Embodiment
To combine the accompanying drawing in the embodiment of the invention below, the technical scheme in the embodiment of the invention is carried out clear, intactly description, obviously, described embodiment only is the present invention's part embodiment, rather than whole embodiment.Based on the embodiment among the present invention, those of ordinary skills are not making the every other embodiment that is obtained under the creative work prerequisite, all belong to the scope of the present invention's protection.
The embodiment of the invention provides a kind of alarm event sending method, and the alarm event that is mainly used in the network management sends, and wherein alarm event comprises alarm and alarm clearance, and as shown in Figure 1, the method for present embodiment is the performed method of agent apparatus, comprising:
Step 101 receives the alarm event trigger messages to equipment or application, wherein, comprises the alarm code that is used to identify alarm event in the alarm event trigger messages, and the variable parameter value of equipment (or application).
Be appreciated that when the application on device hardware or the equipment is broken down, can send the alarm event trigger messages and alarm to agent apparatus; When the application on device hardware or the equipment when malfunction returns to normal condition, also can send the alarm event trigger messages and carry out alarm clearance to agent apparatus.Can comprise that in the alarm event trigger messages indicating equipment (or application) is in the malfunction or the information of fault recovery state; Be used for the alarm code of unique identification alarm event and the variable parameter value of equipment (or application), wherein parametric variable can be logined the operational factor of universal business of used time or the like for fault time, failure recovery time, active user's number or the current user of equipment (or application); The information such as internet protocol address and SNMP port numbers that in the alarm event trigger messages, can also comprise agent apparatus.Here agent apparatus can be a logical block in the equipment that breaks down, and also can be the device independent and equipment that breaks down; And the alarm event trigger messages can be the Indication message of indication equipment (or application) fault, or the Indication message of indicating equipment (or application) recovered failure etc.
Step 102 according to the alarm code in the alarm event trigger messages, and the corresponding relation of the interval value of alarm code that presets and alarm event, is searched the interval value of the corresponding alarm event of the alarm code of reception, and this interval value comprises interval maximum and interval minimum value.
In agent apparatus, storing the information of multiple alarm event, comprising the corresponding alarm code of this alarm event, whether corresponding interval maximum and interval minimum value send the identification information of this alarm event etc. before the transmitting time of this alarm event reaches.When searching, agent apparatus can compare the alarm code in the corresponding relation of alarm code that receives and storage, from finding out corresponding interval value.
Step 103; Agent apparatus need compare the variable parameter value of equipment or application with the interval value that finds, if the variable parameter value of equipment or application is compared with the interval maximum and/or the interval minimum value of the alarm event of searching in the step 102; Satisfy the strategy that presets; Then execution in step 104, if in the interval of the alarm event that the variable parameter value of equipment or application is not searched in step 102, then execution in step 105.
Particularly; Here the strategy that presets comprises: variable parameter value (comprises that variable parameter value equals interval maximum or interval minimum value) between interval maximum and interval minimum value; Or variable parameter value is less than or equal to interval maximum, or variable parameter value is more than or equal to said interval minimum value etc.
Be appreciated that if also comprise the alarm indication in the alarm event trigger messages that receives in the step 101, when this alarm indication is used for indication needs transmission alarm information, execution in step 104 when variable parameter value is less than or equal to said interval maximum then; When this alarm indication is used for indication needs transmission alarm clearance message, then in variable parameter value execution in step 104 during more than or equal to said interval minimum value.And if do not comprise alarm indication, then execution in step 104 when variable parameter value is between said interval maximum and interval minimum value in the alarm event trigger messages that receives in the step 101.
Step 104, the alarm event that filtering alarm Event triggered message is corresponding.
Particularly, when the filtering alarm incident, can ignore processing to this alarm event trigger messages.
Step 105; Send alarm or alarm clearance message and give Network Management Equipment; Particularly, if alarm event trigger messages indicating equipment or application and trouble then send alarm information and give the network equipment; If alarm event trigger messages indicating equipment or application recovered failure are then sent alarm clearance message and are given Network Management Equipment.
For example; If alarm code is the universal service alarm of sign, and the variable parameter value of equipment or application comprises the universal professional actual operation parameters on the equipment, logins the used time etc. such as active user's numerical value or user; Then when the interval maximum of this actual operation parameters greater than the alarm event of searching; Then agent apparatus can send alarm information and give Network Management Equipment, when the interval minimum value of this actual operation parameters less than the alarm event of searching, then sends alarm clearance message and gives Network Management Equipment.Particularly; If the corresponding interval of this alarm code is [80,100], some transmission alarm in active user's number>100; But active user's number returns to [80 from 100; Do not send alarm clearance message during any one value 100], just send alarm clearance message, if will can not produce the alarm clearance message of a large amount of repetitions when active user's number is paced up and down like this between 100 up to being lower than at 80 o'clock.
Need to prove that agent apparatus can also be the current time according to the transmitting time of this alarm event that in system, stores execution of step 104 or at 105 o'clock.
It is thus clear that; In the embodiment of the invention; Agent apparatus can be after receiving the alarm event trigger messages; According to comprising the corresponding relation of alarm code and the storage interval maximum and the interval minimum value of searching corresponding alarm event, and if the variable parameter value of equipment in the alarm event trigger messages or application not in the interval of the alarm event of searching, then send alarm information or alarm clearance message and give Network Management Equipment; If variable parameter value satisfies the strategy that presets, then filtering alarm incident with the interval maximum and/or the interval minimum value of the alarm event of searching.Limit agent apparatus transmission alarm event through an interval like this and comprise alarm information and alarm clearance message; If the actual variable parameter value of equipment or application with satisfy in this interval maximum and/or interval minimum value when necessarily concerning; Agent apparatus can filter this alarm event; With limit agent apparatus with a point in the prior art and send alarm event and compare; Method in the embodiment of the invention can reduce agent apparatus and send the number of times that alarm event is given Network Management Equipment, produces alarm windstorm thereby reduced system.
With reference to shown in Figure 2, in a concrete embodiment, agent apparatus can also be carried out following step after carrying out above-mentioned steps 101:
Whether step 106 sends the corresponding alarm event of alarm code in the alarm event trigger messages before agent apparatus is judged, if, execution in step 107; If not, then carry out above-mentioned steps 102 to 105.
Be appreciated that; In system, storing the information of multiple alarm event; The interval value that comprises alarm code (Trap Code), this alarm event comprises interval maximum (Max value) and interval minimum value (Min value); Alarm flag bit (is Send Notification) of corresponding alarm event state (promptly whether producing before this alarm event) or the like with being used to indicate alarm code particularly, can store information as shown in table 1:
Table 1
When then whether agent apparatus sent the alarm event of alarm code correspondence in the alarm event trigger messages before judging; Can confirm the corresponding alarm flag bit of alarm code that stores in the system produces the corresponding alarm event of alarm code before whether indicating; If do not produce this alarm event before; Then the corresponding alarm flag bit of this alarm code that stores in can also update system of agent apparatus promptly upgrades alarm status for sending this alarm event.
Step 107 confirms that whether current time and last send interval between time of the corresponding alarm event of this alarm code greater than the time interval of presetting, if greater than the time interval of presetting, then execution in step 102 to 105; If be less than or equal to the time interval of presetting, then execution in step 104.
Be appreciated that; Agent apparatus is when having carried out step 107; No matter can also upgrade the transmitting time of the corresponding alarm event of alarm code, particularly, be to confirm to be greater than or less than or the corresponding transmitting time of this alarm code that time interval of equaling to preset stores in can update system is the current time.
In the present embodiment, if the current alarm event that need to send before sent, and time interval of current time and this alarm event of last time transmission when being less than or equal to the time interval of presetting, can filter this alarm event and not send this alarm event.Can reduce the transmission number of times of alarm event so further, thereby the reduction system produces the risk of alarm windstorm.
In another concrete embodiment; Agent apparatus adopts the form of alarm formation to send when in carrying out above-mentioned steps 105, sending alarm event; Alarm event buffer memory that then can alarm code is corresponding before sending alarm event becomes the alarm formation; If the alarm queue length of buffer memory is greater than the length that presets (such as 1000,1000 alarm events of ability buffer memory), the corresponding alarm event of alarm code that then will exceed presetting length stores into warning file.Wherein warning file can be the file of forms such as Excel database, text.
Be appreciated that if in a period of time, a plurality of alarm events produce in a large number, will cause agent apparatus to send a large amount of alarm events simultaneously, make the system consumption resource uprush, make a mistake easily to Network Management Equipment.Therefore, agent apparatus can become the alarm formation with the alarm event buffer memory that produces.Then specifically when carrying out above-mentioned steps 105, can sequentially from the alarm formation, read alarm event and mail to Network Management Equipment, and this alarm event of buffer memory in the deletion alarm formation, all send to Network Management Equipment up to the alarm event that will alarm in the formation.If the alarm formation is empty; Agent apparatus then can read the information of alarm event and construct an alarm information or alarm clearance message goes Network Management Equipment from the warning file that stores; And the information of this alarm event in the warning file that deletion stores is like this up to the alarm event in the warning file is all sent to Network Management Equipment.
Below with a concrete embodiment alarm event sending method in the embodiment of the invention is described; Agent apparatus in the present embodiment is that an independent equipment with faulty equipment is the alarm event dispensing device; Concrete structure is as shown in Figure 3; Comprise: trigger module, alarm filter (filter) module, alarm formation and warning processing module, wherein:
Trigger module is used for triggering alarm event, and the alarm event trigger messages when the equipment that receives faulty equipment or recovered failure sends can trigger the processing to alarm event;
The alarm filter module is to be used for filtering the unnecessary alarm event that sends to Network Management Equipment;
The alarm formation is used for buffer memory and need sends to the alarm event of Network Management Equipment;
The alarm module processing unit is to be used for reading the alarm event in the alarm formation and sending to Network Management Equipment.
With reference to shown in Figure 4, each module of alarm event dispensing device can be carried out the transmission of alarm information according to following flow process in the present embodiment, comprising:
201; Trigger module receiving alarm Event triggered message is logined information such as used time comprising to use warning information (app trap Info) be apptrapInfo.is Clear=mistake (false) the i.e. indication variable parameter value that needs transmission alarm information, equipment or application such as alarm code, alarm indication such as the active user's number or the user of universal business.
202; The alarm filter module finds the interval value (dbtrapInfo) of the corresponding alarm event of this alarm code in database according to alarm code wherein; If the variable parameter value of equipment or application greater than the interval maximum of searching, gets into step 203, the transmitting time of this alarm event that stores in the storehouse otherwise the alarm filter module can Update Information is the current time; And filter this alarm event, and process ends.
203, the corresponding alarm code flag bit of this alarm code that the alarm filter module searches stores in the database, thus whether sent the corresponding alarm event of this alarm code before confirming, if then enter into step 204; The alarm code flag bit of the alarm event that this alarm code that stores in the storehouse otherwise the alarm filter module can Update Information is corresponding is used for indicating and sent this alarm event, puts down in writing the transmitting time of this alarm event, and gets into step 205.
204; Whether the time interval that the alarm filter module is confirmed to send current time and last time this alarm event is greater than the time interval of presetting; If the transmitting time of the alarm event that this alarm code that stores in the storehouse that then Updates Information is corresponding is the current time, and get into step 205; Otherwise the alarm filter module can be filtered this alarm event, and transmitting time last time of the corresponding alarm event of this alarm code that stores in the storehouse that can also Update Information is the current time, and process ends.
205; The alarm filter module is confirmed the length (such as 1000) whether the alarm formation of current cache equals to preset; If equal, then that this alarm code is corresponding alarm event stores into warning file, and the wait warning processing module has been sent the alarm event in the alarm formation; And then handle this warning file, and process ends; If less than, then that this alarm code is corresponding alarm event is cached in the alarm formation, and sends the alarm event in the alarm formation by the warning processing module order.
With reference to shown in Figure 5, each module of alarm event dispensing device can be carried out the transmission of alarm clearance message according to following flow process in the present embodiment, comprising:
301; Trigger module receiving alarm Event triggered message is logined information such as used time comprising to use the indication information of warning information (app trap Info) such as alarm code, fault clearance be correct (true) the i.e. indication of apptrapInfo.is Clear=variable parameter value of needing transmission alarm clearance message, equipment or application such as the active user's number or the user of universal business.
302; The alarm filter module finds the interval value (dbtrapInfo) of the corresponding alarm event of this alarm code in database according to alarm code wherein; If the variable parameter value of equipment or application is less than the interval minimum value of searching; Then get into step 303, otherwise the alarm filter module can be filtered this alarm event, and process ends.
303; The corresponding alarm code flag bit of this alarm code that the alarm filter module searches stores in the database, thus the corresponding alarm event of this alarm code whether sent before confirming, if; Then sent the corresponding alarm of this alarm code before the explanation; The alarm flag bit of the alarm event that this alarm code that stores in the storehouse of can Updating Information is corresponding, this alarm event was not sent in indication, and got into step 304; Otherwise alarm filter module filtering alarm incident and process ends.
304; The alarm filter module is confirmed the length (such as 1000) whether the alarm formation of current cache equals to preset; If equal, then that this alarm code is corresponding alarm event stores into warning file, and the wait warning processing module has been sent the alarm event in the alarm formation; And then handle this warning file, and process ends; If less than, then that this alarm code is corresponding alarm event is cached in the alarm formation, and sends the alarm event in the alarm formation by the warning processing module order.
It is thus clear that; Limit the transmission alarm event through an interval in the embodiment of the invention and comprise alarm information and alarm clearance message; If the actual variable parameter value of equipment or application is less than or equal to interval maximum; Or variable parameter value can filter this alarm event during more than or equal to said interval minimum value, sends alarm event and compares with limiting with a point in the prior art; Device in the embodiment of the invention can reduce the number of times of the alarm event that sends invalid or repetition, produces alarm windstorm thereby reduced system.
And through the alarm event buffer memory being become the alarm formation, having avoided too much effectively, alarm event arrives Network Management Equipment simultaneously and makes a mistake in the present embodiment.
The embodiment of the invention also provides a kind of alarm event dispensing device, can be fault equipment, also can be an equipment that is independent of outside the faulty equipment, and structural representation is as shown in Figure 6, comprising:
Trigger messages receiving element 10; Be used to receive alarm event trigger messages to equipment or application; Comprise the alarm code that is used to identify alarm event in the said alarm event trigger messages; With the variable parameter value of said equipment or application, such as the information such as time of failure of active user's number, equipment or the application of using;
Unit 11 is searched in the interval; Be used for alarm code according to the alarm event trigger messages of said trigger messages receiving element 10 receptions; And the corresponding relation of the interval value of alarm code that presets and alarm event; Search the interval value of the corresponding alarm event of the alarm code of said reception, said interval value comprises interval maximum and interval minimum value;
Filter element 12 is used for searching the interval maximum and/or the interval minimum value of the alarm event of searching unit 11 with said interval and comparing when said variable parameter value, satisfies the strategy that presets, and then filters the corresponding alarm event of said alarm event trigger messages; The said strategy that presets comprises: said variable parameter value (comprises that variable parameter value equals interval maximum or interval minimum value) between said interval maximum and interval minimum value; Or said variable parameter value is less than or equal to said interval maximum, or said variable parameter value is more than or equal to said interval minimum value;
Incident transmitting element 13 is used for working as said variable parameter value not in the interval of the alarm event of searching unit 11 is searched in said interval, then sends alarm information or alarm clearance message and gives said Network Management Equipment.
Particularly; If the alarm code in the alarm event trigger messages that trigger messages receiving element 10 receives is the alarm of the universal business of sign; And the variable parameter value of equipment or application comprises that the actual operation parameters of universal business logins information such as used time such as active user's numerical value or user; Then incident transmitting element 13 is the interval maximums of searching the alarm event of searching unit 11 in actual operation parameters greater than the interval; Then send alarm information and give said Network Management Equipment,, then send alarm clearance message and give Network Management Equipment when actual operation parameters is searched the alarm event of searching unit 11 less than the interval interval minimum value.
Be appreciated that; Can also comprise the alarm indication in the alarm event trigger messages that trigger messages receiving element 10 receives; When being used for the indication needs, this alarm indication sends alarm information; Then filter element 12 is less than or equal to said interval maximum in variable parameter value, filters the corresponding alarm event of said alarm event trigger messages; Send alarm clearance message when this alarm indication is used for the indication needs, then filter element 12 more than or equal to said interval minimum value, then filters the corresponding alarm event of said alarm event trigger messages in variable parameter value.And if do not comprise the alarm indication in the alarm event trigger messages that trigger messages receiving element 10 receives, then filter element 12 be in variable parameter value between said interval maximum and interval minimum value, ability filtering alarm incident.
In the alarm event dispensing device of the embodiment of the invention; Trigger messages receiving element 10 is after receiving the alarm event trigger messages; The interval search unit 11 according to comprising the corresponding relation of alarm code and the storage interval maximum and the interval minimum value of searching corresponding alarm event; And if the variable parameter value of equipment in the alarm event trigger messages or application is not in the interval of the alarm event of searching; Then incident transmitting element 13 sends alarm informations or alarm clearance message is given Network Management Equipment, if the interval maximum and/or the interval minimum value of variable parameter value and the alarm event of searching satisfy the strategy that presets, then filter element 12 filtering alarm incidents.Limit the transmission alarm event through an interval like this and comprise alarm and alarm clearance; If the actual variable parameter value of equipment or application and this interval maximum and/or interval minimum value satisfy when necessarily concerning; Filter element 12 can filter this alarm event; Send alarm event and compare with limiting with a point in the prior art, the device in the embodiment of the invention can reduce and sends the number of times of alarm event to Network Management Equipment, thereby has reduced system's generation alarm windstorm.
With reference to shown in Figure 7; In a concrete embodiment; The alarm dispensing device can also comprise except can comprising structure as shown in Figure 6: incident judging unit 14, at interval definite unit 15, flag bit updating block 16, time updating block 17 and formation storage element 18, wherein:
Incident judging unit 14; Whether send the corresponding alarm event of said alarm code before being used to judge; Particularly; Incident judging unit 14 can confirm the corresponding alarm flag bit of alarm code that stores in the system produces the corresponding alarm event of alarm code before whether indicating, and this alarm flag bit is the state that is used to indicate the corresponding alarm event of said alarm code, promptly whether sends before this alarm event.
Confirm unit 15 at interval; Be used for when said incident judging unit 14 definite corresponding alarm events of said alarm code that send before, whether the interval between the time of the alarm event that then definite current time is corresponding with the said alarm code of last transmission is greater than the time interval of presetting.
Flag bit updating block 16 is used for before said incident judging unit 14 is confirmed, not sending the corresponding alarm event of said alarm code, upgrades the alarm flag bit of the corresponding alarm event of said alarm code.
Time updating block 17 is used to upgrade the transmitting time of the corresponding alarm event of said alarm code.
Formation storage element 18; Be used for the alarm event buffer memory that said alarm code is corresponding and become the alarm formation; If, then will exceeding the corresponding alarm event of said alarm code of presetting length greater than the length that presets, the length of the alarm formation of said buffer memory stores into warning file.
In the present embodiment; After receiving the alarm event trigger messages that comprises alarm code and variable parameter value when trigger messages receiving element 10; Whether sent the corresponding alarm event of this alarm code before can judging by incident judging unit 14 earlier; If not, then can send this alarm event for indication, and search unit 11 by the interval and search interval value through the alarm flag bit of this alarm event of storing in flag bit updating block 16 update system.If sent before; Then by confirming that at interval whether time interval that unit 15 is confirmed the current time and sent this alarm event last time is greater than the time interval of presetting; If greater than the time interval of presetting; Then search unit 11 and search interval value by the interval, and by the time of this alarm event of transmission that stores in time updating block 17 update system be the current time; If be less than or equal to the time interval of presetting,, and can it by the time of this alarm event of transmission that stores in time updating block 17 update system current time by the corresponding alarm event of filter element 12 Direct Filtration alarm event trigger messages.
And in the present embodiment, mail to the mistake that Network Management Equipment causes, before incident transmitting element 13 sends alarm event for fear of a large amount of alarm events; Can become the alarm formation by the alarm event buffer memory that formation storage element 18 will send; If the length of the alarm formation of buffer memory is greater than the length that presets, then that alarm code is corresponding alarm event stores into warning file, and then incident transmitting element 13 particularly; Can order from the alarm formation, read the corresponding alarm event of alarm code; And alarm event sent to Network Management Equipment, and the said alarm event of buffer memory in the deletion alarm formation, all send to Network Management Equipment up to the alarm event that will alarm in the formation.If the alarm formation is empty; 13 of incident transmitting elements can read the information of alarm event and construct an alarm information or alarm clearance message goes Network Management Equipment from the warning file that stores; And the information of this alarm event in the warning file that deletion stores is like this up to the alarm event in the warning file is all sent to Network Management Equipment.
Above-mentioned to carry out method that alarm event sends such as Fig. 1 or the corresponding embodiment of Fig. 2 like each unit in Fig. 6 or the alarm event dispensing device shown in Figure 7 said, do not give unnecessary details at this; And the structure of alarm event dispensing device also can be as shown in Figure 3, do not give unnecessary details at this.
One of ordinary skill in the art will appreciate that all or part of step in the whole bag of tricks of the foregoing description is to instruct relevant hardware to accomplish through program; This program can be stored in the computer-readable recording medium, and storage medium can comprise: read-only memory (ROM), random-access memory (ram), disk or CD etc.
More than to alarm event sending method and device that the embodiment of the invention provided; Carried out detailed introduction; Used concrete example among this paper principle of the present invention and execution mode are set forth, the explanation of above embodiment just is used for helping to understand method of the present invention and core concept thereof; Simultaneously, for one of ordinary skill in the art, according to thought of the present invention, the part that on embodiment and range of application, all can change, in sum, this description should not be construed as limitation of the present invention.