ONES 2.0 details Rule Engine monitoring and Slack and Zendesk alerting

ONES 2.0 introduces a Rule Engine for network monitoring that supports device- and interface-level rule creation, severity-based alerts, and alert distribution via Slack and Zendesk. Enterprise IT and security teams can use it to standardize observability across SONiC deployments and reduce alert noise through per-metric limits.

Research Overview

The vendor describes ONES Rule Engine as an alerting and notification capability added in ONES 2.0. It is positioned around rule-driven monitoring for hardware, network metrics, and component health across multi-vendor environments running SONiC.

In the same brief, the system is described as covering monitoring metrics, enabling rule customization, and attaching detailed metadata to alerts. The vendor also includes integrations that route alerts to Slack and support tickets in Zendesk.

Key Findings

The Rule Engine enables administrators to define rules at both device and interface levels, then configure which devices are included or excluded from specific rules. Alerts can be generated with Critical or Warning severity to support prioritization.

The brief states that alerting can include a maximum number of alerts per metric on a given device to mitigate redundant notifications. It also describes alert details as including rule and metric context, plus device and interface metadata.

Technical Breakdown

The vendor lists the types of metrics covered by rules, including CPU utilization, memory utilization, PSU status, fan speed, and RX/TX. It also describes monitoring for transceiver operational values such as voltage, temperature, and power.

Rules can be created for system health thresholds, component failures (fans and PSUs), traffic monitoring with utilization and error/discard thresholds, and capacity monitoring for ASIC IPv4/IPv6 utilization. The brief also includes SONiC services monitoring, including BGP neighbor status and container CPU utilization.

Operational Impact

For alert distribution, the vendor states that Slack integration delivers alerts to designated channels. It also describes weekly Slack digests that include alert overviews and Zendesk ticket details.

For incident workflow, the vendor states that Zendesk integration automates ticket creation based on alerts. The brief further notes that each alert includes a URL that redirects users to associated visual representations, with device information such as IP address, role, region, SKU, and serial number.

Leadership Perspective

In multi-vendor SONiC operations, the vendor frames the Rule Engine as a way to create tailored alert behavior based on device characteristics such as hardware SKU, role, and OS version. This approach is described as supporting consistent monitoring while targeting alerts to specific device types.

The brief also presents the alert metadata and rule targeting as support for collaboration, with alert summaries that can be shared with teams. It concludes by positioning the capability as part of ONES 2.0 alert management across Slack and Zendesk.

The ONES 2.0 Rule Engine described in the vendor brief focuses on configurable monitoring rules with Critical/Warning alerting, per-metric alert limits, and Slack/Zendesk workflows, covering system health, component failures, traffic and ASIC capacity, transceiver metrics, and SONiC services. Blog Signals brief is a fact-based summary of the vendor blog.