writes were served by one physical disk access; provide the maximum value measurement within the measurement interval
number of logical write operations that were merged into physical write operations, e.g., two logical writes were served by one physical disk access; provide the minimum value measurement within the measurement interval
number of octets per second read from a disk or partition; provide the average measurement within the measurement interval
number of octets per second read from a disk or partition; provide the last measurement within the measurement interval
number of octets per second read from a disk or partition; provide the maximum measurement within the measurement interval
number of octets per second read from a disk or partition; provide the minimum measurement within the measurement interval
number of octets per second written to a disk or partition; provide the average measurement within the measurement interval
number of octets per second written to a disk or partition; provide the last measurement within the measurement interval
number of octets per second written to a disk or partition; provide the maximum measurement within the measurement interval
number of octets per second written to a disk or partition; provide the minimum measurement within the measurement interval
number of read operations per second issued to the disk; provide the average measurement within the measurement interval
number of read operations per second issued to the disk; provide the last measurement within the measurement interval
number of read operations per second issued to the disk; provide the maximum measurement within the measurement interval
number of read operations per second issued to the disk; provide the minimum measurement within the measurement interval
number of write operations per second issued to the disk; provide the average measurement within the measurement interval
number of write operations per second issued to the disk; provide the last measurement within the measurement interval
number of write operations per second issued to the disk; provide the maximum measurement within the measurement interval
number of write operations per second issued to the disk; provide the minimum measurement within the measurement interval
queue size of pending I/O operations per second; provide the average measurement within the measurement interval
queue size of pending I/O operations per second; provide the last measurement within the measurement interval
queue size of pending I/O operations per second; provide the maximum measurement within the measurement interval
queue size of pending I/O operations per second; provide the minimum measurement within the measurement interval
milliseconds a read operation took to complete; provide the average measurement within the measurement interval
milliseconds a read operation took to complete; provide the last measurement within the measurement interval
milliseconds a read operation took to complete; provide the maximum measurement within the measurement interval
milliseconds a read operation took to complete; provide the minimum measurement within the measurement interval
milliseconds a write operation took to complete; provide the average measurement within the measurement interval
milliseconds a write operation took to complete; provide the last measurement within the measurement interval
milliseconds a write operation took to complete; provide the maximum measurement within the measurement interval
milliseconds a write operation took to complete; provide the minimum measurement within the measurement interval
provides end of call voice quality metrics
adjacency name
Either Caller or Callee
1-5 1dp
Calculated percentage packet loss based on Endpoint RTP packets lost (as reported in RTCP) and Local RTP packets sent. Direction is based on Endpoint description (Caller, Callee). Decimal (2 dp)
0-100
millisecs
the root level of the common event format
specification of what information to suppress within an event domain
Event domain enum from the commonEventHeader domain field
List of optional field names in the event block that should not be sent to the Event Listener
Optional list of specific NvPairsNames to suppress within a given Name-Value Field
array of eventDomainThrottleSpecifications
array of events
fields specific to fault events
additional alarm information
alarm condition reported by the device
card, port, channel or interface name of the device generating the alarm
Event category, for example: license, link, routing, security, signaling
event severity
type of event source; examples: card, host, other, port, portThreshold, router, slotThreshold, switch, virtualMachine, virtualNetworkFunction
version of the faultFields block
short description of the alarm or problem
virtual function status enumeration
number of times an identified feature was used over the measurementInterval
disk usage of an identified virtual machine in gigabytes and/or gigabytes per second
Mobility GTP Protocol per flow metrics
average bit error rate
Average packet delay variation or jitter in milliseconds for received packets: Average difference between the packet timestamp and time received for all pairs of consecutive packets
average delivery latency
average receive throughput
average transmit throughput
duration of failed state in milliseconds, computed as the cumulative time between a failed echo request and the next following successful error request, over this reporting interval
Duration of errored state, computed as the cumulative time between a tunnel error indicator and the next following non-errored indicator, over this reporting interval
Endpoint activating the flow
Time the connection is activated in the flow (connection) being reported on, or transmission time of the first packet if activation time is not available
Integer microseconds for the start of the flow connection
time the connection is activated in the flow being reported on, or transmission time of the first packet if activation time is not available; with RFC 2822 compliant format: Sat, 13 Mar 2010 11:29:05 -0800
Endpoint deactivating the flow
Time for the start of the flow connection, in integer UTC epoch time aka UNIX time
Integer microseconds for the start of the flow connection
Transmission time of the first packet in the flow connection being reported on; with RFC 2822 compliant format: Sat, 13 Mar 2010 11:29:05 -0800
connection status at reporting time as a working / inactive / failed indicator value
Current connection state at reporting time
Current tunnel state at reporting time
array of key: value pairs where the keys are drawn from the IP Type-of-Service identifiers which range from '0' to '255', and the values are the count of packets that had those ToS identifiers in the flow
Array of unique IP Type-of-Service values observed in the flow where values range from '0' to '255'
large packet round trip time
large packet threshold being applied
Maximum packet delay variation or jitter in milliseconds for received packets: Maximum of the difference between the packet timestamp and time received for all pairs of consecutive packets
maximum receive bit rate
maximum transmit bit rate
array of key: value pairs where the keys are drawn from LTE QCI or UMTS class of service strings, and the values are the count of packets that had those strings in the flow
Array of unique LTE QCI or UMTS class-of-service values observed in the flow
Number of failed activation requests, as observed by the reporting node
number of errored bits
number of bytes received, including retransmissions
number of bytes transmitted, including retransmissions
number of received packets dropped due to errors per virtual interface
Number of Echo request path failures where failed paths are defined in 3GPP TS 29.281 sec 7.2.1 and 3GPP TS 29.060 sec. 11.2
Number of tunnel error indications where errors are defined in 3GPP TS 29.281 sec 7.3.1 and 3GPP TS 29.060 sec. 11.1
Http error count
number of tunneled layer 7 bytes received, including retransmissions
number of tunneled layer 7 bytes transmitted, excluding retransmissions
number of lost packets
number of out-of-order packets
number of errored packets
number of packets received, excluding retransmission
number of packets received, including retransmission
number of packets transmitted, including retransmissions
number of packet retries
number of packet timeouts
number of tunneled layer 7 bytes received, excluding retransmissions
round trip time
array of key: value pairs where the keys are drawn from TCP Flags and the values are the count of packets that had that TCP Flag in the flow
Array of unique TCP Flags observed in the flow
Time in milliseconds between the connection activation and first byte received
optional field block for fields specific to heartbeat events
additional heartbeat fields if needed
version of the heartbeatFields block
current heartbeat interval in seconds
enrichment fields for internal VES Event Listener service use only, not supplied by event sources
json object schema, name and other meta-information along with one or more object instances
one or more instances of the jsonObject
name of the JSON Object
json schema for the object
Url to the json schema for the object
name of the object associated with the nfSubscriptonId
identifies an openConfig telemetry subscription on a network function, which configures the network function to send complex object data associated with the jsonObject
meta-information about an instance of a jsonObject along with the actual object instance
an instance conforming to the jsonObject schema
the unix time aka epoch time associated with this objectInstance--as microseconds elapsed since 1 Jan 1970 not including leap seconds
an ordered set of keys that identifies this particular instance of jsonObject
tuple which provides the name of a key along with its value and relative order
name of the key
relative sequence or order of the key with respect to other keys
value of the key
number of counts falling within a defined latency bucket
measurementsForVfScaling fields
additional name-value-pair fields
array of named name-value-pair arrays
array of JSON objects described by name, schema and other meta-information
array of codecs in use
peak concurrent sessions for the VM or VNF over the measurementInterval
over the measurementInterval, peak total number of: users, subscribers, devices, adjacencies, etc., for the VM, or subscribers, devices, etc., for the VNF
usage of an array of CPUs
usage of an array of disks
array of features in use
filesystem usage of the VM on which the VNFC reporting the event is running
array of integers representing counts of requests whose latency in milliseconds falls within per-VNF configured ranges
mean seconds required to respond to each request for the VM on which the VNFC reporting the event is running
interval over which measurements are being reported in seconds
version of the measurementsForVfScaling block
memory usage of an array of VMs
number of media ports in use
peak rate of service requests per second to the VNF over the measurementInterval
represents busy-ness of the VNF from 0 to 100 as reported by the VNFC
usage of an array of virtual network interface cards
memory usage of an identified virtual machine
kibibytes of temporary storage for raw disk blocks
kibibytes of memory used for cache
kibibytes of memory configured in the virtual machine on which the VNFC reporting the event is running
kibibytes of physical RAM left unused by the system
the part of the slab that can be reclaimed such as caches measured in kibibytes
the part of the slab that cannot be reclaimed even when lacking memory measured in kibibytes
total memory minus the sum of free, buffered, cached and slab memory measured in kibibytes
virtual machine identifier associated with the memory metrics
mobileFlow fields
additional mobileFlow fields if needed
Application type inferred
application protocol
application protocol version
cell id
Abbreviation referencing a 3GPP reference point e.g., S1-U, S11, etc
Evolved Cell Global Id
Flow direction, indicating if the reporting node is the source of the flow or destination for the flow
GTP protocol
GTP protocol version
HTTP request header, if the flow connects to a node referenced by HTTP
IMEI for the subscriber UE used in this flow, if the flow connects to a mobile device
IMSI for the subscriber UE used in this flow, if the flow connects to a mobile device
IP protocol type e.g., TCP, UDP, RTP...
IP protocol version e.g., IPv4, IPv6
location area code
mobile country code
mobile network code
version of the mobileFlowFields block
MSISDN for the subscriber UE used in this flow, as an integer, if the flow connects to a mobile device
IP address for the other endpoint, as used for the flow being reported on
IP Port for the reporting entity, as used for the flow being reported on
Functional role of the other endpoint for the flow being reported on e.g., MME, S-GW, P-GW, PCRF...
routing area code
Radio Access Technology e.g., 2G, 3G, LTE
IP address for the reporting entity, as used for the flow being reported on
IP port for the reporting entity, as used for the flow being reported on
service area code
Integer identifier for the sampling algorithm or rule being applied in calculating the flow metrics if metrics are calculated based on a sample of packets, or 0 if no sampling is applied
transport area code
tunnel identifier
VLAN identifier used by this flow
an array of name value pairs along with a name for the array
array of name value pairs
fields for events belonging to the 'other' domain of the commonEventHeader domain enumeration
array of named name-value-pair arrays
array of JSON objects described by name, schema and other meta-information
array of name-value pairs
version of the otherFields block
standard request error data structure
Unique message identifier of the format ABCnnnn where ABC is either SVC for Service Exceptions or POL for Policy Exception
Message text, with replacement variables marked with %n, where n is an index into the list of
Hyperlink to a detailed error resource e.g., an HTML page for browser user agents
List of zero or more strings that represent the contents of the variables used by the message text
sip signaling fields
additional sip signaling fields if needed
the full SIP request/response including headers and bodies
this is the same for all events on this call
IP address on VNF
port on VNF
IP address of peer endpoint
port of peer endpoint
version of the sipSignalingFields block
the SIP Method or Response (‘INVITE’, ‘200 OK’, ‘BYE’, etc)
stateChange fields
additional stateChange fields if needed
new state of the entity
previous state of the entity
version of the stateChangeFields block
card or port name of the entity that changed state
List of specific NvPairsNames to suppress within a given Name-Value Field for event Throttling
Name of the field within which are the nvpair names to suppress
Array of nvpair names to suppress within the nvpairFieldName
sysLog fields
additional syslog fields if needed provided as name=value delimited by a pipe ‘|’ symbol, for example: 'name1=value1|name2=value2|…'
hostname of the device
type of event source; examples: other, router, switch, host, card, port, slotThreshold, portThreshold, virtualMachine, virtualNetworkFunction
numeric code from 0 to 23 for facility--see table in documentation
version of the syslogFields block
syslog message
0-192 combined severity and facility
identifies the application that originated the message
a change in the value of this field indicates a discontinuity in syslog reporting
syslog structured data consisting of a structured data Id followed by a set of key value pairs
0-32 char in format name@number for example ourSDID@32473
numerical Code for severity derived from syslogPri as remaider of syslogPri / 8
msgId indicating the type of message such as TCPOUT or TCPIN; NILVALUE should be used when no other value can be provided
IANA assigned version of the syslog protocol specification - typically 1
fields specific to threshold crossing alert events
additional threshold crossing alert fields if needed
performance counters
Event action
Unique short alert description such as IF-SHUB-ERRDROP
Event type
Calculated API value (if applicable)
List of eventIds associated with the event being reported
Time when the performance collector picked up the data; with RFC 2822 compliant format: Sat, 13 Mar 2010 11:29:05 -0800
Specific performance collector instance used
type of network element - internal ATT field
event severity or priority
Time closest to when the measurement was made; with RFC 2822 compliant format: Sat, 13 Mar 2010 11:29:05 -0800
Physical or logical port or card (if applicable)
network name - internal ATT field
Reserved for future use
version of the thresholdCrossingAlertFields block
provides vendor, vnf and vfModule identifying information
VNF vendor name
ASDC vfModuleName for the vfModule generating the event
ASDC modelName for the VNF generating the event
describes the performance and errors of an identified virtual network interface card
Cumulative count of broadcast packets received as read at the end of the measurement interval
Count of broadcast packets received within the measurement interval
Cumulative count of discarded packets received as read at the end of the measurement interval
Count of discarded packets received within the measurement interval
Cumulative count of error packets received as read at the end of the measurement interval
Count of error packets received within the measurement interval
Cumulative count of multicast packets received as read at the end of the measurement interval
Count of multicast packets received within the measurement interval
Cumulative count of octets received as read at the end of the measurement interval
Count of octets received within the measurement interval
Cumulative count of all packets received as read at the end of the measurement interval
Count of all packets received within the measurement interval
Cumulative count of unicast packets received as read at the end of the measurement interval
Count of unicast packets received within the measurement interval
Cumulative count of broadcast packets transmitted as read at the end of the measurement interval
Count of broadcast packets transmitted within the measurement interval
Cumulative count of discarded packets transmitted as read at the end of the measurement interval
Count of discarded packets transmitted within the measurement interval
Cumulative count of error packets transmitted as read at the end of the measurement interval
Count of error packets transmitted within the measurement interval
Cumulative count of multicast packets transmitted as read at the end of the measurement interval
Count of multicast packets transmitted within the measurement interval
Cumulative count of octets transmitted as read at the end of the measurement interval
Count of octets transmitted within the measurement interval
Cumulative count of all packets transmitted as read at the end of the measurement interval
Count of all packets transmitted within the measurement interval
Cumulative count of unicast packets transmitted as read at the end of the measurement interval
Count of unicast packets transmitted within the measurement interval
Indicates whether vNicPerformance values are likely inaccurate due to counter overflow or other condtions
vNic identification
provides statistics related to customer facing voice products
additional voice quality fields if needed
callee codec for the call
caller codec for the call
this is the same for all events on this call
phone number associated with the correlator
Base64 encoding of the binary RTCP data excluding Eth/IP/UDP headers
version of the voiceQualityFields block