CN107026745B - Alarm processing method and alarm processing equipment - Google Patents

Alarm processing method and alarm processing equipment Download PDF

Info

Publication number
CN107026745B
CN107026745B CN201610063905.2A CN201610063905A CN107026745B CN 107026745 B CN107026745 B CN 107026745B CN 201610063905 A CN201610063905 A CN 201610063905A CN 107026745 B CN107026745 B CN 107026745B
Authority
CN
China
Prior art keywords
alarm
updated
compression interval
duration
density function
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201610063905.2A
Other languages
Chinese (zh)
Other versions
CN107026745A (en
Inventor
王剑涛
田光见
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to CN201610063905.2A priority Critical patent/CN107026745B/en
Priority to PCT/CN2016/096876 priority patent/WO2017128712A1/en
Publication of CN107026745A publication Critical patent/CN107026745A/en
Application granted granted Critical
Publication of CN107026745B publication Critical patent/CN107026745B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications

Abstract

The embodiment of the application discloses an alarm processing method and alarm processing equipment, which are used for updating alarm statistical information according to received alarms so as to update an alarm flash rule. The method in the embodiment of the application comprises the following steps: receiving a first alarm; updating a first probability density function according to the first alarm to obtain an updated first probability density function; and updating the first compression interval of the first alarm type according to the updated first probability density function to obtain an updated first compression interval, wherein the updated first compression interval is used for compressing a second alarm when the second alarm received in real time belongs to the first alarm type and the duration of the second alarm is less than the updated first compression interval. The method can well reflect the state of the current network, reduce the dependence on experts and reduce the workload of the experts.

Description

Alarm processing method and alarm processing equipment
Technical Field
The present application relates to the field of communications, and in particular, to an alarm processing method and an alarm processing device.
Background
Telecommunications networks are composed of a large number of network devices that generate a large number of alarms each day. The alarm is a message generated by a network device due to a certain failure, and generally includes a device name, a failure occurrence time, a failure occurrence location, and the like. Each network device reports the alarm generated by the network device to the alarm processing device, and the network monitoring personnel can analyze the alarm obtained from the alarm processing device, find out the problems in the network from the alarm processing device and feed the problems back to the network maintenance personnel for processing.
If all alarms are presented to the network monitoring personnel, the network monitoring personnel can be overwhelmed by the vast number of alarms and cannot concentrate on exploring network problems. In fact, a large portion of alarms do not reflect the root cause of the network problem, so it is not necessary to present all alarms to network monitoring personnel.
In order to reduce the number of alarms presented to monitoring personnel and improve the working efficiency, some unimportant alarms must be filtered, and the unimportant alarms can be stored in a database. Therefore, only the alarm which is possible to have problems is displayed for the same type of alarm, and the rest alarms are directly stored in a database or directly abandoned and are not displayed to network monitoring personnel.
Generally, a technical expert empirically makes an alarm flash rule for each type of alarm, the alarm flash rule including a compression interval, and the alarm is determined to be displayed or compressed according to the relationship between the duration of each alarm and the size of the compression interval. And for any alarm reported, if the duration time of the alarm is not more than the compression interval, the alarm is not displayed to the network monitoring personnel, but is compressed into a database or is directly discarded, otherwise, the alarm is displayed to the network monitoring personnel.
The expert's experience determines the accuracy of the alarm flash rule, so the network quality is strongly dependent on the expert. And because the alarm flash rule is fixed and unchangeable, the alarm flash rule can not be dynamically adjusted according to the network state, when the network state changes, or when a new telecommunication network is just built or an old network is upgraded, the existing alarm flash rule can not accurately reflect the current network state. If a new alarm flash rule is needed, an expert is required to analyze the condition of the whole network again and determine the new alarm flash rule, and the expert needs to consume a great deal of time and energy for the analysis, so that the efficiency of network alarm processing is low.
Disclosure of Invention
The embodiment of the application provides an alarm processing method and alarm processing equipment, which are used for updating alarm statistical information according to a received alarm instance so as to update an alarm flash rule.
In view of this, a first aspect of the present application provides an alarm processing method, including:
receiving a first alarm, wherein the first alarm comprises the occurrence time and the elimination time of the first alarm and a first alarm type to which the first alarm belongs; updating the first probability density function according to the first alarm to obtain an updated first probability density function, wherein the independent variable of the updated first probability density function consists of the duration of the first alarm and the duration of the alarm which is received before the first alarm is received and belongs to the first alarm type, and the duration of the first alarm is the time difference between the occurrence time and the elimination time of the first alarm; and updating the first compression interval of the first alarm type according to the updated first probability density function to obtain an updated first compression interval, wherein the updated first compression interval is used for compressing a second alarm when the second alarm received in real time belongs to the first alarm type and the duration of the second alarm is less than the updated first compression interval.
When the alarm is received by the alarm processing equipment, the alarm processing equipment is used for updating the compression interval of the alarm and taking the compression interval as the alarm flash rule of the alarm. It should be noted that the alarm flashing rule may be represented by a binary group < a, CI >, where a is an alarm name and CI is a numerical value of a compression interval, and is used to determine an alarm type of an alarm when the alarm is received, find the compression interval of the alarm type, and determine whether the alarm needs to be compressed according to a size relationship between a duration and the compression interval, that is, when the duration is less than the compression interval, it indicates that the alarm should not be problematic, the alarm is compressed, otherwise, the alarm is displayed to a worker.
The statistical information may be recorded in terms of a probability density function y ═ f (x) and an accumulated density function y ═ f (x), where the argument x represents the duration of occurrence and the function value is the probability of the duration, i.e. the ratio of the number of occurrences to the number of accumulated alarms. Furthermore, an accumulated density function f (x) is obtained by integrating the probability density function, i.e. the argument x represents the duration of the occurrence, and the function value represents the probability that the duration is between 0 and x, i.e. the ratio of the number of occurrences to the number of accumulated alarms.
In the scheme, the alarm type and the duration of the alarm are obtained by receiving the alarm, and the probability density function of the duration of the alarm type is used for updating the compression interval of the alarm type of the alarm, so that the compression interval is used as an alarm flash rule, and the compression interval is used for compressing the alarm of which the duration is less than the compression interval when the alarm of the same type as the alarm is received in real time. Because the alarm flash rule is updated through dynamic information, the state of the current network can be well reflected, and because no expert is needed to formulate the alarm flash rule, the dependence on the expert is reduced, the workload of the expert is reduced, and the network maintenance is easier.
In combination with the first aspect of the present application, a first implementation manner of the first aspect of the present application includes:
the updated first probability density function is used to calculate the first compression interval with a plurality of preset parameters.
The expert gives a number of preset parameters including: default compression interval CIdefMaximum allowable value CI of compression intervalmaxAnd a preset step size delta. Wherein, CImaxMeaning that the duration of any alarms that can be compressed should not exceed CImaxAll durations being greater than CImaxShould be displayed to network monitoring personnel.
By setting a default compression interval CIdefAnd the value of the compression interval CI is adjusted through the specific local value and the average value and the smaller step length delta, so that the proper alarm flash rule compression interval can be found.
In combination with the first aspect of the present application, a second embodiment of the first aspect of the present application includes:
judging whether the first alarm type exists in a preset incompressible list or not; if yes, setting the value of the updated first compression interval to be zero.
For some special alarms, which should not be compressed anyway, but should be displayed to the network staff, an incompressible list containing the alarm type may be preset. When the display terminal receives the alarm, whether the alarm type of the alarm is in the incompressible list or not is judged. And if the alarm type of the alarm exists in the incompressible list, determining that the alarm cannot be compressed, and directly displaying the alarm to a worker.
Because the incompressible alarm is displayed in advance, in the actual operation, the excessive calculation of the system is avoided, the calculation times of the system are reduced, and the system pressure is reduced.
In combination with the first aspect of the present application, a third embodiment of the first aspect of the present application includes:
reading the duration of a plurality of alarms with the maximum value in the updated first probability density function; judging whether the duration of the plurality of alarms accords with linear distribution; if yes, setting the updated value of the first compression interval to be zero.
There are alarm types in the telecommunications network which have only a few discrete values of their duration, such as 30, 60, 90, 120 …, and these discrete values conform to a linear relationship. Such alarms cannot be compressed in practice because, according to the distribution of the duration, they are not eliminated at all times and become more and more serious and must be addressed in time. The alarms of this alarm type are displayed to the network monitoring personnel.
Because some alarm types which cannot be compressed are determined according to the distribution condition of the duration of the alarm type, the alarm which cannot be compressed in the actual work is displayed, in the actual operation, the excessive calculation of the system is avoided, the calculation times of the system are reduced, and the pressure of the system is reduced.
In combination with the first aspect of the present application, a fourth embodiment of the first aspect of the present application includes:
calculating the proportion that the duration of the alarm in the first probability density function is less than a preset default compression interval; judging whether the proportion is smaller than a preset proportion or not; if yes, setting the value of the updated first compression interval to be zero.
In practice, the proportion of alarms in a duration less than the compression interval should reach a certain proportion if the alarm of one alarm type is considered as less problematic overall. That is, the expert in the field empirically finds that the proportion of the distribution density function of the duration in a certain area must be to a certain extent, and if not, the alarm is considered to possibly show a problem, and is considered to be incompressible, so that the alarm is displayed to the network monitoring personnel. Therefore, an expert in the field can preset a preset proportion value omega and a preset compression interval CIdefJudgment F (CI)def) Whether or not Ω is established. If the alarm is not set, the alarm cannot be compressed, and the alarm is displayed to a network monitoring person.
Because some alarm types which cannot be compressed are determined according to the distribution condition of the duration of the alarm type, the alarm which cannot be compressed in the actual work is displayed, in the actual operation, the excessive calculation of the system is avoided, the calculation times of the system are reduced, and the pressure of the system is reduced.
With reference to the first aspect of the present application, the first embodiment of the first aspect of the present application, the second embodiment of the first aspect of the present application, the third embodiment of the first aspect of the present application, and the fourth embodiment of the first aspect of the present application, the fifth embodiment of the first aspect of the present application includes:
caching the first alarm; judging whether the storage amount of the cached alarm reaches a preset storage amount or not; if so, updating the first probability density function by using the duration of the alarm belonging to the first alarm type in the cached alarms to obtain the updated first probability density function.
In consideration of the fact that if the alarm statistical information is updated as soon as the alarm is received in actual work, the load of system work is too large and does not meet the requirement of the actual work, and therefore the received alarm is firstly cached and is used for updating the statistical information after certain conditions are met.
Because the alarm statistical information is cached before being updated by the alarm instead of being directly used, the alarm information is updated once in a certain time, so that the alarm is not required to be updated once every time the alarm is received, excessive calculation of the system is avoided, the calculation times of the system are reduced, and the pressure of the system is reduced.
In combination with a fifth embodiment of the first aspect of the present application, the method includes:
calculating the time difference between the occurrence time of the first alarm and the current time; judging whether the time difference is smaller than a preset time difference or not; if yes, caching the first alarm.
Counting the appearance time, Duration and alarm name of the alarm, storing in the triple of the alarm < A, Occur, Duration > (wherein A is the alarm name, Occur is the alarm occurrence time, and Duration is the alarm Duration). The buffered alarms are periodically stored in the database and the buffer is emptied. When the alarm data is transferred to the database, the alarm of the alarm duration within the preset time can be used for updating the function density function.
Since some alarms occurring a long time ago may not be able to accurately reflect the current network condition, only the latest alarm is considered as a reflection of the current network condition.
A second aspect of the present application provides an alarm processing apparatus, including:
the first receiving module is used for receiving a first alarm, wherein the first alarm comprises the occurrence time and the elimination time of the first alarm and a first alarm type to which the first alarm belongs; the first updating module updates the first probability density function according to the first alarm received by the first receiving module to obtain an updated first probability density function, wherein the independent variable of the updated first probability density function consists of the duration of the first alarm and the duration of the alarm belonging to the first alarm type received before the first alarm is received, and the duration of the first alarm is the time difference between the occurrence time and the elimination time of the first alarm; and the second updating module is used for updating the first compression interval of the first alarm type according to the updated first probability density function updated by the first updating module to obtain an updated first compression interval, and the updated first compression interval is used for compressing the second alarm when the second alarm received in real time belongs to the first alarm type and the duration of the second alarm is less than the updated first compression interval.
A third aspect of the present application provides an alarm processing apparatus, including:
a receiver, a memory, a processor, and a bus; the receiver, the memory and the processor are connected through the bus; the receiver is used for receiving a first alarm, wherein the first alarm comprises the occurrence time and the elimination time of the first alarm and a first alarm type to which the first alarm belongs; the memory is used for storing a program and the first alarm received by the receiver; the processor is used for updating a first probability density function according to the first alarm to obtain an updated first probability density function, and the argument of the updated first probability density function consists of the duration of the first alarm and the duration of the alarm belonging to the first alarm type received before the first alarm is received, wherein the duration of the first alarm is the time difference between the occurrence time and the elimination time of the first alarm; and updating the first compression interval of the first alarm type according to the updated first probability density function to obtain an updated first compression interval, wherein the updated first compression interval is used for compressing a second alarm when the second alarm received in real time belongs to the first alarm type and the duration of the second alarm is less than the updated first compression interval. The memory is further configured to store the updated first probability density function updated by the processor and the updated first compression interval.
A fourth aspect of the present application provides an alarm processing method, including:
receiving a first alarm, wherein the first alarm comprises the occurrence time and the elimination time of the first alarm and a first alarm type to which the first alarm belongs; judging whether the duration time of the first alarm is less than a first compression interval, wherein the duration time of the first alarm is the time difference between the occurrence time and the elimination time of the first alarm, the first compression interval is determined by an alarm flash rule, the alarm flash rule comprises a plurality of alarm types and a corresponding relationship between compression intervals, and each alarm type in the corresponding relationship has one and only one corresponding compression interval; and if so, compressing the first alarm.
If the duration of the first alarm is less than the first compression interval, the first alarm can be considered to have no problem, compression processing can be performed on the first alarm, and otherwise, the first alarm can be displayed to a worker.
In combination with an embodiment of the first aspect of the present application, the method includes:
and receiving an alarm flash rule, wherein the alarm flash rule comprises the first alarm type and the first compression interval corresponding to the first alarm type.
The alarm flash rule can be a plurality of binary groups < A, CI >, wherein A is an alarm name, namely an alarm type, and CI is a compression interval. Namely, the alarm flash rule has corresponding compression intervals for different alarm types. It should be noted that the compression intervals corresponding to different alarm types may be different or the same, and there is no causal relationship between them.
A fifth aspect of the present application provides an alarm processing apparatus, including:
the second receiving module is used for receiving a first alarm, wherein the first alarm comprises the occurrence time and the elimination time of the first alarm and a first alarm type to which the first alarm belongs; a fourth judging module, configured to judge whether the duration of the first alarm received by the second receiving module is less than a first compression interval, where the duration of the first alarm is a time difference between an occurrence time and a removal time of the first alarm, the first compression interval is determined by an alarm flashing rule, the alarm flashing rule includes a correspondence between multiple alarm types and compression intervals, and each alarm type in the correspondence has one and only one compression interval corresponding to the alarm type; and the compression module is used for compressing the first alarm if the judgment result of the fourth judgment module is positive.
A sixth aspect of the present application provides an alarm processing apparatus, including:
a receiver, a memory, a processor, and a bus; the receiver, the memory and the processor are connected through a bus; the receiver is used for receiving a first alarm, wherein the first alarm comprises the occurrence time and the elimination time of the first alarm and a first alarm type to which the first alarm belongs; the memory is used for storing a program and the first alarm received by the receiver; the processor is configured to determine whether a duration of the first alarm received by the receiver is less than a first compression interval, where the duration of the first alarm is a time difference between an occurrence time of the first alarm and an elimination time, the first compression interval is determined by an alarm flashing rule, the alarm flashing rule includes a correspondence between a plurality of alarm types and compression intervals, and each alarm type in the correspondence has one and only one compression interval corresponding thereto; and if the duration of the first alarm received by the receiver is less than a first compression interval, compressing the first alarm.
According to the technical scheme, the embodiment of the application has the following advantages:
in the scheme, the alarm type and the duration of the alarm are obtained by receiving the alarm, and the probability density function of the duration of the alarm type is used for updating the compression interval of the alarm type of the alarm, so that the compression interval is used as an alarm flash rule, and the compression interval is used for compressing the alarm of which the duration is less than the compression interval when the alarm of the same type as the alarm is received in real time. Because the alarm flash rule is updated through dynamic information, the state of the current network can be well reflected, and because no expert is needed to formulate the alarm flash rule, the dependence on the expert is reduced, the workload of the expert is reduced, and the network maintenance is easier.
Drawings
FIG. 1 is a schematic diagram of an architecture of a network device alarm system according to an embodiment of the present application;
FIG. 2 is a schematic diagram of an embodiment of an alarm processing method in an embodiment of the present application;
FIG. 3 is a schematic diagram of an embodiment of an alarm processing device in an embodiment of the present application;
FIG. 4 is a schematic diagram of another embodiment of an alarm processing device in the embodiment of the present application;
FIG. 5 is a schematic diagram of another embodiment of an alarm processing device in the embodiment of the present application;
FIG. 6 is a schematic diagram of another embodiment of an alarm processing device in the embodiment of the present application;
FIG. 7 is a schematic diagram of another embodiment of an alarm processing device in the embodiment of the present application;
FIG. 8 is a schematic diagram of another embodiment of an alarm processing device in the embodiment of the present application;
FIG. 9 is a schematic diagram of an embodiment of an alarm processing device in an embodiment of the present application;
FIG. 10 is a schematic diagram of another embodiment of an alarm processing method in the embodiment of the present application;
FIG. 11 is a schematic diagram of an embodiment of an alarm processing device in an embodiment of the present application;
FIG. 12 is a schematic diagram of another embodiment of an alarm processing device in the embodiment of the present application;
FIG. 13 is a schematic diagram of an embodiment of an alarm processing device in an embodiment of the present application;
fig. 14 is a schematic diagram of an algorithm for calculating the compression interval in the embodiment of the present application.
Detailed Description
The embodiment of the application provides an alarm processing method and alarm processing equipment, which are used for updating an alarm flash rule containing a compression interval according to alarm statistical information of which the received alarm updating form is a probability density function.
In order to make the technical solutions of the embodiments of the present invention better understood, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
The terms "first," "second," "third," "fourth," and the like in the description and in the claims, as well as in the drawings, if any, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It will be appreciated that the data so used may be interchanged under appropriate circumstances such that the embodiments described herein may be practiced otherwise than as specifically illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
Fig. 1 is a schematic diagram of an architecture of a network device alarm system. The network equipment alarm system is composed of network equipment and alarm processing equipment. In a telecommunication Network, there are a large number of Network devices, such as Radio Network Controllers (RNC), 3G Mobile stations (Node B), Media Gateways (MGW), Mobile Switching Centers (MSC), etc.
Network devices do not generate alarms directly, but rather generate alarm instances, which generate a large number of alarm instances each day. The alarm examples are that the network equipment generates a piece of information due to a certain fault, and the alarm examples are divided into two types: the device alarm example comprises an alarm name, namely an alarm type, and occurrence time, which indicates that a certain device has a certain problem at a certain place and a certain time; an example of a dismissal alert, including the type of alert and the time of dismissal, indicates that an alert has been dismissed.
Generally, the former occurs first for the device alarm instance and the cancel alarm instance that contain the same alarm type. When an alarm for elimination arrives, the system first needs to search the equipment alarm instance corresponding to the alarm for elimination, and calculates the duration of the alarm as: and subtracting the occurrence time of the equipment alarm instance from the occurrence time of the elimination alarm instance to obtain the duration of an alarm. Each network device reports the alarm generated by the network device to the server, and the network monitoring personnel analyze the alarm information acquired by the alarm processing device, find out the problems in the network and feed the problems back to the network maintenance personnel for processing.
If all alarms are presented to the network monitoring personnel, the network monitoring personnel can be overwhelmed by the vast number of alarms and cannot concentrate on exploring network problems. In fact, a large portion of alarms do not reflect the root cause of the network problem, so it is not necessary to present all alarms to network monitoring personnel.
In order to reduce the number of alarms presented to monitoring personnel and improve the working efficiency, some unimportant alarms must be filtered, and the unimportant alarms can be stored in a database or directly discarded. Therefore, only the alarm which is possible to have problems is displayed for the same type of alarm, and the rest alarms are directly stored in a database or directly abandoned and are not displayed to network monitoring personnel.
Generally, a technical expert empirically makes an alarm flash rule for each type of alarm, where the alarm flash rule includes a compression interval, and the compression interval is time-based, and determines whether each alarm should be displayed or compressed according to the relationship between the duration of the alarm and the size of the compression interval. And for any alarm reported, if the duration time of the alarm is not more than the compression interval, the alarm is not displayed to the network monitoring personnel and is compressed to the database, otherwise, the alarm is displayed to the network monitoring personnel.
The expert's experience determines the accuracy of the alarm flash rule, so the dependency on the expert is strong. And because the alarm flash rule is fixed and unchangeable, the alarm flash rule can not be dynamically adjusted according to the network state, when the network state changes, or when a new telecommunication network is just built or an old network is upgraded, the existing alarm flash rule can not accurately reflect the current network state. If a new alarm flashing rule is needed, the expert is required to analyze the condition of the whole network again and determine the new alarm flashing rule, so that the expert consumes a great deal of time and energy.
In the scheme, the alarm type and the duration of the alarm are obtained by receiving the alarm, and the probability density function of the duration of the alarm type is used for updating the compression interval of the alarm type of the alarm, so that the compression interval is used as an alarm flash rule, and the compression interval is used for compressing the alarm of which the duration is less than the compression interval when the alarm of the same type as the alarm is received in real time. Because the alarm flash rule is updated through dynamic information, the state of the current network can be well reflected, and because no expert is needed to formulate the alarm flash rule, the dependence on the expert is reduced, the workload of the expert is reduced, and the network maintenance is easier.
Therefore, the core idea of the embodiment of the present application is to update an alarm flash rule including a compression interval by receiving a new alarm for updating a probability density function of a duration of an alarm type to which the new alarm belongs, where the alarm flash rule is used to determine whether compression processing is required for the newly received alarm.
For convenience of understanding, a specific flow in the embodiment of the present application is described below, and with reference to fig. 2, an embodiment of an alarm processing method in the embodiment of the present application includes:
201. a first alert is received.
In some possible embodiments, there is one and only one alarm type per alarm, also known as alarm name. If two alarms have the same alarm name, the two alarms may be considered to reflect the same type of problem. In addition, the duration of an alarm is one of the most important parameters, and is a main judgment parameter reflecting whether the alarm type is problematic.
It should be noted that, in some possible embodiments, the alarm may further include a device name, a fault type, an occurrence time, an occurrence location, and the like, which are not limited herein, and in the embodiment of the present invention, the example where the alarm includes the alarm type and the duration is described as an example.
In some possible embodiments, the alarm is received by the display terminal, and whether the alarm is displayed or compressed is determined according to the current alarm flashing rule. Meanwhile, on the other hand, the alarm processing device also receives the compressed interval for updating the alarm, and the compressed interval is used as an alarm flash rule of the alarm. It should be noted that the alarm flashing rule may be represented by a binary group < a, CI >, where a is an alarm name and CI is a numerical value of a compression interval, and is used to determine an alarm type of an alarm when the alarm is received, find the compression interval of the alarm type, and determine whether the alarm needs to be compressed according to a size relationship between a duration and the compression interval, that is, when the duration is less than the compression interval, it indicates that the alarm should not be problematic, the alarm is compressed, otherwise, the alarm is displayed to a worker.
It should be noted that, in some possible embodiments, the device that calculates the compression interval and the device that uses the compression interval may be the same device, or may be two different devices, which is not limited herein.
202. And caching the first alarm.
In the embodiment of the invention, the received alarm is firstly cached and is used for updating the statistical information after certain conditions are met, considering that if the alarm statistical information is updated as soon as the alarm is received, the load of the system work is too large and does not meet the requirement of actual work.
In the embodiment of the present invention, a specific implementation manner is to count the occurrence time, Duration and alarm name of an alarm, and store the alarm in a triple of < a, Occur, Duration > (where a is the alarm name, Occur is the occurrence time of the alarm, and Duration is the Duration of the alarm). In some possible embodiments, the buffered alarms are periodically stored in the database and the buffer is emptied. In other possible embodiments, the alarm amount may be stored in the database when the buffered alarm amount reaches a certain size, and the buffer is cleared, which is not limited herein. When the alarm data is transferred to the database, the alarm of the alarm duration within the preset time can be used for updating the function density function.
203. And judging whether the alarm type of the first alarm is in the incompressible list.
In some possible embodiments, there are some alarm types that are not compressible, must be displayed, and if the alarm flash rules are still computed, it is a waste for system resources. Therefore, in the embodiment of the invention, the alarm types can be screened, some incompressible alarm types are determined firstly, and then all alarms in the incompressible alarm types are displayed to the network monitoring personnel.
In the embodiment of the present invention, for some special alarms, which should not be compressed anyway but should be displayed to the network staff, the incompressible list may be preset, and the incompressible list contains the alarm type. When the display terminal receives the alarm, whether the alarm type of the alarm is in the incompressible list or not is judged. And if the alarm type of the alarm exists in the incompressible list, determining that the alarm cannot be compressed, and directly displaying the alarm to a worker.
204. The probability density function of the durations of alarms of the first alarm type is updated.
After receiving the alarm, because some alarms occurring long ago may not be able to accurately reflect the current network condition, in the embodiment of the present invention, only the latest alarm is considered as the reflection of the current network condition.
In order to implement the above solution, in some possible embodiments, the occurrence time of the alarm in the cache information is read, the time difference between the occurrence time and the current time is determined, and if the time difference is smaller than the preset time difference, the alarm is used to update the probability density function of the duration time.
In a specific embodiment, a statistical set of information D ═ Si ═ 1, | i ═ 2, 3, … …, n } (where a is the alarm name, Occur is the time of occurrence of the alarm, and Duration is the Duration of the alarm), and a coverage interval L for set D, which is a user-configurable positive number in time to represent a preset time difference between the time of occurrence of the alarm and the current time.
It should be noted that if L >0, it indicates that the triple in D where the occurrence time of the alarm is not in the region [ t-L, t ] is removed by screening, and finally, the alarm flash rule is updated according to the statistical information of the duration time of the remaining alarms in D. In particular, in some possible embodiments, when the effect of the preset time difference is not considered, i.e., L is set to 0, it means that all triplets derived from the buffered alarms will be stored in D, i.e., the duration of all alarms will be recorded and analyzed.
In some possible embodiments, the alarm of the current day may also be regarded as the latest alarm to be considered, and the alarm flashing rule is updated according to the latest alarm, which is not limited herein.
In the embodiment of the present invention, the data that is used for filtering is updated into the statistical information, which may be recorded in the form of a probability density function y ═ f (x) and an accumulated density function y ═ f (x), wherein the argument x represents the duration of occurrence, and the function value is the probability of the duration, i.e. the ratio of the number of occurrences to the number of accumulated alarms. Furthermore, an accumulated density function f (x) is obtained by integrating the probability density function, i.e. the argument x represents the duration of the occurrence, and the function value represents the probability that the duration is between 0 and x, i.e. the ratio of the number of occurrences to the number of accumulated alarms.
205. And judging whether the duration of the plurality of alarms accords with linear distribution.
In some possible embodiments, there are alarm types in the telecommunications network that have only a few discrete values of their duration, such as 30, 60, 90, 120 …, and these discrete values conform to a linear relationship. Such alarms cannot be compressed in practice because, according to the distribution of the duration, they are not eliminated at all times and become more and more serious and must be addressed in time. The alarms of this alarm type are displayed to the network monitoring personnel.
In order to find the alarm, the alarm probability density function f (x) of the alarm statistics may be extracted, and the durations of the largest alarms, such as 8 alarms, are x1, x2, … …, and x8, respectively. If these 8 values fit into a linear distribution, the alarm is considered to be not compressible.
206. And judging whether the alarm duration in the first probability density function is less than the preset default compression interval proportion or not.
In actual work, if the problem of the alarm of one alarm type is considered to be small on the whole, the proportion of the alarm with the duration less than the compression interval should reach a certain proportion, and if the proportion of the alarm of the other alarm type cannot be reached, the alarm can be considered to be in the problem on the whole, and all the alarms of the whole alarm type need to be displayed.
To achieve the above purpose, in some possible embodiments, a preset ratio Ω and a preset compression interval CI may be preset by experts in the fielddefJudgment F (CI)def) Whether or not Ω is established. If the alarm is not set, the alarm cannot be compressed, and the alarm is displayed to a network monitoring person. That is, experts in the field empirically derive a duration of [0, CI ]def]The proportion of the distribution density function in the alarm must reach a certain proportion, namely a preset proportion omega, if the proportion is not reached, the alarm is considered to possibly display problems, the alarm is considered to be not compressible, and therefore the alarm is displayed to a network monitoring person.
207. The value of the first compression interval is set to zero.
In the embodiment of the invention, the form of the alarm flash rule is represented by a binary element < A, CI >, wherein A is an alarm name, and CI is a numerical value of a compression interval. When the alarm type which cannot be compressed is determined, the returned alarm flash rule is < A, 0 >. Since the duration of all alarm types is greater than 0, when the compression interval of the alarm is 0, all the alarms are not compressed and are displayed to the network monitoring personnel.
In the embodiment of the present invention, if one or more of step 203, step 205, or step 206 is satisfied, the value of the first compression interval may be considered to be zero. It should be noted that, the manner for determining whether the alarm is not compressible may be one or more of the above manners, and other manners are also possible, which are not limited herein.
In some possible embodiments, the alarm flashing rule may include not only the alarm name and the compression interval, but also the occurrence location, the compression ratio, and the like, as long as the alarm name and the compression interval are included, and the rule is not limited herein.
208. And calculating the numerical value of the compression interval.
In some possible embodiments, the probability density function f (x) of the duration of each alarm instance in the alarm statistic information determined in step 204 may be used to obtain a cumulative density function f (x), and the cumulative density function f (x) and a number of preset parameters are used to calculate the compression interval. Referring to fig. 14, the specific implementation is as follows:
the expert gives a number of preset parameters including: default compression interval CIdefMaximum allowable value CI of compression intervalmaxAnd a preset step size delta. Wherein, CImaxMeaning that the duration of any alarms that can be compressed should not exceed CImaxAll durations being greater than CImaxShould be displayed to network monitoring personnel.
The specific implementation mode is that CI is in a default compression intervaldefSearching the left side and the right side to obtain two alternative compression intervals CIlAnd CIr. To CIdefThe reason for the left search is the CI given by the expertdefMay be too large and may compress some important alarms; and the reason for searching to the right is CIdefIt may be too small and too many alarms may be displayed to network monitoring personnel. When CI is presentdefEqual to CIrWhen the final CI is CIlOtherwise, it is CIr. To achieve the above object, the following algorithm may be used:
let x be CIdefΔ, judgment F (x + Δ) -F (x)>＝F(CIdef)×Δ/CIdefIf true, CI is determinedlIf not, judging x as x-delta again; let x be CIdef+ Δ, judgment F (x) -F (x- Δ)<F(CIdef)×Δ/CIdefIf true, CI is determinedrX- Δ, if no and x<CImaxIf x is equal to x + delta, judging again>＝CImaxThen order CIr＝CIdef(ii) a If CI isrEqual to CIdefIf CI is equal to CIlOtherwise CI is equal to CIr(ii) a Then the alarm flash rule is obtained<A,CI>。
The idea of this algorithm is that it can be passed through CIdefThe comparison of the left and right specific local values with the average value can obtain whether the local value is higher or lower than the average value. If CIdefThe local value of the accumulation function on the left is higher than the average value, which indicates that a large number of alarms appear in the local interval on the right, and at least more than the average value, so that the part of alarms can be regarded as a frequent phenomenon, can be regarded as normal and have no problem, and can be compressed. If the local value is lower than the average value, this part can be considered as a minority phenomenon and should be reported to the network monitoring personnel, and one more step Δ should be taken to the left.
Similarly, if CIdefThe local value of the right cumulative function is higher than the average value, which indicates that a large number of alarms appear in the right local interval, at least more than the average value, and the alarm can be regarded as a frequent phenomenon, can be regarded as normal and has no problem, and belongs to a compressible alarm, so that x needs to go to the right by a step length delta. If the local value is lower than the average value, this part can be considered as a few phenomena, belonging to the alarm that is not compressed, and should be reported to the network monitoring personnel.
Note that if CI isrAnd CIlWhile not being equal to CIdefThen CI can be judgedlTo the CIdefThe occurrence number of the alarms in the interval is less, the alarm is an individual phenomenon and can be ignored, and CI is selectedrAs the last CI.
In some possible embodiments, the compression interval of the alarm flash rule may also be calculated by other algorithms or other concepts, so as to obtain an appropriate compression interval CI, which is not limited herein.
In the embodiment of the invention, the compression interval of the alarm flash rule is updated through dynamic information, so that the current state of the network can be well reflected, and the alarm flash rule is formulated without an expert, so that the dependence on the expert is reduced, the workload of the expert is reduced, and the network maintenance is easier.
The above describes the alarm processing method in the embodiment of the present application, and the following describes the alarm processing device in the embodiment of the present application.
Referring to fig. 3, an embodiment of the present application further provides an alarm processing apparatus 300, including:
a first receiving module 301, configured to receive a first alarm, where the first alarm includes an occurrence time and a removal time of the first alarm, and a first alarm type to which the first alarm belongs;
a first updating module 302, configured to update a first probability density function according to the first alarm received by the first receiving module 301 to obtain an updated first probability density function, where an argument of the updated first probability density function is composed of a duration of the first alarm and a duration of an alarm belonging to the first alarm type received before the first alarm is received, and the duration of the first alarm is a time difference between an occurrence time and a cancellation time of the first alarm;
the second updating module 303 updates the first compression interval of the first alarm type according to the updated first probability density function updated by the first updating module 302 to obtain an updated first compression interval, where the updated first compression interval is used to compress a second alarm received in real time when the second alarm belongs to the first alarm type and the duration of the second alarm is less than the updated first compression interval.
In some embodiments, the second updating module 303 is specifically configured to include:
the first compression interval is calculated by using the updated first probability density function updated by the first updating module and a plurality of preset parameters.
In the scheme, the alarm type and the duration of the alarm are obtained by receiving the alarm, and the probability density function of the duration of the alarm type is used for updating the compression interval of the alarm type of the alarm, so that the compression interval is used as an alarm flash rule, and the compression interval is used for compressing the alarm of which the duration is less than the compression interval when the alarm of the same type as the alarm is received in real time. Because the alarm flash rule is updated through dynamic information, the state of the current network can be well reflected, and because no expert is needed to formulate the alarm flash rule, the dependence on the expert is reduced, the workload of the expert is reduced, and the network maintenance is easier.
Referring to fig. 4, in some embodiments, the alert processing apparatus 300 further includes:
a first determining module 304, configured to determine whether the first alarm type received by the first receiving module 301 exists in a preset incompressible list;
a first setting module 305, configured to set the updated value of the first compression interval to zero if the determination result of the first determining module 304 is yes.
Referring to FIG. 5, in some embodiments, the alert processing apparatus 300 includes:
a reading module 306, configured to read the durations of the alarms with the largest values in the updated first probability density function, which are updated by the first updating module 302;
a second judging module 307, configured to judge whether the durations of the plurality of alarms read by the reading module 306 conform to a linear distribution;
a second setting module 308, configured to set the updated value of the first compression interval to zero if the determination result of the second determining module 307 is yes.
Referring to FIG. 6, in some embodiments, the alert processing apparatus 300 includes:
a calculating module 309, configured to calculate a ratio that the duration of the alarm in the updated first probability density function updated by the first updating module 302 is smaller than a preset default compression interval.
A third determining module 310, configured to determine whether the ratio calculated by the calculating module 309 is smaller than a preset ratio.
A third setting module 311, configured to set the updated value of the first compression interval to zero if the determination result of the third determining module 310 is yes.
Referring to fig. 7, in some embodiments, the first update module 302 includes:
the buffering unit 3021 is configured to buffer the first alarm received by the first receiving module 301.
A judging unit 3022 configured to judge whether the storage amount of the alert cached by the caching unit 3021 reaches a preset storage amount.
An updating unit 3023, configured to update the first probability density function using the duration of the alarm of the first alarm type in the cache unit if the determination result of the determining unit 3022 is yes, so as to obtain the updated first probability density function.
Referring to fig. 8, in some embodiments, the cache unit 3021 includes:
a calculating subunit 30211, configured to calculate a time difference between the occurrence time of the first alarm and the current time received by the first receiving module 301.
A judging subunit 30212, configured to judge whether the time difference calculated by the calculating subunit 30211 is smaller than a preset time difference.
A buffering subunit 30213, configured to buffer the first alarm if the determination result of the determining subunit 30212 is yes.
In the embodiment of the invention, the alarm flash rule is updated through dynamic information, so that the current state of the network can be well reflected, and the alarm flash rule is formulated without an expert, so that the dependence on the expert is reduced, the workload of the expert is reduced, and the network maintenance is easier.
The above describes the alarm processing device in the embodiment of the present application from the perspective of the modular functional entity, and the following describes the alarm processing device in the embodiment of the present application from the perspective of the hardware processing, and please refer to fig. 9, which provides an alarm processing device in the embodiment of the present application.
An alert processing apparatus 400 comprising:
a receiver 401, a memory 402, a processor 403, and a bus 404.
The receiver 401, memory 402 and processor 403 are connected by a bus 404.
The receiver 401 is configured to receive a first alarm, where the first alarm includes an occurrence time and a cancellation time of the first alarm, and a first alarm type to which the first alarm belongs.
The receiver 401 may include a communication interface between the processor 403 and a standard communication subsystem.
The receiver 401 may further include a communication interface under the EIA-RS-232C standard, that is, a communication interface under the technical standard of a serial binary Data exchange interface between Data Terminal Equipment (DTE) and Data Communication Equipment (DCE), or a communication interface under the RS-485 protocol, which is not limited herein.
A memory 402 for storing a program, the first alert received by the receiver 401.
The memory 402 may include a volatile memory (RAM), such as a random-access memory (RAM); the memory 402 may also include a non-volatile memory (english: non-volatile memory), such as a flash memory (english: flash memory), a hard disk (english: hard disk drive, abbreviated: HDD) or a solid-state drive (english: SSD); the memory 403 may also comprise a combination of the above types of memory and is not limited thereto.
Optionally, the memory 402 may also be used to store program instructions, and the processor 403 may call the program instructions stored in the memory 402 to execute one or more steps in the embodiment shown in fig. 2, or an alternative embodiment thereof, so that the alarm processing device 400 implements the functions of the above-described method.
A processor 403, configured to update a first probability density function according to the first alarm to obtain an updated first probability density function, where an argument of the updated first probability density function consists of a duration of the first alarm and a duration of an alarm belonging to the first alarm type and received before the first alarm is received, and the duration of the first alarm is a time difference between an occurrence time and a cancellation time of the first alarm; and updating the first compression interval of the first alarm type according to the updated first probability density function to obtain an updated first compression interval, wherein the updated first compression interval is used for compressing a second alarm when the second alarm received in real time belongs to the first alarm type and the duration of the second alarm is less than the updated first compression interval.
The processor 403 may be a Central Processing Unit (CPU), a Network Processor (NP), or a combination of a CPU and an NP.
The processor 403 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a Programmable Logic Device (PLD), or a combination thereof. The aforementioned PLD may be a Complex Programmable Logic Device (CPLD), a field-programmable gate array (FPGA), a General Array Logic (GAL), or any combination thereof.
The memory 402 is further configured to store the updated first probability density function and the updated first compression interval updated by the processor 403.
In the embodiment of the invention, the compression interval of the alarm flash rule is updated through dynamic information, so that the current state of the network can be well reflected, and the alarm flash rule is formulated without an expert, so that the dependence on the expert is reduced, the workload of the expert is reduced, and the network maintenance is easier.
In the above description of the alarm processing device side that generates the compressed interval in the embodiment of the present application, the following description of the alarm processing method on the data processing device side that uses the compressed interval in the embodiment of the present application refers to fig. 10:
501. a first alert is received.
Please refer to step 201, which is not described herein.
502. And receiving an alarm flash rule.
In the embodiment of the invention, the alarm flash rule containing the compression interval generated through the steps 201 to 203 is received. In some possible embodiments, the alarm flashing rule may be a plurality of binary groups < a, CI >, where a is the alarm name, i.e. the alarm type, and CI is the compression interval. Namely, the alarm flash rule has corresponding compression intervals for different alarm types. It should be noted that the compression intervals corresponding to different alarm types may be different or the same, and there is no causal relationship between them.
503. And judging whether the duration of the first alarm is less than a first compression interval or not.
In the embodiment of the present invention, the alarm type may be found in the alarm flashing rule, and then the corresponding compression interval is found, and then the duration of the first alarm received in step 501 and how large the compression interval is are determined in real time on line.
504. The first alert is compressed.
In the embodiment of the present invention, if the duration of the first alarm is less than the first compression interval, it may be determined that the first alarm has no problem, and the first alarm may be compressed, otherwise, the first alarm may be displayed to the staff.
In the above description of the alarm processing method in the embodiment of the present application, please refer to fig. 11 for describing the alarm processing device 600 in the embodiment of the present application.
A second receiving module 601, configured to receive a first alarm, where the first alarm includes an occurrence time and a removal time of the first alarm, and a first alarm type to which the first alarm belongs;
a fourth determining module 602, configured to determine whether the duration of the first alarm received by the second receiving module 601 is smaller than a first compression interval, where the duration of the first alarm is a time difference between the occurrence time and the elimination time of the first alarm, the first compression interval is determined by an alarm flashing rule, the alarm flashing rule includes a correspondence between multiple alarm types and compression intervals, and each alarm type in the correspondence has one and only one compression interval corresponding to the alarm type;
the compressing module 603 compresses the first alarm if the determination result of the fourth determining module 602 is yes.
Referring to fig. 12, in some embodiments, the alert processing apparatus 600 further includes:
a third receiving module 604, configured to receive an alarm flash rule, where the alarm flash rule includes the first alarm type and the first compressed interval corresponding to the first alarm type.
The above describes the alarm processing device in the embodiment of the present application from the perspective of the modular functional entity, and the following describes the alarm processing device in the embodiment of the present application from the perspective of the hardware processing, and please refer to fig. 13, which provides an alarm processing device in the embodiment of the present application.
An alert processing apparatus 700 comprising:
a receiver 701, a memory 702, a processor 703, and a bus 704.
The receiver 701, the memory 702, and the processor 703 are connected by a bus 704.
The receiver 701 is configured to receive a first alarm, where the first alarm includes an occurrence time and a cancellation time of the first alarm, and a first alarm type to which the first alarm belongs.
The memory 702 is used for storing a program and a first alarm received by the receiver 701.
The processor 703 is configured to determine whether a duration of a first alarm received by the receiver 701 is smaller than a first compression interval, where the duration of the first alarm is a time difference between a first alarm occurrence time and a first alarm elimination time, the first compression interval is determined by an alarm flashing rule, and the alarm flashing rule includes a correspondence between multiple alarm types and compression intervals, where each alarm type has one and only one compression interval corresponding to the alarm type in the correspondence.
If the duration of the first alarm received 701 by the receiver is less than the first compression interval, the first alarm is compressed.
It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.
In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.
The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application may be substantially implemented or contributed to by the prior art, or all or part of the technical solution may be embodied in a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.
The above embodiments are only used for illustrating the technical solutions of the present application, and not for limiting the same; although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and the modifications or the substitutions do not make the essence of the corresponding technical solutions depart from the scope of the technical solutions of the embodiments of the present application.

Claims (20)

1. An alarm processing method, comprising:
receiving a first alarm, wherein the first alarm comprises the occurrence time and the elimination time of the first alarm and a first alarm type to which the first alarm belongs;
updating a first probability density function according to the first alarm to obtain an updated first probability density function, wherein the argument of the updated first probability density function consists of the duration of the first alarm and the duration of the alarm belonging to the first alarm type and received before the first alarm is received, and the duration of the first alarm is the time difference between the occurrence time and the elimination time of the first alarm;
and updating the first compression interval of the first alarm type according to the updated first probability density function to obtain an updated first compression interval, wherein the updated first compression interval is used for compressing a second alarm when the second alarm received in real time belongs to the first alarm type and the duration of the second alarm is less than the updated first compression interval.
2. The method of claim 1, wherein updating the first compression interval for the first alarm type according to the updated first probability density function comprises:
calculating the first compression interval using the updated first probability density function and a number of preset parameters.
3. The method of claim 1, wherein after receiving the first alert, further comprising:
judging whether the first alarm type exists in a preset incompressible list or not;
and if so, setting the numerical value of the updated first compression interval to be zero.
4. The method of claim 1, wherein after updating the first probability density function based on the first alert, further comprising:
reading the duration of a plurality of alarms with the maximum value in the updated first probability density function;
judging whether the duration of the plurality of alarms accords with linear distribution or not;
and if so, setting the numerical value of the updated first compression interval to be zero.
5. The method of claim 1, wherein after updating the first probability density function based on the first alert, further comprising:
calculating a proportion that the duration of the alarm in the first probability density function is less than a preset default compression interval;
judging whether the proportion is smaller than a preset proportion or not;
and if so, setting the numerical value of the updated first compression interval to be zero.
6. The method according to any of claims 1-5, wherein said updating a first probability density function according to the first alert comprises:
caching the first alarm;
judging whether the storage amount of the cached alarm reaches a preset storage amount or not;
if so, updating the first probability density function by using the duration of the alarm belonging to the first alarm type in the cached alarms to obtain the updated first probability density function.
7. The method of claim 6, wherein caching the first alert comprises:
calculating the time difference between the occurrence time of the first alarm and the current time;
judging whether the time difference is smaller than a preset time difference or not;
and if so, caching the first alarm.
8. An alarm processing device, comprising:
the first receiving module is used for receiving a first alarm, wherein the first alarm comprises the occurrence time and the elimination time of the first alarm and a first alarm type to which the first alarm belongs;
a first updating module, configured to update a first probability density function according to the first alarm received by the first receiving module to obtain an updated first probability density function, where an argument of the updated first probability density function is composed of a duration of the first alarm and a duration of an alarm belonging to the first alarm type received before the first alarm is received, and the duration of the first alarm is a time difference between an occurrence time and a cancellation time of the first alarm;
and the second updating module updates the first compression interval of the first alarm type according to the updated first probability density function updated by the first updating module to obtain an updated first compression interval, wherein the updated first compression interval is used for compressing a second alarm received in real time when the second alarm belongs to the first alarm type and the duration of the second alarm is less than the updated first compression interval.
9. The alarm processing device of claim 8, wherein the second updating module is specifically configured to:
calculating the first compression interval using the updated first probability density function updated by the first updating module and a number of preset parameters.
10. The alert processing apparatus of claim 8, further comprising:
the first judging module is used for judging whether the first alarm type received by the first receiving module exists in a preset incompressible list or not;
and the first setting module is used for setting the numerical value of the updated first compression interval to be zero if the judgment result of the first judging module is yes.
11. The alert processing apparatus of claim 8, further comprising:
the reading module is used for reading the duration of a plurality of alarms which are updated by the first updating module and have the largest numerical value in the updated first probability density function;
the second judging module is used for judging whether the duration time of the plurality of alarms acquired by the reading module accords with linear distribution or not;
and the second setting module is used for setting the numerical value of the updated first compression interval to be zero if the judgment result of the second judgment module is in line.
12. The alert processing apparatus of claim 8, further comprising:
a calculating module, configured to calculate a ratio that a duration of an alarm in the updated first probability density function is smaller than a preset default compression interval, where the alarm is updated by the first updating module;
the third judging module is used for judging whether the proportion calculated by the calculating module is smaller than a preset proportion or not;
and the third setting module is used for setting the numerical value of the updated first compression interval to be zero if the judgment result of the third judging module is yes.
13. The alert processing apparatus according to any one of claims 8 to 12, wherein the first update module comprises:
the cache unit is used for caching the first alarm received by the first receiving module;
the judging unit is used for judging whether the storage amount of the alarm cached by the caching unit reaches a preset storage amount;
and if the judgment result of the judgment unit is yes, the updating unit is used for updating the first probability density function by using the duration of the alarm belonging to the first alarm type in the cache unit to obtain the updated first probability density function.
14. The alarm processing device according to claim 13, wherein the cache unit comprises:
the calculating subunit is configured to calculate a time difference between the occurrence time of the first alarm and the current time, which is received by the first receiving module;
the judging subunit is used for judging whether the time difference calculated by the calculating subunit is smaller than a preset time difference;
and the cache subunit is used for caching the first alarm if the judgment result of the judgment subunit is yes.
15. An alarm processing device, comprising:
a receiver, a memory, a processor, and a bus;
the receiver, the memory, and the processor are connected by the bus;
the receiver is used for receiving a first alarm, wherein the first alarm comprises the occurrence time and the elimination time of the first alarm and a first alarm type to which the first alarm belongs;
the memory is used for storing a program and the first alarm received by the receiver;
the processor is configured to update a first probability density function according to the first alarm to obtain an updated first probability density function, wherein an argument of the updated first probability density function is composed of a duration of the first alarm and a duration of an alarm belonging to the first alarm type received before the first alarm is received, and the duration of the first alarm is a time difference between an occurrence time and a cancellation time of the first alarm;
updating a first compression interval of the first alarm type according to the updated first probability density function to obtain an updated first compression interval, wherein the updated first compression interval is used for compressing a second alarm when the second alarm received in real time belongs to the first alarm type and the duration of the second alarm is less than the updated first compression interval;
the memory is further configured to store the updated first probability density function updated by the processor and the updated first compression interval.
16. An alarm processing method, comprising:
receiving a first alarm, wherein the first alarm comprises the occurrence time and the elimination time of the first alarm and a first alarm type to which the first alarm belongs;
judging whether the duration of the first alarm is smaller than a first compression interval, wherein the duration of the first alarm is the time difference between the occurrence time and the elimination time of the first alarm, the first compression interval is determined by an alarm flash rule, the alarm flash rule comprises a plurality of alarm types and a corresponding relation between compression intervals, each alarm type in the corresponding relation has only one corresponding compression interval, and the compression interval is determined according to a default compression interval, the maximum allowable value of the compression interval and a preset step length;
and if so, compressing the first alarm.
17. The method of claim 16, wherein before determining whether the duration of the first alert is less than the first compression interval, further comprising:
and receiving an alarm flash rule, wherein the alarm flash rule comprises the first alarm type and the first compression interval corresponding to the first alarm type.
18. An alarm processing device, comprising:
the second receiving module is used for receiving a first alarm, wherein the first alarm comprises the occurrence time and the elimination time of the first alarm and a first alarm type to which the first alarm belongs;
a fourth determining module, configured to determine whether the duration of the first alarm received by the second receiving module is smaller than a first compression interval, where the duration of the first alarm is a time difference between an occurrence time and a removal time of the first alarm, the first compression interval is determined by an alarm flashing rule, the alarm flashing rule includes a correspondence between multiple alarm types and a compression interval, each alarm type in the correspondence has one and only one compression interval corresponding to the alarm type, and the compression interval is determined according to a default compression interval, a maximum allowable value of the compression interval, and a preset step length;
and the compression module compresses the first alarm if the judgment result of the fourth judgment module is positive.
19. The alert processing apparatus of claim 18, further comprising:
and the third receiving module is used for receiving an alarm flash rule, wherein the alarm flash rule comprises the first alarm type and the first compression interval corresponding to the first alarm type.
20. An alarm processing device, comprising:
a receiver, a memory, a processor, and a bus;
the receiver, the memory and the processor are connected by a bus;
the receiver is used for receiving a first alarm, wherein the first alarm comprises the occurrence time and the elimination time of the first alarm and a first alarm type to which the first alarm belongs;
the memory is used for storing a program and the first alarm received by the receiver;
the processor is configured to determine whether a duration of the first alarm received by the receiver is less than a first compression interval, where the duration of the first alarm is a time difference between an occurrence time of the first alarm and an elimination time, the first compression interval is determined by an alarm flashing rule, the alarm flashing rule includes a correspondence between a plurality of alarm types and compression intervals, and each alarm type in the correspondence has one and only one compression interval corresponding to the alarm type;
and if the duration of the first alarm received by the receiver is less than a first compression interval, compressing the first alarm.
CN201610063905.2A 2016-01-29 2016-01-29 Alarm processing method and alarm processing equipment Active CN107026745B (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201610063905.2A CN107026745B (en) 2016-01-29 2016-01-29 Alarm processing method and alarm processing equipment
PCT/CN2016/096876 WO2017128712A1 (en) 2016-01-29 2016-08-26 Alarm processing method and device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201610063905.2A CN107026745B (en) 2016-01-29 2016-01-29 Alarm processing method and alarm processing equipment

Publications (2)

Publication Number Publication Date
CN107026745A CN107026745A (en) 2017-08-08
CN107026745B true CN107026745B (en) 2020-07-07

Family

ID=59397396

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201610063905.2A Active CN107026745B (en) 2016-01-29 2016-01-29 Alarm processing method and alarm processing equipment

Country Status (2)

Country Link
CN (1) CN107026745B (en)
WO (1) WO2017128712A1 (en)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109714180B (en) * 2017-10-26 2022-03-04 中兴通讯股份有限公司 Method for reducing redundant alarm, corresponding equipment and storage medium
CN108667655B (en) * 2018-04-23 2021-09-07 新华三技术有限公司 Interface alarming method, device, network management system and computer readable medium
CN110730100B (en) * 2019-10-21 2022-03-08 中国民航信息网络股份有限公司 Alarm information processing method and device and server
EP4030252B1 (en) * 2021-01-18 2023-05-10 Siemens Aktiengesellschaft Load management in the display of an alarm message display

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007003214A1 (en) * 2005-07-06 2007-01-11 Telecom Italia S.P.A Method and system for identifying faults in communication networks
CN102820995A (en) * 2008-11-18 2012-12-12 华为技术有限公司 Alarm processing method, device and system
CN103378981A (en) * 2012-04-16 2013-10-30 中兴通讯股份有限公司 Method for handling oscillation alarm in network management system and apparatus
CN103856339A (en) * 2012-12-04 2014-06-11 中国移动通信集团广西有限公司 Method and device for compressing alarm information
CN104168137A (en) * 2014-08-08 2014-11-26 蓝盾信息安全技术有限公司 Alarm compressing method

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100589418C (en) * 2007-12-10 2010-02-10 中兴通讯股份有限公司 The generation method and the generation system of alarm correlation rule
CN101355446B (en) * 2008-08-20 2011-05-11 中兴通讯股份有限公司 Compression treatment method for alarm report and apparatus for compressing alarm
CN101958803A (en) * 2010-09-09 2011-01-26 中兴通讯股份有限公司 Alarm compression system and method based on communication network

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007003214A1 (en) * 2005-07-06 2007-01-11 Telecom Italia S.P.A Method and system for identifying faults in communication networks
CN102820995A (en) * 2008-11-18 2012-12-12 华为技术有限公司 Alarm processing method, device and system
CN103378981A (en) * 2012-04-16 2013-10-30 中兴通讯股份有限公司 Method for handling oscillation alarm in network management system and apparatus
CN103856339A (en) * 2012-12-04 2014-06-11 中国移动通信集团广西有限公司 Method and device for compressing alarm information
CN104168137A (en) * 2014-08-08 2014-11-26 蓝盾信息安全技术有限公司 Alarm compressing method

Also Published As

Publication number Publication date
CN107026745A (en) 2017-08-08
WO2017128712A1 (en) 2017-08-03

Similar Documents

Publication Publication Date Title
CN107026745B (en) Alarm processing method and alarm processing equipment
CN109039833B (en) Method and device for monitoring bandwidth state
CN113407507B (en) Method, device and system for generating alarm type association rule and storage medium
CN102546216B (en) Method for processing alarm messages in network management system and network management system
EP3852420B1 (en) Method and device for determining load threshold
CN103220173B (en) A kind of alarm monitoring method and supervisory control system
JPH08307524A (en) Method and equipment for discriminating risk in abnormal conditions of constitutional element of communication network
CN107204894A (en) The monitoring method and device of network servicequality
CN106254137B (en) The alarm root analysis system and method for supervisory systems
EP2454848A1 (en) Method and apparatus for telecommunications network performance anomaly events detection and notification
CN112953738B (en) Root cause alarm positioning system, method and device and computer equipment
CN110955586A (en) System fault prediction method, device and equipment based on log
WO2018125628A1 (en) A network monitor and method for event based prediction of radio network outages and their root cause
CN110650060A (en) Processing method, equipment and storage medium for flow alarm
CN110677480A (en) Node health management method and device and computer readable storage medium
WO2017082782A1 (en) Managing network alarms
CN113190423A (en) Service data monitoring method, device and system
CN110875841A (en) Alarm information pushing method and device and readable storage medium
CN109756372B (en) Elastic expansion method and device for telecommunication charging system
CN111339466A (en) Interface management method and device, electronic equipment and readable storage medium
CN111082956A (en) Event stream processing method, electronic device and readable storage medium
CN111263120B (en) Video equipment online time counting method and device based on stream calculation and terminal
CN102547789B (en) Early warning method, device and system for quality of peer-to-peer service
CN109684182B (en) Method and device for predicting influence of network congestion on network quality
CN106793093A (en) A kind of method for processing business and device

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant