CN114095335A - Network alarm processing method and device and electronic equipment - Google Patents
Network alarm processing method and device and electronic equipment Download PDFInfo
- Publication number
- CN114095335A CN114095335A CN202010766696.4A CN202010766696A CN114095335A CN 114095335 A CN114095335 A CN 114095335A CN 202010766696 A CN202010766696 A CN 202010766696A CN 114095335 A CN114095335 A CN 114095335A
- Authority
- CN
- China
- Prior art keywords
- alarm
- network
- service chain
- network element
- service
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000003672 processing method Methods 0.000 title claims abstract description 29
- 238000000034 method Methods 0.000 claims abstract description 44
- 238000004891 communication Methods 0.000 claims abstract description 15
- 238000013507 mapping Methods 0.000 claims abstract description 7
- 238000012216 screening Methods 0.000 claims description 6
- 238000009877 rendering Methods 0.000 claims description 5
- 238000006243 chemical reaction Methods 0.000 claims description 4
- 230000000737 periodic effect Effects 0.000 claims description 4
- 230000000007 visual effect Effects 0.000 claims description 4
- 238000012545 processing Methods 0.000 abstract description 38
- 230000008569 process Effects 0.000 description 19
- 238000003745 diagnosis Methods 0.000 description 13
- 238000010586 diagram Methods 0.000 description 12
- 230000006870 function Effects 0.000 description 5
- 230000003287 optical effect Effects 0.000 description 5
- 230000008439 repair process Effects 0.000 description 5
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 238000004422 calculation algorithm Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 239000000463 material Substances 0.000 description 2
- 230000002093 peripheral effect Effects 0.000 description 2
- 239000004065 semiconductor Substances 0.000 description 2
- 238000003491 array Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000010354 integration Effects 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 230000002035 prolonged effect Effects 0.000 description 1
- 230000002441 reversible effect Effects 0.000 description 1
- 230000002123 temporal effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0677—Localisation of faults
Abstract
The application provides a network alarm processing method and device and electronic equipment, and relates to the technical field of communication. The network alarm processing method comprises the following steps: determining an alarm network element contained in the alarm ticket by acquiring the alarm ticket, and determining a network element associated with a target service corresponding to the alarm network element; mapping the alarm network element and the associated network element to a network topology to obtain a service network topology; determining an alarm service chain according to the logical relationship among network elements in the service network topology; and determining the alarm reason of the target service according to the alarm weight of the alarm service chain. The method and the device realize efficient acquisition and clear positioning of the network alarm, automatically determine the reason of the alarm, improve the alarm processing efficiency and improve the user experience.
Description
[ technical field ] A method for producing a semiconductor device
The present application relates to the field of communications technologies, and in particular, to a network alarm processing method and apparatus, and an electronic device.
[ background of the invention ]
In the mobile mass flow period, the network scale is explosively enlarged, and the network alarm is increased by geometric multiples. The method can efficiently process the network faults and is an important guarantee for maintaining the normal operation of the network.
However, in the face of an abnormally complex network, the existing network alarm processing technology has the following problems: firstly, the alarm acquisition means is lack of effective integration, and the acquisition efficiency is low; secondly, the alarm positioning content is complicated, and a large amount of invalid alarms are mixed in the alarm positioning content, so that the pressure of the subsequent alarm presentation and alarm processing process is increased; finally, the alarm processing depends on manual work to a great extent, so that the fault processing time is prolonged, and the user experience is seriously influenced.
[ summary of the invention ]
The embodiment of the application provides a network alarm processing method, a network alarm processing device and electronic equipment, so as to realize efficient acquisition, clear positioning and automatic processing of network alarms.
In a first aspect, an embodiment of the present application provides a network alarm processing method, including: acquiring an alarm ticket, wherein the alarm ticket comprises an alarm network element; determining a related network element of a target service corresponding to the alarm network element; mapping the alarm network element and the associated network element into a network topology, and determining a service network topology containing the alarm network element and the associated network element from the network topology; determining alarm service chains in the service network topology according to the logical relationship among network elements in the service network topology, wherein each alarm service chain comprises at least one alarm network element; calculating the alarm weight of the alarm service chain; and determining the alarm reason of the target service according to the alarm service chain with the alarm weight higher than the set threshold value.
In one possible implementation manner, acquiring an alarm ticket includes: acquiring initial alarm tickets of all network elements in a communication network through a northbound interface; and according to a preset format, carrying out format conversion on the initial alarm ticket to obtain an alarm ticket.
In one possible implementation manner, calculating the alarm weight of the alarm service chain includes: screening invalid alarm network elements from alarm network elements contained in the alarm service chain; and calculating the alarm weight of the alarm service chain after the invalid alarm network element is screened out.
In one possible implementation manner, according to a preset time step, extracting an alarm network element contained in an alarm ticket in each time period; clustering the alarm network elements in each time period respectively; and according to the clustering result, determining the alarm network elements with periodic alarms and the alarm network elements with the alarm total duration exceeding a set threshold value as invalid alarm network elements.
In one possible implementation manner, calculating the alarm weight of the alarm service chain includes: and determining the alarm weight of the alarm service chain according to the number of the alarm network elements in the alarm service chain and the hierarchy of the alarm network elements in the service network topology.
In one possible implementation manner, determining an alarm weight of the alarm service chain according to the number of alarm network elements in the alarm service chain and a hierarchy of the alarm network elements in a service network topology includes: when the number of alarm network elements in an alarm service chain is 1, calculating the alarm weight of the alarm service chain according to the following formula:
wherein m is the hierarchy of the alarm network element in the service network topology; n is the total number of network elements contained in the alarm service chain; when the number of the alarm network elements in the alarm service chain is greater than 1, calculating the alarm weight of the alarm service chain according to the following formula:
wherein, the alarm service chain comprises n sections of continuously connected normal network elements; a1 … … an is the number of normal network elements that are continuously connected for each segment; and b is the maximum number of the alarm network elements which are continuously connected in the alarm service chain.
In one possible implementation manner, determining an alarm reason of the target service according to an alarm service chain with an alarm weight higher than a set threshold includes: determining the alarm service chain with the highest alarm weight as a root cause alarm service chain; extracting the alarm network element in the root cause alarm service chain as a root cause alarm network element; and determining the alarm reason of the target service according to the root reason alarm network element.
In one possible implementation manner, the method further includes: in a service topology network, visually presenting the root cause alarm network element; wherein the visual presentation comprises: and (5) alarm rendering.
In a second aspect, an embodiment of the present application provides a network alarm processing apparatus, including: the system comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is used for acquiring an alarm ticket, and the alarm ticket comprises an alarm network element; a determining module, configured to determine a network element associated with a target service corresponding to the alarm network element; mapping the alarm network element and the associated network element into a network topology, and determining a service network topology containing the alarm network element and the associated network element from the network topology; determining alarm service chains in the service network topology according to the logical relationship among network elements in the service network topology, wherein each alarm service chain comprises at least one alarm network element; the processing module is used for calculating the alarm weight of the alarm service chain; determining the alarm reason of the target service according to the alarm service chain with the alarm weight higher than the set threshold; the processing module is configured to, when calculating the alarm weight of the alarm service chain, specifically: screening invalid alarm network elements from alarm network elements contained in the alarm service chain; and calculating the alarm weight of the alarm service chain after the invalid alarm network element is screened out.
In a third aspect, an embodiment of the present application provides an electronic device, including: at least one processor; and at least one memory communicatively coupled to the processor, wherein: the memory stores program instructions executable by the processor, which when called by the processor are capable of performing the method as described above.
In a fourth aspect, embodiments of the present application provide a non-transitory computer-readable storage medium storing computer instructions that cause the computer to perform the method as described above.
In the technical scheme, the alarm call ticket is obtained, the alarm network element contained in the alarm call ticket is determined, and the associated network element of the target service corresponding to the alarm network element is determined; mapping the alarm network element and the associated network element to a network topology to obtain a service network topology; determining an alarm service chain according to the logical relationship among network elements in the service network topology; and determining the alarm reason of the target service according to the alarm weight of the alarm service chain. The method realizes the high-efficiency acquisition and clear positioning of the network alarm and automatically determines the reason of the alarm.
[ description of the drawings ]
In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.
FIG. 1 is a flowchart of an embodiment of a network alarm processing method according to the present application;
FIG. 2 is another flowchart of the network alarm processing method according to the embodiment;
FIG. 3 is a flowchart of another embodiment of a network alarm processing method according to the present application;
FIG. 4 is a flowchart of a network alarm processing method according to another embodiment of the present application;
FIG. 5 is a diagram illustrating an embodiment of a network alarm processing method according to the present application;
FIG. 6 is a diagram illustrating another embodiment of a network alarm processing method according to the present application;
FIG. 7 is a schematic structural diagram of an embodiment of a network alarm processing apparatus according to the present application;
FIG. 8 is a schematic structural diagram of another embodiment of a network alarm processing device according to the present application;
fig. 9 is a schematic structural diagram of an embodiment of an electronic device according to the present application.
[ detailed description ] embodiments
For better understanding of the technical solutions of the present application, the following detailed descriptions of the embodiments of the present application are provided with reference to the accompanying drawings.
It should be understood that the embodiments described are only a few embodiments of the present application, and not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
The terminology used in the embodiments of the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in the examples of this application and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.
Fig. 1 is a flowchart of an embodiment of a network alarm processing method according to the present application, and as shown in fig. 1, the network alarm processing method may include:
Firstly, acquiring initial alarm tickets of all network elements in a communication network through a northbound interface.
In order to realize the efficient collection of the network alarm, the embodiment of the application collects the initial alarm tickets of all network elements in the communication network in real time through the northbound interface. In a specific real-time process, the embodiment of the application can collect all call tickets of a whole number of network elements in a communication network in real time, wherein the call tickets comprise normal call tickets and initial alarm call tickets, and the next operation is executed only when the call tickets are identified as the initial alarm call tickets.
And then, according to a preset format, carrying out format conversion on the initial alarm ticket to obtain the alarm ticket.
The formats of the initial alarm call tickets collected from different devices are different due to different device models and manufacturers. In order to facilitate the processing of the subsequent flow, the content of the collected initial alarm ticket is analyzed, and the format conversion is carried out on key fields such as title, time, network element name and the like in the initial alarm ticket according to a preset format, so that the initial alarm tickets with different formats are converted into the alarm ticket with a uniform format.
And determining the alarm network element contained in the alarm ticket and the target service corresponding to the alarm network element by extracting the key field in the alarm ticket. And determining the associated network element which has an association relation with the alarm network element in the service execution process according to the execution logic of the target service.
In order to sort and simplify a complex network formed by an alarm network element and an associated network element, the alarm network element and the associated network element are mapped into a network topology, a part of the network topology including the alarm network element and the associated network element is determined as a service network topology, and the next step of the embodiment is executed by using the service network topology.
And step 104, determining alarm service chains in the service network topology according to the logical relationship among the network elements in the service network topology, wherein each alarm service chain comprises at least one alarm network element.
And determining a chain-shaped alarm service chain in the service network topology of the mesh structure according to the logic relation and the information flow direction between the alarm network element and the associated network element in the target service execution process. According to the actual situation, there may be multiple alarm service chains, and each alarm service chain includes at least 1 alarm network element.
When determining each alarm service chain, the specific method is as follows: for each alarm service chain, according to a service execution process, taking a network element which passes through the service execution process in a service network topology as an initial network element of the alarm service chain, wherein the network element is the lowest level in the alarm service chain, and the corresponding level number is 1; taking the net element which passes through last in the service execution process in the service network topology as a termination net element, wherein the net element is highest in the hierarchy of an alarm service chain; and the middle network elements are also arranged in sequence according to the service execution process to form an alarm service chain.
And 105, calculating the alarm weight of the alarm service chain, and determining the alarm reason of the target service according to the alarm service chain with the alarm weight higher than the set threshold value.
Fig. 2 is another flowchart of the network alarm processing method according to the embodiment. As shown in fig. 2, the specific flow of the step 105 is as follows:
s1051, removing invalid alarm network elements from the alarm service chain.
It should be noted that, in order to realize clear positioning of the alarm network element, when the alarm weight of the alarm service chain is calculated, the alarm network elements in the alarm service chain are all effective alarm network elements. Therefore, when calculating the alarm weight of the alarm service chain, the invalid alarm network elements need to be screened from the alarm service chain.
When the invalid alarm network element is screened from the alarm service chain, the specific method is as follows:
firstly, according to a preset time step, extracting alarm network elements contained in an alarm ticket in each time period.
Based on the bulkiness of the existing alarm quantity, when the alarm network elements are extracted, the alarm network elements contained in the alarm ticket in each time period are respectively extracted according to the preset time step length in the embodiment of the application. In the actual implementation, the preset time step can be set to 5 minutes as required.
Secondly, clustering is carried out on the alarm network elements in each time period.
And then, according to the clustering result, determining the alarm network elements with periodic alarms and the alarm network elements with the alarm total time length exceeding a set threshold value as invalid alarm network elements.
The alarm network elements with alarms periodically occurring in each time period and the alarm network elements with the alarm total duration exceeding the set threshold can be regarded as the alarm network elements which are found and located, and therefore, the alarm network elements are regarded as invalid alarm network elements. The set threshold value can be determined according to the needs of actual conditions.
On the basis, when the alarm weight of the alarm service chain is calculated, invalid alarm network elements can be screened from the alarm property chain. Specifically, a first alarm time of an alarm ticket corresponding to the alarm service chain is determined. A first time period corresponding to the first alarm time is determined. And acquiring an invalid alarm network element determined according to the alarm ticket in the first time period. And screening out invalid alarm network elements in the alarm service chain. The invalid warning network element in the warning service chain may be: and identifying the alarm network element in the alarm service chain as a normal network element.
In the embodiment of the application, after the screening of the invalid warning network elements is completed, the information of the rest valid warning network elements can be stored in the distributed storage system through the distributed interface so as to be convenient for information query and sharing.
S1052, calculating and screening the alarm weight of the alarm service chain after the invalid alarm network element.
And determining the alarm weight of the alarm service chain according to the number of the alarm network elements in the alarm service chain and the hierarchy of the alarm network elements in the alarm service chain. The level of the alarm network element in the alarm service chain means the rank of the alarm network element in the order determined according to the service flow direction in the service execution process. The network element sequence passing through first in the service execution process is ranked as 1 and sequentially increased.
S1053, determining the alarm service chain with the highest alarm weight as the root cause alarm service chain.
S1054, extracting the alarm network element in the root cause alarm service chain as the root cause alarm network element;
s1055, according to the root cause alarm network element, determining the reason of the alarm of the target service.
In the network alarm processing method, the alarm call ticket is obtained, the alarm network element contained in the alarm call ticket is determined, and the associated network element of the target service corresponding to the alarm network element is determined; mapping the alarm network element and the associated network element to a network topology to obtain a service network topology; determining an alarm service chain according to the logical relationship among network elements in the service network topology; and determining the alarm reason of the target service according to the alarm weight of the alarm service chain. The method realizes the high-efficiency acquisition and clear positioning of the network alarm and automatically determines the reason of the alarm.
Fig. 3 is a flowchart of another embodiment of a network alarm processing method according to the present application. As shown in fig. 3, after step 105 of the embodiment shown in fig. 1 of the present application, the method may further include:
and 106, visually presenting the root cause alarm network element in the service topology network.
In order to visually display the alarm network element and facilitate the checking of the alarm network element, the embodiment of the application visually presents the alarm network element after determining the root cause alarm network element. Specifically, the alarm rendering may be performed on the root cause alarm network element in the service topology network.
In the embodiment of the application, the root cause warning network element is presented in a visual form, so that the presentation form is more visual, and the condition that the warning network element is difficult to identify due to the fact that a large number of warnings are refreshed one by one is avoided.
Fig. 4 is a flowchart of a network alarm processing method according to another embodiment of the present application. As shown in fig. 4, the network alarm processing method of the present application may further include:
and step 107, calling a diagnosis rule base to repair the fault corresponding to the alarm reason.
Specifically, the diagnosis rule base may be associated with the distributed storage system, and the corresponding diagnosis rule is matched from the diagnosis rule base according to the alarm network element information in the distributed storage system, so as to perform fault repair.
In the diagnosis rule base, different diagnosis rules are set for different types of faults. And for the software type fault, inquiring a corresponding batch processing script in the diagnosis rule base, and executing the batch processing script corresponding to the fault to realize automatic fault repair. And for the fault of the hardware type, inquiring a corresponding diagnostician in the diagnosis rule base to realize automatic order dispatching, and manually repairing the fault by the diagnostician.
In the embodiment of the application, the diagnosis rule base is set, and different types of diagnosis rules are adopted for different types of faults, so that automatic software fault repair and automatic hardware fault dispatching are realized, the fault repair efficiency is improved, and the user experience is improved.
Fig. 5 is a schematic diagram of an embodiment of a network alarm processing method according to the present application.
For convenience of understanding, the embodiment of the present application will further describe the flow of the network alarm processing method in combination with the schematic diagram. As shown in fig. 5, the network alarm processing method includes the following steps:
step 1, collecting an initial alarm ticket through a northbound interface.
And 2, converting the format of the initial alarm ticket according to a preset format to generate an alarm ticket with a uniform format. And 2, determining an invalid alarm network element and determining an alarm reason of the target service based on the alarm ticket generated in the step 2. Specifically, the step 3 and the step 4 may be referred to for determining an invalid alarm network element based on the alarm ticket in the step 2. And (5) determining the alarm reason of the target service based on the alarm ticket in the step (2) according to the step (5-8).
And 3, clustering the alarm network elements contained in the alarm call ticket collected in each time period according to the preset time step.
And 4, determining an invalid alarm network element according to the clustering result. Specifically, the alarm network elements obtained after clustering are determined as invalid alarm network elements according to the temporal combination, wherein the alarm network elements give periodic alarms in each time period, and the alarm network elements with the total alarm duration exceeding a set threshold. Then, the determined invalid warning network elements are removed, and the removing mode comprises the following steps: and marking the invalid alarm network element as a normal network element.
And 3, processing the alarm call ticket in each time period in the step 4 and the time dimension, and determining an invalid alarm network element in the alarm call ticket so as to reduce the influence of the irrelevant alarm network element on the positioning efficiency and accuracy of the alarm network element in the execution process of the step 7.
And 5, extracting the alarm network element in the alarm ticket related to the target service.
And 6, associating the alarm network element with the topological network to obtain the service topological network. And generating an alarm service chain by using the service topology network. And step 6, simplifying the complex alarm network into an alarm service chain, conveniently determining the alarm reason through steps 7 and 8, and diagnosing the corresponding fault.
In a specific implementation process, the processing flows corresponding to the steps 3 and 4 and the processing flows corresponding to the steps 5 and 6 may be performed simultaneously.
And 7, calculating the alarm weight of each alarm service chain by using a root cause weight algorithm. Specifically, the two processing flows of the steps 3 and 4 and the steps 5 and 6 may be associated through a timestamp, that is, the first alarm time of the alarm ticket corresponding to the alarm service chain in the step 6 is determined according to the alarm service chain in the step 6; and determining a first time period corresponding to the first alarm time in the step 3 according to the first alarm time, and further determining an invalid alarm network element corresponding to the first time period in the step 4. And then, in the alarm service chain generated in the step 6, marking the invalid alarm network element determined in the step 4 as a normal network element, and calculating the alarm weight of each alarm service chain according to the rest valid alarm network elements by utilizing a root weight algorithm.
And 8, determining a root cause alarm network element, and automatically diagnosing the fault corresponding to the alarm.
And determining the alarm service chain with the highest alarm weight as a root cause alarm service chain, and taking the alarm network element in the root cause alarm service chain as the root cause alarm network element. And automatically diagnosing the fault corresponding to the alarm according to the corresponding diagnostic rule.
And 9, visually presenting the root cause alarm network element through the service topology network.
Specifically, the alarm rendering can be performed on the alarm network element in the topology network, the alarm network element can be visually displayed, and the situation that a large number of alarm items are refreshed and difficult to view is avoided.
In another embodiment of the present application, a specific example is used to describe a specific method for determining an alarm service chain in the service topology network in step 104.
Fig. 6 is a schematic diagram of another embodiment of a network alarm processing method according to the present application. As shown in fig. 6, in the service topology network, the alarm network elements involved in the network failure include network element 21, network element 22 and network element 42.
According to the flow direction of information in the service topology network shown in fig. 6 during the service execution process, the following alarm service chain can be obtained:
alarm service chain 1: network element 11-network element 21-network element 41
And (3) an alarm service chain 2: network element 11-network element 22-network element 42
Alarm service chain 3: network element 13-network element 21-network element 41
And 4, alarm service chain: network element 13-network element 22-network element 42
……
And (4) an alarm service chain N: … …
The alarm service chain 1 is taken as an example for explanation. For the alarm service chain 1, the network element that passes through first in the service execution process is the network element 11, i.e., the initial network element, which has the lowest level in the alarm service chain and is 1; the network element 21 is an alarm network element in an alarm service chain, is a second network element passed by in the service execution process, and has a hierarchy level of 2 in the alarm service chain; the last network element passed through in the service execution process is the network element 41, i.e., the terminating network element, which has the highest level of 3 in the alarm service chain.
In another embodiment of the present application, a specific method for calculating the alarm weight of the alarm service chain after the invalid alarm network elements are screened out in step 105 is described.
When the number of the alarm network elements in the alarm service chain is 1, calculating the alarm weight of the alarm service chain according to the following formula:
wherein m is the level of the alarm network element in the alarm service chain; and N is the total number of network elements contained in the alarm service chain.
For example, if there is an alarm network element in the alarm service chain, and the level of the alarm network element in the alarm service chain is 1; if the total number of network elements in the alarm service chain is 8, then the alarm weight of the alarm service chain is:
if an alarm network element exists in the alarm service chain, and the level of the alarm network element in the alarm service chain is 3; if the total number of network elements in the alarm service chain is 8, then the alarm weight of the alarm service chain is:
it can be seen that, when only one alarm network element exists in the alarm service chain, the higher the hierarchy of the alarm network element is, the greater the alarm weight of the alarm service chain is, and the greater the possibility of becoming the root cause of the alarm service chain is.
When the number of the alarm network elements in the alarm service chain is greater than 1, calculating the alarm weight of the alarm service chain according to the following formula:
wherein, the alarm service chain includes n sections of continuously connected normal network elements, and a1 … … an is the number of each section of continuously connected normal network elements; and b is the maximum number of the alarm network elements which are continuously connected in the alarm service chain.
For example, if the alarm service chain includes 2 segments of continuously connected normal network elements, and the number of each segment of continuously connected normal network elements is 2 and 5 respectively; the maximum number of the alarm network elements continuously connected in the alarm service chain is 2, and then the alarm weight of the alarm service chain is:
if the alarm service chain comprises 2 sections of continuously connected normal network elements, and the number of each section of continuously connected normal network elements is 2 and 2 respectively; the maximum number of the alarm network elements continuously connected in the alarm service chain is 3, and then the alarm weight of the alarm service chain is:
it can be seen that, when the number of the alarm network elements in the alarm service chain is greater than 1, the greater the number of the alarm network elements that are continuously connected, the smaller the number of the normal network elements that are continuously connected, the greater the alarm weight of the alarm service chain, and the greater the possibility of becoming the root cause alarm service chain.
In the embodiment of the application, the alarm weight of each alarm service chain is determined according to the number of the alarm network elements included in each alarm service chain and the hierarchy of the alarm network elements in the alarm service chain, and the alarm service chain with the highest alarm weight is determined as the root cause alarm service chain. The root cause alarm network element contained in the root cause alarm service chain is used as the alarm network element most concerned by alarm positioning, so that the interference of the irrelevant alarm network element to the alarm positioning is reduced, and the alarm positioning is clearer and more accurate.
Fig. 7 is a schematic structural diagram of an embodiment of a network alarm processing apparatus according to the present application, where the network alarm processing apparatus in the embodiment may be used as a network fault processing device to implement the network fault processing method according to the present application. As shown in fig. 7, the network failure processing apparatus may include: an acquisition module 71, a determination module 72 and a processing module 73.
The obtaining module 71 is configured to obtain an alarm ticket, where the alarm ticket includes an alarm network element.
The determining module 72 is configured to determine a relevant network element of the target service corresponding to the alarm network element, map the alarm network element and the relevant network element into a network topology, and determine a service network topology including the alarm network element and the relevant network element from the network topology. And determining an alarm service chain in the service network topology according to the logical relationship among the network elements in the service network topology. Wherein, each alarm service chain comprises at least one alarm network element.
And the processing module 73 is configured to calculate an alarm weight of the alarm service chain, and use the alarm service chain with the alarm weight higher than the set threshold as a root cause alarm service chain. And determining the alarm reason of the target service according to the root reason alarm service chain.
The processing module 73 is configured to, when calculating the alarm weight of the alarm service chain, specifically, screen an invalid alarm network element from the alarm network elements included in the alarm service chain, and calculate the alarm weight of the alarm service chain after the invalid alarm network element is screened.
The network alarm processing device acquires the alarm ticket through the acquisition module 71, and determines the alarm network elements contained in the alarm ticket. The determining module 72 determines the associated network element of the target service corresponding to the alarm network element, and maps the alarm network element and the associated network element to the network topology to obtain the service network topology. And determining an alarm service chain according to the logical relationship among network elements in the service network topology. The processing module 73 determines the alarm reason of the target service according to the alarm weight of the alarm service chain. The method realizes the high-efficiency acquisition and clear positioning of the network alarm and automatically determines the reason of the alarm.
Fig. 8 is a schematic structural diagram of another embodiment of a network alarm processing device according to the present application, and compared with the network alarm processing device shown in fig. 7, the difference is that the network alarm processing device shown in fig. 8 may further include: a display module 81 and a diagnostic module 82.
And the display module 81 is configured to display the root cause alarm network element in the root cause alarm service chain determined by the processing module. Specifically, the alarm rendering can be performed on the root cause alarm network element in the service network topology.
And the diagnosis module 82 is used for automatically repairing various faults according to the diagnosis rules prestored in the diagnosis module.
FIG. 9 is a schematic structural diagram of an embodiment of an electronic device according to the present application, as shown in FIG. 9, the electronic device may include at least one processor; and at least one memory communicatively coupled to the processor, wherein: the memory stores program instructions executable by the processor, and the processor calls the program instructions to execute the network alarm processing method provided by the embodiment of the application.
The electronic device may be a network alarm processing device, and the embodiment does not limit the specific form of the electronic device.
FIG. 9 illustrates a block diagram of an exemplary electronic device suitable for use in implementing embodiments of the present application. The electronic device shown in fig. 9 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present application.
As shown in fig. 9, the electronic device is embodied in the form of a general purpose computing device. Components of the electronic device may include, but are not limited to: one or more processors 410, a memory 430, and a communication bus 440 that connects the various system components (including the memory 430 and the processing unit 410).
Electronic devices typically include a variety of computer system readable media. Such media may be any available media that is accessible by the electronic device and includes both volatile and nonvolatile media, removable and non-removable media.
A program/utility having a set (at least one) of program modules, including but not limited to an operating system, one or more application programs, other program modules, and program data, may be stored in memory 430, each of which examples or some combination may include an implementation of a network environment. The program modules generally perform the functions and/or methodologies of the embodiments described herein.
The electronic device may also communicate with one or more external devices (e.g., keyboard, pointing device, display, etc.), one or more devices that enable a user to interact with the electronic device, and/or any devices (e.g., network card, modem, etc.) that enable the electronic device to communicate with one or more other computing devices. Such communication may occur via communication interface 420. Furthermore, the electronic device may also communicate with one or more networks (e.g., a Local Area Network (LAN), a Wide Area Network (WAN), and/or a public Network such as the Internet) via a Network adapter (not shown in FIG. 9) that may communicate with other modules of the electronic device via the communication bus 440. It should be appreciated that although not shown in FIG. 9, other hardware and/or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, Redundant processing units, external disk drive Arrays, disk array (RAID) systems, tape Drives, and data backup storage systems, among others.
The processor 410 executes programs stored in the memory 430 to perform various functional applications and data processing, for example, implement the network alarm processing method provided by the embodiment of the present application.
The embodiment of the present application further provides a non-transitory computer-readable storage medium, where the non-transitory computer-readable storage medium stores a computer instruction, and the computer instruction causes the computer to execute the network alarm processing method provided in the embodiment of the present application.
The non-transitory computer readable storage medium described above may take any combination of one or more computer readable media. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a Read Only Memory (ROM), an Erasable Programmable Read Only Memory (EPROM), a flash Memory, an optical fiber, a portable compact disc Read Only Memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.
In the description herein, reference to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the application. In this specification, the schematic representations of the terms used above are not necessarily intended to refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, various embodiments or examples and features of different embodiments or examples described in this specification can be combined and combined by one skilled in the art without contradiction.
Any process or method descriptions in flow charts or otherwise described herein may be understood as representing modules, segments, or portions of code which include one or more executable instructions for implementing steps of a custom logic function or process, and alternate implementations are included within the scope of the preferred embodiment of the present application in which functions may be executed out of order from that shown or discussed, including substantially concurrently or in reverse order, depending on the functionality involved, as would be understood by those reasonably skilled in the art of the present application.
It should be noted that the terminal according to the embodiments of the present application may include, but is not limited to, a Personal Computer (Personal Computer; hereinafter, referred to as PC), a Personal Digital Assistant (Personal Digital Assistant; hereinafter, referred to as PDA), a wireless handheld device, a Tablet Computer (Tablet Computer), a mobile phone, an MP3 player, an MP4 player, and the like.
In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical division, and there may be other divisions in actual implementation, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.
The above description is only exemplary of the present application and should not be taken as limiting the present application, as any modification, equivalent replacement, or improvement made within the spirit and principle of the present application should be included in the scope of protection of the present application.
Claims (10)
1. A network alarm processing method is characterized by comprising the following steps:
acquiring an alarm ticket, wherein the alarm ticket comprises an alarm network element;
determining a related network element of a target service corresponding to the alarm network element;
mapping the alarm network element and the associated network element into a network topology, and determining a service network topology containing the alarm network element and the associated network element from the network topology;
determining alarm service chains in the service network topology according to the logical relationship among network elements in the service network topology, wherein each alarm service chain comprises at least one alarm network element;
calculating the alarm weight of the alarm service chain; and determining the alarm reason of the target service according to the alarm service chain with the alarm weight higher than the set threshold value.
2. The method of claim 1, wherein obtaining an alarm ticket comprises:
acquiring initial alarm tickets of all network elements in a communication network through a northbound interface;
and according to a preset format, carrying out format conversion on the initial alarm ticket to obtain an alarm ticket.
3. The method of claim 1, wherein calculating the alarm weight for the alarm traffic chain comprises:
screening invalid alarm network elements from alarm network elements contained in the alarm service chain;
and calculating the alarm weight of the alarm service chain after the invalid alarm network element is screened out.
4. The method of claim 3, further comprising:
extracting alarm network elements contained in the alarm call ticket in each time period according to a preset time step;
clustering the alarm network elements in each time period respectively;
and according to the clustering result, determining the alarm network elements with periodic alarms and the alarm network elements with the alarm total duration exceeding a set threshold value as invalid alarm network elements.
5. The method according to any of claims 1 to 4, wherein calculating an alarm weight for the alarm traffic chain comprises:
and determining the alarm weight of the alarm service chain according to the number of the alarm network elements in the alarm service chain and the hierarchy of the alarm network elements in the alarm service chain.
6. The method of claim 5, wherein determining the alarm weight of the alarm service chain according to the number of alarm network elements in the alarm service chain and the hierarchy of the alarm network elements in the alarm service chain comprises:
when the number of alarm network elements in an alarm service chain is 1, calculating the alarm weight of the alarm service chain according to the following formula:
wherein m is the level of the alarm network element in the alarm service chain; n is the total number of network elements contained in the alarm service chain;
when the number of the alarm network elements in the alarm service chain is greater than 1, calculating the alarm weight of the alarm service chain according to the following formula:
wherein, the alarm service chain comprises n sections of continuously connected normal network elements; a1 … … an is the number of normal network elements that are continuously connected for each segment; and b is the maximum number of the alarm network elements which are continuously connected in the alarm service chain.
7. The method of claim 3, wherein determining the alarm reason of the target service according to the alarm service chain with the alarm weight higher than the set threshold comprises:
determining the alarm service chain with the highest alarm weight as a root cause alarm service chain;
extracting the alarm network element in the root cause alarm service chain as a root cause alarm network element;
and determining the alarm reason of the target service according to the root reason alarm network element.
8. The method of claim 7, further comprising:
in a service topology network, visually presenting the root cause alarm network element;
wherein the visual presentation comprises: and (5) alarm rendering.
9. An electronic device, comprising:
at least one processor; and
at least one memory communicatively coupled to the processor, wherein:
the memory stores program instructions executable by the processor, the processor invoking the program instructions to perform the method of any of claims 1 to 8.
10. A non-transitory computer-readable storage medium storing computer instructions that cause a computer to perform the method of any one of claims 1 to 8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010766696.4A CN114095335B (en) | 2020-08-03 | 2020-08-03 | Network alarm processing method and device and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010766696.4A CN114095335B (en) | 2020-08-03 | 2020-08-03 | Network alarm processing method and device and electronic equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114095335A true CN114095335A (en) | 2022-02-25 |
| CN114095335B CN114095335B (en) | 2023-11-03 |
Family
ID=80295234
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010766696.4A Active CN114095335B (en) | 2020-08-03 | 2020-08-03 | Network alarm processing method and device and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114095335B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115243286A (en) * | 2022-06-20 | 2022-10-25 | 中国联合网络通信集团有限公司 | Data processing method, device and storage medium |
| CN115396289A (en) * | 2022-08-31 | 2022-11-25 | 广东电网有限责任公司 | Fault alarm determination method and device, electronic equipment and storage medium |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20110141914A1 (en) * | 2009-12-15 | 2011-06-16 | Chen-Yui Yang | Systems and Methods for Providing Ethernet Service Circuit Management |
| WO2013155807A1 (en) * | 2012-04-16 | 2013-10-24 | 中兴通讯股份有限公司 | Method and apparatus for correlation analysis of layered network alarms and services |
| CN105721184A (en) * | 2014-12-03 | 2016-06-29 | 中国移动通信集团山东有限公司 | Network link quality monitoring method and apparatus |
| WO2017181805A1 (en) * | 2016-04-20 | 2017-10-26 | 中兴通讯股份有限公司 | Method and device for displaying warning information, and computer storage medium |
| US20180254942A1 (en) * | 2017-03-01 | 2018-09-06 | Teoco Ltd. | System and Method for Alarm Correlation and Root Cause Determination |
| CN109634819A (en) * | 2018-10-26 | 2019-04-16 | 阿里巴巴集团控股有限公司 | Alarm root is because of localization method and device, electronic equipment |
| CN109787816A (en) * | 2018-12-28 | 2019-05-21 | 北京奇安信科技有限公司 | Traffic failure localization method, device, equipment and medium |
| CN110493042A (en) * | 2019-08-16 | 2019-11-22 | 中国联合网络通信集团有限公司 | Method for diagnosing faults, device and server |
-
2020
- 2020-08-03 CN CN202010766696.4A patent/CN114095335B/en active Active
Patent Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20110141914A1 (en) * | 2009-12-15 | 2011-06-16 | Chen-Yui Yang | Systems and Methods for Providing Ethernet Service Circuit Management |
| WO2013155807A1 (en) * | 2012-04-16 | 2013-10-24 | 中兴通讯股份有限公司 | Method and apparatus for correlation analysis of layered network alarms and services |
| CN103378980A (en) * | 2012-04-16 | 2013-10-30 | 中兴通讯股份有限公司 | Method for correlation analysis of layer network alarm with business and device thereof |
| CN105721184A (en) * | 2014-12-03 | 2016-06-29 | 中国移动通信集团山东有限公司 | Network link quality monitoring method and apparatus |
| WO2017181805A1 (en) * | 2016-04-20 | 2017-10-26 | 中兴通讯股份有限公司 | Method and device for displaying warning information, and computer storage medium |
| US20180254942A1 (en) * | 2017-03-01 | 2018-09-06 | Teoco Ltd. | System and Method for Alarm Correlation and Root Cause Determination |
| CN109634819A (en) * | 2018-10-26 | 2019-04-16 | 阿里巴巴集团控股有限公司 | Alarm root is because of localization method and device, electronic equipment |
| CN109787816A (en) * | 2018-12-28 | 2019-05-21 | 北京奇安信科技有限公司 | Traffic failure localization method, device, equipment and medium |
| CN110493042A (en) * | 2019-08-16 | 2019-11-22 | 中国联合网络通信集团有限公司 | Method for diagnosing faults, device and server |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115243286A (en) * | 2022-06-20 | 2022-10-25 | 中国联合网络通信集团有限公司 | Data processing method, device and storage medium |
| CN115396289A (en) * | 2022-08-31 | 2022-11-25 | 广东电网有限责任公司 | Fault alarm determination method and device, electronic equipment and storage medium |
| CN115396289B (en) * | 2022-08-31 | 2024-03-22 | 广东电网有限责任公司 | Fault alarm determining method and device, electronic equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114095335B (en) | 2023-11-03 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110647447B (en) | Abnormal instance detection method, device, equipment and medium for distributed system | |
| CN114095335B (en) | Network alarm processing method and device and electronic equipment | |
| CN109885537B (en) | Log display method, system and computer readable storage medium | |
| CN112306835A (en) | User data monitoring and analyzing method, device, equipment and medium | |
| CN113032403A (en) | Data insight method, device, electronic equipment and storage medium | |
| CN113626335A (en) | Quality evaluation method and system for public security traffic management application software | |
| CN113268403A (en) | Time series analysis and prediction method, device, equipment and storage medium | |
| CN113763502A (en) | Chart generation method, device, equipment and storage medium | |
| CN115237724A (en) | Data monitoring method, device, equipment and storage medium based on artificial intelligence | |
| CN111460293B (en) | Information pushing method and device and computer readable storage medium | |
| CN114896024B (en) | Method and device for detecting running state of virtual machine based on kernel density estimation | |
| CN109345112A (en) | A kind of maintenance technician's ranking method, system and electronic equipment and storage medium | |
| CN114417741A (en) | One-machine one-file equipment data management and processing system | |
| CN113570388A (en) | Remote anti-electricity-stealing checking method and device, computer equipment and storage medium | |
| CN110457705B (en) | Method, device, equipment and storage medium for processing point of interest data | |
| CN113220551A (en) | Index trend prediction and early warning method and device, electronic equipment and storage medium | |
| CN113849464A (en) | Information processing method and apparatus | |
| CN110059234A (en) | Water utilities anomalous event method for detecting and device, computer installation and storage medium | |
| CN114490624B (en) | Big data-based intelligent statistical method and system for people, house, enterprise and readable storage medium | |
| CN117353462B (en) | Power grid operation monitoring analysis method and platform based on artificial intelligence | |
| TWI809635B (en) | Insurance claims fraud detecting system and method for assessing the risk of insurance claims fraud using the same | |
| CN116738216B (en) | Association processing method and device for early warning big data | |
| EP4254182A1 (en) | Method and apparatus of detecting running state of a virtual machine based on kernel density estimation | |
| CN116663257A (en) | Accounting method, system, equipment and storage medium for stamping effective stroke | |
| CN117056352A (en) | Data display method, device, terminal equipment and readable storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |