WO2007143943A1

WO2007143943A1 - Method, system and network device of centralized maintenance of multiple devices

Info

Publication number: WO2007143943A1
Application number: PCT/CN2007/070076
Authority: WO
Inventors: Xiaohong Gao; Huili Lu; Wentang Zhong
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2006-06-01
Filing date: 2007-06-01
Publication date: 2007-12-21
Also published as: CN101047556A; CN100479385C

Abstract

A method, system and network device of centralized maintenance of multiple devices. The method includes: an alarm collecting system transmits alarms of each system device to a centralized maintenance center, the centralized maintenance center filters the received alarms according to the predetermined alarm filtering conditions, the centralized maintenance center maintains the system devices according to the filtered alarms. By setting the predetermined alarm filtering conditions, it makes the centralized maintenance center determine the valuable alarms quickly. Predetermined alarm filtering conditions can be divided into multi-levels, such as physical relevant relationship information, initial relevant analyzing information and alarm special relevant analyzing information, etc.

Description

Description A multi-device centralized maintenance method, system and network device

[1] Technical field

[2] The present invention relates to the field of network communication technologies, and in particular, to a multi-device centralized maintenance method, system, and network device.

[3] Background of the invention

[4] With the development of mobile communication services, the scale of mobile communication networks is becoming larger and more complex. The management and maintenance of mobile communication networks is also becoming more and more important.

[5] The alarm of the network element device in the mobile communication network is an important observation object for network management and maintenance. The alarm of the network element device directly reflects the health of the network element device. It is a barometer of the network element device and is a daily device operation. The main basis for maintenance.

[6] In the telecommunications industry, centralized network management of each network element device in a communication network is a development trend.

The multi-device centralized maintenance system can manage each NE device separately or jointly for each NE device. The multi-device centralized maintenance system is shown in Figure 1.

[7] Figure 1

The multi-device centralized maintenance system includes: one or more system devices, an alarm collection system, and a centralized maintenance center. The system device is the network element device, and the multiple system devices are the system device 1 to the system device N. Each NE device is a complex system consisting of multiple boards. The alarms of the NE devices and their boards are transmitted to the near-end maintenance terminal and the remote centralized maintenance center through the alarm collection system. The alarm collection system can be a fixed physical entity or a fixed physical entity. The centralized maintenance center receives each alarm information and displays each alarm information.

[8] Because multiple network elements in the communication system and each board depend on each other, interact with each other, and work together or cooperate to complete the system function. Therefore, there is a tight or loose relationship between multiple network elements and boards. The relationship between the single-board device and the single-board device may cause abnormalities in other boards or other network element devices or even system functions. That is, an alarm on one board may cause other boards and network element devices to be generated. The alarms, thus, result in a large number of alarms in the centralized maintenance center.

[9] Since the alarm information is mainly analyzed by a single alarm processing mechanism, that is, each network element device The alarms are simply collected, displayed, and monitored. Therefore, the number of alarms in the centralized maintenance center is high, and important alarm information is often overwhelmed and cannot be discovered. Therefore, it is impossible to analyze the root cause of the problem, thereby increasing the number of alarms. Maintaining workload and maintenance difficulty ultimately leads to poor maintainability and manageability of the communication system.

[10] Summary of the invention

[11] The embodiments of the present invention provide a multi-device centralized maintenance method, system, and network device, which can quickly determine valuable alarms by using predetermined alarm screening conditions, so that the centralized maintenance center can perform effective maintenance and management on each system device. Improve the maintainability of system equipment.

[12] A multi-device centralized maintenance method provided by an embodiment of the present invention includes:

[13] The alarm collection system transmits the alarms of each system device to the centralized maintenance center;

[14] The centralized maintenance center filters the alarms it receives according to predetermined alarm screening conditions;

[15] The centralized maintenance center maintains system equipment based on the alarms obtained after screening.

[16] The embodiment of the present invention further provides a multi-device centralized maintenance system, including: a plurality of system devices, an alarm collection system, and a centralized maintenance center, wherein the alarm collection system transmits the alarm of the system equipment to the centralized maintenance center, The centralized maintenance center is also equipped with:

[17] The alarm management unit: filters the alarms received by the centralized maintenance center according to the predetermined alarm screening conditions, and transmits the alarms obtained after the screening to the centralized maintenance unit;

[18] Centralized Maintenance Unit: Maintains system equipment based on the alarms it receives.

[19] The embodiment of the present invention further provides a network device, which is a centralized maintenance center in a multi-device centralized maintenance system, and the centralized maintenance center is further configured with:

[20] The alarm management unit: filters the alarms received by the centralized maintenance center according to the predetermined alarm screening conditions, and transmits the alarms obtained after the screening to the centralized maintenance unit;

[21] Centralized maintenance unit: Maintains system equipment based on the alarms it receives.

[22] According to the description of the foregoing technical solution, the embodiment of the present invention can enable the centralized maintenance center to quickly determine a valuable alarm by setting a predetermined alarm screening condition; thereby improving the system device by using the technical solution provided by the embodiment of the present invention. The purpose of maintainability.

[23] BRIEF DESCRIPTION OF THE DRAWINGS

[24] Figure 1 is a schematic diagram of a multi-device centralized maintenance system; 2 is a schematic diagram of a multi-device centralized maintenance system according to an embodiment of the present invention;

FIG. 3 is a schematic diagram 1 of an alarm association tree according to an embodiment of the present invention; FIG.

4 is a flowchart of processing an alarm association tree engine according to an embodiment of the present invention;

FIG. 5 is a second schematic diagram of a logical association tree according to an embodiment of the present invention.

[29] Mode for carrying out the invention

[30] In the multi-device centralized maintenance method and system of the embodiment of the present invention, the alarm collection system transmits the alarms of the system devices to the centralized maintenance center, and the centralized maintenance center filters the alarms received according to the predetermined alarm screening conditions. The system equipment is maintained according to the alarms obtained after the screening.

[31] The method and system provided by the embodiments of the present invention are further described below.

[32] The alarms received by the centralized maintenance center in the multi-device centralized maintenance system need to be filtered, because the alarms of the system equipment are repeatedly reported, the alarm levels are different, and the alarms are generated between the alarms. The filtered alarms can be presented hierarchically and sub-category. The screening process of the alarm by the centralized maintenance center in the embodiment of the present invention may include two layers, namely, physical association analysis processing and logical association analysis processing. Through the physical association analysis process, the centralized maintenance center can filter out some redundant alarm information, and the logical maintenance analysis process enables the centralized maintenance center to quickly and accurately determine the primary alarm and the secondary alarm, so that fault location can be quickly and accurately performed. , enable the centralized maintenance center to effectively maintain and manage each system equipment. The method and system provided by the embodiments of the present invention may be separately managed for one system device, or may be jointly managed for multiple system devices.

[33] Below with reference to Figure 2

A multi-device centralized maintenance system and method provided by an embodiment of the present invention will be described.

[34] Figure 2

The alarm collection system collects alarms of each system device and transmits them to the centralized maintenance center. The centralized maintenance center can display the alarms transmitted by the alarm collection system in the form of alarm sequences.

[35] The alarm sequence transmitted to the centralized maintenance center needs to be processed through physical association analysis first. The function of physical association analysis processing is implemented by the alarm management unit. The physical association of alarms is characterized by: The association of alarms does not depend on the network model, and it is not necessary to understand the interdependencies between alarms. Only the parameters, attributes, and categories of alarms are analyzed, so that the centralized maintenance center can Provide different alarm observations Latitude, effectively grasp the operation of each system equipment.

[36] The methods of physical association analysis mainly include: alarm compression analysis, alarm filtering analysis, alarm suppression analysis, alarm counting analysis, alarm summary analysis, alarm thinning analysis and alarm inter-day correlation analysis, that is, the function of the alarm management unit is mainly The alarm compression analysis module, the ignore alarm analysis module, the replacement alarm analysis module and the alarm summary analysis module are implemented, wherein the ignore alarm analysis module mainly includes: an alarm filtering analysis sub-module, an alarm suppression analysis sub-module, and a diurnal correlation analysis sub-module. The replacement alarm analysis module mainly includes: an alarm count analysis sub-module and an alarm refinement analysis sub-module.

[37] The functions of each physical association analysis method and module and submodule are shown in Table 1.

[38] Table 1

[39]

Analysis Method Overview Representation Method Application Scenario Alarm Compression Analysis The same occurs multiple times. For the inter-turn window [Τ1, Τ2] multiple occurrences

告警 J Π Alarm [A, A, Α] alarm, can be greatly reduced

We can compress an alarm 频繁[η] for frequent occurrences, the number of alarms, and the number of alarms: η is the number of occurrences, such as frame out-of-step alarms, etc.

告警 Alarm filtering analysis Ignore alarms that do not meet the given alarms that do not satisfy the given bar Signaling link flashing alarm condition [Α ρ(Α) Processing relay flashing alarm

]=>Do not display the alarm alarm suppression analysis in the specific context for the alarm sequence [A1, board failure, suppression of certain alarms 2, Α3, Β] 'Unit failure in the A1 A2 board, As in the high level of A3 eB, then Π

Alarm occurrence 吋Ignore level [A1, A2, A3, B] = >B The alarm alarm count is not low. The specified number of replacements is the same [nx A]=>B. When the alarm repeatedly occurs, the alarm needs to be upgraded. The level of the new type of alarm is as follows:

The trunk circuit is frequently flashed. 吋 Although the flashing time is short, it will affect the service. Therefore, the alarm level should be reported and upgraded.

Alarm summary analysis Classify alarms, critical alarms [Al, A2 Provide dimensions for observation according to alarm network management type, B, C] Classification

Important alarms [A3, A4 are classified according to severity

[40] From Table 1

It can be seen that the centralized maintenance center effectively reduces the redundant information of the alarm through physical association analysis, and can classify and collect the alarms so that the alarm information can be clearly and systematically displayed in the centralized maintenance center.

[41] The centralized maintenance center needs to perform logical association analysis on the alarm information processed by the physical association analysis. The logical association analysis of the alarm can perform in-depth alarm correlation analysis based on the physical association analysis to obtain the root node alarm in each alarm. That is, the main alarm, thereby determining the root cause of the failure of the system equipment. [42] Logical association analysis can be implemented by generating an alarm correlation tree. The centralized maintenance center can generate an alarm correlation tree based on the initial association analysis information of the alarm and the special association analysis information of the alarm.

[43] The centralized maintenance center can set the initial association analysis information of the alarm according to the logical relationship between the different alarms based on the correlation between the diurnal correlation and the parameter correlation. The initial association analysis information is stored in the initial logical association storage module.

[44] The initial logical association and the special logical associations described below can be collectively referred to as Figure 2.

Expert knowledge base.

[45] The initial association analysis information of the alarm in the expert knowledge base mainly includes: an alarm identifier, an associated alarm identifier, an upper limit of the alarm time, a lower limit of the alarm time, a parameter correspondence relationship of the interrelated alarm, and a special association analysis instruction information. For the troubleshooting of faults, the initial association analysis information of the alarm in the expert knowledge base may also include: information such as the cause of the alarm, the recovery suggestion, and the impact of the alarm.

[46] The alarm represented by the alarm identifier and the alarm represented by the associated alarm identifier meet the upper limit of the alarm correlation and the lower limit of the alarm correlation between the alarm generation, and the parameters of the two alarms satisfy the parameter correspondence relationship, that is, It can be determined that the two alarms are interrelated alarms.

[47] The special association analysis indication information is used to indicate that the alarm represented by the alarm identifier may also have an alarm with which it has a deeper association.

[48] The parameter correspondence of the interrelated alarms may be an equal relationship between the parameters of the two interrelated alarms, or may be a calculation relationship between the parameters of the two interrelated alarms.

[49] Table 2 is an example of initial association analysis information in a specific expert knowledge base.

[50] Table 2

[51]

[52] Parameter 1 to parameter 7 in Table 2 are the parameters corresponding to the alarms associated with each other, and the special association ID

That is, special association analysis indication information.

[53] In Table 2, alarm 1 has a logical relationship with alarm 2, alarm 3, and alarm 5, respectively, with alarm 1 and alarm 2

The logical relationship between the two is used as an example to describe the logical relationship between different alarms. Alarm 1 and Alarm 2 respectively include 4 parameters, and parameter 1 of alarm 1 is equal to parameter 1 of alarm 2, parameter 2 of alarm 1 is equal to parameter 2 of alarm 2, parameter 3 of alarm 1 and parameter 3 of alarm 2 Equal, parameter 4 of alarm 1 is equal to parameter 4 of alarm 2. The upper limit of the correlation between alarm 1 and alarm 2 and the lower limit of the correlation between the two are both 1, that is, alarm 1 and alarm 2

The generation should be the same.

[54] The parameter 1 of alarm 1 in Table 2 has a calculation relationship with the parameter 1 of alarm 3. The calculation relationship is the formula F1 [55] Logical correlation analysis module 1

According to the initial association analysis information in the expert knowledge base, the alarm correlation tree can be used to generate at least one alarm association tree for the alarms after the physical association analysis. The initial association analysis information and the alarm correlation tree analysis engine are relatively independent in the centralized maintenance center. In the embodiment of the present invention, the alarm association tree generated by the initial association analysis information may be a tree with only one root node alarm, that is, the alarm has no logical relationship with the alarm, and the alarm does not trigger other alarms. It is called an independent node.

[56] In the association between different alarms, the logical relationship between some alarms is complex. It cannot be easily analyzed through the logical association between alarms and alarm parameters. This part of the logic is complex with alarms such as network elements. Alarms caused by external interface devices, alarms caused by internal communication units of network elements, signal relationships of different transmission media, etc., are classified as follows:

[57] External interface analysis: such as MSC's office route signaling link correlation analysis, office circuit correlation analysis;

[58] Equipment management upper and lower level management level fault relationship analysis;

[59] Alarm system association analysis: including the conversion relationship between optical path and voice channel;

[60] Internal communication system alarm correlation analysis;

[61] Business Logic Association Analysis.

[62] Logical correlation analysis of this part of the alarm, in addition to the need to use the initial correlation analysis information based on the inter-day correlation and parameter relevance, it also needs to include the method of overall planning, and its parameter correlation analysis is much more complicated. Cross-analysis of multiple attributes of two types of alarms, such as for an MSC

Office route, circuit/link/relay group of the office/

Relay devices are attributes of this office direction, and correlation analysis is required.

[63] In order to further discover further logical associations between different alarms, the centralized maintenance center may also set a special association analysis letter of the alarm according to the logical association relationship based on data mining between different alarms. Interest. The special association analysis information is stored in a special logical association storage module. Initial association analysis information and special association analysis information are important components of the expert knowledge base. The special association analysis information mainly includes: an alarm identifier, an associated alarm identifier, a correlation table number, a system configuration table name, an input parameter, an input field, an output parameter, an output field, and the like.

[64] The special association analysis is based on the formulas and algorithms defined in the expert knowledge base, and the relationship between the alarm parameters in the system configuration library is judged and judged. The number of association tables indicates the special association analysis of the alarms. 吋, the number of system configuration tables that need to be queried. The input field and the output field are generally algorithm formulas, and the input parameters indicate their corresponding alarm parameters. For example, if the input parameter is N, it indicates the Nth parameter of the corresponding alarm. The output parameter indicates its corresponding alarm parameter, such as the output parameter is M.

, indicating the M of the corresponding alarm

Parameters. The input parameters need to be substituted into the input field and queried in the table corresponding to the system configuration table name. The output parameters need to be substituted into the output field. When the records obtained by the input field query result and the output field conform to a certain algorithm, the two alarm identifiers are represented. The corresponding alarm has a special alarm relationship. If the output field defaults, it indicates the record and output parameters obtained when the input field query results.

Similarly, the alarms corresponding to the two alarm identifiers have a special alarm association relationship. If there is only a field name in the output field, it means the content and output parameter in the field name of the output field in the record obtained by the input field query result.

Similarly, the alarms corresponding to the two alarm identifiers have a special alarm association relationship. There can be one or more input parameters, and one or more output parameters.

[65] The complex logical relationship of multiple lookup tables can be defined in the expert knowledge table. When the number of association tables is greater than 1

吋, indicating that multiple checklists are required.

[66] Table 3 is an example of special association analysis information in a specific expert knowledge base. The following describes the process of special alarm correlation analysis using special association analysis information by using Table 3 as an example.

[67] Table 3

[69] In Table 3, each record represents a pair of alarms that need to determine the special association relationship. For example, in the first record in the table, the alarm and alarm ID with the alarm ID 471 is 302.

Whether the alarm has an association relationship or not, the process of determining the special association relationship is as follows: Since the input parameter 1 is 1, the first parameter P1 of the 471 alarm needs to be used as the input IModuleNo = PI condition query data table SpmBoardModule, and the matching is obtained. If the value of iLogicalBoardNo in the record is equal to the fifth parameter P5 of the 302 alarm, the 302 alarm is 471.

The child node of the alarm, that is, the 471 alarm and the 302 alarm have a special relationship.

[70] Logical Correlation Analysis Module 1 and Logical Correlation Analysis Module 2

According to the initial association analysis information and the special association analysis information in the expert knowledge base, the alarm correlation tree is used to analyze the alarms generated by the physical association analysis to generate at least one alarm association tree. The special association analysis information and the alarm correlation tree analysis engine are relatively independent in the centralized maintenance center. The alarm association relationship generated by the initial association analysis information and the special association analysis information according to the embodiment of the present invention The tree can be a tree with only one root node alarm. That is, the root node alarm does not have an alarm related to it. The root node alarm does not raise other alarms. Therefore, this root node can be called an independent node.

[71] FIG. 3 is a specific example of an alarm correlation tree obtained by logical correlation analysis.

[72] In Figure 3, alarm 2 is the root node alarm, and the alarms associated with alarm 2 are alarm 21 and alarm 22, that is, alarm 2 raises alarm 21 and alarm 22. The alarms associated with the alarm 21 are alarm 211 and alarm 212, that is, the alarm 21 triggers the alarm 211 and the alarm 212.

[73] Logical Correlation Analysis Module 1 and Logical Correlation Analysis Module 2

The generated alarm association tree may be transmitted to the centralized maintenance unit, or the root node alarm may be directly transmitted to the centralized maintenance unit, so that the centralized maintenance unit can quickly and accurately determine the fault according to the root node alarm or the alarm association tree, so that The fault is quickly eliminated.

[74] Since some associated alarm nodes may not have an alarm identifier in the system, there is no alarm ID.

If the circuit or link of the same office is abnormal, or an emergency call of the same number, etc., establishing an alarm association tree may cause trouble or cause a relationship tree to be established. Therefore, the embodiment of the present invention introduces a virtual node. The concept is such that the logical association analysis module 1 and the logical association analysis module 2 can generate an alarm association tree according to the expert knowledge base through the alarm correlation relationship tree analysis.

[75] The virtual node is composed of virtual alarms. The virtual alarm is derived from normal alarms. It has virtual alarm identification information such as virtual alarm ID, and the virtual alarm ID is in the normal alarm ID.

Out of scope, to distinguish. The virtual alarm is obtained by normal alarm analysis, such as an office route relay E1 fault.

[76] The above alarm correlation tree can also be expressed as follows:

[77] Virtual Root Node (Layer 0)

[78] I-Alarm 1 (1st floor)

[79] I I may cause an alarm 2 (2 layers)

[80] 1 1 I Inter-relationship description

[81] I I I Parameter Correlation Description

[82] 1 1 I - Other description

[83] I I may cause an alarm 3 (2 layers)

[84] 1 1 I Inter-relationship description [85] 1 1 I Parameter Correlation Description

[86] 1 1 I Other description

[87] I-Alarm 2 (1st floor)

[88] I-Alarm 3 (1st floor)

[89] Among them, the 0-layer virtual root node refers to the alarm that the user customizes according to his own experience or expert knowledge base.

Layer 1 is the order of all alarm IDs. Layer 2 is the alarm ID that may be caused by Layer 1 alarms. Layer 3 is the parameter description, inter-description and other related descriptions of the alarms associated with each other.

The content of the layer is the judgment condition of the interrelated alarm, and the independent alarm is distributed in 1

Layers on nodes that have no children.

[90] As can be seen from the above description, the expert knowledge base of the embodiment of the present invention can be divided into two parts, one part is the initial association analysis information, and the other part is the special association analysis information, and these two parts are the core of the expert knowledge base. The information in the expert knowledge base can be determined by the system experts through the rigorous analysis and verification of the system alarms, and is an important basis for the logical correlation analysis of the alarms. The initial association information of the alarm defines the relationship between the alarms and alarm parameters between the two different alarms. The special association analysis information is that the parameter relationship between the two alarms is complex and cannot be expressed by a simple algorithm, but needs to be supported by the configuration database of the system. The special association analysis information is a kind of information established by the data mining method. The special association analysis information analyzes the inter-table relationship of the parameters of the system configuration database, and can obtain an alarm-initiated relationship between the two alarms.

[91] The logical association analysis of the alarms generated by the system devices according to the expert knowledge base is performed, and the alarms are added to the alarm association tree for hierarchical display, and the alarms of each system device can be set up as one or more alarm associations. In the tree, the alarm of the root node of each alarm association tree is the primary alarm. The alarm that is logically related to the alarm of the root node should be the branch alarm or leaf alarm under the alarm of the root node. The centralized maintenance center may not alarm the leaf node. For any processing, only the root node alarms are processed, only the root alarms on the root node are restored, and the leaf node alarms are naturally restored, so that the centralized maintenance center can quickly and accurately find the faults and provide effective recovery. It is recommended to troubleshoot and restore the device.

[92] The expert knowledge base can be modified and updated, and different expert knowledge bases can be customized according to different systems. [93] Below with reference to Figure 4

The process of generating an alarm association tree by the alarm association tree analysis engine according to the expert knowledge base is described in the embodiment of the present invention.

[94] In FIG. 4, in step 400, n alarms in the alarm sequence An are required: Alarm A1 to Alarm An generates an alarm correlation tree. Set the initial value of i to 0 and the initial value of k to 0. k

Indicates the number of branch nodes in the alarm correlation tree.

[95] Step 410, determining whether i is less than n, if not less than, to step 411

The process of generating an alarm association tree ends, and the generated alarm association tree is output.

[96] In step 410, if i is less than n, to step 420, the alarm sequence An

An alarm is generated that has not been processed by the alarm correlation tree.

[97] to step 430, according to the expert knowledge base from the alarm sequence An

The alarms that may be logically associated with the alarm are selected, and the associated alarm series Bm is established according to the alarms that can be logically associated, and the sequence includes m alarms, that is, alarm B1 to alarm Bm.

, set the initial value of j to 0.

[98] Go to step 440 to determine whether the value of m is 0.

That is, whether there is an associated alarm in the associated alarm sequence. If m is 0, go to step 441, and the alarm selected from An is used as an independent node. In step 442, the value of i is increased by 1. Go to step 410.

[99] In step 440, if the value of m is not 0, to step 450, it is determined whether j is less than m

, that is, whether the associated alarms in the associated alarm sequence have been processed, if j is not less than m

, indicating that the associated alarms in the associated alarm sequence have been processed. In step 451, it is determined whether the value of k is 0, that is, whether the branch node of the alarm correlation tree exists, and if the value of k is 0.

, indicating that there is no branch node in the alarm correlation tree, go to step 441, and will be from An.

The selected alarm is used as an independent node. In step 442, the value of i is increased by 1. Go to step 410.

[100] In step 451, if the value of k is not 0

Indicates that there is a branch node in the alarm association tree. You do not need to create an independent node. In step 442, the value of i is increased by 1. Go to step 410.

[101] In step 450, if the value of j is less than m, to step 460, the associated alarm sequence Bm

Take an associated alarm that has not been processed. [102] to steps 470, 480

According to the expert knowledge base, it is determined whether the alarm parameters of the two alarms and the alarm time meet the relevant association conditions. If they are all satisfied, you can go directly to step 490 to determine whether the value of i is 0. If the value of i is 0, indicating that the root node has not been created yet, to step 491, from An

The alarm selected in the alarm sequence is set to the root node, and the alarm selected from Bm is set as the branch node, and the value of k is increased by 1. Go to step 493 and the value of j is increased by 1. Go to step 450.

[103] In step 490, if the value of i is not 0

, indicating that the root node of the logical association tree has been created, to step 492, Bm

The alarm selected in the sequence is set to the branch node, and the value of k is increased by 1. Go to step 493, j

The value of the increase is 1. Go to step 450.

[104] In steps 470, 480

If the alarm parameters and alarms of the two alarms meet the relevant association conditions, you can also go to step 481 to determine the An in the expert knowledge base.

If the special association analysis indication information is set in the initial association analysis information corresponding to the alarm selected in the sequence, if the special association analysis indication information is not set, the value of j is increased by 1 in step 493. Go to step 450.

[105] In step 481, if special association analysis indication information is set, go to step 482

Analyze information from An and Bm according to the special associations in the expert knowledge base

The two selected alarms perform special association analysis. If it is determined that there is a special association analysis, step 490; if it is determined that there is no special association analysis, the value of j is increased by 1 to step 493. Go to step 450.

[106] According to the above process, the alarm sequence An can be

The alarms are grouped into one or more alarm association trees. The following describes an alarm association tree established in the embodiment of the present invention by using a specific alarm sequence as an example and in conjunction with Table 2.

[107] Set the alarm sequence transmitted to the centralized maintenance center as: {alarm 1, alarm 2, alarm 3, alarm 4

, alarm 5}.

[108] The centralized maintenance center selects alarm 1 from the alarm sequence. According to Table 2, it is determined that alarm 2, alarm 3, and alarm 5 in the alarm sequence may be logically related to alarm 1. [109] The centralized maintenance center determines the alarm according to the parameters in Table 2, the upper limit of the alarm, the lower limit of the alarm, the alarm 1, the alarm 2, the alarm 3, the alarm 5, the alarm, the alarm 2, the alarm 3, and the alarm 5 Alarm 1 has a logical relationship 吋, and alarm 2, alarm 3, and alarm 5 are used as leaf nodes of alarm 1. Since alarm 1 and alarm 4 in Table 2 do not have a logical association relationship, alarm 4 is an independent node, that is, alarm 4 is A logical association tree with only root node alarms. Alarm 2, Alarm 2, Alarm 3, Alarm 4, and Alarm 2 generate two logical relationship trees as shown in Figure 5.

[110] The embodiment of the present invention enables a centralized maintenance center to quickly determine a valuable alarm by setting a predetermined alarm screening condition; the predetermined alarm screening condition may be physical association information, such as repeated alarm compression conditions, ignoring alarm conditions, and alarms. The replacement conditions and alarm summary conditions not only avoid unnecessary redundant alarm information, but also enable the centralized maintenance center to present the alarm information clearly and systematically, thus providing different alarm observation latitudes and effectively grasping the system equipment. The operation of the predetermined alarm screening condition may also be logical association information. The logical association information of the embodiment of the present invention introduces the initial association analysis information of the alarm and the special association analysis information of the alarm, and further mines different alarms by using the alarm special association analysis information. The logical association between the alarms enables the centralized maintenance center to set up the alarms it receives as a logical association tree, so that the centralized maintenance center can quickly determine the root cause of the alarm and avoid the correlation with the root cause alarm. The process of the alarms enables the centralized maintenance center to quickly and accurately locate the faults, so that the centralized maintenance center can perform effective maintenance and management on each system equipment. Therefore, the technical solutions provided by the embodiments of the present invention improve the maintainability of the system equipment. Sex

While the invention has been described by the embodiments of the present invention, it will be understood that

Claims

Claim

[1] 1. A centralized maintenance method for multiple devices, including:

The alarm collection system transmits the alarms of each system device to the centralized maintenance center.

The centralized maintenance center filters the alarms received according to the predetermined alarm screening conditions. The centralized maintenance center maintains the system equipment according to the alarms obtained after the screening.

[2] 2, as claimed in claim 1

The method for maintaining centralized maintenance of a multi-device, wherein the predetermined screening condition comprises: initial association analysis information of an alarm set according to a logical association relationship between time-correlation and parameter correlation between different alarms, and The steps of the screening specifically include:

The centralized maintenance center establishes the alarms that are received by the alarm as the root association alarm in the alarm association tree.

[3] 3. According to claim 2

The multi-device centralized maintenance method is characterized in that: the alarm initial association analysis information includes: an alarm identifier, an associated alarm identifier, an alarm time association upper limit, an alarm time association lower limit, and a parameter correspondence relationship of the correlated alarm.

[4] 4, as claimed in claim 3

The multi-device centralized maintenance method is characterized in that: the initial association analysis information of the alarm further includes: at least one of an alarm occurrence cause, a restoration suggestion, and an impact generated by the alarm.

[5] 5, as claimed in claim 1

The multi-device centralized maintenance method is characterized in that: the predetermined screening condition includes: alarm special association analysis information set according to a data mining-based logical association relationship between different alarms, and the screening step includes :

The centralized maintenance center establishes the alarms that are received by the alarm-related association analysis information into at least one alarm association tree, and obtains the root node alarm of the alarm association tree.

[6] 6 , as claimed in claims 1 to 5

A multi-device centralized maintenance method according to any one of the preceding claims, wherein, when the predetermined screening condition includes: an initial association analysis information and an alarm special association analysis information, the initial association analysis information of the alarm further includes: Correlation analysis indication information, and the step of screening Specifically include:

The centralized maintenance center uses the alarm initial association analysis information and the alarm special association analysis information to construct the alarms received into at least one alarm association tree according to the special relationship analysis indication information in the initial association analysis information of the alarm, and acquires the alarm association tree. Root node alarm.

[7] 7 as claimed in claim 1

The multi-device centralized maintenance method is characterized in that: the predetermined alarm screening condition comprises: at least one of a repeated alarm compression condition, an ignoring an alarm condition, an alarm replacement condition, and an alarm generalization condition, and the step of screening Including at least one of the following steps:

The centralized maintenance center uses the same alarm that is received multiple times within a predetermined time interval as an alarm according to the repeated alarm compression condition;

The centralized maintenance center selects an alarm according to the ignored alarm condition;

The centralized maintenance center replaces the alarms it receives that meet the alarm replacement conditions with the predetermined alarms; the centralized maintenance center summarizes the alarms it receives according to the alarm summary conditions into at least one alarm type.

[8] 8. A multi-device centralized maintenance method according to claim 7, wherein:

The step of ignoring the alarm includes: at least one of a filter condition, a suppression condition, and a time window extraction condition, and the step of the centralized maintenance center selecting the alarm according to the ignoring the alarm condition comprises the following at least one step:

The centralized maintenance center selects an alarm that meets the filtering condition from the alarms it receives; the centralized maintenance center suppresses the alarm received in the predetermined context according to the suppression condition;

The centralized maintenance center extracts an alarm that is received within a predetermined time window according to the time window extraction condition; or the alarm replacement condition includes: upgrading at least one of a replacement condition and a sub-category replacement condition, and the centralized maintenance center receives the alarm The step of replacing the alarm satisfying the alarm replacement condition with the predetermined alarm includes at least one of the following steps:

The centralized maintenance center determines the number of times the same alarm is received in the predetermined time interval according to the upgrade replacement condition, and replaces the same alarm with a high-level alarm when the number of times reaches a predetermined number of times; The centralized maintenance center replaces the alarms it receives and meets the subclass replacement conditions with subclass alarms.

[9] 9

A multi-device centralized maintenance system includes: a plurality of system devices, an alarm collection system, and a centralized maintenance center, wherein the alarm collection system transmits the alarms of the system equipment to the centralized maintenance center, wherein the centralized maintenance center is further provided with :

The alarm management unit: screens the alarms received by the centralized maintenance center according to the predetermined alarm screening conditions, and transmits the alarms obtained after the screening to the centralized maintenance unit;

Centralized maintenance unit: Maintains system equipment based on the alarms it receives.

[10] 10, as claimed in claim 9

The multi-device centralized maintenance system is characterized in that: the alarm management unit comprises: an initial logical association relationship storage module: an alarm set according to a logical association relationship between time-correlation and parameter correlation between different alarms Initial association analysis information, and storage; logical association analysis module 1

And generating, according to the initial association analysis information of the alarms stored in the initial logical association storage module, the alarms received by the centralized maintenance center into at least one alarm association tree, and the alarm association tree or the root node of the alarm association tree The alarm is transmitted to the centralized maintenance unit.

[11] 11 , as claimed in claim 9

The multi-device centralized maintenance system is characterized in that: the alarm management unit comprises: a special logical association relationship storage module: an alarm special association analysis information set according to a logical association relationship based on data mining between different alarms, And store

Logical association analysis module 2

And generating, according to the initial association analysis information of the alarms stored in the special logical association storage module, the alarms received by the centralized maintenance center into at least one alarm association tree, and the alarm association tree or the root node of the alarm association tree The alarm is transmitted to the centralized maintenance unit.

[12] 12

A network device is a centralized maintenance center in a centralized maintenance system of a multi-device. The centralized maintenance center is further configured with:

Alarm management unit: Screens the alarms received by the centralized maintenance center according to the predetermined alarm screening conditions. Selecting, and transmitting the alarm obtained after screening to the centralized maintenance unit;

[13] 13 as claimed in claim 12

The network device is characterized in that: the alarm management unit comprises: an initial logical association relationship storage module: an initial association analysis of alarms set according to a logical association relationship between time alarms and parameter correlations between different alarms Information, and storage; logical association analysis module 1

[14] 14 , as claimed in claim 12

The network device is characterized in that: the alarm management unit comprises: a special logical association relationship storage module: the alarm special association analysis information set according to the data association-based logical association relationship between different alarms, and stored;

Logical association analysis module 2

[15] 15 as claimed in claim 12 or 13 or 14

The network management device is characterized in that: the alarm management unit comprises: at least one of an alarm compression analysis module, a ignore alarm analysis module, a replacement alarm analysis module and an alarm summary analysis module;

The alarm compression analysis module: transmits the same alarm received by the centralized maintenance center multiple times in a predetermined time interval as an alarm to the centralized maintenance unit according to the repeated alarm compression condition, and transmits the received number of the same alarm to the centralized maintenance unit;

Ignore the alarm analysis module: Select the alarm according to the ignore alarm condition, and transmit the selected alarm to the centralized maintenance unit;

Replacement alarm analysis module: The replacement replacement bar received by the centralized maintenance center according to the alarm replacement condition The alarm is replaced with a predetermined alarm, and the predetermined alarm is transmitted to the centralized maintenance unit. The alarm summary analysis module: summarizes the alarm received by the centralized maintenance center into at least one alarm type according to the alarm summary condition, and transmits the alarm type information to the centralized maintenance. unit.

16 as in claim 15

The network device is characterized in that: the ignore alarm analysis module comprises at least one submodule described below:

Alarm filtering analysis sub-module: transmitting the alarms that meet the filtering conditions received by the centralized maintenance center to the centralized maintenance unit;

The alarm suppression analysis sub-module: suppresses the alarm that meets the suppression condition received by the centralized maintenance center, and transmits the alarm that does not satisfy the suppression condition to the centralized maintenance unit;

Time correlation analysis sub-module: transmitting the alarm received by the centralized maintenance center and within a predetermined time window to the centralized maintenance unit;

Or the replacement alarm analysis module includes at least one submodule described below:

The alarm count analysis sub-module: determining, according to the upgrade replacement condition, the number of times the same alarm is received within a predetermined time interval, and replacing the same alarm with a high-level alarm when the number of times reaches a predetermined number of times, and The high-level alarm is transmitted to the centralized maintenance unit. The alarm refinement analysis sub-module: replaces the alarm received by the centralized maintenance center that satisfies the sub-type replacement condition with a sub-type alarm, and transmits the sub-type alarm to the centralized maintenance unit.