CN101599874B - Check system and method for checking alarm correlation analysis system - Google Patents
Check system and method for checking alarm correlation analysis system Download PDFInfo
- Publication number
- CN101599874B CN101599874B CN2009101515042A CN200910151504A CN101599874B CN 101599874 B CN101599874 B CN 101599874B CN 2009101515042 A CN2009101515042 A CN 2009101515042A CN 200910151504 A CN200910151504 A CN 200910151504A CN 101599874 B CN101599874 B CN 101599874B
- Authority
- CN
- China
- Prior art keywords
- alarm
- row
- train value
- root
- value
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention provides a check system for checking an alarm correlation analysis system, which comprises a driving module 204 and a check module 206, wherein the driving module 204 is used for simulating a network element, constructing an alarm in a preset alarm correlation rule table, and reporting the alarm to the alarm correlation analysis system; and the check module 206 is used for checking whether an output result of the alarm correlation analysis system aiming at the alarm meets rules in the alarm correlation rule table. The invention also provides a check method for checking the alarm correlation analysis system. The system and the method overcome actual equipment limitation brought by the conventional check method, improve check speed, and fully check the recursive relation and priority of the alarm.
Description
Technical field
The present invention relates to the computer and the communications field, particularly the check system of alarm correlation and method.
Background technology
Enlarging day by day and improving constantly what Network Transmission required of internet scale all promoting constantly advancing of the communication technology.In communication system, certain physical equipment or software module occur when unusual, all can be used to transmit the event report of fault message, and this kind event report is alarm.Because network is interconnected by a lot of equipment and constitutes, and is in service in real network, a large amount of alarms that can cause network unusually of parts, just so-called alarm windstorm.Fault location and processing are carried out in manual work in the alarm of this magnanimity, and speed relies on attendant's knowledge and experience, accuracy and poor reliability slowly and too.
This situation presses for network management system can carry out alarm correlation analysis " intelligence ".And in the alarm correlation analysis process, mainly judge according to the correlation rule between the alarm.Under normal conditions; Each equipment vendors all can define some correlation rules according to inherent laws and the engineering experience manual work in advance that equipment alarm produces; Filter redundant alarm according to these correlation rules then, analyze the correlation between the alarm, distinguish Root alarm and derive alarm; Help user's rapid analysis and locating network fault, as shown in Figure 1.Root alarm as its name suggests, is meant in the network source that alarm produces, and just because this alarm has taken place, and has produced a series of alarm; The alarm of deriving is exactly a series of alarms that Root alarm causes, and it produces along with the generation of Root alarm, disappears along with the disappearance of Root alarm.Illustrate: alarm A has produced alarm B, and alarm B has produced alarm C again.So in this case, A is the Root alarm of B and C, and B and C are the alarm of deriving of A.
Many instrument factory commercial cities have been developed alarm correlation analysis system, how to verify the practicality and the validity of alarm correlation analysis system, and whether this system satisfies its predefined all association rules, becomes a great problem of Virtual network operator.
Verification method is normally constructed every corresponding alarm of rule one by one and is verified that there is following shortcoming in this method on equipment at present:
Equipment limitation: in the existing network environment, each website is all carrying a large number of services.Wanting that the alarm in the formation rule does not influence business again on equipment, is a very thing of difficulty, because the alarm that relates in the rule is basically all relevant with business, and all is the higher alarm of seriousness grade; In addition, on real equipment, construct alarm, need understand very much the inherent laws that each producer's equipment alarm produces, these are a challenge beyond doubt concerning the operation maintenance personnel.
Verifying speed is slow: the traversal strictly all rules, and on real equipment, build environment and produce every alarm that rule is corresponding, well imagine, the length that expends time in, verifying speed is very slow.
Recurrence relation can't be verified: rule generally is that each manufacturer's manual work produces rule according to equipment alarm inside and engineering experience defines in advance; Because equipment alarm is of a great variety; Manual work produces the rule complicacy and adds that regular quantity is huge, so can only be put out directly correlative relationship in order.When therefore rule was verified one by one, recurrence relation can't be verified.
Priority can't fully be verified: suppose that alarm E can produce alarm D, alarm F also can produce alarm D, and produces rule and maintenance experience according to equipment alarm; The possibility that E causes D will be higher than F; That is to say that at E under the simultaneous situation of F and D, E is that the priority of root wants high.And the checking of wall scroll rule can not embody priority.Verify even once construct three alarms of DEF, also can only verify out the priority of E and F.When having recurrence priority, just can't verify fully.
Whether the alarm correlation analysis system of therefore, how fast effectively verifying each manufacturer fully satisfies its predefined all association rules becomes a stubborn problem.
Therefore, need a kind ofly whether satisfy the solution that its predefined all association rules carry out verification, can solve the problem in the above-mentioned correlation technique alarm correlation analysis system.
Summary of the invention
The present invention aims to provide a kind of alarm correlation analysis system of each manufacturer of fast and effeciently verifying and whether satisfies the check system of its predefined all association rules, to overcome the shortcomings such as equipment limitation that traditional verification mode is brought.
According to an aspect of the present invention; A kind of check system that alarm correlation analysis system is verified of being used for is provided; Comprise: driver module is used for the alarm of the predetermined alarm correlation rule table of emulation network element and structure, and gives alarm correlation analysis system with alarm report; And the verification module, be used for verifying whether said alarm correlation analysis system meets the rule of said alarm correlation rule table to the output result of said alarm.
Wherein, this check system also comprises: DBM is used for storing predetermined alarm correlation rule table.
Whether the output result that wherein, verification module also is used for writing down alarm correlation analysis system satisfies the strictly all rules of predetermined alarm correlation rule table.
Wherein, the alarm correlation rule table has association rules matrix data structure, in the matrix data structure; First row have comprised all alarms in the alarm regulation table; To last one all Root alarm that have value to list the alarm that is listed as corresponding to this row first, wherein, second classifies the first priority recurrence Root alarm as from each secondary series of going; The 3rd classifies the second priority recurrence Root alarm as; By that analogy, to the last one has the value row, and secondary series is identical to each train value in last one each row that has in the value row.
Wherein, the set of the train value of first row of each row of identical train value place is the set corresponding to whole alarms of deriving that alarm comprised of identical train value, and be under the situation of sky at the secondary series train value, alarms to be Root alarm.
According to another aspect of the present invention; A kind of method of calibration that alarm correlation analysis system is verified of being used for also is provided; May further comprise the steps: the emulation network element is also constructed the alarm in the predetermined alarm correlation rule table, and give alarm correlation analysis system with alarm report; And verify whether said alarm correlation analysis system meets the rule in the said alarm correlation rule table to the output result of said alarm.
Wherein, this method of calibration is further comprising the steps of: whether the output result of record alarm correlation analysis system meets the strictly all rules in the predetermined alarm correlation rule table.
Wherein, this method of calibration is further comprising the steps of: generate the association rules data matrix with association rules matrix data structure according to the alarm correlation rule table.
Wherein, In the association rules data matrix, first row have comprised all alarms in the alarm regulation table, have value to list all Root alarm corresponding to the alarm of this row first row from each secondary series of going to last one; Second classifies the first priority recurrence Root alarm as; The 3rd classifies the second priority recurrence Root alarm as, and by that analogy, to the last one has the value row; And secondary series is identical to each train value in last one each row that has in the value row, and the set of the train value of first row of each row of identical train value place is the set corresponding to whole alarms of deriving that alarm comprised of identical train value.
Preferably; The output result of alarm correlation analysis system analyzed may further comprise the steps: whether the Root alarm of checking alarm is the corresponding secondary series train value of alarm in the association rules matrix; Check perhaps whether deriving of the pairing alarm of secondary series train value has comprised the corresponding respectively set of the pairing alarm of the first row train value of secondary series train value in alarming; If confirm that then the pairing alarm of said secondary series train value is the Root alarm of said alarm; The alarm of removing the secondary series train value makes it become history alarm; Whether the Root alarm of checking alarm is the 3rd corresponding row train value of alarm in the association rules matrix; Or whether the alarm of deriving of checking the alarm of the 3rd row train value has comprised the corresponding respectively set of the pairing alarm of the first row train value of the 3rd row train value; If confirm that then the pairing alarm of said the 3rd row train value is the Root alarm of said alarm; The alarm of removing the 3rd row train value makes it become history alarm; And by that analogy, the pairing alarm of value row train value is arranged up to having removed all.
Preferably, under the secondary series train value is empty situation, alarms and be Root alarm.
The present invention verifies through the alarm of emulation network element structure whether the alarm correlation analysis system of each manufacturer satisfies its predefined all association rules; Overcome the real equipment limitation that traditional verification mode is brought; Improved verifying speed, and made the recurrence relation of alarm and priority obtain abundant checking.
Other features and advantages of the present invention will be set forth in specification subsequently, and, partly from specification, become obvious, perhaps understand through embodiment of the present invention.The object of the invention can be realized through the structure that in the specification of being write, claims and accompanying drawing, is particularly pointed out and obtained with other advantages.
Description of drawings
Accompanying drawing described herein is used to provide further understanding of the present invention, constitutes the application's a part, and illustrative examples of the present invention and explanation thereof are used to explain the present invention, do not constitute improper qualification of the present invention.In the accompanying drawings:
Fig. 1 illustrates alarm correlation analysis system sketch map in the prior art;
Fig. 2 illustrates the block diagram of check system according to an embodiment of the invention;
Fig. 3 illustrates the flow chart of method of calibration according to an embodiment of the invention;
Fig. 4 illustrates the flow chart of method of calibration in accordance with another embodiment of the present invention;
Fig. 5 illustrates the flow chart that alarm correlation matrix is in accordance with another embodiment of the present invention confirmed method;
Fig. 6 is the structural representation that the cum rights level directed graph of alarm according to another embodiment of the invention is shown;
Fig. 7 is the structural representation of alarm correlation matrix first array unit in accordance with another embodiment of the present invention;
Fig. 8 illustrates association rules matrix in accordance with another embodiment of the present invention;
Fig. 9 illustrates to have removed the association rules matrix sketch map behind the secondary series in accordance with another embodiment of the present invention; And
Figure 10 illustrates the association rules matrix sketch map that has last row in accordance with another embodiment of the present invention.
Embodiment
To combine accompanying drawing to specify embodiments of the invention below.
Fig. 2 is the modular structure figure of check system of the present invention, and check system 200 comprises three modules: DBM 202, driver module 204 and verification module 206.Wherein DBM 202 is stored the alarm correlation rule tables; Driver module 204 emulation network elements are also made the alarm in the association rules table; The result of the 206 pairs of alarm correlation analysis systems of verification module output analyzes judgement, verifies whether strictly all rules passes through, and export all through with the item that does not pass through.
Below in conjunction with accompanying drawing and specific embodiment the present invention is done detailed description further.
At first taken passages the instantiation of fraction rule, as shown in table 1, table 1 is the original alarm correlation rule table of present embodiment.
Table 1
Predefined every the rule of manual work is processed a form, and two hurdles about branch are represented derive alarm and its possible Root alarm respectively.Each hurdle comprises two row again: source points and alarm cause.The alarm of deriving has a plurality of Root alarm, and the sequencing of all possible Root alarm in form represented the derive priority of alarm of its initiation, order more before, its priority is high more.And Ben Biaoge only describes the alarm with direct relation.During describing for ease, this paper will alarm with a capitalization and represent.
Here represent each alarm with capitalization, as follows: A representes the veneer dislocation alarm of OA plate; B representes the unverified alarm of optical module of STM-N light mouth; C representes the LOP alarm of AU4; D representes the LOS alarm of STM-N light mouth; E representes MS-RDI; F representes MS-AIS; G representes AU4-AIS.Alarm correlation rule table after the simplification is as shown in table 2, and table 2 is alarm correlation rule tables that present embodiment is simplified.
Table 2
The detailed process process of this check system is described with two embodiment then.
Fig. 3 illustrates the flow chart of method of calibration according to an embodiment of the invention.With reference to Fig. 3, may further comprise the steps according to the method for calibration of this embodiment:
Step S302, DBM 202 storage alarm correlation rule tables, as shown in table 2;
Step S304 creates NE on webmaster, carries out relevant configuration.On network management system, create the network element and the plate of various equipment types, set up topology and connect, it is professional to dispose polytype low-order and high-order, and purpose is all the alarm source points in the cover up rule table;
Step S306, driver module 204 emulation network elements are also constructed alarm report line by line by rule list and are given alarm correlation analysis system.In the present embodiment, the first behavior example with the alarm correlation rule table describes: structure alarm AD is reported to alarm correlation analysis system;
Step S308, verification module 204 is proof rule line by line, verifies up to all row.The last step has constructed alarm AD; Alarm correlation analysis system can carry out correlation analysis automatically; Verification module 204 checks whether current Root alarm interface only shows A; Whether the alarm of deriving of inquiry A comprises D (perhaps going to the current alarm interface of deriving to check whether the Root alarm that whether only shows D and D is A), if any not being inconsistent, then writes down this line discipline for not passing through;
By that analogy, repeating step S306 and S308, the GC of delegation's alarm to the last verifies.
From this embodiment, can find out; Use the emulation network element to construct alarm and checking in the association rules table line by line; Can overcome the limitation of real equipment, and practice thrift greatly and on real equipment, built the time that environment produces corresponding alarm, improve operating efficiency.But this proof method line by line, verifying speed is fast inadequately, still exists recurrence relation and priority shortcoming such as can't fully verify.Another embodiment among this paper has then overcome these problems.
Fig. 4 illustrates the flow chart of method of calibration in accordance with another embodiment of the present invention.With reference to Fig. 4, the method for calibration of this embodiment may further comprise the steps:
Step S402, the alarm correlation rule table of DBM 202 storing predetermined justice, as shown in table 2;
Step S404 generates association rules matrix and storage with rule list;
Wherein, the generating algorithm of association rules matrix is following:
Fig. 5 confirms the flow chart of method for alarm correlation matrix of the present invention, and as shown in Figure 5, alarm correlation matrix of the present invention confirms that method may further comprise the steps:
Step S502 reads and resolves all alarm associations of having set up rule, confirms to have the correlation of the alarm of direct correlation relation.
With the optical-fiber network is the correlation of example explanation alarm.As shown in table 1, represent the veneer dislocation alarm of OA plate with A; B representes the unverified alarm of optical module of N level synchronous transfer module (STM-N, SynchronousTransmission Module level N) light mouth; C representes Loss Of Pointer (LOP, the Loss of Pointer) alarm of administrative unit AU (Administrative Unit) 4; D representes loss of signal alarm (LOS, the Loss of Signal) alarm of STM-N light mouth; E representes multiplex section remote bug indication (MS-RDI, MultiplexSection-Remote Defect Indication) alarm; F representes Multiplex Section AIS (MS-AIS, Multiplex Section Alarm Indication Signal); G representes AU4 alarm indication signal (AU4-AIS).The correlation form of the alarm of representing with alphabetical is as shown in table 2:
Alarm correlation in the table 2 is: A and B can cause D, and the priority of A is higher than B; D can cause F; D and F can cause E, and the priority of D is higher than F; D, F and C can cause G, and priority orders is D＞F＞C.
Step S504 generates cum rights level directed graph according to alarm correlation.The principle that generates cum rights level directed graph is: the alarm of deriving is positioned at the lower floor of its corresponding direct Root alarm; Direct Root alarm and its are derived between the alarm through the unidirectional arrow indication; Wherein, Derive alarm during corresponding to plural direct Root alarm, said plural direct Root alarm with said derive between the alarm the unidirectional arrow line according to priority order deasil from left to right arrange, sign has the weights corresponding with its priority on the unidirectional arrow line.Alarm can be positioned at plural when layer in cum rights level directed graph, this alarm is arranged in cum rights level directed graph that layer down.
Fig. 6 is the structural representation of the cum rights level directed graph of the present invention's alarm; As shown in Figure 6, A and B are not the Root alarm of the alarm of deriving of any alarm, are positioned at the superiors of cum rights level directed graph; A and the B D that can derive; And the priority of A is higher than B, and with the child node of D as A and B, A and B all point to D so.Because the priority of A is higher than B, therefore, A is placed on the left side of B, and the weights on the limit of A → D are denoted as 1, the weights of B → D are put on 2.
D can cause F, so just F is placed on following one deck of D, and F just has only a Root alarm, so weights are 0, does not provide concrete sign for 0 weights.D and F can cause E, and the priority of D is higher than F.On scheming, can find out that D can cause E, and F also can cause E, and the layer at D, F place is different, E is equivalent to be positioned at the layer at F place, also can be positioned at following one deck of F, according to aforesaid principle, and the layer under E should be positioned at, i.e. following one deck of F.Because the priority of D is higher than F, therefore F is drawn in the clockwise right-hand side of D again, puts on corresponding weights simultaneously.D, F and C all can cause G, and priority D＞F＞C.Because D also can cause F, therefore G is placed on the lower floor of F again; Have no alarm can cause C, C is not the Root alarm that any alarm is derived and alarmed, so C is placed on the right side of the superiors.Simultaneously three directed edges are put on corresponding weight value: 1,2 and 3.
Though the present invention exemplarily explains the cum rights level directed graph of alarm,, the relation between all alarms duplicates, and can generate the cum rights level directed graph of alarm by aforesaid principle.
Step S506 generates correlation matrix according to cum rights level directed graph.
At first cum rights level directed graph is pressed level from top to bottom, every level is pressed sequential search alarming node from left to right, and all alarming node that search out are listed as as first of matrix successively.Cum rights level directed graph with shown in Figure 6 is example, and is as shown in Figure 7, and the Search Results of first row of correlation matrix is: ABCDFEG.
Then each the alarm array element in first row of correlation matrix is from left to right carried out the father node search by the in-degree clockwise direction; The alarming node that the level peak is minimum is as the alarm array element of the secondary series of this alarm array element; It is its first priority recurrence Root alarm; The tertial array element that the inferior little alarming node of level time high weight is alarmed as said array element is till having searched for the maximum father node of the minimum weights of rightmost side level.If in search procedure, search out the Root alarm of repetition then skip continuation and search for next time.Specify with each row of ABCDFEG below.
For A, B and C, owing to can not search for any father node, so the Root alarm of these three alarms is empty.Mainly be that example is elaborated below with G: the in-degree of G from left to right is followed successively by D, F and C in the direction of the clock.Begin earlier, search out A and B from D, so with A as the first priority Root alarm because its level highest weight value is minimum, B is as the second priority Root alarm, the level that is positioned at is identical with A but weights are higher; D is as the 3rd priority Root alarm, and the level that is positioned at is minimum.
Search for from F again, search A, B and D because ABD all searches out, so skip, only with F as the 4th priority Root alarm.
Search for from C at last, only search C, so with C as its 5th priority root.
So the Root alarm of G is arranged on priority and the recursiveness and is followed successively by: ABDFC.
Confirm that by alarm correlation matrix of the present invention the flow process of method can find out for all alarms that generated in the network; Can clearly and succinctly express the first priority recurrence Root alarm of every alarm; The second priority recurrence Root alarm etc.; Also can clearly and succinctly draw all set of deriving and alarming that every alarm causes; And guaranteed the priority and the recursiveness of Root alarm layer by layer, it is slow to have overcome the analysis speed that traditional wall scroll rale store brings, recurrence relation unintelligible with can not guarantee shortcoming such as priority.
The association rules matrix that generates is as shown in Figure 8.This association rules matrix has following characteristics:
1. first row have comprised all alarms that relate in the rule;
2. there are the value row intactly to list this row first from the secondary series of going to last one and are listed as all Root alarm of corresponding alarm, and very clearly guarantee and embodied the priority and the recursiveness of each Root alarm.Second classifies the first priority recurrence Root alarm as, and the 3rd classifies second priority recurrence Root alarm or the like as;
3. second train value himself is exactly a Root alarm for empty explanation;
4. have the train value of value row identical (except first row), the set of first row of the row of identical train value is whole alarm set of deriving that the corresponding alarm of this train value is comprised.With Fig. 5 is example, and second the train value of value row is arranged all is A, and the set of first row of the row at A place is DFEG, that is to say, all of A alarm set of deriving are DFEG; And
5. the association rules matrix is a lower triangular matrix, can save half the memory space.
Step S406 creates NE on webmaster, carries out relevant configuration.On network management system, create the network element and the plate of various equipment types, set up topology and connect, it is professional to dispose polytype low-order and high-order, and purpose is all the alarm source points in the cover up rule table;
Step S408, driver module 204 emulation network elements and all alarms of disposable structure.In the present embodiment, structure association rules matrix first is listed as all alarm ABCDFEG that comprise and is reported to alarm correlation analysis system.In addition, can also the quality paper proclamation police that this step constructs be preserved, direct this message of loading sends to webmaster and gets final product when reusing, and conveniently uses later on; And
Step S410, verification module 204 usefulness " by row disappearance method " checking strictly all rules.
Wherein, " pursuing row disappearance method " will be described in detail below.
What verification module 204 was used the association rules matrixes verifies that by row disappearance method the step whether strictly all rules pass through is following: in step S207, used driver module 204 to construct all alarms in the rule; Alarm correlation analysis system can carry out correlation analysis automatically; Whether the Root alarm of verification module 204 each alarm of checking is analyzed correctly; That is to say; Whether Root alarm of checking each alarm is its second corresponding train value in the association rules matrix (perhaps checking the set that whether has comprised its first corresponding row alarm in the alarm of deriving of alarm of second train value), and second train value himself is exactly a Root alarm for empty explanation; On webmaster, the alarm of second train value removed then and confirm that operation makes it become history alarm (when current alarm becomes history alarm; Can refresh automatically on the current alarm interface); Choose all remaining current alarms to reanalyse; Whether the Root alarm of checking each alarm is its 3rd corresponding train value in the association rules matrix (or whether the alarm of deriving of the alarm of the 3rd train value has comprised the set of its first corresponding row alarm); By that analogy, the alarm up to all train values disappears.In proof procedure, verification module 204 can note all through with the rule of not passing through.
Set forth the detailed process of checking below in conjunction with embodiment.
At first; Under the situation that has all alarm ABCDFEG; Verification module 204 checks whether current Root alarm interface only shows three alarms of ABC, and whether the alarm of deriving of inquiry A has comprised DFEG, and whether the alarm of deriving of inquiry B and C is sky (perhaps going to the current alarm interface of deriving to check whether the Root alarm that whether only shows four alarms of DFEG and every alarm all is A); If any incongruent, the rule that record does not pass through.This process is used for verifying whether the analysis of the first priority recurrence Root alarm of each bar alarm is correct.
Then, verification module 204 makes it become history alarm A alarm carrying out clear confirmation operation.Because what use is the emulation network element, the disappearance of A alarm can not cause the disappearance of other alarms, and is so the current alarm that exists at present set is BCDFEG, as shown in Figure 9.Choose these alarms to reanalyse; Check on the current Root alarm interface after refreshing and whether only show BC; And whether the alarm of deriving of B has comprised DFEG; Whether the alarm of deriving of C is empty (perhaps going the current alarm window of deriving to check whether the Root alarm that whether only shows DFEG and every alarm all is B), if any incongruent, and the rule that record does not pass through.This process is used for verifying whether the analysis of the second priority recurrence Root alarm of each bar alarm is correct.
Then, verification module 204 is with B, and D and F disappear successively, and proof procedure is the same, repeats no more.After the ABDF alarm all disappeared, only remaining CEG alarm was shown in figure 10 on the webmaster.Choose these three alarms to reanalyse; Check whether current Root alarm interface only shows CE, and the alarm of deriving of C is G, the alarm of deriving of E is empty (perhaps go the current alarm window of deriving to check and whether only show that G and its Root alarm are C); If any incongruent, the rule that record does not pass through.This process is used for verifying whether the analysis of last priority level recurrence Root alarm of each bar alarm is correct.
Make it become history alarm C alarm carrying out clear confirmation operation at last.The current alarm set that exists at present is EG, chooses these two alarms to reanalyse.Check whether show on the current Root alarm interface after refreshing that EG and its alarm of deriving is sky (perhaps going the current alarm of deriving to check it whether is empty).This process is used for verifying whether the analysis of the alarm that does not have secondary relationship is correct.All row that begin from secondary series up to the association rules matrix all disappear, and proof procedure finishes.In this process, verification module 204 can write down automatically all through with the rule of not passing through.
Can find out from this embodiment; Through all alarms of the disposable structure of emulation network element with utilize " by row disappearance method " of association rules matrix to verify; Not only overcome the limitation of real equipment; Fully verify priority and recursiveness, and verified rapid and convenient, overcome all major defects of traditional verification mode.
The above is merely the preferred embodiments of the present invention, is not limited to the present invention, and for a person skilled in the art, the present invention can have various changes and variation.All within spirit of the present invention and principle, any modification of being done, be equal to replacement, improvement etc., all should be included within protection scope of the present invention.
Claims (16)
1. one kind is used for check system that alarm correlation analysis system is verified, it is characterized in that, comprising:
Driver module is used for the alarm of the predetermined alarm correlation rule table of emulation network element and structure, and gives said alarm correlation analysis system with said alarm report; And
The verification module is used for verifying whether said alarm correlation analysis system meets the rule of said alarm correlation rule table to the output result of said alarm, and wherein, said rule comprises the correlation of the Root alarm and the alarm of deriving.
2. check system according to claim 1 is characterized in that, also comprises: DBM is used to store said predetermined alarm correlation rule table.
3. check system according to claim 1 and 2 is characterized in that, whether the output result that said verification module also is used for writing down said alarm correlation analysis system satisfies the strictly all rules of said predetermined alarm correlation rule table.
4. check system according to claim 3 is characterized in that, said alarm correlation rule table has association rules matrix data structure.
5. check system according to claim 4; It is characterized in that; In said matrix data structure, first row have comprised all alarms in the said alarm regulation table, have value to list all Root alarm corresponding to the alarm of this row first row from each secondary series of going to last one.
6. check system according to claim 5; It is characterized in that; Said second classifies the first priority recurrence Root alarm as, and the 3rd classifies the second priority recurrence Root alarm as, by that analogy; To the last one has value row, and said secondary series to said last have in the value row each each train value in being listed as identical.
7. check system according to claim 6 is characterized in that, the set of the train value of first row of each row of identical train value place is the whole set of deriving and alarming that alarm comprised corresponding to said identical train value.
8. check system according to claim 7 is characterized in that, is that said alarm is a Root alarm under the situation of sky at said secondary series train value.
9. one kind is used for method of calibration that alarm correlation analysis system is verified, it is characterized in that, may further comprise the steps:
The emulation network element is also constructed the alarm in the predetermined alarm correlation rule table, and give said alarm correlation analysis system with said alarm report; And
Verify whether said alarm correlation analysis system meets the rule in the said alarm correlation rule table to the output result of said alarm, wherein, said rule comprises the correlation of the Root alarm and the alarm of deriving.
10. method of calibration according to claim 9 is characterized in that, and is further comprising the steps of:
Whether the output result who writes down said alarm correlation analysis system meets the rule in the said predetermined alarm correlation rule table.
11. method of calibration according to claim 10 is characterized in that, and is further comprising the steps of: generate association rules data matrix according to said alarm correlation rule table with association rules matrix data structure.
12. method of calibration according to claim 11; It is characterized in that; In the association rules data matrix; First row have comprised all alarms in the said alarm regulation table, have value to list all Root alarm corresponding to the alarm of this row first row from each secondary series of going to last one.
13. method of calibration according to claim 12; It is characterized in that; Said second classifies the first priority recurrence Root alarm as, and the 3rd classifies the second priority recurrence Root alarm as, by that analogy; To the last one has value row, and said secondary series to said last have in the value row each each train value in being listed as identical.
14. method of calibration according to claim 13 is characterized in that, the set of the train value of first row of each row of identical train value place is the whole set of deriving and alarming that alarm comprised corresponding to said identical train value.
15. method of calibration according to claim 14 is characterized in that, the output result of said alarm correlation analysis system is analyzed may further comprise the steps:
Whether the Root alarm of checking said alarm is the corresponding secondary series train value of alarm described in the said association rules matrix; Perhaps check the set that whether has comprised the corresponding pairing alarm of each said first row train value of said secondary series train value in the alarm of deriving of the pairing alarm of said secondary series train value; If confirm that then the pairing alarm of said secondary series train value is the Root alarm of said alarm;
The alarm of removing said secondary series train value makes it become history alarm;
Whether the Root alarm of checking said alarm is the 3rd corresponding row train value of alarm described in the said association rules matrix; Or whether the alarm of deriving of checking the alarm of said the 3rd row train value has comprised the set of the corresponding pairing alarm of each said first row train value of said the 3rd row train value; If confirm that then the pairing alarm of said the 3rd row train value is the Root alarm of said alarm;
The alarm of removing said the 3rd row train value makes it become history alarm; And
By that analogy, said the pairing alarm of value row train value arranged up to having removed all.
16. method of calibration according to claim 15 is characterized in that, is that said alarm is a Root alarm under the situation of sky at said secondary series train value.
Priority Applications (3)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2009101515042A CN101599874B (en) | 2009-06-29 | 2009-06-29 | Check system and method for checking alarm correlation analysis system |
| PCT/CN2009/073941 WO2010139146A1 (en) | 2009-06-05 | 2009-09-15 | Method and device for analyzing alarm correlation, system and method for checking alarm correlation analyzing device |
| EP09845426.7A EP2439877B1 (en) | 2009-06-05 | 2009-09-15 | Method and device for analyzing alarm correlation, system and method for checking alarm correlation analyzing device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2009101515042A CN101599874B (en) | 2009-06-29 | 2009-06-29 | Check system and method for checking alarm correlation analysis system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101599874A CN101599874A (en) | 2009-12-09 |
| CN101599874B true CN101599874B (en) | 2012-02-08 |
Family
ID=41421137
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2009101515042A Active CN101599874B (en) | 2009-06-05 | 2009-06-29 | Check system and method for checking alarm correlation analysis system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101599874B (en) |
Families Citing this family (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102142983A (en) * | 2010-11-24 | 2011-08-03 | 华为技术有限公司 | Alarm correlation analysis method and device |
| CN105991339B (en) * | 2015-03-05 | 2018-09-07 | 腾讯科技（深圳）有限公司 | A kind of alarm root localization method and device |
| CN106992900A (en) * | 2016-01-20 | 2017-07-28 | 北京国双科技有限公司 | The method and intelligent early-warning notification platform of monitoring and early warning |
| CN107992012B (en) * | 2017-12-20 | 2020-09-25 | 联想(北京)有限公司 | Method and device for acquiring correlation between production line processes |
| CN109889355B (en) * | 2018-06-13 | 2022-04-26 | 广东电网有限责任公司 | Power grid alarm rule strategy control method |
-
2009
- 2009-06-29 CN CN2009101515042A patent/CN101599874B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN101599874A (en) | 2009-12-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN101577636B (en) | Method and device for determining alarm correlation matrix and analyzing alarm correlation | |
| CN101599874B (en) | Check system and method for checking alarm correlation analysis system | |
| RU2336566C2 (en) | Method of modeling of processes of provision of technical readiness of communication networks in technical operation and system for its implementation | |
| CN107219997A (en) | A kind of method and device for being used to verify data consistency | |
| CN105808437A (en) | Automation testing method and system based on test case data table | |
| CN103226562A (en) | Method and apparatus for generating questions | |
| CN111176991B (en) | Automatic generation method for embedded software interface use cases | |
| CN106255959B (en) | For exporting system, method and the storage medium of the report of the remaining probability of multiple events | |
| CN104135390A (en) | Novel electric power communication system reliability analysis algorithm | |
| CN110289997A (en) | A kind of log message checking method, apparatus and system | |
| CA2893699C (en) | Physical connection of network components in a graphical computer enviroment with one-way signal propagation | |
| WO2010139146A1 (en) | Method and device for analyzing alarm correlation, system and method for checking alarm correlation analyzing device | |
| Mo et al. | Network simplification and K-terminal reliability evaluation of sensor-cloud systems | |
| Li et al. | Design of an otn-based failure/alarm propagation simulator | |
| CN113220578A (en) | Method for generating function test case | |
| CN106355301A (en) | Method and device for determining workflow template | |
| Dureja et al. | Formal framework for safety, security, and availability of aircraft communication networks | |
| CN105704189B (en) | Correlation method, device and system between upper layer link and lower layer link | |
| Nghatsane et al. | Fritchman modeling for correlated turbulence-induced errors in FSO communication | |
| Favali et al. | The role of Information Communication Technologies (ICT) for seafloor observatories: Acquisition, archival, analysis, interoperability | |
| Zhao et al. | Identifying Root-Cause Changes for User-Reported Incidents in Online Service Systems | |
| CN105683938A (en) | Recording an application test | |
| Smith | Current status of cooperation for the Light-Water Reactor R&D Sub-WG PRA | |
| Chaturvedi | Irredundant subset cut generation to compute capacity related reliability | |
| Nadi et al. | Draca: Decision support for root cause analysis and change impact analysis for cmdbs |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant |