告警消息的处理方法及装置 技术领域 本发明涉及通信领域， 具体而言， 涉及一种告警消息的处理方法及装置。 背景技术 在电信系统中， 设备的故障管理是系统可维护性的重要组成部分。 当系统设备出 现故障或者出现异常时， 设备就会上报告警信息， 方便维护人员能及时的定位问题解 决故障。 告警信息从网元产生， 网元接收该告警消息， 最后， 由网元上报的相应的网 元管理系统（Element Management System, 简称为 EMS)， 维护人员从 EMS上获得网 元的告警信息， 从而尽快地定位和排除故障。 目前电信系统中告警信息的上报方式一般是网元一产生告警立即上报给 EMS。正 常情况下， 这种机制可以使操作维护人员及时地了解故障的发生和恢复。 但是在一些 特殊的情况下，会出现一些特殊的故障，这些故障在很短的时间内不停的发生和恢复， 从而在短时间内不停的上报告警和恢复。 这种短时内大量产生告警和告警恢复消息会 给系统带来很大的负荷， 特别是在业务高峰期， 会占有过多的系统资源， 从而影响系 统的运行效率。 发明内容 本发明实施例提供了一种告警消息的处理方法及装置， 以至少解决相关技术中， 由于短时内大量产生告警和告警恢复消息会给系统带来很大的负荷， 占有过多的系统 资源， 从而影响系统的运行效率的问题。 根据本发明实施例的一个方面， 提供了一种告警消息的处理方法， 包括： 判断在 预定时间段内是否收到需要上报的告警消息对应的告警恢复消息； 在所述预定时间段 内未收到所述告警恢复消息的情况下， 将所述告警消息上报。 优选地， 判断在预定时间段内是否收到需要上报的告警消息对应的告警恢复消息 包括： 产生所述告警消息的网元判断所述告警消息的告警属性是否设置了告警延时； 如果是， 则将所述告警延时设定为所述预定时间段， 并判断在所述预定时间段内是否 收到告警恢复消息。
优选地， 判断在预定时间段内是否收到告警恢复消息包括： 在所述告警延时内， 所述网元的定时器定时检测是否收到所述告警恢复消息； 如果否， 则将所述告警延时 减去所述定时器触发一次检测所需的时间得到新的告警延时； 将所述预定时间段更新 为所述新的告警延时，继续在更新后的预定时间段内判断是否收到所述告警恢复消息。 优选地， 所述方法还包括： 当所述告警消息的告警延时减至为零之前收到所述告 警恢复消息， 则清除所述告警消息。 优选地， 所述方法还包括： 如果所述告警属性未设置告警延时， 则直接向所述网 管上报所述告警消息。 优选地， 所述方法还包括： 所述网元按照各个所述告警消息的优先级对所述告警 消息进行处理。 优选地， 判断在预定时间段内是否收到告警恢复消息之前， 还包括： 所述网元判 断在预定时间内是否存在上报次数大于第一预设次数且恢复次数大于第二预设次数的 告警消息； 如果是， 则在所述告警消息的告警属性中设置所述告警延时。 根据本发明实施例的另一方面， 提供了一种告警消息的处理装置， 包括： 第一判 断模块， 设置为判断在预定时间段内是否收到需要上报的告警消息对应的告警恢复消 息； 上报模块， 设置为在所述预定时间段内未收到所述告警恢复消息的情况下， 将所 述告警消息上报。 优选地， 所述第一判断模块包括： 判断单元， 设置为判断所述告警消息的告警属 性是否设置了告警延时； 设置单元， 设置为在所述告警消息的告警属性设置了所述告 警延时的情况下， 将所述告警延时设定为所述预定时间段， 并判断在所述预定时间段 内是否收到告警恢复消息。 优选地， 所述装置还包括： 第二判断模块， 设置为判断在预定时间内是否存在上 报次数大于第一预设次数且恢复次数大于第二预设次数的告警消息； 设置模块， 设置 为在存在上报次数大于第一预设次数且恢复次数大于第二预设次数的告警消息的情况 下， 在所述告警消息的告警属性中设置所述告警延时。 本发明实施例采用了如下方法： 在预定时间段内判断是否收到需要上报的告警消 息的恢复消息， 如果没有收到告警恢复消息， 则才将该告警消息进行上报。 通过运用 本发明实施例， 在存在频繁告警且随即又恢复的告警消息进行了处理， 解决了由于短 时内大量产生告警和告警恢复消息会给系统带来很大的负荷， 占有过多的系统资源，
从而影响系统的运行效率的问题， 进而减少了占用的系统资源， 提升了系统的运行效 率。 附图说明 此处所说明的附图用来提供对本发明实施例的进一步理解，构成本申请的一部分， 本发明的示意性实施例及其说明用于解释本发明， 并不构成对本发明的不当限定。 在 附图中- 图 1是根据本发明实施例的告警消息的处理方法的流程图； 图 2是根据本发明优选实施例实例一的告警消息的处理方法的流程图； 图 3是根据本发明优选实施例实例二的定时器消息处理的流程图； 图 4是根据本发明实施例的告警消息的处理装置的结构框图一； 图 5是根据本发明实施例的告警消息的处理装置的第一判断模块的结构框图； 以 及 图 6是根据本发明实施例的告警消息的处理装置的结构框图二。 具体实施方式 下文中将参考附图并结合实施例来详细说明本发明实施例。 需要说明的是， 在不 冲突的情况下， 本申请中的实施例及实施例中的特征可以相互组合。 基于相关技术中由于短时内大量产生告警和告警恢复消息会给系统带来很大的负 荷， 占有过多的系统资源， 从而影响系统的运行效率的问题， 本发明实施例提供了一 种告警消息的处理方法， 该方法的流程如图 1所示， 包括步骤 S102至步骤 S104: 步骤 S102，判断在预定时间段内是否收到需要上报的告警消息对应的告警恢复消 息； 步骤 S104， 在预定时间段内未收到告警恢复消息的情况下， 将该告警消息上报。 本发明实施例采用了如下方法： 在预定时间段内判断是否收到需要上报的告警消 息的恢复消息， 如果没有收到告警恢复消息， 则才将该告警消息进行上报。 通过运用 本实施例， 在存在频繁告警且随即又恢复的告警消息进行了处理， 解决了由于短时内
大量产生告警和告警恢复消息会给系统带来很大的负荷， 占有过多的系统资源， 从而 影响系统的运行效率的问题， 进而减少了占用的系统资源， 提升了系统的运行效率。 由于不同问题的出现会产生不同种类的告警消息， 例如， 设备真正出现故障产生 的告警消息， 由于灵敏度较高导致产生的告警消息等。 因此， 在判断在预定时间段内 是否收到告警恢复消息之前， 还可以选择对不同的告警消息进行不同的设置， 例如， 对频繁上报和恢复的告警消息设置告警延时， 对没有频繁上报或即使频繁上报但没有 频繁恢复的告警消息不设置告警延时。 对频繁上报和恢复的告警消息设置告警延时， 可以是网元判断在预定时间内是否 存在上报次数大于第一预设次数且恢复次数大于第二预设次数的告警消息； 如果存在 这样的告警消息， 则在告警消息的告警属性中设置告警延时。 实施过程中， 第一预设 次数与第二预设次数可以相同， 也可以不同， 例如， 设置预定时间为 10分钟， 第一预 设次数与第二预设次数同时为 20次， 则如果同一告警消息在 10分钟内上报和恢复的 次数都大于 20次， 则设置该告警消息的告警属性，将其属性设置为具有告警延时的属 性。 设置的方式可以是在没有该告警延时属性的选项时增加该选项， 也可以是在有该 告警延时的属性选项时， 通过 0和 1来设置其关闭和开启。 在步骤 S102的执行过程中，判断在预定时间段内是否收到需要上报的告警消息对 应的告警恢复消息的过程可以如下： 产生告警消息的网元判断告警消息的告警属性是 否设置了告警延时； 如果设置了告警延时， 则将告警延时设定为预定时间段， 并判断 在预定时间段内是否收到告警恢复消息。 实施时， 在告警延时内， 网元的定时器定时检测是否收到告警恢复消息； 如果没 有收到告警恢复消息， 则将告警延时减去定时器触发一次检测所需的时间得到新的告 警延时； 将预定时间段更新为新的告警延时， 继续在更新后的预定时间段内判断是否 收到告警恢复消息， 继续检测是否收到告警恢复消息。 如果当告警消息的告警延时减 至为零之前收到告警恢复消息， 则清除告警消息。 如果当告警消息的告警延时减至为 零之时仍未收到告警恢复消息， 则将该告警消息上报至网管。 实施过程中， 如果告警属性未设置告警延时（也可能是设置了未开启的状态）， 则 说明该告警消息不属于频繁上报和恢复的告警消息， 直接向网管上报告警消息。 在上述步骤执行的过程中，网元按照各个告警消息的优先级对告警消息进行处理。 例如， A告警消息相对于 B告警消息更重要， 则可以设置 A告警消息的优先级高于 B 告警消息， 则在对告警消息进行处理时， 即使 B告警消息先于 A告警消息产生， 也先 对 A告警消息进行处理。
实施时， 还可以设置一个告警缓存池来存放上述告警消息。 则在告警缓存池中， 可以由多个告警消息， 在对多个告警消息进行处理时， 可以按照告警消息的优先级进 行处理。 本实施例通过上述方法对告警消息进行特殊处理， 来有效的减少系统负荷， 同时 也有利于操作维护人员筛选告警信息进行处理。 下面结合优选实施例对上述实施方式进行说明。 优选实施例 本优选实施例提供了一种告警消息上报的方法， 可以有效的处理短时内频繁上报 的告警信息， 即让操作维护人员了解到系统有该告警， 又不至于在短时间内产生过多 的告警。 该优选实施例的告警消息上报的方法包括步骤： The present invention relates to the field of communications, and in particular to a method and apparatus for processing an alert message. BACKGROUND OF THE INVENTION In telecommunications systems, fault management of equipment is an important component of system maintainability. When the system equipment fails or an abnormality occurs, the device will report the alarm information, which is convenient for the maintenance personnel to locate the problem in time to solve the problem. The alarm information is generated from the network element, and the network element receives the alarm message. Finally, the corresponding element management system (Element Management System, EMS for short) is reported by the network element, and the maintenance personnel obtains the alarm information of the network element from the EMS. Locate and troubleshoot as quickly as possible. At present, the alarm information is reported to the EMS in the telecommunication system. Under normal circumstances, this mechanism enables operators and maintenance personnel to understand the occurrence and recovery of faults in a timely manner. However, in some special cases, there will be some special faults, which will occur and recover in a short period of time, so that the alarm and recovery will be reported in a short time. Such a large number of alarms and alarm recovery messages generated in a short period of time will bring a great load to the system, especially in the peak period of the business, which will occupy too much system resources, thereby affecting the operating efficiency of the system. SUMMARY OF THE INVENTION The embodiments of the present invention provide a method and a device for processing an alarm message, so as to at least solve the related art, because a large number of alarms and alarm recovery messages are generated in a short period of time, the system will bring a large load and occupy too much System resources, which affect the efficiency of the system. According to an aspect of the present invention, a method for processing an alarm message is provided, including: determining whether an alarm recovery message corresponding to an alarm message to be reported is received within a predetermined time period; The alarm message is reported to the alarm recovery message. Preferably, the determining, by the network element that generates the alarm message, whether the alarm attribute of the alarm message is set is an alarm delay; if yes, And setting the alarm delay to the predetermined time period, and determining whether an alarm recovery message is received within the predetermined time period. Preferably, determining whether the alarm recovery message is received within a predetermined time period comprises: in the alarm delay, the timer of the network element periodically detects whether the alarm recovery message is received; if not, the The alarm delay is subtracted from the time required for the timer to trigger a detection to obtain a new alarm delay; the predetermined time period is updated to the new alarm delay, and the determination is continued within the updated predetermined time period. The alarm recovery message is received. Preferably, the method further includes: when the alarm recovery message is received before the alarm delay of the alarm message is reduced to zero, the alarm message is cleared. Preferably, the method further includes: if the alarm attribute does not set an alarm delay, directly reporting the alarm message to the network management. Preferably, the method further includes: the network element processing the alarm message according to a priority of each of the alarm messages. Preferably, before determining whether the alarm recovery message is received in the predetermined time period, the method further includes: determining, by the network element, whether the number of times of reporting is greater than the first preset number of times and the number of times of recovery is greater than the second preset number of times The message; if yes, the alarm delay is set in the alarm attribute of the alarm message. According to another aspect of the present invention, an apparatus for processing an alarm message is provided, including: a first determining module, configured to determine whether an alarm recovery message corresponding to an alarm message that needs to be reported is received within a predetermined time period; The module is configured to report the alarm message if the alarm recovery message is not received within the predetermined time period. Preferably, the first determining module includes: a determining unit, configured to determine whether an alarm delay is set in an alarm attribute of the alarm message; and a setting unit configured to set the alarm delay in an alarm attribute of the alarm message In the case of time, the alarm delay is set to the predetermined time period, and it is determined whether an alarm recovery message is received within the predetermined time period. Preferably, the device further includes: a second determining module, configured to determine whether there is an alarm message that the number of times of reporting is greater than the first preset number of times and the number of times of recovery is greater than the second preset number of times within a predetermined time; In the case that there is an alarm message whose number of times of reporting is greater than the first preset number of times and the number of times of recovery is greater than the second preset number of times, the alarm delay is set in the alarm attribute of the alarm message. The embodiment of the present invention adopts the following method: It is determined whether a recovery message of an alarm message to be reported is received within a predetermined time period, and if the alarm recovery message is not received, the alarm message is reported. By using the embodiment of the present invention, an alarm message with frequent alarms and then resumed is processed, which solves the problem that a large number of alarms and alarm recovery messages are generated in a short period of time, which brings a large load to the system and occupies a large system. Resources, Therefore, the problem of the operating efficiency of the system is affected, thereby reducing the occupied system resources and improving the operating efficiency of the system. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,, . 1 is a flowchart of a method for processing an alarm message according to an embodiment of the present invention; FIG. 2 is a flowchart of a method for processing an alarm message according to a preferred embodiment of the present invention; FIG. 4 is a block diagram of a processing device for processing an alarm message according to an embodiment of the present invention; FIG. 5 is a first block diagram of a processing device for an alarm message according to an embodiment of the present invention; FIG. 6 is a structural block diagram of a processing apparatus for an alarm message according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. The embodiment of the present invention provides an alarm according to the related art, because a large number of alarms and alarms are generated in a short period of time, which may cause a large load on the system, and occupy a large amount of system resources, thereby affecting the operating efficiency of the system. The processing method of the message, the process of the method is as shown in FIG. 1 , and includes the step S102 to the step S104: Step S102, determining whether an alarm recovery message corresponding to the alarm message to be reported is received within a predetermined time period; Step S104, scheduling If the alarm recovery message is not received within the time range, the alarm message is reported. The embodiment of the present invention adopts the following method: It is determined whether a recovery message of an alarm message to be reported is received within a predetermined time period, and if the alarm recovery message is not received, the alarm message is reported. By using the embodiment, the alarm message with frequent alarms and then recovered is processed, and the short-term solution is solved. A large number of alarms and alarm recovery messages will bring a lot of load to the system, occupying too much system resources, thus affecting the system's operating efficiency, thereby reducing the occupied system resources and improving the system's operating efficiency. Different types of alarm messages may be generated due to different problems, for example, alarm messages generated by the device actually failing, and alarm messages generated due to high sensitivity. Therefore, before determining whether an alarm recovery message is received within a predetermined time period, the alarm message may be set differently, for example, an alarm delay is set for the frequently reported and restored alarm message, and no frequent reporting or Even if the alarm message is frequently reported but not frequently recovered, the alarm delay is not set. An alarm delay is set for the alarm message that is frequently reported and restored. The network element determines whether there is an alarm message that the number of times of reporting is greater than the first preset number of times and the number of times of recovery is greater than the second preset number of times. The message sets the alarm delay in the alarm attribute of the alarm message. During the implementation, the first preset number of times and the second preset number of times may be the same or different, for example, the preset time is set to 10 minutes, and the first preset number of times and the second preset number of times are 20 times simultaneously, if the same If the alarm message is reported and restored more than 20 times in 10 minutes, set the alarm attribute of the alarm message and set its attribute to the attribute with alarm delay. This can be set by adding this option when there is no option for the alarm delay attribute, or by setting it to 0 and 1 when there is an attribute option for the alarm delay. In the process of the step S102, the process of determining whether the alarm recovery message corresponding to the alarm message to be reported is received in the predetermined time period may be as follows: The network element generating the alarm message determines whether the alarm attribute of the alarm message is set with an alarm delay. If the alarm delay is set, the alarm delay is set to a predetermined time period, and it is determined whether an alarm recovery message is received within the predetermined time period. During the implementation, during the alarm delay, the timer of the network element periodically detects whether an alarm recovery message is received. If no alarm recovery message is received, the alarm delay is subtracted from the time required for the timer to trigger a detection to obtain a new one. Alarm delay; update the predetermined time period to a new alarm delay, continue to determine whether an alarm recovery message is received within the updated scheduled time period, and continue to detect whether an alarm recovery message is received. If an alarm recovery message is received before the alarm delay of the alarm message is reduced to zero, the alarm message is cleared. If the alarm recovery message is not received when the alarm delay of the alarm message is reduced to zero, the alarm message is reported to the NMS. During the implementation, if the alarm attribute is not set with the alarm delay (or the status is not set), the alarm message does not belong to the alarm message that is frequently reported and restored, and the alarm message is directly reported to the NMS. During the process of the foregoing steps, the network element processes the alarm message according to the priority of each alarm message. For example, if the A alarm message is more important than the B alarm message, the A alarm message can be set to have a higher priority than the B alarm message. When the alarm message is processed, even if the B alarm message is generated before the A alarm message, The A alarm message is processed. During the implementation, an alarm buffer pool can also be set to store the above alarm message. In the alarm buffer pool, multiple alarm messages may be processed according to the priority of the alarm message when processing multiple alarm messages. In this embodiment, the alarm message is specially processed by the foregoing method to effectively reduce the system load, and the operation and maintenance personnel also filter the alarm information for processing. The above embodiments will be described below in conjunction with the preferred embodiments. The preferred embodiment provides a method for reporting an alarm message, which can effectively process the alarm information frequently reported in a short period of time, that is, the operation and maintenance personnel know that the system has the alarm, and the alarm is not generated in a short time. Excessive alarms. The method for reporting the alarm message of the preferred embodiment includes the following steps:
( 1 ) 根据目前系统设备的告警， 判断是否存在短时间内频繁上报的告警。 (1) According to the alarms of the current system equipment, determine whether there are alarms that are frequently reported in a short period of time.
(2)如果存在， 再根据这类告警的持续时间， 设置这些告警延时上报的时间， 可 以根据需要设置不同告警的延时时长，延时时间越长告警上报给 EMS的就越少； 如果 不存在， 则不对其进行设置。 (2) If yes, set the delay time for reporting these alarms based on the duration of such alarms. You can set the delay duration for different alarms as needed. The longer the delay, the less the alarms are reported to the EMS. If it does not exist, it will not be set.
(3 ) 设置了告警延时后， 如果产生告警消息， 则启用网元内部定时器。 实施时， 上述过程的实现方法如下： 当任何一个告警消息设置过告警延时上报后就启用该定时器， 该定时器是个循环 定时器， 可以根据需要设置定时器的时长。 当定时器消息到达时， 首先判断网元内部 各个告警的告警延时是否为 0， 等于 0的就立即将该告警上报给 EMS， 对于非 0的告 警就将该告警的告警延时减 1次触发定时器所用的时间。 当用户取消所有告警的告警 延时时长， 即将时长都设置为 0时， 就将该定时器取消。 (3) After the alarm delay is set, if an alarm message is generated, the internal timer of the NE is enabled. In the implementation, the foregoing process is implemented as follows: When any alarm message is set to report the alarm delay, the timer is enabled. The timer is a loop timer, and the duration of the timer can be set as needed. When the timer message arrives, it is first determined whether the alarm delay of each alarm in the network element is 0. If the alarm is equal to 0, the alarm is reported to the EMS immediately. If the alarm is not 0, the alarm delay of the alarm is reduced by 1 time. The time it takes to trigger the timer. When the user cancels the alarm delay time of all alarms and sets the duration to 0, the timer is canceled.
(4) 对设置过告警延时上报的告警消息及告警恢复消息进行处理。 实施时， 当网元上产生告警时， 先根据告警码判断这种告警码是否设置过延时告 警， 即判断告警消息上报的延时时长是否为 0。 如果为 0就说明并未配置， 立即将该 告警上报给 EMS， 如果非 0， 就将该告警消息的告警延时时长填入该告警属性中， 先 不进行上报。 等定时器消息到来时， 将该告警消息的告警上报时延减去 1次定时器触
发的时间， 再次以新的告警上报时延检测是否收到告警恢复消息。 等减到 0时， 还未 收到告警恢复消息， 再将该告警消息上报给 EMS。 当告警恢复消息在该告警时延的时间段内到达， 即告警消息的告警上报时延还未 减到 0。 就在网元内部清除该告警， 就不再上报到 EMS， 这样就能有效的减少短时内 大量的产生又恢复的告警消息， 可以根据需要设置告警延时上报的时长。 时长设置的 越长， 这类告警上报给 EMS的数量就越少。 下面结合实例一及实例二对上述优选实施例进行说明。 实例一 本实施例提供一种告警消息的处理方法。其流程如图 2所示，包括步骤 S202至步 骤 S216。 步骤 S202， 根据 EMS的告警消息， 分析目前是否存在短时内频繁上报和恢复的 告警消息。 如果是， 则执行步骤 S204， 否则， 执行步骤 S216。 步骤 S204， 如果存在短时间内频繁上报和恢复的告警， 从告警信息中分析大部分 告警的持续时间， 可以根据需要， 设置告警延时上报的时长。 步骤 S206， 网元内部产生异常， 上报告警消息至网元。 在该步骤执行的过程中， 也可以在网元内部设置告警模块， 则产生的告警消息就上报至网元内部的告警模块。 步骤 S208， 判断该告警消息的告警属性是否设置了告警延时。 网元收到告警消息 时，根据该告警消息的告警属性确定是否上报给 EMS网管。如果是，则执行步骤 S210， 否则执行步骤 S216。 步骤 S210， 启动定时器检测在预设置的延时时长内是否收到告警恢复消息。 如果 收到， 则执行步骤 S212， 否则执行步骤 S214。 步骤 S212， 放弃向 EMS上报该告警消息。 步骤 S214， 将该告警消息上报至 EMS。 步骤 S216， 将产生的该告警消息直接上报至 EMS。 在步骤 S208实施的过程中， 当网元的告警模块收到其他模块上报的告警时，先判 断该告警是否配置了告警延时上报，如果没有配置那么直接上报给 EMS;如果已配置，
就将该告警放入网元告警模块的延时告警池中， 并且将该告警配置的告警延时时长赋 值给该告警， 如果有其他延时告警启动过定时器就不必设置定时器， 如果没有设置定 时器就需要同时设置定时器， 该告警在延时告警中等待定时器消息。 实例二 图 3是本实例提供的定时器消息处理流程图。 在接收到上报的告警消息后， 首先 启动定时器， 下面对定时器的处理流程进行说明， 在该实施例中， 网元内部独立设置 了网元告警模块， 其属于相关技术的一部分。 该实施例还设置了告警缓存池， 用于存 放需要上报的告警消息。 该定时器处理流程包括步骤 S302至步骤 S320。 步骤 S302， 网元告警模块收到定时器消息。 步骤 S304， 判断当前延时告警缓存池中告警数量是否为 0。 如果为是， 则执行步 骤 S306; 如果非 0， 则执行步骤 S308。 步骤 S306， 结束定时器的处理流程。 步骤 S308， 按照优先级顺序取出第一条告警消息进行处理。 步骤 S310， 取出的告警消息的告警延时的上报延时时长是否为 0。 如果是， 则执 行步骤 S312，； 如果否， 则执行步骤 S314。 步骤 S312， 将该告警消息上报给 EMS网管， 并同时将该告警从延时告警中清除。 步骤 S314， 将该告警消息的告警延时时长减去触发一次定时器的时长。 继续进行 检测， 选择上报告警消息或放弃上报。 步骤 S316， 判断延时告警池中是否存在下一条告警消息。 如果是， 则执行步骤 S318, 否则执行步骤 S320。 步骤 S318， 结束对告警缓存池中告警消息的处理。 步骤 S320，取下一条告警消息进行处理。对下一条告警消息的处理即从步骤 S310 再次开始执行。 实施过程中， 如果告警恢复消息是在该告警延时时长变为 0之前到达， 那么直接 在告警缓存池中清除该告警消息， 不再上报给 EMS。
本发明实施例还提供了一种告警消息的处理装置， 该装置用于实现上述方法， 该 装置中的模块可以在处理器中实现，例如，一种处理器包括第一判断模块 10和上报模 块 20。 这些模块可以通过软件来实现， 例如， 一种软件包括第一判断模块 10和上报 模块 20， 该软件还可以存储在计算机可读介质中。 该装置的结构框图如图 4所示， 包 括： 第一判断模块 10， 设置为判断在预定时间段内是否收到需要上报的告警消息对应 的告警恢复消息； 上报模块 20， 与第一判断模块 10耦合， 设置为在预定时间段内未 收到告警恢复消息的情况下， 将告警消息上报。 实施过程中， 第一判断模块 10还可以如图 5所示， 包括： 判断单元 102， 设置为 判断告警消息的告警属性是否设置了告警延时； 设置单元 104， 与判断单元 102耦合， 设置为在告警消息的告警属性设置了告警延时的情况下， 将告警延时设定为预定时间 段， 并判断在预定时间段内是否收到告警恢复消息。 上述告警消息的处理装置还可以如图 6所示， 还可以包括： 第二判断模块 30， 设 置为判断在预定时间内是否存在上报次数大于第一预设次数且恢复次数大于第二预设 次数的告警消息； 设置模块 40， 与第二判断模块 30和第一判断模块 10耦合， 设置为 在存在上报次数大于第一预设次数且恢复次数大于第二预设次数的告警消息的情况 下， 在告警消息的告警属性中设置告警延时。 在上述告警消息的处理装置的第一判断模块 10可以包括以下单元：设置为在告警 延时内， 定时检测是否收到告警恢复消息的单元； 设置为在没有收到告警恢复消息的 情况下， 将告警延时减去定时器触发一次检测所需的时间得到新的告警延时的单元； 设置为将预定时间段更新为新的告警延时， 继续在更新后的预定时间段内判断是否收 到告警恢复消息的单元。 实施过程中，第一判断模块 10还可以包括设置为在告警消息的告警延时减至为零 之前收到告警恢复消息的情况下， 清除告警消息的单元。 如果确定上述告警消息的告警属性未设置告警延， 则直接向网管上报告警消息。 本实施例通过上述告警消息的处理装置的处理， 有效的减少系统负荷， 同时也有 利于操作维护人员筛选告警信息进行处理。 从以上的描述中， 可以看出， 本发明实施例实现了如下技术效果： 本发明实施例采用了如下方法： 在预定时间段内判断是否收到需要上报的告警消 息的恢复消息， 如果没有收到告警恢复消息， 则才将该告警消息进行上报。 通过运用
本实施例， 在存在频繁告警且随即又恢复的告警消息进行了处理， 解决了由于短时内 大量产生告警和告警恢复消息会给系统带来很大的负荷， 占有过多的系统资源， 从而 影响系统的运行效率的问题， 进而减少了占用的系统资源， 提升了系统的运行效率。 显然， 本领域的技术人员应该明白， 上述的本发明实施例的各模块或各步骤可以 用通用的计算装置来实现， 它们可以集中在单个的计算装置上， 或者分布在多个计算 装置所组成的网络上， 可选地， 它们可以用计算装置可执行的程序代码来实现， 从而， 可以将它们存储在存储装置中由计算装置来执行， 并且在某些情况下， 可以以不同于 此处的顺序执行所示出或描述的步骤， 或者将它们分别制作成各个集成电路模块， 或 者将它们中的多个模块或步骤制作成单个集成电路模块来实现。 这样， 本发明不限制 于任何特定的硬件和软件结合。 以上所述仅为本发明的优选实施例而已， 并不用于限制本发明， 对于本领域的技 术人员来说， 本发明可以有各种更改和变化。 凡在本发明的精神和原则之内， 所作的 任何修改、 等同替换、 改进等， 均应包含在本发明的保护范围之内。
(4) Process the alarm message and alarm recovery message that has been set to report the alarm delay. In the implementation, when an alarm is generated on the NE, it is determined whether the alarm code is set to an excessive delay alarm according to the alarm code, that is, whether the delay time reported by the alarm message is 0. If it is 0, it is not configured. The alarm is reported to the EMS immediately. If it is not 0, the alarm delay time of the alarm message is filled in the alarm attribute. When the timer message arrives, the alarm reporting delay of the alarm message is subtracted by one timer. At the time of sending, the new alarm reporting delay is used to detect whether an alarm recovery message is received. When the value is reduced to 0, the alarm recovery message has not been received, and the alarm message is reported to the EMS. When the alarm recovery message arrives within the period of the alarm delay, the alarm reporting delay of the alarm message has not been reduced to zero. If the alarm is cleared in the network element, the alarm is not reported to the EMS. This can effectively reduce the number of generated and recovered alarm messages in a short period of time. You can set the length of the alarm delay report as required. The longer the duration is set, the less such alarms are reported to the EMS. The above preferred embodiments will be described below with reference to the first embodiment and the second embodiment. Example 1 This embodiment provides a method for processing an alarm message. The flow is as shown in FIG. 2, and includes steps S202 to S216. Step S202: According to the alarm message of the EMS, analyze whether there is an alarm message that is frequently reported and restored in a short period of time. If yes, step S204 is performed, otherwise, step S216 is performed. In step S204, if there is an alarm that is frequently reported and restored in a short period of time, the duration of most alarms is analyzed from the alarm information, and the duration of the alarm delay reporting may be set as needed. Step S206: An abnormality is generated inside the network element, and a warning message is reported to the network element. In the process of performing the step, the alarm module is also set up in the network element, and the generated alarm message is reported to the alarm module inside the network element. Step S208, determining whether an alarm delay is set in the alarm attribute of the alarm message. When receiving an alarm message, the NE determines whether to report it to the EMS network management system based on the alarm attribute of the alarm message. If yes, step S210 is performed, otherwise step S216 is performed. Step S210, the startup timer detects whether an alarm recovery message is received within a preset delay duration. If yes, step S212 is performed, otherwise step S214 is performed. In step S212, the alarm message is discarded to the EMS. Step S214, the alarm message is reported to the EMS. Step S216: The generated alarm message is directly reported to the EMS. In the process of the step S208, when the alarm module of the network element receives the alarm reported by the other module, it is first determined whether the alarm is configured to report the alarm delay. If not configured, the alarm is directly reported to the EMS; if configured, The alarm is placed in the delay alarm pool of the network element alarm module, and the alarm delay time of the alarm configuration is assigned to the alarm. If there are other delay alarms, the timer does not need to be set, if not To set a timer, you need to set a timer at the same time. This alarm waits for a timer message in the delay alarm. Example 2 FIG. 3 is a flowchart of processing a timer message provided by this example. After receiving the reported alarm message, the timer is started first. The processing flow of the timer is described below. In this embodiment, the network element alarm module is separately set in the network element, which is part of the related art. The alarm cache pool is also configured to store alarm messages that need to be reported. The timer processing flow includes steps S302 to S320. Step S302, the network element alarm module receives the timer message. Step S304, determining whether the number of alarms in the current delay alarm buffer pool is 0. If yes, step S306 is performed; if not, step S308 is performed. Step S306, the processing flow of the timer is ended. Step S308, the first alarm message is taken out in priority order for processing. Step S310, whether the delay time of the alarm delay of the received alarm message is 0. If yes, step S312 is performed; if no, step S314 is performed. In step S312, the alarm message is reported to the EMS network management device, and the alarm is cleared from the delay alarm. Step S314, subtracting the duration of the alarm delay of the alarm message from the duration of triggering the timer. Continue to test, choose to report the police message or give up the report. Step S316, determining whether there is a next alarm message in the delayed alarm pool. If yes, step S318 is performed, otherwise step S320 is performed. Step S318, the processing of the alarm message in the alarm buffer pool is ended. In step S320, an alarm message is taken for processing. The processing of the next alarm message is started again from step S310. During the implementation, if the alarm recovery message arrives before the alarm delay time becomes 0, the alarm message is cleared in the alarm buffer pool and is not reported to the EMS. The embodiment of the present invention further provides an apparatus for processing an alarm message, where the apparatus is used to implement the foregoing method, and the module in the apparatus may be implemented in a processor. For example, a processor includes a first determining module 10 and a reporting module. 20. These modules may be implemented by software, for example, a software comprising a first decision module 10 and a report module 20, which software may also be stored in a computer readable medium. The block diagram of the device is as shown in FIG. 4, and includes: a first determining module 10, configured to determine whether an alarm recovery message corresponding to an alarm message to be reported is received within a predetermined time period; the reporting module 20, and the first determining module If the alarm recovery message is not received within the predetermined time period, the alarm message is reported. During the implementation, the first determining module 10 is further configured as shown in FIG. 5, and includes: a determining unit 102, configured to determine whether an alarm delay is set in an alarm attribute of the alarm message; and the setting unit 104 is coupled to the determining unit 102, and configured to In the case that the alarm attribute of the alarm message is set with the alarm delay, the alarm delay is set to a predetermined time period, and it is determined whether an alarm recovery message is received within the predetermined time period. The processing device of the foregoing alarm message may also be as shown in FIG. 6, and may further include: a second determining module 30, configured to determine whether the number of times of reporting is greater than the first preset number of times and the number of times of recovery is greater than the second preset number of times within a predetermined time The setting module 40 is coupled to the second determining module 30 and the first determining module 10, and is configured to be configured to: when there is an alarm message that the number of times of reporting is greater than the first preset number of times and the number of times of recovery is greater than the second preset number of times, Set the alarm delay in the alarm attribute of the alarm message. The first judging module 10 of the processing device of the foregoing alarm message may include the following unit: a unit configured to periodically detect whether an alarm recovery message is received within an alarm delay; and set to not receive an alarm recovery message, The alarm delay is subtracted from the time required for the timer to trigger a detection to obtain a new alarm delay; set to update the predetermined time period to a new alarm delay, and continue to determine whether to receive the updated time period. The unit to the alarm recovery message. During the implementation, the first judging module 10 may further include a unit that is set to clear the alarm message if the alarm recovery message is received before the alarm delay of the alarm message is reduced to zero. If it is determined that the alarm attribute of the above alarm message is not set to alarm delay, the alarm message is directly reported to the network management. In this embodiment, the processing of the alarm message processing device is used to effectively reduce the system load, and the operation and maintenance personnel also filter the alarm information for processing. From the above description, it can be seen that the following technical effects are achieved in the embodiment of the present invention: The embodiment of the present invention adopts the following method: determining, in a predetermined time period, whether a recovery message of an alarm message to be reported is received, if not received The alarm message is reported to the alarm recovery message. Through application In this embodiment, the alarm message that is frequently alarmed and then resumed is processed, which solves the problem that a large amount of alarms and alarm recovery messages are generated in a short period of time, which causes a large load on the system and occupies excessive system resources. The problem affecting the operating efficiency of the system, thereby reducing the occupied system resources and improving the operating efficiency of the system. Obviously, those skilled in the art should understand that the above modules or steps of the embodiments of the present invention can be implemented by a general computing device, which can be concentrated on a single computing device or distributed in multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device and, in some cases, may be different from The steps shown or described are performed sequentially, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated into a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software. The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.