Glossary

Performance Management Counters

Performance management counters are cumulative metrics on network elements that record the number of specific events, such as handover attempts or failures, which are periodically collected and analyzed for performance monitoring and anomaly detection.

Get in touch Learn more

Security analyst reviewing fraud detection AI on multiple screens, alert dashboards visible, dark mode monitoring setup.

NETWORK TELEMETRY FUNDAMENTALS

What is Performance Management Counters?

Performance Management (PM) counters are cumulative registers on network elements that tally specific events, such as handover attempts or call drops, providing the raw statistical foundation for performance monitoring and anomaly detection.

A Performance Management Counter is a discrete, cumulative metric maintained by a network element—such as a gNB, eNB, or core network function—that increments each time a specific, predefined event occurs. These counters are the atomic units of network observability, recording everything from successful Radio Resource Control (RRC) connection setups to the number of bytes transmitted on a data radio bearer. Unlike gauges that represent a fluctuating state, PM counters are strictly monotonic, providing an absolute count of occurrences over a granular measurement period, typically 5, 15, or 30 minutes.

These counters are periodically collected via protocols like gRPC streaming telemetry or legacy file transfer and analyzed by operations support systems. In the context of anomaly detection, a sudden deviation in a counter's rate of change—such as a spike in L.HO.Fail.TargetCell—serves as a primary signal for automated fault identification. By establishing baselines for counter behavior, machine learning models can distinguish between normal traffic fluctuations and genuine degradation events, enabling predictive maintenance and zero-touch network optimization without manual threshold configuration.

CUMULATIVE TELEMETRY PRIMITIVES

Key Characteristics of PM Counters

Performance Management (PM) counters are the foundational data source for network observability. Understanding their inherent characteristics is critical for designing accurate anomaly detection systems.

Cumulative Nature & Reset Logic

PM counters are strictly monotonically increasing accumulators that record the total number of events since the last reset. They do not store rates or averages directly.

Wrap-around risk: Counters have a finite bit depth (e.g., 32-bit or 64-bit) and will overflow, resetting to zero.
Scheduled resets: Many RAN vendors configure counters to reset at the end of a granularity period (e.g., 15 minutes).
Deriving metrics: The actual rate of events (e.g., handover attempts per second) must be calculated by the management system by taking the delta between two consecutive collection intervals.

Granularity Periods & Binning

Network elements aggregate counter values into fixed time windows before reporting, a process known as binning.

Standard intervals: Common granularity periods are 5, 15, or 30 minutes.
Cumulative vs. differential: A counter can be reported as a running total or as the delta specific to that interval.
Anomaly impact: A spike in call drops might be averaged out and hidden within a 15-minute bin, making sub-interval analysis or shorter granularity periods essential for detecting transient faults.

Vendor-Specific Implementations

Despite 3GPP standardization, the exact definition and triggering logic of a PM counter often varies by Original Equipment Manufacturer (OEM).

Semantic drift: A 'failed handover' counter from Vendor A might include preparation failures, while Vendor B only counts execution failures.
Counter catalogues: Each vendor provides a massive, proprietary Performance Measurement Dictionary.
Multi-vendor normalization: A critical pre-processing step for anomaly detection is mapping these disparate counters to a unified, vendor-agnostic data model to ensure consistent analysis across a heterogeneous RAN.

Protocol-Level Measurement Points

Counters are instrumented at specific points in the protocol stack, providing granular visibility into network behavior.

RRC counters: Track connection establishments, re-establishments, and releases, indicating accessibility and retainability issues.
E-RAB counters: Monitor the setup and release of radio access bearers, directly reflecting user-plane service quality.
Mobility counters: Record intra-frequency, inter-frequency, and inter-RAT handover attempts and successes, crucial for analyzing cell edge performance.
Physical layer counters: Measure HARQ retransmissions and CQI reports, providing insight into radio link quality.

Counter Relationships & KPI Formulas

Individual counters are rarely useful in isolation. Key Performance Indicators (KPIs) are derived from mathematical formulas combining multiple counters.

Success rates: (Successful Events / Total Attempts) * 100 (e.g., Call Setup Success Rate).
Drop rates: (Abnormal Releases / Total Releases) * 100 (e.g., Call Drop Rate).
Anomaly context: A drop in a success rate KPI can be caused by a rise in the numerator's failure counter, a fall in the denominator's attempt counter, or both. Root cause analysis requires examining the raw counters behind the KPI.

Data Collection: Push vs. Pull

The mechanism for retrieving PM counters from network elements significantly impacts the timeliness and reliability of anomaly detection.

Legacy pull (FTP/SFTP): The management system periodically downloads bulk files. This is high-latency and can miss counters resetting between pulls.
Streaming push (gRPC): Modern O-RAN architectures use streaming telemetry where the network element pushes structured data continuously. This enables near-real-time anomaly detection with sub-second latency.
Reliability trade-off: UDP-based streaming is faster but can lose data, while TCP-based streaming ensures delivery but may introduce back-pressure.

PERFORMANCE MANAGEMENT COUNTERS

Frequently Asked Questions

Clear, technical answers to the most common questions about the role of performance management counters in network telemetry and anomaly detection.

A Performance Management (PM) counter is a cumulative, non-resettable tally maintained by a network element (like a gNB or eNB) that records the absolute number of specific events occurring over a defined granularity period, typically 5, 15, or 30 minutes. Unlike a gauge that measures a current state, a PM counter is strictly monotonic; it only increments. For example, a counter might record the total number of RRC.ConnectionSetup.Attempts or IntraFreq.Handover.Failures. The raw counter value is periodically collected by a management system, and the difference between consecutive samples is calculated to derive a rate or volume for that interval. This mechanism provides a loss-tolerant, highly scalable method for quantifying network behavior, as a missed sample does not invalidate the next calculation, only the specific interval's delta.

Enabling Efficiency, Speed & Accuracy

Intelligent Analysis, Decision & Execution

We build AI systems for teams that need search across company data, workflow automation across tools, or AI features inside products and internal software.

Talk to Us

Search across company data

Give teams answers from docs, tickets, runbooks, and product data with sources and permissions.

Useful when people spend too long searching or get different answers from different systems.

Enterprise searchRAGPermissions

Automate internal workflows

Use AI to route work, draft outputs, trigger actions, and keep approvals and logs in place.

Useful when repetitive work moves across multiple tools and teams.

AI agentsWorkflow automationGovernance

Add AI to products and internal tools

Build assistants, guided actions, or decision support into the software your team or customers already use.

Useful when AI needs to be part of the product, not a separate tool.

AI integrationDecision supportModel routing

PERFORMANCE MANAGEMENT ECOSYSTEM

Related Terms

Explore the foundational concepts, collection protocols, and analytical methods that form the complete lifecycle of performance management counter data in modern telecommunications networks.

Network Telemetry

The automated process of collecting measurements and status data from remote network devices. Modern telemetry uses streaming protocols like gRPC to push data continuously, replacing legacy polling methods.

Push-based collection: Devices stream counters at configurable intervals
Structured data: Uses protocols like GPB (Google Protocol Buffers) for compact encoding
Key advantage: Enables sub-second granularity for anomaly detection vs. 15-minute legacy polling

EXPLORE

KPI Anomaly Detection

The specific application of anomaly detection algorithms to Key Performance Indicators derived from performance counters. This process automatically identifies service degradation in a telecommunications network.

Derived KPIs: Call drop rate = (dropped calls / total calls) from counter ratios
Dynamic baselines: Algorithms learn normal diurnal patterns per cell
Correlated anomalies: A spike in RRC connection failures often correlates with a drop in E-RAB setup success rate

Time-Series Anomaly Detection

The identification of unexpected patterns within a sequence of time-ordered counter observations. Performance counters are inherently time-series data, making this the primary analytical approach.

Seasonal decomposition: Separates counter data into trend, weekly/daily seasonality, and residual noise
LSTM models: Learn long-term dependencies in sequential counter data to predict expected values
Residual analysis: Anomalies are flagged when actual counter values deviate significantly from the predicted range

Change Point Detection

The process of identifying abrupt shifts in the underlying generative process of a time series. In RAN performance management, this corresponds to a system state change or fault.

Mean shift: A sudden, sustained increase in handover failure counters after a configuration change
Variance change: Increased volatility in PRB utilization counters indicating instability
Real-time application: Detecting a cell outage within seconds by identifying a sudden drop to zero across multiple activity counters

Root Cause Analysis (RCA)

A systematic problem-solving method used to identify the fundamental origin of a fault flagged by anomalous counters. RCA moves beyond symptoms to pinpoint the underlying cause within a complex system like a RAN.

Topology-aware: Correlates counters across neighboring cells to distinguish a localized fault from a wider outage
Counter dependency mapping: A failure in X2 handover counters may trace back to an S1 link issue
Automated RCA: AI models ingest thousands of counters simultaneously to isolate the root cause in minutes, not hours

Data Drift

A change in the distribution of input data features over time, which can cause a previously well-performing anomaly detection model to degrade. Performance counter distributions shift naturally with network evolution.

Traffic growth: Gradual increase in mean PDCP volume counters as user data consumption rises
Reconfiguration events: A new carrier addition fundamentally changes the expected range of PRB utilization counters
Mitigation: Continuous monitoring of counter distributions and periodic model retraining are required to maintain detection accuracy

About the author

Prasad Kumkar

CEO & MD, Inference Systems

Prasad Kumkar is the CEO & MD of Inference Systems and writes about AI systems architecture, LLM infrastructure, model serving, evaluation, and production deployment. Over 5+ years, he has worked across computer vision models, L5 autonomous vehicle systems, and LLM research, with a focus on taking complex AI ideas into real-world engineering systems.

His work and writing cover AI systems, large language models, AI agents, multimodal systems, autonomous systems, inference optimization, RAG, evaluation, and production AI engineering.

Limited slotsGet a Free AI Consultation

How We Work

Custom AI workflows for your Business

One-fit-all AI don't work for modern businesses. At Inferensys, we aim to understand your business & custom requirements; which we use to define most efficient agentic workflows, the data, and the tools for your business.