CN100433647C - An alarm management method and system - Google Patents

Abstract

The invention discloses an alarm management method and system. The invention sets the parent-child relationship between the alarms on the basis of analyzing the relationship between the alarms, and when the alarm is reported and processed, if there is a parent alarm, it will not be reported. The corresponding sub-alarm. Therefore, the implementation of the present invention can effectively reduce the number of alarms, and report the parent alarm to maintain the integrity of the alarm function and facilitate finding the source of the fault, thereby achieving the effect of simplification and optimization of alarms and facilitating fault diagnosis and maintenance.

Description

An alarm management method and system

technical field

The invention relates to data processing in network management, in particular to an alarm management method and system.

Background technique

The communication network is composed of various network communication devices, and each network communication device needs to work together to realize corresponding communication services. In order to ensure the normal operation of network communication equipment, it is necessary to adopt necessary maintenance methods for maintenance. Among them, the communication equipment alarm is an important maintenance method for network equipment, which is usually implemented by the regional management systems of communication equipment.

The communication equipment alarm management system mainly consists of two parts:

1. Alarm generation and reporting equipment: used to generate and report alarm information of network communication equipment; such as GPRS (General Packet Radio Service) Service Support Node SGSN, General Packet Radio Service GPRS Gateway Support Node GGSN and other communication network equipment belong to alarm generation devices, and each device will report the alarms generated to the alarm management system.

2. Alarm management system: accept alarm information reported by alarm generating and reporting equipment (such as each network element), and provide various alarm management operations to users, and at the same time, complete the function of issuing alarm management commands to each network element.

Usually, the alarm is to display the operation status of the system in a timely and intuitive manner through sound and light, etc., and provide data basis for user equipment maintenance, network optimization, business analysis and other work. The fault alarm items displayed on the alarm console are provided to the equipment maintenance personnel so that the maintenance personnel can perform corresponding maintenance operations. The alarm console is the core component of network fault management; in order to ensure the high availability of the fault alarm items, it is required The data must focus on the practicality for customers.

However, the current alarm system of network communication equipment generally has problems such as too many alarms, too high frequency, and lack of focus. Therefore, it is not conducive to the user to quickly and effectively locate the source of equipment failure, and to carry out follow-up diagnosis and maintenance work for the failure.

For this reason, it is necessary to streamline the alarms to eliminate problems such as excessive alarms and unfocused issues.

Alarm shielding is a widely used method to eliminate excessive alarms. Mask certain types of alarms through configuration. Once such alarms occur in the system, they will be blocked and not reported to users. Because all alarms are masked, it is equivalent to turning off the reporting function of such alarms. Although the number of alarms is reduced, it can no longer reflect the characteristics of certain types of system failures, which is not conducive to user maintenance of equipment.

Contents of the invention

In view of the above-mentioned problems in the prior art, the object of the present invention is to provide an alarm management method and system, which can effectively reduce the number of alarms and facilitate finding the source of the fault without losing the integrity of the alarm function.

The purpose of the present invention is achieved through the following technical solutions:

The present invention provides an alarm management method, comprising the following steps:

A. Set the relevant alarms in the network as parent alarms and corresponding child alarms according to the causal relationship between the alarms;

B. According to the correlation between the parent alarm and the corresponding child alarm, the alarm information is processed, and the alarm information is processed as follows: if the parent alarm is generated within a predetermined time after the unrecovered child alarm If generated, the correlation recovery is performed on the unrecovered sub-alarms, and the correlation recovery specifically includes: shielding the unrecovered sub-alarms due to the existence of the parent alarm.

The correlation settings of the parent alarm and the corresponding child alarm in the step A are stored in the configured storage database, and a management interface for updating it is provided.

The correlation between the parent alarm and the child alarm in the step A includes that the parent alarm will inevitably cause the corresponding child alarm, and the parent alarm includes a combined parent alarm, and the combined parent alarm is a plurality of simultaneously occurring parent alarms. Combination of alarms; when the parent alarm of the combination occurs, a child alarm must be generated.

In the present invention, when it is determined that a sub-alarm needs to be reported, if its corresponding parent alarm already exists, the sub-alarm is not reported.

In the present invention, the processing of the alarm information further includes: reporting the child alarm if the child alarm is still not recovered when the parent alarm is recovered.

In the present invention, the processing of the alarm information further includes: when the child alarm is recovered, if the parent alarm is still not recovered, reporting a child alarm recovery message.

In the present invention, if the parent alarm has not been recovered when the child alarm is restored normally, the correlation recovery of the child alarm is updated to normal recovery.

The present invention also discloses an alarm management system, which includes an alarm information receiving module and an alarm information sending module, and is characterized in that the system also includes an alarm information processing module, wherein

The alarm information processing module is used to set the relevant alarms in the received alarm information as parent alarms and corresponding child alarms according to the causal relationship between alarms;

The alarm information processing module further includes a correlation processing module, the correlation processing module is used to shield and report the alarm information according to the preset correlation of the alarm information, and the shielding of the alarm information is due to The existence of the parent alarm blocks the unrecovered child alarm.

It can be seen from the above-mentioned technical solution provided by the present invention that the present invention sets the parent-child relationship between alarms on the basis of analyzing the relationship between alarms, that is, when a parent alarm is generated, a child alarm must also be generated, and the alarm is reported for processing Sub-alarms are not reported from time to time to reduce the number of alarms, and parent alarms are reported to maintain the integrity of the alarm function and help find fault sources, thereby achieving the effect of alarm simplification and optimization, and facilitating fault diagnosis and maintenance.

The parent-child relationship between alarms can be stored in a database, and the parent alarm can be a combined parent alarm, that is, the combined parent alarm is a combination of multiple alarms. Therefore, this alarm database can contain all alarms between alarms. The parent-child relationship refers to all necessary causal relationships between alarm generation. In this way, through the analysis of the alarm correlation, only the parent alarm is reported for multiple alarms with a certain causal relationship, reducing the number of alarms reported by the device to the user, helping the user to effectively locate the fault source of the device, quickly find the parent alarm, and target the parent alarm. Alarms are used for subsequent fault diagnosis and fault maintenance, which improves the practicality of alarms and the efficiency of equipment maintenance.

In addition, the method for optimizing the network management alarm reporting process of the present invention is more complete, convenient and practical through relevant corresponding supporting measures in the alarm reporting process.

Description of drawings

Fig. 1 is a schematic diagram of the processing flow of the method of the present invention;

Fig. 2 is a schematic structural diagram of the system of the present invention.

Detailed ways

The core idea of the present invention is to set the parent-child relationship between the alarms on the basis of analyzing the relationship between the alarms, that is, to determine the correlation between the alarms, and when the alarm is reported and processed, according to the correlation. Alarm reporting processing, specifically: if the parent alarm exists, the child alarm is not reported to reduce the number of reported alarms, but only the parent alarm is reported, so as to maintain the integrity of the alarm function and help find the source of the fault, thereby achieving alarm simplification optimization purposes.

It can be seen that, in order to realize the object of the present invention, it is necessary to set a reasonable correlation between alarms in the system. In order to have a better understanding of the present invention, the correlation between the alarms in the present invention will first be analyzed below:

The alarm instances reported in the communication equipment do not exist in isolation. For example, if a failure of a bottom layer function occurs, other functions based on the function of the upper layer will not work normally, so the actual alarm instance reported to the user will have both Bottom-layer fault alarms also have upper-layer fault alarms. It can be seen that there is a causal relationship between these alarms. It is set in the present invention: if A alarm must cause B alarm, then these alarms are called correlation alarms. A alarm is the parent alarm of B alarm, and B alarm is the child of A alarm. alarm.

In actual fault location, as long as the cause of the parent alarm is analyzed and the fault is eliminated, all related alarms will be recovered. Therefore, the alarm system can analyze the correlation between alarm instances, use parent alarms to shield or restore child alarms, reduce the number of alarms reported by the system to users, and help users effectively locate the source of equipment failures.

The alarm correlation is the relationship between alarm instances. For example, if a certain link on subsystem A is disconnected, the channel established on this link will be interrupted, then there is a correlation between the link disconnection alarm a and the channel interruption alarm b on this subsystem; if the subsystem The channel on B also fails, and a channel interruption alarm c is reported. This channel interruption alarm has no correlation with the link disconnection alarm a.

Therefore, to determine whether the alarm instance is related, the specific implementation methods include:

(1) The basis for judging whether the alarm items are related:

If there is a logical correlation between the link break alarm and the channel interruption alarm, it can be considered that there is a basis for correlation between them, and there is no basis for correlation for alarm items that do not have logical correlation;

(2) Determine whether there is a logical association between the key attributes of the alarm instance:

The key attribute of the alarm instance determines which fault the alarm instance comes from. If there is a correlation basis for the alarm items corresponding to the two alarm instances and their key attributes match, it can be truly judged that there is a correlation relationship between them.

Based on the above analysis, if the alarm items with correlation basis are defined in advance, and the alarm attributes that need to be matched by the correlation are clearly defined, the correlation between alarm instances can be judged according to the defined alarm correlation rules when the alarm instance is reported. Sub-alarms are subsequently masked.

The present invention will be further described in detail below in conjunction with the accompanying drawings.

The concrete realization of method for the present invention is shown in Figure 1, comprises the following steps:

Step 100: Configure the parent-child relationship between alarms in the database, that is, configure the correlation between parent alarms and child alarms.

Setting the parent-child relationship between alarms in the database is based on the analysis of alarm correlation, and can be updated or reconfigured according to changes in the situation.

In the configuration process, if the correlation between two alarms meets the condition that when one alarm is generated, another alarm will be generated, the former alarm can be called a parent alarm, and the latter alarm can be called a child alarm.

When an alarm is generated, multiple alarms must be generated, and multiple parent-child relationships can be established;

If multiple alarms occur at the same time, another alarm must be generated, and only a many-to-one parent-child relationship can be established. At this time, the parent alarm is called a combined parent alarm; when one or more alarms in the combination do not occur at the same time , the sub-alarm does not necessarily appear. Therefore, if multiple alarms are bound to be generated when a combined parent alarm is generated, multiple many-to-one parent-child relationships can be established.

In this way, after the configuration in step 101, various inevitable causal relationships between alarms can be decomposed into one-to-one or many-to-one parent-child correspondence, and each correspondence can be conveniently stored and configured in the form of a database , and modify and update.

After configuring the parent-child relationship between alarms, they can be applied to the optimized processing of alarm reporting;

Step 101: waiting to receive a new alarm/recovery message;

Step 102: After receiving a new alarm/restoration message, it is first necessary to judge whether it is a new alarm or a recovery message. If it is a new alarm, go to step 103; otherwise, go to step 107:

Step 103: further judge whether there is an unrecovered parent alarm, if so, execute step 105, otherwise, execute step 104;

Step 104: report the alarm information normally, and execute step 105;

Step 105: Determine whether there is a time range within the previous 10 seconds (or other time ranges where the parent alarm and the child alarm can be considered to be generated at the same time or even earlier, and the 10 second time can also be adjusted according to actual needs, that is, it is not fixed at 10 seconds ) generated and not recovered sub-alarms, if yes, execute step 106, otherwise, the process ends, and re-execute step 101.

Here, it should be noted that the execution sequence of the two judgments described in step 103 and step 105 can be changed, and of course, the corresponding processing measures also change the order at the same time. In short, if there is an unrecovered parent alarm, no new alarm will be reported; if there is no unrecovered parent alarm, a new alarm will be reported normally. If there is a sub-alarm that has not been recovered within the previous 10 seconds, then perform step 106; otherwise, no special processing is required;

Step 106: Perform correlation recovery on the sub-alarm, the process ends, and execute step 101 after waiting for a new alarm/recovery message to be received again;

The correlation restoration refers to shielding the child alarm due to the existence of the parent alarm.

Step 107: If it is judged in step 104 that the received alarm is not a new alarm but an alarm recovery message, it is also necessary to determine whether the alarm corresponding to the recovery message has been reported, if yes, perform step 108, otherwise, perform step 111 ;

Step 108: Determine whether the reported corresponding alarm is in the state of correlation recovery. If yes, it indicates that the parent alarm of the corresponding alarm has not recovered after adopting correlation recovery measures, and step 109 needs to be performed; otherwise, step 110 is performed. ;

Step 109: Update the correlation recovery corresponding to the fault to normal recovery, and execute step 111;

Step 110: Report the recovery message normally, and execute step 111;

Step 111: Determine whether the sub-alarm corresponding to the alarm has not been recovered, if yes, execute step 112, otherwise, end the process, and re-execute step 101;

Here, it should be noted that the order of the two judging processes described in step 107 and step 111 can also be changed, and of course, the order of the corresponding processing measures can also be changed at the same time.

Step 112: Judging that the sub-alarm corresponding to the alarm has not been recovered, activate the sub-alarm and report the sub-alarm again.

The present invention also provides an alarm management system, as shown in Figure 2, including an alarm information receiving module for receiving alarm information, an alarm information processing module for processing alarm information, and an alarm information for reporting alarm information The sending module, at the same time, adds a correlation processing module to the system, specifically adding a correlation processing module to the alarm information processing module, which is used to respond to the alarm information according to the correlation of the preset alarm information. The specific shielding and reporting processing methods have been described above, so they will not be described in detail here.

In summary, the present invention effectively simplifies the amount of alarms reported in the network management process by analyzing the correlation of each alarm, and can ensure the reliable realization of the alarm function. maintainability.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present invention can easily think of changes or Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (8)

1, a kind of alarm management method is characterized in that, comprises the steps:

The alarm that respectively has correlation in A, the network is set to father's alarm and corresponding child alarm according to the causality between alarm respectively;

B, according to the correlation of described father alarm and corresponding child alarm, warning information is handled, described warning information is treated to: if produce in the preset time of described father alarm after the child alarm that is not resumed produces, then the described child alarm that is not resumed is carried out correlation and recover, described correlation is recovered to be specially: owing to the existence of described father's alarm the described child alarm that is not resumed is shielded.

2, alarm management method according to claim 1 is characterized in that, father's alarm and corresponding child alarm correlation setting in the described steps A are stored in the stored data base of configuration, and provide the management interface that it is upgraded.

3, alarm management method according to claim 1, it is characterized in that, father in described steps A alarm and correlation between the child alarm comprise that the father alarms and will inevitably cause corresponding child alarm, and described father's alarm comprises combination father alarm, and described combination father alarm is that a plurality of father's alarms that occur simultaneously constitute; When this combination father alarm certainly leads to child alarm when occurring.

4, alarm management method according to claim 1 is characterized in that, described warning information is handled also comprises: when determining to report child alarm, if its corresponding father alarm exists, then do not report this child alarm.

5, alarm management method according to claim 1 is characterized in that, described warning information is handled also comprises: when father's alarm clearing, if child alarm does not still recover, then report this child alarm.

6, alarm management method according to claim 1 is characterized in that, described warning information is handled also comprises: during the group alarm clearing, if father's alarm does not still recover, then report child alarm to recover message.

7, alarm management method according to claim 1 is characterized in that, described warning information is handled also comprises: if father's alarm does not also recover when child alarm normally recovers, then the correlation of child alarm is recovered to be updated to normal recovery.

8, a kind of alarm and control system comprises warning information receiver module and warning information sending module, it is characterized in that described system also comprises the warning information processing module, wherein

The warning information processing module, the alarm with correlation that is used for the warning information that will receive is set to father's alarm and corresponding child alarm respectively according to the causality between alarm;

Described warning information processing module further comprises the correlation processing module, described correlation processing module, be used for correlation according to the warning information that sets in advance, warning information is shielded and reports, described warning information is shielded is owing to the existence of described father's alarm the described child alarm that is not resumed to be shielded.

Images