To monitor the subscriber in the SMF, use the following CLI command:

monitor subscriber [ capture-duration duration  | gr-instance gr_instance_id  | imei imei_id | imsi imsi_value | internal-messages [ yes ] | namespace [ sgw | smf ] | nf-service [ sgw | smf ] | supi supi_id | transaction-logs [ yes ] ] 

NOTES:

• capture-duration duration : Specify the duration in seconds during which monitor subscriber is enabled. The default value is 300 seconds (5 minutes). This is an optional parameter.

• gr-instance gr_instance_id : Specify the GR instance ID. The instance ID 1 denotes the local instance ID.

• imei imei_id : Specify the subscriber IMEI. For example: 123456789012345, *

• imsi imsi_value : Specify the subscriber IMSI. For example: 123456789, *

• internal-messages [ yes ] : Enable internal messages when set to yes . By default, it is disabled. This is an optional parameter.

• namespace [ sgw | smf ] : Enable the specified namespace. By default, namespace is set to none. This is an optional parameter.

  Important

  This keyword is deprecated in release 2021.02.0 and replaced with nf-service keyword.

• nf-service [ sgw | smf ] : Enable the specified NF service. By default, nf-service is set to none.

  Important

  The nf-service keyword replaces the namespace keyword in release 2021.02 and beyond.

• supi supi_id : Specify the subscriber identifier. For example: imsi-123456789, imsi-123*

• transaction-logs [ yes ] : Enable transaction logs when set to yes . By default, it is disabled. This is an optional parameter.

  To view the transaction history logs, use the dump transactionhistory command.

  Note	The most recent transaction logs are stored in a circular queue of size 1024 transaction logs.

The monitor subscriber CLI command can be run simultaneously on multiple terminals. For example, run the CLI simultaneously in two SMF Ops Center terminals for two subscribers (for example, imsi-123456789012345 and imsi-456780123456789) to implement the following:

• Monitor the duration when the monitor subscriber is enabled

• View internal messages for the specified subscriber

• View transaction logs for the specified subscriber

Terminal 1: The following command monitors and displays subscriber messages for the specified subscriber.

monitor subscriber supi imsi-123456789012345 capture-duration 1000 internal-messages yes

Terminal 2: The following command monitors and displays transaction logs for the specified subscriber.

monitor subscriber supi imsi-456780123456789 capture-duration 500 internal-messages yes transaction-logs yes

After the capture duration is completed, stop the CLI by using the Ctrl+C keys. The captured messages are reordered and stored in a file. To retrieve the list of stored files, use the monitor subscriber list CLI command.

For example:

monitor subscriber list
RELEASE_NAMESPACE: 'smf'
'monsublogs/subscriberID_imsi-*_AT_2019-10-22T09:19:05.586237087.txt.sorted'
monsublogs/subscriberID_imsi-123456789012345_AT_2019-10-22T09:20:11.122225534.txt.sorted

To view the sorted file on the SMF Ops Center screen, use the following CLI command:

monitor subscriber dump filename filename 

For example:

monitor subscriber dump filename monsublogs/subscriberID_imsi-123456789012345_AT_2019-10-22T09:20:11.122225534.txt.sorted

To monitor the interface protocol on the SMF, use the following CLI command:

monitor protocol { interface interface_name [ capture-duration duration  | gr-instancegr_instance | pcacp yes | | ] | list [ | ] }  

Warning

Use the monitor protocol interface command cautiously, as it may disrupt user services. When used in a live network, it can cause session delays, call drops, and degrade system performance.

Note

interface interface_name —Specify the interface name on which PCAP is captured. This CLI allows the configuration of multiple interface names in a single CLI command. capture-duration duration —Specify the duration in seconds during which pcap is captured. The default is 300 seconds (5 minutes). The configured interface names can be retrieved using the show endpoint CLI command. gr-instance gr_instance_id —Specify the GR instance ID. The instance ID 1 denotes the local instance ID. pcap yes —Configure this option to enable PCAP file generation. By default, this option is disabled. list —Monitor protocol list files.

Important

The monitor protocol command in Exec mode is restricted based on pod's CPU utilization configured through monitor protocol cpu-limit threshold_percentage command in the Global Configuration mode.

The monitor protocol CLI can be run simultaneously on multiple terminals. Also, the interface interface_name CLI allows the configuration of multiple endpoint names in a single CLI command.

For example:

monitor protocol interface sbi,N4:209.165.200.241:8805,gtpc capture-duration 1000 

Use the following configuration to enable UPF Monitor Subscriber from SMF.

config 
    monitor nf subscriber  [ gpsi gpsi_value |imei imei_id|imsiimsi_value control { true | false }  data { true | false } target-nf { sgwu | upf } ] 
    end 

NOTES:

• monitor nf —Specify the NF that you want to monitor.

• gpsi gpsi_value —Specify the subscriber GPSI.

• imsi imsi_value —Specify the subscriber IMSI. For example: 123456789, *

• imei imei_id —Specify the subscriber IMEI. For example: 123456789012345, *

• control { true | false } —Specify whether to enable or disable the control event tracing.

• data { true | false } —Specify whether to enable or disable the data event tracing.

• target-nf { sgwu | upf } —Specify the target NF as SGW-U or UPF. target-nf is an optional parameter and if an operator doesn't configure this parameter, monitor subscriber is enabled on both the UPF and SGW-U.

Configuration Example

The following is an example configuration.

[smf] smf(config)# monitor nf subscriber
   imsi 234150999999999
      control true
      data true 
      target-nf upf 
exit

Use the following configuration to disable UPF Monitor Subscriber from SMF.

config 
    [ no ]monitor nf subscriber  [ gpsi gpsi_value |imei imei_id | imsiimsi_value ] 
    end 

NOTES:

• monitor nf —Specify the NF that you want to monitor.

• gpsi gpsi_value —Specify the subscriber GPSI.

• imsi imsi_value —Specify the subscriber IMSI. For example: 123456789, *

• imei imei_id —Specify the subscriber IMEI. For example: 123456789012345, *

Use the following sample configuration to configure alerts related to the 4G PDN Modify procedure:

alerts rules group SMFPDN 
   interval-seconds 300 
   rule SMFPDNModify 
   expression “sum(smf_service_stats{procedure_type=~\”pdn_ho_location_changed| pdn_ho_rat_type_changed|pdn_inter_sgw_handover|pdn_mbr\” , status=\“success\”})/sum(smf_service_stats{procedure_type=~ \”pdn_ho_location_changed|pdn_ho_rat_type_changed |pdn_inter_sgw_handover|pdn_mbr\” , status=\“attempted\”}) < 0.95” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 4G PDN Modify is below threshold” 
   exit 
exit 

Use the following sample configuration to configure alerts related to the 4G PDN Release Success procedure:

alerts rules group SMFPDN 
   interval-seconds 300 
   rule SMFPDNRelease 
   expression “sum(smf_service_stats{procedure_type=~\“.*pdn_sess_rel\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=~\“.*pdn_sess_rel\” , status=\“attempted\”} < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 4G PDN Release is below threshold.” 
   exit 
exit 

Use the following sample configuration to configure alerts related to the 4G PDN Setup Success procedure:

alerts rules group SMFPDN 
   interval-seconds 300 
   rule SMFPDNSetup 
   expression “sum(smf_service_stats{procedure_type=\”pdn_sess_create\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=\”pdn_sess_create\” , status=\“attempted\”} < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 4G PDN Setup is below threshold.” 
   exit 
exit 

Use the following configuration to configure alerts related to the 4G to 5G HO Success procedure:

alerts rules group Handover 
   interval-seconds 300 
   rule 4gTo5gHOSuccess 
   expression “sum(smf_service_stats{procedure_type=~\“n26_4g_to_5g_handover|n26_4g_to_5g_im_mobility\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=~\“n26_4g_to_5g_handover|n26_4g_to_5g_im_mobility\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 4G to 5G HO is below threshold.” 
   exit 
exit 

Use the following configuration to configure alerts related to the 4G to WiFi HO Success procedure:

alerts rules group Handover 
   interval-seconds 300 
   rule 4GtoWifiHOSuccess 
   expression “sum(smf_service_stats{procedure_type=\”enb_to_untrusted_wifi_handover\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=\“enb_to_untrusted_wifi_handover\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N4 responses sent is lesser than 95 %." 
   exit 
exit 

Use the following configuration to configure alerts related to the 5G N2 HO Success procedure:

alerts rules group Handover 
   interval-seconds 300 
   rule N2HOSuccess 
   expression “sum(smf_service_stats{procedure_type=\“n2_handover\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=\“n2_handover\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 5G N2 HO is below threshold.” 
   exit 
exit 

Use the following configuration to configure alerts related to the 5G PDU Idle Success procedure:

alerts rules group SMFPDU 
   interval-seconds 300 
   rule SMFPDUIdleSuccess 
   expression “sum(smf_service_stats{procedure_type=~\“.*idle\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=~\“.*idle\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 5G PDU Idle is below threshold” 
   exit 
exit 

Use the following configuration to configure alerts related to the 5G PDU Modify Success procedure:

alerts rules group SMFPDU 
   interval-seconds 300 
   rule SMFSessionModifySuccess 
   expression “sum(smf_service_stats{procedure_type=~\“.*pdu_sess_mod\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=~\“.*pdu_sess_mod\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 5G PDU Modify is below threshold” 
   exit 
exit 

Use the following configuration to configure alerts related to the 5G PDU Release Success procedure.

alerts rules group SMFPDU 
   interval-seconds 300 
   rule SMFSessionReleaseFailure 
   expression “sum(smf_service_stats{procedure_type=~\“.*pdu_sess_rel\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=~\“.*pdu_sess_rel\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 5G PDU Setup is below threshold” 
   exit 
exit 

Use the following configuration to configure alerts related to the 5G PDU Setup Success procedure:

alerts rules group SMFPDU 
   interval-seconds 300 
   rule SMFSessionSetupFailure 
   expression “sum(smf_service_stats{procedure_type=\”pdu_sess_create\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=\”pdu_sess_create\” , status=\“attempted\”} < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when failed to setup sessions is more than 5%” 
   exit 
exit 

Use the following configuration to configure alerts related to the 5G to 4G HO Success procedure:

alerts rules group Handover 
   interval-seconds 300 
   rule 5gTo4gHOSuccess 
   expression “sum(smf_service_stats{procedure_type=~\“pdn_5g_4g_handover |pdn_5g_4g_handover_dft|eps_fb_5g_4g_handover_dft|eps_fb_5g_4g_handover_idft |pdn_5g_4g_handover_idft\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=~\“pdn_5g_4g_handover  |pdn_5g_4g_handover_dft|eps_fb_5g_4g_handover_dft| eps_fb_5g_4g_handover_idft|pdn_5g_4g_handover_idft\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 5G to 4G HO is below threshold.” 
   exit 
exit 

Use the following sample configuration to configure alerts related to the 5G to WiFi HO Success procedure:

alerts rules group Handover 
   interval-seconds 300 
   rule 5GtoWifiHOSuccess 
   expression “sum(smf_service_stats{procedure_type=\”nr_to_untrusted_wifi_handover\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=\“nr_to_untrusted_wifi_handover\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N4 responses sent is lesser than 95 %." 
   exit 
exit 

Use the following sample configuration to configure alerts related to the 5G Xn HO Success procedure:

alerts rules group Handover 
   interval-seconds 300 
   rule XnHOSuccess 
   expression “sum(smf_service_stats{procedure_type=\“xn_handover\” , status=\“success\”}) / sum(smf_service_stats{procedure_type=\“xn_handover\” , status=\“attempted\”}) < 0.95 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage successful 5G Xn HO is below threshold.” 
   exit 
exit 

Use the following sample configuration to configure alerts related to the PDN Session Create procedure.

alerts rules group SMFProcStatus 
   interval-seconds 300 
   rule PDNSessCreate 
   expression "sum(increase(smf_service_stats{app_name=\"SMF\",procedure_type=  /\"pdn_sess_create\",status=\"success\”}[5m])) / sum(increase(smf_service_stats{app_name=\"SMF\  /",procedure_type=\"pdn_sess_create\",status=\"  /attempted\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the success percentage of pdn_sess_create procedure is lesser threshold.” 
   exit 
exit 

Use the following sample configuration to configure alerts related to the PDU Session Create procedure.

alerts rules group SMFProcStatus 
   interval-seconds 300 
   rule PDUSessCreate 
   expression "sum(increase(smf_service_stats{app_name=\"SMF\",procedure_type=  /\"pdu_sess_create\",status=\"success\”}[5m]))sum  /(increase(smf_service_stats{app_name=\"SMF\",  /procedure_type=\"pdu_sess_create\",status=\  /"attempted\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the success percentage of pdu_sess_create procedure is lesser threshold.” 
   exit 
exit 

Use the following sample configuration to configure alerts related to the PDU Session Modify procedure.

alerts rules group SMFProcStatus 
   interval-seconds 300 
   rule PDUSessModify 
   expression "sum(increase(smf_service_stats{app_name=\"SMF\",procedure_type=~\".  /*req_pdu_sess_mod\",status=\"success\”}[5m]))sum(increase  /(smf_service_stats{app_name=\"SMF\",procedure_type=~  /\”.*req_pdu_sess_mod\",status=\"attempted\”}[5m]))  / < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the success percentage of req_pdu_sess_mod procedure is lesser threshold.” 
   exit 
exit 

Use the following sample configuration to configure alerts related to the PDU Session Release procedure:

alerts rules group SMFProcStatus 
   interval-seconds 300 
   rule PDUSessRelease 
   expression "sum(increase(smf_service_stats{app_name=\"SMF\",procedure_type=~\".*req_pdu_sess_rel\",status=\  /"success\”}[5m]))sum(increase(smf_service_stats{app_name=\"SMF  /\",procedure_type=~\”.*req_pdu_sess_rel\",status=\  /"attempted\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the success percentage of req_pdu_sess_rel procedure is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to the GTPC Peer Down procedure.

alerts rules group GTPCPeerDown 
   interval-seconds 300 
   rule GTPCPeerDown 
   expression nodemgr_gtpc_peer_status{gtpc_peer_status=\“gtpc_peer_path_down\”}) 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired when the GTPC Path failure detected for peer crosses threshold” 
   exit 
exit 

Use the following commands to configure alerts related to the N4 Message Success procedure.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN4MessageSuccess 
   expression "sum(protocol_udp_res_msg_total{message_direction=\"inbound\", status=\”accepted\”}) / sum(protocol_udp_res_msg_total{message_direction=\"inbound\”, status=~\”accepted|denied\”}) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N4 responses sent is lesser than 95 %." 
   exit 
exit 

Use the following commands to configure alerts related to the N4 UPF Association Down query by N4 address.

alerts rules group N4Association 
   interval-seconds 300 
   rule SMFAssociationRelease 
   expression ”proto_udp_res_msg_total{procedure_type=\“n4_association_release_res\”, message_direction= \“inbound\”, status=\“accepted\”}) ” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired when the N4 Association with UPF is released” 
   exit 
exit 

Use the following commands to configure alerts related to the N4 UPF Association Up query by N4 address.

alerts rules group N4Association 
   interval-seconds 300 
   rule N4AssociationUP 
   expression ”proto_udp_res_msg_total{procedure_type=\“n4_association_setup_res\”, message_direction= \“inbound\”, status=\“accepted\”}” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired when the N4 Association with UPF is established” 
   exit 
exit 

Use the following commands to configure alerts related to an outbound N7 interface.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN7Outbound 
   expression "sum(increase(smf_restep_http_msg_total{nf_type=\"pcf\", message_direction=\"outbound\", response_status=~\”2..\”}[5m])) /  sum(increase(smf_restep_http_msg_total{nf_type=\"pcf\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N7 responses received is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to an inbound N7 interface.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN7Inbound 
   expression "sum(increase(smf_restep_http_msg_total{nf_type=\"pcf\", message_direction=\"inbound\", response_status=~\”2..\”}[5m])) /  sum(increase(smf_restep_http_msg_total{nf_type=\"pcf\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N7 responses sent is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to the N7 Message Timed Out procedure.

alerts rules group MessageTimeout 
   interval-seconds 300 
   rule SMFN7Timeout 
   expression ”sum(irate(smf_restep_http_msg_total{nf_type=\“pcf\”, message_direction=\”inbound\”, response_status=\”504\”}[5m])) > 5” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired when the increase in timeout for N7 messages toward PCF crosses threshold” 
   exit 
exit 

Use the following commands to configure alerts related to the N10 interface.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN10 
   expression "sum(increase(smf_restep_http_msg_total{nf_type=\"udm\", message_direction=\"outbound\", response_status=~\”2..\”}[5m])) /  sum(increase(smf_restep_http_msg_total{nf_type=\"udm\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N10 responses received is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to an inbound N11 interface.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN11Inbound 
   expression "sum(increase(smf_restep_http_msg_total{nf_type=\"amf\", message_direction=\"inbound\", response_status=~\”2..\”}[5m])) /  sum(increase(smf_restep_http_msg_total{nf_type=\"amf\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N11 responses sent is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to an outbound N11 interface.

alerts rules group SMFSvcStatus 
   interval-seconds 60 
   rule SMFN11Outbound 
   expression "sum(increase(smf_restep_http_msg_total{nf_type=\"amf\", message_direction=\"outbound\", response_status=~\”2..\”}[5m])) /  sum(increase(smf_restep_http_msg_total{nf_type=\"amf\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N11 responses received is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to the N11 Message Timed Out procedure.

alerts rules group MessageTimeout 
   interval-seconds 300 
   rule SMFN40Timeout 
   expression ”sum(irate(smf_restep_http_msg_total{nf_type=\“chf\”, message_direction=\”inbound\”, response_status=\”504\”}[5m])) > 5” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired when the increase in timeout for N11 messages toward AMF crosses threshold” 
   exit 
exit 

Use the following commands to configure alerts related to an inbound N40 interface.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN40Inbound 
   expression "sum(increase(smf_restep_http_msg_total{nf_type=\"chf\", message_direction=\"inbound\", response_status=~\”2..\”}[5m])) /  sum(increase(smf_restep_http_msg_total{nf_type=\"chf\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N40 responses sent is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to an outbound N40 interface.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN40Outbound 
   expression "sum(increase(smf_restep_http_msg_total{nf_type=\"chf\", message_direction=\"outbound\", response_status=~\”2..\”}[5m])) /  sum(increase(smf_restep_http_msg_total{nf_type=\"chf\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N40 responses received is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to the N40 Message Timed Out procedure.

alerts rules group MessageTimeout 
   interval-seconds 300 
   rule SMFN11Timeout 
   expression ”sum(irate(smf_restep_http_msg_total{nf_type=\“chf\”, message_direction=\”inbound\”, response_status=\”504\”}[5m])) > 5” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired the increase in timeout for N40 messages toward CHF crosses threshold” 
   exit 
exit 

Use the following commands to configure alerts related to the NRF Discovery procedure.

alerts rules group NRF 
   interval-seconds 300 
   rule NRFDiscovery 
   expression “sum(nf_discover_messages_total{result=~\”success|failure\”,svc_name=\”nnrf-disc\”, service_name=\”smf-rest-ep\”}) < 0.95” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of N4 responses sent is lesser than 95 %." 
   exit 
exit 

Use the following commands to configure alerts related to the SMF Service Start procedure.

alerts rules group SMFService 
   interval-seconds 300 
   rule SMFServiceStart 
   expression “irate(outgoing_response_msg_total{msg_type=\”NrfNfmRegistration\”}[5m])” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when SMF-Service starts upon registration with NRF” 
   exit 
exit 

Use the following commands to configure alerts related to the IP Pool used procedure.

alerts rules group IPPool 
   interval-seconds 300 
   rule IPPool 
   expression “sum(IPAM_address_allocations_current) > THRESHOLD” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired when the percentage IP pool addresses used is above the threshold” 
   exit 
exit 

Use the following commands to configure alerts related to N11 SM Create.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN11Success 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"amf_create_sm_context\", message_direction=\"inbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"amf_create_sm_context\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of amf_create_sm_context responses sent is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to N11 SM Update.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN11Update 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"amf_update_sm_context\", message_direction=\"inbound\", response_status=\"200\"}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"amf_update_sm_context\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of amf_update_sm_context responses sent is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to N11 SM Release.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN11Release 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"amf_release_sm_context\", message_direction=\"inbound\", response_status=\"204\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"amf_release_sm_context\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of amf_release_sm_context responses sent is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to N1 N2 Message Transfer.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN1N2Transfer 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"amf_n1_n2_transfer\", message_direction=\"outbound\", response_status=\"200\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"amf_n1_n2_transfer\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of amf_n1_n2_transfer responses received is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to N11 EBI Assignment.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN11EBI 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"amf_assign_ebi\", message_direction=\"outbound\", response_status=\"200\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"amf_assign_ebi\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of amf_assign_ebi responses received is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to N11 SM Status Notify.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN11StatusNotify 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"amf_status_notify\", message_direction=\"outbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"amf_status_notify\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of amf_status_notify responses received is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to N11 SM Context Retrieve.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN11ContextRetrieve 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"amf_retrieve_sm_context\", message_direction=\"inbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"amf_retrieve_sm_context\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of amf_retrieve_sm_context responses sent is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to N7 SM Policy Create.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN7PolicyCreate 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_create\", message_direction=\"outbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_create\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of pcf_sm_policy_control_create responses received is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to N7 SM Policy Update.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN7PolicyUpdate 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_update\", message_direction=\"outbound\", response_status=\"200\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_update\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of pcf_sm_policy_control_update responses received is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to N7 SM Policy Delete.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN7PolicyDelete 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_delete\", message_direction=\"outbound\", response_status=\"204\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_delete\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of pcf_sm_policy_control_delete responses received is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to N7 SM Policy Notify Update.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN7PolicyUpdateNotify 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_update_notify\", message_direction=\"inbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_update_notify\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of pcf_sm_policy_control_update_notify responses sent is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to N7 SM Policy Terminate.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN7PolicyTerminateNotify 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_terminate_notify\", message_direction=\"inbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"pcf_sm_policy_control_terminate_notify\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of pcf_sm_policy_control_terminate_notify responses sent is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to N10 UE Register.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN10UERegister 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"register_ue\", message_direction=\"outbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"register_ue\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of register_ue responses received is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to N10 UE DeRegister.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN10UEDeRegister 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"deregister_ue\", message_direction=\"outbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"deregister_ue\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of deregister_ue responses received is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to N10 Subscription Fetch.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN10SubscriptionFetch 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"subscription_req\", message_direction=\"outbound\", response_status=\"200\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"subscription_req\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of subscription_req responses received is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to N10 Subscribe for Notification.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN10SubscriptionNotification 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"sdm_subscription_req\", message_direction=\"outbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"sdm_subscription_req\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of sdm_subscription_req responses received is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to N10 Charging Data Request.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN10ChargingRequest 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"chf_charging_data_request\", message_direction=\"outbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"chf_charging_data_request\", message_direction=\"outbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of chf_charging_data_request responses received is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to N10 Charging Data Notify.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFN10ChargingDataNotify 
   expression "sum(increase(smf_restep_http_msg_total{api_name=\"chf_abort_notify\", message_direction=\"inbound\", response_status=\"201\”}[5m])) /  sum(increase(smf_restep_http_msg_total{api_name=\"chf_abort_notify\", message_direction=\"inbound\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of chf_abort_notify responses sent is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to addition of dynamic PCC rules.

alerts rules group SMFPolicyStatus 
   interval-seconds 300 
   rule AddPCCRule 
   expression "sum(increase(policy_dynamic_pcc_rules_total{app_name=\"SMF\",event=\"success\",operation=\"install\”}[5m]))  / sum(increase(policy_dynamic_pcc_rules_total{app_name=\"SMF\",event=\"attempted\",operation=\"install\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of successful addition of dynamic pcc rules is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to modification of dynamic PCC rules.

alerts rules group SMFPolicyStatus 
   interval-seconds 300 
   rule ModifyPCCRule 
   expression "sum(increase(policy_dynamic_pcc_rules_total{app_name=\"SMF\",event=\"success\",operation=\"modify\”}[5m]))  / sum(increase(policy_dynamic_pcc_rules_total{app_name=\"SMF\",event=\"attempted\",operation=\"modify\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of successful modification of dynamic pcc rules is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to removal of dynamic PCC rules.

alerts rules group SMFPolicyStatus 
   interval-seconds 300 
   rule RemovePCCRule 
   expression "sum(increase(policy_dynamic_pcc_rules_total{app_name=\"SMF\",event=\"success\",operation=\"remove\”}[5m]))  / sum(increase(policy_dynamic_pcc_rules_total{app_name=\"SMF\",event=\"attempted\",operation=\"remove\”}[5m])) < 0.95" 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the percentage of successful removal of dynamic pcc rules is lesser threshold.” 
   exit 
exit 

Use the following commands to configure alerts related to the SMF Overload procedure.

alerts rules group SMFSvcStatus 
   interval-seconds 300 
   rule SMFOverload 
   expression “sum by (component) (system_overload_status) == true” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when increase in events not processed due to system overload” 
   exit 
exit 

Use the following commands to configure alerts related to the Session Release Rate procedure.

alerts rules group SMFSession 
   interval-seconds 300 
   rule SMFSessionReleaseRate 
   expression “sum(rate(smf_service_stats{procedure_type=~\“.*pdu_sess_rel|.*pdn_sess_rel\” , status=\“attempted\”}[5m])) >  THRESHOLD ” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired when the session release rate exceeds the threshold” 
   exit 
exit 

Use the following commands to configure alerts related to the Session Setup Failure procedure.

alerts rules group SMFSession 
   interval-seconds 300 
   rule SMFSessionSetupFailure 
   expression “sum(smf_service_stats{procedure_type=~\”pdu_sess_create|pdn_sess_create\” , status=\“failures\”}) / sum(smf_service_stats{procedure_type=\”pdu_sess_create|pdn_sess_create\” , status=\“attempted\”}) >  0.05 “ 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when failed to setup sessions is more than 5%” 
   exit 
exit 

Use the following commands to configure alerts related to the Session Setup Rate procedure.

alerts rules group SMFSession 
   interval-seconds 300 
   rule SMFSessionSetupRate 
   expression “sum(rate(smf_service_stats{procedure_type=~\”pdu_sess_create|pdn_sess_create\” , status=\“attempted\”}[5m]))>  THRESHOLD ” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value “This alert is fired when the session setup rate exceeds the threshold” 
   exit 
exit 

Use the following commands to configure alerts related to the Subscriber Limit procedure.

alerts rules group SMFSession 
   interval-seconds 300 
   rule SMFSubscriberLimit 
   expression “sum(smf_session_counters{pdu_type=~\”ipv4v6|ipv4|ipv6\”}) > THRESHOLD” 
   severity major 
   type "Communications Alarm" 
   annotation summary 
   value "This alert is fired when the max number of subscribers is more  
   than the threshold” 
   exit 
exit 

Files that are generated using the monitor subscriber command, monitor protocol command, and transaction logs are stored in the OAM pod. The files that are generated in OAM pod are collected and stored in an internal Apache server. You can view and download the files by using a web browser, after user authentication.

Note	Use the same credentials as ops-center to authenticate user access to the files present in the oam-pod and edr-monitor pod using a browser.

The files are created in separate folders, as and when their respective commands are executed. You can download the following OAM and EDR pod files:

• Monitor subscriber files: These files are generated using the monitor subscriber CLI option to trace messages that are related to a specified subscriber. The files that are generated for the monitor protocol command are present in the monsublogs/ directory.

• Monitor protocol files: These files are using the monitor protocol CLI option to capture packets on a specific interface provided under the CLI command. The files that are generated for the monitor protocol command are present in monprologs/ directory.

• Transaction logs: When transaction logging is enabled, the transaction logs are sent to oam-pod and can be downloaded from there. The files generated for transaction logging when enabled and are present in the transactionlogs/ directory.

• EDR files: These files are generated in smf service pod and periodically copied to edr-monitor pod. The files are available in /edr directory.

SMF supports the following log levels:

• Debug—This level is used to get detailed messages about the application operations and events, such as variable values, function calls, and interactions between components. This information is useful during the development and debugging of an application.

• Info—This level is used for providing a high-level information on the progress of an application. These messages are less detailed than the debug messages and are used to confirm if an application is functioning as expected. This level is used to log application milestones, such as the start and completion of significant tasks, configuration settings, or the successful completion of operations.

The following table lists the procedures, pods, and interfaces for the supported logging on SMF.