JP2011109489A - Alert management apparatus and alert management method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To present alerts from a plurality of communication devices to users without taking a lot of time to specify a cause of a failure. <P>SOLUTION: There is disclosed a monitoring apparatus 10 which manages alerts of a plurality of communication devices. The monitoring apparatus includes a display control unit 36 which causes a predetermined display device to display a main alert that output from a reference communication device in alerts output from a plurality of communication devices, with higher visibility than additional alerts which are output from the other communication devices when the main alert is issued. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a data processing technique, and more particularly to an alert management device that manages alerts output from a plurality of communication devices and an alert management method that is executed by the devices.

  When a communication device constituting a communication network detects the occurrence of a failure, it generally outputs an alert. The user who manages the communication device identifies the cause of the failure by confirming the alert, and implements recovery or prevention of the failure.

JP-A-11-205318

  When a failure occurs in one communication device, the failure may be detected in another communication device affected by the failure. In this case, not only an alert is output from the communication device in which a failure has occurred in the first place, but also an alert is output from another communication device, and a large number of alerts are presented to the user. As a result, it has become difficult to identify the alert indicating the failure that occurred first, and it may take time to identify the cause of the failure.

  The present invention has been made in view of these problems, and a main object of the present invention is to provide a technology that supports the identification of the root cause of a failure based on alerts from a plurality of communication devices.

  In order to solve the above-described problem, an alert management device according to an aspect of the present invention is a device that manages alerts of a plurality of communication devices, with the occurrence of a main alert that is an alert from a reference communication device. , A dependency holding unit that holds a dependency indicating that an accompanying alert that is an alert from another communication device is generated, an alert acquisition unit that acquires an alert output from a plurality of communication devices, and reference the dependency And a display control unit for making the main alert more visible than the accompanying alert and displaying it on a predetermined display device.

  The communication device may be a communication device constituting various communication networks such as LAN, WAN, and the Internet. For example, it may be an optical transmission device constituting a WDM (Wavelength Division Multiplex) network. Also, a router or an L3 / L2 switch may be used. The main alert may notify the occurrence or recovery of a failure in the reference communication device. The accompanying alert may notify the occurrence or recovery of a failure detected in another communication device in association with a failure in the reference communication device.

  According to this aspect, by relatively improving the visibility of the main alert among the alerts output from each of the plurality of communication devices, the user monitoring the communication device can easily determine the main alert, and the contents Can be confirmed. As a result, the user can easily identify the root cause of the failure, and can quickly recover and prevent the failure.

  The display control unit may further display that the main alert is not acquired when the accompanying alert is acquired and the main alert is not acquired. According to this aspect, even when the main alert is not detected due to various factors, it is possible to suggest the occurrence of a failure related to the main alert to the user, and it is possible to assist the user in identifying the root cause of the failure.

  A dependency relationship is set between the two alerts on condition that the event occurrence time indicated by the alert from the other communication device is within a predetermined period from the event occurrence time indicated by the alert from the reference communication device. A dependency relationship setting unit may be further provided.

  The predetermined period may be an arbitrary period set by the user, and may be a grace period from when the communication device detects the occurrence or recovery of a failure to when an alert indicating that fact is transmitted to the outside. This grace period may be a period for determining whether or not the detected operation state is fixed, and may be, for example, a period of about 1 second to 2 seconds.

  According to this aspect, it is possible to absorb the time lag from the detection of the failure to the alert notification in each of the plurality of communication devices, and to appropriately set the dependency relationship between the alerts.

  Output from the reference communication device on the condition that a dependency relationship is established between the alert indicating failure recovery output from the reference communication device and the alert indicating failure recovery output from another communication device There may be further provided a dependency relationship setting unit that sets a dependency relationship between the alert indicating the occurrence of the failure and the alert indicating the occurrence of the failure output from another communication device.

  If a dependency relationship is established between failure recovery alerts, there is a high possibility that a dependency relationship is also established between failure occurrence alerts. According to this aspect, the dependency relationship between alerts can be set more appropriately.

  The dependency relationship holding unit transmits a communication device adjacent to the reference communication device, a communication device adjacent to the adjacent communication device, and connected to the reference communication device via the adjacent communication device to another communication device. You may hold | maintain the dependence relationship made into the range of the communication apparatus. Similarly, the dependency relationship setting unit includes a communication device adjacent to the reference communication device, a communication device adjacent to the adjacent communication device, and connected to the reference communication device via the adjacent communication device. You may set the dependence which made the range of other communication apparatuses into.

  According to this aspect, even when there are a large number of communication devices to be monitored, the range of the subject of the accompanying alert is limited. Therefore, the amount of dependency data to be held by the alert management device and the dependency relationship are set. Therefore, the processing amount can be reduced. As a result, hardware resources and processing time required for setting or maintaining the dependency relationship can be reduced.

  When the visibility of the main alert is increased, the display control unit may record information indicating the dependency in a predetermined file as the basis. According to this aspect, since the trail with relatively improved visibility of the main alert is recorded, the trail can be referred to later if necessary. For example, detailed processing contents can be confirmed later, and the validity of the processing can be verified later.

  Another aspect of the present invention is also an alert management device. This device manages alerts of a plurality of communication devices, and generates a main alert that is an alert output from a reference communication device among alerts output from a plurality of communication devices. Accordingly, a display control unit is provided that has a higher visibility than an accompanying alert that is an alert output from another communication device and displays the alert on a predetermined display device. According to this aspect, similarly to the above, by relatively improving the visibility of the main alert, it is possible to assist the user who monitors the communication device to deal with the failure.

  Yet another embodiment of the present invention is an alert management method. This method is a method executed by a device that manages alerts of a plurality of communication devices, the step of acquiring alerts output from the plurality of communication devices, and a main alert that is an alert from a reference communication device With reference to a dependency relationship indicating that an accompanying alert, which is an alert from another communication device, is generated in accordance with the occurrence of the incident, and displaying the predetermined alert on a predetermined display device with higher visibility of the main alert than the accompanying alert; and . According to this aspect, similarly to the above, by relatively improving the visibility of the main alert, it is possible to assist the user who monitors the communication device to deal with the failure.

  It should be noted that any combination of the above-described constituent elements and a representation of the present invention converted between an apparatus, method, system, program, recording medium storing the program, etc. are also effective as an aspect of the present invention.

  ADVANTAGE OF THE INVENTION According to this invention, it can assist specifying the root cause of a failure based on the alert from a some communication apparatus.

It is a figure which shows the structure of the communication system of this Embodiment. It is a block diagram which shows the function structure of the monitoring apparatus of FIG. It is a figure which shows the example of data stored in an original alert holding | maintenance part. It is a figure which shows the example of data stored in a dependence relationship holding part. It is a figure which shows the example of data stored in a display alert holding | maintenance part. It is a figure which shows the example of data stored in a trail holding part. It is a figure which shows the example of determination of dependence. It is a flowchart which shows the processing algorithm of a display mode determination part.

Before describing the embodiment of the present invention, an outline will be described first.
When a user copes with a failure that has occurred in a communication device, the cause of the failure is identified from an alert output from the communication device, and the failure is solved by removing the cause. By the way, a communication network is generally composed of a plurality of communication devices. When a failure occurs in one of these communication devices, an alert is output from the plurality of communication devices due to the failure. There is. As a result of presenting a plurality of alerts to the user, it may take time to identify an alert indicating the root cause of the failure.

  In addition, the communication device that is the output source of the alert shall notify the alert indicating the failure after the grace period for confirming that the failure continues after the failure is first detected. There is. In this case, in particular, the notification order of alerts from each of the plurality of communication devices tends to be random, and it may take time to identify an alert indicating the root cause of the failure.

  Therefore, in the present embodiment, a monitoring device to which an alert management technique for assisting in identifying the root cause of a failure based on alerts from a plurality of communication devices is proposed. The monitoring device displays an alert output from each of the plurality of communication devices on a display. At that time, multiple alerts indicate the root cause of the failure, in other words, the “primary alert” output when the root failure is detected, and the “accompanying alert” output when the primary alert occurs ”And display on the display in a state where the visibility of the main alert is higher than that of the accompanying alert. Since the primary alert indicates the root cause of multiple failures that occurred in a chain in the communication network, the visibility of the primary alert is increased, so that the user can quickly identify the root cause of the failure, Preventive work can be carried out quickly.

  FIG. 1 shows a configuration of a communication system according to the present embodiment. The communication system 100 includes a monitoring device 10 and NE-A 12 a to NE-J 12 j collectively referred to as a network element (NE) 12. NE-A 12a to NE-F 12f are communication devices that constitute a WDM network, and NE-G 12g to NE-J 12j are communication devices that constitute an access network for a client terminal (not shown).

  The NE-A 12a to NE-J 12j are connected to each other via a main signal line 16 serving as a communication line for user frames transmitted and received between client terminals, and execute user frame relay processing. When each of the NE-A 12 a to NE-J 12 j detects a predetermined failure in its own device, the NE-A 12 a to NE-J 12 j transmit alert data indicating the failure content and detection time to the monitoring device 10.

  Note that the NE-A 12a to the NE-J 12j notify the alert after the grace period elapses when the recovery of the failure is not detected during a predetermined grace period after the occurrence of the failure in the own apparatus. . This grace period may be appropriately determined according to the elapsed time from the occurrence when the failure is recovered immediately after the occurrence of the failure, the frequency, or the like.

  The monitoring device 10 is an information processing device that monitors the operation states of the NE-A 12a to NE-J 12j, and includes a control signal line 14 that is a communication path dedicated to a control frame used for monitoring the NE 12, Each NE 12 is connected via a signal line 16. The monitoring device 10 receives alert data from each of the NE-A 12 a to NE-J 12 j and presents the contents of the alert to a user who monitors the communication system 100.

  FIG. 2 is a block diagram showing a functional configuration of the monitoring apparatus 10 of FIG. The monitoring apparatus 10 includes a data holding unit 20 that is a storage area for holding various types of data, and a data processing unit 30 that executes various types of data processing.

  Each block shown in the block diagram of the present specification can be realized in terms of hardware by elements and mechanical devices such as a CPU and a memory of a computer, and in terms of software, it can be realized by a computer program or the like. Then, the functional block realized by those cooperation is drawn. Therefore, those skilled in the art will understand that these functional blocks can be realized in various forms by a combination of hardware and software.

  For example, the data holding unit 20 may be realized by a recording medium such as a hard disk and data held in the recording medium. Further, the data processing unit 30 may be implemented as a computer program, stored in a recording medium, appropriately read into the main memory, and executed by the processor.

  The data holding unit 20 includes an original alert holding unit 22, a dependency relationship holding unit 24, a display alert holding unit 26, and a trail holding unit 28. The original alert holding unit 22 is a storage area in which original data of alerts output from each of the NE-A 12a to NE-J 12j is sequentially stored.

  FIG. 3 shows an example of data stored in the original alert holding unit 22. One record in FIG. 3 indicates information included in one alert. In the record ID field, a serial number for uniquely indicating the stored alert is set. Alert identification information is set in the alert ID field. In the device name field, identification information of the NE 12 that has output the alert is set. In the detection date / time field, the date / time when the occurrence or recovery of the failure is detected in the NE 12 is set. In the alert content field, information indicating the content of the failure, for example, whether the failure has occurred or has been recovered is set.

  Returning to FIG. 2, the dependency relationship holding unit 24 is a storage area that holds dependency relationships between alerts respectively output from the two NEs 12. That is, the dependency relationship of alerts in each combination of NE-A 12a and NE-B 12b, NE-A 12a and NE-C 12c, NE-B 12b and NE-C 12c,.

  FIG. 4 shows an example of data stored in the dependency relationship holding unit 24. This figure shows the dependency between the alert of NE-A 12a and the alert of NE-B 12b. The vertical axis indicates a list of alerts output from the NE-A 12a, and the horizontal axis indicates a list of alerts output from the NE-B 12b.

  The first indicator 60 indicates a relationship in which an alert is generated in the NE-B 12b as an alert is generated in the NE-A 12a. For example, when “ERROR-008” is output from the NE-A 12a, “ERROR-005” is output from the NE-B 12b. This is a situation in which a failure occurs in NE-A 12a and a failure also occurs in NE-B 12b due to the failure, in other words, a situation in which the root cause of the failure in NE-B 12b is a failure in NE-A 12a. Typically occurs. In this case, “ERROR-008” of NE-A 12a is the main alert, and “ERROR-005” of NE-B 12b is the accompanying alert.

  The second indicator 62 indicates a relationship in which an alert is generated in the NE-A 12a as an alert is generated in the NE-B 12b. That is, when “ERROR-007” is output from the NE-B 12b, “ERROR-011” is output from the NE-A 12a. In this case, “ERROR-007” of NE-B 12b becomes the main alert, and “ERROR-011” of NE-A 12a becomes the accompanying alert.

  In the spillover degree 64, a degree (hereinafter also referred to as “spillover degree”) in which the occurrence of each alert of the NE-A 12a causes the occurrence of each alert of the NE-B 12b is set. Specifically, the total number of the first indicators 60 set in each alert of the NE-A 12a is set as the ripple degree. In the dependency level 66, a degree (hereinafter also referred to as “dependency level”) in which each alert of the NE-A 12a is caused depending on the occurrence of each alert of the NE-B 12b is set. Specifically, the total number of second indicators 62 set in each alert of NE-A 12a is set as the dependency.

  In the dependency 68, the dependency of each alert of the NE-B 12b with respect to each alert of the NE-A 12a is set. Specifically, the total number of first indicators 60 set in each alert of NE-B 12b is set as the dependency. In the spillover degree 70, the spillover degree of each alert of the NE-B 12b with respect to each alert of the NE-A 12a is set. Specifically, the total number of the second indicators 62 set for each alert of the NE-B 12b is set as the ripple degree.

  The dependency relationship holding unit 24 is a part of the NE 12 constituting the communication system 100 as a range of accompanying alerts having a dependency relationship with a main alert from a reference NE 12 (hereinafter referred to as “reference NE”). Keep dependencies only for alerts from. In the present embodiment, the NE 12 adjacent to the reference NE (hereinafter referred to as “adjacent NE”) and the NE 12 adjacent to the adjacent NE and connected to the reference NE via the adjacent NE (hereinafter referred to as “adjacent NE”). The alert output from the above is set as the range of the dependent alert. For example, in the communication system 100, when the NE-A 12a in FIG. 1 is used as the reference NE, an alert output from the NE-B 12b that is an adjacent NE and the NE-C 12c that is an adjacent NE is set as the range of the dependent alert.

  Limiting the range of the incidental alert to the proximity NE is to set the range of the incidental alert in order to detect a large number of incidental alerts, and to reduce the processing amount and hardware resources of the monitoring device 10. The present inventor has come up with a comparative consideration that the range of the accompanying alert should be set narrow. In other words, based on the knowledge that many of the dependency relationships between alerts can be covered by the range up to the neighboring NE, the monitoring device is able to maintain the detection accuracy of the accompanying alert by limiting the range of the accompanying alert to the neighboring NE. Reduction of 10 processing amount and hardware resources is realized.

  Returning to FIG. 2, the display alert holding unit 26 is a storage area for holding alert display data after being edited into a format to be displayed on the display. FIG. 5 shows an example of data stored in the display alert holding unit 26. This figure shows a state after editing each alert shown in FIG. That is, the alerts with the record IDs “00501”, “00503”, “00506”, “00508” are deleted (not displayed), while the alerts with the record IDs “00502-1”, “00505-1” are deleted. Has been added.

  Returning to FIG. 2, the trail holding unit 28 is a storage area that holds, as a trail, the contents of processing edited from the original alert data to the display data. Specifically, the contents and the reason for modification when the original data of the original alert holding unit 22 is used as the display data of the display alert holding unit 26 are stored.

  FIG. 6 shows an example of data stored in the trail holding unit 28. In the processing content field, the content of the editing processing is set. For example, “non-display” indicating that the alert is not displayed and “add” indicating that a new alert is added are set. The reason for executing these editing processes is set in the process reason field.

  For example, for record ID “00501,” ERROR-005 output by NE-B 12b is an accompanying alert of ERROR-008 output by NE-A 12a, indicating that it is not displayed. For record ID “00502-1”, ERROR-010 of NE-B12b is an accompanying alert, but ERROR-012 of NE-A12a, which is the main alert, has not been detected. Indicates that an alert has been added.

  Returning to FIG. 2, the data processing unit 30 includes an alert acquisition unit 32, a dependency relationship setting unit 34, and a display control unit 36. The alert acquisition unit 32 receives the alert transmitted from each of the NE-A 12a to NE-J 12j and stores the data in the original alert holding unit 22 as the original data of the alert.

  The dependency relationship setting unit 34 refers to the original data of the alert held in the original alert holding unit 22 to determine the dependency relationship between the alerts output from each of the different NEs 12. Then, the data indicating the dependency relationship, for example, the data illustrated in FIG. 4 is stored in the dependency relationship holding unit 24. Specifically, for each alert output from the reference NE, the dependency relationship setting unit 34 sets the adjacent NE and the proximity NE according to the detection date and time indicated by each alert and the grace period preset by the reference NE. The dependency with each alert output from is determined.

  The grace period is a period provided in advance for notifying a fault with a high degree of accuracy when a fault detected in the NE 12 is recovered immediately or when a fault is erroneously detected. It may be 1 second. When the NE 12 detects the recovery of the failure during the grace period, the NE 12 cancels the alert notification of the failure to the monitoring device 10.

  FIG. 7 shows an example of determination of dependency. The horizontal axis in the figure is the elapsed time. Assume that an alert indicating the occurrence of ERROR-008 and an alert indicating recovery have been received from NE-A 12a. The time zone of t1 + t2 in the figure is obtained by adding a grace period (= t1 = t2) before and after the failure occurrence detection time of ERROR-008. The time period of t3 + t4 is obtained by adding a grace period (= t3 = t4) before and after the failure recovery detection time of ERROR-008. In this case, among the alerts output from the NE-B 12b, ERROR-005 whose failure occurrence detection time is included in t1 + t2 and failure recovery detection time is included in t3 + t4 is specified as an alert having a dependency. Then, a dependency is set with ERROR-008 of NE-A 12a as a main alert and ERROR-005 of NE-B 12b as an accompanying alert.

  The dependency relationship setting unit 34 first identifies the dependency relationship with the NE-B 12b using the NE-A 12a as a reference NE, and sets the first indicator 60 of FIG. Next, the NE-B 12b is used as a reference NE, the dependency relationship with the NE-A 12a is specified, and the second indicator 62 in FIG. 4 is set. Then, the ripple degree 64, the dependency degree 66, the dependence degree 68, and the ripple degree 70 are calculated, and the setting of the dependency relationship between the alert of the NE-A 12a and the alert of the NE-B 12b is completed. Similarly, a dependency relationship between the alert of NE-A 12a and the alert of NE-C 12c is set.

  In the present embodiment, in the dependency setting process, all the NEs 12 are used as reference NEs in turn. That is, after one NE 12 is set as a reference NE and the dependency is set, another NE 12 is set as a reference NE and the dependency is set. However, when the dependency relationship overlaps among the plurality of NEs 12, the alert of the NE 12 having a high priority predetermined among the plurality of NEs 12 is set as a main alert, and the alert of the other NE 12 is set as an accompanying alert. This priority may be set higher for the NE 12 where the failure is likely to spread to other NEs 12, the NE 12 having a large number of communication lines, or the NE 12 installed in a large city. For example, in the present embodiment, the priority of NE-A12a> NE-B12b is set. Therefore, between the NE-A 12a alert “ERROR-008” and the NE-B 12b alert “ERROR-005”, the former is the main alert and the latter is the accompanying alert.

  As a modification, only a part of the plurality of NEs 12 may be selected by the user as the reference NE. For example, the NE 12 that is assumed to easily spread to other NEs 12, the NE 12 having a large number of communication lines, or the NE 12 installed in a large city may be selected.

  The display control unit 36 sends the alert data output from each NE 12 of the communication system 100 to a predetermined display for display. The display control unit 36 includes a display mode determination unit 38, a trail recording unit 40, and an alert display unit 42.

  The display mode determination unit 38 refers to the dependency relationship between alerts, and determines the display mode of the alert presented to the user so that the visibility of the main alert is higher than that of the accompanying alert. In the present embodiment, the visibility of the main alert is relatively enhanced by hiding the accompanying alert. In addition, when the accompanying alert is acquired by the alert acquiring unit 32 and the main alert corresponding to the accompanying alert has not been acquired, the display mode determining unit 38 has not acquired the main alert that should originally be acquired. The display mode is determined so as to display the effect.

  The display mode determination unit 38 sets alert display data from the alert original data held in the original alert holding unit 22 according to the determined display mode, and stores the alert display data in the display alert holding unit 26. Specifically, the main alert data is transferred from the original alert holding unit 22 to the display alert holding unit 26, and the accompanying alert data is not transferred. Further, data indicating that the main alert has not been acquired is further stored in the display alert holding unit 26.

  FIG. 8 is a flowchart showing a processing algorithm of the display mode determination unit 38. When a predetermined processing interval (for example, 1 minute) has elapsed since the previous display mode determination process (Y in S10), the display mode determination unit 38 executes the following processing. If the processing interval has not elapsed since the previous display mode determination processing (N in S10), the following processing is skipped and the flow of this figure is ended.

  The display mode determination unit 38 selects ERROR-j, which is an alert (hereinafter, also referred to as “target alert”) as a target of the display mode determination process, from among the alerts received during the processing interval. In the present embodiment, target alerts are selected in ascending order of record IDs in the original alert holding unit 22. The display mode determination unit 38 refers to the dependency relationship holding unit 24 and adjusts the dependency degree of the target alert with respect to other alerts according to the distance relationship between the NEs 12 (hereinafter also referred to as “adjustment dependency degree”). ) Calculate (S12).

  The display mode determination unit 38 uses the NE 12 that has output the target alert as a reference NE, and calculates an adjustment dependency for each combination of each alert output from the adjacent NE and the adjacent NE and the target alert. For example, when NE-A12a ERROR-001 is the target alert, “the combination of the target alert with NE-B12b ERROR-001 and NE-C12c ERROR-001”, “the target alert and NE- Adjusted for each combination of B12b ERROR-002 and NE-C12c ERROR-002 ", ..." Target alert and NE-B12b ERROR-015 and NE-C12c ERROR-015 " Dependency is calculated.

Specifically, the adjustment dependency is calculated according to the following calculation formula.
Adjustment dependency = Σ (index value indicating presence / absence of dependency / distance from reference NE)
The “distance from the reference NE” is an index value indicating the distance from the reference NE to the adjacent NE or the adjacent NE, and is 1 for the adjacent NE and 2 for the adjacent NE. The “index value indicating presence / absence of dependency” is an index value indicating the presence / absence of a main alert having the target alert as an accompanying alert. For example, in the dependency relationship of FIG. 4, when NE-A 12a is the reference NE, 1 is set if the second indicator 62 is set, and 0 is set if it is not set. When NE-B 12b is the reference NE, 1 is set if the first indicator 60 is set, and 0 is set if the first indicator 60 is not set.

  According to the above calculation formula, if the target alert is an accompanying alert to an alert from an adjacent NE, the adjustment dependency is 1. In addition, if the target alert is an accompanying alert for an alert from a neighboring NE, the adjustment dependency is 0.5. If the alert is an accompanying alert for both an alert from an adjacent NE and an alert from an adjacent NE, the adjustment dependency is 1.5. In addition, the adjustment dependency is 0 if the alert from the adjacent NE and the alert from the adjacent NE are not incidental alerts.

  If there is an ERROR-k having an adjustment dependency of 1 or more (Y in S14) and the ERROR-k has been acquired from the adjacent NE (Y in S16), ERROR-j is not displayed ( S18). That is, if the target alert is an accompanying alert for the main alert that has been output from the adjacent NE, the target alert is not displayed. If ERROR-k is not acquired from the adjacent NE (N in S16), ERROR-j is set as a display target and ERROR-k is set as an undetected candidate (S20).

  There is no ERROR-k whose adjustment dependency is 1 or more (N in S14), but there is an ERROR-l whose adjustment dependency is 0.5 or more (Y in S22). If it is acquired from the neighboring NE (Y in S24), ERROR-j is not displayed (S18). That is, if the target alert is an accompanying alert for the main alert that has been output from the proximity NE, the target alert is not displayed. If ERROR-l is not acquired from the neighboring NE (N in S24), ERROR-j is set as a display target and ERROR-l is set as an undetected candidate (S26).

  When there is no ERROR-l having an adjustment dependency of 0.5 or more (N in S22), the target alert ERROR-j is set as a display target (S28). This is because the target alert is not an accompanying alert of other alerts in the first place. If the display mode determination process for all alerts is completed (Y in S30), the flow in this figure is terminated. If there is an unprocessed alert (N in S30), the process returns to S12.

  The trail recording unit 40 sequentially records the reason why the accompanying alert is not displayed and the reason why the message indicating that the main alert has not been acquired is added to the trail holding unit 28. The display control unit 36 may appropriately display the processing reason recorded in the trail holding unit 28 on an external display.

  The alert display unit 42 sequentially outputs and displays the alerts to be displayed, that is, the records added to the display alert holding unit 26 on an external display. An alert display request may be received from an external device, and display data of the display alert holding unit 26 may be output to the external device or a predetermined output device as a response to the request.

The operation of the above configuration will be described below.
The dependency setting unit 34 of the monitoring device 10 refers to the original data of alerts output in the past from the plurality of NEs 12 in the communication system 100, sets the dependency between the plurality of alerts, and sets the data as a dependency holding unit 24. Each of the plurality of NEs 12 detects the occurrence or recovery of a failure and sequentially outputs an alert indicating that fact. The alert acquisition unit 32 of the monitoring device 10 sequentially acquires alerts output from the NEs 12 and stores the data in the original alert holding unit 22.

  The display mode determination unit 38 refers to the dependency relationship between alerts held in the dependency relationship holding unit 24, sets alert display data from the original alert data, and stores it in the display alert holding unit 26. The trail recording unit 40 records the processing reason in the alert display data setting process, in other words, the reason for alteration from the original data of the alert in the trail holding unit 28. The alert display unit 42 sequentially displays records of display data added to the display alert holding unit 26 on an external display.

  For example, when the dependency shown in FIG. 4 is set between the NE-A 12a alert and the NE-B 12b alert, the alert display data shown in FIG. 5 is set from the alert original data shown in FIG. Also good. At the same time, the reason for processing in FIG. 6 may be recorded.

  Until now, for example, in situations where repeated notification of occurrence or recovery of a phenomenon such as a momentary disconnection of the line or an error rate is repeated, the main alert and accompanying alerts are mixed, and the grace period is also set. Together, it took time to identify the root cause of the failure. According to the monitoring device 10 of the present embodiment, the visibility of the main alert can be relatively improved by hiding the accompanying alert. Since the main alert indicates the root cause of the failure, it is possible to support the user's work for identifying the root cause of the failure by increasing the visibility of the main alert. The user can quickly identify the root cause of the failure and quickly remove the root cause or take preventive measures. Therefore, maintainability of the communication system 100 is improved and MTTR (Mean Time To Repair) is reduced.

  Moreover, according to the monitoring apparatus 10, when only the accompanying alert is acquired, in addition to the display of the accompanying alert, it displays that the corresponding main alert is not acquired. As a result, even when a situation in which the main alert is not detected, for example, when a failure has occurred that prevents notification of the main alert in the NE that should output the main alert, the main alert indicating the root cause of the failure can be suggested to the user. Furthermore, the reason for setting the alert display data is recorded, so that the user can verify the validity of the display data setting process as necessary.

  Furthermore, according to the monitoring device 10, it is possible to appropriately set the dependency between alerts based on the grace period set by the NE 12. In addition, by setting the dependency relationship between alerts indicating the occurrence of a failure on the condition that the dependency relationship is established between alerts indicating failure recovery, the possibility of erroneous setting of the dependency relationship can be reduced.

  Furthermore, the range in which the dependency relationship is set is limited to the alerts that are output from the reference NE, the adjacent NE, and the adjacent NE, which are assumed to have a high possibility of establishing the dependency relationship. Thereby, it is possible to reduce the data processing amount required for setting the dependency relationship in the monitoring apparatus 10 and the data amount of the dependency relationship to be retained.

  The present invention has been described based on the embodiments. This embodiment is an exemplification, and it will be understood by those skilled in the art that various modifications can be made to combinations of the respective constituent elements and processing processes, and such modifications are also within the scope of the present invention. is there. A modification is shown below.

  A first modification will be described. In the above embodiment, the dependency relationship is set among the alerts output from the reference NE, the adjacent NE, and the adjacent NE. As a modification, a dependency relationship may be set between alerts output from the reference NE and NEs that are further away from the neighboring NE. Further, a dependency relationship may be set between alerts output by all NEs existing in the communication system 100. In this case, in setting the adjustment dependency, the distance from the reference NE may be set to 3, 4, 5,. Further, for each NE to be added, the same processing as S14 to S20 and S22 to S26 in FIG. 8 may be added, and the comparison threshold value with the adjustment dependency is 1/3, 1/4, It may be set as one fifth. According to this modification, since the setting range of the dependency relationship is expanded, it is easy to specify more accompanying messages that are not displayed, and it is easy to display alerts in a concise manner.

  A second modification will be described. In the above embodiment, the first dependency data indicating the dependency relationship between the alerts output from the reference NE and the neighboring NE, and the second dependency indicating the dependency relationship between the alerts output from the reference NE and the neighboring NE. Retained separately from related data. In the modification, the first dependency relationship data may be applied as a dependency relationship between alerts output from the reference NE and the proximity NE. According to this modified example, common dependency relationship data can be used in a plurality of combinations of NEs, and therefore the amount of dependency relationship data to be retained can be reduced. In the case where both the adjacent NE and the adjacent NE are the same type of NE, the possibility of common dependency increases, which is a particularly useful aspect.

  A third modification will be described. When selecting the target alert, the display mode determination unit 38 refers to the dependency relationship of each alert received from the plurality of NEs 12, and has a high degree of spreading to other alerts, that is, the spreading degree 64 and the spreading degree 70. You may select with priority over alerts. According to this modification, it is easy to promptly determine the display mode of an alert that has a low possibility of being an accompanying alert, that is, a high possibility of a main alert, and to promptly present the main alert to the user.

  A fourth modification will be described. When selecting the target alert, the display mode determination unit 38 refers to the dependency relationship of each alert received from the plurality of NEs 12, and has a large degree of dependence on other alerts, that is, the dependence degree 66 and the dependence degree 68. You may select with priority over alerts. According to this modification, the display mode of the alert that is likely to be an accompanying alert, that is, the possibility that the main alert is low, is quickly determined, and when there is an undetected main alert, the main alert is quickly transmitted to the user. It becomes easy to present.

  A fifth modification will be described. In the above embodiment, the accompanying alert is not displayed. In the modified example, the accompanying alert may be displayed, and at that time, the accompanying alert may be displayed in a mode that is less conspicuous than the main alert and is assumed to have low visibility. For example, when the main alert is displayed in black, the accompanying alert may be displayed in light gray, or the accompanying alert may be displayed with a smaller character size than the main alert.

  A sixth modification will be described. In the above embodiment, the accompanying alert is not displayed. In the modified example, it may be configured such that the user can select whether or not to display the accompanying alert and in what manner the accompanying alert is displayed. The display mode determination unit 38 determines the display mode of each alert according to the user's selection. Accordingly, the user can select an appropriate display method of the accompanying alert according to the operation policy for alert monitoring.

  Any combination of the above-described embodiments and modifications is also useful as an embodiment of the present invention. The new embodiment generated by the combination has the effects of the combined embodiment and the modified examples.

  It should also be understood by those skilled in the art that the functions to be fulfilled by the constituent elements recited in the claims are realized by the individual constituent elements shown in the embodiments and the modified examples or by their linkage.

  DESCRIPTION OF SYMBOLS 10 Monitoring apparatus, 12 NE, 22 Original alert holding | maintenance part, 24 Dependency holding part, 26 Display alert holding | maintenance part, 28 Trail holding part, 32 Alert acquisition part, 34 Dependency setting part, 36 Display control part, 38 Display mode determination Section, 40 trail recording section, 42 alert display section, 100 communication system.

Claims (8)

A device for managing alerts of a plurality of communication devices,
A dependency holding unit that holds a dependency indicating that an accompanying alert that is an alert from another communication device is generated when a main alert that is an alert from the reference communication device is generated;
An alert acquisition unit for acquiring an alert output from the plurality of communication devices;
A display control unit that refers to the dependency relationship and displays the main alert on a predetermined display device with higher visibility than the accompanying alert,
An alert management device comprising:   The alert according to claim 1, wherein the display control unit further displays that the main alert is not acquired when the accompanying alert is acquired but the main alert is not acquired. Management device.   On the condition that the event occurrence time indicated by the alert from the other communication device is within a predetermined period from the event occurrence time indicated by the alert from the reference communication device, a dependency is established between the two alerts. The alert management device according to claim 1, further comprising a dependency relationship setting unit to be set.   The reference communication, provided that a dependency relationship is established between the alert indicating failure recovery output from the reference communication device and the alert indicating failure recovery output from the other communication device. The apparatus further comprises a dependency setting unit that sets a dependency relationship between an alert indicating the occurrence of a failure output from a device and an alert indicating the occurrence of a failure output from the other communication device. Or the alert management device according to 2;   The dependency relationship holding unit includes a communication device adjacent to the reference communication device, a communication device adjacent to the adjacent communication device, and connected to the reference communication device via the adjacent communication device. The alert management device according to any one of claims 1 to 4, wherein a dependency relationship that holds a range of the other communication device is maintained.   The alert according to any one of claims 1 to 5, wherein when the visibility of the main alert is increased, the display control unit records information indicating the dependency relationship in a predetermined file as a basis for the visibility. Management device. A device for managing alerts of a plurality of communication devices,
Among the alerts output from the plurality of communication devices, the main alert that is the alert output from the communication device serving as a reference is more than the incidental alert that is the alert output from another communication device when the main alert occurs. An alert management device comprising a display control unit for improving visibility and displaying on a predetermined display device. A method performed by a device that manages alerts of a plurality of communication devices, comprising:
Obtaining an alert output from the plurality of communication devices;
Refers to the dependency relationship indicating that an accompanying alert that is an alert from another communication device occurs when a primary alert that is an alert from a reference communication device occurs, and the visibility of the main alert is higher than the accompanying alert Increasing and displaying on a predetermined display device;
An alert management method comprising:

Images