CN108322318A - Alert analysis method and apparatus - Google Patents
Alert analysis method and apparatus Download PDFInfo
- Publication number
- CN108322318A CN108322318A CN201710033521.0A CN201710033521A CN108322318A CN 108322318 A CN108322318 A CN 108322318A CN 201710033521 A CN201710033521 A CN 201710033521A CN 108322318 A CN108322318 A CN 108322318A
- Authority
- CN
- China
- Prior art keywords
- node
- alarming
- server
- accessed
- alarm
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/12—Discovery or management of network topologies
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The embodiment of the present invention provides a kind of alert analysis method and apparatus, is applied to Network Management System, and the Network Management System includes server and multiple nodes, the method includes：Server obtains the alarm that at least one alarming node reports, and the alarming node is that the node of alarm is generated in the multiple node；The server determines root because alerting corresponding destination node according to the accessed node list of the topological decomposition result and each alarming node of the multiple node at least one alarming node；Wherein, the topological decomposition result includes the priority ranking alerted as root because of alarm that the multiple node generates, and the priority ranking is determined according to the out-degree of each node in the multiple node.The embodiment of the present invention reduces the enforcement difficulty of alarm root cause analysis while promoting alarm root because of analysis efficiency.
Description
Technical field
The present embodiments relate to technical field of network management more particularly to a kind of alert analysis method and apparatus.
Background technology
It usually will appear failure in information system, for the ease of the management of information system, often through fault warning side
Formula carrys out fault point, but with the increase of equipment in information system, the scale and complexity of information system show finger
The growth of several levels.
In practical applications, Network Management System receives the largely warning information from information system, and a large amount of
It is root because of warning information often there was only a small amount of warning information in warning information, but technical staff is difficult in a large amount of warning information
In find root because of warning information.In order to find root because of warning information, alarm root of the prior art based on system status monitoring
It is realized because analyzing.Specifically, in network element to after Network Management System report and alarm information, Network Management System passes through failure
Front and back system mode it was found that system exception point, such as link is abnormal, warping apparatus, then by abnormal point with reporting
Alarm between correspondence come determine root because alarm.For example, network element A has reported alarm 1, network element B to report alarm 2, net
Network manages system by the system mode before and after failure it was found that system exception point is network element A and network element C, it is determined that network element
The corresponding alarms 1 of A are root because of alarm.
However, the alarm root cause analysis based on system status monitoring, needs the state for fully monitoring whole system, causes
The expense of system is larger, and enforcement difficulty is high；Also needed to after alarm spend longer time to the system mode before and after failure into
Row leads to the inefficiency for alerting root cause analysis it was found that system exception point.
Invention content
The embodiment of the present invention provides a kind of alert analysis method and apparatus, to reduce the overhead of alert analysis process,
While promoting alarm root because of analysis efficiency, the enforcement difficulty of alarm root cause analysis is reduced.
In a first aspect, the embodiment of the present invention provides a kind of alert analysis method, it is applied to Network Management System, the network
Management system includes server and multiple nodes, the method includes：
Server obtains the alarm that at least one alarming node reports, and server is according to the topological decomposition results of multiple nodes
With the accessed node list of each alarming node, determine root because alerting corresponding destination node at least one alarming node；
Wherein, alarming node is that the node of alarm is generated in multiple nodes, and topological decomposition result includes that multiple nodes generate
Alarm as root because of the priority ranking of alarm, priority ranking be according to the out-degree of each node in multiple nodes determination
, optionally, accessed node list includes the mark of each node and the mark of the corresponding accessed node of each node.It should
The mark of accessed node includes the mark of the mark and dereference node of direct accessed node.
Server by the accessed node list of the topological decomposition result and each alarming node of the multiple nodes pre-established,
Determine that root because alerting corresponding destination node, need not monitor the state of whole system, reduce at least one alarming node
The expense of system, and system mode need not be compared, while promoting alarm root because of analysis efficiency, also reduce
Alert the enforcement difficulty of root cause analysis.
In a kind of possible design, topological decomposition result and each announcement of the server according to the multiple node
The accessed node list of alert node determines root because of the corresponding destination node of alarm at least one alarming node, including：
The server is according to the accessed node list of the priority ranking and each alarming node, in alarming node
Target alarms node and target access alarming node are excluded successively, and the target alarms node is the alarming node of current residual
The middle highest alarming node of alert priority；For primary condition, the alarming node of current residual is all alarming nodes,
It executes after excluding operation, the alarming node of current residual is then surplus after excluding target alarms node and target access alarming node
Remaining alarming node；
The target access alarming node is the accessed node of the target alarms node, and target access alarm saves
The alarming node that point alerts for generation；
The server determines root because alerting corresponding destination node according to the target alarms node being excluded.
By excluding target alarms node and target access alarming node, by communication topology by the target alarms node
Alarm caused by propagating is excluded, and so as to quickly position root because alerting corresponding destination node, improves root because of alarm
Acquisition efficiency.
In a kind of possible design, the server is according to the access section of the priority ranking and each alarming node
Point list excludes target alarms node and target access alarming node successively in alarming node, including：
The server establishes alarming node set, and the alarming node set includes at least one alarm section
Point, the target alarms node and the alarming node that the target access alarming node is in the alarming node set；
The server determines highest first alarming node of alert priority in the alarming node set, to described
Processing is marked in first alarming node；According to the accessed node list of first alarming node, to the alarming node collection
It closes and executes delete operation, wherein first alarming node and the first access alarming node be the node being deleted, described the
One alarming node is the target alarms node in the alarming node set, and described first accesses alarming node saves for the alarm
Target access alarming node in point set, described first accesses the accessed node that alarming node is first alarming node；
Determine that alert priority highest second is accused in remaining node of the server in the alarming node set
Alert node, processing is marked to second alarming node；According to the accessed node list of second alarming node, to institute
It states alarming node set and executes delete operation；Wherein, second alarming node and the second access alarming node are deleted
Node, second alarming node be the alarming node set in target alarms node, it is described second access alarm section
Point is the target access alarming node in the alarming node set, and described second accesses alarming node as the second alarm section
The accessed node of point；
The remaining node in the alarming node set is marked the process of processing and delete operation in repetition, until institute
It states alarming node collection and is combined into sky；
The server determines root because of the corresponding destination node of alarm according to the target alarms node being excluded, including：
The server obtains root because alerting corresponding destination node according to the alarming node of labeled processing.
In a kind of possible design, server determines highest first alarm of alert priority in alarming node set
Processing is marked to the first alarming node in alarming node set in node；It is arranged according to the accessed node of the first alarming node
Table executes delete operation to alarming node set, wherein and the first access alarming node be the node being deleted, described the
One alarming node is the target alarms node in the alarming node set, and described first accesses alarming node saves for the alarm
Target access alarming node in point set, first accesses the accessed node that alarming node is the first alarming node；
Determine that alarm is preferential in remaining node of the server in alarming node set in addition to first alarming node
Highest second alarming node of grade, processing is marked to the second alarming node in alarming node set；According to the second alarm
The accessed node list of node executes delete operation to alarming node set, wherein the second access alarming node is to be deleted
The node removed, second alarming node are the target alarms node in the alarming node set, and described second accesses alarm
Node is the target access alarming node in the alarming node set, and second accesses the visit that alarming node is the second alarming node
Ask node；
It repeats that the remaining node in addition to labeled node in alarming node set is marked processing and deleted to grasp
The process of work, until only existing labeled alarming node in alarming node set；Server according to labeled alarming node,
Root is obtained because alerting corresponding destination node.The label processing of the present embodiment can be in alarming node set to alarming node
It is hidden and/or locks, to prevent labeled alarming node to be identified priority again, and/or, prevent labeled announcement
Alert node is accidentally deleted.
So that the implementation process for excluding to access alarming node can by excluding access alarming node in alarming node set
Orderly to carry out, processing is marked to target alarms node so that final root is recognizable because alerting corresponding destination node,
It ensure that the correctness of destination node.
In a kind of possible design, the server obtains the alarm that at least one alarming node reports, including：
The server obtains the alarm that at least one alarming node reports in preset time range.
In a kind of possible design, topological decomposition result and each announcement of the server according to the multiple node
The accessed node list of alert node, before determining root because of the corresponding destination node of alarm at least one alarming node,
Further include：
The server obtains the access relational data that each node reports, and the access relational data includes accessing
The mark of node and the mark of access node；Wherein, the accessed node in the access relational data is the accessed section
The direct accessed node of point；
The server obtains the first communication topology according to the access relational data；
The server obtains the topological decomposition result according to the out-degree of each node in first communication topology
With the accessed node list.
Each node only needs to report access relational data, server need not be by other equipments such as gateways just to server
The first communication topology can be obtained so that the process for obtaining the first communication topology is easily achieved.
In a kind of possible design, the server obtains the first communication topology according to the access relational data, packet
It includes：
The server establishes initial communication topology according to the access relational data；
Multiple Node compressions on same loop in the initial communication topology are a virtual section by the server
Point obtains first communication topology.
By being a dummy node by multiple Node compressions on the same loop in initial communication topology so that deposited
In the communication topology of communications loop, alert analysis method provided in this embodiment can also be applied, expands the suitable of the present embodiment
With range so that the present embodiment can cope with various communication topologies.
In a kind of possible design, the server according to the out-degree of each node in first communication topology,
The topological decomposition result and the accessed node list are obtained, including：
The node that out-degree in first communication topology is 0 is carried out removal processing by the server, and it is logical to obtain second
Letter topology and first removes node；
The node that out-degree in second communication topology is 0 is carried out removal processing by the server, and it is logical to obtain third
Letter topology and second removes node；
It repeats remove the process of processing by out-degree for 0 node, until all nodes are removed；
The server obtains the topological decomposition result and the accessed node list according to the node removed every time.
In a kind of possible design, the server obtains the topological decomposition result according to the node removed every time,
Including：
The server obtains the topology and decomposes knot according to the corresponding sequencing for removing processing of each removal node
Fruit；
Wherein, the same priority for removing the node being moved out of in processing procedure is identical, and the priority that N removes node is big
The priority of node is removed in N+1, the N is the integer more than 0.
Server is according to the corresponding sequencing for removing processing of each removal node, so that it may excellent with the alarm for obtaining each node
First grade sequence, server implementation process is fairly simple, need not carry out cumbersome operation, reduce the burden of server.
In a kind of possible design, the server obtains the accessed node list according to the node removed every time,
Including：
The first node that an out-degree is zero is often removed, the server determines corresponding second section of the first node
Point, the second node are the direct accessed node of the first node；
The server stores the second node into the corresponding accessed node list of the first node；
The server judges that the first node whether there is in the accessed node list of third node, if so,
The second node is stored into the accessed node list of the third node；
The server traverses all removed nodes, obtains institute successively in order according to the removal sequence of each node
State accessed node list；
Wherein, include the void in the accessed node list if including dummy node in the accessed node list
The corresponding all ancestor nodes of quasi- node.
The removal sequence for the node that server is zero according to each out-degree, can obtain accessed node list, the accessed node
List includes not only direct accessed node, further includes dereference node so that server, can be with according to the accessed node list
The alarm for excluding the topological broadcast caused by the node, improves the accuracy of alert analysis, and server implementation process compares
Simply, cumbersome operation need not be carried out, the burden of server is reduced.
Second aspect, the embodiment of the present invention provide a kind of server, are applied to Network Management System, the Network Management Department
System includes the server and multiple nodes, the method includes：
Acquisition module, the alarm reported for obtaining at least one alarming node are alerted, the alarming node is described more
The node of alarm is generated in a node；
Determining module is alerted, the access of the topological decomposition result and each alarming node according to the multiple node is used for
Node listing determines root because alerting corresponding destination node at least one alarming node；
Wherein, the topological decomposition result includes the priority row alerted as root because of alarm that the multiple node generates
Sequence, the priority ranking are determined according to the out-degree of each node in the multiple node.
In a kind of possible design, the alarm determining module is specifically used for：
According to the accessed node list of the priority ranking and each alarming node, mesh is excluded successively in alarming node
Alarming node and target access alarming node are marked, the target alarms node is preferential to be alerted in the alarming node of current residual
The highest alarming node of grade, the target access alarming node are the accessed node of the target alarms node, and the target
It is to generate the alarming node of alarm to access alarming node；
According to the target alarms node being excluded, determine root because alerting corresponding destination node.
In a kind of possible design, the alarm determining module is specifically used for：
Alarming node set is established, the alarming node set includes at least one alarming node, the target
Alarming node and the alarming node that the target access alarming node is in the alarming node set；
Highest first alarming node of alert priority is determined in the alarming node set, and first alarm is saved
Processing is marked in point；According to the accessed node list of first alarming node, deletion is executed to the alarming node set
Operation, wherein first alarming node and first access alarming node be deleted node, first alarming node
Alarming node is accessed as in the alarming node set for the target alarms node in the alarming node set, described first
Target access alarming node；
Highest second alarming node of alert priority is determined in remaining node in the alarming node set, to institute
It states the second alarming node and processing is marked；According to the accessed node list of second alarming node, to the alarming node
Set executes delete operation；Wherein, second alarming node and the second access alarming node are deleted node, described
Second alarming node is the target alarms node in the alarming node set, and described second accesses alarming node as the alarm
Target access alarming node in node set；
The remaining node in the alarming node set is marked the process of processing and delete operation in repetition, until institute
It states alarming node collection and is combined into sky；
According to the alarming node of labeled processing, root is obtained because alerting corresponding destination node.
In a kind of possible design, the alarm acquisition module is specifically used for：
The alarm that at least one alarming node reports is obtained in preset time range.
In a kind of possible design, further include：Relation acquisition module, relationship processing module and generation module；Wherein
The Relation acquisition module, the access relational data reported for obtaining each node, the access relation number
According to the mark of the mark and access node that include accessed node；
The relationship processing module, for according to the access relational data, obtaining the first communication topology；
The generation module obtains the topology for the out-degree according to each node in first communication topology
Decomposition result and the accessed node list.
In a kind of possible design, the relationship processing module is specifically used for：
According to the access relational data, initial communication topology is established；
It is a dummy node by multiple Node compressions on the same loop in the initial communication topology, described in foundation
First communication topology.
In a kind of possible design, the generation module is specifically used for：
The node that out-degree in first communication topology is 0 is subjected to removal processing, obtains the second communication topology and the
One removes node；
The node that out-degree in second communication topology is 0 is subjected to removal processing, obtains third communication topology and the
Two remove node；
It repeats remove the process of processing by out-degree for 0 node, until all nodes are removed；
According to the node removed every time, the topological decomposition result and the accessed node list are obtained.
In a kind of possible design, the generation module is specifically used for：
According to the corresponding sequencing for removing processing of each removal node, the topological decomposition result is obtained；
Wherein, the same priority for removing the node being moved out of in processing procedure is identical, and the priority that N removes node is big
The priority of node is removed in N+1, the N is the integer more than 0.
In a kind of possible design, the generation module is specifically used for：
The first node that an out-degree is zero is often removed, determines the corresponding second node of the first node, described second
Node is the direct accessed node of the first node；
The second node is stored into the corresponding accessed node list of the first node；
Judge that the first node whether there is in the accessed node list of third node, if so, by described second
Node is stored into the accessed node list of the third node；
According to the removal of each node sequence, traverses all removed nodes successively in order, obtain the accessed node
List；
Wherein, include the void in the accessed node list if including dummy node in the accessed node list
The corresponding all ancestor nodes of quasi- node.
The third aspect, the embodiment of the present invention provide a kind of server, including：At least one processor and memory；
The memory stores computer executed instructions；
At least one processor executes the computer executed instructions of the memory storage so that the server is held
The above-mentioned various alert analysis methods that offer may be provided of row.
A kind of computer readable storage medium is also provided in the embodiment of the present invention, is stored in computer readable storage medium
Computer executed instructions, when at least one processor of server executes the computer executed instructions, server executes above-mentioned
It is various that the alert analysis method provided may be provided.
A kind of computer program product is also provided in the embodiment of the present invention, which includes that computer executes
Instruction, the computer executed instructions store in a computer-readable storage medium.At least one processor of server can be from
Computer readable storage medium reads the computer executed instructions, and at least one processor executes the computer executed instructions and makes
The above-mentioned various alert analysis methods that offer may be provided of server implementation.
Description of the drawings
Fig. 1 is the configuration diagram of Network Management System provided in an embodiment of the present invention；
Fig. 2 is the flow diagram one of alert analysis method provided in an embodiment of the present invention；
Fig. 3 is alarm schematic diagram provided in an embodiment of the present invention；
Fig. 4 is the network topology schematic diagram of telecommunication system provided in an embodiment of the present invention；
Fig. 5 is the flow diagram two of alert analysis method provided in an embodiment of the present invention；
Fig. 6 is the structural schematic diagram of the first communication topology provided in an embodiment of the present invention；
Fig. 7 is the structural schematic diagram of the second communication topology provided in an embodiment of the present invention；
Fig. 8 is the structural schematic diagram of the third communication provided in an embodiment of the present invention topology；
Fig. 9 is the structural schematic diagram of fourth communication provided in an embodiment of the present invention topology；
Figure 10 is the flow diagram three of alert analysis method provided in an embodiment of the present invention；
Figure 11 is the alarm schematic diagram one of telecommunication system provided in an embodiment of the present invention；
Figure 12 is the alarm schematic diagram two of telecommunication system provided in an embodiment of the present invention；
Figure 13 is the structural schematic diagram of server provided in an embodiment of the present invention；
Figure 14 is the hardware architecture diagram of server provided in an embodiment of the present invention.
Specific implementation mode
Fig. 1 is the configuration diagram of Network Management System provided in an embodiment of the present invention.Network pipe provided in this embodiment
Reason system includes server and multiple nodes.There is the relationship for accessing and being accessed between multiple nodes.Access between node
Relationship forms network topology.Node provided in this embodiment can be various network elements.In Fig. 1, between two nodes
Arrow " → " represents access relation, such as node E → node B, represents node E accessed nodes B.For example, node E can be to
Node B sends service request, and either node E calls interface of node B etc. or node E to read data etc. from node B.Wherein,
Node B is access node, and node E is the direct accessed node of node B.For node C → node D → node E, then it represents that section
Point D accessed node E, node C accessed nodes D.In the present embodiment, node D is the accessed node of node E, and node D is to node E
With access process, node C is the dereference node of node E, and node C does not have access process to node E.In following implementation
In example, if not otherwise specified, involved accessed node includes direct accessed node and dereference node.
In the present embodiment, each node periodically can report access relational data to server, which is
Include the mark of accessed node and the mark of access node.Wherein, the accessed node in the access relational data is institute
State the direct accessed node of access node；Server can establish the accessed node of each node according to the access relational data
List and topological decomposition result.Wherein, to include the alarm that generates of multiple nodes excellent because of alarm as root for topological decomposition result
First grade sequence.Accessed node list includes the mark of each node and the mark of corresponding accessed node.For specifically establishing
Process will be described in detail in following embodiments.
When node occurs abnormal, node can be to server report and alarm.It will be understood by those skilled in the art that alarm is
It is propagated along communication topology.For example, in the embodiment shown in fig. 1, when node B and node G are alerted, node B is root
Because of alarm, i.e. the alarm of node B is the triggering alarm of node G.If a certain node only exists accessed situation, may be not present
To the situation that other nodes access, then when generating alarm on the node, root is because of alarm " oneself caused by can only being
Body ".Based on this, server can be according to the accessed node list pre-established and topological decomposition result, in the section of report and alarm
In point, determine root because alerting corresponding node, to while promoting alarm root because of analysis efficiency, also reduce alarm root because
The enforcement difficulty of analysis.With reference to Fig. 2 and Fig. 3, the embodiment of the present invention is described in detail.
Fig. 2 is the flow diagram one of alert analysis method provided in an embodiment of the present invention, and Fig. 3 carries for the embodiment of the present invention
The alarm schematic diagram of confession.As shown in Fig. 2, this method includes：
S201, server obtain the alarm that at least one alarming node reports, and the alarming node is the multiple node
The middle node for generating alarm；
In conjunction with shown in Fig. 1, when node B, node G, the node H in multiple nodes in Fig. 1 generate alarm, for the ease of
Illustrate, the node for generating alarm is marked in Fig. 3, and the node for generating alarm is known as alarming node.Such as Fig. 3 institutes
Show, node B generates alarm 1, node G generates alarm 2, node H generates alarm 3, node F generates alarm 4.Alarming node, that is, node
B, respectively to server report and alarm, server obtains the alarm that alarming node reports by node G, node H, node F.
It will be understood by those skilled in the art that server can within a preset period of time obtain at least one alarming node
The alarm of report.Specifically, which can be that server is pre-set.For example, the server pre-set time
Section can with half an hour for a stage, i.e., every half an hour, what server statistics were once reported in the period alarming node
Alarm.The signal of preset time period can be 8:31-8:32、8:32-8:33、8:33-8:34 etc..For example, reaching 8:32 it
Afterwards, server statistics 8:31-8:32 alarms reported, i.e., 8:31 alarms reported in corresponding 60 seconds, to obtain at least one
The alarm that a alarming node reports.
S202, the server are according to the access section of the topological decomposition result and each alarming node of the multiple node
Point list determines root because alerting corresponding destination node at least one alarming node；
Wherein, the accessed node list includes the mark and the corresponding accessed node of each node of each node
Mark, the topology decomposition result includes priority ranking of the alarm that generates of the multiple node as root because of alarm, institute
Stating priority ranking is determined according to the out-degree of each node in the multiple node.
In the present embodiment, accessed node list includes the mark and the corresponding access section of each node of each node
The mark of point.The mark of the accessed node includes the mark of the mark and dereference node of direct accessed node.For example, scheming
In 3, the accessed node of node B includes not only node E, further includes node H, node G, node D, node C, node A.The access section
Point list can be the list that server is pre-established according to communication topology.For network topology shown in FIG. 1, table one is shown
A kind of possible sequence of accessed node list.
Table one
| Node | Accessed node list |
| Node A | Node D, node C, node H |
| Node B | Node E, node H, node G, node D, node C, node A |
| Node C | |
| Node D | Node C |
| Node E | Node H, node G, node D, node C, node A |
| Node F | |
| Node G | Node H, node D |
| Node H | |
| Node I | Node H |
It will be understood by those skilled in the art that table one gives a kind of possible realization method of accessed node list.
During specific implementation, there can also be other realization methods.For example, it is also possible to which each node respectively corresponds to the access section of oneself
Point list.Such as table two provides a possible way of realization by taking node A as an example.For the specific implementation of accessed node list
Mode, the present embodiment are not particularly limited herein.
Table two
In the present embodiment, topological decomposition result includes the priority row alerted as root because of alarm that multiple nodes generate
Sequence is that server is determined according to the out-degree of each node.Wherein, it is starting that out-degree, which refers to a certain node, is directed toward other sections
The number on the side of point.Communication topology can regard a digraph as, and in communication topology, out-degree refers to being with a node
Begin, the quantity for other nodes which directly accesses.Such as in figure 3, the out-degree of node D is 3.Server can be according to logical
The out-degree of each node carries out topological decomposition in letter topology, pre-establishes topological decomposition result.In specific decomposable process, first will
Out-degree be 0 node removed, wherein the highest priority for the node being moved out of, i.e., first by out-degree be 0 node B, node
F, node I is removed, the node priority highest being moved out of, and then in remaining communication topology, continues to move out the section that out-degree is 0
The preferential level of point, the node being moved out of is high, repeats the above process, until the number of nodes in communication topology is 0.For Fig. 1
Shown in network topology, table three shows a kind of possible realization method of priority ranking.
Table three
| Node | Priority | Node | Priority |
| Node B | 1 | Node G | 3 |
| Node F | 1 | Node D | 4 |
| Node I | 1 | Node H | 4 |
| Node E | 2 | Node C | 5 |
| Node A | 3 |
It is to embody priority in digital form in the priority ranking shown in table three, the smaller priority of number
It is higher.During specific implementation, priority concrete implementation mode, the present embodiment is not particularly limited herein, as long as can
Express the priority ranking of each node.
Server can be according to the accessed node of the topological decomposition result and each alarming node of the multiple nodes pre-established
List determines root because alerting corresponding destination node at least one alarming node.Specifically, server is arranged according to priority
The accessed node list of sequence and each alarming node, excluded successively in alarming node the high target alarms node of priority and
Target access alarming node, the target alarms node are the highest alarm section of alert priority in the alarming node of current residual
Point, target access alarming node is the accessed node of target alarms node, and the target access alarming node is to generate alarm
Alarming node, server determines root because alerting corresponding destination node according to the target alarms node being excluded.
For example, node B generates alarm 1, node G generates alarm 2, node H generates alarm 3, node F generates alarm 4.By table
Three it is found that node B as root because of the highest priority of alarm, then node B and node are excluded in alarming node according to table one
The corresponding access alarming nodes of B exclude node B, node H and node G.At this point, remaining node F, then save in remaining alarm
In point, the alarming node of highest priority is node F, and without other alarming nodes, then final root because alarm be node B and
The alarm that node F is generated.If it will be understood by those skilled in the art that the alarming node of highest priority is node F at this time, and going back
There are other alarming nodes, then the corresponding access alarming nodes of node F is excluded according to table one, and so on, until surplus without node
It is remaining.
Alert analysis method provided in this embodiment, server is in the alarm for getting at least one alarming node and reporting
Afterwards, server is according to the accessed node list of the topological decomposition result and each alarming node of the multiple nodes pre-established, extremely
It determines that root because alerting corresponding destination node, need not monitor the state of whole system in a few alarming node, reduces and be
The expense of system, and can quickly determine root because accusing according only to the topological decomposition result and accessed node list pre-established
It is alert, system mode need not be compared, while promoting alarm root because of analysis efficiency, also reduce alarm root cause analysis
Enforcement difficulty.
Below by taking Network Management System is specially telecommunication system as an example, in conjunction with network topology shown in Fig. 4, to of the invention real
The alert analysis method for applying example offer is described in detail.Fig. 4 is the network topology of telecommunication system provided in an embodiment of the present invention
Schematic diagram.As shown in figure 4, schematically illustrating the communication topology between several nodes, shown node includes in Fig. 4
Set-top box (Set Top Box, STB), media entertainment management middleware (Media Entertainment Middleware,
MEM), system for unified management (Unified Management System, UMS), Integration Bus (Integration Bus,
IB), Media Delivery Network (Media Delivery Network, MDN), quasi-video request program, carousel television server (Near
Video on Demand, NVOD Server), condition access (Conditional Access, CA), File Transfer Protocol
(File Transfer Protocol, FTP) server, fast channel switching (Fast Channel Change, FCC), number
User line access multiplexing device (Digital Subscriber Line Access Multiplexer, DSLAM), network time association
Discuss (Network Time Protocol, NTP) server.
The above-mentioned realization method for only schematically illustrating several nodes in telecommunication system, other realizations for node
Mode, the present embodiment are not particularly limited herein.
Illustrate that topological decomposition result and the specific of accessed node list establish process first below.
Fig. 5 is the flow diagram two of alert analysis method provided in an embodiment of the present invention.As shown in figure 5, this method packet
It includes：
S501, the server obtain the access relational data that each node reports, and are wrapped in the access relational data
Include the mark of accessed node and the mark of access node.
Node is responsible for extraction and the relevant call relation data of the node, and each node can periodically report access relation number
According to the access relational data includes the mark of accessed node and the mark of access node.
In one possible implementation, basic call relation data can be indicated with two tuples, i.e., (visit
The side of asking is accessed side), reality can include other additional informations in the middle, and such as (access side, accessed square, additional information 1 is attached
Add information 2 ..., additional information n).
Node is more diversified to the means for calling the extraction of relation data, is referred to existing method, can also tie
It closes system features and designs more efficient way, the limitation of the use of specific method not as the embodiment of the present invention.
Below a simple example is provided to be based on network state information extraction access relational data：In consideration system
Two node A, node B, it is assumed that node B accesses the service in node A, then believing from the network state of node A
It can be found that there is connection between the service listening port of the IP and node A of node B in breath.In above-mentioned hypothesis scene, node A
Two tuples of an expression access relation, wherein access side can be extracted from its network state information with the IP of node B
Location indicates, is accessed the IP address that side is node A and indicates, i.e., (IP address of node B, the IP address of node A).Further basis
IP can obtain two tuple of access relation between node with the correspondence between node, i.e. (node B, node A).IP is with section
Correspondence between point is present in usually as the essential information of node in management system, or can be according in management system
The essential information of node is established.
Optionally, server is after getting the access relational data that each node reports, and server is to access relational data
Statistics is carried out to summarize, filter.Wherein statistics remittance general purpose is to carry out the data with identical access side and accessed side
It integrates, removes duplicate keys；Filtering purpose be the call relation data unrelated with Operational Visit of the generations such as standby to heartbeat, calamity into
Row is rejected.
For network topology shown in Fig. 4, after statistics summarizes and filters, remaining access relational data, which constitutes, is
The Operational Visit relationship of system.It is assumed that the Operational Visit relationship of system is as shown in Table 4.
Table four
| Access side | Accessed side | Access side | Accessed side |
| STB | CA | IB | UMS |
| STB | MDN | IB | MDN |
| STB | MEM | UMS | IB |
| STB | NTP | UMS | MEM |
| STB | DSLAM | MDN | CA |
| MEM | CA | MDN | FCC |
| MEM | IB | MDN | NVODServer |
| IB | CA | NVOD Server | MDN |
| IB | MEM | CA | FTP |
S502, the server obtain the first communication topology according to the access relational data.
Server can obtain initial communication topology as shown in Figure 4 according to access relational data shown in table four.Scheming
In 4, in initial communication topology, there are loop, therefore need will be more on the same loop in initial communication topology for server
A Node compression is a dummy node, establishes the first communication topology.
It will be understood by those skilled in the art that if obtain initial communication topology as shown in Figure 1, be not present loop,
The initial communication topology is the first communication topology, need not carry out compression processing again.
Please continue to refer to Fig. 4, in communication topology shown in Fig. 4, compression processing, MDN → NVOD are needed there are two loop
Server → MDN and UMS → MEM → IB → UMS.Specifically, MDN and NVOD Server are interconnected to form loop, by two
Node compression is a dummy node MDN_NVOD Server.Since NVOD Server only exist the connection of MDN, so only
It needs the connection for being connected to MDN_NVOD Server and other nodes of MDN and other nodes.
Although UMS and IB, MEM and IB form respectively loop in Fig. 4, they are generally a big ring
Road, so being a dummy node MEM_UMS_IB by three Node compressions.There is the connection to CA in MEM and IB, for void
For quasi- node M EM_UMS_IB, retain one.Meanwhile converting the connection of STB to MEN to STB to MEM_UMS_IB
Connection, convert the connection of IB to MDN to the connection of MEM_UMS_IB to MDN, obtained compressed communication topology, i.e.,
One communication topology.Fig. 6 is the structural schematic diagram of the first communication topology provided in an embodiment of the present invention.
S503, the server obtain the topology point according to the out-degree of each node in first communication topology
Solve result and the accessed node list.
Specifically, the node that the out-degree in the first communication topology is 0 is carried out removal processing by server, obtains the second communication
Topology and first removes node；The node that out-degree in second communication topology is 0 is carried out removal processing by server, obtains third
Communication topology and second removes node；The node that out-degree is 0 remove the process of processing by repetition, until by all nodes
It removes；Server obtains topological decomposition result and accessed node list according to the node removed every time.Detailed reality is used below
Example is applied, the realization process for obtaining topological decomposition result and accessed node list is described in detail respectively.
Shown in Fig. 6, the out-degree of each node is as shown in Table 5.
Table five
| Node | Out-degree |
| STB | 5 |
| MEM_UMS_IB | 2 |
| MDN_NVODServer | 2 |
| CA | 1 |
| FTP | 0 |
| FCC | 0 |
| DSLAM | 0 |
| NTP | 0 |
The node that out-degree is 0 is removed from first communication topology, the second communication topology and first is obtained and removes node.
In the process, it after a certain node is removed, can be also removed with the relevant connection of the node.The out-degree of remaining node also can
It changes, needs the out-degree for recalculating remaining node.According to table five, tetra- nodes of FTP, FCC, DSLAM, NTP
Out-degree is 0, and four nodes are removed from the first communication topology shown in fig. 6, obtains the second communication topology and first and removes
Node FTP, FCC, DSLAM, NTP.Fig. 7 is the structural schematic diagram of the second communication topology provided in an embodiment of the present invention.
It will be understood by those skilled in the art that as shown in fig. 7, after NTP is removed, the connection of STB to NTP can also be moved
It removes, according to the computational methods of out-degree, the out-degree of STB should subtract one.The out-degree of each node is such as in second communication topology shown in Fig. 7
Shown in table six.
Table six
| Node | Out-degree |
| STB | 3 |
| MEM_UMS_IB | 2 |
| MDN_NVODServer | 1 |
| CA | 0 |
According to table six, the out-degree of CA is 0, therefore CA nodes are removed in the second communication topology, obtains the third communication
Topology and second removes node CA.Fig. 8 is the structural schematic diagram of the third communication provided in an embodiment of the present invention topology.Shown in Fig. 8
Third communication topology in each node out-degree it is as shown in Table 7.
Table seven
| Node | Out-degree |
| STB | 2 |
| MEM_UMS_IB | 1 |
| MDN_NVOD Server | 0 |
According to table seven, the out-degree of MDN_NVOD Server is 0, therefore removes MDN_ in third communication topology
NVOD Server nodes, obtain fourth communication topology and third removes node M DN_NVOD Server.Fig. 9 is that the present invention is implemented
The structural schematic diagram for the fourth communication topology that example provides.The out-degree of each node in fourth communication topology shown in Fig. 9 such as table eight
It is shown.
Table eight
| Node | Out-degree |
| STB | 1 |
| MEM_UMS_IB | 0 |
According to table eight, the out-degree of MEM_UMS_IB is 0, therefore removes MEM_UMS_IB in fourth communication topology,
It obtains fifth communication topology and the 4th and removes node M EM_UMS_IB.Finally the STB nodes in fifth communication topology are removed, are obtained
Node STB is removed to the 5th, that is, completes the process for removing all nodes.
It can be obtained removing the node removed in processing procedure every time from above, specifically may refer to shown in table nine.
Table nine
| First removes node | FTP、FCC、DSLAM、NTP |
| Second removes node | CA |
| Third removes node | MDN_NVOD Server |
| 4th removes node | MEM_UMS_IB |
| 5th removes node | STB |
Server is ranked up topological node according to the sequence that topology is decomposed.Specifically, according to each removal node pair
The sequencing for the removal processing answered, obtains topological decomposition result.Wherein, the node being moved out of in same removal processing procedure
Priority is identical.Specifically, the highest priority of node is removed for the first time, second of node priority for removing processing time is high,
And so on.For the node on loop, the priority of all nodes on loop is equal to respective virtual node
Priority.Finally obtained priority ranking is as shown in Table 10.
Table ten
| Node | Serial number | Node | Serial number |
| FCC | 1 | MDN | 3 |
| DSLAM | 1 | NVOD_Server | 3 |
| NTP | 1 | MEM | 4 |
| FTP | 1 | UMS | 4 |
| CA | 2 | IB | 4 |
| STB | 5 |
Wherein, serial number is smaller, and corresponding priority is higher, results in topological decomposition result.
Optionally, during above-mentioned removal node, while accessed node list is generated.Figure 10 is that the present invention is implemented
The flow diagram three for the alert analysis method that example provides.As shown in Figure 10, this method includes：
S1001, the first node that an out-degree is zero often being removed, server determines the corresponding second node of first node,
Second node is the direct accessed node of first node；
S1002, server store second node into the corresponding accessed node list of first node；
S1003, server judge that first node whether there is in the accessed node list of third node, if so, executing
S1004, if it is not, executing S1005；
S1004, server store second node into the accessed node list of third node；
S1005, server traverse all removed nodes, obtain successively in order according to the removal sequence of each node
Accessed node list.
Wherein, corresponding comprising dummy node in accessed node list if including dummy node in accessed node list
All ancestor nodes.
By taking a specific example as an example, when removing the first removal node FTP, server is true according to present communications topology
It is CA to determine the corresponding direct accessed nodes of FTP, and CA is stored into the corresponding accessed node lists of FTP, then serviced by server
Device judges that FTP whether there is in the accessed node list of other nodes, if not existing, server continues to determine the access of FCC
Node, server determine that the corresponding direct accessed nodes of FCC are MDN_NVOD Server, by MDN_ according to present communications topology
NVOD Server are stored into the corresponding accessed node lists of FCC, and then server judges that FCC whether there is in other nodes
Accessed node list in, and so on；In the process, for example, when MDN-NVOD Server are moved out of, server root
Determine that the corresponding direct accessed nodes of MDN_NVOD Server are STB, MEM_UMS_IB according to present communications topology, server will
STB, MEM_UMS_IB are stored into the accessed node list of MDN_NVOD Server, judge MDN_NVOD Server in FCC
Accessed node list in, then STB, MEM_UMS_IB are also stored into the accessed node list of FCC, and so on.By
The above process, finally obtained accessed node list is as shown in table 11.
Table 11
| Node | Accessed node list |
| STB | |
| MEM_UMS_IB | STB |
| MDN_NVOD Server | MEM_UMS_IB, STB |
| CA | MDN_NVODServer, MEM_UMS_IB, STB |
| FTP | CA, MDN_NVOD Server, MEM_UMS_IB, STB |
| FCC | MDN_NVODServer, MEM_UMS_IB, STB |
| DSLAM | STB |
| NTP | STB |
For the node on loop, the visit of the accessed node list and corresponding dummy node of the node on loop
Ask that node listing is identical.If the accessed node list of MEM_UMS_IB is STB, then the accessed node list of MEM, UMS, IB is
STB。
If including dummy node in the accessed node list of some node, then it is equivalent in the access list of the node
Including the corresponding all ancestor nodes of dummy node.As CA accessed node list in comprising MDN_NVOD Server, then it is equivalent
Include MDN, NVOD Server in the accessed node list of CA.
It will be understood by those skilled in the art that due to being compressed to the node in loop, in the present embodiment
Access relation in accessed node list is unidirectional access relation, that is, only exists the way of realization of node A accessed nodes B, do not deposit
In the way of realization of node B accessed nodes A.
After obtaining topological decomposition result and accessed node list, so that it may to determine root because of alarm.Herein with above-mentioned
Telecommunication system for, to determining that root is illustrated again because of the specific implementation of alarm.The present embodiment provides following possibility
Embodiment, for other similar modes, all in the protection domain of the embodiment of the present invention.
In one possible implementation, server determines alert priority highest first in alarming node set
Processing is marked to the first alarming node in alarming node；According to the accessed node list of the first alarming node, to alarming node
Set execute delete operation, wherein the first alarming node and first access alarming node be deleted node.First accesses
Alarming node is the node in alarming node set, and first accesses the accessed node that alarming node is the first alarming node, alarm
Node set includes at least two alarming nodes, determines that alarm is preferential in remaining node of the server in alarming node set
Highest second alarming node of grade, processing is marked to the second alarming node；It is arranged according to the accessed node of the second alarming node
Table executes delete operation to alarming node set, wherein the second alarming node and the second access alarming node be deleted
Node, second accesses alarming node as the node in alarming node set, and second accesses alarming node as the second alarming node
Accessed node；The remaining node in alarming node set is marked the process of processing and delete operation in repetition, until alarm
Node set is sky；Server obtains root because alerting corresponding destination node according to the alarming node of labeled processing.This implementation
The mark mode of example can be to store the alarming node to root because in alarm list, or to this in initial communication topology
Alarming node is marked, and for the specific implementation of label, the present embodiment is not particularly limited herein.
In alternatively possible realization method, server determines alert priority highest the in alarming node set
Processing is marked to the first alarming node in alarming node set in one alarming node；According to the access of the first alarming node
Node listing executes delete operation to alarming node set, wherein the first access alarming node is the node being deleted, alarm
Node set includes multiple alarming nodes, and first accesses alarming node as the node in alarming node set, and first accesses announcement
Alert node is the accessed node of the first alarming node；Server is in alarming node set in addition to first alarming node
Highest second alarming node of alert priority is determined in remaining node, and the second alarming node in alarming node set is carried out
Label processing；According to the accessed node list of the second alarming node, delete operation is executed to alarming node set, wherein second
The node that alarming node is deleted is accessed, second accesses alarming node as the node in alarming node set, and the second access is accused
Alert node is the accessed node of the second alarming node；It repeats to the remaining section in addition to labeled node in alarming node set
The process of processing and delete operation is marked in point, until only existing labeled alarming node in alarming node set；Service
Device obtains root because alerting corresponding destination node according to labeled alarming node.The present embodiment label processing can be
Alarming node is hidden and/or is locked in alarming node set, it is excellent to prevent labeled alarming node to be identified again
First grade, and/or, prevent labeled alarming node from accidentally being deleted.
Below for above-mentioned telecommunication system, two specific embodiments are provided to be described in detail.
Figure 11 is the alarm schematic diagram one of telecommunication system provided in an embodiment of the present invention.As shown in chart 11, share at three
Alarm, alarm collection are combined into { alarm 1, alarm 2, alarm 3 }, and the alarming node collection for generating alarm is combined into { FTP, MDN, STB }.According to
Shown in table nine, the serial number of FTP is minimum, so will 1 label of alarm.According to table 11, the accessed node list of FTP be CA,
MDN_NVODServer, MEM_UMS_IB, STB } namely { CA, MDN, NVOD Server, MEM, UMS, IB, STB }, so needing
FTP, MDN, STB are deleted from alarming node set, while 1 (label alarm) will be alerted, 2 (being generated by MDN) of alarm, accused
Alert 3 (being generated by STB) are deleted in gathering from alarm.At this point, remaining alarming node set and remaining alarm set are sky, alarm
Root cause analysis terminates, the final alarm for determining root and being generated for alarm 1, i.e. FTP by alarm.
Figure 12 is the alarm schematic diagram two of telecommunication system provided in an embodiment of the present invention.As shown in chart 12, share everywhere
Alarm, alarm collection are combined into { alarm 1, alarm 2, alarm 3, alarm 4 }, the alarming node collection for generating alarm be combined into FCC, MDN,
STB、CA}.According to table nine, the serial number of FCC is minimum, so will 1 label of alarm.According to table 11, the access section of FCC
Point list be { MDN_NVOD Server, MEM_UMS_IB, STB }, namely MDN, NVOD Server, MEM, UMS, IB,
STB }, so need to delete FCC, MDN, STB from alarming node set, while will alarm 1 (label alarm), alarm 2 (by
MDN generate), alarm 3 (being generated by STB) from alarm gather in delete.At this point, remaining alarming node collection is combined into { CA }, residue is accused
Alert collection is combined into { alarm 4 }.It will be apparent that needing to remove in by 4 label of alarm and by it gathering from alarm, while CA being saved from alarm
It is removed in point set.So far, alarm root cause analysis terminates.Because alarm is alerts 1, alarm 4, i.e. FCC and CA are produced final determining root
Raw alarm.
It will be understood by those skilled in the art that be directed to dummy node, if the dummy node is root because alerting corresponding target
Node, then all nodes in dummy node are all root because of alarm.Alarm is generated accordingly, at least two nodes in loop
When or at least two node be all root because alerting corresponding node or alarm all non-root that the two generates are because of alarm.Example
Such as, MDN shown in Fig. 4 generates alarm 1, NVOD Server generate alarm 2, otherwise the alarm that then the two generates all is confirmed as
It is non-because the node of alarm is that the alarm that MDN and NVOD Server or the two generate all is confirmed as to generate root because of alarm for root
Root is because of alarm.Other loops are similar, and details are not described herein again for the present embodiment.
To sum up, the embodiment of the present invention is directly based upon topological decomposition result and carries out judgement of the root because of alarm, independent of artificial
Intervention analysis directly uses, institute wherein topological decomposition result can be obtained ahead of time according to communication topology when alerting root cause analysis
It is very high with the efficiency of analysis；And the embodiment of the present invention can complete system communication in time according to the variation of the call relation reported
The update of topology, so having the ability of reply system dynamic change.Meanwhile the acquisition accessed node list of the embodiment of the present invention
All fairly simple with the realization process of the process of topological decomposition result, and alarm root cause analysis etc., only call relation extracts
There are certain complexities, so whole technology enforcement difficulty is relatively low.Further, the resource overhead of the embodiment of the present invention
Relatively small, only call relation reports the resource consumption of link more apparent.
The above-mentioned function of being realized for server, is described scheme provided in an embodiment of the present invention.It can manage
Solution, for server in order to realize above-mentioned function, it comprises execute the corresponding hardware configuration of each function and/or software mould
Block.In conjunction with each exemplary unit and algorithm steps that the disclosed embodiments of the embodiment of the present invention describe, energy of the embodiment of the present invention
The combining form with hardware or hardware and computer software is reached to realize.Some function is driven with hardware or computer software actually
The mode of hardware is moved to execute, depends on the specific application and design constraint of technical solution.Those skilled in the art can be with
Described function is realized using different methods to each specific application, but this realization is it is not considered that beyond this
The range of the technical solution of inventive embodiments.
The embodiment of the present invention can carry out server according to the above method example division of function module, for example, can be with
Corresponding each function divides each function module, and two or more functions can also be integrated in a processing unit
In.The form that hardware had both may be used in above-mentioned integrated unit is realized, can also be realized in the form of software function module.It needs
It is noted that be schematical, only a kind of division of logic function to the division of module in the embodiment of the present invention, it is practical real
It is current that there may be another division manner.
Figure 13 is the structural schematic diagram of server provided in an embodiment of the present invention.As shown in figure 13, which wraps
It includes：Alert acquisition module 1301 and alarm determining module 1302.Optionally, further include Relation acquisition module 1303, Automated generalization
Module 1304 and generation module 1305.
Acquisition module 1301 is alerted, the alarm reported for obtaining at least one alarming node, the alarming node is institute
State the node that alarm is generated in multiple nodes；
Determining module 1302 is alerted, for according to the topological decomposition result of the multiple node and each alarming node
Accessed node list determines root because alerting corresponding destination node at least one alarming node；
Wherein, the topological decomposition result includes the priority row alerted as root because of alarm that the multiple node generates
Sequence, the priority ranking are determined according to the out-degree of each node in the multiple node.
Optionally, the alarm determining module 1302 is specifically used for：
According to the accessed node list of the priority ranking and each alarming node, mesh is excluded successively in alarming node
Alarming node and target access alarming node are marked, the target alarms node is preferential to be alerted in the alarming node of current residual
The highest alarming node of grade, the target access alarming node are the accessed node of the target alarms node, and the target
It is to generate the alarming node of alarm to access alarming node；
According to the target alarms node being excluded, determine root because alerting corresponding destination node.
Optionally, the alarm determining module 1302, is specifically used for：
Alarming node set is established, the alarming node set includes at least one alarming node, the target
Alarming node and the alarming node that the target access alarming node is in the alarming node set；
Highest first alarming node of alert priority is determined in the alarming node set, and first alarm is saved
Processing is marked in point；According to the accessed node list of first alarming node, deletion is executed to the alarming node set
Operation, wherein first alarming node and first access alarming node be deleted node, first alarming node
Alarming node is accessed as in the alarming node set for the target alarms node in the alarming node set, described first
Target access alarming node；
Highest second alarming node of alert priority is determined in remaining node in the alarming node set, to institute
It states the second alarming node and processing is marked；According to the accessed node list of second alarming node, to the alarming node
Set executes delete operation；Wherein, second alarming node and the second access alarming node are deleted node, described
Second alarming node is the target alarms node in the alarming node set, and described second accesses alarming node as the alarm
Target access alarming node in node set；
The remaining node in the alarming node set is marked the process of processing and delete operation in repetition, until institute
It states alarming node collection and is combined into sky；
According to the alarming node of labeled processing, root is obtained because alerting corresponding destination node.
Optionally, the alarm acquisition module 1301, is specifically used for：
The alarm that at least one alarming node reports is obtained in preset time range.
Optionally, the Relation acquisition module 1303, the access relational data reported for obtaining each node are described
Access relational data includes the mark of accessed node and the mark of access node；
The relationship processing module 1304, for according to the access relational data, obtaining the first communication topology；
The generation module 1305 obtains described for the out-degree according to each node in first communication topology
Topological decomposition result and the accessed node list.
Optionally, the relationship processing module 1304, is specifically used for：
According to the access relational data, initial communication topology is established；
It is a dummy node by multiple Node compressions on the same loop in the initial communication topology, described in foundation
First communication topology.
Optionally, the generation module 1305, is specifically used for：
The node that out-degree in first communication topology is 0 is subjected to removal processing, obtains the second communication topology and the
One removes node；
The node that out-degree in second communication topology is 0 is subjected to removal processing, obtains third communication topology and the
Two remove node；
It repeats remove the process of processing by out-degree for 0 node, until all nodes are removed；
According to the node removed every time, the topological decomposition result and the accessed node list are obtained.
Optionally, the generation module 1305, is specifically used for
According to the corresponding sequencing for removing processing of each removal node, the topological decomposition result is obtained；
Wherein, the same priority for removing the node being moved out of in processing procedure is identical, and the priority that N removes node is big
The priority of node is removed in N+1, the N is the integer more than 0.
Optionally, the generation module 1305, is specifically used for：
The first node that an out-degree is zero is often removed, determines the corresponding second node of the first node, described second
Node is the direct accessed node of the first node；
The second node is stored into the corresponding accessed node list of the first node；
Judge that the first node whether there is in the accessed node list of third node, if so, by described second
Node is stored into the accessed node list of the third node；
According to the removal of each node sequence, traverses all removed nodes successively in order, obtain the accessed node
List；
Wherein, include the void in the accessed node list if including dummy node in the accessed node list
The corresponding all ancestor nodes of quasi- node.
Server provided in this embodiment can execute above method embodiment, and implementing principle and technical effect are similar,
Details are not described herein again for the present embodiment.
Server above-mentioned in the specific implementation, alarm acquisition module and Relation acquisition module may be implemented as communication connect
Mouthful, alarm determining module, relationship processing module and generation module may be implemented as processor.Data and program code can be deposited
Storage in memory, is controlled according to corresponding program instruction by processor and is executed.
Figure 14 is the hardware architecture diagram of server provided in an embodiment of the present invention.As shown in figure 14, the present embodiment carries
The server 1400 of confession includes：At least one processor 1401, memory 1402 and bus 1403.Optionally, further include communication
Interface 1404.Memory 1402 stores computer executed instructions；At least one processor 1401 executes what memory 1402 stored
Computer executed instructions so that server executes the alert analysis method as described in figure 1 above to Figure 12.
In addition, a kind of computer readable storage medium is also provided in the embodiment of the present invention, in computer readable storage medium
Computer executed instructions are stored with, when at least one processor of server executes the computer executed instructions, server is held
The above-mentioned various alert analysis methods that offer may be provided of row.
A kind of computer program product is also provided in the embodiment of the present invention, which includes that computer executes
Instruction, the computer executed instructions store in a computer-readable storage medium.At least one processor of server can be from
Computer readable storage medium reads the computer executed instructions, and at least one processor executes the computer executed instructions and makes
The various alert analysis methods that offer may be provided in server implementation preceding method embodiment.
One of ordinary skill in the art will appreciate that：Realize that all or part of step of above-mentioned each method embodiment can lead to
The relevant hardware of program instruction is crossed to complete.Program above-mentioned can be stored in a computer read/write memory medium.The journey
When being executed, execution includes the steps that above-mentioned each method embodiment to sequence；And storage medium above-mentioned includes：ROM, RAM, magnetic disc or
The various media that can store program code such as person's CD.
Finally it should be noted that：The above various embodiments is only to illustrate the technical solution of the embodiment of the present invention, rather than to it
Limitation；Although the embodiment of the present invention is described in detail with reference to foregoing embodiments, those skilled in the art
It should be understood that：Its still can with technical scheme described in the above embodiments is modified, either to which part or
All technical features carries out equivalent replacement；And these modifications or replacements, it does not separate the essence of the corresponding technical solution this hair
The range of bright embodiment technical solution.
Claims (19)
1. a kind of alert analysis method, which is characterized in that be applied to Network Management System, the Network Management System includes service
Device and multiple nodes, the method includes：
Server obtains the alarm that at least one alarming node reports, and the alarming node is that alarm is generated in the multiple node
Node；
The server according to the accessed node list of the topological decomposition result and each alarming node of the multiple node,
Determine root because alerting corresponding destination node at least one alarming node；
Wherein, the topological decomposition result includes the priority ranking alerted as root because of alarm that the multiple node generates,
The priority ranking is determined according to the out-degree of each node in the multiple node.
2. according to the method described in claim 1, it is characterized in that, the server is decomposed according to the topology of the multiple node
As a result with the accessed node list of each alarming node, determine that root is corresponding because alerting at least one alarming node
Destination node, including：
The server is according to the accessed node list of the priority ranking and each alarming node, in alarming node successively
Exclude target alarms node and target access alarming node, the target alarms node be current residual alarming node in accuse
The alarming node of alert highest priority, the target access alarming node are the accessed node of the target alarms node, and institute
It is to generate the alarming node of alarm to state target access alarming node；
The server determines root because alerting corresponding destination node according to the target alarms node being excluded.
3. according to the method described in claim 2, it is characterized in that, the server is according to the priority ranking and each announcement
The accessed node list of alert node, excludes target alarms node and target access alarming node successively in alarming node, wraps
It includes：
The server establishes alarming node set, and the alarming node set includes at least one alarming node, institute
It is the alarming node in the alarming node set that target alarms node, which is stated, with the target access alarming node；
The server determines highest first alarming node of alert priority in the alarming node set, to described first
Processing is marked in alarming node；According to the accessed node list of first alarming node, the alarming node set is held
Row delete operation, wherein first alarming node and the first access alarming node be deleted node, first announcement
Alert node is the target alarms node in the alarming node set, and described first accesses alarming node as the alarming node collection
Target access alarming node in conjunction；
The highest second alarm section of alert priority is determined in remaining node of the server in the alarming node set
Processing is marked to second alarming node in point；According to the accessed node list of second alarming node, to the announcement
Alert node set executes delete operation；Wherein, second alarming node and the second access alarming node are deleted section
Point, second alarming node are the target alarms node in the alarming node set, and the second access alarming node is
Target access alarming node in the alarming node set；
The remaining node in the alarming node set is marked the process of processing and delete operation in repetition, until the announcement
Alert node set is sky；
The server determines root because of the corresponding destination node of alarm according to the target alarms node being excluded, including：
The server obtains root because alerting corresponding destination node according to the alarming node of labeled processing.
4. according to the method described in claim 1, it is characterized in that, the server obtains what at least one alarming node reported
Alarm, including：
The server obtains the alarm that at least one alarming node reports in preset time range.
5. method according to any one of claims 1 to 4, which is characterized in that the server is according to the multiple node
Topological decomposition result and each alarming node accessed node list, at least one alarming node determine root because
Before alerting corresponding destination node, further include：
The server obtains the access relational data that each node reports, and the access relational data includes accessed node
Mark and access node mark, the accessed node is the direct accessed node of the access node；
The server obtains the first communication topology according to the access relational data；
The server obtains the topological decomposition result and institute according to the out-degree of each node in first communication topology
State accessed node list.
6. according to the method described in claim 5, it is characterized in that, the server is obtained according to the access relational data
First communication topology, including：
The server establishes initial communication topology according to the access relational data；
Multiple Node compressions on same loop in the initial communication topology are a dummy node by the server, are obtained
To first communication topology.
7. according to the method described in claim 6, it is characterized in that, the server is according to every in first communication topology
The out-degree of a node obtains the topological decomposition result and the accessed node list, including：
The node that out-degree in first communication topology is 0 is carried out removal processing by the server, is obtained the second communication and is opened up
It flutters and removes node with first；
The node that out-degree in second communication topology is 0 is carried out removal processing by the server, is obtained the third communication and is opened up
It flutters and removes node with second；
It repeats remove the process of processing by out-degree for 0 node, until all nodes are removed；
The server obtains the topological decomposition result and the accessed node list according to the node removed every time.
8. the method according to the description of claim 7 is characterized in that the server obtains institute according to the node removed every time
Topological decomposition result is stated, including：
The server obtains the topological decomposition result according to the corresponding sequencing for removing processing of each removal node；
Wherein, same to remove that the priority of node being moved out of in processing procedure is identical, the priority that N removes node is more than the
N+1 removes the priority of node, and the N is the integer more than 0.
9. the method according to the description of claim 7 is characterized in that the server obtains institute according to the node removed every time
Accessed node list is stated, including：
The first node that an out-degree is zero is often removed, the server determines the corresponding second node of the first node, institute
State the direct accessed node that second node is the first node；
The server stores the second node into the corresponding accessed node list of the first node；
The server judges that the first node whether there is in the accessed node list of third node, if so, by institute
Second node is stated to store into the accessed node list of the third node；
The server traverses all removed nodes, obtains the visit successively in order according to the removal sequence of each node
Ask node listing；
Wherein, include the virtual section in the accessed node list if including dummy node in the accessed node list
The corresponding all ancestor nodes of point.
10. a kind of server, which is characterized in that be applied to Network Management System, the Network Management System includes the service
Device and multiple nodes, the method includes：
Acquisition module, the alarm reported for obtaining at least one alarming node are alerted, the alarming node is the multiple section
The node of alarm is generated in point；
Determining module is alerted, the accessed node of the topological decomposition result and each alarming node according to the multiple node is used for
List determines root because alerting corresponding destination node at least one alarming node；
Wherein, the topological decomposition result includes the priority ranking alerted as root because of alarm that the multiple node generates,
The priority ranking is determined according to the out-degree of each node in the multiple node.
11. server according to claim 10, which is characterized in that the alarm determining module is specifically used for：
According to the accessed node list of the priority ranking and each alarming node, target announcement is excluded successively in alarming node
Alert node and target access alarming node, the target alarms node be current residual alarming node in alert priority most
High alarming node, the target access alarming node are the accessed node of the target alarms node, and the target access
Alarming node is to generate the alarming node of alarm；
According to the target alarms node being excluded, determine root because alerting corresponding destination node.
12. server according to claim 11, which is characterized in that the alarm determining module is specifically used for：
Alarming node set is established, the alarming node set includes at least one alarming node, the target alarms
Node and the alarming node that the target access alarming node is in the alarming node set；
Alert priority highest first alarming node is determined in the alarming node set, to first alarming node into
Line flag processing；According to the accessed node list of first alarming node, delete operation is executed to the alarming node set,
Wherein, first alarming node and the first access alarming node are deleted node, and first alarming node is institute
The target alarms node in alarming node set is stated, described first accesses alarming node as the target in the alarming node set
Access alarming node；
Alert priority highest second alarming node is determined in remaining node in the alarming node set, to described the
Processing is marked in two alarming nodes；According to the accessed node list of second alarming node, to the alarming node set
Execute delete operation；Wherein, second alarming node and second access alarming node be deleted node, described second
Alarming node is the target alarms node in the alarming node set, and described second accesses alarming node as the alarming node
Target access alarming node in set；
The remaining node in the alarming node set is marked the process of processing and delete operation in repetition, until the announcement
Alert node set is sky；
According to the alarming node of labeled processing, root is obtained because alerting corresponding destination node.
13. server according to claim 10, which is characterized in that the alarm acquisition module is specifically used for：
The alarm that at least one alarming node reports is obtained in preset time range.
14. according to claim 10 to 13 any one of them server, which is characterized in that further include：Relation acquisition module is closed
It is processing module and generation module；Wherein
The Relation acquisition module, the access relational data reported for obtaining each node, in the access relational data
The mark of mark and access node including accessed node；
The relationship processing module, for according to the access relational data, obtaining the first communication topology；
The generation module obtains the topology and decomposes for the out-degree according to each node in first communication topology
As a result with the accessed node list.
15. server according to claim 14, which is characterized in that the relationship processing module is specifically used for：
According to the access relational data, initial communication topology is established；
It is a dummy node by multiple Node compressions on the same loop in the initial communication topology, establishes described first
Communication topology.
16. server according to claim 15, which is characterized in that the generation module is specifically used for：
The node that out-degree in first communication topology is 0 is subjected to removal processing, the second communication topology and first is obtained and moves
Egress；
The node that out-degree in second communication topology is 0 is subjected to removal processing, third communication topology and second is obtained and moves
Egress；
It repeats remove the process of processing by out-degree for 0 node, until all nodes are removed；
According to the node removed every time, the topological decomposition result and the accessed node list are obtained.
17. server according to claim 16, which is characterized in that the generation module is specifically used for
According to the corresponding sequencing for removing processing of each removal node, the topological decomposition result is obtained；
Wherein, same to remove that the priority of node being moved out of in processing procedure is identical, the priority that N removes node is more than the
N+1 removes the priority of node, and the N is the integer more than 0.
18. server according to claim 16, which is characterized in that the generation module is specifically used for：
The first node that an out-degree is zero is often removed, determines the corresponding second node of the first node, the second node
For the direct accessed node of the first node；
The second node is stored into the corresponding accessed node list of the first node；
Judge that the first node whether there is in the accessed node list of third node, if so, by the second node
It stores into the accessed node list of the third node；
According to the removal of each node sequence, traverses all removed nodes successively in order, obtain the accessed node list；
Wherein, include the virtual section in the accessed node list if including dummy node in the accessed node list
The corresponding all ancestor nodes of point.
19. a kind of server, which is characterized in that including：At least one processor and memory；
The memory stores computer executed instructions；
At least one processor executes the computer executed instructions of the memory storage so that the server executes such as
Claim 1 to 9 any one of them alert analysis method.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710033521.0A CN108322318B (en) | 2017-01-16 | 2017-01-16 | Alarm analysis method and equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710033521.0A CN108322318B (en) | 2017-01-16 | 2017-01-16 | Alarm analysis method and equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108322318A true CN108322318A (en) | 2018-07-24 |
| CN108322318B CN108322318B (en) | 2021-04-09 |
Family
ID=62892023
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710033521.0A Active CN108322318B (en) | 2017-01-16 | 2017-01-16 | Alarm analysis method and equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108322318B (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109634819A (en) * | 2018-10-26 | 2019-04-16 | 阿里巴巴集团控股有限公司 | Alarm root is because of localization method and device, electronic equipment |
| CN110351118A (en) * | 2019-05-28 | 2019-10-18 | 华为技术有限公司 | Root is because of alarm decision networks construction method, device and storage medium |
| CN110535686A (en) * | 2019-07-25 | 2019-12-03 | 深圳壹师城科技有限公司 | Anomalous event treating method and apparatus |
| CN110995482A (en) * | 2019-11-27 | 2020-04-10 | 深圳市商汤科技有限公司 | Alarm analysis method and device, computer equipment and computer readable storage medium |
| CN111669282A (en) * | 2019-03-08 | 2020-09-15 | 华为技术有限公司 | Method, device and computer storage medium for identifying suspected root cause alarm |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20120066376A1 (en) * | 2010-09-09 | 2012-03-15 | Hitachi, Ltd. | Management method of computer system and management system |
| US20150008938A1 (en) * | 2008-10-31 | 2015-01-08 | Howard University | System And Method Of Detecting And Locating Intermittent And Other Faults |
| CN104796273A (en) * | 2014-01-20 | 2015-07-22 | 中国移动通信集团山西有限公司 | Method and device for diagnosing root of network faults |
| CN105471659A (en) * | 2015-12-25 | 2016-04-06 | 华为技术有限公司 | Root fault cause analysis method and analysis device |
-
2017
- 2017-01-16 CN CN201710033521.0A patent/CN108322318B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20150008938A1 (en) * | 2008-10-31 | 2015-01-08 | Howard University | System And Method Of Detecting And Locating Intermittent And Other Faults |
| US20120066376A1 (en) * | 2010-09-09 | 2012-03-15 | Hitachi, Ltd. | Management method of computer system and management system |
| CN104796273A (en) * | 2014-01-20 | 2015-07-22 | 中国移动通信集团山西有限公司 | Method and device for diagnosing root of network faults |
| CN105471659A (en) * | 2015-12-25 | 2016-04-06 | 华为技术有限公司 | Root fault cause analysis method and analysis device |
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109634819A (en) * | 2018-10-26 | 2019-04-16 | 阿里巴巴集团控股有限公司 | Alarm root is because of localization method and device, electronic equipment |
| CN109634819B (en) * | 2018-10-26 | 2022-02-01 | 创新先进技术有限公司 | Alarm root cause positioning method and device and electronic equipment |
| CN111669282A (en) * | 2019-03-08 | 2020-09-15 | 华为技术有限公司 | Method, device and computer storage medium for identifying suspected root cause alarm |
| CN111669282B (en) * | 2019-03-08 | 2023-10-24 | 华为技术有限公司 | Method, device and computer storage medium for identifying suspected root cause alarm |
| CN110351118A (en) * | 2019-05-28 | 2019-10-18 | 华为技术有限公司 | Root is because of alarm decision networks construction method, device and storage medium |
| CN110351118B (en) * | 2019-05-28 | 2020-12-01 | 华为技术有限公司 | Root cause alarm decision network construction method, device and storage medium |
| CN110535686A (en) * | 2019-07-25 | 2019-12-03 | 深圳壹师城科技有限公司 | Anomalous event treating method and apparatus |
| CN110535686B (en) * | 2019-07-25 | 2021-12-31 | 深圳壹师城科技有限公司 | Abnormal event processing method and device |
| CN110995482A (en) * | 2019-11-27 | 2020-04-10 | 深圳市商汤科技有限公司 | Alarm analysis method and device, computer equipment and computer readable storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN108322318B (en) | 2021-04-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108322318A (en) | Alert analysis method and apparatus | |
| US6061735A (en) | Network restoration plan regeneration responsive to network topology changes | |
| CN100556038C (en) | A kind of content distribution method based on outer condition trigger node action | |
| CN108712491A (en) | Block chain node, exchange information processing method, terminal device and medium | |
| CN106844220A (en) | A kind of method of testing and system of simulation computer web application real running environment | |
| CN107104824A (en) | A kind of network topology determines method and apparatus | |
| CN110417870A (en) | configuration file management method, device, equipment and storage medium | |
| CN108965918A (en) | streaming media processing method, device, system and computer readable storage medium | |
| CN108696392A (en) | A kind of communications status monitoring method, network node and computer readable storage medium | |
| CN104079430A (en) | Safety management platform, system and method based on information | |
| CN108023759A (en) | Adaptive resource regulating method and device | |
| CN110413498A (en) | A kind of method and system of server O&M large-size screen monitors monitoring | |
| CN114189423A (en) | Intelligent inquiry alarm system, method and medium with comprehensive compatibility and expansion | |
| CN106878038A (en) | Fault Locating Method and device in a kind of communication network | |
| CN110196780A (en) | Determine method, apparatus, storage medium and the electronic device of server state | |
| CN104639450B (en) | The architecture system of packet transmission control method, device and software defined network | |
| WO2012083740A1 (en) | Method and device for detecting warnings | |
| CN105207793B (en) | A kind of acquisition methods and system of tree topology interior joint information | |
| WO2012009911A1 (en) | Method, apparatus and system for processing alarm screening rule | |
| CN106131134A (en) | A kind of message content merges De-weight method and system | |
| CN109120434A (en) | A kind of storage cluster alarm method, device and computer readable storage medium | |
| CN104852849B (en) | A kind of OSPF configuration methods and relevant apparatus | |
| CN101192962B (en) | Generation and recovery method for adhesion value alarm in telecom network management system | |
| CN109446291A (en) | Road network state statistical method and device and computer readable storage medium | |
| CN112714008B (en) | Network topology analysis method, device and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |