CN109510718B

CN109510718B - Alarm information processing method and device

Info

Publication number: CN109510718B
Application number: CN201710835325.5A
Authority: CN
Inventors: 张珺; 葛根华
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2017-09-15
Filing date: 2017-09-15
Publication date: 2020-09-11
Anticipated expiration: 2037-09-15
Also published as: CN109510718A

Abstract

According to the method and the device for processing the alarm information, provided by the embodiment of the invention, FKS is distributed to the alarm through the network equipment, the FKS of the root alarm is determined by the network management equipment according to the FKS carried by the alarm, the same correlation family to which the FKS of the alarm and the FKS of the root alarm belong is determined according to the alarm information of the alarm, and the alarm information is added to the same correlation family, so that the situation that when the alarm quantity is large, the network management equipment needs to traverse all alarms and reports the alarm to the network management equipment before the root alarm, the network equipment needs to update the sub-alarm information or needs to carry all the sub-alarm information while reporting the root alarm is carried is avoided, the search amount is reduced, and the search time is saved.

Description

Alarm information processing method and device

Technical Field

The present application relates to the field of network technologies, and in particular, to a method and an apparatus for processing alarm information.

Background

With the rapid development of communication networks and the expansion of communication services, the management and maintenance of communication networks become more and more difficult. Fault diagnosis is an important step in network fault management, namely, fault sources are analyzed from collected alarm information. The alarm correlation analysis adopts a rule-based analysis method, and plays a very key role in communication network fault maintenance.

Some communication network faults can cause generation of various alarms, and the method is called alarm correlation analysis, wherein the analysis of the incidence relation among the alarms is completed according to a pre-specified model, the root alarm and the derived alarm are identified, and the fault positioning is convenient. Wherein, the alarm is description information of the fault.

After the alarm correlation analysis identifies the root alarm and the derivative alarm, the derivative alarm is inhibited, and the method is called alarm correlation inhibition. Wherein the root alarm means that the fault indicated by the alarm is caused by the cause of the part itself generating the alarm, and the derived alarm means that the fault indicated by the alarm is caused by a fault in another part of the system. In a broad sense, for some derived alarms, since the fault indicated by the alarm may also cause other faults to occur, the alarm may also be regarded as a root alarm of other alarms.

At present, alarm correlation analysis is divided into analysis at an equipment side and analysis at a network management side, wherein a network equipment unit completes the alarm correlation analysis inside the equipment, and a network management device completes the alarm correlation analysis among network equipment. After the alarm correlation analysis switch is opened, the network equipment carries out correlation analysis on the fault alarm and identifies a child alarm and a parent alarm of the current alarm, wherein the child alarm is a next-level alarm associated with the current alarm, and the parent alarm is a previous-level alarm associated with the current alarm, so that whether the current alarm is a root alarm or a derivative alarm is judged. Wherein, one of the sub alarms is a derivative alarm, and the parent alarm can be a derivative alarm or a root alarm. When the network device reports a single alarm to the network management device, the single alarm carries the father alarm instance number of the current alarm, thereby helping the network management device to establish the correlation relationship. After the correlation suppression switch is turned on, only the root alarm is reported to the network management equipment, and the derivative alarm is not reported, so that the alarm concerned by the user is easily missed.

In this case, when the alarm correlation suppression switch is turned off, the alarm amount reported by the network device becomes large, and the network management device has a situation of managing a plurality of network devices, so the alarm amount on the network management device may be large, and when all alarms are reported to the network management device, the network management device needs to traverse all single alarms, and the search amount is large, so that it takes time for the network management device to search for a root alarm according to parent alarm information of the current alarm to establish a correlation relationship.

When the derived alarm is reported to the network management device before the root alarm, the network device needs to update the derived alarm information or carry all the derived alarm information while the root alarm is reported. In practical application, usually, one root alarm has many derived alarms, and no matter the derived alarms are reported with the derived alarms or are directly updated or reported again, a large number of alarms are repeatedly reported due to the large number of derived alarms, so that more communication bandwidth is occupied.

Disclosure of Invention

The embodiment of the invention provides a method and a device for processing alarm information, which are used for solving the problems in the prior art.

In a first aspect, a method for processing alarm information is provided, where the method includes: the method comprises the steps that a network device determines first alarm information according to a first fault detected by the network device, wherein the first alarm information comprises a first alarm instance number and a first father alarm instance number, the first alarm instance number is used for identifying an alarm instance of the first fault, and the first father alarm instance number is used for identifying an alarm instance of a previous-level fault associated with the first fault; the network equipment determines a first family number set according to the first alarm instance number and the first father alarm instance number in the first alarm information, wherein the first family number set is a subset of a root alarm family number set corresponding to the root alarm information, the first family number set and the root alarm family number set belong to the same correlation family, and the same correlation family represents that the first alarm has correlation with a root fault generating the root alarm information; the network equipment generates first alarm reporting information, wherein the first alarm reporting information comprises the first alarm information and the first family number set; and the network equipment sends the first alarm reporting information to network management equipment.

In an implementation manner of the first aspect, the network device determines second alarm information according to a second fault detected by the network device, where the second alarm information includes a second alarm instance number and a second parent alarm instance number, the second alarm instance number is used to identify an alarm instance of the second fault, and the second parent alarm instance number is equal to the first alarm instance number;

the network device determines a second family number set according to the second alarm instance number and the second father alarm instance number in the second alarm information, wherein the second family number set is a subset of the first family number set, and the second family number set belongs to the same correlation family;

the network equipment generates second alarm reporting information, wherein the second alarm reporting information comprises the second alarm information and the second group number set;

and the network equipment sends the second alarm reporting information to network management equipment.

In an implementation manner of the first aspect, the network device determines third alarm information according to a third fault detected by the network device, where the third alarm information includes a third alarm instance number and a third parent alarm instance number, the third alarm instance number is equal to an alarm instance number of a previous fault associated with the first fault, and the third parent alarm instance number is used to identify an alarm instance of the previous fault associated with the third fault;

the network device determines a third family number set according to the third alarm instance number and the third father alarm instance number in the third alarm information, wherein the first family number set is a subset of the third family number set, and the third family number set belongs to the same correlation family;

generating, by the network device, third alarm reporting information, where the third alarm reporting information includes the third alarm information and the third group number set;

and the network equipment sends the third alarm reporting information to network management equipment.

In an implementation manner of the first aspect, the first alarm information is independent alarm information, the first group number set is equal to the root alarm group number set, and the first fault is the root alarm.

In an implementation manner of the first aspect, the third fault is a root fault, the third group number set is equal to the root alarm group number set, and the third alarm information is the same as the root alarm information.

In one implementation of the first aspect, the first set of family numbers includes elements having the same value as the first alarm instance number.

In an implementation manner of the first aspect, the determining, by the network device, first alarm information according to a first fault detected by the network device specifically includes:

the network equipment determines the serial number of the first alarm instance according to the alarm object of the first fault and the alarm identifier of the first fault; and the network equipment searches the upper-level fault associated with the first fault according to the alarm object of the first fault and the alarm identifier of the first fault, and determines the first father alarm instance number according to the instance number of the upper-level fault associated with the first fault.

In a second aspect, a method for processing alarm information is provided, where the method includes: the network management equipment receives first alarm reporting information sent by the network equipment, wherein the first alarm reporting information comprises first alarm information and a first family number set, the first alarm information is determined by the network equipment according to the first fault detected by the network equipment, the first alarm information includes a first alarm instance number and a first parent alarm instance number, the first alarm instance number is used to identify an alarm instance of the first fault, the first parent alarm instance number is used to identify an alarm instance of a higher level fault associated with the first fault, the first family number set is a subset of a root alarm family number set corresponding to the root alarm information, the first family number set and the root cause alarm family number set belong to a first correlation family, and the first correlation family represents that the first fault has correlation with a root cause fault which generates the root cause alarm information; the network management equipment determines the root alarm family number set according to the first family number set, and determines the first family number set and the first correlation family to which the root alarm family number set belongs; the network management device adds the first alarm to the first correlation family according to the first alarm information.

In an implementation manner of the second aspect, the adding, by the network management device, the first alarm to the first correlation family according to the first alarm information specifically includes:

the network management equipment searches a second alarm instance number matched with a first father alarm instance number in the first alarm information in the first correlation family, wherein the second alarm instance number corresponds to a second alarm, and the second alarm belongs to the first correlation family;

when the network management device determines the second alarm instance number matching the first parent alarm instance number in the first alarm information, the network management device adds the first alarm as a child alarm of the second alarm to the first correlation family.

the network management equipment searches a third father alarm instance number matched with a first alarm instance number in the first alarm information in the first correlation family, wherein the third father alarm instance number corresponds to a third alarm, and the third alarm belongs to the first correlation family;

when the network management device determines the third parent alarm instance number matching the first alarm instance number in the first alarm information, the network management device adds the first alarm as the parent alarm of the third alarm to the first correlation family.

In a third aspect, a network device is provided, which includes: the device comprises a determining module, a judging module and a judging module, wherein the determining module is used for determining first alarm information according to a detected first fault, the first alarm information comprises a first alarm instance number and a first father alarm instance number, the first alarm instance number is used for identifying an alarm instance of the first fault, and the first father alarm instance number is used for identifying an alarm instance of a previous-level fault associated with the first fault; a setting module, configured to determine a first family number set according to the first alarm instance number and the first parent alarm instance number in the first alarm information, where the first family number set is a subset of a root alarm family number set corresponding to a root alarm information, the first family number set and the root alarm family number set belong to a same correlation family, and the same correlation family indicates that the first alarm has a correlation with a root fault that generates the root alarm information; a generating module, configured to generate first alarm reporting information, where the first alarm reporting information includes the first alarm information and the first group number set; and the sending module is used for sending the first alarm reporting information to network management equipment.

In an implementation manner of the third aspect, the determining module is further configured to determine second alarm information according to a second fault detected by the network device, where the second alarm information includes a second alarm instance number and a second parent alarm instance number, the second alarm instance number is used to identify an alarm instance of the second fault, and the second parent alarm instance number is equal to the first alarm instance number.

In an implementation manner of the third aspect, the setting module is further configured to determine a second group number set according to the second alarm instance number and the second parent alarm instance number in the second alarm information, where the second group number set is a subset of the first group number set, and the second group number set belongs to the same correlation group.

In an implementation manner of the third aspect, the generating module is further configured to generate second alarm reporting information, where the second alarm reporting information includes the second alarm information and the second group number set.

In an implementation manner of the third aspect, the sending module is further configured to send the second alarm reporting information to a network management device.

In an implementation manner of the third aspect, the determining module is further configured to determine third alarm information according to a third fault detected by the network device, where the third alarm information includes a third alarm instance number and a third parent alarm instance number, the third alarm instance number is equal to an alarm instance number of a previous fault associated with the first fault, and the third parent alarm instance number is used to identify an alarm instance of the previous fault associated with the third fault.

In an implementation manner of the third aspect, the setting module is further configured to determine a third group number set according to the third alarm instance number and the third parent alarm instance number in the third alarm information, where the first group number set is a subset of the third group number set, and the third group number set belongs to the same correlation group.

In an implementation manner of the third aspect, the generating module is further configured to generate third alarm reporting information, where the third alarm reporting information includes the third alarm information and the group iii number set.

In an implementation manner of the third aspect, the sending module is further configured to send the third alarm reporting information to a network management device.

In a fourth aspect, there is provided a network management device, comprising: a receiving module, configured to receive first alarm reporting information sent by a network device, where the first alarm reporting information includes first alarm information and a first group number set, the first alarm information is determined by the network equipment according to the first fault detected by the network equipment, the first alarm information includes a first alarm instance number and a first parent alarm instance number, the first alarm instance number is used to identify an alarm instance of the first fault, the first parent alarm instance number is used to identify an alarm instance of a higher level fault associated with the first fault, the first family number set is a subset of a root alarm family number set corresponding to the root alarm information, the first family number set and the root cause alarm family number set belong to a first correlation family, and the first correlation family represents that the first fault has correlation with a root cause fault which generates the root cause alarm information; a determining module, configured to determine the root alarm family number set according to the first family number set, and determine the first family number set and the first correlation family to which the root alarm family number set belongs; an add module to add the first alert to the first relevance family.

In one implementation manner of the fourth aspect, the network management device may include a processing apparatus for processing the alarm information, and the processing apparatus may include: a receiving module 910, a determining module 920, and an adding module 930.

In a fifth aspect, an embodiment of the present invention provides a communication apparatus, where the communication apparatus may be a network device, and the communication apparatus may implement the functions performed in the method design of the first aspect, where the functions may be implemented by hardware, or may be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-described functions.

In one possible design, the communication apparatus includes a processor configured to enable the device to perform the corresponding functions of the method of the first aspect. The communication device may also include a memory for coupling with the processor that retains program instructions and data necessary for the apparatus. The communication device may also include a communication interface for sending or receiving information or the like.

In a sixth aspect, an embodiment of the present invention provides a communication apparatus, where the communication apparatus may be a terminal device, and the communication apparatus may implement the functions executed in the method design of the second aspect, where the functions may be implemented by hardware, or may be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-described functions.

In a seventh aspect, an embodiment of the present invention provides a chip, where the chip may be disposed in a device, and the chip includes a processor and an interface. The processor is configured to enable the chip to perform the corresponding functions of the method of the first aspect. The interface is used to support communication between the chip and other chips or other network elements. The chip may also include a memory for coupling with the processor that holds the necessary program instructions and data for the chip.

In an eighth aspect, embodiments of the present invention provide a chip, which may be disposed in a device, and which includes a processor and an interface. The processor is configured to support the chip to perform the corresponding functions in the method of the second aspect. The interface is used to support communication between the chip and other chips or other network elements. The chip may also include a memory for coupling with the processor that holds the necessary program instructions and data for the chip.

In a ninth aspect, an embodiment of the present invention provides a computer storage medium, which stores instructions that, when executed on a computer, cause the computer to perform the method described in the first aspect or any one of the possible designs of the first aspect.

In a tenth aspect, embodiments of the present invention provide a computer storage medium having stored therein instructions that, when executed on a computer, cause the computer to perform the method of the second aspect or any one of the possible designs of the second aspect.

In an eleventh aspect, an embodiment of the present invention provides a computer program product, which contains instructions that, when the program is executed by a computer, cause the computer to execute the method described in the first aspect or any one of the possible designs of the first aspect.

In a twelfth aspect, an embodiment of the present invention provides a computer program product, which contains instructions that, when the program is executed by a computer, cause the computer to execute the method described in the second aspect or any one of the possible designs of the second aspect.

The method and the device for processing the alarm information provided by the embodiment of the invention allocate the group number set for the alarm through the network equipment, the network management equipment determines the group number set of the root alarm according to the group number set carried by the alarm, determines the same correlation group to which the group number set of the alarm and the group number set of the root alarm belong according to the alarm information of the alarm, and adds the alarm information to the same correlation group, thereby avoiding the situation that when the alarm quantity is large, the network management equipment needs to traverse all alarms and when the derivative alarm is reported to the network management equipment before the root alarm, the network equipment needs to update the sub-alarm information or needs to carry all the sub-alarm information while reporting the root alarm, reducing the search amount and saving the search time.

Drawings

Fig. 1 is a schematic diagram of an alarm information processing system architecture according to an embodiment of the present invention;

FIG. 2 is a topological diagram of a correlation relationship of alarms according to an embodiment of the present invention;

fig. 3 is a schematic flow chart of a method for processing alarm information according to an embodiment of the present invention;

fig. 4 is a schematic diagram illustrating a method for assigning FKS to an alarm by a network device according to an embodiment of the present invention;

fig. 5 is a schematic diagram illustrating a method for distributing FKS to an alarm by a network device according to an embodiment of the present invention;

fig. 6 is a schematic diagram illustrating a first method for determining an identical correlation family by a network management device according to an embodiment of the present invention;

fig. 7 is a schematic diagram of a second method for determining an identical correlation family by a network management device according to an embodiment of the present invention;

fig. 8 is a schematic structural diagram of a first network device according to an embodiment of the present invention;

fig. 9 is a schematic structural diagram of a first network management device according to an embodiment of the present invention;

fig. 10 is a schematic structural diagram of a second network device according to an embodiment of the present invention;

fig. 11 is a schematic structural diagram of a second network management device according to an embodiment of the present invention.

Detailed Description

The embodiments of the present invention will be described below with reference to the drawings.

Fig. 1 is a schematic diagram of a system architecture for processing alarm information according to an embodiment of the present invention.

As shown in fig. 1, the application architecture of the alarm information processing system may include: network device 110 and network management device 120. Among them, the network device 110 may be one or more.

In embodiments of the present invention, network device 110 may include routers, switches, repeaters, firewalls, and bridges. The network device 110 has a fault management unit, an alarm correlation analysis switch, and a correlation suppression switch built therein. When the correlation analysis switch is turned on, the fault management unit may set a Family Key Set (FKS) for the alarm by analyzing the alarm received by the fault management unit, where the FKS may be a data set for identifying the correlation family alarms having the same root alarm. The alarm information carrying the FKS is reported to the network management device 120 through a simple network management protocol or a network configuration protocol.

In one example, as shown in FIG. 1, the network device 110 detects 4 alarms A, B, C and D in sequence. The network device 110 first stores the alarm a, obtains the alarm identifier and the alarm object of the alarm a through analysis, sets an alarm instance number for the alarm a according to the alarm identifier and the alarm object, searches the previous-level alarm associated with the alarm a according to the alarm identifier and the alarm object of the alarm a, and sets the alarm instance number of the previous-level alarm associated with the alarm a as the parent alarm instance number of the alarm a if the previous-level alarm associated with the alarm a is found;

if network device 110 does not find the upper level alarm associated with alarm A, then the parent alarm instance number for alarm A is not set. In addition, if the network device 110 subsequently finds the upper level alarm associated with the alarm a, the alarm instance number of the upper level alarm associated with the alarm a is set to be the parent alarm instance number of the alarm a, and at this time, the parent alarm instance number of the alarm a generates a change process from nothing to nothing.

The correlation analysis process of the network device 110 for the alarms B, C and D is the same as for the alarm a, and will not be described herein.

The alarm identification is used for identifying the type of the fault, the alarm object is used for identifying the specific position of the fault, the alarm instance number is used for identifying the only alarm instance of the fault, and the father alarm instance number is used for identifying the alarm instance of the upper-level fault associated with the first fault.

The network management device 120 may include a terminal and a management module installed in the terminal, where the network management device 120 receives and parses the alarm reported by the network device 110, determines an FKS of a root alarm corresponding to the alarm according to an FKS of the alarm, and further determines that the FKS of the alarm and the FKS of the root alarm corresponding to the alarm belong to the same correlation family.

In one example, as shown in fig. 1, when the alarm D reports, the alarm A, B and C already exists on the network management device 120, and the instance number, the parent alarm instance number and the FKS are carried, the network management device 120 determines the FKS of its root alarm a according to the FKS carried by the alarm D, and determines the alarm information of the alarm A, B and C, which belongs to the same correlation family as the FKS of the alarm D and the FKS of its root alarm a, according to the instance number and the parent alarm instance number carried by the alarm D, and adds the alarm information of the alarm D to the alarm information of the alarms A, B and C. The topological graph of the correlation relationship between the alarms A, B, C and D is shown in FIG. 2.

Wherein, the alarm A is a root alarm, and the alarms B, C and D are derived alarms. Meanwhile, the alarm A is the father alarm of the alarm B, the alarm B is the father alarm of the alarm C, and the alarm C is the father alarm of the alarm D. Therefore, one source alarm is a parent alarm, but the parent alarm is not necessarily the source alarm, and can also be a derivative alarm.

The generation of the alarm A can cause the generation of an alarm B, and similarly, the generation of the alarm B can cause the generation of an alarm C but not necessarily cause the generation of the alarm A; the generation of the alarm C must cause the generation of the alarm D, but must cause the generation of the alarm B.

From the topology shown in fig. 2, the network administrator can know that alarm a is the root alarm, and alarms B, C and D are the derivative alarms, where alarm B is the sub-alarm of alarm a, alarm C is the sub-alarm of alarm B, and alarm D is the sub-alarm of alarm C.

The terminal can also be called a system, subscriber unit, subscriber station, mobile, remote station, remote terminal, mobile device, user terminal, mobile terminal, wireless communication device, user agent, user device, or User Equipment (UE). For example, the terminal may be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA), a handheld device with Wireless communication capability, a computing device, a vehicle-mounted communication module, a smart meter, a smart home device, or other processing device connected to a Wireless modem.

Fig. 3 is a flowchart illustrating a method for processing alarm information according to an embodiment of the present invention.

As shown in fig. 3, the steps of the method for processing alarm information are as follows:

s301, the network device 110 detects a fault;

s302, the network device 110 stores the detected fault and determines the alarm information of the fault according to the detected fault, wherein the alarm information comprises an alarm instance number and a parent alarm instance number;

in one example, the process for network device 110 to determine the alarm information for the fault may be:

firstly, the network device 110 detects an alarm a, the network device 110 performs preliminary analysis, the alarm identifier of the alarm a is a physical interface fault, the alarm object is a physical entity GE3/0/1, and the network device 110, according to the alarm identifier of the alarm a: physical interface failure and alarm object: the physical entity GE3/0/1 sets an alarm instance number 123 for the alarm A; the network device 110 then, according to the alarm flag of alarm a: physical interface failure and alarm object: the physical entity GE3/0/1 searches the fault associated with the alarm A, does not search the fault associated with the alarm A, and does not set the father alarm instance number of the alarm A;

secondly, the network device 110 detects an alarm B, the network device 110 performs preliminary analysis, the alarm identifier of the alarm B is a link failure, the alarm object is an interface GE3/0/1, and the network device 110, according to the alarm identifier of the alarm B: link failure and alarm object: interface GE3/0/1, set alarm instance number 345 for alarm B; the network device 110 then, according to the alarm flag of alarm B: link failure and alarm object: the interface GE3/0/1 searches the alarm A associated with the alarm B, determines that the alarm A is the father alarm of the alarm B, and allocates the alarm instance number 123 of the alarm A to the alarm B as the father alarm instance number of the alarm B;

thirdly, the network device 110 detects an alarm C, the network device 110 performs preliminary analysis, the alarm identifier of the alarm C is a sub-link fault, the alarm object is a sub-interface GE3/0/1.1, and the network device 110, according to the alarm identifier of the alarm C: sub-link failure and alarm object: the subinterface GE3/0/1.1 sets an alarm instance number 567 for the alarm C; the network device 110 then, according to the alarm identifier of alarm C: sub-link failure and alarm object: the child interface GE3/0/1.1 finds the alarm B associated with the alarm C, determines that the alarm B is a parent alarm of the alarm C, and allocates the alarm instance number 345 of the alarm B to the alarm C as the parent alarm instance number of the alarm C;

thirdly, the network device 110 detects an alarm D, the network device 110 performs preliminary analysis, an alarm identifier of the alarm D is a Multi-Protocol Label Switching (MPLS) tunnel fault, an alarm object is an MPLS tunnel identifier 45, and the network device 110, according to the alarm identifier of the alarm D: Multi-Protocol label switching (MPLS) tunnel failure and alarm object: MPLS tunnel mark 45, setting alarm example number 789 for alarm D; the network device 110, according to the alarm identifier of the alarm D: Multi-Protocol Label Switching (MPLS) tunnel failure and alarm object: the MPLS tunnel identifier 45 is used for searching the alarm C associated with the alarm D, determining that the alarm C is a father alarm of the alarm D, and allocating the alarm instance number 567 of the alarm C to the alarm D as the father alarm instance number of the alarm D;

s303, the network equipment 110 determines the FKS of the alarm according to the alarm instance number and the father alarm instance number in the alarm information;

preferably, as shown in fig. 1, the network device determines that alarm a is the root alarm and alarms B, C and D are derivative alarms according to the alarm instance numbers and parent alarm instance numbers of alarms A, B, C and D, and assigns alarm instance number 123 of alarm a to alarms B, C and D as FKS for alarms A, B, C and D.

In one example, the network device 110 may also set alarm generation times, alarm recovery times, alarm levels, alarm object identification parameters, alarm attach parameters, etc. for the alarms A, B, C and D.

S304, the network device 110 generates an alarm report message, where the alarm report message includes the alarm message and the FKS of the alarm;

s305, the network device 110 sends the alarm report information to the network management device 120;

in an example, the Network device 110 may send the alarm report information to the Network management device 120 through a Simple Network Management Protocol (SNMP) or a Network Configuration Protocol (NETCONF).

S306, the network management device 120 receives and stores the alarm report information;

s307, the network management device 120 determines the FKS of the root alarm corresponding to the alarm according to the FKS of the alarm, and further determines the same correlation family to which the FKS of the alarm and the FKS of the root alarm corresponding to the alarm belong;

in one example, alarms A, B and C already exist on the network management device 120, where the alarm instance number, parent alarm instance number and FKS of alarm A are 123, none and {123} respectively, the alarm instance number, parent alarm instance number and FKS of alarm B are 345, 123 and {123} respectively, the alarm instance number, parent alarm instance number and FKS of alarm C are 567, 345 and {123} respectively, when alarm D is received, alarm D carries the instance number, parent alarm instance number and FKS 789, 567 and {123} respectively, the network management device 120 determines FKS of alarm A as its root alarm from FKS {123} carried by alarm D, and further determines FKS of alarm D as the same family of dependencies as FKS of alarms A, B and C, and adds the alarm instance number, parent alarm instance number and FKS of alarm D to the alarm A {123}, FKS, And B and C.

S308, the network management device 120 adds the alarm to the same correlation family according to the alarm information.

In one example, the network management device 120 looks up the alarm instance number of alarm C that matches the parent alarm instance number of alarm D in the same correlation family (alarm A, B, C) to which the network management device 120 adds the alarm information for alarm D.

The method for processing the alarm information provided by the embodiment of the invention allocates the FKS to the alarm through the network equipment, and the network management equipment determines the FKS of the root alarm according to the FKS carried by the alarm, determines the same correlation family to which the FKS of the alarm and the FKS of the root alarm belong according to the alarm information of the alarm and adds the alarm information to the same correlation family, thereby avoiding the situation that when the alarm quantity is large, the network management equipment needs to traverse all alarms and when the derivative alarm is reported to the network management equipment before the root alarm, the network equipment needs to update the sub-alarm information or needs to carry all the sub-alarm information while reporting the root alarm, reducing the search quantity and saving the search time.

Fig. 4 is a schematic diagram of a method for assigning FKS to an alarm by a network device according to an embodiment of the present invention. As shown in fig. 4, the network device 110 determines the alarm information of the alarms A, B and C in turn, where:

the alarm instance number of alarm a is 123, and there is no parent alarm instance number, the network device 110 takes the alarm instance number of alarm a as the FKS of alarm a, i.e. the FKS of alarm a is {123 };

the parent alarm instance number of alarm B is the alarm instance number of alarm A, network device 110 determines that alarm A is the parent alarm, and assigns the alarm instance number of alarm A to alarm B as the FKS of alarm B, i.e. the FKS of alarm B is also {123 };

the alarm instance number of alarm C is the alarm instance number of alarm a, and network device 110 determines that alarm a is its parent alarm and assigns the alarm instance number of alarm a to alarm C, i.e., the FKS of alarm C is also {123 }.

Thus, the FKS of alarm A, B and C are the same and belong to the same correlation family.

Fig. 5 is a schematic diagram of a method for distributing FKS to an alarm by a network device according to an embodiment of the present invention. As shown in fig. 5, the network device 110 determines the alarm B, C and the alarm information of a in turn, where:

the alarm instance number of alarm B is 123, and there is no parent alarm instance number, the network device 110 takes the alarm instance number of alarm B as the FKS of alarm B, i.e. the FKS of alarm B is {123 };

the alarm instance number of alarm C is 456, no parent alarm instance number exists, and the network device 110 takes the alarm instance number of alarm B as the FKS of alarm C, i.e. the FKS of alarm C is {456 };

the alarm instance number of alarm a is {123, 456}, there is no parent alarm instance number, network device 110 determines alarm a to be the parent alarm of alarms B and C, assigns alarms B and C to the alarm instance number of alarm a as the parent alarm instance numbers of alarms B and C, and at the same time, takes the parent alarm instance number of alarm a as the FKS of alarm a.

Thus, although alerts A, B and C have different FKS, the union of the FKS of alert B and alert C is the FKS of alert A, leading to the conclusion that alert B, C and the FKS of A belong to the same family of correlations.

Fig. 6 is a schematic diagram of a method for determining an identical correlation family by a network management device according to an embodiment of the present invention.

As shown in fig. 6, the network management device 120 has alarms A, B, C, D, E, F and G, where: a and E are root alarms, C and D are independent alarms, B is a derivative alarm of A, and F and G are derivative alarms of E.

When the alarm H carries the alarm instance number, the parent alarm instance number, and FKS {135, 246}, and is sent to the network management device 120, the network management device 120 finds that the parent alarm instance number of the alarm H matches the alarm instance number of the alarm G according to the parent alarm instance number of the alarm H, and determines that the alarm G is the parent alarm of the alarm H, and since the alarm E is the parent alarm of the alarm G, the network management device 120 may determine that the FKS of the alarm E is the FKS of the root alarm, and further determine that the FKS of the alarm G belongs to the same correlation family as the FKS of the alarms E, F and G.

In practical application, the number of derived alarms may be much larger than the number of root alarms, and compared with all alarms, the number of the alarm correlation family is much smaller, and the cost of traversing the alarm correlation family is much smaller than that of traversing all alarms.

Fig. 7 is a schematic diagram of a second method for determining the same correlation family by the network management device according to the embodiment of the present invention. As shown in fig. 7, there are alarms A, B and C already on the webmaster, where: a is the root alarm, B is the independent alarm, and C is the derived alarm of A.

The network device 120 receives the alarm D, where the alarm D carries the alarm instance number and FKS {123, 456}, and the network management device 120 finds that the alarm instance number of the alarm D matches the parent alarm instance numbers of the alarms B and a according to the alarm instance number of the alarm D, and determines that the alarm D is the parent alarm of the alarms B and a, and further determines that the FKS of the alarm D is the FKS of the root alarm, so that it can be determined that the FKS of the alarm D and the FKS of the alarms A, B and C belong to the same correlation family.

According to the method for determining the same correlation family, provided by the embodiment of the invention, FKS is set for the alarm through the network equipment, and the network management equipment determines the same correlation family according to the FKS carried by the alarm, so that the situation that the network equipment needs to update the sub-alarm information or needs to carry all the sub-alarm information while reporting the root alarm under the condition that the derivative alarm is reported to the network management equipment before the root alarm is avoided, the search amount is reduced, and the search time is saved.

Fig. 8 is a schematic structural diagram of a first network device according to an embodiment of the present invention.

As shown in fig. 8, the network device 800 includes: a determining module 810, a setting module 820, a generating module 830 and a sending module 840. Wherein:

a determining module 810, configured to determine first alarm information according to a detected first fault, where the first alarm information includes a first alarm instance number and a first parent alarm instance number, the first alarm instance number is used to identify an alarm instance of the first fault, and the first parent alarm instance number is used to identify an alarm instance of a previous-level fault associated with the first fault;

a setting module 820, configured to determine a first family number set according to the first alarm instance number and the first parent alarm instance number in the first alarm information, where the first family number set is a subset of a root alarm family number set corresponding to a root alarm information, the first family number set and the root alarm family number set belong to a same correlation family, and the same correlation family indicates that the first alarm has a correlation with a root fault that generates the root alarm information;

a generating module 830, configured to generate first alarm reporting information, where the first alarm reporting information includes the first alarm information and the first group number set;

a sending module 840, configured to send the first alarm reporting information to a network management device.

The network device provided in the embodiment of the present invention may include a router, a switch, a repeater, a firewall, and a bridge, and the network device 110 has a built-in fault management unit, an alarm correlation analysis switch, and a correlation suppression switch.

It can be understood that the functions of the functional modules of the management device in the embodiment of the present invention can be implemented through the steps of the method embodiments shown in fig. 1, fig. 3 to fig. 5, and the specific implementation process thereof may refer to the related description of the above method embodiments, and is not described herein again.

The network device provided by the embodiment of the invention allocates the FKS for the alarm through the network device, and the network management device determines the FKS of the source alarm according to the FKS carried by the alarm, determines the same correlation family to which the FKS of the alarm and the FKS of the source alarm belong according to the alarm information of the alarm, and adds the alarm information to the same correlation family, thereby avoiding that when the alarm quantity is large, the network management device needs to traverse all alarms and when the derivative alarm is reported to the network management device before the source alarm, the network device needs to update the sub-alarm information or needs to carry all the sub-alarm information while reporting the source alarm, reducing the search quantity and saving the search time.

Fig. 9 is a schematic structural diagram of a first network management device according to an embodiment of the present invention.

As shown in fig. 9, the network management apparatus 900 includes: a receiving module 910, a determining module 920 and an adding module 930. Wherein:

a receiving module 910, configured to receive first alarm reporting information sent by a network device, where the first alarm reporting information includes first alarm information and a first group number set, the first alarm information is determined by the network equipment according to the first fault detected by the network equipment, the first alarm information includes a first alarm instance number and a first parent alarm instance number, the first alarm instance number is used to identify an alarm instance of the first fault, the first parent alarm instance number is used to identify an alarm instance of a higher level fault associated with the first fault, the first family number set is a subset of a root alarm family number set corresponding to the root alarm information, the first family number set and the root cause alarm family number set belong to a first correlation family, and the first correlation family represents that the first fault has correlation with a root cause fault which generates the root cause alarm information;

a determining module 920, configured to determine the root alarm family number set according to the first family number set, and determine the first family number set and the first correlation family to which the root alarm family number set belongs;

an adding module 930 for adding the first alert to the first relevance family with the first alert information.

It can be understood that the functions of the functional modules of the management device in the embodiment of the present invention can be implemented through the steps of the method embodiments shown in fig. 1, fig. 6 to fig. 7, and the specific implementation process thereof may refer to the related description of the above method embodiments, and is not described herein again.

The network management equipment provided by the embodiment of the invention allocates the FKS for the alarm through the network equipment, and the network management equipment determines the FKS of the source alarm according to the FKS carried by the alarm, determines the same correlation family to which the FKS of the alarm and the FKS of the source alarm belong according to the alarm information of the alarm and adds the alarm information to the same correlation family, thereby avoiding that when the alarm quantity is large, the network management equipment needs to traverse all alarms and when the derivative alarm is reported to the network management equipment before the source alarm, the network equipment needs to update the sub-alarm information or needs to carry all the sub-alarm information while reporting the source alarm, reducing the search quantity and saving the search time.

Fig. 10 is a schematic structural diagram of a second network device according to an embodiment of the present invention.

As shown in fig. 10, the network device may include: a processor 1010, a memory 1020, and a communication interface 1030. Wherein:

the processor 1010 may be a Central Processing Unit (CPU), or a combination of a CPU and a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a Programmable Logic Device (PLD), or a combination thereof. The PLD may be a Complex Programmable Logic Device (CPLD), a field-programmable gate array (FPGA), a General Array Logic (GAL), or any combination thereof.

The memory 1020 is used to store various applications, operating systems, and data. The memory 1020 may transfer the stored data to the processor 1010. The memory 1020 may include a volatile memory, such as a nonvolatile dynamic random access memory (NVRAM), a phase change random access memory (PRAM), a Magnetoresistive Random Access Memory (MRAM), and the like, and a nonvolatile memory, such as at least one magnetic disk memory device, an electrically erasable programmable read-only memory (EEPROM), a flash memory device, such as a NOR flash memory (NOR flash memory) or a NAND flash memory (EEPROM), a semiconductor device, such as a Solid State Disk (SSD), and the like. Memory 1020 may also include a combination of memories of the sort described above.

The communication interface 1030 may be a transceiver, a transceiver circuit, etc., wherein the communication interface 1030 is generally referred to and may include one or more interfaces.

It is understood that the memory 1020 may be integrated into the processor 1010 or may stand alone.

Wherein the process 1010 is configured to perform the following operations according to program instructions stored in the memory 1020:

determining first alarm information according to the detected first fault, wherein the first alarm information comprises a first alarm instance number and a first father alarm instance number, the first alarm instance number is used for identifying an alarm instance of the first fault, and the first father alarm instance number is used for identifying an alarm instance of a previous-level fault associated with the first fault;

determining a first family number set according to the first alarm instance number and the first father alarm instance number in the first alarm information, wherein the first family number set is a subset of a root alarm family number set corresponding to the root alarm information, the first family number set and the root alarm family number set belong to the same correlation family, and the same correlation family represents that the first alarm has correlation with a root fault generating the root alarm information;

generating first alarm reporting information, wherein the first alarm reporting information comprises the first alarm information and the first family number set;

and sending the first alarm reporting information to the network management device 120 through the communication interface 1030.

In one example, process 1010, in accordance with program instructions stored in memory 1020, further performs the following:

determining second alarm information according to the detected second fault, wherein the second alarm information comprises a second alarm instance number and a second father alarm instance number, the second alarm instance number is used for identifying the alarm instance of the second fault, and the second father alarm instance number is equal to the first alarm instance number;

determining a second family number set according to the second alarm instance number and the second father alarm instance number in the second alarm information, wherein the second family number set is a subset of the first family number set, and the second family number set belongs to the same correlation family;

generating second alarm reporting information, wherein the second alarm reporting information comprises the second alarm information and the second group number set;

and sending the second alarm reporting information to a network management device through a communication interface 1030.

determining third alarm information according to the detected third fault, wherein the third alarm information comprises a third alarm instance number and a third father alarm instance number, the third alarm instance number is equal to the alarm instance number of the upper-level fault associated with the first fault, and the third father alarm instance number is used for identifying the alarm instance of the upper-level fault associated with the third fault;

determining a third family number set according to the third alarm instance number and the third father alarm instance number in the third alarm information, wherein the first family number set is a subset of the third family number set, and the third family number set belongs to the same correlation family;

generating third alarm reporting information, wherein the third alarm reporting information comprises the third alarm information and the third family number set;

and sending the third alarm reporting information to a network management device through a communication interface 1030.

As shown in fig. 11, the network management apparatus includes: a processor 1110, a memory 1120, and a communications interface 1130.

Processor 1110 may be processor 1010 described previously.

The memory 1120 may be the memory 1020 described previously.

The communication interface 1130 may be a transceiver, transceiving circuitry, or the like, wherein the communication interface 1130 is generally referred to and may include one or more interfaces.

It is to be appreciated that the memory 1120 can be integrated into the processor 1110 or can stand alone.

Wherein processor 1110 performs the following operations according to program instructions stored in the memory:

receiving, via the communication interface 1130, first alarm reporting information sent by a network device, where the first alarm reporting information includes first alarm information and a first family number set, the first alarm information is determined by the network equipment according to the first fault detected by the network equipment, the first alarm information includes a first alarm instance number and a first parent alarm instance number, the first alarm instance number is used to identify an alarm instance of the first fault, the first parent alarm instance number is used to identify an alarm instance of a higher level fault associated with the first fault, the first family number set is a subset of a root alarm family number set corresponding to the root alarm information, the first family number set and the root cause alarm family number set belong to a first correlation family, and the first correlation family represents that the first fault has correlation with a root cause fault which generates the root cause alarm information;

determining the root alarm family number set according to the first family number set, and determining the first family number set and the first correlation family to which the root alarm family number set belongs;

adding the first alert to the first relevance family in accordance with the first alert information.

In one example, the adding, by the processor 1110, the first alarm to the first relevance family according to the first alarm information specifically includes:

processor 1110 searches, in the first correlation family, a second alarm instance number that matches a first parent alarm instance number in the first alarm information, where the second alarm instance number corresponds to a second alarm, and the second alarm belongs to the first correlation family;

when the processor 1110 determines the second alarm instance number that matches the first parent alarm instance number in the first alarm information, the processor adds the first alarm to the first dependency family as a child alarm of the second alarm.

the adding, by the processor, the first alarm to the first relevance family according to the first alarm information specifically includes:

the processor searches a third father alarm instance number matched with the first alarm instance number in the first alarm information in the first correlation family, wherein the third father alarm instance number corresponds to a third alarm, and the third alarm belongs to the first correlation family;

when the processor determines the third parent alarm instance number that matches the first alarm instance number in the first alarm information, the processor adds the first alarm as the parent alarm of the third alarm to the first dependency family.

The alarm information processing device provided by the embodiment of the invention can be arranged in a Terminal (Terminal), for example, can be an LPA in the Terminal. The terminal can also be called a system, subscriber unit, subscriber station, mobile, remote station, remote terminal, mobile device, User terminal, mobile terminal, wireless communication device, User agent, User device, or User Equipment (UE). For example, the terminal may be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA), a handheld device with Wireless communication capability, a computing device, a vehicle-mounted communication module, a smart meter, a smart home device, or other processing device connected to a Wireless modem.

In embodiments of the present invention, the communication bus may include a power bus, a control bus, a status signal bus, and the like, in addition to the data bus. But for clarity of illustration the various buses are labeled as communication buses in the figures.

Those of ordinary skill in the art will appreciate that the modular units and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both, and that the exemplary components and steps have been described above generally in terms of their functionality in order to clearly illustrate the interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.

In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention essentially or partially contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product stored in a storage medium and including instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.

The above description is only for the specific embodiments of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present invention, and all the changes or substitutions should be covered within the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the appended claims.

Claims

1. A method for processing alarm information is characterized in that the method comprises the following steps:

the method comprises the steps that a network device determines first alarm information according to a first fault detected by the network device, wherein the first alarm information comprises a first alarm instance number and a first father alarm instance number, the first alarm instance number is used for identifying an alarm instance of the first fault, and the first father alarm instance number is used for identifying an alarm instance of a previous-level fault associated with the first fault;

the network equipment determines a first family number set according to the first alarm instance number and the first father alarm instance number in the first alarm information, wherein the first family number set is a subset of a root alarm family number set corresponding to the root alarm information, the first family number set and the root alarm family number set belong to the same correlation family, and the same correlation family represents that the first alarm has correlation with a root fault generating the root alarm information;

the network equipment generates first alarm reporting information, wherein the first alarm reporting information comprises the first alarm information and the first family number set;

and the network equipment sends the first alarm reporting information to network management equipment.

2. The method according to claim 1, characterized in that it comprises:

the network equipment determines second alarm information according to a second fault detected by the network equipment, wherein the second alarm information comprises a second alarm instance number and a second father alarm instance number, the second alarm instance number is used for identifying an alarm instance of the second fault, and the second father alarm instance number is equal to the first alarm instance number;

3. The method according to claim 1, characterized in that it comprises:

the network device determines third alarm information according to a third fault detected by the network device, wherein the third alarm information comprises a third alarm instance number and a third father alarm instance number, the third alarm instance number is equal to the alarm instance number of the upper-level fault associated with the first fault, and the third father alarm instance number is used for identifying the alarm instance of the upper-level fault associated with the third fault;

4. The method of claim 1,

the first alarm information is independent alarm information, the first family number set is equal to the root alarm family number set, and the first fault is the root alarm.

5. The method of claim 3,

the third fault is a root fault, the third group number set is equal to the root alarm group number set, and the third alarm information is the same as the root alarm information.

6. The method of any one of claims 1 to 5,

the first set of family numbers includes elements having the same value as the first alarm instance number.

7. The method according to any one of claims 1 to 5, wherein the determining, by the network device, the first alarm information according to the first fault detected by the network device specifically includes:

8. A method for processing alarm information is characterized in that the method comprises the following steps:

the network management equipment receives first alarm reporting information sent by the network equipment, wherein the first alarm reporting information comprises first alarm information and a first family number set, the first alarm information is determined by the network equipment according to the first fault detected by the network equipment, the first alarm information includes a first alarm instance number and a first parent alarm instance number, the first alarm instance number is used to identify an alarm instance of the first fault, the first parent alarm instance number is used to identify an alarm instance of a higher level fault associated with the first fault, the first family number set is a subset of a root alarm family number set corresponding to the root alarm information, the first family number set and the root cause alarm family number set belong to a first correlation family, and the first correlation family represents that the first fault has correlation with a root cause fault which generates the root cause alarm information;

the network management equipment determines the root alarm family number set according to the first family number set, and determines the first family number set and the first correlation family to which the root alarm family number set belongs;

the network management device adds the first alarm to the first correlation family according to the first alarm information.

9. The method according to claim 8, wherein the adding, by the network management device, the first alarm to the first relevance family according to the first alarm information specifically comprises:

10. The method according to claim 8, wherein the adding, by the network management device, the first alarm to the first relevance family according to the first alarm information specifically comprises:

11. A network device, characterized in that the network device comprises:

the device comprises a determining module, a judging module and a judging module, wherein the determining module is used for determining first alarm information according to a detected first fault, the first alarm information comprises a first alarm instance number and a first father alarm instance number, the first alarm instance number is used for identifying an alarm instance of the first fault, and the first father alarm instance number is used for identifying an alarm instance of a previous-level fault associated with the first fault;

a setting module, configured to determine a first family number set according to the first alarm instance number and the first parent alarm instance number in the first alarm information, where the first family number set is a subset of a root alarm family number set corresponding to a root alarm information, the first family number set and the root alarm family number set belong to a same correlation family, and the same correlation family indicates that the first alarm has a correlation with a root fault that generates the root alarm information;

a generating module, configured to generate first alarm reporting information, where the first alarm reporting information includes the first alarm information and the first group number set;

and the sending module is used for sending the first alarm reporting information to network management equipment.

12. The network device of claim 11, wherein the determining module is further configured to determine second alarm information according to a second fault detected by the network device, and the second alarm information includes a second alarm instance number and a second parent alarm instance number, the second alarm instance number is used to identify an alarm instance of the second fault, and the second parent alarm instance number is equal to the first alarm instance number.

13. The network device of claim 12, wherein the setting module is further configured to determine a second group number set according to the second alarm instance number and the second parent alarm instance number in the second alarm information, wherein the second group number set is a subset of the first group number set, and the second group number set belongs to the same correlation group.

14. The network device of claim 13, wherein the generating module is further configured to generate a second alarm reporting information, and the second alarm reporting information includes the second alarm information and the second group number set.

15. The network device of claim 14, wherein the sending module is further configured to send the second alarm reporting information to a network management device.

16. The network device of claim 11, wherein the determining module is further configured to determine third alarm information according to a third fault detected by the network device, and wherein the third alarm information includes a third alarm instance number and a third parent alarm instance number, and wherein the third alarm instance number is equal to an alarm instance number of a previous fault associated with the first fault, and wherein the third parent alarm instance number is used to identify an alarm instance of the previous fault associated with the third fault.

17. The network device of claim 16, wherein the setting module is further configured to determine a third group number set according to the third alarm instance number and the third parent alarm instance number in the third alarm information, wherein the first group number set is a subset of the third group number set, and wherein the third group number set belongs to the same correlation group.

18. The network device of claim 17, wherein the generating module is further configured to generate third alarm reporting information, and the third alarm reporting information includes the third alarm information and the set of group iii numbers.

19. The network device of claim 18, wherein the sending module is further configured to send the third alarm reporting information to a network management device.

20. A network management device, characterized in that the network management device comprises:

a receiving module, configured to receive first alarm reporting information sent by a network device, where the first alarm reporting information includes first alarm information and a first group number set, the first alarm information is determined by the network equipment according to the first fault detected by the network equipment, the first alarm information includes a first alarm instance number and a first parent alarm instance number, the first alarm instance number is used to identify an alarm instance of the first fault, the first parent alarm instance number is used to identify an alarm instance of a higher level fault associated with the first fault, the first family number set is a subset of a root alarm family number set corresponding to the root alarm information, the first family number set and the root cause alarm family number set belong to a first correlation family, and the first correlation family represents that the first fault has correlation with a root cause fault which generates the root cause alarm information;

a determining module, configured to determine the root alarm family number set according to the first family number set, and determine the first family number set and the first correlation family to which the root alarm family number set belongs;

an adding module that adds the first alert to the first relevance family according to the first alert information.

21. A network device, characterized in that the network device comprises: a processor, a memory, and a communication interface; wherein the content of the first and second substances,

the memory to store program instructions;

the processor is configured to perform the following operations according to program instructions stored in the memory:

and sending the first alarm reporting information to network management equipment through the communication interface.

22. The network device of claim 21, wherein the processor, in accordance with program instructions stored in the memory, further performs the following:

and sending the second alarm reporting information to network management equipment through the communication interface.

23. The network device of claim 21, wherein the processor, in accordance with program instructions stored in the memory, further performs the following:

and sending the third alarm reporting information to network management equipment through the communication interface.

24. A network management device, characterized in that the network management device comprises: a processor, a memory, and a communication interface; wherein the content of the first and second substances,

the memory to store program instructions;

receiving first alarm reporting information sent by a network device through the communication interface, wherein the first alarm reporting information comprises first alarm information and a first family number set, the first alarm information is determined by the network equipment according to the first fault detected by the network equipment, the first alarm information includes a first alarm instance number and a first parent alarm instance number, the first alarm instance number is used to identify an alarm instance of the first fault, the first parent alarm instance number is used to identify an alarm instance of a higher level fault associated with the first fault, the first family number set is a subset of a root alarm family number set corresponding to the root alarm information, the first family number set and the root cause alarm family number set belong to a first correlation family, and the first correlation family represents that the first fault has correlation with a root cause fault which generates the root cause alarm information;

25. The network management device of claim 24, wherein the adding, by the processor, the first alarm to the first dependency family according to the first alarm information specifically comprises:

the processor searches a second alarm instance number matched with a first father alarm instance number in the first alarm information in the first correlation family, wherein the second alarm instance number corresponds to a second alarm, and the second alarm belongs to the first correlation family;

when the processor determines the second alarm instance number that matches the first parent alarm instance number in the first alarm information, the processor adds the first alarm to the first dependency family as a child alarm of the second alarm.

26. The network management device of claim 24, wherein the adding, by the processor, the first alarm to the first dependency family according to the first alarm information specifically comprises: