Each real problem on your network and security devices, in one sentence, with the log lines that show it.
3ER is an appliance that runs on your own hardware. It reads the logs your devices already send and writes each real problem as a sentence the whole team can follow, with the evidence attached. Nothing is sent outside your network.
A port that will not stay up
Port 2/0/17 on core-switch-03 is flapping: down and up 14 times since 02:14.
- core-switch-03port 2/0/17 went down
- core-switch-03port 2/0/17 came up
- core-switch-03port 2/0/17 went down
- core-switch-03port 2/0/17 came up
- core-switch-03port 2/0/17 went down
- and 41 more
What happened at 02:14
At 02:12 someone changes the configuration of core-switch-03 from its console. A minute and a half later, port 2/0/17 starts going down and coming back up, and two other devices begin logging about it. This is how 3ER handled that night. You can pause it, or pick any moment below.
- 02:14. The first line about port 2/0/17 arrives.
- 02:14. A Situation opens for the flapping port.
- 02:15. The configuration change made just before it is placed beside it.
- 02:16. The lines that show it are kept with it.
- 02:20. Raven is asked what changed just before, and answers with its sources.
- 07:00. The shift hands over, with the report.
An illustration made for this page, not the product screen.
What a Situation is
A Situation is one problem written as a sentence you could read to a colleague over the phone: what is wrong, where, and since when. The log lines that show it sit underneath. Repeats of the same problem fold into it, and a different problem gets a Situation of its own.
Run the same logs through 3ER twice and you get the same Situation back, word for word, with the same evidence. 3ER raises a Situation only when the log lines support it, which keeps the board short.
| Log lines read | 2,906 |
|---|---|
| Lines about port 2/0/17 on core-switch-03 | Became 1 Situation |
| Scheduled reload of wlc-2 at 02:30, marked by the team as expected | Not raised |
| Routine lines from eleven other devices | Not raised |
| On the board at 03:00 | 3 Situations |
The wording changes as better evidence arrives
The first sentence 3ER writes about a problem is often not its last. When stronger evidence arrives, a newer sentence replaces the older one and the earlier wording stays on record. Ask Raven why the conclusion changed and it lists each change and what brought it.
Earlier wording, replaced: Port 2/0/17 on core-switch-03 went down.- Port 2/0/17 on core-switch-03 is flapping: down and up 6 times in 2 minutes.
Problems you have had before
3ER files each Situation under a named kind of problem. A port that keeps flapping on a switch in one building and on a router in another are the same kind, with the same name.
Because the kind is named, its past comes with it: how often it has happened on your network, how it ended, and when it last happened on the same device.
A port that will not stay up
| On your network this quarter | 9 times |
|---|---|
| Cleared by itself | 7 of 9 |
| Last time on core-switch-03 | 12 days ago |
| Open now | 1 |
What 3ER puts beside a Situation
Open the flapping port and the configuration change made at 02:12 is already beside it, a minute and a half before the first failure. So is the last time this happened on core-switch-03: 12 days ago, one of three earlier times, and it cleared by itself after four minutes.
On the edge-router-7 Situation, 3ER names the problem on core-switch-03 as the likely source, and never more than likely: only your team can confirm a cause.
One press away, the Situations page shows what else was found at the same moment (edge-router-7 lost its routing neighbour, and dist-switch-07 saw one address on two ports), which problems keep coming back, and what your team has marked as expected, such as the scheduled reload of wlc-2, with who marked it and when.
Devices that go quiet
A device that stops logging can look the same as a device with nothing to report. 3ER keeps your devices on one list and shows which of them have gone quiet, and since when.
A quiet device stays on that list, off the board. Only when the silence comes with other signs of a problem does 3ER raise a Situation.
| Device | State | Last log |
|---|---|---|
| core-switch-03 | Reporting | 02:14:26 |
| fw-edge-2 | Reporting | 02:14:19 |
| access-switch-41 | Silent | 23:40:12 |
| wlc-2 | Reporting | 02:14:01 |
Raven explains a Situation and shows its sources
Raven is the part of 3ER you question about a Situation. You pick from the questions an operator asks about a problem, and Raven answers from that Situation's evidence. What it says about your network points to the log lines behind it, and where the evidence cannot support an answer, Raven says so.
Ask what to check, and Raven lists read-only checks in order, each with the command to run and what a healthy result looks like. It does not change anything on your devices.
Reports you can check, and a handover at the end of the shift
Raven's answers go into a PDF report that keeps its sources, so whoever reads it next can check each claim the way you did. At the end of a shift, one press writes the handover report: what opened and closed during the shift, and what is still open.
What changed just before?
At 02:12 the configuration of core-switch-03 was changed from its console[3]. A minute and a half later port 2/0/17 went down[1] and came back two seconds later[2], the first of 14 times in six minutes[4]. The change came first. On its own, that does not show it caused the failures.
Check first, read-only: the error counters on port 2/0/17, then the 02:12 change against the one before it.
- [1]02:14:03 core-switch-03 port 2/0/17 went down
- [2]02:14:05 core-switch-03 port 2/0/17 came up
- [3]02:12:31 core-switch-03 configuration changed from console
- [4]02:14:03 to 02:20:11 core-switch-03 port 2/0/17, down and up 14 times
Nothing leaves your network
3ER runs as an appliance on your own hardware and works without an internet connection or a cloud account. Raven runs inside the appliance as well. The logs, and everything 3ER writes about them, stay inside your network.
- Runs on
- Your own servers, as one appliance
- Reads
- Logs from your network and security devices
- Internet connection
- Not required
- Cloud account
- Not required
Walkthroughs are private
We show 3ER in private sessions. Tell us roughly what you run and we will suggest a date.