CN106713017B - Alarm information processing method and device - Google Patents
Alarm information processing method and device Download PDFInfo
- Publication number
- CN106713017B CN106713017B CN201611123054.2A CN201611123054A CN106713017B CN 106713017 B CN106713017 B CN 106713017B CN 201611123054 A CN201611123054 A CN 201611123054A CN 106713017 B CN106713017 B CN 106713017B
- Authority
- CN
- China
- Prior art keywords
- alarm information
- processed
- alarm
- association rule
- association
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 230000010365 information processing Effects 0.000 title description 5
- 238000003672 processing method Methods 0.000 title description 3
- 238000012545 processing Methods 0.000 claims abstract description 61
- 238000000034 method Methods 0.000 claims abstract description 41
- 238000001914 filtration Methods 0.000 claims abstract description 39
- 238000004891 communication Methods 0.000 claims abstract description 34
- 238000012549 training Methods 0.000 claims description 19
- 238000012800 visualization Methods 0.000 claims description 12
- 230000000007 visual effect Effects 0.000 claims description 7
- 230000003287 optical effect Effects 0.000 description 15
- 230000008569 process Effects 0.000 description 5
- 238000004458 analytical method Methods 0.000 description 4
- 230000005540 biological transmission Effects 0.000 description 4
- 238000010586 diagram Methods 0.000 description 4
- 230000000694 effects Effects 0.000 description 3
- 230000001960 triggered effect Effects 0.000 description 3
- 230000005856 abnormality Effects 0.000 description 2
- 238000003745 diagnosis Methods 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 238000012423 maintenance Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012360 testing method Methods 0.000 description 2
- 238000004590 computer program Methods 0.000 description 1
- 239000000284 extract Substances 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 230000014509 gene expression Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 238000005259 measurement Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0604—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a method and a device for processing alarm information. Wherein, the method comprises the following steps: receiving a plurality of pieces of alarm information sent by communication equipment; determining the attribute category of each piece of alarm information; extracting alarm information with the attribute category of a first type of alarm to obtain alarm information to be processed, wherein the first type of alarm is an alarm with an association relation between the alarm information; filtering the alarm information to be processed by adopting an association rule base; and displaying the processed alarm information on a target interface. The invention solves the technical problems that the speed and the efficiency of alarm discovery, positioning and processing are influenced by a large number of derived alarms generated by a plurality of network element alarms caused by the fault of one network element due to the fact that the alarm data generated by equipment faults often have an association relation or a time partial order relation.
Description
Technical Field
The invention relates to the field of information processing, in particular to a method and a device for processing alarm information.
Background
The alarm data generated by equipment failure often has correlation relationship due to large scale and complex structure of the power distribution communication network, or has partial sequence relationship in time, so that the failure of one network element can cause a plurality of network element alarms, a large amount of derived alarms are generated, and the speed and efficiency of alarm discovery, positioning and processing are seriously affected.
In view of the above problems, no effective solution has been proposed.
Disclosure of Invention
The embodiment of the invention provides a method and a device for processing alarm information, which at least solve the technical problems that due to the fact that association relation often exists between alarm data generated by equipment faults or partial sequence relation exists in time, a plurality of network element alarms are generated due to the fault of one network element, a large number of derived alarms are generated, and the speed and the efficiency of alarm discovery, positioning and processing are influenced.
According to an aspect of an embodiment of the present invention, a method for processing alarm information is provided, where the method includes: receiving a plurality of pieces of alarm information sent by communication equipment; determining the attribute category of each piece of alarm information; extracting alarm information with the attribute category of a first type of alarm to obtain alarm information to be processed, wherein the first type of alarm is an alarm with an association relation between the alarm information; filtering the alarm information to be processed by adopting an association rule base; and displaying the processed alarm information on a target interface.
Further, after receiving a plurality of pieces of alarm information sent by the communication device, before determining the attribute category of each piece of alarm information, the method further includes: filtering the plurality of alarm information according to a plurality of preset conditions respectively; determining the attribute category of each piece of alarm information comprises: and determining the attribute category of each piece of alarm information after filtering processing.
Further, before filtering the alarm information to be processed by using the association rule base, the method further includes: learning and training historical alarm information sent by communication equipment to obtain a plurality of association rules among the alarm information; storing a plurality of association rules into a preset database; and using the preset database as an association rule base.
Further, after filtering the alarm information to be processed by using the association rule base, the method further includes: performing learning training on the alarm information to be processed to obtain association rules among the alarm information to be processed; judging whether an association rule between alarm information to be processed exists in an association rule base; and if the association rule between the alarm information to be processed does not exist in the association rule base, storing the association rule between the alarm information to be processed into the association rule base.
Further, the displaying the processed alarm information on the target interface includes: generating a visual view corresponding to the processed alarm information; determining a location on the target interface at which to display the visualization view; and displaying the visualization view in position.
According to another aspect of the embodiments of the present invention, there is also provided an apparatus for processing alarm information, the apparatus including: the receiving unit is used for receiving a plurality of pieces of alarm information sent by the communication equipment; the first determining unit is used for determining the attribute category of each piece of alarm information; the extraction unit is used for extracting the alarm information with the attribute type of a first type of alarm to obtain the alarm information to be processed, wherein the first type of alarm is the alarm with the incidence relation among the alarm information; the first processing unit is used for filtering the alarm information to be processed by adopting the association rule base; and the display unit is used for displaying the processed alarm information on a target interface.
Further, the apparatus further comprises: the second processing unit is used for filtering a plurality of pieces of alarm information according to a plurality of preset conditions respectively after receiving the plurality of pieces of alarm information sent by the communication equipment and before determining the attribute type of each piece of alarm information; the first determining unit further determines the attribute category of each piece of alarm information after the filtering processing.
Further, the apparatus further comprises: the first training unit is used for learning and training historical alarm information sent by communication equipment before filtering the alarm information to be processed by adopting the association rule base to obtain a plurality of association rules among the alarm information; the first storage unit is used for storing the plurality of association rules into a preset database; and a second determination unit configured to use a preset database as the association rule base.
Further, the apparatus further comprises: the second training unit is used for performing learning training on the alarm information to be processed after filtering the alarm information to be processed by adopting the association rule base to obtain association rules among the alarm information to be processed; the judging unit is used for judging whether the association rule between the alarm information to be processed exists in the association rule base or not; and the second storage unit is used for storing the association rules among the alarm information to be processed into the association rule base under the condition that the association rules among the alarm information to be processed do not exist in the association rule base.
Further, the display unit includes: the generating module is used for generating a visual view corresponding to the processed alarm information; a determination module for determining a location on the target interface at which to display the visualization view; and a display module for displaying the visualization view in position.
In the embodiment of the invention, a plurality of pieces of alarm information sent by communication equipment are received; determining the attribute category of each piece of alarm information; extracting alarm information with the attribute category of a first type of alarm to obtain alarm information to be processed, wherein the first type of alarm is an alarm with an association relation between the alarm information; filtering the alarm information to be processed by adopting an association rule base; and displaying the processed alarm information on a target interface, thereby achieving the technical effects of filtering the alarm information with association and displaying the processed alarm information on the target interface, thereby realizing the rapid positioning of the alarm information and the subsequent processing efficiency, and further solving the technical problems that the alarm discovery, positioning and processing speed and efficiency are influenced because a plurality of network element alarms caused by the fault of one network element are generated due to the association between alarm data generated by equipment faults or the partial sequence relation exists in time, and a large amount of derivative alarms are generated.
Drawings
The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the invention and together with the description serve to explain the invention without limiting the invention. In the drawings:
fig. 1 is a flowchart of a method for processing alarm information according to an embodiment of the present application;
FIG. 2 is a schematic diagram of an experimental test performed according to the method for processing alarm information provided in the embodiment of the present application;
fig. 3 is a schematic diagram of an apparatus for processing alarm information according to an embodiment of the present application.
Detailed Description
In order to make the technical solutions of the present invention better understood, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
It should be noted that the terms "first," "second," and the like in the description and claims of the present invention and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are capable of operation in sequences other than those illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
For convenience of description, some terms or expressions referred to in the embodiments of the present application are explained below:
OLT: optical Line Terminal.
And ONU: optical Network Unit, Optical Network Unit.
According to the embodiment of the application, a method for processing alarm information is provided.
Fig. 1 is a flowchart of a method for processing alarm information according to an embodiment of the present application. As shown in fig. 1, the method comprises the steps of:
step S102, a plurality of pieces of alarm information sent by the communication equipment are received.
The communication device mentioned in the present application may be an optical line terminal, an optical network unit, and a switch, and receives a plurality of pieces of alarm information sent by the communication device. The alarm information mentioned in the present application is information sent when an abnormality occurs in the communication device during operation, and the alarm information may include a reason why the abnormality occurs in the communication device or a source from which the alarm information is sent.
As an optional embodiment, in order to improve efficiency of finding out effective alarm information from a plurality of pieces of alarm information, in the method for processing alarm information provided in the embodiment of the present application, after receiving the plurality of pieces of alarm information sent by the communication device, before determining an attribute category of each piece of alarm information, the method further includes: and respectively filtering the plurality of alarm information according to a plurality of preset conditions.
For example, the multiple pieces of alarm information include a strobe alarm, a repeat alarm, a false event alarm, and the like, the strobe alarm can be recovered within a very short time after being triggered, the alarm information of strobe counting is performed, and the repeat alarm can repeatedly generate an alarm event within an unrecovered time period, so that the same alarm appears for multiple times. It may be considered to identify the first triggered alarm and to merge the same alarms triggered during the time that the alarm was not recovered. False event alarms are not true alarm events and may be notification events, such as those resulting from cutover, normal service, etc., that may be discarded directly.
The method and the device have the advantages that the multiple pieces of alarm information are filtered according to multiple preset conditions, namely bottom layer filtering is carried out, and after filtering, stroboscopic alarm, repeated alarm, false event alarm and the like which are regarded as invalid alarm information are filtered, so that the efficiency of finding out valid alarm information from the multiple pieces of alarm information is improved. The filtered effective alarm information can be stored in a preset database.
And step S104, determining the attribute type of each piece of alarm information.
The attribute category of the alarm information mentioned in the present application includes a first type alarm and a second type alarm, the first type alarm is alarm information in which an association relationship exists between the alarm information and other alarm information, and the first type alarm is alarm information in which an association relationship exists between the alarm information and other alarm information. For example, when the communication device generates the alarm information a, it may also trigger generation of the alarm information B and the alarm information C, that is, it is considered that there is an association relationship between the alarm information a, the alarm information B, and the alarm information C.
In which the attribute class of each piece of alarm information issued by the communication device is determined. And if the plurality of alarm information are filtered according to the plurality of preset conditions, determining the attribute category of each alarm information after filtering.
Step S106, extracting the alarm information with the attribute type of the first type alarm to obtain the alarm information to be processed, wherein the first type alarm is the alarm with the incidence relation among the alarm information.
The alarm information with the attribute type of the first type alarm is extracted in the step to obtain the alarm information to be processed for processing the alarm information with the association relationship between the alarm information in the follow-up process.
And step S108, filtering the alarm information to be processed by adopting an association rule base.
The alarm information to be processed is filtered by adopting the association rule base, so that the speed and the efficiency of discovering, positioning and processing the effective alarm information are improved.
Optionally, in the method for processing alarm information provided in the embodiment of the present application, before filtering the alarm information to be processed by using the association rule base, the method further includes: learning and training historical alarm information sent by communication equipment to obtain a plurality of association rules among the alarm information; storing a plurality of association rules into a preset database; and using the preset database as an association rule base.
And learning and training the historical alarm information sent by the communication equipment, or summarizing and concluding the historical alarm information sent by the communication equipment by technical maintenance personnel to obtain a plurality of association rules among the alarm information. That is, the experience knowledge accumulated by the technical maintenance personnel combines the manual experience with the association rule automatically mined by the system to perfect the association rule base. The association rule base can be updated in a man-machine interaction mode, or the association rule base is automatically updated after the experience is stored in the experience base in advance, so that the association rule is directly obtained to filter the alarm information to be processed when the alarm information is processed in the following process. Therefore, the speed and the efficiency of discovering, positioning and processing the effective alarm information are improved.
Optionally, in the method for processing alarm information provided in the embodiment of the present application, after filtering the alarm information to be processed by using the association rule base, the method further includes: performing learning training on the alarm information to be processed to obtain association rules among the alarm information to be processed; judging whether an association rule between alarm information to be processed exists in an association rule base; and if the association rule between the alarm information to be processed does not exist in the association rule base, storing the association rule between the alarm information to be processed into the association rule base.
Through the scheme, the association rule between the alarm information to be processed does not exist in the association rule base, and is stored in the association rule base. Therefore, the association rule base is continuously updated and perfected. Therefore, the derivative alarm and the root alarm can be analyzed quickly and accurately in the follow-up process, and the alarm tree is generated and displayed in a layered mode. Therefore, the alarm quantity in the real-time alarm table is effectively compressed, and the rapid discovery, positioning and processing of the fault are realized.
And step S110, displaying the processed alarm information on a target interface.
The processed alarm information is displayed on the target interface, so that effective alarm information can be rapidly found, and the effective alarm information is positioned in a plurality of pieces of alarm information, thereby improving the speed and efficiency of processing and responding to the alarm information.
Optionally, in the method for processing alarm information provided in the embodiment of the present application, displaying the processed alarm information on a target interface includes: generating a visual view corresponding to the processed alarm information; determining a location on the target interface at which to display the visualization view; and displaying the visualization view in position.
And presenting in a view mode according to the attention and the service requirements of the user. Multi-view presentation may be implemented using the alerts pool technique, where each view has a filter, and the views only display a portion of the data that satisfies the filter, enabling each view to present only alerts of interest to a particular user. The processed alarm information is displayed on the target interface in a visual view mode, so that effective alarm information can be found more quickly, the effective alarm information can be positioned in a plurality of pieces of alarm information, and the speed and the efficiency of processing and responding the alarm information are improved.
According to the method for processing the alarm information, a plurality of pieces of alarm information sent by the communication equipment are received; determining the attribute category of each piece of alarm information; extracting alarm information with the attribute category of a first type of alarm to obtain alarm information to be processed, wherein the first type of alarm is an alarm with an association relation between the alarm information; filtering the alarm information to be processed by adopting an association rule base; and displaying the processed alarm information on a target interface, thereby achieving the technical effects of filtering the alarm information with association and displaying the processed alarm information on the target interface, thereby realizing the rapid positioning of the alarm information and the subsequent processing efficiency, and further solving the technical problems that the alarm discovery, positioning and processing speed and efficiency are influenced because a plurality of network element alarms caused by the fault of one network element are generated due to the association between alarm data generated by equipment faults or the partial sequence relation exists in time, and a large amount of derivative alarms are generated.
In order to verify the performance and efficiency of the above alarm information processing method, taking a line fault which has the greatest influence on the service quality of the power distribution communication network as an example, the influence of the line fault occurring in the underlying network on the service of the higher-level network is discussed. Assuming that an experimental Network is constructed by using an OLT (Optical Line Terminal) device and an ONU (Optical Network Unit) device, fig. 2 is a schematic diagram of performing an experimental test according to the method for processing alarm information provided in the embodiment of the present application, and a bearing relationship between the OLT and the ONU system is shown in fig. 2. The method comprises the following specific steps:
1) the physical transmission layer is composed of 4 optical cable segments { No. 1, No. 2, No. 3, No. 4}, and an optical network system is carried on the optical cable.
2) The OLT system consists of 4 nodes of a, b, c and d to form 3 optical transmission segments { a-b, b-c, c-d }.
3) 4 systems { R1, R2, R3, R4} are carried on the OLT system at the same time. Wherein R1 and R4 are carried on segments a-b and b-c, R2 is carried on segments b-c and c-d, and R3 is carried on segments c-d.
Variables M ═ { M1, M2, M3, M4}, N ═ N1, N2, N3}, E ═ E1, E2, E3, E4} are defined for the cable segment information, the OLT optical transmission segment information, and the ONU multiplexing segment information, respectively. All variables have a value range of normal, fault. When the variable is equal to fault, it indicates a line fault and cannot provide reliable transmission service for the upper layer.
Failure 1: and in a certain time period, R1 and R4 report alarms simultaneously, and the alarms indicate the line faults of R1 and R4 multiplexing sections. The result of the model analysis is that the root fault causing the alarm simultaneous occurrence of the R1 and the R4 is the line fault of the No. 1 or No. 2 optical cable section.
And (3) failure 2: and in a certain time period, R2 and R3 report alarms simultaneously, and the alarms indicate the line faults of R2 and R3 multiplexing sections. The model analysis result shows that the root fault causing the simultaneous alarm of the R2 and the R3 is the line fault of the No. 4 optical cable segment.
Failure 3: and in a certain time period, R1, R2 and R4 report alarms simultaneously, and the alarms indicate the line faults of R1, R2 and R4 multiplex sections. The model analysis result shows that the root fault causing the simultaneous alarm of R1, R2 and R4 is the line fault of the No. 3 optical cable segment.
After the fault prior probability is obtained according to historical fault data (rules of a predefined rule base), the fault diagnosis accuracy of the model obtained through multiple measurement results can reach more than 92%. On the other hand, according to the root alarm diagnosis model in the text, a set of programs is written by Oracle and JAVA, and the original alarm data taken from a certain power distribution communication network management system is analyzed and processed by the programs. Experimental operation proves that the model can efficiently realize alarm analysis and positioning.
It should be noted that the steps illustrated in the flowcharts of the figures may be performed in a computer system such as a set of computer-executable instructions and that, although a logical order is illustrated in the flowcharts, in some cases, the steps illustrated or described may be performed in an order different than presented herein.
The embodiment of the present application further provides a device for processing alarm information, and it should be noted that the device for processing alarm information according to the embodiment of the present application may be used to execute the method for processing alarm information according to the embodiment of the present application. The following describes an apparatus for processing alarm information provided in an embodiment of the present application.
Fig. 2 is a schematic diagram of an alarm information processing apparatus according to an embodiment of the present application. As shown in fig. 2, the apparatus includes: a receiving unit 10, a first determining unit 20, an extracting unit 30, a first processing unit 40 and a display unit 50.
Specifically, the receiving unit 10 is configured to receive a plurality of pieces of alarm information sent by the communication device.
The first determining unit 20 is configured to determine an attribute category of each piece of alarm information.
The extracting unit 30 is configured to extract alarm information with an attribute type of a first type alarm to obtain alarm information to be processed, where the first type alarm is an alarm with an association relationship between the alarm information.
The first processing unit 40 is configured to perform filtering processing on the alarm information to be processed by using the association rule base.
And the display unit 50 is used for displaying the processed alarm information on a target interface.
The processing device of the alarm information provided by the embodiment of the application receives a plurality of pieces of alarm information sent by communication equipment through the receiving unit 10; the first determination unit 20 determines the attribute category of each piece of alarm information; the extracting unit 30 extracts the alarm information of which the attribute type is a first type alarm to obtain the alarm information to be processed, wherein the first type alarm is an alarm with an association relation between the alarm information; the first processing unit 40 performs filtering processing on the alarm information to be processed by using an association rule base; and the display unit 50 displays the processed alarm information on a target interface, so that the technical effects of filtering the alarm information with the association relation and displaying the processed alarm information on the target interface are achieved, the alarm information is quickly positioned and the subsequent processing efficiency is realized, and the technical problems that due to the association relation existing among alarm data generated by equipment faults or the partial sequence relation existing in time, a plurality of network element alarms caused by the faults of one network element generate a large amount of derivative alarms, and the alarm discovery, positioning and processing speed and efficiency are influenced are solved.
Optionally, in the apparatus for processing alarm information provided in the embodiment of the present application, the apparatus further includes: the second processing unit is used for filtering a plurality of pieces of alarm information according to a plurality of preset conditions respectively after receiving the plurality of pieces of alarm information sent by the communication equipment and before determining the attribute type of each piece of alarm information; the first determining unit further determines the attribute category of each piece of alarm information after the filtering processing.
Optionally, in the apparatus for processing alarm information provided in the embodiment of the present application, the apparatus further includes: the first training unit is used for learning and training historical alarm information sent by communication equipment before filtering the alarm information to be processed by adopting the association rule base to obtain a plurality of association rules among the alarm information; the first storage unit is used for storing the plurality of association rules into a preset database; and a second determination unit configured to use a preset database as the association rule base.
Optionally, in the apparatus for processing alarm information provided in the embodiment of the present application, the apparatus further includes: the second training unit is used for performing learning training on the alarm information to be processed after filtering the alarm information to be processed by adopting the association rule base to obtain association rules among the alarm information to be processed; the judging unit is used for judging whether the association rule between the alarm information to be processed exists in the association rule base or not; and the second storage unit is used for storing the association rules among the alarm information to be processed into the association rule base under the condition that the association rules among the alarm information to be processed do not exist in the association rule base.
Optionally, in the apparatus for processing warning information provided in the embodiment of the present application, the display unit 50 includes: the generating module is used for generating a visual view corresponding to the processed alarm information; a determination module for determining a location on the target interface at which to display the visualization view; and a display module for displaying the visualization view in position.
The processing device of the alarm information comprises a processor and a memory, wherein the receiving unit 10, the first determining unit 20, the extracting unit 30, the first processing unit 40, the display unit 50 and the like are stored in the memory as program units, and the processor executes the program units stored in the memory to realize corresponding functions. The first preset rule and the second preset rule may be stored in the memory.
The processor comprises a kernel, and the kernel calls the corresponding program unit from the memory. The kernel can be set to one or more than one, and alarm information is processed by adjusting kernel parameters.
The memory may include volatile memory in a computer readable medium, Random Access Memory (RAM) and/or nonvolatile memory such as Read Only Memory (ROM) or flash memory (flash RAM), and the memory includes at least one memory chip.
The present application further provides an embodiment of a computer program product, which, when being executed on a data processing device, is adapted to carry out program code for initializing the following method steps: receiving a plurality of pieces of alarm information sent by communication equipment; determining the attribute category of each piece of alarm information; extracting alarm information with the attribute category of a first type of alarm to obtain alarm information to be processed, wherein the first type of alarm is an alarm with an association relation between the alarm information; filtering the alarm information to be processed by adopting an association rule base; and displaying the processed alarm information on a target interface.
It should be noted that, for simplicity of description, the above-mentioned method embodiments are described as a series of acts or combination of acts, but those skilled in the art will recognize that the present application is not limited by the order of acts described, as some steps may occur in other orders or concurrently depending on the application. Further, those skilled in the art should also appreciate that the embodiments described in the specification are preferred embodiments and that the acts and modules referred to are not necessarily required in this application.
In the foregoing embodiments, the descriptions of the respective embodiments have respective emphasis, and for parts that are not described in detail in a certain embodiment, reference may be made to related descriptions of other embodiments.
In the embodiments provided in the present application, it should be understood that the disclosed apparatus may be implemented in other manners. For example, the above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units is only one type of division of logical functions, and there may be other divisions when actually implementing, for example, a plurality of units or components may be combined or may be integrated into another system, or some features may be omitted, or not implemented.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.
It will be apparent to those skilled in the art that the modules or steps of the present application described above may be implemented by a general purpose computing device, they may be centralized on a single computing device or distributed across a network of multiple computing devices, and they may alternatively be implemented by program code executable by a computing device, such that they may be stored in a storage device and executed by a computing device, or fabricated separately as individual integrated circuit modules, or fabricated as a single integrated circuit module from multiple modules or steps. Thus, the present application is not limited to any specific combination of hardware and software.
The above description is only a preferred embodiment of the present application and is not intended to limit the present application, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims (4)
1. A method for processing alarm information is characterized by comprising the following steps:
receiving a plurality of pieces of alarm information sent by communication equipment;
determining the attribute category of each piece of alarm information;
extracting alarm information of which the attribute type is a first type alarm to obtain alarm information to be processed, wherein the first type alarm is an alarm with an association relation between the alarm information;
filtering the alarm information to be processed by adopting an association rule base; and
displaying the processed alarm information on a target interface;
before filtering the alarm information to be processed by adopting the association rule base, the method further comprises the following steps:
learning and training historical alarm information sent by the communication equipment to obtain a plurality of association rules among the alarm information;
storing the plurality of association rules into a preset database; and
taking the preset database as the association rule base;
wherein, displaying the processed alarm information on the target interface comprises: generating a visual view corresponding to the processed alarm information; determining a location on the target interface at which to display the visualization view; and displaying the visualization view on the location;
after the alarm information to be processed is filtered by adopting the association rule base, the method further comprises the following steps:
performing learning training on the alarm information to be processed to obtain an association rule between the alarm information to be processed;
judging whether the association rule between the alarm information to be processed exists in the association rule base;
and if the association rule among the alarm information to be processed does not exist in the association rule base, storing the association rule among the alarm information to be processed into the association rule base.
2. The method of claim 1,
after receiving a plurality of pieces of alarm information sent by the communication device, before determining the attribute category of each piece of alarm information, the method further comprises: respectively filtering the plurality of alarm information according to a plurality of preset conditions;
determining the attribute category of each piece of alarm information comprises: and determining the attribute category of each piece of alarm information after filtering processing.
3. An apparatus for processing alarm information, comprising:
the receiving unit is used for receiving a plurality of pieces of alarm information sent by the communication equipment;
the first determining unit is used for determining the attribute category of each piece of alarm information;
the extracting unit is used for extracting the alarm information of which the attribute type is a first type of alarm to obtain the alarm information to be processed, wherein the first type of alarm is the alarm of which the association relationship exists between the alarm information;
the first processing unit is used for filtering the alarm information to be processed by adopting an association rule base; and
the display unit is used for displaying the processed alarm information on a target interface;
wherein the apparatus further comprises:
the first training unit is used for learning and training historical alarm information sent by the communication equipment before filtering the alarm information to be processed by adopting an association rule base to obtain a plurality of association rules among the alarm information;
the first storage unit is used for storing the association rules into a preset database; and
a second determining unit, configured to use the preset database as the association rule base;
the generating module is used for generating a visual view corresponding to the processed alarm information;
a determination module to determine a location on the target interface at which to display the visualization view; and
a display module for displaying the visualization view on the location;
wherein the apparatus further comprises:
the second training unit is used for performing learning training on the alarm information to be processed after filtering the alarm information to be processed by adopting an association rule base to obtain association rules among the alarm information to be processed;
the judging unit is used for judging whether the association rule between the alarm information to be processed exists in the association rule base or not;
and the second storage unit is used for storing the association rule among the alarm information to be processed into the association rule base under the condition that the association rule among the alarm information to be processed does not exist in the association rule base.
4. The apparatus of claim 3,
the device further comprises: the second processing unit is used for filtering a plurality of pieces of alarm information according to a plurality of preset conditions respectively after receiving the plurality of pieces of alarm information sent by the communication equipment and before determining the attribute type of each piece of alarm information;
the first determining unit further determines the attribute category of each piece of alarm information after the filtering processing.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611123054.2A CN106713017B (en) | 2016-12-08 | 2016-12-08 | Alarm information processing method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611123054.2A CN106713017B (en) | 2016-12-08 | 2016-12-08 | Alarm information processing method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106713017A CN106713017A (en) | 2017-05-24 |
| CN106713017B true CN106713017B (en) | 2020-06-19 |
Family
ID=58936508
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201611123054.2A Active CN106713017B (en) | 2016-12-08 | 2016-12-08 | Alarm information processing method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106713017B (en) |
Families Citing this family (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106992895A (en) * | 2017-05-26 | 2017-07-28 | 郑州云海信息技术有限公司 | A kind of alarm method of anti-oscillating, alarm device and program product |
| EP3635913A4 (en) * | 2017-06-05 | 2021-01-20 | Honeywell International Inc. | Alarm processing devices, methods, and systems |
| CN107861856A (en) * | 2017-11-08 | 2018-03-30 | 郑州云海信息技术有限公司 | The processing method and computer-readable storage medium of warning information in cloud data system |
| CN107908530B (en) * | 2017-11-27 | 2019-10-18 | 新华三云计算技术有限公司 | A kind of alert processing method and device |
| CN108156019B (en) * | 2017-11-29 | 2022-10-25 | 全球能源互联网研究院有限公司 | SDN-based network derived alarm filtering system and method |
| CN108243063A (en) * | 2017-12-28 | 2018-07-03 | 北京市天元网络技术股份有限公司 | The determining method and system of electric power terminal communication access net root alarm |
| CN110224969A (en) * | 2018-03-01 | 2019-09-10 | 中兴通讯股份有限公司 | The processing method and processing device of data |
| CN111078513B (en) * | 2018-10-22 | 2024-02-27 | 杭州海康威视数字技术股份有限公司 | Log processing method, device, equipment, storage medium and log alarm system |
| CN109544425A (en) * | 2018-11-08 | 2019-03-29 | 国网北京市电力公司 | Regional alarm method and device |
| CN111200515B (en) * | 2018-11-20 | 2022-12-06 | 中国移动通信集团内蒙古有限公司 | Alarm processing method and device |
| CN111294218B (en) * | 2018-12-06 | 2022-07-26 | 云智慧（北京）科技有限公司 | Information processing method, device, system and storage medium |
| CN111786806B (en) * | 2019-04-04 | 2022-03-01 | 大唐移动通信设备有限公司 | Network element exception handling method and network management system |
| CN110493066A (en) * | 2019-09-04 | 2019-11-22 | 山东钢铁股份有限公司 | Substation's background monitoring communications trouble shoot method |
| CN112735103A (en) * | 2020-12-16 | 2021-04-30 | 中盈优创资讯科技有限公司 | Alarm correlation identification method, device and equipment |
| CN112787860B (en) * | 2020-12-30 | 2023-03-14 | 广东电网有限责任公司电力调度控制中心 | Root alarm analysis and identification method and device |
| CN114172785B (en) * | 2021-10-21 | 2023-10-03 | 广州市百果园信息技术有限公司 | Alarm information processing method, device, equipment and storage medium |
| CN114500229B (en) * | 2021-12-30 | 2024-02-02 | 国网河北省电力有限公司信息通信分公司 | Network alarm positioning and analyzing method based on space-time information |
| CN114710396B (en) * | 2022-04-08 | 2023-06-23 | 中国联合网络通信集团有限公司 | Network alarm processing method and server |
| CN116467139B (en) * | 2023-03-27 | 2024-06-07 | 深圳市明源云科技有限公司 | System alarm repetition rate detection method, electronic equipment and readable storage medium |
| CN116599820B (en) * | 2023-05-26 | 2024-03-19 | 北京天融信网络安全技术有限公司 | Alarm filtering processing method, device, equipment and storage medium |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101047556A (en) * | 2006-06-01 | 2007-10-03 | 华为技术有限公司 | Integral maintaining method and system for multi-equipment |
| EP1769475B1 (en) * | 2004-06-28 | 2010-05-05 | Abb Research Ltd. | System and method for suppressing redundant alarms |
| CN103324128A (en) * | 2013-05-30 | 2013-09-25 | 国家电网公司 | Primary equipment fault warning comprehensive compression method in power dispatching automation system |
| CN103916260A (en) * | 2013-01-08 | 2014-07-09 | 中国移动通信集团浙江有限公司 | Device and method for alarm correlation |
| CN104463709A (en) * | 2014-12-12 | 2015-03-25 | 国家电网公司 | Substation alarm information processing method based on decision trees |
| CN105095523A (en) * | 2015-09-28 | 2015-11-25 | 浪潮(北京)电子信息产业有限公司 | Alarm event handling method and system |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN100589418C (en) * | 2007-12-10 | 2010-02-10 | 中兴通讯股份有限公司 | The generation method and the generation system of alarm correlation rule |
-
2016
- 2016-12-08 CN CN201611123054.2A patent/CN106713017B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP1769475B1 (en) * | 2004-06-28 | 2010-05-05 | Abb Research Ltd. | System and method for suppressing redundant alarms |
| CN101047556A (en) * | 2006-06-01 | 2007-10-03 | 华为技术有限公司 | Integral maintaining method and system for multi-equipment |
| CN103916260A (en) * | 2013-01-08 | 2014-07-09 | 中国移动通信集团浙江有限公司 | Device and method for alarm correlation |
| CN103324128A (en) * | 2013-05-30 | 2013-09-25 | 国家电网公司 | Primary equipment fault warning comprehensive compression method in power dispatching automation system |
| CN104463709A (en) * | 2014-12-12 | 2015-03-25 | 国家电网公司 | Substation alarm information processing method based on decision trees |
| CN105095523A (en) * | 2015-09-28 | 2015-11-25 | 浪潮(北京)电子信息产业有限公司 | Alarm event handling method and system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106713017A (en) | 2017-05-24 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106713017B (en) | Alarm information processing method and device | |
| CN111064614B (en) | Fault root cause positioning method, device, equipment and storage medium | |
| CN105095056B (en) | A kind of method of data warehouse data monitoring | |
| CN110995482B (en) | Alarm analysis method and device, computer equipment and computer readable storage medium | |
| JP6708219B2 (en) | Log analysis system, method and program | |
| CN108243063A (en) | The determining method and system of electric power terminal communication access net root alarm | |
| KR960701563A (en) | EVENT CORRELATION | |
| CN108768753B (en) | Method and device for positioning warning source, storage medium and electronic device | |
| CN111294217A (en) | Alarm analysis method, device, system and storage medium | |
| CN111858254B (en) | Data processing method, device, computing equipment and medium | |
| CN107426013A (en) | Facility information monitoring method, apparatus and system | |
| CN114567538A (en) | Alarm information processing method and device | |
| CN110739637A (en) | power transmission line monitoring method, system, terminal and storage medium | |
| CN111131290A (en) | Flow data processing method and device | |
| CN113132128B (en) | Prompt information processing method, device and storage medium | |
| CN111767193A (en) | Server data anomaly detection method and device, storage medium and equipment | |
| US10055460B2 (en) | Analysis of parallel processing systems | |
| CN111062503A (en) | Power grid monitoring alarm processing method, system, terminal and storage medium | |
| CN114202206A (en) | System abnormal root cause analysis method and device | |
| CN110888949B (en) | Equipment alarm shielding method, device, equipment and medium based on three-dimensional map | |
| CN109815082B (en) | KAFKA theme monitoring method and device, electronic equipment and storage medium | |
| CN110278105B (en) | Method for detecting overall service operation quality based on zabbix and web dial testing | |
| CN115529219B (en) | Alarm analysis method and device, computer readable storage medium and electronic equipment | |
| CN108156019B (en) | SDN-based network derived alarm filtering system and method | |
| CN113077144B (en) | Intelligent statistical method and device for number of users affected by distribution network fault |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |