CN101075902A - Method for discriminating related alert - Google Patents
Method for discriminating related alert Download PDFInfo
- Publication number
- CN101075902A CN101075902A CN 200610080435 CN200610080435A CN101075902A CN 101075902 A CN101075902 A CN 101075902A CN 200610080435 CN200610080435 CN 200610080435 CN 200610080435 A CN200610080435 A CN 200610080435A CN 101075902 A CN101075902 A CN 101075902A
- Authority
- CN
- China
- Prior art keywords
- alarm
- information
- relevant
- management system
- warning information
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
The invention provides an alarm analyzing method with higher accuracy and lower cost for mobile device, net element system and network management system, which comprises: when processing an alarm happening in the net element, the relevant alarming information is added into each alarming message; the relevant alarming information comprises one or more main alarming identification information; the net element sends the alarming message containing the relevant alarming information to its upper layer management system; after receiving the alarming message, the upper layer management system process the alarming message sent from the net element according to the relevant alarming information.
Description
Technical field
The present invention relates to screen the method for alarm, particularly mobile device, Element management system (EMS) and network management system (nms) three's alarm implementation method.
Background technology
Communication network is interconnected by a plurality of equipment, parts and forms, and the fault of certain parts may influence a plurality of parts, equipment or related service, thereby causes a plurality of equipment or service QOS alarm.The Root alarm that causes these alarms is called " main alarm ", and other alarms are called " relevant alarm ".
In mobile network's operation maintenance at present, the examination of alarming being correlated with, analysis are mainly in network management system, the dedicated analysis instrument that uses the third party to provide, some association rules, the self maintained experience that provide according to equipment vendor, perhaps on the basis based on some correlation models analysis tool, vast as the open sea magnanimity original alarm data are screened, analyzed, finally draw the data that help locating rapidly the alarm root.This original alarm data that report according to mobile device are carried out the correlation analysis in later stage, can be called the mode that " passive " screens relevant alarm.Its shortcoming is that for distinct device merchant's distinct device, alarm correlation rule has very big difference, causes only relying on the accumulation of experience to have inaccuracy incomprehensive, that correlation models is analyzed, all causes the error of the relevant alarm of passive examination bigger.And the magnanimity original alarm data that passive mode is faced also cause its analysis cost higher.
Summary of the invention
For overcoming above-mentioned defective, the object of the present invention is to provide the basic reason of more accurate, the quick location of a kind of network element alarm generation and reduce network element device is screened implementation method from relevant alarm to the active of the alarm flux of interface.
For achieving the above object, a kind of implementation method of screening relevant alarm of the present invention may further comprise the steps:
(1) network element device increases relevant warning information in every alarm information when the alarm of the inner generation of processing net element, and this relevant warning information comprises one or more main alarm identifier information;
(2) network element device sends to the upper management system to the alarm information that comprises relevant warning information, the content unanimity of the content of this relevant warning information and the relevant warning information described in the step 1;
(3) upper management system handles the alarm information that network element device sends according to relevant warning information after receiving alarm information.
Wherein, be the sign of the main alarm of unique identification at the main alarm identifier described in the step (1), described main alarm is meant the alarm of representing the fault basic reason, the perhaps warning information of fault location root.
Wherein, described step (3) is specially: the upper management system is after receiving alarm information, according to the content of main alarm identifier, to having the warning information classification or the gathering of identical main alarm identifier.
Wherein, the relevant warning information in the described step (1) also comprises the alarm correlation degree information.
Wherein, described step (3) is specially: the upper management system is after receiving alarm information, according to the alarm correlation degree information, to further classification or gathering of warning information.
Wherein, described upper management system is Element management system or network management system.
Wherein, described Element management system uses main alarm identifier and degree of relevancy information setting filtering rule, requires network element to report the alarm of appointment according to an alarm correlation degree information.
Wherein, described Element management system sends to the network management system processing to the alarm information that comprises described relevant warning information.
Adopt said method, network element device provides the function and the degree of relevancy information of initiatively screening relevant alarm, helps Element management system or network management system to be alarmed relevant information more accurately, thereby helps final location alarm root; In addition, between network element and Element management system, utilize the information of relevant alarm to filter and to reduce the flow that interface is alarmed.
Description of drawings
Fig. 1 will screen the schematic diagram that is transferred to Element management system of relevant warning information for network element device of the present invention.
Embodiment
As shown in Figure 1, the present invention initiatively screens the relevant implementation method of alarming by network element, and concrete steps are:
1) network element is when the alarm of the inner generation of processing net element, according to the predetermined correlation rule, search in the already present warning information tabulation and whether have main alarm, increase the information of relevant alarm in every alarm information (Alarm Message), the information of this relevant alarm comprises: alarm correlation degree (Alarm Relativity Level) and main alarm identifier (Primary AlarmId).
If main alarm exists, then fill in main alarm identifier and definite alarm correlation degree, every alarm may be relevant with a plurality of main alarms, and at this moment, this alarm can be different with each main degree of relevancy of alarming; If main alarm does not exist, then main alarm identifier be a sky, and the alarm correlation degree is set is no correlation;
Wherein, main alarm being meant the alarm of representing certain fault basic reason, warning information that perhaps can the fault location root, main alarm identifier refer to can the main alarm of unique identification sign, main alarm can be one or more.
Wherein, the alarm correlation degree is represented the degree of relevancy between certain alarm and the main alarm, when the main alarm identifier of certain alarm is sky, represents that the alarm correlation degree of this alarm is minimum (promptly not having correlation).
Wherein, network element is according to the relevant warning information of every alarm of predetermined correlation rule process, and the condition of the association rules of alarm forms according to the some or all of information combination of alarm type, warning position (source), possible cause, raising Time, alarm level, detailed reason, threshold information, monitored object, additional information, additional content and network element self-defined information etc.
2) network element sends to the upper management system to the alarm that comprises relevant warning information, the content of warning information of wherein being correlated with and the relevant warning information content unanimity of network element internal, and the upper management system can be an Element management system, also can be network management system.
3) upper management system can further handle according to the relevant warning information that reports after receiving alarm.Its processing procedure is specially:
31) according to the content of main alarm identifier,,, can also further classify or gathering to warning information in conjunction with the alarm correlation degree information to having the warning information classification or the gathering of identical main alarm identifier.
32) for the upper management system be the situation of Element management system, Element management system can not handled relevant warning information, but the alarm report network management system that comprises relevant warning information.Be beneficial to more accurate, the quick location alarm of user root; Element management system is assembled and is presented the warning information of identical main alarm identifier according to the content of main alarm identifier, is convenient to the user and finds to alarm root fast; Exist under the situation of a plurality of main alarm identifiers, system can be in conjunction with the degree of relevancy information of each main alarm identifier correspondence, and warning information is further classified and presented.
4) in addition, Element management system can use main alarm identifier and degree of relevancy information setting filtering rule, requires network element to report the alarm of appointment according to certain alarm correlation degree.
In sum, the present invention is by the alarm of being correlated with in the analysis of network element side, and provide relevant warning information to higher level's network management system, thereby the dependency relation between the alarms reported by network elements is provided more accurately, help higher level's network management system accurately, location alarm root fast.
Claims (8)
1, a kind of implementation method of screening relevant alarm is characterized in that, may further comprise the steps:
(1) network element device increases relevant warning information in every alarm information when the alarm of the inner generation of processing net element, and this relevant warning information comprises one or more main alarm identifier information;
(2) network element device sends to the upper management system to the alarm information that comprises relevant warning information, the content unanimity of the content of this relevant warning information and the relevant warning information described in the step 1;
(3) upper management system handles the alarm information that network element device sends according to relevant warning information after receiving alarm information.
2, according to the relevant implementation method of alarming of the described examination of claim 1, it is characterized in that, be the sign of the main alarm of unique identification at the main alarm identifier described in the step (1), wherein, main alarm is meant the alarm of representing the fault basic reason, the perhaps warning information of fault location root.
3, according to claim 1 or the relevant implementation method of alarming of 2 described examinations, it is characterized in that, described step (3) is specially: the upper management system is after receiving alarm information, according to the content of main alarm identifier, to having the warning information classification or the gathering of identical main alarm identifier.
4, according to the implementation method of the relevant alarm of the described examination of claim 1, it is characterized in that the relevant warning information in the described step (1) also comprises the alarm correlation degree information.
5, according to the implementation method of the relevant alarm of the described examination of claim 3, it is characterized in that described step (3) is specially: the upper management system is after receiving alarm information, according to the alarm correlation degree information, to further classification or gathering of warning information.
According to the implementation method of the relevant alarm of claim 1,2,3,4 or 5 described examinations, it is characterized in that 6, described upper management system is Element management system or network management system.
7, according to the relevant implementation method of alarming of the described examination of claim 6, it is characterized in that, described Element management system uses main alarm identifier and degree of relevancy information setting filtering rule, requires network element to report the alarm of appointment according to an alarm correlation degree information.
According to the implementation method of the relevant alarm of the described examination of claim 6, it is characterized in that 8, described Element management system sends to network management system to the alarm information that comprises described relevant warning information and handles.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB2006100804357A CN100555952C (en) | 2006-05-15 | 2006-05-15 | Screen the implementation method of relevant alarm |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB2006100804357A CN100555952C (en) | 2006-05-15 | 2006-05-15 | Screen the implementation method of relevant alarm |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101075902A true CN101075902A (en) | 2007-11-21 |
| CN100555952C CN100555952C (en) | 2009-10-28 |
Family
ID=38976732
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CNB2006100804357A Expired - Fee Related CN100555952C (en) | 2006-05-15 | 2006-05-15 | Screen the implementation method of relevant alarm |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN100555952C (en) |
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101212367B (en) * | 2007-12-25 | 2010-06-30 | 北京亿阳信通软件研究院有限公司 | Alarm message processing method and device |
| CN102026253A (en) * | 2010-12-21 | 2011-04-20 | 大唐移动通信设备有限公司 | Alarm reporting and processing method, system and equipment |
| CN101500345B (en) * | 2008-02-01 | 2012-03-07 | 中兴通讯股份有限公司 | Method and apparatus for reducing alarm information loss in high-grade alarm filtering |
| CN102457396A (en) * | 2010-10-28 | 2012-05-16 | 大唐移动通信设备有限公司 | Fault warning method and equipment |
| CN102761430A (en) * | 2011-04-29 | 2012-10-31 | 中兴通讯股份有限公司 | Method and system for acquiring alarm message |
| CN104348667A (en) * | 2014-11-11 | 2015-02-11 | 上海新炬网络技术有限公司 | Fault positioning method based on warning information |
| CN105634822A (en) * | 2016-01-15 | 2016-06-01 | 武汉烽火网络有限责任公司 | Method and device for rapidly querying warning information based on warning grouping |
| CN105991339A (en) * | 2015-03-05 | 2016-10-05 | 腾讯科技（深圳）有限公司 | Alarm source positioning method and device |
| CN106685694A (en) * | 2016-11-24 | 2017-05-17 | 国家电网公司 | Method and system for analyzing information system warning correlation |
| CN109510718A (en) * | 2017-09-15 | 2019-03-22 | 华为技术有限公司 | The processing method and processing device of warning information |
-
2006
- 2006-05-15 CN CNB2006100804357A patent/CN100555952C/en not_active Expired - Fee Related
Cited By (17)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101212367B (en) * | 2007-12-25 | 2010-06-30 | 北京亿阳信通软件研究院有限公司 | Alarm message processing method and device |
| CN101500345B (en) * | 2008-02-01 | 2012-03-07 | 中兴通讯股份有限公司 | Method and apparatus for reducing alarm information loss in high-grade alarm filtering |
| CN102457396A (en) * | 2010-10-28 | 2012-05-16 | 大唐移动通信设备有限公司 | Fault warning method and equipment |
| CN102026253A (en) * | 2010-12-21 | 2011-04-20 | 大唐移动通信设备有限公司 | Alarm reporting and processing method, system and equipment |
| CN102026253B (en) * | 2010-12-21 | 2014-04-02 | 大唐移动通信设备有限公司 | Alarm reporting and processing method, system and equipment |
| CN102761430B (en) * | 2011-04-29 | 2017-03-01 | 中兴通讯股份有限公司 | A kind of method and system obtaining warning information |
| CN102761430A (en) * | 2011-04-29 | 2012-10-31 | 中兴通讯股份有限公司 | Method and system for acquiring alarm message |
| CN104348667A (en) * | 2014-11-11 | 2015-02-11 | 上海新炬网络技术有限公司 | Fault positioning method based on warning information |
| CN104348667B (en) * | 2014-11-11 | 2017-12-29 | 上海新炬网络技术有限公司 | Fault Locating Method based on warning information |
| CN105991339A (en) * | 2015-03-05 | 2016-10-05 | 腾讯科技（深圳）有限公司 | Alarm source positioning method and device |
| CN105991339B (en) * | 2015-03-05 | 2018-09-07 | 腾讯科技（深圳）有限公司 | A kind of alarm root localization method and device |
| CN105634822A (en) * | 2016-01-15 | 2016-06-01 | 武汉烽火网络有限责任公司 | Method and device for rapidly querying warning information based on warning grouping |
| CN105634822B (en) * | 2016-01-15 | 2018-10-30 | 武汉烽火网络有限责任公司 | The method and device of quick query warning information is realized based on alarm packets |
| CN106685694A (en) * | 2016-11-24 | 2017-05-17 | 国家电网公司 | Method and system for analyzing information system warning correlation |
| CN106685694B (en) * | 2016-11-24 | 2020-05-08 | 国家电网公司 | Information system alarm correlation analysis method and system |
| CN109510718A (en) * | 2017-09-15 | 2019-03-22 | 华为技术有限公司 | The processing method and processing device of warning information |
| CN109510718B (en) * | 2017-09-15 | 2020-09-11 | 华为技术有限公司 | Alarm information processing method and device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN100555952C (en) | 2009-10-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN101075902A (en) | Method for discriminating related alert | |
| CN110493348B (en) | Intelligent monitoring alarm system based on Internet of things | |
| KR100955281B1 (en) | Security Risk Evaluation Method for Threat Management | |
| US9413597B2 (en) | Method and system for providing aggregated network alarms | |
| KR100718023B1 (en) | System for intrusion detection and vulnerability analysis in a telecommunications signaling network | |
| EP2487860B1 (en) | Method and system for improving security threats detection in communication networks | |
| US7389345B1 (en) | Filtering approach for network system alarms | |
| CN108989132A (en) | Fault warning processing method, system and computer readable storage medium | |
| CN106778873B (en) | A kind of warning information classification method of disposal and device based on white list rule | |
| WO2007143943A1 (en) | Method, system and network device of centralized maintenance of multiple devices | |
| Tang et al. | Optimizing system monitoring configurations for non-actionable alerts | |
| CN115664939B (en) | Comprehensive operation and maintenance method based on automation technology and storage medium | |
| CN117336055B (en) | Network abnormal behavior detection method and device, electronic equipment and storage medium | |
| CN106789234B (en) | Automatic alarm test system and method for call center | |
| JP2008234351A (en) | Integrated operation monitoring system and program | |
| CN103618635A (en) | Classified association management and control system of informationized equipment | |
| CN113132370A (en) | Universal integrated safety pipe center system | |
| CN112817827A (en) | Operation and maintenance method, device, server, equipment, system and medium | |
| CN109474529B (en) | Method for feeding back terminal network associated data | |
| CN114257414A (en) | Intelligent network security duty method and system | |
| CN113572628B (en) | Data association method, device, computing equipment and computer storage medium | |
| CN111261271B (en) | Service availability diagnosis method and device for video monitoring environment | |
| US8976783B2 (en) | Method and apparatus for assuring voice over internet protocol service | |
| TWI670953B (en) | Abnormity monitoring system and anbormity monitoring method | |
| CN112000507A (en) | Fault processing method, system, device and medium based on software load balancing |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20091028 Termination date: 20150515 |
|
| EXPY | Termination of patent right or utility model |