CN114448774A - Alarm processing method, device and storage medium - Google Patents
Alarm processing method, device and storage medium Download PDFInfo
- Publication number
- CN114448774A CN114448774A CN202111561777.1A CN202111561777A CN114448774A CN 114448774 A CN114448774 A CN 114448774A CN 202111561777 A CN202111561777 A CN 202111561777A CN 114448774 A CN114448774 A CN 114448774A
- Authority
- CN
- China
- Prior art keywords
- alarm
- alarms
- tree
- root
- historical
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000003672 processing method Methods 0.000 title claims abstract description 28
- 238000000034 method Methods 0.000 claims abstract description 41
- 238000012545 processing Methods 0.000 claims abstract description 19
- 238000004458 analytical method Methods 0.000 claims abstract description 15
- 238000010219 correlation analysis Methods 0.000 claims description 47
- 238000011156 evaluation Methods 0.000 claims description 18
- 238000004590 computer program Methods 0.000 claims description 11
- 238000012217 deletion Methods 0.000 claims description 5
- 230000037430 deletion Effects 0.000 claims description 5
- 238000010223 real-time analysis Methods 0.000 abstract description 2
- 230000000875 corresponding effect Effects 0.000 description 30
- 238000004891 communication Methods 0.000 description 8
- 238000010586 diagram Methods 0.000 description 8
- 230000003287 optical effect Effects 0.000 description 8
- 239000013307 optical fiber Substances 0.000 description 7
- 238000011144 upstream manufacturing Methods 0.000 description 7
- 238000013210 evaluation model Methods 0.000 description 5
- 230000008569 process Effects 0.000 description 5
- 230000001629 suppression Effects 0.000 description 4
- 238000004364 calculation method Methods 0.000 description 3
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 239000000835 fiber Substances 0.000 description 3
- 238000007726 management method Methods 0.000 description 3
- 238000012986 modification Methods 0.000 description 3
- 230000004048 modification Effects 0.000 description 3
- 230000002159 abnormal effect Effects 0.000 description 2
- 238000013528 artificial neural network Methods 0.000 description 2
- 230000002596 correlated effect Effects 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 230000005764 inhibitory process Effects 0.000 description 2
- 238000009825 accumulation Methods 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 230000003247 decreasing effect Effects 0.000 description 1
- 230000008034 disappearance Effects 0.000 description 1
- 235000019800 disodium phosphate Nutrition 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 238000012549 training Methods 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0677—Localisation of faults
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The embodiment of the disclosure relates to an alarm processing method, an alarm processing device and a storage medium, wherein the method comprises the following steps: determining an alarm set; according to a preset relevance rule, carrying out relevance analysis on a plurality of alarms in an alarm set to obtain an association relation between the alarms; and determining the root alarm in the plurality of alarms according to the association relation among the alarms. The embodiment of the disclosure can realize real-time analysis of network root source alarm, greatly shorten alarm processing time and facilitate quick positioning of root cause fault.
Description
Technical Field
The present disclosure relates to the field of information technologies, and in particular, to an alarm processing method and apparatus, and a storage medium.
Background
The network device is an important component of the construction of a novel infrastructure, and refers to various switches, routers, data transmission and other devices required by the whole network, and the network management system is a platform system for managing the devices and has management functions of configuration, alarm, performance, safety and the like.
Since twenty-first century, communication networks have been rapidly developed, the scale accumulation of equipment is quite large, and various equipment alarms can be generated due to sudden reasons such as equipment faults, optical fiber faults and misoperation in the actual network operation. How to rapidly determine the root alarm of the fault from a large number of alarms becomes an urgent problem to be solved.
Disclosure of Invention
The embodiment of the disclosure provides an alarm processing method, an alarm processing device and a storage medium.
The technical scheme of the disclosure is realized as follows:
in a first aspect, an alarm processing method is provided, where the method includes:
determining an alarm set;
according to a preset relevance rule, carrying out relevance analysis on a plurality of alarms in the alarm set to obtain an association relation among the alarms;
and determining the root alarm in the plurality of alarms according to the incidence relation among the alarms.
In the foregoing solution, the performing, according to a preset relevance rule, relevance analysis on multiple alarms in the alarm set to obtain an association relationship between the alarms includes:
determining alarm attribute information of each alarm;
aiming at any two alarms which are subjected to correlation analysis, executing a correlation rule matched with alarm attribute information of the two alarms to obtain an incidence relation between the two alarms; wherein the dependency rules comprise: alarm attribute information of the source alarm and alarm attribute information of the derived alarm.
In the foregoing solution, the alarm attribute information includes: one or more items of alarm level, alarm type, alarm time, and attribute information of the alarm source;
the alert source includes: the device resource or the link between the devices that generated the alarm.
In the above scheme, when there are multiple correlation rules matching both the attribute information of the two alarms, the executed correlation rules are as follows: a most reliable correlation rule among the plurality of correlation rules.
In the foregoing solution, the method further includes:
and adjusting the reliability of the executed correlation rule according to the correctness evaluation result of the root alarm.
In the foregoing solution, the determining, according to the association relationship between the alarms, that causes a root alarm in the multiple alarms includes:
generating an alarm tree according to the incidence relation among the alarms, wherein the alarm tree comprises: one node corresponds to one alarm, the alarm corresponding to the father node is a source alarm, and the alarm corresponding to the child node of the father node is a derivative alarm;
and determining to cause a root alarm in the plurality of alarms according to the alarm tree.
In the above solution, the association relationship between the alarms includes: the method comprises the following steps of (1) associating relation between first alarms and associating relation between the first alarms and second alarms; wherein the first alarm is: the alarm set comprises alarms different from the historical alarm set, and the second alarm is: alarms which are common to the alarm set and the historical alarm set;
generating an alarm tree according to the incidence relation among the alarms comprises the following steps:
updating a historical alarm tree according to the incidence relation between the first alarms and the second alarms; wherein different nodes in the historical alarm tree correspond to different alarms in the historical alarm set;
and generating the alarm tree according to the updated historical alarm tree.
In the foregoing solution, the generating the alarm tree according to the updated historical alarm tree includes:
when the historical alarm set also comprises a third alarm which is different from the alarm set, executing deletion operation in the updated historical alarm tree to obtain the alarm tree;
and deleting the node corresponding to the third alarm and the edge connected with the node, wherein the alarm corresponding to the root node in the alarm tree is the root alarm in the alarm set.
In the above scheme, the historical alarm set is as follows: and the historical alarm set with the largest number of second alarms in common with the alarm set in the plurality of historical alarm sets.
In a second aspect, an alarm processing apparatus is provided, the apparatus comprising:
the first determining module is used for determining an alarm set;
the correlation analysis module is used for carrying out correlation analysis on the plurality of alarms in the alarm set according to a preset correlation rule to obtain an incidence relation among the alarms;
and the second determination module is used for determining the root alarm in the plurality of alarms according to the incidence relation among the alarms.
In a third aspect, a computer device is provided, which includes a memory, a processor, and a computer program stored on the memory and executable on the processor, and when the processor executes the program, the steps of the alarm processing method according to any one of the first aspect are implemented.
In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, which computer program, when being executed by a processor, carries out the steps of the alert processing method of any one of the first aspects.
The alarm processing method, the alarm processing device and the storage medium provided by the disclosure are characterized in that an alarm set is determined; according to a preset relevance rule, carrying out relevance analysis on a plurality of alarms in an alarm set to obtain an association relation between the alarms; and determining to cause a root alarm in the plurality of alarms according to the incidence relation among the alarms. Therefore, compared with a mode of manually analyzing root cause alarm, the embodiment of the disclosure can quickly analyze the root cause alarm from a large amount of alarms, greatly shortens the alarm processing time, and is convenient for quickly positioning the root cause fault.
Drawings
Fig. 1 is a schematic flow chart of an alarm processing method according to an embodiment of the present disclosure;
FIG. 2 is a schematic flow chart of step 102 of the method of FIG. 1;
FIG. 3 is a schematic flow chart of step 103 of the method shown in FIG. 1;
FIG. 4 is a schematic flow chart of step 301 of the method shown in FIG. 3;
fig. 5 is a specific flowchart of an alarm processing method according to an embodiment of the present disclosure.
Fig. 6 is a schematic diagram of a point-to-point network topology according to an embodiment of the present disclosure;
fig. 7 is a schematic alarm diagram in an OCH service optical fiber interruption scenario provided in the embodiment of the present disclosure;
fig. 8 is a specific flowchart of another alarm processing method according to the embodiment of the present disclosure.
Fig. 9 is a schematic structural diagram of an alarm processing apparatus according to an embodiment of the present disclosure;
fig. 10 is a schematic structural diagram of a computer device according to an embodiment of the present disclosure.
Detailed Description
To make the objects, technical solutions and advantages of the present disclosure more clearly and completely apparent, the technical solutions in the embodiments of the present disclosure will be described below with reference to the accompanying drawings in the embodiments of the present disclosure, and it is obvious that the described embodiments are only a part of the embodiments of the present disclosure, not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments disclosed herein without making any creative effort, shall fall within the protection scope of the present disclosure. The embodiments and features of the embodiments in the present disclosure may be arbitrarily combined with each other without conflict. The steps illustrated in the flow charts of the figures may be performed in a computer system such as a set of computer-executable instructions. Also, while a logical order is shown in the flow diagrams, in some cases, the steps shown or described may be performed in an order different than here.
It is to be understood that the description of the embodiments of the present disclosure emphasizes the differences between the embodiments, and the same or similar parts may be referred to each other, so that the descriptions thereof are omitted for brevity.
It should be noted that: "first," "second," and the like are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. In addition, the technical solutions described in the embodiments of the present disclosure can be arbitrarily combined without conflict.
The device in the network system has correlation, the fault of the correlated device can be caused by one device fault, the correlated upstream and downstream devices and services can generate a large amount of alarms in a short time, the network management platform can stack alarm acquisition by default to cause that real alarm information is submerged, the reason fault is very difficult to identify, and when large-area fault alarm occurs, the condition is more serious, so that the reason alarm is manually analyzed, and the real-time requirement of alarm processing of a large-scale network can not be basically met.
The embodiment of the disclosure provides an alarm processing method, which can be executed by an alarm processing device, the device can be realized by software and/or hardware, and the device can be configured in computer equipment, so that the computer equipment can execute the alarm processing method.
Referring to fig. 1, the alarm processing method may include:
101, determining an alarm set.
The set of alarms includes a plurality of alarms within a preset time period. The preset time period may be a current time period including a current time, or may be another time period. Alarms may be identified using an alarm number or an alarm name.
Specifically, the alarm set may be determined according to a plurality of alarms within a preset time period actively reported by the network system, or may be determined according to a plurality of alarms within a preset time period extracted from alarm log information of the network system by using a polling mechanism. Here, the network system may be various communication network systems such as an optical communication network system.
A fault or abnormal event in the network system can cause a plurality of alarms, wherein the alarm caused by the fault or the abnormal event directly is called a root alarm, and the alarm derived directly or indirectly from the root alarm is called a derived alarm. After a root alarm is generated, the alarm propagates along the call link in the network system, resulting in a large number of derived alarms.
102, according to a preset relevance rule, carrying out relevance analysis on a plurality of alarms in the alarm set to obtain an association relation among the alarms.
The correlation rule is used for analyzing the incidence relation between the alarms. The relevance rule may be generated in advance according to the relevance between the alarms mined from the historical alarm data information, or may be preset according to expert experience, which is not specifically limited in this embodiment.
The association between any two alarms may include: source alarms and derived alarms caused by source alarms.
It will be appreciated that the source alarm is relative to the derived alarm. For example, for alarm a and alarm b, alarm a is the source alarm, alarm b is the derivative alarm of alarm a, alarm a may also be the derivative alarm directly caused by alarm c, and alarm b may also be the source alarm causing alarm d.
Specifically, for each two alarms in the multiple alarms, a correlation rule in a preset rule base is traversed through an alarm analysis engine, the two alarms are matched with each traversed correlation rule, correlation analysis is performed on the two alarms according to the matched correlation rules, and the incidence relation between the two alarms is obtained.
103, determining to cause a root alarm in the plurality of alarms according to the incidence relation among the alarms.
In one example, an alarm propagation link is determined based on the incidence relationship between the alarms, and a root alarm in the plurality of alarms is determined to be caused based on the alarm propagation link. Wherein, the root alarm is the first alarm in the alarm propagation link.
In another example, an alarm association relationship graph may be constructed according to association relationships between alarms, and a root alarm in a plurality of alarms may be caused according to the alarm association relationship graph.
For example, the alarm association graph may be represented in a tree structure. The tree structure includes: the method comprises the following steps that nodes and edges among the nodes, wherein one node corresponds to one alarm, the edges among the nodes are used for representing the incidence relation among the alarms, the alarm corresponding to a father node is a source alarm, and the alarm corresponding to a child node of the father node is a derivative alarm. The root alarm in the plurality of alarms can be determined according to the alarm corresponding to the root node of the tree structure.
The embodiment of the disclosure provides an alarm processing method, which performs alarm correlation analysis through correlation rules to obtain an association relationship between alarms, and determines a root alarm causing multiple alarms according to the association relationship between the alarms.
In an embodiment, as shown in fig. 2, in the step 102, performing correlation analysis on multiple alarms in the alarm set according to a preset correlation rule to obtain an association relationship between the alarms, including:
and 201, determining alarm attribute information of each alarm.
In one example, the alert attribute information includes: one or more of an alarm level, an alarm type, an alarm time, and attribute information of an alarm source.
The alert sources include: the device resource or the link between the devices that generated the alarm.
In one example, the alarm attribute information for each alarm may be queried from a pre-built abstract model. For example, according to the alarm number or the alarm name of each alarm, the alarm attribute information of each alarm is inquired from the abstract model.
Here, the abstract model may include: a device model, a device topology model, and/or an alarm model.
Wherein the device model comprises: device resource information, the device resource information comprising: network element information, board card port information and/or board card module information.
The device topology model comprises: network topology information among devices, the network topology information including: link information between devices, which may be used to indicate upstream and downstream relationships between devices. The device topology model can be obtained by constructing a network topology of the network system.
The alarm model includes: an alert source of the alert, an alert level, and an alert time, where the alert source may be a device resource or a link between devices that generated the alert. The alarm level may be set according to actual needs, for example, the alarm level may be decreased according to the alarm severity, and is divided into: emergency alarm, important alarm, secondary alarm, ordinary alarm. The alert time may include: the time of generation of the alert and/or the duration of the alert.
202, executing a correlation rule matched with the alarm attribute information of two alarms aiming at any two alarms subjected to correlation analysis to obtain an incidence relation between the two alarms; wherein, the correlation rule comprises: alarm attribute information of the source alarm and alarm attribute information of the derived alarm.
In one example, the relevance rules may be divided into: a correlation rule based on device resource information, a correlation rule based on network topology information, a correlation rule based on alarm level and/or alarm timing, a correlation rule based on device resource information and alarm level, a correlation rule based on network topology information and alarm level, and so on.
In one example, the relevance rules based on the device resource information are used to determine source alarms and derived alarms in the alarms generated by the device resource.
For any two alarms, the device resources of the two alarms may be: the same port, different ports of the same board card, the same module, different modules of the same board card, different board cards of the same network element, and the like.
The relevance rule based on the device resource information includes: the device resource information of the source alarm and the device resource information of the derived alarm. For example, the device resource generating the alarm a is an input port of the block board card a, the device resource generating the alarm b is an output port of the block board card a, and the matched correlation rule includes: the device resource information of the source alarm and the device resource information of the derived alarm are respectively an input port and an output port of the same board card, so that after the matched correlation rule is executed, the alarm a can be determined as the source alarm, and the alarm b can be determined as the derived alarm.
In one example, the correlation rule based on the network topology information is used to perform alarm correlation analysis according to the upstream and downstream of the topology where the alarm source is located, and determine the source alarm and the derived alarm.
For example, the correlation rule based on the network topology information may indicate: when the alarm attribute information of the alarm a indicates that the alarm source of the alarm a is the link upstream and the alarm attribute information of the alarm b indicates that the alarm source of the alarm b is the link downstream, after the correlation rule is executed, the alarm a can be determined as the source alarm and the alarm b is the derivative alarm.
In addition, the correlation rule based on the network topology information may also indicate other things, such as the link down alarm being the source alarm, the incoming alarm of the downstream device being the derived alarm, etc.
In one example, the relevance rules based on alert level and/or alert timing include: the alarm level and/or alarm time of the source alarm, the alarm level and/or alarm time of the derived alarm.
Wherein the alarm level of the source alarm is higher than the alarm level of the derived alarm, and the alarm time of the source alarm is earlier than the alarm time of the derived alarm.
In one example, the method is used for performing alarm correlation analysis on different alarms of the same equipment resource from alarm sources according to alarm levels based on the correlation rules of the equipment resource information and the alarm levels, wherein the alarm sources are two alarms of the same equipment resource, and the alarm level of the source alarm is higher than the alarm level of the derived alarm.
In one embodiment, when there are multiple correlation rules matching the attribute information of both alarms, the executed correlation rules are: the most reliable correlation rule among the plurality of correlation rules.
Here, the trustworthiness of the relevance rule may be used to characterize the reliability of the relevance rule.
In the embodiment of the disclosure, when the number of the matched correlation rules is multiple, the correlation rule with the highest reliability is selected from the multiple matched correlation rules to perform correlation analysis between alarms, so that the reliability of the correlation analysis of the alarms can be improved, and the accuracy of positioning the root alarms is improved.
In one embodiment, the method may further comprise:
and adjusting the credibility of the executed correlation rule according to the correctness evaluation result of the root alarm.
Wherein, the correctness evaluation result is used for indicating the correctness of the root alarm.
In one example, the correctness evaluation result may be input by the fault analyst after comparing the root fault point of the root alarm with the actual root fault point.
In another example, the correctness evaluation result may be an evaluation result obtained by evaluating the root alarm and the derived alarm according to a preset evaluation model. For example, the root cause alarm, the alarm attribute information of the root cause alarm, the derivative alarm, and the alarm attribute information of the derivative alarm are input into a preset evaluation model, and an evaluation result output by the preset evaluation model is obtained.
The preset evaluation model can be obtained by the following method:
and training the preset neural network according to the root alarm, the alarm attribute information of the root alarm, the derivative alarm and the alarm attribute information of the derivative alarm in the historical alarm set, and determining the trained preset neural network as a preset evaluation model.
As described above, the correctness evaluation result can be expressed using the correctness evaluation value. When the correctness evaluation value is larger than the preset threshold value, the correctness evaluation result indicates that the root cause alarm is a real root cause alarm, and when the correctness evaluation value is larger than the preset threshold value, the correctness evaluation result indicates that the root cause alarm is not the real root cause alarm.
Specifically, when the correctness evaluation result of the root alarm indicates that the root alarm is a real root alarm, the reliability of each executed correlation rule is increased according to a preset adjustment step length. And when the correctness evaluation result of the root alarm indicates that the root alarm is not the real root alarm, determining a correlation rule causing the error result in the executed correlation rules, and reducing the reliability of the determined correlation rule according to the preset adjustment step length.
In one example, the method may further comprise:
outputting rule modification prompt information, wherein the rule modification prompt information is used for prompting a correlation rule with modification reliability lower than preset reliability;
or deleting the correlation rule with the reliability lower than the preset reliability, wherein the preset reliability can be flexibly set according to the experience of the user or the actual requirement, and is not specifically limited herein. For example, when the confidence level value ranges from 0 to 1, the preset confidence level may be set to any value between 0.6 and 0.7.
In the embodiment of the disclosure, the reliability of the executed correlation rule is adjusted according to the correctness evaluation result of the root alarm, so that the correlation rule with high reliability can be conveniently used for alarm correlation analysis subsequently, and the reliability of the alarm correlation analysis can be ensured.
In an embodiment, as shown in fig. 3, in the step 103, determining to cause a root alarm in the multiple alarms according to the association relationship between the alarms may include:
301, generating an alarm tree according to the association relationship between alarms, wherein the alarm tree includes: and one node corresponds to one alarm, the alarm corresponding to the father node is a source alarm, and the alarm corresponding to the child node of the father node is a derivative alarm.
302, determining to cause a root alarm of the plurality of alarms according to the alarm tree.
In one example, the implementation of step 302 may include:
traversing the alarm tree from top to bottom, determining the node corresponding to the first alarm in the alarm set as the node corresponding to the root alarm, and determining the root alarm according to the determined node.
It can be understood that, when the alarms corresponding to the nodes included in the alarm tree all belong to the alarm set, the alarm corresponding to the root node of the alarm tree is the root alarm.
In the embodiment of the disclosure, the alarm tree is generated according to the incidence relation between the alarms, and the root alarm of a plurality of alarms is determined according to the alarm tree, so that the root alarm can be quickly determined.
In one embodiment, the association between alarms includes: the incidence relation between the first alarms and the second alarms; wherein the first alarm is: the alarm set comprises alarms different from the historical alarm set, and the second alarm is as follows: alarms common to the alarm set and the historical alarm set.
In specific implementation, a difference set operation may be performed on the alarm set and the historical alarm set to determine a first alarm included in the alarm set, which is different from the historical alarm set. And solving intersection operation on the alarm set and the historical alarm set, and determining a second alarm which is common to the alarm set and the historical alarm set.
As shown in fig. 4, in step 301, generating an alarm tree according to the association relationship between alarms may include:
401, updating a historical alarm tree according to the incidence relation between the first alarms and the second alarms; wherein different nodes in the historical alarm tree correspond to different alarms in the historical alarm set.
Specifically, an adding operation may be executed in the historical alarm tree according to the association relationship between the first alarms and the second alarms to update the alarm tree; and adding operation, namely adding a node corresponding to the first alarm and an edge connected with the node.
And 402, generating an alarm tree according to the updated historical alarm tree.
Here, the updated historical alarm tree may be directly used as an alarm tree for determining a root alarm in the set of alarms. At this time, the alarms corresponding to at least part of the nodes in the updated historical alarm tree are the alarms in the alarm set.
For example, when the historical alarm set is included in the alarm set (i.e., any one of the alarms in the historical alarm set is an alarm in the alarm set), the alarm corresponding to each node in the updated historical alarm tree belongs to the alarm set.
In the embodiment of the disclosure, the historical alarm tree is updated according to the association relationship between the first alarms and the second alarms, and correlation analysis is not required to be performed between the alarms which are common to the alarm set and the historical alarm set through correlation rules, so that the calculated amount in the correlation analysis process can be effectively reduced, the calculation resource consumption of the correlation analysis is saved, and the time for determining the root alarm in the alarm set is shortened.
In one embodiment, the set of historical alarms is: and the historical alarm set with the largest number of second alarms in common with the alarm set in the plurality of historical alarm sets.
Specifically, intersection operation is carried out on the alarm set and a plurality of historical alarm sets in different historical time periods respectively to obtain a plurality of intersection operation results, and the historical alarm set which has the most alarm quantity and is common to the alarm sets in the plurality of historical alarm sets is determined according to the plurality of intersection operation results.
In the embodiment of the disclosure, the calculation amount in the correlation analysis process can be further reduced, and the calculation resource consumption of the correlation analysis is further saved, so that the root alarm in the alarm set can be determined more quickly.
In an embodiment, in the step 402, generating an alarm tree according to the updated historical alarm tree may include:
and when the historical alarm set also comprises a third alarm different from the alarm set, executing deletion operation in the updated historical alarm tree to obtain the alarm tree.
And deleting the node corresponding to the third alarm and the edge connected with the node, wherein the alarm corresponding to the root node in the alarm tree is the root alarm in the alarm set.
In the embodiment of the present disclosure, when the history alarm set further includes a third alarm different from the alarm set, a deletion operation is performed in the updated history alarm tree, so that the alarm corresponding to any node in the obtained alarm tree belongs to the alarm set, and since the alarm corresponding to the parent node in the alarm tree is a source alarm and the alarm corresponding to the child node of the parent node is a derivative alarm, the alarm corresponding to the root node in the alarm tree can be directly determined as the root source alarm in the alarm set.
Next, the alarm processing method provided by the present disclosure is described with reference to specific embodiments.
Fig. 5 is a specific flowchart of an alarm processing method according to an embodiment of the present disclosure.
Referring to fig. 5, the alarm processing method may include the following steps:
and S11, creating an equipment model, a network topology model and an alarm model.
The equipment model includes: port resources, module resources, board card resources, and network element resources.
The network topology model comprises: network topology resources; the network topology resources include: port-to-port OCH (Optical Channel), OMS (Optical multiplex section), ETH (ethernet), and other topology resources.
The alarm model comprises: alert source, topology source, alert level, alert time, etc.
S12, starting an alarm analysis engine.
The alarm analysis engine is used for calling corresponding correlation rules to carry out correlation analysis among alarms so as to obtain the incidence relation among the alarms.
When the alarm analysis engine is started for the first time, various alarm correlation analysis rules are executed to perform correlation analysis on the whole network alarm set, a whole network alarm correlation analysis result tree is constructed, correlation analysis is triggered through generation and/or disappearance of a new alarm, and the whole network alarm correlation analysis result tree is updated according to the correlation analysis result.
And S13, performing alarm correlation analysis based on the correlation rule of the equipment resource information.
And the correlation rule based on the equipment resource information is used for determining the source alarm and the derived alarm in the alarms generated by the equipment resource. For any two alarms, the device resources of the two alarms may be: the same port, different ports of the same board card, the same module, different modules of the same board card, different board cards of the same network element, and the like.
And S14, performing alarm correlation analysis based on the correlation rule of the network topology information.
And the correlation rule based on the network topology information is used for carrying out alarm correlation analysis according to the upstream and downstream of the topology where the alarm source is located. For example, an output LOS (LOSs Of Signal) alarm Of an upstream EDFA (Erbium-doped Fiber Amplifier) suppresses an input LOS alarm Of a downstream EDFA, and for example, an Optical Fiber interruption alarm suppresses an input LOS alarm Of a downstream EDFA. Wherein alarm suppression may be used to prevent notification of derived alarms raised by a source alarm.
And S15, performing alarm correlation analysis based on the alarm grade and/or the correlation rule of the alarm time sequence.
Correlation rules based on alarm level and/or alarm timing may be used to exclude false alarms. In general, the root cause alarm is a higher level alarm, and the generation time of the root cause alarm is prior to the derivative alarm.
S16, constructing a whole network alarm correlation analysis result tree based on the alarm correlation analysis result.
The alarm correlation analysis result comprises the following steps: the suppression relationship between alarms. One alarm of any two alarms with inhibition relation is a source alarm, and the other alarm is a derivative alarm of the source alarm.
After at least one of the steps S12 to S15, a parent-child suppression relationship result (parent node is root alarm, child node is derivative alarm) is generated between every two alarms, and an N-ary tree can be constructed according to the parent-child relationship of the whole network, where the alarm corresponding to the upper node of the tree is generally the root alarm of each fault point of the whole network.
And S17, determining the credibility of the correlation rule based on the correctness of the alarm correlation analysis result.
The relevance rules are used for analyzing the relevance among the alarms, so that the feedback of the relevance analysis result analyzed by the relevance rules can be more helpful for judging the reliability of the relevance rules, and when the reliability of one relevance rule is lower than the set reliability, the alarm analysis engine abandons the rule, thereby being beneficial to the perfection of the relevance rules and the improvement of the reliability of the subsequent alarm relevance analysis.
Fig. 6 is a schematic diagram of a point-to-point network topology provided by an embodiment of the present disclosure, where the network topology shown in fig. 6 includes: an OLP (Optical Fiber Line Auto Switch Protection device), an EDFA, and a communication Line between devices. When an alarm is generated, the OLP board card included IN the OLP and its ports Tx, Rx, T1, T2, R1, R2, the EDFA board card included IN the EDFA and its IN/OUT ports, and the network element internal connection fiber and the network element inter-connection fiber of the topology may be true failure points for generating the alarm.
Fig. 7 is a schematic alarm diagram in an OCH service optical fiber interruption scenario provided in an embodiment of the present disclosure, where a network system shown in fig. 7 includes: MUX (Multiplexer), OLP, BA (Booster Power Amplifier), LA (Line Amplifier, optical Line Amplifier), PA (Pre-Amplifier), and DEMUX (De-Multiplexer). When OCH (Optical Channel) service Optical fiber is interrupted, assuming that the first EDFA input port reports LOS alarm due to no light, the derived alarm caused by LOS alarm will continue to the relay station as long as the alarm has a transfer characteristic, until the OTM (Optical Transport Module) station at the opposite end. When the correlation rule is used for carrying out correlation analysis on the alarms D to I, D > E can be analyzed according to the correlation rule of the downstream LOS alarm suppressed by the optical fiber interruption alarm, namely the alarm D suppresses the alarm E, and the symbol ">" represents the suppression relation; e > F, G > H can be analyzed according to the correlation rule of input and output inhibition of the EDFA object in the object; according to the correlation rule of suppressing downstream of topology upstream, F > G, H > I can be analyzed. And finally, D > E > F > G > H > I is obtained, so that the alarm D can be determined to be the root alarm.
Fig. 8 is a specific flowchart of another alarm processing method according to the embodiment of the present disclosure. Referring to fig. 8, the alarm processing method may include the following steps:
and S21, inquiring the whole network alarm.
And S22, inquiring the alarm level and/or the alarm time of the alarm.
Wherein, the alarm level and/or the alarm time can be inquired from the alarm model.
And S23, inquiring the alarm equipment resource.
The alert device resource may be used to query from the device model.
And S24, inquiring the device topology resource of the alarm.
The device topology resources can be obtained by querying in the device topology model.
And S25, inquiring a credible alarm correlation analysis rule.
Here, the trusted alarm correlation analysis rule may be an alarm correlation analysis rule whose confidence exceeds a preset confidence.
And S26, analyzing the correlation between the alarms according to the correlation analysis rule.
And S27, generating a correlation analysis result tree.
And S28, judging the reliability of the correlation rule.
In summary, the alarm processing method provided in this embodiment can implement real-time analysis of network root-source alarms, greatly shorten alarm processing time, and facilitate quick location of root cause faults.
Based on the foregoing method embodiment, an embodiment of the present disclosure further provides an alarm processing apparatus, as shown in fig. 9, the apparatus may include:
a first determining module 901, configured to determine an alarm set;
a correlation analysis module 902, configured to perform correlation analysis on multiple alarms in the alarm set according to a preset correlation rule, to obtain an association relationship between the alarms;
the second determining module 903 is configured to determine, according to the association relationship between the alarms, that a root alarm in the multiple alarms is caused.
In one embodiment, the correlation analysis module 902 is specifically configured to:
determining alarm attribute information of each alarm;
aiming at any two alarms for correlation analysis, executing a correlation rule matched with alarm attribute information of the two alarms to obtain an incidence relation between the two alarms; wherein, the correlation rule comprises: alarm attribute information of the source alarm and alarm attribute information of the derived alarm.
In one embodiment, the alarm attribute information includes: one or more items of alarm level, alarm type, alarm time, and attribute information of the alarm source;
the alert sources include: the device resource or the link between the devices that generated the alarm.
In one embodiment, when there are multiple correlation rules matching the attribute information of both alarms, the executed correlation rules are: the most reliable correlation rule among the plurality of correlation rules.
In one embodiment, the apparatus further comprises:
and the adjusting module is used for adjusting the reliability of the executed correlation rule according to the correctness evaluation result of the root alarm.
In one embodiment, the second determining module 903 comprises:
the generating submodule is used for generating an alarm tree according to the incidence relation between the alarms, wherein the alarm tree comprises: one node corresponds to one alarm, the alarm corresponding to the father node is a source alarm, and the alarm corresponding to the child node of the father node is a derivative alarm;
and the determining submodule is used for determining the root alarm in the plurality of alarms according to the alarm tree.
In one embodiment, the association between alarms includes: the incidence relation between the first alarms and the second alarms; wherein the first alarm is: the alarm set comprises alarms different from the historical alarm set, and the second alarm is as follows: alarms which are common to the alarm set and the historical alarm set;
the generation submodule is specifically configured to:
updating a historical alarm tree according to the incidence relation between the first alarms and the second alarms; wherein different nodes in the historical alarm tree correspond to different alarms in the historical alarm set;
and generating an alarm tree according to the updated historical alarm tree.
In one embodiment, the generating submodule is configured to generate an alarm tree according to the updated historical alarm tree, and includes:
when the historical alarm set also comprises a third alarm different from the alarm set, executing deletion operation in the updated historical alarm tree to obtain an alarm tree;
and deleting the node corresponding to the third alarm and the edge connected with the node, wherein the alarm corresponding to the root node in the alarm tree is the root alarm in the alarm set.
In one embodiment, the set of historical alarms is: and the historical alarm set with the largest number of second alarms in common with the alarm set in the plurality of historical alarm sets.
It should be noted that: in the alarm processing device provided in the foregoing embodiment, when implementing the alarm processing method, only the division of the program modules is exemplified, and in practical applications, the processing may be allocated to be completed by different program modules according to needs, that is, the internal structure of the alarm processing device is divided into different program modules, so as to complete all or part of the processing described above. In addition, the embodiments of the alarm processing apparatus and the alarm processing method provided by the above embodiments belong to the same concept, and specific implementation processes thereof are detailed in the method embodiments and are not described herein again.
Fig. 10 is a schematic structural diagram of a computer device according to an embodiment of the present disclosure. As shown in fig. 10, the computer apparatus 1000 includes: a processor 1001 and a memory 1002 for storing computer programs capable of running on the processor; when the processor 1001 is used to run the computer program, the following operations are executed:
determining an alarm set;
according to a preset relevance rule, carrying out relevance analysis on a plurality of alarms in an alarm set to obtain an association relation between the alarms;
and determining to cause a root alarm in the plurality of alarms according to the incidence relation among the alarms.
When the processor runs the computer program, corresponding processes in the methods of the embodiments of the present disclosure are implemented, and for brevity, are not described herein again.
In practical applications, the computer device 1000 may further include: at least one network interface 1003. The various components in the computer device 1000 are coupled together by a bus system 1004. It is understood that the bus system 1004 is used to enable communications among the components. The bus system 1004 includes a power bus, a control bus, and a status signal bus in addition to a data bus. For clarity of illustration, the various buses are designated in figure 10 as the bus system 1004. The number of the processors 1001 may be at least one. The network interface 1003 is used for wired or wireless communication between the computer apparatus 1000 and other apparatuses.
The memory 1002 in the disclosed embodiments is used to store various types of data to support the operation of the computer device 1000.
The method disclosed by the embodiment of the present disclosure may be applied to the processor 1001, or implemented by the processor 1001. The processor 1001 may be an integrated circuit chip having signal processing capabilities. In implementation, the steps of the above method may be implemented by integrated logic circuits of hardware or instructions in the form of software in the processor 1001. The Processor 1001 may be a general purpose Processor, a DiGital Signal Processor (DSP), or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, or the like. The processor 1001 may implement or perform the methods, steps, and logic blocks disclosed in the embodiments of the present disclosure. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present disclosure may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium located in the memory 1002 and the processor 1001 reads the information from the memory 1002 and performs the steps of the method described above in conjunction with its hardware.
In an exemplary embodiment, the computer Device 1000 may be implemented by one or more Application Specific Integrated Circuits (ASICs), DSPs, Programmable Logic Devices (PLDs), Complex Programmable Logic Devices (CPLDs), Field Programmable Gate Arrays (FPGAs), general purpose processors, controllers, Micro Controllers (MCUs), microprocessors (microprocessors), or other electronic components for performing the foregoing methods.
The disclosed embodiments also provide a computer-readable storage medium having a computer program stored thereon; when the computer readable storage medium is applied to the alarm processing method, the computer program is executed by the processor to execute the following operations:
determining an alarm set;
according to a preset relevance rule, carrying out relevance analysis on a plurality of alarms in an alarm set to obtain an association relation between the alarms;
and determining to cause a root alarm in the plurality of alarms according to the incidence relation among the alarms.
When being executed by a processor, the computer program implements corresponding processes in the methods of the embodiments of the present disclosure, which are not described herein again for brevity.
In the several embodiments provided in the present disclosure, it should be understood that the disclosed apparatus and method may be implemented in other ways. The above-described device embodiments are merely illustrative, for example, the division of a unit is only one logical function division, and there may be other division ways in actual implementation, such as: multiple units or components may be combined, or may be integrated into another system, or some features may be omitted, or not implemented. In addition, the coupling, direct coupling or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection between the devices or units may be electrical, mechanical or other forms.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed on a plurality of network units; some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, all the functional units in the embodiments of the present disclosure may be integrated into one processing unit, or each unit may be separately regarded as one unit, or two or more units may be integrated into one unit; the integrated unit can be realized in a form of hardware, or in a form of hardware plus a software functional unit.
Those of ordinary skill in the art will understand that: all or part of the steps for implementing the method embodiments may be implemented by hardware related to program instructions, and the program may be stored in a computer readable storage medium, and when executed, the program performs the steps including the method embodiments; and the aforementioned storage medium includes: a mobile storage device, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.
Alternatively, the integrated unit of the present disclosure may be stored in a computer-readable storage medium if it is implemented in the form of a software functional module and sold or used as a separate product. Based on such understanding, the technical solutions of the embodiments of the present disclosure may be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the methods of the embodiments of the present disclosure. And the aforementioned storage medium includes: a removable storage device, a ROM, a RAM, a magnetic or optical disk, or various other media that can store program code.
The above is only a specific embodiment of the present disclosure, but the scope of the present disclosure is not limited thereto, and any person skilled in the art can easily conceive of changes or substitutions within the technical scope of the present disclosure, and shall be covered by the scope of the present disclosure. Therefore, the protection scope of the present disclosure shall be subject to the protection scope of the claims.
Claims (12)
1. An alarm processing method, characterized in that the method comprises:
determining an alarm set;
according to a preset relevance rule, carrying out relevance analysis on a plurality of alarms in the alarm set to obtain an association relation among the alarms;
and determining the root alarm in the plurality of alarms according to the incidence relation among the alarms.
2. The method according to claim 1, wherein the performing correlation analysis on the plurality of alarms in the alarm set according to a preset correlation rule to obtain an association relationship between the alarms comprises:
determining alarm attribute information of each alarm;
aiming at any two alarms which are subjected to correlation analysis, executing a correlation rule matched with alarm attribute information of the two alarms to obtain an incidence relation between the two alarms; wherein the dependency rules comprise: alarm attribute information of the source alarm and alarm attribute information of the derived alarm.
3. The method of claim 2, wherein the alarm attribute information comprises: one or more items of alarm level, alarm type, alarm time, and attribute information of the alarm source;
the alert source includes: the device resource or the link between the devices that generated the alarm.
4. The method according to claim 2, wherein when there are a plurality of correlation rules matching both of the attribute information of the two alarms, the correlation rules are executed as follows: a most reliable correlation rule among the plurality of correlation rules.
5. The method of claim 2, further comprising:
and adjusting the reliability of the executed correlation rule according to the correctness evaluation result of the root alarm.
6. The method according to any one of claims 1 to 5, wherein said determining that a root alarm in a plurality of alarms is caused according to the association relationship between the alarms comprises:
generating an alarm tree according to the incidence relation among the alarms, wherein the alarm tree comprises: one node corresponds to one alarm, the alarm corresponding to the father node is a source alarm, and the alarm corresponding to the child node of the father node is a derivative alarm;
and determining to cause a root alarm in the plurality of alarms according to the alarm tree.
7. The method of claim 6, wherein the association between the alarms comprises: the method comprises the following steps of (1) associating relation between first alarms and associating relation between the first alarms and second alarms; wherein the first alarm is: the alarm set comprises alarms different from the historical alarm set, and the second alarm is as follows: alarms which are common to the alarm set and the historical alarm set;
generating an alarm tree according to the incidence relation among the alarms comprises the following steps:
updating a historical alarm tree according to the incidence relation between the first alarms and the second alarms; wherein different nodes in the historical alarm tree correspond to different alarms in the historical alarm set;
and generating the alarm tree according to the updated historical alarm tree.
8. The method of claim 7, wherein generating the alarm tree according to the updated historical alarm tree comprises:
when the historical alarm set also comprises a third alarm which is different from the alarm set, executing deletion operation in the updated historical alarm tree to obtain the alarm tree;
and deleting the node corresponding to the third alarm and the edge connected with the node, wherein the alarm corresponding to the root node in the alarm tree is the root alarm in the alarm set.
9. The method according to claim 7 or 8, wherein the set of historical alarms is: and the historical alarm set with the largest number of second alarms in common with the alarm set in the plurality of historical alarm sets.
10. An alert processing apparatus, characterized in that the apparatus comprises:
the first determining module is used for determining an alarm set;
the correlation analysis module is used for carrying out correlation analysis on the plurality of alarms in the alarm set according to a preset correlation rule to obtain an incidence relation among the alarms;
and the second determination module is used for determining the root alarm in the plurality of alarms according to the incidence relation among the alarms.
11. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the steps of the alert processing method of any of claims 1 to 9 are implemented when the program is executed by the processor.
12. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the alert processing method of any one of claims 1 to 9.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111561777.1A CN114448774B (en) | 2021-12-16 | 2021-12-16 | Alarm processing method, device and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111561777.1A CN114448774B (en) | 2021-12-16 | 2021-12-16 | Alarm processing method, device and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114448774A true CN114448774A (en) | 2022-05-06 |
| CN114448774B CN114448774B (en) | 2023-12-05 |
Family
ID=81362983
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111561777.1A Active CN114448774B (en) | 2021-12-16 | 2021-12-16 | Alarm processing method, device and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114448774B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115776436A (en) * | 2022-11-22 | 2023-03-10 | 中国工商银行股份有限公司 | Fault delimitation method, device, equipment, storage medium and computer program product |
| CN116016121A (en) * | 2023-03-24 | 2023-04-25 | 卡奥斯工业智能研究院(青岛)有限公司 | Method, device, equipment and storage medium for determining associated data of alarm data |
| WO2024156242A1 (en) * | 2023-01-28 | 2024-08-02 | 中兴通讯股份有限公司 | Alarm data analysis method and apparatus, and device |
Citations (25)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6243746B1 (en) * | 1998-12-04 | 2001-06-05 | Sun Microsystems, Inc. | Method and implementation for using computer network topology objects |
| JP2002271328A (en) * | 2001-03-09 | 2002-09-20 | Mitsubishi Electric Corp | System and method for analyzing network fault |
| US6499117B1 (en) * | 1999-01-14 | 2002-12-24 | Nec Corporation | Network fault information management system in which fault nodes are displayed in tree form |
| US6604208B1 (en) * | 2000-04-07 | 2003-08-05 | Telefonaktiebolaget Lm Ericsson (Publ) | Incremental alarm correlation method and apparatus |
| US20080250265A1 (en) * | 2007-04-05 | 2008-10-09 | Shu-Ping Chang | Systems and methods for predictive failure management |
| CN101917282A (en) * | 2010-07-20 | 2010-12-15 | 中兴通讯股份有限公司 | Method, device and system for processing alarm shielding rules |
| US20150006459A1 (en) * | 2013-06-29 | 2015-01-01 | Huawei Technologies Co., Ltd. | Alarm Correlation Analysis Method, Apparatus and System |
| CN105425772A (en) * | 2014-11-28 | 2016-03-23 | 上海核工程研究设计院 | Fault tree simplified nuclear power plant risk assessment method based on logical equivalence |
| CN106330501A (en) * | 2015-06-26 | 2017-01-11 | 中兴通讯股份有限公司 | Fault correlation method and device |
| CN106789145A (en) * | 2016-03-30 | 2017-05-31 | 新华三技术有限公司 | A kind of warning information method for pushing and device |
| CN107633307A (en) * | 2017-09-08 | 2018-01-26 | 国家计算机网络与信息安全管理中心 | Power supply-distribution system Root alarm detection method, device, terminal and computer-readable storage medium |
| KR20180046524A (en) * | 2016-10-28 | 2018-05-09 | 한국원자력연구원 | Fault tree simplifying apparatus, fault tree analyzing apparatus and fault tree analyzing method |
| CN108156037A (en) * | 2017-12-29 | 2018-06-12 | 中国移动通信集团江苏有限公司 | Alarm correlation analysis method, device, equipment and medium |
| CN108833168A (en) * | 2018-06-20 | 2018-11-16 | 郑州云海信息技术有限公司 | A kind of server cluster environment network system and Detection of Stability method |
| CN108847994A (en) * | 2018-07-25 | 2018-11-20 | 山东中创软件商用中间件股份有限公司 | Alarm localization method, device, equipment and storage medium based on data analysis |
| CN109684181A (en) * | 2018-11-20 | 2019-04-26 | 华为技术有限公司 | Alarm root is because of analysis method, device, equipment and storage medium |
| CN109787817A (en) * | 2018-12-28 | 2019-05-21 | 武汉船舶通信研究所（中国船舶重工集团公司第七二二研究所） | Network fault diagnosis method, device and computer readable storage medium |
| CN109921847A (en) * | 2019-04-15 | 2019-06-21 | 中国电力科学研究院有限公司 | The localization method and system of fault branch in a kind of passive optical network |
| CN109981363A (en) * | 2019-03-22 | 2019-07-05 | 烽火通信科技股份有限公司 | A kind of adaptation method and system of southbound interface |
| CN111010297A (en) * | 2019-12-04 | 2020-04-14 | 国网山东省电力公司信息通信公司 | Intelligent analysis method and system for supporting cross-professional faults in power communication network |
| CN112073208A (en) * | 2019-05-25 | 2020-12-11 | 成都华为技术有限公司 | Alarm analysis method and related equipment |
| CN112636967A (en) * | 2020-12-18 | 2021-04-09 | 北京浪潮数据技术有限公司 | Root cause analysis method, device, equipment and storage medium |
| WO2021179643A1 (en) * | 2020-03-12 | 2021-09-16 | 华为技术有限公司 | Fault processing method, apparatus and system |
| CN113592343A (en) * | 2021-08-10 | 2021-11-02 | 国网河北省电力有限公司电力科学研究院 | Fault diagnosis method, device, equipment and storage medium of secondary system |
| CN113641526A (en) * | 2021-09-01 | 2021-11-12 | 京东科技信息技术有限公司 | Alarm root cause positioning method and device, electronic equipment and computer storage medium |
-
2021
- 2021-12-16 CN CN202111561777.1A patent/CN114448774B/en active Active
Patent Citations (25)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6243746B1 (en) * | 1998-12-04 | 2001-06-05 | Sun Microsystems, Inc. | Method and implementation for using computer network topology objects |
| US6499117B1 (en) * | 1999-01-14 | 2002-12-24 | Nec Corporation | Network fault information management system in which fault nodes are displayed in tree form |
| US6604208B1 (en) * | 2000-04-07 | 2003-08-05 | Telefonaktiebolaget Lm Ericsson (Publ) | Incremental alarm correlation method and apparatus |
| JP2002271328A (en) * | 2001-03-09 | 2002-09-20 | Mitsubishi Electric Corp | System and method for analyzing network fault |
| US20080250265A1 (en) * | 2007-04-05 | 2008-10-09 | Shu-Ping Chang | Systems and methods for predictive failure management |
| CN101917282A (en) * | 2010-07-20 | 2010-12-15 | 中兴通讯股份有限公司 | Method, device and system for processing alarm shielding rules |
| US20150006459A1 (en) * | 2013-06-29 | 2015-01-01 | Huawei Technologies Co., Ltd. | Alarm Correlation Analysis Method, Apparatus and System |
| CN105425772A (en) * | 2014-11-28 | 2016-03-23 | 上海核工程研究设计院 | Fault tree simplified nuclear power plant risk assessment method based on logical equivalence |
| CN106330501A (en) * | 2015-06-26 | 2017-01-11 | 中兴通讯股份有限公司 | Fault correlation method and device |
| CN106789145A (en) * | 2016-03-30 | 2017-05-31 | 新华三技术有限公司 | A kind of warning information method for pushing and device |
| KR20180046524A (en) * | 2016-10-28 | 2018-05-09 | 한국원자력연구원 | Fault tree simplifying apparatus, fault tree analyzing apparatus and fault tree analyzing method |
| CN107633307A (en) * | 2017-09-08 | 2018-01-26 | 国家计算机网络与信息安全管理中心 | Power supply-distribution system Root alarm detection method, device, terminal and computer-readable storage medium |
| CN108156037A (en) * | 2017-12-29 | 2018-06-12 | 中国移动通信集团江苏有限公司 | Alarm correlation analysis method, device, equipment and medium |
| CN108833168A (en) * | 2018-06-20 | 2018-11-16 | 郑州云海信息技术有限公司 | A kind of server cluster environment network system and Detection of Stability method |
| CN108847994A (en) * | 2018-07-25 | 2018-11-20 | 山东中创软件商用中间件股份有限公司 | Alarm localization method, device, equipment and storage medium based on data analysis |
| CN109684181A (en) * | 2018-11-20 | 2019-04-26 | 华为技术有限公司 | Alarm root is because of analysis method, device, equipment and storage medium |
| CN109787817A (en) * | 2018-12-28 | 2019-05-21 | 武汉船舶通信研究所（中国船舶重工集团公司第七二二研究所） | Network fault diagnosis method, device and computer readable storage medium |
| CN109981363A (en) * | 2019-03-22 | 2019-07-05 | 烽火通信科技股份有限公司 | A kind of adaptation method and system of southbound interface |
| CN109921847A (en) * | 2019-04-15 | 2019-06-21 | 中国电力科学研究院有限公司 | The localization method and system of fault branch in a kind of passive optical network |
| CN112073208A (en) * | 2019-05-25 | 2020-12-11 | 成都华为技术有限公司 | Alarm analysis method and related equipment |
| CN111010297A (en) * | 2019-12-04 | 2020-04-14 | 国网山东省电力公司信息通信公司 | Intelligent analysis method and system for supporting cross-professional faults in power communication network |
| WO2021179643A1 (en) * | 2020-03-12 | 2021-09-16 | 华为技术有限公司 | Fault processing method, apparatus and system |
| CN112636967A (en) * | 2020-12-18 | 2021-04-09 | 北京浪潮数据技术有限公司 | Root cause analysis method, device, equipment and storage medium |
| CN113592343A (en) * | 2021-08-10 | 2021-11-02 | 国网河北省电力有限公司电力科学研究院 | Fault diagnosis method, device, equipment and storage medium of secondary system |
| CN113641526A (en) * | 2021-09-01 | 2021-11-12 | 京东科技信息技术有限公司 | Alarm root cause positioning method and device, electronic equipment and computer storage medium |
Non-Patent Citations (1)
| Title |
|---|
| 黑新宏;张阳阳;钱富才;谢国;何文娟;: "基于二元决策图的故障树底事件排序", 西安理工大学学报, no. 01 * |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115776436A (en) * | 2022-11-22 | 2023-03-10 | 中国工商银行股份有限公司 | Fault delimitation method, device, equipment, storage medium and computer program product |
| WO2024156242A1 (en) * | 2023-01-28 | 2024-08-02 | 中兴通讯股份有限公司 | Alarm data analysis method and apparatus, and device |
| CN116016121A (en) * | 2023-03-24 | 2023-04-25 | 卡奥斯工业智能研究院(青岛)有限公司 | Method, device, equipment and storage medium for determining associated data of alarm data |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114448774B (en) | 2023-12-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN114448774A (en) | Alarm processing method, device and storage medium | |
| US20220345218A1 (en) | Method and apparatus for obtaining odn logical topology information, device, and storage medium | |
| US20200021511A1 (en) | Performance analysis for transport networks using frequent log sequence discovery | |
| CN105659528B (en) | A kind of method and device for realizing fault location | |
| EP2800024B1 (en) | System and methods for identifying applications in mobile networks | |
| CN109120338B (en) | Network fault positioning method, device, equipment and medium | |
| CN105095048A (en) | Processing method for alarm correlation of monitoring system based on business rules | |
| CN113268399B (en) | Alarm processing method and device and electronic equipment | |
| CN111884832B (en) | Method for acquiring passive network topology information and related equipment | |
| CN106878038B (en) | Fault positioning method and device in communication network | |
| US11757701B2 (en) | Method for recommending similar incident, and related device | |
| CN101808351A (en) | Method and system for business impact analysis | |
| CN111262624B (en) | Optical cable fault monitoring method and device | |
| CN116662058A (en) | Method, device, equipment and storage medium for constructing fault propagation relationship | |
| CN116225769B (en) | Method, device, equipment and medium for determining root cause of system fault | |
| CN112214577A (en) | Target user determination method, device, equipment and computer storage medium | |
| CN111611097A (en) | Fault detection method, device, equipment and storage medium | |
| CN113656252B (en) | Fault positioning method, device, electronic equipment and storage medium | |
| CN114095808B (en) | Network fault detection method, device, equipment and computer readable storage medium | |
| CN112463452A (en) | Data service method, device and storage medium | |
| CN116662127A (en) | Method, system, equipment and medium for classifying and early warning equipment alarm information | |
| CN100454846C (en) | Method and device for reporting alarming information in distributed system | |
| CN116668264A (en) | Root cause analysis method, device, equipment and storage medium for alarm clustering | |
| CN115396287B (en) | Fault analysis method and device | |
| CN116795631A (en) | Service system monitoring alarm method, device, equipment and medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |