CN104125087B - A kind of alarm information processing method and device - Google Patents
A kind of alarm information processing method and device Download PDFInfo
- Publication number
- CN104125087B CN104125087B CN201310154388.6A CN201310154388A CN104125087B CN 104125087 B CN104125087 B CN 104125087B CN 201310154388 A CN201310154388 A CN 201310154388A CN 104125087 B CN104125087 B CN 104125087B
- Authority
- CN
- China
- Prior art keywords
- alarm information
- information
- general
- alarm
- general alarm
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
- Alarm Systems (AREA)
Abstract
The invention discloses a kind of alarm information processing method and device, the program can effectively improve the treatment effeciency of warning information without manually participating in.Method is specifically included：Obtain by least one first general alarm information and the general alarm information aggregate of at least one the second general alarm information structure, wherein, the alarm identifier of any first general alarm information and any second general alarm information is satisfied by：Matched unanimously with any alarm identifier included in the multi-disciplinary correlation rule pre-set；The multi-disciplinary correlation rule, which is included, needs to participate in the alarm identifier of the general alarm information in the different majors of incidence relation analysis；Judge whether the first general alarm information meets the condition that alarm association relation is set up with the second general alarm information；When judged result is to be, the results messages that there is incidence relation between the first general alarm information and the second general alarm information for characterizing are exported.
Description
Technical field
The present invention relates to field of network management, more particularly to a kind of alarm information processing method and device.
Background technology
With the continuous extension of communication network scale, multi-standard, many producers, multi-service, the fusion of multi-specialized network cause
Mobile communications network is increasingly sophisticated, while business service support and user also propose higher demand to communication network quality,
This just brings great challenge to the Centralized Monitoring work of communication network.Current communication network management system is to traffic, biography
The monitoring of multiple professional a large amount of warning information such as defeated, data, analyze and position not comprehensive enough, be mainly reflected in each professional webmaster
The monitoring data of system isolates, it is impossible to realize a series of multi-disciplinary network alarms to being triggered by some specialized network failure cause
It is associated analysis.In the prior art, when related alarm occurs in each professional network management system, it usually needs each professional webmaster dimension
Shield personnel combine O＆M experience, and Various types of data is extracted from multiple operational systems or instrument respectively and is analyzed and is judged, this
Dividing the present situation of special maintenance warning information causes the treatment effeciency to alarm low.
The content of the invention
The embodiment of the present invention provides a kind of alarm information processing method and device, to solve the presence of alarm in the prior art
The problem of information processing efficiency is low.
The embodiment of the present invention uses following technical scheme：
A kind of alarm information processing method, including：Obtain by least one first general alarm information and at least one the
The general alarm information aggregate that two general warning information are constituted；Wherein, any first general alarm information and any second general
The alarm identifier of warning information is satisfied by：One is matched with any alarm identifier included in the multi-disciplinary correlation rule pre-set
Cause；The multi-disciplinary correlation rule, which is included, needs to participate in the alarm of the general alarm information in the different majors of incidence relation analysis
Mark；Judge whether the first general alarm information meets the condition that alarm association relation is set up with the second general alarm information；
There is incidence relation for characterizing between the first general alarm information and the second general alarm information when being, to export in judged result
Results messages.
A kind of warning information processing unit, including：General alarm information acquisition unit, for obtain by least one first
The general alarm information aggregate of general alarm information and at least one the second general alarm information structure；Wherein, any first leads to
It is satisfied by with the alarm identifier of warning information and any second general alarm information：With in the multi-disciplinary correlation rule that pre-sets
Comprising the matching of any alarm identifier it is consistent；The multi-disciplinary correlation rule, which is included, needs the difference for participating in incidence relation analysis specially
The alarm identifier of general alarm information in industry；Matching judgment unit is alerted, for judging the general alarm acquisition of information list
Whether the first general alarm information in the general alarm information aggregate that member is obtained, which meets to set up with the second general alarm information, is accused
The condition of alert incidence relation；Results messages output unit, is yes for obtaining judged result in the alarm matching judgment unit
When, export the results messages that there is incidence relation between the first general alarm information and the second general alarm information for characterizing.
The embodiment of the present invention has the beneficial effect that：
Such scheme provided in an embodiment of the present invention can effectively improve alarm information of the entire network without manually participating in
Treatment effeciency, reduction distributes work order quantity and quick discovery alarm main contributor.
Brief description of the drawings
Fig. 1 implements flow chart for a kind of alarm information processing method provided in an embodiment of the present invention；
Fig. 2 is the warning information processing system for being used to realize method provided in an embodiment of the present invention in actual communication network
The concrete structure schematic diagram of system；
Fig. 3 is the particular flow sheet for implementing method provided in an embodiment of the present invention based on warning information processing system；
Fig. 4 is a kind of concrete structure schematic diagram of warning information processing unit provided in an embodiment of the present invention.
Embodiment
Inventor has found that current monitoring system is multiple to voice network, transmission network etc. specially by the research to prior art
The monitoring of a large amount of warning information of industry, analyze and position not comprehensive enough, the monitoring data of each professional network management system isolates, it is impossible to real
Analysis now is associated to a series of multi-disciplinary network alarms that some specialized network failure cause triggers, and is merged into one group of announcement
Alert concentrate presents and associates distribute leaflets.Therefore, according to prior art, when there is related alarm in each professional network management system, in addition it is also necessary to
Each professional attendant combines O＆M experience, and Various types of data is extracted from multiple operational systems or instrument respectively carries out total score
Analysis and judgement.It can be seen that, prior art use warning information processing scheme exist it is larger to the dependence of personnel, lack towards
The whole network, service-oriented and the monitoring of customer-oriented integrated information and data relation analysis, so that substantial amounts of O＆M manpower is needed, and
And the defect of O＆M efficiency reduction.
At present, the drawbacks described above existed for warning information processing scheme, there is following several solutions：
1st, for the single professional warning information processing scheme based on alarm association rule.
Such as different warning information are determined by excavating the relation between the different warning information in single specialty merely
Between alarm association rule；Or based on network topology storehouse, to the correlation between different warning information in single specialty
Property analyzed, and set up alarm association rule；Or it is single to analyze based on the resource model set up for single specialty
Correlation in specialty between different warning information, and set up alarm correlation rule；
2nd, for the processing scheme of the professional warning information in part.With part specialty for voice network, transmission network and rotating ring net
Exemplified by, the relevance for the base station name that the implementation principle of the program is included for the warning information in different majors, respectively
From the warning information produced by these three specialties, some filtered out with specifying possess the base station phase of incidence relation each other
The warning information of pass, afterwards further according to the causality between each warning information filtered out and warning information generation time
Sequencing, correlation analysis is carried out to each warning information filtered out.
Such scheme 1 has a drawback in that the processing for warning information is only limitted to a specialty；Such scheme 2 is deposited
Defect be, it is necessary first to the relevant database based on base station name is filtered to warning information, this method by
Database is formed on, therefore, it is difficult to adapt to information（Such as base station name information）Change so that flexibility and scalability all compared with
Difference.
Although above method can preferably solve the problem of simple network is monitored from different perspectives, do not integrate
The characteristics of in view of facing multi-standard, multi-specialized, many equipment and multi-service qos requirement in real network operation, not yet from the whole network
The incidence relation that angle is set up warning information monitoring view and alerted to the whole network is analyzed, and is realized and is run feelings to each specialized network
The comprehensive monitoring of condition.
And the embodiment of the present invention is in view of the shortcomings of the prior art, it is proposed that a kind of new alarm information processing method and dress
Put.The program is by judging the condition for setting up alarm association relation whether is met between different warning information, to determine different announcements
It whether there is incidence relation between alert information.The program can effectively improve alarm information of the entire network without manually participating in
Treatment effeciency, reduction distributes work order quantity and quick discovery alarm main contributor.Also, the program is not only restricted to database, from
And flexibility and scalability are all higher.
Embodiments of the invention are illustrated below in conjunction with Figure of description, it will be appreciated that described herein to implement
Example is merely to illustrate and explain the present invention, and is not intended to limit the invention.And in the case where not conflicting, the reality in this explanation
Applying the feature of example and embodiment can be combined with each other.
First, the embodiment of the present invention provides a kind of alarm information processing method, and this method implements flow chart such as Fig. 1
It is shown, mainly comprise the steps：
Step 11：Obtain by least one first general alarm information and at least one the second general alarm information structure
General alarm information aggregate；
Wherein, the alarm identifier of any first general alarm information and any second general alarm information is satisfied by：With it is pre-
Any alarm identifier matching included in the multi-disciplinary correlation rule first set is consistent.
In the embodiment of the present invention, the multi-disciplinary correlation rule includes the multiple different majors for needing to participate in incidence relation analysis
In general alarm information alarm identifier.Wherein, alarm identifier mentioned here can be the alarm mark of general alarm information
Keyword in topic or alarm title, can also be the alarm id of general alarm information, it might even be possible to be general alarm
Mark of alarm equipment corresponding to information etc..
It should be noted that the alarm identifier included in the multi-disciplinary correlation rule is not limited in leading in a certain specialty
With the alarm identifier of warning information, but the alarm identifier of the general alarm information in multiple specialties can be included.So can be with
Program compatibility provided in an embodiment of the present invention is realized to the processing across multiple professional warning information.Wherein, across
Multiple professional warning information general satisfactions：Generate the alarm equipment of the warning information and using the warning information as trigger condition
And generate in the alarm equipment of other warning information, at least two alarm equipments are located in different majors respectively.
In the embodiment of the present invention, the warning information directly obtained from each specialty is properly termed as original alarm information.Due to
The different alarm equipment manufacturers for producing original alarm information are different, therefore the original alarm information produced by different alarm equipments exists
It is often different in terms of information format.The different original alarm information of form is difficult to be uniformly processed, and therefore, it can according to setting in advance
The information transformation rule put, original alarm information is converted to the warning information for meeting specify information form.For the ease of description,
The warning information that the specify information form is will be provided with the embodiment of the present invention is referred to as " general alarm information ".
In the embodiment of the present invention, above-mentioned first general alarm information and the second general alarm information referred to hereinafter
To be obtained from performing above-mentioned conversion respectively to corresponding first original alarm information and the second original alarm information.
Step 12：Judge whether the first general alarm information meets and set up alarm association relation with the second general alarm information
Condition；In judged result for when being, otherwise execution step 13 can then terminate flow.
In the embodiment of the present invention, setting up in the condition of alarm association relation can be comprising the condition for setting up primary and secondary association.With
Exemplified by two warning information A, B, if the incidence relation between this two warning information is called main secondary association, its implication can be
Warning information A and warning information B occur simultaneously in the range of certain time, and warning information B producing cause is by alarm letter
Cease caused by A, i.e., the logical relation between them is set membership or other relations, then warning information A is main warning information, and
Warning information B is then time warning information.The definition of primary and secondary association and specific example may be referred to table 1 below.Specifically, first leads to
The condition that primary and secondary is associated of setting up is met with warning information and the second general alarm information, can refer to the first general alarm information and
Second general alarm information meets following 3 aspects simultaneously：
1st, the professional resources data corresponding to the first general alarm information and the specialty corresponding to the second general alarm information
Resource data is associated.Wherein, professional resources data mentioned here can produce the resource topologies such as the equipment of warning information
The information of relation, the resource location information that resource associations relation can be included from general alarm message text is directly obtained or passed through
Professional network management system or comprehensive resources system are inquired about and obtained indirectly.Such as, can be according in wireless professional warning information text
The resource data further inquired about in professional network management system of base station number, obtain corresponding base station rotating ring computer room title, if with
Base station rotating ring computer room title in rotating ring specialty alarm text is identical, then illustrates that first, second warning information distinguishes corresponding
Professional resources data are associated.
2nd, the alarm identifier of the first general alarm information and the alarm identifier of the second general alarm information correspond respectively to across
The alarm identifier of main alarm and time alarm identifier of alarm in professional correlation rule, or correspond respectively to time alarm identifier of alarm
With the alarm identifier of main alarm；
3rd, between the time occurred between the moment for occurring moment and the second general alarm information of the first general alarm information
Every of length no more than first stipulated time length.
In the embodiment of the present invention, setting up in the condition of alarm association relation can be comprising the condition for setting up derivative association.With T
Exemplified by bar warning information A1, A2 ... AN ... AT, if in the range of certain region or equipment, when warning information AN is reached, forward
Search time window, if reaching quantity or ratio or the frequency, produces a new warning information B, then its implication can be announcement
Alert information A1, A2 ... AN triggerings generate warning information B；Set up after incidence relation, backward the alarm AN+1 ... AT in time window
Continue to be articulated under derivative alarm B, and the incidence relation between T bars warning information and warning information B is called that derivative is associated；And surpass
The alarm AT+1 for having gone out time window then will not continue to association.The definition of derivative association and specific example may be referred to table 1 below.Tool
Body, the first general alarm information (A1) meets to set up with the second general alarm information (A1, A2 ... AN ... AT) derives what is associated
Condition, can refer to the first general alarm information and the second general alarm information while meeting following several aspects：
1st, the feature of all general alarm information in general alarm information aggregate is identical with regulation feature；
Wherein, this feature described here can be the alarm identifier of all general alarm information, and the institute
There is the total quantity of general alarm information；Or
This feature is the alarm identifier of all general alarm information, and the spy in all general alarm information
Determine the quantity of general alarm information and the ratio of the total quantity；Or
This feature be all general alarm information alarm identifier, and all general alarm information generation
Frequency value.
2nd, the professional resources data corresponding to the first general alarm information and the specialty corresponding to the second general alarm information
Resource data is associated.Wherein, professional resources data mentioned here can produce the resource topologies such as the equipment of warning information
The information of relation, the resource location information that resource associations relation can be included from general alarm message text is directly obtained or passed through
Professional network management system or comprehensive resources system are inquired about and obtained indirectly；
3rd, the first general alarm information occur moment and the second general alarm information occur between the moment when
Between gap length be no more than the first stipulated time length.
Table 1：
Step 13：Export and there is incidence relation for characterizing between the first general alarm information and the second general alarm information
Results messages.
In the embodiment of the present invention, when judged by step 12 first general alarm information meet with the second general alarm
When information sets up the condition of derivative incidence relation, following step can also be further performed：
In the information that the information content, the second general alarm information included according to the first general alarm information is included
Hold, and generation derives the data format requirement of warning information, the derivative warning information of generation.
Whether method provided in an embodiment of the present invention is set up alarm association and is closed by judging to meet between different warning information
The condition of system, to determine to whether there is incidence relation between different warning information.The program can have without manually participating in
Effect improves the treatment effeciency of warning information.
Below by taking a above method provided in an embodiment of the present invention concrete application in practice as an example, describing in detail should
The implementation process of method and its technique effect that can be reached.
In actual communication network, the concrete structure schematic diagram of warning information processing system is as shown in Figure 2.In Fig. 2, accuse
Alert information processing system can logically be divided into warning information modular converter, rule match filtering module, incidence relation
Analysis module and association results adaptation module.
Based on the system as shown in Figure 2, from that will gather from the warning information of different majors is input to the system, extremely should
System is exported mainly includes such as Fig. 3 for characterizing the whole handling process for the results messages that there is incidence relation between warning information
Shown following step：
Step 31：The gathered data from existing network, including collection original alarm information etc., and the original alarm collected is believed
Breath input warning information processing system.
Step 32：Warning information processing system, which is obtained, to be inputted after the original alarm information of itself, warning information processing system
In warning information modular converter conversion process is carried out to the original alarm information that collects.
Specifically, warning information modular converter carries out conversion process to the original alarm information collected mainly includes：Will
Original alarm information is converted into general alarm information.Wherein, due to the form and generation original alarm information of original alarm information
Equipment original setting it is relevant, and original set is often that equipment vendor defines, therefore original alarm information is alternatively referred to as
Equipment vendor's warning information.It is, in general, that the form of equipment vendor's warning information is prespecified by corresponding equipment vendor.Although no
It is often different with the form of equipment vendor's warning information of equipment vendor's defined, but possess equipment vendor's warning information of different-format
It often can all include the field represented by field name as shown in table 2.
Table 2：
By being carried out respectively to the different equipment manufacturer warning information comprising the field represented by field name as shown in table 2
Conversion, can obtain the general alarm information for possessing specified format.Specifically, " equipment vendor's warning information mould can be pre-established
Type ", and based on the model, by different equipment vendor's warning information relationship maps into general alarm information, so as to effectively shield
Different equipment manufacturer warning information is in alarm information formats, warning information rank, warning information classification each side difference that may be present
It is different, so as to reduce the complexity of maintenance work.
In the present embodiment, general alarm information model can be represented by table 3 below.
Table 3：
Step 33：Rule match filtering module is directed to every general alarm information that warning information modular converter is converted to
Operations described below is performed respectively：
Based on included in the general alarm information " network management alarm ID " and/or " alarm title " etc. can uniquely represent one
Content in the field of bar general alarm information, according to the correlation rule being pre-configured with the rule base pre-set, judging should
Whether general alarm information participates in incidence relation analysis, if it is judged that being yes, then this general alarm information is delayed
Deposit, and results messages are sent to incidence relation analysis module, to trigger general announcement of the incidence relation analysis module implementation to caching
The analysis of alert information.
Various information as shown in table 4 below can be configured in the present embodiment, in the rule base pre-set.
Table 4：
The information of some the specific correlation rules included in rule base can be as shown in table 5.By taking the secondary series of table 5 as an example
It can be seen that：1st, entitled " alarm of [primary and secondary association] rotating ring causes base station service quit " of the correlation rule；2nd, association rule are met
Corresponding warning information then indicates rotating ring net, and with wireless network there is incidence relation in the two specialties；3rd, the correlation rule is met
Corresponding warning information is often to be produced by " rotating ring alarm causes base station service quit alarm generation "；4th, the correlation rule is met
Interrelational form between corresponding warning information is " primary and secondary "；5th, include in the title for the main warning information for meeting the correlation rule
Content as " NodeB moves back clothes/base station service quit "；6th, include in the title for the secondary warning information for meeting the correlation rule and " store
Assembled battery total voltage is low, principal, civil power whether there is（Have a power failure）" as content.
Table 5：
Some conventional correlation rules are illustrated further below：
1st, the correlation rule that signaling link is interrupted is caused by trunk failure.Meet the title of the warning information of the correlation rule
In typically occur " MTP link failures ", " WEPI E1 remote alarms ", " WEPI E1 Frame Alignment Loss ", " WEPI E1 receive
Sliding frame alarm ", " WEPI E1 send sliding frame alarm " or " WEPIE1 dropouts ".Main warning information may be prescribed as in title
Include the warning information of " MTP link failures ".
2nd, the inaccessible correlation rule of MTP destination signaling points is caused because MTP routes are unavailable.Meet the correlation rule
" MTP destination signaling points are unreachable ", " MTP link failures ", " MTP routes are unavailable " typically occur in the text of warning information
Or " SCCP destination signaling points are forbidden ".Main warning information may be prescribed as in text including " MTP destination signaling points are unreachable "
Warning information.
Step 34：Incidence relation analysis module after the above results message that rule match filtering module is sent is received,
The analysis to the general alarm information of caching is performed, and affiliated partner is generated according to analysis result and is sent to association results adaptation mould
Block.
Specifically, analysis of the incidence relation analysis module to the general alarm information of caching can include the description below：
Incidence relation analysis module since being received the above results message timing, and according to coordinate interrelation information（Than
Obtained if desired for directly obtaining or being inquired about indirectly by professional network management system/comprehensive resources system from general alarm message text
Resource information）, judge since in a period of time timing, whether occurred in that in the general alarm information of caching meet it is as follows
The warning information of " condition of triggering association " shown in table 6.If the determination result is YES, then incidence relation analysis module according to slow
The warning information generation affiliated partner of " condition of triggering association " is met in the general alarm information deposited, and the affiliated partner is sent out
Give association results adaptation module.Wherein, can be only comprising the general of caching in difference according to the actual requirements, the affiliated partner
The relevant information of the warning information of " condition of triggering association " is met in warning information；Can also further it include slow for characterizing
The information of the specific interrelational form between the warning information of " condition of triggering association " is met in the general alarm information deposited, and
Information of " condition of triggering association " specifically met comprising those general alarm information etc..Resource associations relation can be from logical
Directly obtained or by between professional network management system or comprehensive resources system with the resource location information included in warning information text
Connect inquiry and obtain
In the present embodiment, it can be pre-set in incidence relation analysis module " association stand-by period window ".Should " association wait
Time window " refers to the length value of a period of time, i.e., the length value of previously described " a period of time since timing ".In addition, closing
Derivative alarm triggered threshold value can also be pre-set in connection relationship analysis module.
It should be noted that correlation rule in previously described rule base can only since timing to timing duration
It is effective in this period equal to " association stand-by period window ".Under such a scenario, rule match filtering module can also be with
The most short transmission cycle that " association stand-by period window " is results messages is somebody's turn to do, described results messages is being sent once and is waiting not short
In after the time span of " the association stand-by period window ", the transmission of next results messages is just carried out.And whenever incidence relation point
When analysis module receives the results messages of rule match filtering module transmission, reclocking is begun to.
Optionally, rule judgment submodule can also be set in the incidence relation analysis module described in the present embodiment, should
Submodule is used for when being equal to this section of " association stand-by period window " since timing incidence relation analysis module to timing duration
In, if judging to have the warning information for meeting " condition of triggering association " in the general alarm information cached, generate and close
Connection object concurrency gives association results adaptation module.
Table 6：
For the condition of association " triggering " in upper table 6 it should be noted that：In the present embodiment, based on collection of resources mode
It is different, it is possible to use the text for the general alarm information being converted to or the real-time dynamic generation of resource data that collects those touch
Send out the condition of association.
Step 35：Association results adaptation module " is touched after affiliated partner is received according to the satisfaction included in affiliated partner
Send out the condition of association " warning information relevant information, generate and there is incidence relation for characterizing between those warning information
Results messages are simultaneously exported.
Further, association results adaptation module can also be according to the derivative alarm triggered threshold value and derivative pre-set
The derivative alarm information of data format requirement generation of alarm is simultaneously exported.Such as, when the warning information included in affiliated partner is met
During the derivative alarm triggered threshold value, association results adaptation module just can according to the information contents of those warning information and on
State the data format of derivative alarm, the derivative warning information of generation.Such as, when the bar number of the warning information included in affiliated partner surpasses
When crossing 10 this derivative alarm triggered threshold value, the derivative warning information of generation.
The program can be seen that by sentencing by the above-mentioned application flow of method provided in an embodiment of the present invention in practice
The condition for setting up alarm association relation whether is met between disconnected different warning information, to determine whether deposited between different warning information
In incidence relation.The program can effectively improve the treatment effeciency of warning information without manually participating in.
For with above-mentioned alarm information processing method identical inventive concept provided in an embodiment of the present invention, the present invention implement
Example also provides a kind of warning information processing unit, to solve the asking lowly of warning information treatment effeciency present in prior art
Topic.The concrete structure schematic diagram of the device is as shown in figure 4, mainly include following function unit：
General alarm information acquisition unit 41, for obtain by least one the first general alarm information and at least one the
The general alarm information aggregate that two general warning information are constituted；Wherein, any first general alarm information and any second general
The alarm identifier of warning information is satisfied by：One is matched with any alarm identifier included in the multi-disciplinary correlation rule pre-set
Cause；The multi-disciplinary correlation rule, which is included, needs to participate in the alarm of the general alarm information in the different majors of incidence relation analysis
Mark；
Matching judgment unit 42 is alerted, for judging the general alarm information collection that general alarm information acquisition unit 41 is obtained
Whether the first general alarm information in conjunction meets the condition that alarm association relation is set up with the second general alarm information；
Results messages output unit 43, for when it is to be to alert matching judgment unit 42 to obtain judged result, output to be used
There are the results messages of incidence relation between the first general alarm information of sign and the second general alarm information.
Optionally, said apparatus provided in an embodiment of the present invention can also include：
Derivative alarm generation unit, is obtained for going out general alarm information acquisition unit 41 in alarm matching judgment unit judges
The first general alarm information in the general alarm information aggregate taken, which meets to set up with the second general alarm information, derives what is associated
During condition, the information content that the information content, the second general alarm information included according to the first general alarm information is included,
And the data format requirement of the derivative warning information of generation, the derivative warning information of generation.
Optionally, general alarm information acquisition unit 41 can specifically be divided into following functions subelement, including：
Warning information gathers subelement, for gathering the second original alarm information of the first original alarm information and collection；
Warning information conversion subunit, for according to the information transformation rule pre-set, warning information being gathered into son single
The first original alarm information that member is collected is converted to the first general alarm information, and warning information is gathered into what subelement was collected
Second original alarm information is converted to the second general alarm information.
Optionally, warning information collection subelement specifically can be used for：The first original alarm letter is gathered from the first specialty
Breath；And according at least the information gathering of one the second original alarm information of collection is advised from the second major different from the first specialty
Then, the second original alarm information is gathered.
The application of such scheme provided in an embodiment of the present invention in practice shows that the program has following technical advantages：
1st, the warning information collection towards the whole network, processing can be realized and presented.
2nd, the association analysis of alarm information of the entire network can be realized, redundant alarm information is effectively rejected（Believe with other alarms
Cease the warning information without incidence relation）, failure cause is quickly positioned, O＆M cost is reduced.
3rd, due to the association of different warning information can be realized, and the warning information of primary and secondary Correlation Criteria is set up for meeting
Only need generation for the work order of main warning information, the warning information only needs generation one of derivative Correlation Criteria is set up for meeting
Individual work order, so as to effectively reduce work order growing amount, suppresses time alarm distribute leaflets.
It should be understood by those skilled in the art that, embodiments of the invention can be provided as method, system or computer program
Product.Therefore, the present invention can be using the reality in terms of complete hardware embodiment, complete software embodiment or combination software and hardware
Apply the form of example.Moreover, the present invention can be used in one or more computers for wherein including computer usable program code
Usable storage medium（Including but not limited to magnetic disk storage, CD-ROM, optical memory etc.）The computer program production of upper implementation
The form of product.
The present invention is with reference to method according to embodiments of the present invention, equipment（System）And the flow of computer program product
Figure and/or block diagram are described.It should be understood that can be by every first-class in computer program instructions implementation process figure and/or block diagram
Journey and/or the flow in square frame and flow chart and/or block diagram and/or the combination of square frame.These computer programs can be provided
The processor of all-purpose computer, special-purpose computer, Embedded Processor or other programmable data processing devices is instructed to produce
A raw machine so that produced by the instruction of computer or the computing device of other programmable data processing devices for real
The device for the function of being specified in present one flow of flow chart or one square frame of multiple flows and/or block diagram or multiple square frames.
These computer program instructions, which may be alternatively stored in, can guide computer or other programmable data processing devices with spy
Determine in the computer-readable memory that mode works so that the instruction being stored in the computer-readable memory, which is produced, to be included referring to
Make the manufacture of device, the command device realize in one flow of flow chart or multiple flows and/or one square frame of block diagram or
The function of being specified in multiple square frames.
These computer program instructions can be also loaded into computer or other programmable data processing devices so that in meter
Series of operation steps is performed on calculation machine or other programmable devices to produce computer implemented processing, thus in computer or
The instruction performed on other programmable devices is provided for realizing in one flow of flow chart or multiple flows and/or block diagram one
The step of function of being specified in individual square frame or multiple square frames.
, but those skilled in the art once know basic creation although preferred embodiments of the present invention have been described
Property concept, then can make other change and modification to these embodiments.So, appended claims are intended to be construed to include excellent
Select embodiment and fall into having altered and changing for the scope of the invention.
Obviously, those skilled in the art can carry out the essence of various changes and modification without departing from the present invention to the present invention
God and scope.So, if these modifications and variations of the present invention belong to the scope of the claims in the present invention and its equivalent technologies
Within, then the present invention is also intended to comprising including these changes and modification.
Claims (8)
1. a kind of alarm information processing method, it is characterised in that including：
Obtain and believed by least one first general alarm information and the general alarm of at least one the second general alarm information structure
Breath set；Wherein, the alarm identifier of any first general alarm information and any second general alarm information is satisfied by：With it is advance
Any alarm identifier matching included in the multi-disciplinary correlation rule set is consistent；The multi-disciplinary correlation rule, which is included, needs ginseng
The alarm identifier of general alarm information in the different majors analyzed with incidence relation；
Judge whether the first general alarm information meets the condition that alarm association relation is set up with the second general alarm information；
Associated in judged result when being, to export for characterizing the first general alarm information with existing between the second general alarm information
The results messages of relation；
Wherein, the condition for setting up primary and secondary association is included in the condition for setting up alarm association relation, and sets up primary and secondary association
Condition includes：
The alarm identifier of the first general alarm information and the alarm identifier of the second general alarm information are corresponded respectively to
The alarm identifier of main alarm and time alarm identifier of alarm in the multi-disciplinary correlation rule, or correspond respectively to time announcement of alarm
Alert mark and the alarm identifier of main alarm；And
Professional resources data corresponding to the first general alarm information and the specialty money corresponding to the second general alarm information
Source data is associated；
The time interval occurred between the moment for occurring moment and the second general alarm information of first general alarm information
Of length no more than first stipulated time length；
The condition of the derivative association of foundation is also included in the condition for setting up alarm association relation, and sets up the derivative condition associated
Including：
The feature of all general alarm information in the general alarm information aggregate is identical with regulation feature；And
Professional resources data corresponding to first general alarm information and the specialty money corresponding to the second general alarm information
Source data is associated；And
The time interval occurred between the moment for occurring moment and the second general alarm information of first general alarm information
Of length no more than first stipulated time length；
Wherein, the alarm identifier for being characterized as all general alarm information, and all general alarm information
Total quantity；Or
The alarm identifier for being characterized as all general alarm information, and it is specific in all general alarm information
The ratio of the quantity of general alarm information and the total quantity；Or
The alarm identifier for being characterized as all general alarm information, and all general alarm information generation frequency
Sub-value.
2. the method as described in claim 1, it is characterised in that judging the first general alarm information satisfaction and described second
When general alarm information sets up the condition of derivative association, methods described also includes：
In the information that the information content, the second general alarm information included according to the first general alarm information is included
Hold, and generation derives the data format requirement of warning information, the derivative warning information of generation.
3. the method as described in claim 1, it is characterised in that obtain the first general alarm information and specifically include：
Gather the first original alarm information；
According to the information transformation rule pre-set, the first original alarm information collected is converted into the first general alarm letter
Breath；
The second general alarm information is obtained to specifically include：
Gather the second original alarm information；
According to the information transformation rule pre-set, the second original alarm information collected is converted into the second general alarm letter
Breath.
4. method as claimed in claim 3, it is characterised in that the first original alarm information of collection, is specifically included：
The first original alarm information is gathered from the first specialty；
The second original alarm information is gathered, is specifically included：
According at least the information gathering of one the second original alarm information of collection is advised from the second major different from the first specialty
Then, the second original alarm information is gathered.
5. a kind of warning information processing unit, it is characterised in that including：
General alarm information acquisition unit, for obtaining by least one the first general alarm information and at least one is second general
The general alarm information aggregate that warning information is constituted；Wherein, any first general alarm information and any second general alarm letter
The alarm identifier of breath is satisfied by：Matched unanimously with any alarm identifier included in the multi-disciplinary correlation rule pre-set；Institute
Stating multi-disciplinary correlation rule and including needs to participate in the alarm identifier of the general alarm information in the different majors of incidence relation analysis；
Matching judgment unit is alerted, for judging in the general alarm information aggregate that the general alarm information acquisition unit is obtained
The first general alarm information whether meet the condition that alarm association relation is set up with the second general alarm information；
Results messages output unit, for when the alarm matching judgment unit obtains judged result to be, exporting for table
Levy the results messages that there is incidence relation between the first general alarm information and the second general alarm information；
Wherein, the condition for setting up primary and secondary association is included in the condition for setting up alarm association relation, and sets up primary and secondary association
Condition includes：
The alarm identifier of the first general alarm information and the alarm identifier of the second general alarm information are corresponded respectively to
The alarm identifier of main alarm and time alarm identifier of alarm in the multi-disciplinary correlation rule, or correspond respectively to time announcement of alarm
Alert mark and the alarm identifier of main alarm；And
Professional resources data corresponding to the first general alarm information and the specialty money corresponding to the second general alarm information
Source data is associated；And
The time interval occurred between the moment for occurring moment and the second general alarm information of first general alarm information
Of length no more than first stipulated time length；
The condition of the derivative association of foundation is also included in the condition for setting up alarm association relation, and sets up the derivative condition associated
Including：
The feature of all general alarm information in the general alarm information aggregate is identical with regulation feature；And
Professional resources data corresponding to first general alarm information and the specialty money corresponding to the second general alarm information
Source data is associated；And
The time interval occurred between the moment for occurring moment and the second general alarm information of first general alarm information
Of length no more than first stipulated time length；
Wherein, the alarm identifier for being characterized as all general alarm information, and all general alarm information
Total quantity；Or
The alarm identifier for being characterized as all general alarm information, and it is specific in all general alarm information
The ratio of the quantity of general alarm information and the total quantity；Or
The alarm identifier for being characterized as all general alarm information, and all general alarm information generation frequency
Sub-value.
6. device as claimed in claim 5, it is characterised in that described device also includes：
Derivative alarm generation unit, is obtained for going out the general alarm information acquisition unit in alarm matching judgment unit judges
General alarm information aggregate in the first general alarm information meet and set up the bar that associates of derivative with the second general alarm information
During part, the information content, described that the first general alarm information obtained according to the general alarm information acquisition unit is included
The information content that second general alarm information is included, and generation derive the data format requirement of warning information, and generation derives
Warning information.
7. device as claimed in claim 5, it is characterised in that the general alarm information acquisition unit is specifically included：
Warning information gathers subelement, for gathering the second original alarm information of the first original alarm information and collection；
Warning information conversion subunit, for according to the information transformation rule pre-set, the warning information being gathered into son single
The first original alarm information that member is collected is converted to the first general alarm information, by warning information collection subelement collection
To the second original alarm information be converted to the second general alarm information.
8. device as claimed in claim 7, it is characterised in that warning information gather subelement specifically for：From the first specialty
The first original alarm information of middle collection；And according at least collection one is second original from the second major different from the first specialty
The information gathering rule of warning information, gathers the second original alarm information.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310154388.6A CN104125087B (en) | 2013-04-28 | 2013-04-28 | A kind of alarm information processing method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310154388.6A CN104125087B (en) | 2013-04-28 | 2013-04-28 | A kind of alarm information processing method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN104125087A CN104125087A (en) | 2014-10-29 |
| CN104125087B true CN104125087B (en) | 2017-10-24 |
Family
ID=51770359
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310154388.6A Active CN104125087B (en) | 2013-04-28 | 2013-04-28 | A kind of alarm information processing method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104125087B (en) |
Families Citing this family (16)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2016127482A1 (en) | 2015-02-12 | 2016-08-18 | 华为技术有限公司 | Alarm information processing method, relevant device and system |
| CN105049253B (en) * | 2015-07-28 | 2018-06-01 | 浪潮天元通信信息系统有限公司 | A kind of method for obtaining mobile network's fault location and fault pre-alarming |
| CN106446941B (en) * | 2016-09-14 | 2019-05-24 | 河海大学 | Unconventional emergency event dynamic priority method based on Model Matching |
| CN108021492B (en) * | 2016-11-04 | 2021-01-29 | 华为技术有限公司 | Alarm merging method and equipment |
| CN107332718B (en) * | 2017-08-16 | 2022-08-09 | 国网江苏省电力公司南京供电公司 | Real-time linkage fault positioning method for power communication and power distribution and utilization terminal |
| CN108256722B (en) * | 2017-11-16 | 2022-03-01 | 国网河北省电力有限公司信息通信分公司 | Electric power information communication dispatching order hand-held terminal |
| CN111327438B (en) * | 2018-12-14 | 2022-08-23 | 中国移动通信集团北京有限公司 | Alarm data processing method and device and readable medium |
| CN110147980A (en) * | 2019-04-03 | 2019-08-20 | 口碑(上海)信息技术有限公司 | Worksheet method and device |
| CN110289998A (en) * | 2019-06-19 | 2019-09-27 | 北京市天元网络技术股份有限公司 | A kind of disconnected alarm method and the device of standing in derivation base station |
| CN111814999B (en) * | 2020-07-08 | 2024-01-16 | 上海燕汐软件信息科技有限公司 | Fault work order generation method, device and equipment |
| CN112564949A (en) * | 2020-11-27 | 2021-03-26 | 中盈优创资讯科技有限公司 | Analysis method and device based on cross-professional alarm association rule |
| CN112583643A (en) * | 2020-12-14 | 2021-03-30 | 浪潮云信息技术股份公司 | Cross-device alarm correlation method |
| CN112735103A (en) * | 2020-12-16 | 2021-04-30 | 中盈优创资讯科技有限公司 | Alarm correlation identification method, device and equipment |
| CN113568991B (en) * | 2021-09-22 | 2022-02-08 | 北京必示科技有限公司 | Alarm processing method and system based on dynamic risk |
| CN114710532B (en) * | 2022-04-02 | 2023-10-03 | 中国科学院水生生物研究所 | Method and device for suppressing security electricity utilization alarm of museum |
| CN116560937B (en) * | 2023-03-27 | 2024-02-27 | 中国华能集团有限公司北京招标分公司 | Alarm engine using method |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1984170A (en) * | 2005-12-15 | 2007-06-20 | 中国移动通信集团公司 | Method for processing network alerting information |
| CN101651576A (en) * | 2009-08-28 | 2010-02-17 | 曙光信息产业(北京)有限公司 | Alarm information processing method and system |
| CN101808015A (en) * | 2009-02-18 | 2010-08-18 | 普天信息技术研究院有限公司 | Analytical method and device for relevance of alarm information |
| CN102142983A (en) * | 2010-11-24 | 2011-08-03 | 华为技术有限公司 | Alarm correlation analysis method and device |
-
2013
- 2013-04-28 CN CN201310154388.6A patent/CN104125087B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1984170A (en) * | 2005-12-15 | 2007-06-20 | 中国移动通信集团公司 | Method for processing network alerting information |
| CN101808015A (en) * | 2009-02-18 | 2010-08-18 | 普天信息技术研究院有限公司 | Analytical method and device for relevance of alarm information |
| CN101651576A (en) * | 2009-08-28 | 2010-02-17 | 曙光信息产业(北京)有限公司 | Alarm information processing method and system |
| CN102142983A (en) * | 2010-11-24 | 2011-08-03 | 华为技术有限公司 | Alarm correlation analysis method and device |
Non-Patent Citations (1)
| Title |
|---|
| 通信网告警影响性分析机制的研究与应用;石永革等;《微计算机信息》;20081016;第3.1节第2段 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104125087A (en) | 2014-10-29 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104125087B (en) | A kind of alarm information processing method and device | |
| CN105790990B (en) | A kind of method and its system for supervising adapted telecommunication business | |
| CN103840975B (en) | The management method and device of a kind of fibre system | |
| CN104065496B (en) | The generation method and device of network topological diagram | |
| WO2021197353A1 (en) | Data distribution method and apparatus, and device and medium | |
| CN107273228A (en) | Method for message transmission based on star topology framework | |
| CN106506256A (en) | A kind of equipment monitoring system and method based on platform+plug-in | |
| CN114301818A (en) | Service flow detection method, device, system, terminal and storage medium | |
| CN109510777A (en) | Flow table method of combination, device and SDN controller | |
| CN102130796B (en) | Power communication network detecting method based on reverse N-1 analysis and system thereof | |
| CN104254095A (en) | Method and device for positioning transmission fault causing large-scale base station service failure | |
| CN102752158B (en) | Service traffics monitoring method and device | |
| CN107800559A (en) | A kind of software defined network SDN alert processing method and device | |
| CN102045186B (en) | Event analysis method and system | |
| CN107995026B (en) | Management and control method, management node, managed node and system based on middleware | |
| CN110854824B (en) | Method and device for monitoring availability of relay protection service of power communication network | |
| CN103414595B (en) | Power dispatch data network link monitoring system topological drawing generating method | |
| CN111756642A (en) | Network traffic scheduling system and method based on DPI and machine learning | |
| CN109687985B (en) | Automatic configuration method and system for process level network of transformer substation | |
| CN116302431A (en) | Big data system for crystal pulling production | |
| CN101431435A (en) | Connection-oriented service configuration and management method | |
| CN104244293A (en) | Network node alarming method and system | |
| CN104537090B (en) | User profile standardized data treating method and apparatus | |
| CN106612207A (en) | Method and device for managing and controlling RSTP (Rapid Spanning Tree Protocol) information of Ethernet equipment | |
| CN112488326A (en) | Intelligent operation and maintenance fault early warning method and device based on 5G core network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |