CN103929326A - Communication network transmission type alarm uniform analysis device and method - Google Patents
Communication network transmission type alarm uniform analysis device and method Download PDFInfo
- Publication number
- CN103929326A CN103929326A CN201410099972.0A CN201410099972A CN103929326A CN 103929326 A CN103929326 A CN 103929326A CN 201410099972 A CN201410099972 A CN 201410099972A CN 103929326 A CN103929326 A CN 103929326A
- Authority
- CN
- China
- Prior art keywords
- alarm
- correlation
- analysis
- module
- path
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Abstract
The invention discloses a communication network transmission type alarm uniform analysis device and method and relates to the field of communications. The device comprises a display module, an adaptive module, an interface module, a preprocessing analysis module, a secondary analysis module and a static data read-only module, wherein the display module, the adaptive module, the interface module, the preprocessing analysis module, the secondary analysis module and the static data read-only module are sequentially connected, the adaptive module completes delivery and transition of the service path and alarm correlation analysis services and is communicated with the display module, the interface module provides data for the preprocessing analysis module, and outputs alarm correlation analysis results, the preprocessing analysis module conducts preprocessing analysis on the alarm correlation analysis, and the secondary analysis module conducts secondary analysis on the alarm correlation analysis. Software service technologies are adopted on the implementation forms of the modules, different service analysis modules are reused in a binary mode conveniently, the preprocessing and asynchronous parallel processing are adopted, the alarm analysis efficiency can be effectively improved, the secondary analysis mechanism is adopted, and interference possibly existing in the analysis results can be effectively avoided.
Description
Technical field
The present invention relates to the communications field, specifically relate to the unified device and method of analyzing of a kind of communication network transmission class alarm.
Background technology
In transmission network equipment, conventional tranmission techniques comprises SDH(Synchronous Digital Hierarchy, synchronous digital hierarchy), WDM(Wavelength Division Multiplexing, wavelength division multiplexing), OTN(Optical Transport Network, optical transfer network) and PTN(Packet Transport Network, Packet Transport Network) etc., and in the day-to-day operation of concrete equipment is safeguarded, need to adopt the method that meets above-mentioned technical characterictic configure and activate the service, and carry out the supervision of running quality by alarm and performance for the business after opening.Along with the expansion of transmission network construction scale, its structure is day by day complicated, service path quantity also strengthens thereupon, need the alarm monitoring to be also magnanimity growth trend, now, it is unpractical entirely going out root alarm by manual analysis, and the analytical method of automation is imperative, and the judgement of inhibition relation between any two alarms is the basis of root alert analysis, is called for short alarm inhibition analysis in literary composition.
The method of the alarm inhibition analysis of present existing automation is divided into two kinds: to using the inhibition analysis between the alarm that the transmission equipment of certain concrete tranmission techniques produces; For same tranmission techniques by the transmission equipment of different manufacturers realize institute produced after alarm comprehensively after inhibition analysis.But the method for above-mentioned alarm inhibition analysis is not all crossed over the specific field of certain tranmission techniques, thereby the analysis Restrainable algorithms that causes the exploitation of the equipment for applying concrete tranmission techniques can not directly be brought the alarm inhibition analysis of the equipment for applying other tranmission techniques and use, when newly-increased a kind of equipment of applying certain concrete tranmission techniques, be the identical alarm inhibition analysis algorithm in logic that this equipment development is new again, waste is exploited natural resources.
In sum, there is following problem in the realization of present existing alert analysis:
(1) source code of alert analysis function is embedded in the source code of certain service management module, causes alert analysis function and business configuration Function Coupling too high, be unfavorable for the reusing of source code of alert analysis function;
(2) in the time analyzing an alarm, existing solution is that potential all alarms are compared with it, and causing algorithm complex is index rank, and in the face of the alarm of magnanimity, the efficiency of analytic process is lower;
(3), in traditional alarm correlation analysis process, may there is interference in analysis result each other.
Summary of the invention
The object of the invention is the deficiency in order to overcome above-mentioned background technology, provide a kind of communication network transmission class alarm the unified device and method of analyzing, realize in form and adopt software service technology in module, be convenient to reuse with binary mode at different business analysis module; Take preliminary treatment, asynchronous parallel processing, the secondary analysis mechanism of a series of alert analysis, can effectively improve the efficiency of alert analysis; Adopt directed acyclic diagram technology, the interference that can effectively avoid analysis result may exist each other.
The invention provides the unified device of analyzing of a kind of communication network transmission class alarm, comprise connected in turn display module, adaptation module, interface module, Preprocessing module, secondary analysis module and a static data read through model,
Described display module, for: the demonstration of analysis result completed;
Described adaptation module, for: delivery and the conversion of finishing service path, alarm correlation analysis service, and communicate with display module, for display module provides analysis result;
Described interface module, for: for Preprocessing module provides data, and the result of outputting alarm correlation analysis, be alarm correlation analysis algorithm can executive process carrier;
Described Preprocessing module, for: the Preprocessing of realizing alarm correlation analysis;
Described secondary analysis module, for: remove the interference between alarm correlation analysis result;
A described static data read through model, for: realize unified encapsulation and the access of warning code static data and alarm correlation analysis rule static data;
Alarm arrives after Preprocessing module by adaptation module, interface module, according to rule and preprocessing and scheduling strategy in a static data read through model, carry out alarm preliminary treatment assignment: in the time of an alarm of interface module input, first carry out alarm verification, if the warning code of input alarm is not in the regular collection in a static data read through model, do not process, continue to process next input alarm; In the time that alarm enters into Preprocessing module, first enter the queue of alarm to be analyzed, be responsible for taking-up by assigning thread, carry out the preliminary treatment in alarm path; Assign thread and completed after the preliminary treatment of path, according to thread selection algorithm, the thread that alarm is delivered to appointment is analyzed, and again again from queue, takes out next alarm, when in queue when no alarm, carries out dormancy wait; In the time of correlation service stopping, top service notification analysis module stops the processing of thread pool;
Preprocessing module is during for alarm correlation analysis, the alarm of traffic aided possesses correlation for the alarm on same path, non-service class alarm possesses correlation for the alarm in same network element: in the time of concurrent processing, for non-service alarm, traffic aided alarm, similar alarm scheduling is processed at same thread;
The mode of traffic aided alarm concurrent scheduling is: (1) service path is without service layer path: processing threads number=path, alarm place ID% traffic aided processing threads number; (2) service path has service layer path: the bottom service layer path ID% traffic aided processing threads number in processing threads number=path, alarm place;
The mode of independent of service alarm concurrent scheduling: processing threads number=alarm place NE ID % independent of service processing threads number;
Concurrent classification processing: the situation that the traffic aided alarm based on possessing service path ID and independent of service alarm exist scene to intersect in the time of concurrent processing, concurrent processing is divided into bi-level treatment: the first order is processed traffic aided alarm, flows into the second level without the alarm of service path ID; Draw the alarm of correlation results for the first order, no longer flowed into the second level; For the alarm that flows into the second level, the NE ID again occurring according to alarm is selected processing threads;
The alarm correlation Preprocessing flow process of Preprocessing module is as follows:
Obtain corresponding correlation analysis rule by the alarm of current input, obtain a regular set; By alert analysis fetch strategy, based on current input alarm, find associated alarm set;
Whether the alarm set obtaining by extraction, adopts current alarm rule to analyze with the alarm in alarm and the alarm set of current input one by one, check and mate, if do not mated, enters next rule and calculates; If coupling, buffer memory present analysis result;
Complete after strictly all rules coupling, if neither one rule exists analysis result, buffer memory current alarm, exits epicycle Preprocessing; If there is Preprocessing result, after merging, send to secondary analysis module, this alarm of buffer memory, exits epicycle Preprocessing simultaneously;
The fetch strategy of Preprocessing module institute foundation comprises space constraint and time-constrain, space constraint is the generation distribution relation of alarm on network and service path, time-constrain comprises: alarm time of origin is in the corresponding spatial dimension of this alarm, centered by this alarm time of origin, respectively to analyze the time interval of binding hours as positive and negative upper and lower limit;
The process that generates alarm correlation data in Preprocessing module is as follows:
Determine after the alarm scope of constraint, alarm set in restriction range is derived, the goal set of analyzing as current alarm, preanalysis process is by all alarms in current input alarm and goal set, according to analysis rule corresponding to current input alarm, judge, if there is correlation, this correlation is submitted to secondary analysis module, if non-correlation, do not process, retain this data preparation subsequent analysis;
In preanalysis, generate after preanalysis relation, in preanalysis relation, carry rule ID, traffic ID, analysis time, as the foundation of secondary analysis;
The alarm of the correlation of Preprocessing result is stored as a directed acyclic graph DAG by secondary analysis module, this directed acyclic graph DAG memory dependency, summit storage Alarm ID and this alarm add the temporal information of graph of a relation, the traversal DFS's according to field using Alarm ID as the degree of depth;
Relation between alarm represents with the arc in directed acyclic graph DAG, the starting point of arc represents Root alarm, the terminal of arc represents derivative alarm, and the attribute on arc comprises time, Root alarm ID, derivative Alarm ID, service path ID, rule ID that this arc generates, whether reached the fields such as stable state represents; In this directed acyclic graph, be made up of respectively different connected components, each connected component is actually an alarm correlation group, and for the persistence of alarm correlation, reporting output is all based on this connected component;
Warning relation DFS traversal: DFS traversal is carried out in timing in correlation DAG figure, operation below carrying out in DFS ergodic process: whether the time by each summit in the connected component of a summit association exceedes threshold value stabilization time, determine that whether the relation between summit reaches stable state, reaches stable state and this stable relation is delivered to and reports queue; Determine between summit whether have merging relation, if there is merging relation, merge summit; Determine between summit and whether can be cached in persistence module; If reached persistence standard, this is related to group persistence;
In alarm correlation analysis process, have the interim preliminary treatment relation being produced by intermediateness, this part relation merges with reference to following methods:
Preliminary treatment correlation is adjusted based on root alert priority, type of service, processing rule type and processing time 4 conditions, first suppress priority packet by alarm, packet-priority sorts by priority, priority value is less, priority is higher, select one group of the highest relation of priority, the grouping that other priority are low abandons, and the order of priority is as follows:
First by circuit I D grouping;
In circuit I D group, the rule that selective rule priority is the highest; If highest priority rule, exists multiple equal priority, whether judgment rule is to support many rules so, if single rule, select time correlation at most retains, and other abandon, if many rules retain corresponding result;
Undertaken second in the first round by the remaining correlation of each inherent filtration in circuit I D grouping and take turns eliminating, second takes turns the correlation of getting rid of according to the priority selection limit priority of the residual correlation rule of correspondence is retained, if highest priority rule, have multiple equal priority, whether judgment rule is to support many rules so, if single rule, select time correlation at most retains, other abandon, if many rules retain corresponding result;
Second take turns analysis after, secondary analysis module reports the second association results of taking turns after having analyzed to interface module.
On the basis of technique scheme, the data that described adaptation module is used comprise alarm, configuration data and service path data, and alarm comprises locating information, warning code, time of origin, and locating information comprises single-deck ID, NE ID and port-mark; Configuration data comprises network element data, single-deck data, port data; Service path data are the combination of 3 hierarchical data: circuit-> path-> connects; article one, subnet transposition circuit is made up of operating path set and Protection path set; operating path set is identical with the data structure of Protection path set, and path essential information comprises ID of trace route path, circuit identifier, work/protection, service path information.
On the basis of technique scheme, in described alarm, record temporal information, locating information, alarm correlation analysis result that warning code, alarm occur, alarm correlation analysis result according to the structure of rule ID+root Alarm ID+derivative Alarm ID to upper layer transfers.
On the basis of technique scheme, the expression mode of described port is divided into 3 kinds: (1) 64 integer single-deck ID; (2) operation level at port place; (3) port-mark character string; The level at port place comprises transmission medium layer, higher order path layer, low order channel layer, the PDH (Pseudo-synchronous Digital Hierarchy) pdh physical interface layer of SDH serial equipment; The section layer of PTN serial equipment, channel layer, circuit layer, operation layer; Optical transport layer OTS, the optical multiplex layer OMS of WDM series, optical channel layers OCH, client layer; The OTS layer of OTN series, OMS layer, OCH layer, light path data cell ODUk layer, client layer, k=0,1,2,3,4.
On the basis of technique scheme, the type of described port comprises physical terminal point PTP, floated terminal point FTP, connection end points CTP, and port-mark character string identifies according to the set membership of the type of port, port; The string table of port-mark is shown: port type 1=port numbers 1[/ port type 2=port numbers 2] [/ port type 3=port numbers 3] ... [/ port type n=port numbers n], n is natural number.
The present invention also provides the communication network transmission class alarm based on said apparatus the unified method of analyzing, and comprises the following steps:
S1, judge that warning code whether in a static data read through model, if so, forwards step S2 to; Otherwise, finish;
S2, alarm arrive after Preprocessing module by adaptation module, interface module, according to rule and preprocessing and scheduling strategy in a static data read through model, carry out alarm preliminary treatment assignment: in the time of an alarm of interface module input, first carry out alarm verification, if the warning code of input alarm is not in the regular collection in a static data read through model, do not process, continue to process next input alarm; In the time that alarm enters into Preprocessing module, first enter the queue of alarm to be analyzed, be responsible for taking-up by assigning thread, carry out the preliminary treatment in alarm path; Assign thread and completed after the preliminary treatment of path, according to thread selection algorithm, the thread that alarm is delivered to appointment is analyzed, and again again from queue, takes out next alarm, when in queue when no alarm, carries out dormancy wait; In the time of correlation service stopping, top service notification analysis module stops the processing of thread pool;
Preprocessing module is during for alarm correlation analysis, the alarm of traffic aided possesses correlation for the alarm on same path, non-service class alarm possesses correlation for the alarm in same network element: in the time of concurrent processing, for non-service alarm, traffic aided alarm, similar alarm scheduling is processed at same thread;
The mode of traffic aided alarm concurrent scheduling is: (1) service path is without service layer path: processing threads number=path, alarm place ID% traffic aided processing threads number; (2) service path has service layer path: the bottom service layer path ID% traffic aided processing threads number in processing threads number=path, alarm place;
The mode of independent of service alarm concurrent scheduling: processing threads number=alarm place NE ID % independent of service processing threads number;
Concurrent classification processing: the situation that the traffic aided alarm based on possessing service path ID and independent of service alarm exist scene to intersect in the time of concurrent processing, concurrent processing is divided into bi-level treatment: the first order is processed traffic aided alarm, flows into the second level without the alarm of service path ID; Draw the alarm of correlation results for the first order, no longer flowed into the second level; For the alarm that flows into the second level, the NE ID again occurring according to alarm is selected processing threads;
The alarm correlation Preprocessing flow process of S3, Preprocessing module is as follows:
Obtain corresponding correlation analysis rule by the alarm of current input, obtain a regular set; By alert analysis fetch strategy, based on current input alarm, find associated alarm set;
Whether the alarm set obtaining by extraction, adopts current alarm rule to analyze with the alarm in alarm and the alarm set of current input one by one, check and mate, if do not mated, enters next rule and calculates; If coupling, buffer memory present analysis result;
Complete after strictly all rules coupling, if neither one rule exists analysis result, buffer memory current alarm, exits epicycle Preprocessing; If there is Preprocessing result, after merging, send to secondary analysis module, this alarm of buffer memory, exits epicycle Preprocessing simultaneously;
The fetch strategy of Preprocessing module institute foundation comprises space constraint and time-constrain, space constraint is the generation distribution relation of alarm on network and service path, time-constrain comprises: alarm time of origin is in the corresponding spatial dimension of this alarm, centered by this alarm time of origin, respectively to analyze the time interval of binding hours as positive and negative upper and lower limit;
The process that Preprocessing module generates alarm correlation data is as follows:
Determine after the alarm scope of constraint, alarm set in restriction range is derived, the goal set of analyzing as current alarm, preanalysis process is by all alarms in current input alarm and goal set, according to analysis rule corresponding to current input alarm, judge, if there is correlation, this correlation is submitted to secondary analysis module, if non-correlation, do not process, retain this data preparation subsequent analysis;
In preanalysis, generate after preanalysis relation, in preanalysis relation, carry rule ID, traffic ID, analysis time, as the foundation of secondary analysis;
S4, alarm correlation secondary analysis: the alarm of the correlation of Preprocessing result is stored as a directed acyclic graph DAG by secondary analysis module, this directed acyclic graph DAG memory dependency, summit storage Alarm ID and this alarm add the temporal information of graph of a relation, the traversal DFS's according to field using Alarm ID as the degree of depth;
Relation between alarm represents with the arc in directed acyclic graph DAG, the starting point of arc represents Root alarm, the terminal of arc represents derivative alarm, and the attribute on arc comprises time, Root alarm ID, derivative Alarm ID, service path ID, rule ID that this arc generates, whether reached the fields such as stable state represents; In this directed acyclic graph, be made up of respectively different connected components, each connected component is actually an alarm correlation group, and for the persistence of alarm correlation, reporting output is all based on this connected component;
Warning relation DFS traversal: DFS traversal is carried out in timing in correlation DAG figure, operation below carrying out in DFS ergodic process: whether the time by each summit in the connected component of a summit association exceedes threshold value stabilization time, determine that whether the relation between summit reaches stable state, reaches stable state and this stable relation is delivered to and reports queue; Determine between summit whether have merging relation, if there is merging relation, merge summit; Determine between summit and whether can be cached in persistence module; If reached persistence standard, this is related to group persistence;
In alarm correlation analysis process, have the interim preliminary treatment relation being produced by intermediateness, this part relation merges with reference to following methods:
Preliminary treatment correlation is adjusted based on root alert priority, type of service, processing rule type and processing time 4 conditions, first suppress priority packet by alarm, packet-priority sorts by priority, priority value is less, priority is higher, select one group of the highest relation of priority, the grouping that other priority are low abandons, and the order of priority is as follows:
First by circuit I D grouping;
In circuit I D group, the rule that selective rule priority is the highest; If highest priority rule, exists multiple equal priority, whether judgment rule is to support many rules so, if single rule, select time correlation at most retains, and other abandon, if many rules retain corresponding result;
Undertaken second in the first round by the remaining correlation of each inherent filtration in circuit I D grouping and take turns eliminating, second takes turns the correlation of getting rid of according to the priority selection limit priority of the residual correlation rule of correspondence is retained, if highest priority rule, have multiple equal priority, whether judgment rule is to support many rules so, if single rule, select time correlation at most retains, other abandon, if many rules retain corresponding result;
S5, second take turns analysis after, secondary analysis module reports the second association results of taking turns after having analyzed to interface module, finish.
On the basis of technique scheme, the data that described adaptation module is used comprise alarm, configuration data and service path data, and alarm comprises locating information, warning code, time of origin, and locating information comprises single-deck ID, NE ID and port-mark; Configuration data comprises network element data, single-deck data, port data; Service path data are the combination of 3 hierarchical data: circuit-> path-> connects; article one, subnet transposition circuit is made up of operating path set and Protection path set; operating path set is identical with the data structure of Protection path set, and path essential information comprises ID of trace route path, circuit identifier, work/protection, service path information.
On the basis of technique scheme, in described alarm, record temporal information, locating information, alarm correlation analysis result that warning code, alarm occur, alarm correlation analysis result according to the structure of rule ID+root Alarm ID+derivative Alarm ID to upper layer transfers.
On the basis of technique scheme, the expression mode of described port is divided into 3 kinds: (1) 64 integer single-deck ID; (2) operation level at port place; (3) port-mark character string; The level at port place comprises transmission medium layer, higher order path layer, low order channel layer, the PDH (Pseudo-synchronous Digital Hierarchy) pdh physical interface layer of SDH serial equipment; The section layer of PTN serial equipment, channel layer, circuit layer, operation layer; Optical transport layer OTS, the optical multiplex layer OMS of WDM series, optical channel layers OCH, client layer; The OTS layer of OTN series, OMS layer, OCH layer, light path data cell ODUk layer, client layer, k=0,1,2,3,4.
On the basis of technique scheme, the type of described port comprises physical terminal point PTP, floated terminal point FTP, connection end points CTP, and port-mark character string identifies according to the set membership of the type of port, port; The string table of port-mark is shown: port type 1=port numbers 1[/ port type 2=port numbers 2] [/ port type 3=port numbers 3] ... [/ port type n=port numbers n], n is natural number.
Compared with prior art, advantage of the present invention is as follows:
The present invention realizes in form and adopts software service technology in module, is convenient to reuse with binary mode at different business analysis module; Take preliminary treatment, the asynchronous parallel processing of a series of alert analysis, can effectively improve the efficiency of alert analysis; Employing secondary analysis mechanism, the interference that can effectively avoid analysis result may exist each other.
Brief description of the drawings
Fig. 1 is the structured flowchart of the unified device of analyzing of communication network transmission class alarm in the embodiment of the present invention.
Fig. 2 is the structural representation of service path data.
Fig. 3 is the flow chart of the unified method of analyzing of communication network transmission class alarm in the embodiment of the present invention.
Fig. 4 is that in the embodiment of the present invention, the pretreated multithreading of alarm is processed schematic diagram.
Fig. 5 is the schematic diagram of the directed acyclic graph of alarm secondary analysis in the embodiment of the present invention.
Embodiment
Below in conjunction with drawings and the specific embodiments, the present invention is described in further detail.
Shown in Figure 1, the embodiment of the present invention provides a kind of communication network transmission class alarm the unified device of analyzing, comprise connected in turn display module, adaptation module, interface module, Preprocessing module, secondary analysis module and a static data read through model, wherein:
Display module, for: the demonstration of analysis result completed;
Adaptation module, for: delivery and the conversion of finishing service path, alarm correlation analysis service, and communicate with display module, for display module provides analysis result;
Interface module, for: for Preprocessing module provides data, and the result of outputting alarm correlation analysis, be alarm correlation analysis algorithm can executive process carrier;
Preprocessing module, for: the Preprocessing of realizing alarm correlation analysis;
Secondary analysis module, for: remove the interference between alarm correlation analysis result;
A static data read through model, for: realize unified encapsulation and the access of warning code static data and alarm correlation analysis rule static data.
The data that adaptation module is used comprise alarm, configuration data and service path data, and alarm at least comprises the attribute items such as locating information, warning code, time of origin, locating information comprises single-deck ID(Identifier, identifier), NE ID and port-mark; Configuration data comprises network element data, single-deck data, port data; Service path data are the combination of 3 hierarchical data: circuit-> path-> connects.Shown in Figure 2; article one, subnet transposition circuit is made up of operating path set and Protection path set; operating path set is identical with the data structure of Protection path set; path essential information at least comprises the information such as the set of connection in ID of trace route path, circuit identifier, work/protection, service path, path; in the set connecting, each connection is subdivided into again source port, egress mouth.
In alarm correlation analysis, the position relationship on service path statement space, also have with dish, same to network element, same to physical port, with this space-like position relationship of logic port, this class is related to the locating information in associated alarm.In alarm, record temporal information, locating information, the alarm correlation analysis result of warning code, alarm generation.Alarm correlation analysis result according to the structure of rule ID+root Alarm ID+derivative Alarm ID to upper layer transfers.
The expression mode of port is divided into 3 kinds: (1) 64 integer single-deck ID; (2) operation level at port place; (3) port-mark character string.
The level at port place comprises transmission medium layer, higher order path layer, low order channel layer, the PDH(Plesiochronous Digital Hierarchy of SDH serial equipment, PDH (Pseudo-synchronous Digital Hierarchy)) physical interface layer; The section layer of PTN serial equipment, channel layer, circuit layer, operation layer; The OTS(Optical Transmission Section of WDM series, optical transport layer) layer, OMS(Optical Multiplex Section, optical multiplex layer) layer, OCH(Optical Channel, optical channel layers) layer, CLIENT(client) layer; The OTS layer of OTN series, OMS layer, OCH layer, ODUk(Optical Channel Data Unit-k, light path data cell k, k=0,1,2,3,4) layer, CLIENT layer.
The type of port comprises PTP(Physical Terminal Point, physical terminal point, represent physical port), FTP(Float Terminal Point, floated terminal point, represent the backboard port of single-deck), CTP(Connection TerminalPoint, connection end points, presentation logic port), port-mark character string identifies according to the set membership of the type of port, port.The string table of port-mark is shown: port type 1=port numbers 1[/ port type 2=port numbers 2] [/ port type 3=port numbers 3] ... [/ port type n=port numbers n], n is natural number.
Shown in Figure 3, the embodiment of the present invention also provides a kind of transmission of the communication network based on said apparatus class alarm the unified method of analyzing, and comprises the following steps:
S1, judge that warning code whether in a static data read through model, if so, forwards step S2 to; Otherwise, finish;
S2, adaptation module is passed through in alarm, interface module arrives after Preprocessing module, according to rule and preprocessing and scheduling strategy in a static data read through model, carry out alarm preliminary treatment assignment: in order to solve the queues up problem of processing of existing alert analysis in a processing threads, the embodiment of the present invention has been introduced the concurrent mechanism of alarm preliminary treatment and analysis: in the time of an alarm of interface module input, first carry out alarm verification, if the warning code of input alarm is not in the regular collection in a static data read through model, do not process, continue to process next input alarm.Shown in Figure 4, in the time that alarm enters into Preprocessing module, first enter the queue of alarm to be analyzed, be responsible for taking-up by assigning thread, carry out the preliminary treatment in alarm path; Assign thread and completed after the preliminary treatment of path, according to thread selection algorithm, the thread that alarm is delivered to appointment is analyzed, and again again from queue, takes out next alarm, when in queue when no alarm, carries out dormancy wait; In the time of correlation service stopping, top service notification analysis module stops the processing of thread pool.
Preprocessing module is during for alarm correlation analysis, the alarm of traffic aided possesses correlation for the alarm on same path, non-service class alarm possesses correlation for the alarm in same network element: in the time of concurrent processing, need to, for non-service alarm, traffic aided alarm, similar alarm scheduling be processed at same thread.
The mode of traffic aided alarm concurrent scheduling is:
(1) service path is without service layer path: processing threads number=path, alarm place ID% traffic aided processing threads number;
(2) service path has service layer path: the bottom service layer path ID% traffic aided processing threads number in processing threads number=path, alarm place.
The mode of independent of service alarm concurrent scheduling: processing threads number=alarm place NE ID % independent of service processing threads number.
Concurrent hierarchical processing method: based on the traffic aided alarm and independent of service alarm (the same dish that possess service path ID, with PTP etc.) situation that exists scene to intersect in the time of concurrent processing, concurrent processing need to be divided into bi-level treatment: the first order is processed traffic aided alarm (alarm without service path ID flows into the second level); Draw the alarm of correlation results for the first order, no longer flowed into the second level; For the alarm that flows into the second level, the NE ID again occurring according to alarm is selected processing threads.
The alarm correlation Preprocessing flow process of S3, Preprocessing module is as follows:
Obtain corresponding correlation analysis rule by the alarm of current input, obtain a regular set; Because each correlation analysis rule has specific alert analysis fetch strategy, by alert analysis fetch strategy, based on current input alarm, find associated alarm set;
Whether the alarm set obtaining by extraction, adopts current alarm rule to analyze with the alarm in alarm and the alarm set of current input one by one, check and mate, if do not mated, enters next rule and calculates; If coupling, buffer memory present analysis result;
Complete after strictly all rules coupling, if neither one rule exists analysis result, buffer memory current alarm, exits epicycle Preprocessing; If there is Preprocessing result, after merging, send to secondary analysis module, this alarm of buffer memory, exits epicycle Preprocessing simultaneously.
The fetch strategy of Preprocessing module institute foundation has comprised space constraint and time-constrain.Space constraint had been exactly both the generation distribution relation of alarm on network and service path, it is very ripe technology, time-constrain comprises: alarm time of origin is in the corresponding spatial dimension of this alarm, centered by this alarm time of origin, respectively to analyze the time interval of binding hours as positive and negative upper and lower limit.In the time that increment alarm arrives, be the alert analysis scope of its generation, can effectively avoid occurring invalid analysis situation.
The process that Preprocessing module generates alarm correlation data is as follows:
Having determined after the alarm scope of constraint, the alarm set in restriction range is derived to the goal set of analyzing as current alarm.Preanalysis process is by all alarms in current input alarm and goal set, according to analysis rule corresponding to current input alarm, judge, if there is correlation, this correlation is submitted to secondary analysis module, if non-correlation, does not process, retain this data preparation subsequent analysis.
In preanalysis, generate after preanalysis relation, in preanalysis relation, carry rule ID, traffic ID, analysis time, as the foundation of secondary analysis.
The result obtaining in alarm correlation preanalysis, conventionally there is interference problem, in the analysis result disturbing in existence, these disturb the possibility of result to have plenty of because alarm concussion causes, what have may be because the effect that alarm cascading triggers produces, cause the root of same alarm to have multiple, for final location Root alarm causes difficulty.The embodiment of the present invention is introduced DAG(Directed Acyclic Graph, directed acyclic graph) reason be: the characteristic of DAG itself can solve the queueing problem of interfering data in correlation analysis very easily: in (1) DAG, do not have closed loop, therefore can, by the characteristic of itself, get rid of the relation that interdepends in result; (2) DAG has efficient data removing, and insertion ability is saved analysis time; (3) DAG is by being divided into multiple connected subgraphs, and these connected subgraphs have just in time represented an alarm correlation set.
S4, alarm correlation secondary analysis:
The DAG figure of warning relation is shown in Figure 5, the alarm of the correlation of Preprocessing result is stored as a directed acyclic graph DAG by secondary analysis module, this directed acyclic graph DAG is responsible for memory dependency, summit storage Alarm ID and this alarm add the temporal information of graph of a relation, using Alarm ID as DFS(Deep First Search, degree of depth traversal) traversal according to field.
Relation between alarm represents with the arc of directed acyclic graph DAG in Fig. 5, and the starting point of arc represents Root alarm, and the terminal of arc represents derivative alarm.Attribute on arc comprises time, Root alarm ID, derivative Alarm ID, service path ID, rule ID that this arc generates, whether reached the fields such as stable state represents.
Because alarm is based on network element and service path, can determine that this figure is a sparse graph, in storage, select adjacency list.In this directed acyclic graph, be made up of respectively different connected components, each connected component is actually an alarm correlation group.For the persistence of alarm correlation, reporting output is all based on this connected component.
Warning relation DFS traversal: DFS traversal is carried out in timing in correlation DAG figure, operation below carrying out in DFS ergodic process: whether the time by each summit in the connected component of a summit association exceedes threshold value stabilization time, determine that whether the relation between summit reaches stable state, reaches stable state and this stable relation is delivered to and reports queue; Determine between summit whether have merging relation, if there is merging relation, merge summit; Determine between summit and whether can be cached in persistence module; If reached persistence standard, this is related to group persistence.
In alarm correlation analysis process, have the interim preliminary treatment relation producing due to intermediateness, this part relation merges with reference to following methods.
Preliminary treatment correlation is adjusted based on root alert priority, type of service, processing rule type and processing time 4 conditions, first suppress priority packet by alarm, packet-priority sorts by priority that (priority value is less, priority is higher), select one group of the highest relation of priority, the grouping that other priority are low abandons, and the order of priority is described as follows:
First by circuit I D grouping;
In circuit I D group, the rule that selective rule priority is the highest; If highest priority rule, exists multiple equal priority, whether judgment rule is to support many rules so, if single rule, select time correlation at most retains, and other abandon, if many rules retain corresponding result;
Undertaken second in the first round by the remaining correlation of each inherent filtration in circuit I D grouping and take turns eliminating, second takes turns the correlation of getting rid of according to the priority selection limit priority of the residual correlation rule of correspondence is retained, if highest priority rule, have multiple equal priority, whether judgment rule is to support many rules so, if single rule, select time correlation at most retains, other abandon, if many rules retain corresponding result;
S5, second take turns analysis after, secondary analysis module reports the second association results of taking turns after having analyzed to interface module, finish.
Be elaborated below by concrete example.
Suppose 2 alarms of current input: the first alarm A1, the second alarm A2,2 circuit of current existence: the first circuit C1, second circuit C2, the port of the first alarm A1 is P1, the port that the second alarm A2 occurs is P2.The path of the first circuit C1 is { (Pa1, Pz1), (Pa2, Pz2) ..(Pan, Pzn) }, the path of second circuit C2 is { (Pa1', Pz1'), (Pa2', Pz2'), ..(Pan', Pzn') }, Pan represents n the source port connecting in the operating path of the first circuit C1, Pzn represents n the egress mouth connecting in the operating path of the first circuit C1, and n is natural number.Pan' represents n the source port connecting in the operating path of second circuit C2, and Pzn' represents the egress mouth of n connection in the operating path of second circuit C2.
Step 101, when after the first alarm A1 input, first judge whether the first alarm A1 meets alarm correlation rule, if the first alarm A1 warning code does not meet the warning code of existing rule definition, no longer analyze.Suppose that the first alarm A1 is through Preprocessing here, without relevant alarm, the first alarm A1 is kept in preliminary treatment alarm buffer memory tree.
Carry out complete explanation as an example of the second alarm A2 example below.
Step 102, now input the second alarm A2, the warning code of the second alarm A2 is as met corresponding alarm correlation rule, further judge whether the second alarm A2 exists relevant circuit, if there is corresponding circuits, circuit I D is pressed to pretreatment line number of passes delivery, be assigned to (inner hypothesis has configured 2 preliminary treatment threads) on corresponding preliminary treatment thread, here it is consistent with the port of the second alarm A2 that the second alarm A2 corresponds to the last connectivity port of first circuit C1(the first circuit C1), the mark road code name C1 that powers in the alarm of the second alarm A2.The second alarm A2 is delivered in the preliminary treatment thread T1 that the first circuit C1 is corresponding.If the alarm in actual treatment corresponds to many circuit, also need alarm to copy as corresponding many parts, then being delivered to respectively in alignment processing thread.
Attention: suppose that the second alarm A2 can correspond to many circuit, so also the second alarm A2 will be copied as to corresponding many parts, then be assigned to corresponding preliminary treatment thread.If there is no related circuit, presses the second alarm A2 the NE ID delivery at place, is delivered to corresponding preliminary treatment thread and analyzes.If the second alarm A2 NE ID delivery difference, can be delivered to different processing threads, for the alarm of independent of service, normally occur in same network element, therefore the alarm of independent of service is processed conventionally in same preliminary treatment thread.Here will remark additionally a bit, analyze switch if opened to maximize, even if there is corresponding circuits, alarm can be delivered to Preprocessing processing threads by NE ID delivery equally and calculate once.
Step 103, when the second alarm A2 arrives after preliminary treatment thread T1, according to warning code, obtain corresponding correlation alarm fetch strategy list object, and travel through one by one by fetch strategy list object, obtain the alarm set that has potential correlation with alarm.Here the second alarm A2 can search for out by the first alarm A1 alarm of input before, (when the relevant alarm of search, alarm time of origin to search is restricted, and the second alarm A2 and the first alarm A1 time of origin can not exceed limit value, and this is the time-constrain of correlation analysis).
Step 104, in corresponding alert analysis list of rules, with the above-mentioned alarm set of the traversal of rule one by one in list of rules, in current alarm set, only has a first alarm A1, the correlation of rule judgment current alarm (the second alarm A2) and the first alarm A1 one by one.If there not being correlation, skip over, otherwise have correlation, enter step 105.
Step 105, the warning relation R1[R2 of correlation, R3 will be there is ... Rn], n is natural number, is delivered to secondary analysis module.Delivering when secondary analysis, filter the relation repeating, and self relevant relation.
Step 106, in secondary analysis module, the directed acyclic graph of degree of depth traversal alarm correlation composition, in ergodic process, checks into arc and goes out arc each node, get rid of invalid arc according to precipitation algorithm, what in last directed graph, remain is exactly suitable correlation.
Step 107, in the time of each traversal, check apart from checking last time and exceed the subgraph that reports time threshold, meet the sedimentation time while requiring when the time of each node in subgraph, the relation that shows this subgraph is stable, reports so corresponding relations all in this subgraph.In directed acyclic graph, delete this subgraph, with conserve space simultaneously.
Step 108, the correlation analysis result that acquisition need to report in alarm correlation analysis service, by messaging bus, issue to outside.Alarm correlation analysis adaptation services is received corresponding analysis result, then reports to client, display analysis result on interface.
Those skilled in the art can carry out various modifications and variations to the embodiment of the present invention, if these amendment and modification within the scope of the claims in the present invention and equivalent technologies thereof, these revise and modification also within protection scope of the present invention.
The prior art that the content of not describing in detail in specification is known to the skilled person.
Claims (10)
1. the unified device of analyzing of communication network transmission class alarm, comprises connected in turn display module, adaptation module, interface module, Preprocessing module, secondary analysis module and a static data read through model, it is characterized in that:
Described display module, for: the demonstration of analysis result completed;
Described adaptation module, for: delivery and the conversion of finishing service path, alarm correlation analysis service, and communicate with display module, for display module provides analysis result;
Described interface module, for: for Preprocessing module provides data, and the result of outputting alarm correlation analysis, be alarm correlation analysis algorithm can executive process carrier;
Described Preprocessing module, for: the Preprocessing of realizing alarm correlation analysis;
Described secondary analysis module, for: remove the interference between alarm correlation analysis result;
A described static data read through model, for: realize unified encapsulation and the access of warning code static data and alarm correlation analysis rule static data;
Alarm arrives after Preprocessing module by adaptation module, interface module, according to rule and preprocessing and scheduling strategy in a static data read through model, carry out alarm preliminary treatment assignment: in the time of an alarm of interface module input, first carry out alarm verification, if the warning code of input alarm is not in the regular collection in a static data read through model, do not process, continue to process next input alarm; In the time that alarm enters into Preprocessing module, first enter the queue of alarm to be analyzed, be responsible for taking-up by assigning thread, carry out the preliminary treatment in alarm path; Assign thread and completed after the preliminary treatment of path, according to thread selection algorithm, the thread that alarm is delivered to appointment is analyzed, and again again from queue, takes out next alarm, when in queue when no alarm, carries out dormancy wait; In the time of correlation service stopping, top service notification analysis module stops the processing of thread pool;
Preprocessing module is during for alarm correlation analysis, the alarm of traffic aided possesses correlation for the alarm on same path, non-service class alarm possesses correlation for the alarm in same network element: in the time of concurrent processing, for non-service alarm, traffic aided alarm, similar alarm scheduling is processed at same thread;
The mode of traffic aided alarm concurrent scheduling is: (1) service path is without service layer path: processing threads number=path, alarm place ID% traffic aided processing threads number; (2) service path has service layer path: the bottom service layer path ID% traffic aided processing threads number in processing threads number=path, alarm place;
The mode of independent of service alarm concurrent scheduling: processing threads number=alarm place NE ID % independent of service processing threads number;
Concurrent classification processing: the situation that the traffic aided alarm based on possessing service path ID and independent of service alarm exist scene to intersect in the time of concurrent processing, concurrent processing is divided into bi-level treatment: the first order is processed traffic aided alarm, flows into the second level without the alarm of service path ID; Draw the alarm of correlation results for the first order, no longer flowed into the second level; For the alarm that flows into the second level, the NE ID again occurring according to alarm is selected processing threads;
The alarm correlation Preprocessing flow process of Preprocessing module is as follows:
Obtain corresponding correlation analysis rule by the alarm of current input, obtain a regular set; By alert analysis fetch strategy, based on current input alarm, find associated alarm set;
Whether the alarm set obtaining by extraction, adopts current alarm rule to analyze with the alarm in alarm and the alarm set of current input one by one, check and mate, if do not mated, enters next rule and calculates; If coupling, buffer memory present analysis result;
Complete after strictly all rules coupling, if neither one rule exists analysis result, buffer memory current alarm, exits epicycle Preprocessing; If there is Preprocessing result, after merging, send to secondary analysis module, this alarm of buffer memory, exits epicycle Preprocessing simultaneously;
The fetch strategy of Preprocessing module institute foundation comprises space constraint and time-constrain, space constraint is the generation distribution relation of alarm on network and service path, time-constrain comprises: alarm time of origin is in the corresponding spatial dimension of this alarm, centered by this alarm time of origin, respectively to analyze the time interval of binding hours as positive and negative upper and lower limit;
The process that generates alarm correlation data in Preprocessing module is as follows:
Determine after the alarm scope of constraint, alarm set in restriction range is derived, the goal set of analyzing as current alarm, preanalysis process is by all alarms in current input alarm and goal set, according to analysis rule corresponding to current input alarm, judge, if there is correlation, this correlation is submitted to secondary analysis module, if non-correlation, do not process, retain this data preparation subsequent analysis;
In preanalysis, generate after preanalysis relation, in preanalysis relation, carry rule ID, traffic ID, analysis time, as the foundation of secondary analysis;
The alarm of the correlation of Preprocessing result is stored as a directed acyclic graph DAG by secondary analysis module, this directed acyclic graph DAG memory dependency, summit storage Alarm ID and this alarm add the temporal information of graph of a relation, the traversal DFS's according to field using Alarm ID as the degree of depth;
Relation between alarm represents with the arc in directed acyclic graph DAG, the starting point of arc represents Root alarm, the terminal of arc represents derivative alarm, and the attribute on arc comprises time, Root alarm ID, derivative Alarm ID, service path ID, rule ID that this arc generates, whether reached the fields such as stable state represents; In this directed acyclic graph, be made up of respectively different connected components, each connected component is actually an alarm correlation group, and for the persistence of alarm correlation, reporting output is all based on this connected component;
Warning relation DFS traversal: DFS traversal is carried out in timing in correlation DAG figure, operation below carrying out in DFS ergodic process: whether the time by each summit in the connected component of a summit association exceedes threshold value stabilization time, determine that whether the relation between summit reaches stable state, reaches stable state and this stable relation is delivered to and reports queue; Determine between summit whether have merging relation, if there is merging relation, merge summit; Determine between summit and whether can be cached in persistence module; If reached persistence standard, this is related to group persistence;
In alarm correlation analysis process, have the interim preliminary treatment relation being produced by intermediateness, this part relation merges with reference to following methods:
Preliminary treatment correlation is adjusted based on root alert priority, type of service, processing rule type and processing time 4 conditions, first suppress priority packet by alarm, packet-priority sorts by priority, priority value is less, priority is higher, select one group of the highest relation of priority, the grouping that other priority are low abandons, and the order of priority is as follows:
First by circuit I D grouping;
In circuit I D group, the rule that selective rule priority is the highest; If highest priority rule, exists multiple equal priority, whether judgment rule is to support many rules so, if single rule, select time correlation at most retains, and other abandon, if many rules retain corresponding result;
Undertaken second in the first round by the remaining correlation of each inherent filtration in circuit I D grouping and take turns eliminating, second takes turns the correlation of getting rid of according to the priority selection limit priority of the residual correlation rule of correspondence is retained, if highest priority rule, have multiple equal priority, whether judgment rule is to support many rules so, if single rule, select time correlation at most retains, other abandon, if many rules retain corresponding result;
Second take turns analysis after, secondary analysis module reports the second association results of taking turns after having analyzed to interface module.
2. the unified device of analyzing of communication network transmission class alarm as claimed in claim 1, it is characterized in that: the data that described adaptation module is used comprise alarm, configuration data and service path data, alarm comprises locating information, warning code, time of origin, and locating information comprises single-deck ID, NE ID and port-mark; Configuration data comprises network element data, single-deck data, port data; Service path data are the combination of 3 hierarchical data: circuit-> path-> connects; article one, subnet transposition circuit is made up of operating path set and Protection path set; operating path set is identical with the data structure of Protection path set, and path essential information comprises ID of trace route path, circuit identifier, work/protection, service path information.
3. the unified device of analyzing of communication network transmission class alarm as claimed in claim 2, it is characterized in that: in described alarm, record temporal information, locating information, alarm correlation analysis result that warning code, alarm occur, alarm correlation analysis result according to the structure of rule ID+root Alarm ID+derivative Alarm ID to upper layer transfers.
4. the unified device of analyzing of communication network transmission class alarm as claimed in claim 2, is characterized in that: the expression mode of described port is divided into 3 kinds: (1) 64 integer single-deck ID; (2) operation level at port place; (3) port-mark character string; The level at port place comprises transmission medium layer, higher order path layer, low order channel layer, the PDH (Pseudo-synchronous Digital Hierarchy) pdh physical interface layer of SDH serial equipment; The section layer of PTN serial equipment, channel layer, circuit layer, operation layer; Optical transport layer OTS, the optical multiplex layer OMS of WDM series, optical channel layers OCH, client layer; The OTS layer of OTN series, OMS layer, OCH layer, light path data cell ODUk layer, client layer, k=0,1,2,3,4.
5. the unified device of analyzing of communication network transmission class alarm as claimed in claim 4, it is characterized in that: the type of described port comprises physical terminal point PTP, floated terminal point FTP, connection end points CTP, and port-mark character string identifies according to the set membership of the type of port, port; The string table of port-mark is shown: port type 1=port numbers 1[/ port type 2=port numbers 2] [/ port type 3=port numbers 3] ... [/ port type n=port numbers n], n is natural number.
6. the unified method of analyzing of the transmission of the communication network based on installing described in any one in claim 1 to 5 class alarm, is characterized in that, comprises the following steps:
S1, judge that warning code whether in a static data read through model, if so, forwards step S2 to; Otherwise, finish;
S2, alarm arrive after Preprocessing module by adaptation module, interface module, according to rule and preprocessing and scheduling strategy in a static data read through model, carry out alarm preliminary treatment assignment: in the time of an alarm of interface module input, first carry out alarm verification, if the warning code of input alarm is not in the regular collection in a static data read through model, do not process, continue to process next input alarm; In the time that alarm enters into Preprocessing module, first enter the queue of alarm to be analyzed, be responsible for taking-up by assigning thread, carry out the preliminary treatment in alarm path; Assign thread and completed after the preliminary treatment of path, according to thread selection algorithm, the thread that alarm is delivered to appointment is analyzed, and again again from queue, takes out next alarm, when in queue when no alarm, carries out dormancy wait; In the time of correlation service stopping, top service notification analysis module stops the processing of thread pool;
Preprocessing module is during for alarm correlation analysis, the alarm of traffic aided possesses correlation for the alarm on same path, non-service class alarm possesses correlation for the alarm in same network element: in the time of concurrent processing, for non-service alarm, traffic aided alarm, similar alarm scheduling is processed at same thread;
The mode of traffic aided alarm concurrent scheduling is: (1) service path is without service layer path: processing threads number=path, alarm place ID% traffic aided processing threads number; (2) service path has service layer path: the bottom service layer path ID% traffic aided processing threads number in processing threads number=path, alarm place;
The mode of independent of service alarm concurrent scheduling: processing threads number=alarm place NE ID % independent of service processing threads number;
Concurrent classification processing: the situation that the traffic aided alarm based on possessing service path ID and independent of service alarm exist scene to intersect in the time of concurrent processing, concurrent processing is divided into bi-level treatment: the first order is processed traffic aided alarm, flows into the second level without the alarm of service path ID; Draw the alarm of correlation results for the first order, no longer flowed into the second level; For the alarm that flows into the second level, the NE ID again occurring according to alarm is selected processing threads;
The alarm correlation Preprocessing flow process of S3, Preprocessing module is as follows:
Obtain corresponding correlation analysis rule by the alarm of current input, obtain a regular set; By alert analysis fetch strategy, based on current input alarm, find associated alarm set;
Whether the alarm set obtaining by extraction, adopts current alarm rule to analyze with the alarm in alarm and the alarm set of current input one by one, check and mate, if do not mated, enters next rule and calculates; If coupling, buffer memory present analysis result;
Complete after strictly all rules coupling, if neither one rule exists analysis result, buffer memory current alarm, exits epicycle Preprocessing; If there is Preprocessing result, after merging, send to secondary analysis module, this alarm of buffer memory, exits epicycle Preprocessing simultaneously;
The fetch strategy of Preprocessing module institute foundation comprises space constraint and time-constrain, space constraint is the generation distribution relation of alarm on network and service path, time-constrain comprises: alarm time of origin is in the corresponding spatial dimension of this alarm, centered by this alarm time of origin, respectively to analyze the time interval of binding hours as positive and negative upper and lower limit;
The process that Preprocessing module generates alarm correlation data is as follows:
Determine after the alarm scope of constraint, alarm set in restriction range is derived, the goal set of analyzing as current alarm, preanalysis process is by all alarms in current input alarm and goal set, according to analysis rule corresponding to current input alarm, judge, if there is correlation, this correlation is submitted to secondary analysis module, if non-correlation, do not process, retain this data preparation subsequent analysis;
In preanalysis, generate after preanalysis relation, in preanalysis relation, carry rule ID, traffic ID, analysis time, as the foundation of secondary analysis;
S4, alarm correlation secondary analysis: the alarm of the correlation of Preprocessing result is stored as a directed acyclic graph DAG by secondary analysis module, this directed acyclic graph DAG memory dependency, summit storage Alarm ID and this alarm add the temporal information of graph of a relation, the traversal DFS's according to field using Alarm ID as the degree of depth;
Relation between alarm represents with the arc in directed acyclic graph DAG, the starting point of arc represents Root alarm, the terminal of arc represents derivative alarm, and the attribute on arc comprises time, Root alarm ID, derivative Alarm ID, service path ID, rule ID that this arc generates, whether reached the fields such as stable state represents; In this directed acyclic graph, be made up of respectively different connected components, each connected component is actually an alarm correlation group, and for the persistence of alarm correlation, reporting output is all based on this connected component;
Warning relation DFS traversal: DFS traversal is carried out in timing in correlation DAG figure, operation below carrying out in DFS ergodic process: whether the time by each summit in the connected component of a summit association exceedes threshold value stabilization time, determine that whether the relation between summit reaches stable state, reaches stable state and this stable relation is delivered to and reports queue; Determine between summit whether have merging relation, if there is merging relation, merge summit; Determine between summit and whether can be cached in persistence module; If reached persistence standard, this is related to group persistence;
In alarm correlation analysis process, have the interim preliminary treatment relation being produced by intermediateness, this part relation merges with reference to following methods:
Preliminary treatment correlation is adjusted based on root alert priority, type of service, processing rule type and processing time 4 conditions, first suppress priority packet by alarm, packet-priority sorts by priority, priority value is less, priority is higher, select one group of the highest relation of priority, the grouping that other priority are low abandons, and the order of priority is as follows:
First by circuit I D grouping;
In circuit I D group, the rule that selective rule priority is the highest; If highest priority rule, exists multiple equal priority, whether judgment rule is to support many rules so, if single rule, select time correlation at most retains, and other abandon, if many rules retain corresponding result;
Undertaken second in the first round by the remaining correlation of each inherent filtration in circuit I D grouping and take turns eliminating, second takes turns the correlation of getting rid of according to the priority selection limit priority of the residual correlation rule of correspondence is retained, if highest priority rule, have multiple equal priority, whether judgment rule is to support many rules so, if single rule, select time correlation at most retains, other abandon, if many rules retain corresponding result;
S5, second take turns analysis after, secondary analysis module reports the second association results of taking turns after having analyzed to interface module, finish.
7. the unified method of analyzing of communication network transmission class alarm as claimed in claim 6, it is characterized in that: the data that described adaptation module is used comprise alarm, configuration data and service path data, alarm comprises locating information, warning code, time of origin, and locating information comprises single-deck ID, NE ID and port-mark; Configuration data comprises network element data, single-deck data, port data; Service path data are the combination of 3 hierarchical data: circuit-> path-> connects; article one, subnet transposition circuit is made up of operating path set and Protection path set; operating path set is identical with the data structure of Protection path set, and path essential information comprises ID of trace route path, circuit identifier, work/protection, service path information.
8. the unified method of analyzing of communication network transmission class alarm as claimed in claim 7, it is characterized in that: in described alarm, record temporal information, locating information, alarm correlation analysis result that warning code, alarm occur, alarm correlation analysis result according to the structure of rule ID+root Alarm ID+derivative Alarm ID to upper layer transfers.
9. the unified method of analyzing of communication network transmission class alarm as claimed in claim 7, is characterized in that: the expression mode of described port is divided into 3 kinds: (1) 64 integer single-deck ID; (2) operation level at port place; (3) port-mark character string; The level at port place comprises transmission medium layer, higher order path layer, low order channel layer, the PDH (Pseudo-synchronous Digital Hierarchy) pdh physical interface layer of SDH serial equipment; The section layer of PTN serial equipment, channel layer, circuit layer, operation layer; Optical transport layer OTS, the optical multiplex layer OMS of WDM series, optical channel layers OCH, client layer; The OTS layer of OTN series, OMS layer, OCH layer, light path data cell ODUk layer, client layer, k=0,1,2,3,4.
10. the unified method of analyzing of communication network transmission class alarm as claimed in claim 9, it is characterized in that: the type of described port comprises physical terminal point PTP, floated terminal point FTP, connection end points CTP, and port-mark character string identifies according to the set membership of the type of port, port; The string table of port-mark is shown: port type 1=port numbers 1[/ port type 2=port numbers 2] [/ port type 3=port numbers 3] ... [/ port type n=port numbers n], n is natural number.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410099972.0A CN103929326B (en) | 2014-03-18 | 2014-03-18 | Communication network transmission class alerts the device and method of united analysis |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410099972.0A CN103929326B (en) | 2014-03-18 | 2014-03-18 | Communication network transmission class alerts the device and method of united analysis |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103929326A true CN103929326A (en) | 2014-07-16 |
| CN103929326B CN103929326B (en) | 2017-06-13 |
Family
ID=51147410
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410099972.0A Active CN103929326B (en) | 2014-03-18 | 2014-03-18 | Communication network transmission class alerts the device and method of united analysis |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103929326B (en) |
Cited By (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104408890A (en) * | 2014-11-05 | 2015-03-11 | 国家电网公司 | Alarm handling method and device of electric power system |
| CN104683148A (en) * | 2015-02-06 | 2015-06-03 | 烽火通信科技股份有限公司 | Uniform port model and method for accessing logical port thereof |
| WO2016095603A1 (en) * | 2014-12-15 | 2016-06-23 | 中兴通讯股份有限公司 | Adaptation sub-system and network management data reporting method thereof |
| CN106130929A (en) * | 2016-06-17 | 2016-11-16 | 众安在线财产保险股份有限公司 | The service message automatic processing method of the Internet based on graph-theoretical algorithm insurance field and system |
| CN106257845A (en) * | 2015-06-16 | 2016-12-28 | 中兴通讯股份有限公司 | Verifying method, Apparatus and system |
| CN106533879A (en) * | 2015-09-10 | 2017-03-22 | 中兴通讯股份有限公司 | Data communication network (DCN) irregular domain intercommunicating method and device in packet transport network (PTN) equipment |
| CN108234189A (en) * | 2016-12-22 | 2018-06-29 | 北京神州泰岳软件股份有限公司 | A kind of alarm data treating method and apparatus |
| CN110457371A (en) * | 2019-08-13 | 2019-11-15 | 杭州有赞科技有限公司 | Data managing method, device, storage medium and system |
| WO2020215505A1 (en) * | 2019-04-23 | 2020-10-29 | 烽火通信科技股份有限公司 | Multi-dimensional correlation generation method and system for network alarm rules |
| CN112671560A (en) * | 2020-12-11 | 2021-04-16 | 广东电力通信科技有限公司 | High-availability distributed real-time alarm processing method and system |
| CN112802313A (en) * | 2020-12-31 | 2021-05-14 | 新奥数能科技有限公司 | Alarm method and device of equipment |
| CN114500229A (en) * | 2021-12-30 | 2022-05-13 | 国网河北省电力有限公司信息通信分公司 | Network alarm positioning and analyzing method based on space-time information |
| CN114884798A (en) * | 2022-05-05 | 2022-08-09 | 中国联合网络通信集团有限公司 | Cross-professional fault analysis method, device and system |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101183989A (en) * | 2007-12-03 | 2008-05-21 | 中兴通讯股份有限公司 | Incremental analysis method of optical synchronization transmission network alarm correlation |
| CN101217408A (en) * | 2008-01-17 | 2008-07-09 | 中兴通讯股份有限公司 | A processing system on all-round failure pertinence treatment system and the corresponding processing method |
| CN101675648A (en) * | 2007-03-08 | 2010-03-17 | Lm爱立信电话有限公司 | Structure relevant and method with performance monitoring |
| CN102035678A (en) * | 2010-12-16 | 2011-04-27 | 中国电子科技集团公司第三十研究所 | Multidimensional comprehensive situation display system based on degree of association |
| EP2362579A1 (en) * | 2010-02-18 | 2011-08-31 | Hand Held Products, Inc. | Remote device management system and method |
-
2014
- 2014-03-18 CN CN201410099972.0A patent/CN103929326B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101675648A (en) * | 2007-03-08 | 2010-03-17 | Lm爱立信电话有限公司 | Structure relevant and method with performance monitoring |
| CN101183989A (en) * | 2007-12-03 | 2008-05-21 | 中兴通讯股份有限公司 | Incremental analysis method of optical synchronization transmission network alarm correlation |
| CN101217408A (en) * | 2008-01-17 | 2008-07-09 | 中兴通讯股份有限公司 | A processing system on all-round failure pertinence treatment system and the corresponding processing method |
| EP2362579A1 (en) * | 2010-02-18 | 2011-08-31 | Hand Held Products, Inc. | Remote device management system and method |
| CN102035678A (en) * | 2010-12-16 | 2011-04-27 | 中国电子科技集团公司第三十研究所 | Multidimensional comprehensive situation display system based on degree of association |
Non-Patent Citations (1)
| Title |
|---|
| 肖念: "通信网络告警相关性的研究", 《计算机光盘软件与应用》 * |
Cited By (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104408890A (en) * | 2014-11-05 | 2015-03-11 | 国家电网公司 | Alarm handling method and device of electric power system |
| WO2016095603A1 (en) * | 2014-12-15 | 2016-06-23 | 中兴通讯股份有限公司 | Adaptation sub-system and network management data reporting method thereof |
| CN104683148B (en) * | 2015-02-06 | 2018-04-20 | 烽火通信科技股份有限公司 | A kind of unified port system and its method for accessing logic port |
| CN104683148A (en) * | 2015-02-06 | 2015-06-03 | 烽火通信科技股份有限公司 | Uniform port model and method for accessing logical port thereof |
| CN106257845A (en) * | 2015-06-16 | 2016-12-28 | 中兴通讯股份有限公司 | Verifying method, Apparatus and system |
| CN106533879B (en) * | 2015-09-10 | 2020-04-28 | 中兴通讯股份有限公司 | Method and device for DCN irregular domain intercommunication in PTN equipment |
| CN106533879A (en) * | 2015-09-10 | 2017-03-22 | 中兴通讯股份有限公司 | Data communication network (DCN) irregular domain intercommunicating method and device in packet transport network (PTN) equipment |
| CN106130929B (en) * | 2016-06-17 | 2019-07-09 | 众安在线财产保险股份有限公司 | The service message automatic processing method and system of internet insurance field based on graph-theoretical algorithm |
| CN106130929A (en) * | 2016-06-17 | 2016-11-16 | 众安在线财产保险股份有限公司 | The service message automatic processing method of the Internet based on graph-theoretical algorithm insurance field and system |
| CN108234189B (en) * | 2016-12-22 | 2021-10-08 | 北京神州泰岳软件股份有限公司 | Alarm data processing method and device |
| CN108234189A (en) * | 2016-12-22 | 2018-06-29 | 北京神州泰岳软件股份有限公司 | A kind of alarm data treating method and apparatus |
| WO2020215505A1 (en) * | 2019-04-23 | 2020-10-29 | 烽火通信科技股份有限公司 | Multi-dimensional correlation generation method and system for network alarm rules |
| CN110457371A (en) * | 2019-08-13 | 2019-11-15 | 杭州有赞科技有限公司 | Data managing method, device, storage medium and system |
| CN112671560A (en) * | 2020-12-11 | 2021-04-16 | 广东电力通信科技有限公司 | High-availability distributed real-time alarm processing method and system |
| CN112671560B (en) * | 2020-12-11 | 2023-08-01 | 广东电力通信科技有限公司 | High-availability distributed real-time alarm processing method and system |
| CN112802313A (en) * | 2020-12-31 | 2021-05-14 | 新奥数能科技有限公司 | Alarm method and device of equipment |
| CN114500229A (en) * | 2021-12-30 | 2022-05-13 | 国网河北省电力有限公司信息通信分公司 | Network alarm positioning and analyzing method based on space-time information |
| CN114500229B (en) * | 2021-12-30 | 2024-02-02 | 国网河北省电力有限公司信息通信分公司 | Network alarm positioning and analyzing method based on space-time information |
| CN114884798A (en) * | 2022-05-05 | 2022-08-09 | 中国联合网络通信集团有限公司 | Cross-professional fault analysis method, device and system |
| CN114884798B (en) * | 2022-05-05 | 2023-06-09 | 中国联合网络通信集团有限公司 | Cross-specialty fault analysis method, device and system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103929326B (en) | 2017-06-13 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN103929326A (en) | Communication network transmission type alarm uniform analysis device and method | |
| EP3554051A1 (en) | Data processing method and device | |
| CN1855784B (en) | Line-timing in packet-based networks | |
| US9680585B2 (en) | Clock data recovery method and device for branch signal in SDH | |
| US9503356B2 (en) | Method and device for determining topology of network | |
| CN102387082B (en) | Flow-classification-based grouping flow control system and control method | |
| CN101409596B (en) | Method for planning dynamic business wavelength route optical network | |
| CN101039209A (en) | Method for analyzing root warning for multi-manufacturer DWDM network management system | |
| CN105099595B (en) | A kind of method for mapping business and device of optical transfer network OTN equipment | |
| EP3282605A1 (en) | Configuration method and apparatus for synchronization network | |
| CN105930609B (en) | A kind of FPGA timing optimization method for coherent demodulation | |
| CN103997426A (en) | Method for detecting error sequence of subframe in inverse multiplexing and nodes | |
| CN101656622A (en) | Alarm management system and alarm management method | |
| CN104007962B (en) | The implementation method of OMCI entities based on Object-oriented Technique | |
| CN100384147C (en) | Alarm reporting method | |
| CN104125146A (en) | Service processing method and service processing method | |
| CN107491366A (en) | Export clock generation method and device | |
| CN103716183A (en) | Management method and management device of optical transport network | |
| CN103888189B (en) | It is applicable to the single fiber looped network means of communication of extensive power electronic system | |
| Korman et al. | Labeling schemes for weighted dynamic trees | |
| CN103248509A (en) | ODU (optical data unit) management method and device | |
| US8352537B2 (en) | Object modeling scheme for next generation network wavelength division multiplexing | |
| CN1667985B (en) | SDH/SONET non-loading plug-in method and apparatus | |
| CN108337174B (en) | Method and device for searching end-to-end service route of transmission network and storage medium | |
| CN101977186B (en) | Device for realizing synchronous transport module level-1 (STM-1) multipath Ethernet over E1 conversion |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |