Network Observability Workgroup

Mission Statement

The mission of the workgroup is to advance use of open source technology for building holistic observability framework with best practices encompassing network fabric, serving platform and applications. The outcome of the observability framework can be benefited by Security, AI driven network operations (AIOps), Autonomous Networks (AN) etc. This WG will create and disseminate clear, actionable blueprints and insightful white papers focused on network observability using the Linux Foundation Networking (LFN) and adjacent project ecosystems. We will achieve this by:

• Deeply analyzing existing open source projects to understand their current observability capabilities and identify opportunities for enhancement in the context of network security.

• Collaboratively defining critical network security use cases that can be significantly improved through enhanced network observability.

• Developing detailed architectural blueprints that outline how open source components can be effectively combined and extended to provide comprehensive network observability for these security use cases.

• Authoring clear and informative white papers that articulate the rationale behind our proposed architectures, discuss implementation considerations, and highlight the benefits of enhanced network observability for security.

The workgroup’s goal is to empower the networking industry with the knowledge and practical guidance needed to build and deploy robust network observability solutions that proactively address security challenges and foster a more secure networking environment.

Sample Projects to be Acquired/Inspired

Reference Articles

Workgroup members (Please sign up by adding your name)

Slack/Zoolip channel

#lfn-discussion > Network Observability Workgroup

Meeting logistics

Meeting occurs every two weeks, starting Wednesday, September 10th 2025 7AM PDT

Link to self-registration https://zoom-lfx.platform.linuxfoundation.org/meeting/97007221645?password=1f72199a-0405-4628-8943-2a950b29319b

Working Document

https://docs.google.com/document/d/1V-Ks-0SCvSK2DSs6w5rEXNxIM3UtYUEDNE4xLXeQw-0/edit?usp=sharing

Meeting Minutes - Sep 10, 2025

Attendees:

Notes:

• A network provides a service, and is comprised of components that include open source components. We can focus on how open source network components report their state. Analysis should focus on the role of OSS projects and then how they provide telemetry. A low hanging fruit could be analyzing what telemetry (logs reports, measurements) is already provided by our OSS projects.

• Observability has two sides ; Producers (of the data points; M.E.L.T) ↔︎ Consumers.

  • Consumers are the ones operationalizing the data for insights generations, corrective actions for workflows etc.

  • Consumers act upon the published/available data produced by the producers.

  • Consumers' needs may change and evolve over time, they are driven by business/operational needs.

  • Producers are defined by SDOs like 3GPP (KPIs, Counters), IETF, Opensource Project Working Groups (such as vLLM etc).

  • We can start with the consumer side, analyzing use cases and determine what observability data is required, and then analyzing how that data can be produced by the producers.

• Action-Plan (Possible):

  • Start with mapping consumer usecase ↔︎ datasets needed (what we have now and then define what needs to be added).

  • Look-at/Investigate the existing stack/abilities for observability (most of it is under CNCF) for Network, IaaS, PaaS and SaaS layers .

• We created a working document - https://docs.google.com/document/d/1V-Ks-0SCvSK2DSs6w5rEXNxIM3UtYUEDNE4xLXeQw-0/edit?usp=sharing

• Participants are requested to add their thoughts to the “topics to expand on” section at the end of the document

• We will reach out to the workgroup mailing list and TAC to solicit input.

•  

Meeting Minutes Oct 8,2025

Attendees:

Notes:

• We started mapping the stakeholders - Fatih will reach out to a few of them to join the workgroup and educate us about the existing stack in the SaaS/IT observability domain, so we can figure out which assets in our LFN community are relevant.

• We will aim to present some outcome at the Cloud Native Telco Day - https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/cloud-native-telco-day/ or, if we don’t get through the event CFP process, another LFN platform like a webinar or podcast episode

Meeting minutes October 22,2025

Notes:

• Overview of the recent Nephio observability work - Integrating OTEL with Nephio

  • Focusing on capturing information from Nephio itself

  • Dealing with challenges related to Nephio modules not providing the required interfaces for OTEL

  • Approach so far has been bottom-up, and there is no overarching architecture discussion yet.

• @Khushi Chhillar - working on observability using eBPF - https://github.com/ngkore/HEXAeBPF/tree/main

• @ Parker - RedHat Observability jamie

• Telco Day submission - @Fatih Nar will start a draft for CFP submission, @Khushi Chhillar and Jamie will contribute. (Last Submission Date for proposal : 2 nov @Fatih Nar )

•  

Meeting minutes November 5,2025

Notes:

• We can focus on defining the “conduit” for transferring the data from the source to collection points, then we can discuss processing the data and taking action, e.g. for remediation

• We need to look at it both from the projects telemetry capabilities (current and near future), but also from the system that acts on the data (O&M, FCAPS)

• @Muddasar Ahmed proposes creating an ‘objective’ document guiding projects on a common practice for generating observability data.

• @Muddasar Ahmed will reach out to @Byung-Woo Jun requesting a readout from ONAP about their existing observability capabilities

• We can focus on a 5G observability use case as described by the AI-RAN Alliance leadership (Alex Choi) - https://media.licdn.com/dms/document/media/v2/D4E1FAQGq_GBPBoad8w/feedshare-document-pdf-analyzed/B4EZokNWnyKoAY-/0/1761544076663?e=1762387200&v=beta&t=11Jwbnu-vKwRdP2-9bDoTce9WD9nvfhcYJNruWIuf0k

•  

Meeting minutes November 19,2025

Notes:

• Cloud native telco day CFP focus - ~10% of submissions are related to observability and applying AI to OTEL data

  • Assuming OTEL is the source of data, should there be a common layer that ingests OTEL data and ‘normalizes’ it for processing

  • The ONAP community created a standard for creating and emitting logs - @Muddasar Ahmed will add a link here

• ONAP Observability readout

  • ONAP had initial analysis of the relevance of L3AF for ONAP observability. There needs to be an architecture analysis in the ONAP community on how to integrate L3AF. Might become a feature in one of the ONAP sub-project.

• @Muddasar Ahmed proposes starting with a use case and generating a mindmap or similar visualization related to it - @Muddasar Ahmed might have a MITRE example he could share

• Please use the working document and Zulip topic to share material relevant to the use case analysis.

Meeting minutes December 3,2025

Notes:

• Any update on topics discussed in the last meeting

• What do we want to focus on next?

* We did not have a critical mass of participants - meeting adjourned early *