CN100450008C - Processing method of communication network warning and relatively analysis management device - Google Patents
Processing method of communication network warning and relatively analysis management device Download PDFInfo
- Publication number
- CN100450008C CN100450008C CNB021456690A CN02145669A CN100450008C CN 100450008 C CN100450008 C CN 100450008C CN B021456690 A CNB021456690 A CN B021456690A CN 02145669 A CN02145669 A CN 02145669A CN 100450008 C CN100450008 C CN 100450008C
- Authority
- CN
- China
- Prior art keywords
- alarm
- analyzed
- warning
- buffer memory
- correlation analysis
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Lifetime
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0604—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
- H04L41/0622—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time based on time
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0677—Localisation of faults
Abstract
The present invention provides a processing method of communication network warning and a correlation analysis manager. The warning processing method of the present invention comprises the following steps: 1, searing warning to be analyzed; 2, carrying out analysis for the warning to be analyzed according to correlation rules; 3, eliminating relevant network warning according to correlation analysis results. The warning correlation analysis manager of the present invention comprises a receiving interface used for receiving searched warning to be analyzed, an output interface used for outputting analysis results, a warning data buffer memory used for storing warning to be analyzed and the analysis result, and a work area used for analyzing the warning. In transmission network management systems, the present invention can reduce warning network storms, be convenient for users to quickly position root warning, eliminate warning and provide basis for subsequent warning diagnostic functions.
Description
Technical field
The present invention relates to a kind of processing method of network failure alarm and be used for the correlation analysis manager.
Background technology
Communication network is made up of a plurality of equipment, this communication equipment can send the alarm notification network management unit when break down in equipment self or inside, so that redistribute route, avoid using the link or the communication equipment that break down, and fault is repaired for network.The same with other networks, communication network can be divided into a plurality of VLAN, comprises a plurality of equipment among the VLAN again, and each equipment room is with broadcast mode communication, and all devices in same VLAN sends information, and the communication between devices among the different VLAN then needs to pass through switch.As seen, above-mentioned alarm relevant devices and switch in by network are reported in the process of network management unit layer by layer will produce a large amount of warning information, comprise that the propagation that produces in source alarm that faulty equipment sends and the communication process alarms, thereby formation alarm windstorm, not only bandwidth consumed also influences network work efficient, therefore need carry out correlation analysis to these warning information, eliminates and propagates alarm, the root information that rapid fault location causes, better guides user is fixed a breakdown.A kind of alarm removing method that is used for light transmitting device is arranged at present: judge according to pre-set Alarm ID whether detected alarm is the source alarm, if the source alarm is then determined according to network configuration and is eliminated the propagation that is caused by the source alarm and alarm on network, promptly retrieve the next network element of the direction of propagation, and then eliminate the propagation alarm on the network element according to the direction of propagation of source alarm.Because during communication between devices, relevant information is driven in the packet, as source address, destination address and failure-description etc., therefore can judge according to the address in the alarm whether node or position that alarm takes place meet the direction of propagation in the network.In brief, the characteristics of prior art are to alarm the network element of searching on the alarm propagation direction according to the source earlier, eliminate or shield the propagation alarm on these network elements then.
Along with the renewal day by day of transmission equipment, on-line apparatus is increasing, and the number of report and alarm is also more and more, and there is very big defective in above-mentioned processing method on versatility and autgmentability, reports different alarms to be difficult to unified the processing to different equipment.
Summary of the invention
For versatility and the scaling concern that solves prior art, the invention provides a kind of processing method and correlation analysis manager of network alarm.
Method of the present invention may further comprise the steps: A. searches for alarm to be analyzed; B. according to the correlation analysis rule alarm to be analyzed is analyzed; C. eliminate relevant alarm according to analysis result.
Step B comprises: B1. puts into the correlation analysis manager with described alarm to be analyzed; B2. read in the correlation analysis rule; The alarm that B3. will meet the correlation analysis rule is stamped Shield Flag and with the serial number of the source alarm source Alarm Sequence Number as this alarm;
B4. export analysis result.B1 comprises service area and the buffer memory of described alarm to be analyzed being put into simultaneously the correlation analysis manager; Step B2 and B3 finish in the service area; Step B4 bag is exported with the data in the buffer memory analysis result input-buffer after to be analyzed the finishing as analysis result.
Described correlation analysis rule is stored in the analysis rule knowledge base, comprises the primitive rule knowledge base and expands rule-based knowledge base; Described alarm to be analyzed surpasses setting-up time and then exports as analysis result in buffer memory; Described correlation analysis per second carries out once.
Alert analysis manager of the present invention comprises:
Receiving interface is used to receive the alarm to be analyzed that searches;
The alarm data buffer memory links to each other with receiving interface, is used to store alarm to be analyzed and analysis result; The service area links to each other with the alarm data buffer memory, is used for storing the warning information that shines upon mutually with the data of alarm data buffer memory;
Analysis engine links to each other with the service area with the alarm data buffer memory, is used for correlation analysis is carried out in alarm to be analyzed, analysis result is imported in the alarm data buffer memory then;
Output interface links to each other with the alarm data buffer memory, is used for the analysis result of outputting alarm metadata cache.
In order to control the life period of alarm in buffer memory, but described manager also comprises the interface that a per second triggers.
The present invention sets up the correlation analysis rule according to the relation between the alarm of transmission equipment, by alarm is analyzed, eliminate alarm according to analysis result, can report different alarms to unify to handle to different equipment, can prevent that not only fault message from spreading unchecked, the person of going into fault location is rapidly safeguarded in convenient help, and has stronger versatility and autgmentability.Association rules is deposited in the knowledge base, be convenient to user's maintenance and expansion.
Description of drawings
Fig. 1 is an alarming processing flow chart of the present invention.
Fig. 2 is a coherency management device schematic diagram of the present invention.
Embodiment
Design of the present invention is to look for alarm (comprise the source alarm and propagate alarm) earlier, judges whether the alarm that searches exists correlative relationship, and the non-root alarm that will meet association rules marks, and eliminates alarm according to mark then again.
Specify below in conjunction with embodiment.
As shown in Figure 1, the present invention can adopt dynamic analysing method to orient the relation of alarm, determines the source alarm, eliminates and propagates alarm.Be specially:
Step 1: the alarm information in the search network.
Step 2: in the alarm buffer memory to be analyzed and service area that will search.
Data in buffer memory and the service area are mapping relations.
Step 3: read in the correlation analysis rule.
The correlation analysis rule is stored in the analysis rule knowledge base, comprises the primitive rule knowledge base and the storehouse that expands knowledge.
Step 4: judge that whether the alarm to be analyzed in the buffer memory surpasses setting-up time, if overtime then should alarm and export as analysis result; If do not have overtime then enter step 5.
The analytic process of present embodiment adopts dynamical fashion, the alarm per second analysis that is about to collect once, because the object number that the disposal ability of correlation analysis is subjected to need in the service area to analyze influences, and relevant alarm time of origin should be close, so, when dynamic analysis, only need the inhibition relation of processing time span between an alarm in more among a small circle.In realization, the life period of just alarming in the alarm buffer memory (also being the time analyzed in the correlation analysis manager) is a less fixed value, when the time of alarm to be analyzed in buffer memory surpasses this fixed value, should alarm and export as analysis result.Consider the mechanism of production of alarm, and the empirical data of existing system, this value is decided to be 5 seconds.This problem can in regularly driving, be exported overtime alarm record by increasing a timestamp to each the bar alarm record in the buffer memory as analysis result.Step 5: correlation analysis is carried out to alarm to be analyzed in the service area.
If find an alarm B who does not have a conductively-closed and source alarm A network element dependency relation, professional opposite end relation or professional upstream and downstream relation are arranged, then B is stamped Shield Flag, the serial number of A is composed source Alarm Sequence Number to B.
Step 6: analysis result input-buffer.
Step 7: judging whether alarm to be analyzed in the buffer memory is analyzed finishes, if do not finish then get back to step 3 and continue to handle; If analysis finishes then enters step 8.
Step 8: the analysis result in the output buffers.
Step 9: eliminate the propagation alarm according to analysis result.
Above-mentioned dynamic analysis function can be opened or closed by user's decision.
Accompanying drawing 2 is depicted as the schematic diagram of correlation analysis manager among the present invention.The external interface of correlation analysis manager mainly contains two, receives the interface of alarm to be analyzed and the interface of outputting alarm analysis result (loading of diagnostic rule can be thought correlation analysis management self characteristics).Consider the simplification of realization, the dtd of the input and output of two interfaces can be become identical, so in the correlation analysis manager, just can set up the buffer memory of an alarm data, data in it and the correlation analysis manager service area are relations of a mapping, all alarms to be analyzed of coming in from input interface all are placed into the alarm buffer memory and (also have been placed in the correlation analysis manager service area simultaneously), analyze by analysis engine, if alarm to be analyzed meets association rules, revise the attribute of alarm, with the serial number of source alarm root serial number, and analysis result is saved in the buffer memory as shielded alarms.When the alarm in the service area all analyze finish after, the data in the buffer memory are exported as analysis result.
Because dynamic analysis needs the alarm in the per second analysis buffer memory, so for dynamic correlation analysis manager, export outside two interfaces except alarming input and result, but the interface that also needs to provide a per second to trigger is controlled the life period of alarm in buffer memory.
Claims (10)
1 one kinds of communication network alert processing methods is characterized in that: said method comprising the steps of: A. searches for alarm to be analyzed; B. according to the correlation analysis rule correlation analysis is carried out in alarm to be analyzed; C. eliminate relevant alarm according to analysis result.
2. communication network alert processing method, it is characterized in that: said method comprising the steps of: A. searches for alarm to be analyzed;
B1. the correlation analysis manager is put in described alarm to be analyzed;
B2. read in the correlation analysis rule;
The alarm that B3. will meet the correlation analysis rule is stamped Shield Flag and with the serial number of the source alarm source Alarm Sequence Number as this alarm;
B4. export analysis result;
C. eliminate relevant alarm according to analysis result.
3. communication network alert processing method as claimed in claim 2, it is characterized in that: step B1 is specially: service area and the buffer memory of described alarm to be analyzed being put into simultaneously the correlation analysis manager.
4. communication network alert processing method as claimed in claim 2 is characterized in that: described correlation analysis rule is stored in the analysis rule knowledge base.
5. communication network alert processing method as claimed in claim 3 is characterized in that: step B2 and B3 finish in the service area.
6. communication network alert processing method as claimed in claim 5, it is characterized in that: step B4 comprises: with the analysis result input-buffer, after to be analyzed the finishing the data in the buffer memory are exported as analysis result.
7. communication network alert processing method as claimed in claim 6 is characterized in that: described alarm to be analyzed surpasses setting-up time and then exports as analysis result in buffer memory.
8. as claim 2,3,4,5,6 or 7 described communication network alert processing methods, it is characterized in that: described correlation analysis per second carries out once.
9. communication network alarm correlation analysis manager, it is characterized in that: described correlation analysis manager comprises:
Receiving interface is used to receive the alarm to be analyzed that searches;
The alarm data buffer memory links to each other with described receiving interface, is used to store alarm to be analyzed and analysis result;
The service area links to each other with the alarm data buffer memory, is used for storing the warning information that shines upon mutually with the data of alarm data buffer memory;
Analysis engine links to each other with the service area with the alarm data buffer memory, is used for correlation analysis is carried out in alarm to be analyzed, analysis result is imported in the alarm data buffer memory then;
Output interface links to each other with the alarm data buffer memory, is used for the analysis result of outputting alarm metadata cache.
10. communication network alarm correlation analysis manager as claimed in claim 9 is characterized in that: described manager also comprises the interface that a per second triggers, and is used for controlling the life period of alarm at buffer memory.
Priority Applications (3)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB021456690A CN100450008C (en) | 2002-10-22 | 2002-10-22 | Processing method of communication network warning and relatively analysis management device |
| AU2003280535A AU2003280535A1 (en) | 2002-10-22 | 2003-10-21 | The method of processing alarm in the communicate network and a relativity analysis manager |
| PCT/CN2003/000884 WO2004039004A1 (en) | 2002-10-22 | 2003-10-21 | The method of processing alarm in the communicate network and a relativity analysis manager |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB021456690A CN100450008C (en) | 2002-10-22 | 2002-10-22 | Processing method of communication network warning and relatively analysis management device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN1492624A CN1492624A (en) | 2004-04-28 |
| CN100450008C true CN100450008C (en) | 2009-01-07 |
Family
ID=32111544
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CNB021456690A Expired - Lifetime CN100450008C (en) | 2002-10-22 | 2002-10-22 | Processing method of communication network warning and relatively analysis management device |
Country Status (3)
| Country | Link |
|---|---|
| CN (1) | CN100450008C (en) |
| AU (1) | AU2003280535A1 (en) |
| WO (1) | WO2004039004A1 (en) |
Families Citing this family (30)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1309217C (en) * | 2004-05-14 | 2007-04-04 | 中国联合通信有限公司 | A fault positioning method and equipment for communication network |
| CN100375435C (en) * | 2004-06-22 | 2008-03-12 | 中兴通讯股份有限公司 | Alarm correlation analysis of light synchronous transmitting net |
| CN101069445B (en) * | 2004-11-29 | 2010-11-10 | 艾利森电话股份有限公司 | Service alarm correlation |
| CN1863025B (en) * | 2005-05-09 | 2011-04-20 | 中兴通讯股份有限公司 | Method and system for processing damage in WDM system |
| CN100438429C (en) * | 2005-05-31 | 2008-11-26 | 华为技术有限公司 | Method for treating relativity of alarm based on parent-child relationship |
| CN100384147C (en) * | 2005-07-05 | 2008-04-23 | 上海华为技术有限公司 | Alarm reporting method |
| CN100433647C (en) * | 2005-10-20 | 2008-11-12 | 华为技术有限公司 | Warning managing method and system |
| CN100382509C (en) * | 2005-11-28 | 2008-04-16 | 华为技术有限公司 | Fault positioning method in wireless network |
| CN1992636B (en) * | 2005-12-29 | 2010-04-21 | 华为技术有限公司 | System and method for processing warning information |
| CN101009518B (en) | 2006-01-23 | 2011-11-16 | 华为技术有限公司 | Processing method of the failure relevancy monitoring for serial connection at different levels |
| CN101102217B (en) * | 2006-07-07 | 2010-06-09 | 中兴通讯股份有限公司 | Processing method for duplicate alert and discontinuous reporting and monitoring in telecom network management system |
| CN101159617B (en) * | 2007-11-22 | 2010-06-16 | 中国电信股份有限公司 | Two dimensional fault management method and system of combining whole network and whole service |
| CN101222742B (en) * | 2007-11-22 | 2010-12-01 | 中国移动通信集团山东有限公司 | Alarm self-positioning and self-processing method and system for mobile communication network guard system |
| CN101257694B (en) * | 2007-11-22 | 2012-11-07 | 中国移动通信集团山东有限公司 | Mobile communication network managing intelligent sending method based on information support system |
| CN101212367B (en) * | 2007-12-25 | 2010-06-30 | 北京亿阳信通软件研究院有限公司 | Alarm message processing method and device |
| CN101217408B (en) * | 2008-01-17 | 2010-12-08 | 中兴通讯股份有限公司 | A processing system on all-round failure pertinence treatment system and the corresponding processing method |
| CN101222360B (en) * | 2008-01-22 | 2012-09-05 | 中兴通讯股份有限公司 | Regulation engine system and method for establishing alarm regulation association |
| ATE489810T1 (en) * | 2008-04-08 | 2010-12-15 | Tieto Oyj | DYNAMIC FAULT ANALYSIS FOR A CENTRALLY MANAGED NETWORK ELEMENT IN A TELECOMMUNICATIONS SYSTEM |
| US8091573B2 (en) | 2008-04-17 | 2012-01-10 | Bp Corporation North America Inc. | Pipeline intervention |
| CN102111788A (en) * | 2009-12-29 | 2011-06-29 | 中兴通讯股份有限公司 | Alarm processing method and alarm management system |
| CN101916499B (en) * | 2010-08-12 | 2012-05-30 | 深圳市共济科技有限公司 | Intelligent alarm device and intelligent alarm method |
| CN102377595B (en) * | 2010-08-20 | 2015-08-19 | 中兴通讯股份有限公司 | A kind of fault alarming method, system and device |
| CN101908981B (en) * | 2010-09-03 | 2012-07-25 | 烽火通信科技股份有限公司 | Method for shielding and uniformly processing alarm and performance data |
| CN102571407A (en) * | 2010-12-30 | 2012-07-11 | 中国移动通信集团河北有限公司 | Alarm correlation analysis method and device |
| CN102158355B (en) * | 2011-03-11 | 2013-08-14 | 广州蓝科科技股份有限公司 | Log event correlation analysis method and device capable of concurrent and interrupted analysis |
| CN103220173B (en) * | 2013-04-09 | 2015-10-21 | 北京搜狐新媒体信息技术有限公司 | A kind of alarm monitoring method and supervisory control system |
| CN104243192B (en) * | 2013-06-17 | 2017-11-10 | 北京神州泰岳软件股份有限公司 | Fault handling method and system |
| CN108206757B (en) * | 2016-12-20 | 2020-12-18 | 中国移动通信集团广东有限公司 | Wireless transmission fault alarm processing method and device |
| CN108234189B (en) * | 2016-12-22 | 2021-10-08 | 北京神州泰岳软件股份有限公司 | Alarm data processing method and device |
| WO2024026852A1 (en) * | 2022-08-05 | 2024-02-08 | Nokia Shanghai Bell Co., Ltd. | Task specific measurment input optimization |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5309448A (en) * | 1992-01-03 | 1994-05-03 | International Business Machines Corporation | Methods and systems for alarm correlation and fault localization in communication networks |
| US6000045A (en) * | 1996-05-28 | 1999-12-07 | Cabletron Systems, Inc. | Method and apparatus for inter-domain alarm correlation |
Family Cites Families (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO1994019912A1 (en) * | 1993-02-23 | 1994-09-01 | British Telecommunications Public Limited Company | Event correlation |
| AU688652B2 (en) * | 1994-12-23 | 1998-03-12 | British Telecommunications Public Limited Company | Fault monitoring |
| ES2207722T3 (en) * | 1996-11-13 | 2004-06-01 | British Telecommunications Public Limited Company | ERROR MANAGEMENT SYSTEM FOR A TELECOMMUNICATIONS NETWORK. |
| JPH11170326A (en) * | 1997-12-15 | 1999-06-29 | Fanuc Ltd | Alarm analyzing method of injection molder and analyzing device. |
| US6604208B1 (en) * | 2000-04-07 | 2003-08-05 | Telefonaktiebolaget Lm Ericsson (Publ) | Incremental alarm correlation method and apparatus |
| DE10035966A1 (en) * | 2000-07-24 | 2002-02-21 | Siemens Ag | Interference suppression procedure for a higher-level NMC by correlating alarms with results of automatic tests |
-
2002
- 2002-10-22 CN CNB021456690A patent/CN100450008C/en not_active Expired - Lifetime
-
2003
- 2003-10-21 WO PCT/CN2003/000884 patent/WO2004039004A1/en not_active Application Discontinuation
- 2003-10-21 AU AU2003280535A patent/AU2003280535A1/en not_active Abandoned
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5309448A (en) * | 1992-01-03 | 1994-05-03 | International Business Machines Corporation | Methods and systems for alarm correlation and fault localization in communication networks |
| US6000045A (en) * | 1996-05-28 | 1999-12-07 | Cabletron Systems, Inc. | Method and apparatus for inter-domain alarm correlation |
Non-Patent Citations (5)
| Title |
|---|
| . . |
| 电信网络告警中的关联规则改进算法. 邹东升，程代杰.微电子学与计算机，第18卷第5期. 2001 |
| 电信网络告警中的关联规则改进算法. 邹东升，程代杰. 微电子学与计算机，第18卷第5期. 2001 * |
| 通信网络中的告警相关性研究. 郑庆国，吕卫锋.计算机工程与应用，第38卷第2期. 2002 |
| 通信网络中的告警相关性研究. 郑庆国，吕卫锋. 计算机工程与应用，第38卷第2期. 2002 * |
Also Published As
| Publication number | Publication date |
|---|---|
| AU2003280535A1 (en) | 2004-05-13 |
| CN1492624A (en) | 2004-04-28 |
| WO2004039004A1 (en) | 2004-05-06 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN100450008C (en) | Processing method of communication network warning and relatively analysis management device | |
| CN105488610B (en) | Fault real-time analysis and diagnosis method for power application system | |
| CN100589418C (en) | The generation method and the generation system of alarm correlation rule | |
| JP4509904B2 (en) | Network security equipment | |
| CN108039957B (en) | Intelligent analysis system for complex network traffic packet | |
| CN110505102B (en) | Power information communication fusion monitoring and service standardization management platform system and method | |
| CN111162949A (en) | Interface monitoring method based on Java byte code embedding technology | |
| CN101335643B (en) | Method and apparatus for SDH equipment alarm correlativity analysis | |
| CN101808351B (en) | Method and system for business impact analysis | |
| CN107612779B (en) | Secondary safety protection network equipment of dispatching data network and service operation monitoring system | |
| US9210057B2 (en) | Cross-cutting event correlation | |
| EP0650302A2 (en) | Data analysis and event prediction in a telecommunications network | |
| CN104574557A (en) | Alarm-based site polling method, alarm-based site polling manipulation device and alarm-based site polling system | |
| CN101789899A (en) | Network service quality analysis method and system | |
| CN104243192B (en) | Fault handling method and system | |
| CN111542083A (en) | Method for collecting and analyzing through industrial wireless network air interface | |
| CN106878038A (en) | Fault Locating Method and device in a kind of communication network | |
| CN102111788A (en) | Alarm processing method and alarm management system | |
| CN109032904A (en) | Monitored, management server and data acquisition, analysis method and management system | |
| Cybenko et al. | The foundations of information push and pull | |
| CN106789158A (en) | Damage identification method and system are insured in a kind of cloud service | |
| CN110413434A (en) | The abnormality recognition method and device of server | |
| CN109818795A (en) | The failure analysis methods and system that a kind of IN service dynamic is switched | |
| Devitt et al. | Topographical proximity for mining network alarm data | |
| JPH09307550A (en) | Network system monitoring device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CX01 | Expiry of patent term | ||
| CX01 | Expiry of patent term |
Granted publication date: 20090107 |