CN101277218B - Dynamic analysis system and method for network alarm - Google Patents
Dynamic analysis system and method for network alarm Download PDFInfo
- Publication number
- CN101277218B CN101277218B CN2008100670949A CN200810067094A CN101277218B CN 101277218 B CN101277218 B CN 101277218B CN 2008100670949 A CN2008100670949 A CN 2008100670949A CN 200810067094 A CN200810067094 A CN 200810067094A CN 101277218 B CN101277218 B CN 101277218B
- Authority
- CN
- China
- Prior art keywords
- alarm
- influence degree
- analyzer
- related service
- current
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a dynamic analyse system of network alarm which is used for dynamic analysing influence degree of alarm to service network. The dynamic analyse system includes: the corresponding service analyzer is used for generating corresponding service link list; the alarm frequency analyzer is used for receiving alarm information came from the alarm influence degree analyzer and time section used for calculating alarm frequency, and calculates alarm frequency generated in present alarm port; the alarm influence degree analyser is used for colligating present alarm information and the alarm frequency to calculate influence degree of present alarm. Comparing with prior art, the system and method provided by the invention can make manager finding key problem of threatening and influencing network developing smoothly. On the one hand, manager can achieve maximum results with little effort and reduce labour cost, on the other hand, recovery capability and immunity capability of network can be solved early.
Description
Technical field
The present invention relates to a kind of network management system and method for analyzing the alarm influence degree, in particular, is the system and method for a kind of dynamic analysis alarm to the influence degree of business network.
Background technology
The effect of network management system is to help the network management personnel network equipment to be carried out a series of bookkeepings such as remote monitoring, configuration, maintenance.If a problem has appearred in the equipment in the network, the information such as location and time that monitor can be found immediately and upwards alarm is numbered and produced to the layer network management system report and alarm, the pattern manipulation interface of network management system is resolved these information, inform reason, grade and the position etc. that the network manager alarms in straightaway text description mode, the keeper is at current alarm, utilization warning diagnostic rule is keeped in repair the equipment that goes wrong, thereby deal with problems rapidly, reduce the influence of equipment fault network operation.
If the speed that alarm produces is removed the speed of alarm less than administrative staff, can not have the situation that a large amount of alarms wait for that keepers handle in other words, the network that management runs well like this, existing technical scheme is no problem.But, in case when having the large number quipments problem of similar alarm windstorm and so on to produce, it is current that to have a pile alarm etc. pending, and network management technology in the past just will be alarmed classification, the serious grade of various alarms can be customized in advance by the keeper, and network management system provides alarm prompt behind the report and alarm, can demonstrate information such as alarm cause, serious grade, position in the graphical interfaces, general management person only can go to handle the high alarm of serious grade earlier with current alarm by serious ranking compositor.If current generation all is critical alarm, keeper without analyse still takes to come blindly an alarm just to solve the method for an alarm, must cause the keeper in a rush, and inefficiency makes network quality abominable.
In order to tackle the problem of above-mentioned alarm windstorm and so on, patent publication No. is the Chinese patent application " a kind of alert processing method and warning system " of CN 101018157A, has proposed a kind of solution by alarm buffer queue, multithreading and has dealt with the solution of this a kind of network accident of alarm windstorm.But; this solution is only at this a kind of network accident of alarm windstorm; when taking place, alarm windstorm deals with the crisis of alarm windstorm by increasing processing threads; and not from the comprehensive influence degree of alarming of dynamically analyzing of the angle of alarm correlation, alarm related service and alarm occurrence frequency, so can't fundamentally solve the problem that warning information accumulative total is brought.
As seen from last, also there is certain problem in the processing of network alarm in the prior art, needs the further better solution of research and development.
Summary of the invention
The object of the present invention is to provide a kind of dynamic analysis system and method for network alarm, it can dynamically analyze the influence degree of alarm and help the keeper to handle alarm efficiently from the alarm correlation equal angles is comprehensive, thoroughly solves the problem of being brought because of alarm.
In order to reach above goal of the invention, the present invention by the following technical solutions:
The invention provides a kind of dynamic analysis system of network alarm, be used for the influence degree of dynamic analysis alarm to business network, described dynamic analysis system comprises: the alarm receiver that is used to receive report and alarm information; Described dynamic analysis system also comprises: related service analyzer, alarm influence degree analyzer and alert frequency analyzer; Described related service analyzer is used to receive the warning information from described alarm receiver, and generates the related service chained list, and this table is used to write down the service conditions that passes through on the current alarm originating port; Described alert frequency analyzer was used to receive from the warning information of described alarm influence degree analyzer and the time period that is used to calculate alert frequency, and calculate the alert frequency that produces this type of alarm on the current alarm originating port, and this alert frequency is fed back to described alarm influence degree analyzer; Described alarm influence degree analyzer is used to receive described related service chained list and from the warning information of described alarm receiver, and the time period that the warning information that obtains and being used to of calculating are calculated alert frequency is sent to described alert frequency analyzer, and the relevant information of comprehensive current alarm and described alert frequency calculate the influence degree of current alarm.
Wherein, described alarm influence degree analyzer links to each other with described alarm receiver, and described alarm influence degree analyzer is used to receive the start-up control signal from described alarm receiver.
Wherein, described service conditions comprises the related service number, reaches the professional activation moments that is activated the earliest in the described related service chained list.
Wherein, described dynamic analysis system also comprises:
The alarm correlation analysis device, this analyzer links to each other with alarm influence degree analyzer with described alarm receiver, described alarm correlation analysis device is used to receive the warning information from described alarm receiver, and the Root alarm sign of current alarm is set, and this Root alarm sign is sent to described alarm influence degree analyzer.
Wherein, described alarm influence degree analyzer comprises:
Information receiving unit is used to receive the warning information of the related service chained list from described related service analyzer, described alarm receiver and the Root alarm sign of described alarm correlation analysis device;
The warning information analytic unit is used to receive related service chained list and the warning information that described information receiving unit obtains, and calculates the time period that is used to calculate alert frequency, and warning information and the time period that obtains is sent to described alert frequency analyzer; And
Alarm influence degree analytic unit, be used to receive warning information from described warning information analytic unit, from the Root alarm sign of the current alarm of described information receiving unit and from the alert frequency of described alert frequency analyzer, and calculate the influence degree of current alarm.
The present invention also provides a kind of dynamic analysing method of network alarm, said method comprising the steps of:
A, according to warning information, obtain the port information that current alarm takes place;
B, the described port information of foundation are searched all business through the current alarm originating port, and the service conditions that finds are stored in the related service chained list from professional chained list;
Produce the alert frequency of this type of alarm on C, the calculating current alarm originating port;
The relevant information and the described alert frequency of D, comprehensive current alarm, the influence degree of calculating current alarm.
Wherein, further comprising the steps of between described step C and the step D:
C1, current alarm is carried out correlation analysis, and the Root alarm sign of current alarm is set;
The original grade of seriousness of C2, the described Root alarm sign of foundation and current alarm is calculated the alarm severity of current alarm and is expanded grade;
And described step D adopts following process to calculate the influence degree of current alarm:
To the related service number in alarm severity expansion grade, the related service chained list, and alert frequency be weighted calculating, obtain the influence degree of current alarm.
Wherein, if the related service number that writes down in the related service chained list is zero, then following process is adopted in the calculating of described step C:
S11, prompting user input are used to calculate time period in the initial moment of alert frequency, and calculate the described time difference that is carved into when initial between the current time, are defined as the time period that is used to calculate alert frequency this time difference;
Produce the number of times of this type of alarm on S12, the interior current alarm originating port of described time period of statistics;
S13, described statistics is obtained number of times divided by the described time period, promptly obtain described alert frequency.
Wherein, if the related service number that writes down in the related service chained list is non-vanishing, then following process is adopted in the calculating of described step C:
S21, calculate the professional activation moments that is activated the earliest in the described related service chained list, this time period is defined as time period about the current alarm frequency to time period of current time;
Produce the number of times of this type of alarm on S22, the interior current alarm originating port of described time period of statistics;
S23, described statistics is obtained number of times divided by the described time period, promptly obtain described alert frequency.
Wherein, alarm severity expansion grade adopts following formula to calculate among the described step C2:
G＝F×M+G0；
In the above-mentioned formula, G represents alarm severity expansion grade, and F represents the value of Root alarm sign, and M represents the maximum of original alarm seriousness grade, and G0 represents the original grade of alarm severity;
The influence degree of current alarm adopts following formula to calculate among the described step D:
Result＝G×2
16+N
S×2
8+Q；
In the above-mentioned formula, Result represents the value of the influence degree of current alarm, and G represents alarm severity expansion grade, and NS represents the related service number that writes down in the described related service chained list, and Q represents described alert frequency.
In conjunction with technique scheme as can be known, compared with prior art, system and method of the present invention make the keeper can be more directly perceived, find into the side of body more quickly and influence the key issue of network sound and stable operation, guaranteed getting twice the result with half the effort of keeper's work on the one hand, reduce the cost of manpower aspect, problem solution has as early as possible guaranteed the recovery capability and the immunocompetence of network on the other hand.The present invention not only can introduce the scope of business and these two factors of alarm occurrence frequency of influencing, whether can also introduce is the factor of Root alarm, come the influence degree of comprehensive analysis and judgement alarm, because the value of these three factors is to come out according to concrete network condition dynamic calculation constantly, so more accurate than using static alarm severity grade to assess the influence degree of alarm in the prior art.
Description of drawings
Fig. 1 is the structural representation of dynamic analysis system of the present invention;
Fig. 2 is the structural representation that the present invention alarms the influence degree analyzer;
Fig. 3 is the method flow diagram of dynamic analysis alarm of the present invention to the business network influence degree;
Fig. 4 is the flow chart that calculates the alarm occurrence frequency;
Fig. 5 is the flow chart that the Root alarm flag bit of alarm is set of the present invention;
Fig. 6 is the interface schematic diagram that the prompting user imports the time period that needs when calculating the alarm occurrence frequency in the embodiment of the invention;
Fig. 7 is that the user chooses wall scroll to alarm the schematic diagram of the right button popup menu of clicking the mouse in the embodiment of the invention.
Embodiment
Describe technical scheme of the present invention in detail below in conjunction with accompanying drawing.
As shown in Figure 1, the invention provides a kind of dynamic analysis system, be mainly used in the influence degree of dynamic analysis alarm to business network, it comprises: alarm receiver 200, related service analyzer 210, alert frequency analyzer 230 and alarm influence degree analyzer 220.
Wherein, alarm receiver 200 is used to receive report and alarm information, and transmits parameter to its downstream module/unit, comprising: the positional information of alarm originating port in the warning information is imported in the related service analyzer 210, counted parameter in order to calculate related service; Also alarm severity grade in the warning information is imported in the alarm influence degree analyzer 220, calculated a parameter of final alarm influence degree as alarm influence degree analyzer 220; Can also send the start-up control signal to alarm influence degree analyzer 220, and then make transfer of data enter running status.As seen, should comprise in the warning information: about the information such as position, reason and the original grade of alarm severity of this alarm originating port.The corresponding seriousness grade of various alarms is set according to concrete condition in advance by the keeper.
Wherein, related service analyzer 210, be used to receive warning information from alarm receiver 200, and according to the positional information of alarming originating port in the warning information, the service conditions that passes through on the statistics current alarm originating port, and generate the related service chained list, wherein, service conditions comprises the related service number, reaches the activation moments breath that is activated professional the earliest in the described related service chained list.When the specific implementation statistical work, need set up a Service Database 211, it links to each other with described related service analyzer 210, is mainly used in all business of depositing current foundation, and is used for providing to related service analyzer 210 function of database servers such as inquiry, statistics.If the alarm port is professional relevant port, then related service analyzer 210 is searched all business through this port in Service Database 210, generate the related service chained list, and calculate the activation moments of the business that is activated the earliest in these related services, at last this activation moments and related service chained list are passed to alarm influence degree analyzer 220.If the port that this alarm takes place is not professional relevant port, the related service chained list of passing to alarm influence degree analyzer 220 then is set is sky, activation moments does not pass, the initial moment of the time period that alarm influence degree analyzer 220 is final can be reminded the user to import when calculating the alarm influence degree will to analyze.Here mentioned professional relevant port, the all of the port type that current operation may be passed through has only limited twenties kinds, in addition also have the alarm on some ports also can be influential to service operation, as port type is 0 veneer from one's body alarm, and the union of this two generic port is exactly the type scope of professional related port.
Wherein, alert frequency analyzer 230, the time period that is used to receive warning information from alarm influence degree analyzer 220 (comprising alarm originating port, Position Number and alarm severity class information) and is used to calculate alert frequency, (this time period was used to calculate alert frequency, can be that the user imports or the calculating acquisition), calculate the alert frequency that produces this type of alarm in this time period on the current alarm originating port then.When the specific implementation frequency computation part, need set up a record alert database 231, it links to each other with described alert frequency analyzer 230, is used to deposit history alarm data and current alarm data, and is used for providing to alert frequency analyzer 230 function of database servers such as inquiry, statistics.When alert frequency analyzer 230 receives warning information, to deposit in the record alert database 231 about information such as the alert port position of height, numberings in advance, in record alert database 231, count the number of times that this type of alarm takes place on the current alarm port in section preset time then, and then calculate the alert frequency that current alarm takes place in the period at this section, and pass to alarm influence degree analyzer 220.
Wherein, alarm influence degree analyzer 220, be used to receive described related service chained list and from the warning information of described alarm receiver, and the time period that the warning information that obtains and being used to of calculating are calculated alert frequency is sent to described alert frequency analyzer 230, and the relevant information of comprehensive current alarm and described alert frequency calculate the influence degree of current alarm.If the related service chained list is not empty, and the related service number is non-vanishing, the time period of be activated the earliest professional activation moments and the current time calculating alert frequency that then writes down in the basis related service chained list that imports into; If the related service chained list is empty, then point out the user to import the time period that to analyze, interface as shown in Figure 6 stops constantly being defaulted as current time, then warning information such as the port of alarm, numbering and the time period information of calculating alert frequency is passed to alert frequency analyzer 230.Here the relevant information of said current alarm comprises: the related service number in the described related service chained list, alarm severity grade or the like below also can specifically describe in the explanation of method flow.As shown in Figure 2, this alarm influence degree analyzer 220 also is provided with a display unit 225, the alarm influence degree that is used for finally calculating acquisition is shown to management with patterned form, the function that also provides the influence degree according to alarm that current alarm is sorted simultaneously.
On the basis of said structure, as shown in Figure 1, dynamic analysis system of the present invention also comprises with lower unit:
Alarm correlation analysis device 240, this analyzer links to each other with alarm influence degree analyzer with described alarm receiver.Alarm correlation analysis device 240 is used to receive the warning information from alarm receiver 200, and according to warning information the Root alarm sign of current alarm is set, and this Root alarm sign is sent to alarm influence degree analyzer 220.When specifically searching Root alarm, need set up a current alarm storehouse 241, this database links to each other with alarm correlation analysis device 240, only is used to deposit current alarm, and is used for providing to alarm correlation analysis device 240 functions such as inquiry, statistics.Alarm correlation analysis device 240 receives current alarm information from alarm receiver 200, and directly import in the current alarm storehouse 241, analyze the correlation of alarm data in the storehouse according to prior art, find out various Root alarm, and the Root alarm sign of current alarm is set, if current alarm belongs to Root alarm according to lookup result, then the value of its Root alarm sign can be labeled as 1, otherwise, be labeled as 0, and the value of this sign passed to alarm influence degree analyzer 220.
Owing to increased alarm correlation analysis device 240, in order to finish each function of alarm influence degree analyzer 220, as shown in Figure 2, it comprises following components:
Information receiving unit 222 is used to receive the related service chained list from related service analyzer 210, the warning information of alarm receiver 200 and the Root alarm sign of alarm correlation analysis device 240;
Warning information analytic unit 223, be used to receive related service chained list and the warning information that information receiving unit 222 obtains, and calculate the time period that is used to calculate alert frequency, and warning information and the time period that obtains is sent to alert frequency analyzer 230 according to the activation moments that writes down in time of user input or the related service chained list; And
Alarm influence degree analytic unit 224, be used to receive warning information from warning information analytic unit 223, from the Root alarm sign of the current alarm of information receiving unit 220 and from the alert frequency of alert frequency analyzer 230, and according to the influence degree of each the calculation of parameter current alarm relevant with current alarm, its concrete computational methods can be referring to following explanation about method.
Based on the said system structure, the present invention also provides the method for a kind of dynamic analysis alarm to the influence degree of business network, and this method is mainly used in the dynamic analysis system of the present invention.As shown in Figure 3, the method for the invention comprises following step:
Step 310 receives warning information, can obtain the information such as port, Position Number and alarm severity grade that current alarm takes place according to this warning information.Can obtain the value G of the original grade of seriousness of current alarm according to the alarm numbering and the correspondence table of seriousness grade
o, the corresponding seriousness grade of various alarms can be revised customization according to concrete condition voluntarily by the keeper.
Step 320 according to above-mentioned port information, is searched all business through the current alarm originating port, and the service conditions that finds is stored in the related service chained list from professional chained list.If the port that alarm takes place is the port relevant with business, then from professional chained list, searches all business, and in the related service chained list, write down the related service number N through this port
sIf this related service number is not 0, then also in the related service chained list, write down the activation moments T of the business that is activated the earliest
b, and forward step 330 to; If this related service number be 0 or the port that takes place of alarm be with the port of independent of service then forward step 340 to;
Step 330 is obtained current time T
c, then calculate the time period T=T of alert frequency
c-T
b, forward step 350 to;
Step 340, the prompting user imports the initial moment T of the time period of calculating alert frequency
s, stop T constantly
eBe defaulted as current time, initial moment T is calculated as shown in Figure 6 then in the prompting interface
sTo current time T
eBetween time difference, be defined as the time period T=T that is used to calculate alert frequency this time difference
e-T
s, forward step 350 to;
Step 350 is calculated the frequency Q that produces this type of alarm in time period T on this port;
Step 360 is carried out correlation analysis to current alarm, and the value F of the Root alarm sign of current alarm is set, if current alarm belongs to Root alarm, and F=1 then, otherwise, F=0;
Step 370 is according to the value F of Root alarm sign and the original grade G of seriousness of current alarm
o, calculate the alarm severity of current alarm and expand grade G=F * M+G
o, promptly the alarm grade of non-Root alarm still is former grade, adds M and the alarm grade of Root alarm is an initial value;
Step 380 is counted N to the related service in alarm severity expansion grade G, the related service chained list
S, and alert frequency Q be weighted calculating, obtain the influence degree Result of current alarm, such as adopting following formula to calculate the influence degree Result of current alarm:
Result＝G×2
16+N
s×2
8+Q。
From the computing formula of the influence degree Result of above-mentioned current alarm as can be seen, if the related service number N that writes down in the related service chained list
sBe zero, the influence degree Result=G of current alarm * 2 then
16+ Q, Result are only relevant with alert frequency Q with alarm severity expansion grade G, at this moment, if current alarm does not belong to Root alarm, the influence degree Result=G of current alarm then
0* 2
16+ Q, Result just only with the original grade G of alarm severity
0Q is relevant with alert frequency.So, comprehensive various situation, as can be seen, the influence degree of current alarm is that the relevant information and the described alert frequency of comprehensive current alarm calculates acquisition, and the relevant information of the current alarm here comprises: the situation of alarm severity grade (is the original grade G of alarm severity
0Or alarm severity expansion grade G), reach the related service number N that writes down in the related service chained list
s
Step 390, the details of display alarm on the interface comprise the influence degree value of alarm, flow process finishes.
As shown in Figure 4, the frequency concrete steps of calculating alarm in the above-mentioned steps 350 are as follows,
Step 351 should be alarmed input record alert database and current alarm storehouse;
Step 353 is calculated the frequency Q=N that produces this type of alarm in time period T on this port
a/ T.
As seen, if the alarm port belongs to professional related port, and the related service number that writes down in the related service chained list is non-vanishing, then can pass through above-mentioned steps 330, and integrating step 351,352,353 is calculated alert frequency Q; If the alarm port does not belong to professional related port, or the related service number that writes down in the related service chained list is zero, then can pass through above-mentioned steps 340, and integrating step 351,352,353 calculating alert frequency Q.
As shown in Figure 5, the concrete steps of the Root alarm flag bit of calculating current alarm are as follows in the above-mentioned steps 360:
Step 361: use existing alarm correlation analysis technology, find out the Root alarm in the current alarm storehouse, generate the Root alarm chained list;
Step 362: whether the current alarm that receives in the determining step 310 is in the Root alarm chained list;
Step 363: if current alarm in the root chained list, then its Root alarm value of statistical indicant F assignment is 1, otherwise its Root alarm value of statistical indicant F assignment is 0.
In sum, the computing formula of the influence degree Result of above-mentioned current alarm combines the factor of following three aspects:
(1) whether be Root alarm.Because have only the root place that reflects alarm to management, just can cut the Gordian knot, settle at one go to remove and alarm threat;
(2) related service number.The quality of quality of service also is to weigh the key factor of network quality, and therefore influencing the many more alarms of professional number more should significant.
(3) alert frequency.The frequent alarm that occurs, the arriving that may indicate alarm windstorm even be not critical alarm, also is very serious to the influence of network performance, so this frequent alarm that occurs is in time handled, can avoid the generation of serious network accident.
As seen, the present invention is by anatomizing the correlation between the alarm, catch the root of these alarm cause, what be concerned about most from operator is the influence angle of plant issue to business, added up the alarm of frequent appearance, dynamic analysis alarm to the influence degree of business network, and the result is shown to the keeper by figure.Shown in Fig. 6 and 7, the present invention can also add man-machine interface, and for the keeper provides the function of checking alarm related service, Root alarm, alarm occurrence frequency, the user chooses certain bar alarm, and the right button of clicking the mouse can eject menu as shown in Figure 6.
Certainly; the present invention can also have other numerous embodiments; under the situation that does not deviate from spirit of the present invention and essence; those skilled in the art can make various corresponding changes and distortion according to the present invention, but these corresponding changes and distortion all should belong to the protection range of the appended claim of the present invention.
Claims (10)
1. the dynamic analysis system of a network alarm, it is used for the influence degree of dynamic analysis alarm to business network, and described dynamic analysis system comprises: the alarm receiver that is used to receive report and alarm information; It is characterized in that described dynamic analysis system also comprises: related service analyzer, alarm influence degree analyzer and alert frequency analyzer;
Described related service analyzer is used to receive the warning information from described alarm receiver, and generates the related service chained list, and this table is used to write down the service conditions that passes through on the current alarm originating port;
Described alert frequency analyzer was used to receive from the warning information of described alarm influence degree analyzer and the time period that is used to calculate alert frequency, and calculate the alert frequency that produces this type of alarm on the current alarm originating port, and this alert frequency is fed back to described alarm influence degree analyzer;
Described alarm influence degree analyzer is used to receive described related service chained list and from the warning information of described alarm receiver, and the time period that the warning information that obtains and being used to of calculating are calculated alert frequency is sent to described alert frequency analyzer, and the relevant information of comprehensive current alarm and described alert frequency calculate the influence degree of current alarm.
2. dynamic analysis system according to claim 1 is characterized in that, described alarm influence degree analyzer links to each other with described alarm receiver, and described alarm influence degree analyzer is used to receive the start-up control signal from described alarm receiver.
3. dynamic analysis system according to claim 1 is characterized in that, described service conditions comprises the related service number, reaches the professional activation moments that is activated the earliest in the described related service chained list.
4. according to claim 1,2 or 3 described dynamic analysis systems, it is characterized in that described dynamic analysis system also comprises:
The alarm correlation analysis device, this analyzer links to each other with alarm influence degree analyzer with described alarm receiver, described alarm correlation analysis device is used to receive the warning information from described alarm receiver, and the Root alarm sign of current alarm is set, and this Root alarm sign is sent to described alarm influence degree analyzer.
5. dynamic analysis system according to claim 4 is characterized in that, described alarm influence degree analyzer comprises:
Information receiving unit is used to receive the warning information of the related service chained list from described related service analyzer, described alarm receiver and the Root alarm sign of described alarm correlation analysis device;
The warning information analytic unit is used to receive related service chained list and the warning information that described information receiving unit obtains, and calculates the time period that is used to calculate alert frequency, and warning information and the time period that obtains is sent to described alert frequency analyzer; And
Alarm influence degree analytic unit, be used to receive warning information from described warning information analytic unit, from the Root alarm sign of the current alarm of described information receiving unit and from the alert frequency of described alert frequency analyzer, and calculate the influence degree of current alarm.
6. the dynamic analysing method of a network alarm is characterized in that, said method comprising the steps of:
A, according to warning information, obtain the port information that current alarm takes place;
B, the described port information of foundation are searched all business through the current alarm originating port, and the service conditions that finds are stored in the related service chained list from professional chained list;
Produce the alert frequency of this type of alarm on C, the calculating current alarm originating port;
The relevant information and the described alert frequency of D, comprehensive current alarm, the influence degree of calculating current alarm.
7. dynamic analysing method according to claim 6 is characterized in that, and is further comprising the steps of between described step C and the step D:
C1, current alarm is carried out correlation analysis, and the Root alarm sign of current alarm is set;
The original grade of seriousness of C2, the described Root alarm sign of foundation and current alarm is calculated the alarm severity of current alarm and is expanded grade;
And described step D adopts following process to calculate the influence degree of current alarm:
To the related service number in alarm severity expansion grade, the related service chained list, and alert frequency be weighted calculating, obtain the influence degree of current alarm.
8. dynamic analysing method according to claim 6 is characterized in that, if the related service number that writes down in the related service chained list is zero, then following process is adopted in the calculating of described step C:
S11, prompting user input are used to calculate time period in the initial moment of alert frequency, and calculate the described time difference that is carved into when initial between the current time, are defined as the time period that is used to calculate alert frequency this time difference;
Produce the number of times of this type of alarm on S12, the interior current alarm originating port of described time period of statistics;
S13, described statistics is obtained number of times divided by the described time period, promptly obtain described alert frequency.
9. dynamic analysing method according to claim 6 is characterized in that, if the related service number that writes down in the related service chained list is non-vanishing, then following process is adopted in the calculating of described step C:
S21, calculate the professional activation moments that is activated the earliest in the described related service chained list, this time period is defined as time period about the current alarm frequency to time period of current time;
Produce the number of times of this type of alarm on S22, the interior current alarm originating port of described time period of statistics;
S23, described statistics is obtained number of times divided by the described time period, promptly obtain described alert frequency.
10. dynamic analysing method according to claim 7 is characterized in that, alarm severity expansion grade adopts following formula to calculate among the described step C2:
G＝F×M+G
0；
In the above-mentioned formula, G represents alarm severity expansion grade, and F represents the value of Root alarm sign, and M represents the maximum of original alarm seriousness grade, G
0The original grade of expression alarm severity;
The influence degree of current alarm adopts following formula to calculate among the described step D:
Result＝G×2
16+N
S×2
8+Q ；
In the above-mentioned formula, Result represents the value of the influence degree of current alarm, and G represents alarm severity expansion grade, N
SRepresent the related service number that writes down in the described related service chained list, Q represents described alert frequency.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2008100670949A CN101277218B (en) | 2008-05-04 | 2008-05-04 | Dynamic analysis system and method for network alarm |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2008100670949A CN101277218B (en) | 2008-05-04 | 2008-05-04 | Dynamic analysis system and method for network alarm |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101277218A CN101277218A (en) | 2008-10-01 |
| CN101277218B true CN101277218B (en) | 2010-12-29 |
Family
ID=39996254
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2008100670949A Active CN101277218B (en) | 2008-05-04 | 2008-05-04 | Dynamic analysis system and method for network alarm |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101277218B (en) |
Families Citing this family (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102447570B (en) * | 2010-09-30 | 2014-07-30 | 中国移动通信集团福建有限公司 | Monitoring device and method based on health degree analysis |
| CN104243184B (en) * | 2013-06-06 | 2018-01-30 | 中国移动通信集团河北有限公司 | A kind of processing method and processing device of warning information |
| CN105577403A (en) * | 2014-10-14 | 2016-05-11 | 中兴通讯股份有限公司 | Frequent-path-based mining method and apparatus for data related to warning |
| CN105528280B (en) * | 2015-11-30 | 2018-11-23 | 中电科华云信息技术有限公司 | System log and health monitoring relationship determine the method and system of log alarm grade |
| CN106549831B (en) * | 2016-11-24 | 2019-12-24 | 国家电网公司 | Health analysis method and system of information system |
| CN107547262B (en) * | 2017-07-25 | 2021-07-06 | 新华三技术有限公司 | Method and device for generating alarm level and network management equipment |
| CN110061867B (en) * | 2019-04-02 | 2022-01-07 | 武汉烽火技术服务有限公司 | Communication network alarm analysis method and system based on fault source alarm intensity |
| CN112118141B (en) * | 2020-09-21 | 2021-12-17 | 中山大学 | Communication network-oriented alarm event correlation compression method and device |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1486021A (en) * | 2002-09-28 | 2004-03-31 | 深圳市中兴通讯股份有限公司上海第二 | Method for reporting alarm data to dynamic multiple network manager |
| EP1228599B1 (en) * | 1999-11-09 | 2005-08-17 | Siemens Aktiengesellschaft | Method and system for hierarchical network management |
| CN1655517A (en) * | 2004-02-11 | 2005-08-17 | 三星电子株式会社 | Method and system for processing fault information in NMS |
| EP1031208B1 (en) * | 1997-10-14 | 2005-09-21 | Nokia Corporation | Network monitoring method for telecommunications network |
-
2008
- 2008-05-04 CN CN2008100670949A patent/CN101277218B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP1031208B1 (en) * | 1997-10-14 | 2005-09-21 | Nokia Corporation | Network monitoring method for telecommunications network |
| EP1228599B1 (en) * | 1999-11-09 | 2005-08-17 | Siemens Aktiengesellschaft | Method and system for hierarchical network management |
| CN1486021A (en) * | 2002-09-28 | 2004-03-31 | 深圳市中兴通讯股份有限公司上海第二 | Method for reporting alarm data to dynamic multiple network manager |
| CN1655517A (en) * | 2004-02-11 | 2005-08-17 | 三星电子株式会社 | Method and system for processing fault information in NMS |
Also Published As
| Publication number | Publication date |
|---|---|
| CN101277218A (en) | 2008-10-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN101277218B (en) | Dynamic analysis system and method for network alarm | |
| JP6538980B2 (en) | Automated anomaly detection service in heterogeneous mixed log streams | |
| US9892020B1 (en) | User interface for specifying data stream processing language programs for analyzing instrumented software | |
| CN108197261A (en) | A kind of wisdom traffic operating system | |
| US20180129579A1 (en) | Systems and Methods with a Realtime Log Analysis Framework | |
| Yang et al. | A time efficient approach for detecting errors in big sensor data on cloud | |
| CN105095048B (en) | A kind of monitoring system alarm association processing method based on business rule | |
| US9659042B2 (en) | Data lineage tracking | |
| CN109471846A (en) | User behavior auditing system and method on a kind of cloud based on cloud log analysis | |
| WO2022257423A1 (en) | Warning information association method and apparatus, and electronic device and readable storage medium | |
| CN107147639A (en) | A kind of actual time safety method for early warning based on Complex event processing | |
| CN108415789A (en) | Node failure forecasting system and method towards extensive mixing heterogeneous storage system | |
| CN106371986A (en) | Log treatment operation and maintenance monitoring system | |
| CN106815125A (en) | A kind of log audit method and platform | |
| WO2020238130A1 (en) | Big data log monitoring method and apparatus, storage medium, and computer device | |
| CN101459537A (en) | Network security situation sensing system and method based on multi-layer multi-angle analysis | |
| CN101188523A (en) | Generation method and generation system of alarm association rules | |
| CN109255523A (en) | Analysis indexes computing platform based on KKS coding rule and big data framework | |
| CN112491611A (en) | Fault location system, method, apparatus, electronic device and computer readable medium | |
| KR102087959B1 (en) | Artificial intelligence operations system of telecommunication network, and operating method thereof | |
| CN106030565B (en) | Use the computer performance prediction of search technique | |
| KR102067032B1 (en) | Method and system for data processing based on hybrid big data system | |
| CN108234176A (en) | A kind of monitoring system and its method | |
| CN111740884A (en) | Log processing method, electronic equipment, server and storage medium | |
| CN114579407A (en) | Causal relationship inspection and micro-service index prediction alarm method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant |