JP4738155B2 - Alarm management device and alarm management method - Google Patents

Description

  The present invention relates to an alarm management device and an alarm management method.

As a conventional alarm management method in network failure management, there is a method for managing an alarm management information table for suppressing an abnormal alarm caused by construction among abnormal alarms generated by a network or server monitoring device (for example, , See Patent Document 1). In the information table, the work date and time of the construction, the worker who performs the construction work, the work target device that performs the work, the ripple device that is affected when the work target device stops, the ripple alarm that occurs in the event of an abnormality, etc. If an alarm occurs in the monitoring device, compare the information table with the generated alarm to determine whether it is a real abnormality or an alarm caused by construction. Notice.
JP 7-87191 A

  The prior art described above has the following problems.

  Abnormality because the start time and end time of various works that occur in the planned monitoring on the customer side, the line borrowing work by the carrier, and the power outage on the monitoring target side do not match the actual start time and end time of the work There is a problem that the function of the alarm filter for suppressing the alarm does not sufficiently exhibit the effect. In the construction plan planned in advance, the start time and end time of the work, the work target device to be worked on, the affected transmission device, etc. are all registered. At this time, it was detected by the network monitoring device or server monitoring device. It is determined whether the alarm caused by the construction is an alarm related to the construction in light of the start time and the end time of the construction. However, the actual construction often involves humans, and the construction does not necessarily start and end at the planned construction start time and construction end time. In this case, because the start date / time and end date / time registered in the information table as planned work differ from the actual work start date / time and end date / time, a fault alarm is detected before the planned work start date / time, or the work is scheduled to end. A failure alarm is detected after the date and time. In this case, the supervisor who is monitoring with the management terminal actually recognizes the alarm caused by the construction as a failure and performs the failure response. For this reason, despite the fact that it is an alarm caused by construction, in order to carry out recovery response, contact with the administrator who manages the monitoring target or arrangement with the affiliated company for failure recovery, etc. are performed, Generate unnecessary work. Normally, all of the work for recovering from a failure is managed by a trouble ticket or the like, and therefore, the work for recording them is wastefully performed.

  According to the present invention, for example, when a construction for a network or a device connected to the network starts earlier than scheduled or finishes later than scheduled, a failure alarm that requires an administrator to deal with a failure alarm caused by the construction. It is intended to suppress performing a wasteful operation due to misunderstanding.

The alarm management device according to the present invention is:
Monitoring a plurality of devices connected to the network, and when a failure occurs in any of the plurality of devices, monitoring target identification information for identifying the device and failure occurrence time information indicating the occurrence time of the failure; An alarm receiver for receiving fault alarms including:
Construction information including construction target identification information for identifying a device to be constructed among the plurality of devices, construction start time information indicating a scheduled start time of the construction, and construction end time information indicating a planned end time of the construction A construction information reading unit that reads construction information including construction target identification information that identifies the same device as the monitoring target identification information included in the failure alarm received by the alarm reception unit, from a storage device that stores
The processing device compares the failure occurrence time information included in the failure alarm received by the alarm receiving unit with the construction start time information included in the construction information read by the construction information reading unit and the construction end time information. A determination unit that determines whether the construction has been performed as scheduled and whether the failure may have occurred due to the construction;
Included in the failure alarm received by the alarm receiving unit when the construction is carried out in a period different from the schedule and the determination unit determines that the failure may have occurred due to the construction. And an output unit that outputs output information indicating that the failure may have occurred due to the work.

  In the present invention, in the alarm management device, the determination unit includes the failure start time information included in the failure alarm received by the alarm reception unit and the construction start time included in the construction information read by the construction information reading unit. Compare the information with the construction end time information to determine whether the construction was carried out as scheduled and whether there was a possibility that a failure occurred due to the construction, and the output unit scheduled the construction It corresponds to the monitoring target identification information included in the failure alarm received by the alarm receiver when the determination unit determines that a failure may have occurred due to construction work. By outputting output information indicating that a failure may have occurred in the equipment due to construction work, the work on the network and the equipment connected to the network But if they have not been carried out as planned, the administrator it is possible to suppress to make a useless work a failure alarm caused by mistaken as required failure alarm is deal with the construction work.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

Embodiment 1 FIG.
FIG. 1 is a diagram illustrating an example of a configuration of a system according to the present embodiment.

  In FIG. 1, this system includes a monitoring target router 100, a monitoring target server 101, a management terminal 102, a monitoring side router 103, a failure log information recording device 104, a construction information management device 105, a network monitoring device 106, a server monitoring device 107, An alarm management device 200 is provided. The construction information management apparatus 105 stores an alarm management information table.

  The network monitoring device 106 monitors the life and death of the monitoring target router 100 by PING (Packet Internet Grouper) monitoring at intervals of several minutes. The server monitoring device 107 monitors the life and death of the monitoring target server 101, the operating status of a CPU (Central Processing Unit) as a server resource, the usage status of the memory, the status of the free disk space, etc. every few minutes. As a method for realizing such server monitoring, a method of introducing a server monitoring agent to the monitoring target server 101 is generally used.

  In the management terminal 102, the result of monitoring the monitoring target router 100 and the monitoring target server 101 by the network monitoring device 106 and the server monitoring device 107 is displayed, and the monitor (administrator) has detected an abnormality in the monitoring target 108 by the management terminal 102. It is confirmed whether or not it has occurred. When there is an abnormality in the monitoring target 108, the network monitoring apparatus 106 and the server monitoring apparatus 107 issue an alarm to the management terminal 102 by detecting an alarm indicating the abnormality. All the abnormal alarms generated in these monitored objects 108 are stored and recorded as time series data in the failure log information recording device 104.

  Normally, network monitoring and server monitoring are performed with the above-described configuration, but as a special case, processing due to construction is required. The construction is, for example, construction for the convenience of the supervisor such as exchanging the monitoring router 103 for the convenience of the supervisor, construction by the carrier providing the line, and the building where the monitoring target 108 is installed. It is classified as construction accompanying power outage. In these constructions, the monitoring target router 100 or the monitoring target server 101 is disconnected from the power supply or the line is disconnected, so that monitoring from the monitoring device such as the network monitoring device 106 or the server monitoring device 107 is performed. Cannot be normally implemented, and these monitoring devices recognize that an abnormality (failure) has occurred. However, in reality, no abnormality has occurred in these monitoring targets 108.

  In contrast to this, in the prior art, a construction information management device 105 is provided in order to suppress an abnormal alarm caused by this construction, and information for alarm management for suppressing an abnormal alarm caused by the construction inside the device. Manage tables. In the information table, the work date and time, the worker who performs the work, the identifier of the work target device that performs the work (for example, a unique name such as the host name of the device), and the impact of the work target device being stopped are affected. The spilling device to be received, the spilling alarm generated at the time of abnormality are registered in advance, the abnormality alarm generated at the network monitoring device 106 and the server monitoring device 107 is written in the failure log information recording device 104, and the abnormality is displayed on the management terminal 102. By comparing the information table with the generated alarm, it is determined whether it is really abnormal or an alarm caused by construction, and only the alarm with the abnormality is notified to the management terminal 102.

  In the present embodiment, by adding the alarm management device 200 to the above system, an alarm is generated when the actual construction starts early or finishes late with respect to the planned construction start / end date and time. Even if it occurs and becomes a fault alarm, this is not an alarm related to construction, but the supervisor of the management terminal 102 does not immediately contact the manager of the monitoring target 108 (the manager of the monitoring target 108 manages it). If it is different from the monitor of the terminal 102), contact the person in charge of construction input at the time of setting the planned construction, confirm the construction status, etc., and then contact the manager of the monitoring target 108. The management terminal 102 automatically marks such alarms by changing the color of the alarm display or by specially marking them. As described above, the monitoring of the monitoring target 108 is made possible by notifying the supervisor of the management terminal 102 that the construction plan has started early and the construction has been extended and the construction that has been completed late is a failure related to the construction. It is no longer necessary to contact the manager directly, and after confirming the construction status with the person in charge of construction, it is possible to contact the manager of the monitoring target 108, and this has the effect of preventing faulty misidentification during planned construction. is there. The alarm management device 200 will be described below.

  FIG. 2 is a block diagram showing the configuration of the alarm management device according to the present embodiment.

  In the present embodiment, the alarm management device 200 includes a processing device 210 and a storage device 211. The processing device 210 includes an alarm receiving unit 212, a construction information reading unit 213, a determination unit 214, and an output unit 215. In the storage device 211, alarm information 206 and construction information 207 are stored.

  In FIG. 2, the alarm management device 200 is connected to a monitoring device 201 such as the network monitoring device 106 or the server monitoring device 107, and receives a failure alarm 202 detected when a failure occurs in the monitoring device 201 by an alarm receiving unit 212. The alarm receiving unit 212 further has an alarm storage function 203 for storing and managing generated alarms. The generated alarm is stored in the storage device 211 as alarm information 206 by the alarm storage function 203. The construction information reading unit 213 and the determination unit 214 make an inquiry about the failure alarm 202 with respect to the construction information 207 that records information on the planned construction, and an alarm that determines whether the alarm is generated due to the construction. A determination function 204 is provided. The alarm management device 200 is also connected to a management terminal 102 for a monitor to manage whether or not a failure has occurred. The output unit 215 notifies the management terminal 102 of various output information.

  The configuration shown in FIG. 2 is the same as the configuration adopted in the construction of a monitoring center such as a managed service provider that monitors the operation of a network or server. The network and server monitoring apparatus 201 performs failure detection by checking the abnormality of the router or server to be monitored 108 at a certain time interval of about several minutes according to each setting. The alarm management device 200 performs integrated management of alarms of these monitoring devices 201. In particular, it is assumed that a plurality of network and server monitoring devices 201 are connected, and the size of the monitoring target 108 is tens of thousands. A monitoring target 108 of a scale is assumed. In such a case, a certain amount of fault alarms 202 are also generated and their management is required.

  For the addition and update of the contents of the construction information 207, for example, a construction management system such as the construction information management apparatus 105 illustrated in FIG. 1 is prepared, and the person in charge of construction, the manager of the monitoring target 108, the carrier, etc. cooperate with each other. It is assumed that planned construction information to be exchanged is input through the construction management system.

  FIG. 3 is a flowchart showing an example of the operation (alarm management method) of the alarm management apparatus according to the present embodiment. FIG. 4 is a sequence diagram showing processing of the system according to the present embodiment.

  The alarm reception unit 212 monitors a plurality of devices (monitoring target 108) connected to the network via the monitoring device 201, and identifies a device when a failure occurs in any of the plurality of devices. A failure alarm 202 including monitoring target identification information (for example, the host name of the monitoring target 108) and failure occurrence time information indicating the failure occurrence time (date and time) is received from the monitoring device 201 (alarm reception step).

  For example, in step S <b> 101 of FIG. 3, the alarm receiving unit 212 receives the failure alarm 202. The failure alarm 202 is generated by monitoring P101 in FIG. The operation of P101 in FIG. 4 is an operation according to the setting of the monitoring device 201 such as the network monitoring device 106 or the server monitoring device 107, and alive monitoring of the monitoring target 108 is performed at intervals of several minutes. For example, in the case of network monitoring, it is possible to monitor the life and death of the network line from the monitoring target router 100 or the monitoring apparatus 201 to the monitoring target router 100 by setting to perform monitoring by PING at intervals of several minutes. If there is no response as a result of PING monitoring, it can be detected that an error has occurred in the monitoring target router 100 or the line. This is the failure detection at P102 in FIG. When a failure is detected, a failure alarm 202 indicating the occurrence of the failure is recorded in the monitoring device 201. In the present embodiment, the failure alarm 202 is received in step S101 in FIG. 3 and P103 in FIG. As a protocol at this time, SNMP (Simple Network Management Protocol) Trap, TCP / IP (Transmission Control Protocol / Internet Protocol) socket communication, or the like can be used.

  Next, in step S <b> 102 of FIG. 3, the alarm receiving unit 212 records the failure alarm 202 as the alarm information 206 in the storage device 211. When the alarm receiving unit 212 records the alarm information 206, the alarm receiving unit 212 accesses a configuration management information database storing contract information, network information, configuration information, and the like of the monitoring target 108 separately prepared, and stores these information in the alarm information 206. Configuration management information may be added.

  Next, in step S <b> 103 of FIG. 3, the alarm reception unit 212 analyzes the failure alarm 202. In the case of a network failure, the failure alarm 202 includes a monitoring target host name, a failure occurrence date / time, a monitoring device host name, a failure message, etc., and these are analyzed to extract the monitoring target host name and failure occurrence date / time. In P104 of FIG. 4, preparation for access to the construction information 207 is performed based on the monitored host name and the failure occurrence date and time.

  The construction information reading unit 213 displays construction target identification information (for example, the host name of the monitoring target 108) for identifying a device on which the construction is performed among a plurality of devices (monitoring target 108) and a scheduled start time (date and time) of the construction. The monitoring target included in the failure alarm 202 received by the alarm receiving unit 212 from the storage device 211 that stores the construction information 207 including the construction start time information to be shown and the construction end time information to indicate the scheduled construction end time (date and time). The construction information 207 including construction object identification information for identifying the same device as the identification information is read (construction information reading step).

  For example, the construction information reading unit 213 refers to the construction information 207 in step S104 of FIG. When referring to the construction information 207, it is referred to whether there is the corresponding construction information 207 using the monitoring target host name (P105 in FIG. 4). Since the construction information 207 is composed of a relational database or the like, the construction information 207 can be easily referred to by setting the key of the construction information 207 as the monitoring target host name. The construction information reading unit 213 acquires, as construction information 207, a construction ID, construction start date / time, construction end date / time, monitored host name, alarm content, construction classification, and the like (P106 in FIG. 4).

  The determination unit 214 includes the failure occurrence time information included in the failure alarm 202 received by the alarm reception unit 212 and the construction start time information and the construction included in the construction information 207 read by the construction information reading unit 213. Comparing with the end time information, it is determined whether or not the construction has been carried out as scheduled and whether or not there is a possibility that a failure has occurred due to the construction (determination step). Specifically, the determination unit 214 uses the processing device 210 to start the construction included in the failure occurrence time information included in the failure alarm 202 received by the alarm reception unit 212 and the construction information read by the construction information reading unit 213. Compare the time information with the construction end time information. (1) If the failure occurrence time is between the scheduled start time and the planned end time of the construction, it is determined that a failure has occurred due to the construction work. (2) The period from the failure occurrence time to the scheduled construction start time is less than or equal to a predetermined time (for example, 1 hour); and (3) the period from the failure occurrence time to the scheduled construction completion time is predetermined. It is determined that there is a possibility that the construction was carried out in a period different from the schedule and that there was a failure due to the influence of the construction. (4) In other cases, Cause There is judged to have occurred.

  For example, in step S105 of FIG. 3, the determination unit 214 determines whether the failure occurrence date and time extracted from the failure alarm 202 is included between the construction start date and time and the construction end date and time recorded in the construction information 207. . If the failure occurrence date and time taken out from the failure alarm 202 is included between the construction start date and time and the construction end date recorded in the construction information 207, the corresponding failure alarm 202 is alarmed as a construction alarm (alarm caused by construction). By managing the information 206, the supervisor who uses the management terminal 102 can recognize which fault alarm 202 is the fault alarm 202 caused by the construction. When the failure occurrence date and time extracted from the failure alarm is slightly shifted from the construction start date and time and the construction end date and time recorded in the construction information 207, the determination unit 214, for example, 1 hour with respect to the construction start date and time If the failure occurrence date / time is deviated in the range of, it is interpreted that the construction work performed by a human has started earlier or that the construction work has been extended, and the failure alarm 202 is suspected of construction. The probability that the monitoring target 108 indicated by the monitoring target host name included in the construction information 207 is accidentally shifted by one hour from the construction period is extremely rare, and is determined to be the failure alarm 202 generated by the construction work. By doing so, the response of the supervisor can be changed.

  The output unit 215 is implemented when the construction is performed in a period different from the schedule and the judgment unit 214 determines that a failure may have occurred due to the construction (in the case of (2) or (3) above) In addition, output information (for example, alarm information 206 is managed) indicating that there is a possibility that a failure has occurred in the apparatus corresponding to the monitoring target identification information included in the failure alarm 202 received by the alarm reception unit 212 due to the construction work. Is output to the management terminal 102 (output step). At this time, the output unit 215 may calculate the difference between the failure occurrence time and the scheduled start time or the end time of the construction by the processing device 210 and output the output information indicating the calculation result to the management terminal 102. Good. In addition, the output unit 215 monitors the failure included in the failure alarm 202 received by the alarm reception unit 212 when the determination unit 214 determines that a failure has occurred due to something other than construction (in the case of (4) above). Output information indicating that a failure has occurred in the device corresponding to the target identification information is output to the management terminal 102. In addition, the output unit 215 is a monitoring target included in the failure alarm 202 received by the alarm reception unit 212 when the determination unit 214 determines that a failure has occurred due to construction (in the case of (1) above). Output information indicating that a failure has occurred in the apparatus corresponding to the identification information due to the construction work is output to the management terminal 102.

  For example, in step S106 of FIG. 3, the output unit 215 displays the alarm determination result in the alarm information 206 in the form of failure, construction, and suspected construction on the management terminal 102 (P107 in FIG. 4).

  The determination unit 214 is further included in the failure content information (for example, a failure message) included in the failure alarm 202 received by the alarm reception unit 212 and the construction information 207 read by the construction information reading unit 213 by the processing device 210. It may be determined whether or not the failure indicates the feature of the failure that occurs due to the construction work by comparing the failure feature information (for example, the server process name and resource name, the router port number). Then, the output unit 215 is a case where the determination unit 214 determines that a failure has occurred due to a cause other than construction, and the determination unit 214 determines that the failure does not indicate the characteristics of the failure caused by the construction. In this case, output information indicating that a failure has occurred in a device corresponding to the monitoring target identification information included in the failure alarm 202 received by the alarm reception unit 212 may be output to the management terminal 102.

  For example, the determination unit 214 may perform not only time determination but also filtering by matching with a failure message using a server process name or resource name, or a network router port number may be extracted from the failure message. It is also possible to perform filtering by matching with a port number prepared in advance in the construction information 207.

  The determination unit 214 further performs analysis on the alarm information 206 and the construction information 207 recorded in the storage device 211 later, so that a device with a lot of construction, a failure occurrence rate due to construction, a construction filter (for example, The accuracy of the determination function in step S105 of FIG. 3 may be analyzable. Thereby, proactive (active) operation monitoring expected in the future can be realized.

  5 and 6 are diagrams illustrating an example of the failure alarm 202. FIG. FIG. 7 is a diagram illustrating an example of the construction information 207. These are the main interfaces of FIG.

  An example of a network (monitoring) failure alarm in P103 of FIG. 4 has a format as shown in FIG. An example of a server (monitoring) failure alarm has a format as shown in FIG. As the result of the construction information 207 in P106 of FIG. 4, for example, the contents of FIG. 7 are returned.

  As shown in FIG. 7, the construction information 207 includes, for example, the ID of each data of the construction information 207 as the construction ID, the ID indicating the entire system of the monitored host name as the target ID, and the monitoring target of the construction target as the monitored host name. Host name, scheduled construction start date / time as planned construction start date / time, planned construction end date / time as planned construction completion date / time, server monitoring information as process name and resource name on server, alarm message content as fault message and alarm content If they are the same, the message content to be filtered, the construction as the construction category, the construction of the carrier by the carrier, the reason for the construction such as a power failure on the monitoring target side, and the port number of the router in network monitoring are set as the port number.

As described above, the alarm management device according to the present embodiment is
Monitoring a plurality of devices connected to the network, and when a failure occurs in any of the plurality of devices, monitoring target identification information for identifying the device and failure occurrence time information indicating the occurrence time of the failure; An alarm receiver for receiving fault alarms including:
Construction information including construction target identification information for identifying a device to be constructed among the plurality of devices, construction start time information indicating a scheduled start time of the construction, and construction end time information indicating a planned end time of the construction A construction information reading unit that reads construction information including construction target identification information that identifies the same device as the monitoring target identification information included in the failure alarm received by the alarm reception unit, from a storage device that stores
The processing device compares the failure occurrence time information included in the failure alarm received by the alarm receiving unit with the construction start time information included in the construction information read by the construction information reading unit and the construction end time information. A determination unit that determines whether the construction has been performed as scheduled and whether the failure may have occurred due to the construction;
Included in the failure alarm received by the alarm receiving unit when the construction is carried out in a period different from the schedule and the determination unit determines that the failure may have occurred due to the construction. And an output unit that outputs output information indicating that the failure may have occurred due to the work.

  Due to these features, when work on the network and the devices connected to the network is not carried out as scheduled, the administrator misidentifies the trouble alarm caused by the work as a trouble alarm that needs to be dealt with, and wasteful work It becomes possible to suppress performing.

  The output unit performs the failure of the failure by the processing device when the construction is carried out in a period different from the schedule and the determination unit determines that the failure may have occurred due to the influence of the construction. A difference between the occurrence time and the planned start time or the end time of the construction is calculated, and output information indicating the calculation result is output.

  With such a feature, it becomes possible for the manager to easily check how much the time when the failure alarm due to the construction is different from the scheduled construction time.

  The determination unit includes the failure occurrence time information included in the failure alarm received by the alarm reception unit, the construction start time information and the construction end time included in the construction information read by the construction information reading unit by the processing device. (1) When the failure occurrence time is between the scheduled start time and the scheduled finish time of the construction, it is determined that the failure has occurred due to the construction, 2) A period from the failure occurrence time to the scheduled construction start time is less than a predetermined time; and (3) a period from the failure occurrence time to the scheduled construction end time is less than a predetermined time. In some cases, it is determined that the construction work was carried out in a different period from the schedule, and that the failure may have occurred due to the construction work. (4) In other cases, other than the construction work Cause And judging said fault has occurred.

  Because of these features, when a work on a network or a device connected to the network starts earlier than scheduled or ends later than scheduled, a fault alarm that requires an administrator to handle a fault alarm caused by the work It is possible to suppress performing a wasteful operation due to misunderstanding.

The failure alarm includes failure content information indicating the content of the failure,
The construction information includes failure feature information indicating a feature of a failure that occurs due to the influence of the construction,
The determination unit compares the failure content information included in the failure alarm received by the alarm reception unit and the failure feature information included in the construction information read by the construction information reading unit by the processing device, Determine whether the failure indicates the characteristics of the failure caused by the construction,
The output unit is a case where the determination unit determines that the failure has occurred due to a cause other than the construction, and the determination unit indicates that the failure does not indicate a characteristic of the failure that occurs due to the influence of the construction. When it is determined, output information indicating that the failure has occurred is output to a device corresponding to the monitoring target identification information included in the failure alarm received by the alarm receiving unit.

  With such a feature, it is possible to more accurately determine whether or not the failure alarm is a failure alarm caused by construction.

  When the determination unit determines that the failure has occurred due to reasons other than the construction, the output unit includes the device corresponding to the monitoring target identification information included in the failure alarm received by the alarm reception unit. Output information indicating that a failure has occurred is output.

  With such a feature, it is possible to notify the administrator of a failure alarm that needs to be dealt with separately from a failure alarm caused by construction.

  When the determination unit determines that the failure has occurred due to the construction, the output unit applies the construction to the device corresponding to the monitoring target identification information included in the failure alarm received by the alarm reception unit. Output information indicating that the failure has occurred due to the influence of is output.

  With such a feature, it is possible to reliably notify the administrator of a failure alarm caused by construction, in distinction from a failure alarm that may be caused by construction.

The alarm management method according to the present embodiment is
The alarm reception unit of the alarm management device monitors a plurality of devices connected to the network, and when any of the plurality of devices fails, the monitoring target identification information for identifying the device and the failure An alarm reception step for receiving a failure alarm including failure occurrence time information indicating the occurrence time of
The construction information reading unit of the alarm management device has construction target identification information for identifying a device to be constructed among the plurality of devices, construction start time information indicating the planned construction start time, and scheduled construction completion time. Construction information including construction target identification information for identifying the same device as the monitoring target identification information included in the failure alarm received by the alarm receiver from a storage device that stores construction information including construction completion time information indicating A construction information reading step for reading
The determination unit included in the alarm management device includes, by the processing device, failure occurrence time information included in the failure alarm received by the alarm reception unit and construction start time information included in the construction information read by the construction information reading unit. A determination step of comparing the construction end time information and determining whether the construction has been performed in a scheduled period and whether the failure may have occurred due to the construction;
When the output unit included in the alarm management device is implemented in a period different from the schedule, and the determination unit determines that the failure may have occurred due to the work, the alarm reception is performed. An output step of outputting output information indicating that the failure may have occurred due to the construction work to a device corresponding to the monitoring target identification information included in the failure alarm received by the unit, To do.

  Due to these features, when work on the network and the devices connected to the network is not carried out as scheduled, the administrator misidentifies the trouble alarm caused by the work as a trouble alarm that needs to be dealt with, and wasteful work It becomes possible to suppress performing.

  In the determination step, the determination unit includes the failure occurrence time information included in the failure alarm received by the alarm reception unit and the construction start time information included in the construction information read by the construction information reading unit. And (1) If the failure occurrence time is between the scheduled start time and the scheduled finish time of the construction, the failure has occurred due to the influence of the construction. (2) when the period from the occurrence time of the failure to the scheduled start time of the construction is less than or equal to a predetermined time; and (3) the period from the occurrence time of the failure to the scheduled completion time of the construction is predetermined. It is determined that there is a possibility that the failure has occurred due to the influence of the construction, and (4) in other cases, in front Except construction work and judging that the said failure caused.

  Because of these features, when a work on a network or a device connected to the network starts earlier than scheduled or ends later than scheduled, a fault alarm that requires an administrator to handle a fault alarm caused by the work It is possible to suppress performing a wasteful operation due to misunderstanding.

The alarm management apparatus and method described in the first embodiment are as follows.
In the fault management method such as network server that reports the fault that occurred in each device to the administrator according to the fault alarm notified from each device that configures the network, the fault alarm that occurs due to various construction work When the construction work is performed on the device, the construction is performed by referring to the failure alarm read from the alarm storage function and the construction information indicating the contents of the construction work. It is determined whether or not the failure alarm notified during the work is an alarm related to construction. If the failure alarm is a construction alarm, notification of the failure occurrence to the administrator is suppressed, and the failure alarm To the construction judgment function that judges whether the failure occurrence date and time is a certain time lag from the start date and time and end date and time of construction information Ri, is characterized in that so as to notification of there work influence at the time of notification of the failure to the administrator.

The construction determination function further includes:
When the failure occurrence date and time of the failure alarm is compared with the start date and time of the construction information, if the failure occurrence date and time of the failure alarm is shifted by a predetermined time, a difference between the times is obtained and It is characterized in that the difference between the notification with the effect of construction and the time is displayed at the time of notification of the occurrence of the failure.

The construction determination function further includes:
When the failure occurrence date and time of the failure alarm is compared with the completion date and time of the construction information, if the failure occurrence date and time of the failure alarm is shifted by a predetermined time, the difference between the times is obtained and It is characterized in that the difference between the notification with the effect of construction and the time is displayed at the time of notification of the occurrence of the failure.

Embodiment 2. FIG.
In the present embodiment, the alarm management device 200 automatically confirms the influence on the peripheral devices and lines due to the construction at the end of the construction, and automatically confirms that the construction-affected equipment (monitoring target 108) can be restored to normal monitoring without any problem. Judgment. This process is called construction restoration confirmation. Hereinafter, differences from the first embodiment will be mainly described.

  FIG. 8 is a block diagram showing a configuration of the alarm management device according to the present embodiment.

  In the present embodiment, the processing device 210 included in the alarm management device 200 includes a construction information setting unit 216. The work recovery confirmation information 208 is stored in the storage device 211 included in the alarm management device 200.

  In FIG. 8, an alarm reception unit 212, a construction information reading unit 213, a determination unit 214, and a construction information setting unit 216 have a restoration confirmation function 205 for confirming restoration of the monitoring target 108 from construction at the end of construction. The construction recovery confirmation information 208 that records the time (time) for performing construction restoration confirmation and information related to the monitoring target device is referred to by the restoration confirmation function 205.

  For the addition and update of the contents of the construction restoration confirmation information 208, for example, a construction management system such as the construction information management apparatus 105 illustrated in FIG. 1 is prepared. The construction manager, the manager of the monitoring target 108, the carrier, etc. It is assumed that planned construction information to be exchanged in cooperation is input through the construction management system.

  There are two purposes for confirmation of construction restoration. One is that the alarm management device 200 automatically checks whether or not the construction work is delayed by using a PING or the like for recovery confirmation. Check with the person in charge whether the construction work is delayed. If construction work is delayed, the supervisor will take measures to extend the planned construction time. If construction work is not delayed, trouble shooting will be performed. The other is to check whether each monitoring object 108 can be correctly returned to the normal monitoring state by using PING or the like after the construction work.

  FIG. 9 is a flowchart showing an example of the operation (alarm management method) of the alarm management apparatus according to the present embodiment. FIG. 10 is a sequence diagram showing processing of the system according to the present embodiment.

  The construction information reading unit 213 includes construction target identification information (for example, the host name of the monitoring target 108) for identifying a device on which the construction is performed among a plurality of devices (monitoring target 108) connected to the network, and a work completion schedule. Construction information including construction end time information indicating time (date) (here, construction information 207 and construction restoration confirmation information 208 are collectively referred to as construction information, for example, not construction information 207 itself in FIG. The construction restoration confirmation information 208 is read from the storage device 211 that stores the construction restoration confirmation information 208 (described as construction restoration confirmation information 208) (construction information reading step).

  For example, in step S107 in FIG. 9, the construction information reading unit 213 refers to the construction restoration confirmation information 208 (P107 in FIG. 10). The construction restoration confirmation information 208 is referred to at a short time interval such as 2 minutes or 3 minutes by a polling process or the like. This time interval can be changed by setting. By referring to the construction restoration confirmation information 208 set in advance by the construction management system using the current time as a key at this time interval, the monitoring target host name corresponding to the construction to be confirmed for the current restoration is extracted (FIG. 10). P108).

  The alarm receiving unit 212 compares the current time with the work end time information included in the work restoration confirmation information 208 read by the work information reading unit 213 by the processing device 210, and the current time is used to determine the expected work end time. If it has passed, the equipment corresponding to the construction object identification information included in the construction restoration confirmation information 208 read by the construction information reading unit 213 is monitored every predetermined period, and the equipment has occurred due to the construction work. When the device is recovered from the failure, a recovery alarm 209 including monitoring target identification information (for example, the host name of the monitoring target 108) for identifying the device is received (alarm receiving step).

  For example, as shown in step S <b> 108 of FIG. 9, the alarm reception unit 212 performs recovery confirmation on the monitoring target 108 indicated by the monitoring target host name acquired from the construction recovery confirmation information 208. For restoration confirmation, PING or the like is issued to the monitored host, and the result is received as an alarm. Here, an example in which the alarm management device 200 issues a recovery confirmation command directly will be described, but recovery confirmation may be performed via the monitoring device 201 such as the network monitoring device 106 or the server monitoring device 107. Since a plurality of monitored host names for which recovery confirmation is performed are included in the result of the construction restoration confirmation information 208, recovery confirmation is performed for all of these monitored hosts (P109 in FIG. 10).

  Next, as shown in step S109 of FIG. 9, the alarm receiving unit 212 receives the result of the restoration confirmation as an alarm. Based on the result of this alarm, it is determined whether or not the corresponding monitored host has been restored (P110 in FIG. 10).

  Next, at step S110 in FIG. 9, the alarm receiving unit 212 performs failure determination.

  The output unit 215 outputs output information indicating that the device corresponding to the monitoring target identification information included in the recovery alarm 209 received by the alarm reception unit 212 has been recovered to the management terminal 102 (output step).

  For example, as shown in step S111 of FIG. 9, if the result of the restoration confirmation is normal, the output unit 215 manages that there is no abnormality (such as a screen indicating that the construction is completed for the monitored host). It is displayed on the terminal 102 (P111 in FIG. 10). If there is an abnormality, there is a possibility that the construction work of the monitored host is still in progress. Therefore, the alarm management apparatus 200 performs the abnormality determination as described in the first embodiment so that the person in charge of the construction can be contacted. Do.

  FIG. 11 is a diagram showing an example of the construction restoration confirmation information 208. As shown in FIG.

  As shown in FIG. 11, the contents of the construction restoration confirmation information 208 include, for example, an ID to construction-related information (for example, construction information 207) as a construction ID, an ID indicating the entire system of the monitored host name as a target ID, and a monitoring target Monitored host name as the host name, server / network type as the service name, recovery confirmation execution date and time 15 minutes after the scheduled construction completion date (set by the construction management system), and recovery confirmation result as the recovery confirmation result OK / NG to be performed, 0/1 to indicate that the restoration is being confirmed as the restoration confirmation flag, construction as the construction classification, line borrowing by the carrier, classification of the power failure on the monitoring target side, and the construction management system maintained the results as the system reflection flag It becomes a flag 0/1 indicating whether or not.

  As described in step S107 in FIG. 9, when construction restoration confirmation is performed by polling, the value of the construction restoration confirmation flag is manipulated so that restoration confirmation is not repeatedly performed on the same monitored host. By doing so, when the construction recovery confirmation in progress flag is 1, it may be controlled that the construction restoration confirmation is in progress and the restoration confirmation is not executed redundantly. Moreover, the result of the construction restoration confirmation may be managed by writing back the result of the construction restoration confirmation in the construction restoration confirmation information 208 as the result of the construction restoration confirmation. Furthermore, the construction management system may be provided with a system reflection flag indicating whether or not the restoration confirmation result has been taken into the construction management system, so that the contents of the construction restoration confirmation information can be maintained.

  Therefore, the construction information setting unit 216 included in the alarm management device 200 is the same as the monitoring target identification information included in the restoration alarm 209 received by the alarm reception unit 212 among the construction restoration confirmation information 208 stored in the storage device 211. Recovery information (for example, a recovery confirmation flag and a recovery confirmation result) included in the construction restoration confirmation information 208 including construction target identification information for identifying the device is set (construction information setting step). The determination unit 214 refers to the restoration information included in the construction restoration confirmation information 208 read by the construction information reading unit 213 by the processing device 210 and is included in the construction restoration confirmation information 208 read by the construction information reading unit 213. It is determined whether the device corresponding to the construction object identification information to be repaired has already been recovered (determination step). When the determination unit 214 determines that the device corresponding to the construction object identification information included in the construction restoration confirmation information 208 read by the construction information reading unit 213 is not restored, the alarm reception unit 212 To monitor. The output unit 215 manages output information indicating whether or not the device on which the construction is performed has been restored among a plurality of devices, based on the restoration information included in the construction restoration confirmation information 208 read by the construction information reading unit 213. You may output to the terminal 102.

  In the present embodiment, the construction information 207 and construction restoration confirmation information 208 database shown in FIG. 8 can be configured with the same information, but the monitoring target host name may be changed depending on the construction. In this case, the host name to be monitored may be different before and after the construction, so the explanation is given using an example in which the information is divided into two pieces of information. When the information is composed of one piece of information, two monitored host names may be managed before construction and after construction.

As described above, the alarm management device according to the present embodiment is
From the storage device that stores construction information including construction target identification information for identifying a device to be constructed among a plurality of devices connected to the network and construction completion time information indicating a scheduled completion time of the construction, the construction A construction information reading unit for reading information;
The processing device compares the current time with the work end time information included in the work information read by the work information reading unit, and if the current time has passed the planned work end time, the work The device corresponding to the construction object identification information included in the construction information read by the information reading unit is monitored every predetermined period, and when the device is recovered from a failure that occurred in the device due to the construction, An alarm receiver for receiving a recovery alarm including monitoring target identification information for identifying a device;
And an output unit that outputs output information indicating that the device corresponding to the monitoring target identification information included in the recovery alarm received by the alarm receiving unit is recovered.

  With such a feature, it is possible for the administrator to easily confirm whether or not the work has been restored from the work on the device connected to the network.

The construction information includes restoration information indicating whether or not a device corresponding to construction target identification information included in the construction information read by the construction information reading unit has been restored,
The alarm management device further includes:
Set the recovery information included in the construction information including the construction target identification information for identifying the same device as the monitoring target identification information included in the recovery alarm received by the alarm receiver from the construction information stored in the storage device Construction information setting section to be
With reference to the restoration information included in the construction information read by the construction information reading unit by the processing device, an apparatus corresponding to the construction target identification information included in the construction information read by the construction information reading unit has already been obtained. A determination unit for determining whether or not the recovery has occurred,
The alarm receiving unit monitors the device when the determination unit determines that the device corresponding to the construction object identification information included in the construction information read by the construction information reading unit has not yet been restored. It is characterized by that.

  With such a feature, it is possible to efficiently determine whether or not the work has been restored from the work on the device connected to the network.

The construction information includes restoration information indicating whether or not a device corresponding to construction target identification information included in the construction information read by the construction information reading unit has been restored,
The alarm management device further includes:
Set the recovery information included in the construction information including the construction target identification information for identifying the same device as the monitoring target identification information included in the recovery alarm received by the alarm receiver from the construction information stored in the storage device With a construction information setting section
The output unit outputs output information indicating whether or not a device on which the construction is performed is restored among the plurality of devices based on the restoration information included in the construction information read by the construction information reading unit. It is characterized by.

  With such a feature, the administrator can easily confirm the result of determining whether or not the work has been restored from the work on the device connected to the network.

The alarm management method according to the present embodiment is
The construction information reading unit included in the alarm management device includes construction target identification information for identifying a device on which construction is to be performed among a plurality of devices connected to the network, and construction end time information indicating a scheduled end time of the construction. A construction information reading step for reading the construction information from a storage device for storing construction information;
The alarm receiving unit included in the alarm management device compares the current time with the work end time information included in the work information read by the work information reading unit by the processing device, and the current time is the estimated work end time. If it has passed, the equipment corresponding to the construction object identification information included in the construction information read by the construction information reading unit is monitored every predetermined period, and a failure occurred in the equipment due to the construction work. An alarm reception step for receiving a recovery alarm including monitoring target identification information for identifying the device when the device is recovered from;
An output unit included in the alarm management device includes an output step of outputting output information indicating that the device corresponding to the monitoring target identification information included in the recovery alarm received by the alarm reception unit is recovered. To do.

  With such a feature, it is possible for the administrator to easily confirm whether or not the work has been restored from the work on the device connected to the network.

The alarm management apparatus and method described in the second embodiment are as follows.
In order to confirm the completion of construction, refer to the construction restoration confirmation information at regular time intervals, and if the construction completion confirmation time has passed, a function to perform restoration confirmation is provided and the restoration confirmation result is judged. The feature is that the end of the construction work is determined on time.

The function of performing the recovery confirmation is further
During recovery confirmation, a recovery confirmation flag that does not perform redundant confirmation is provided, the recovery confirmation flag is set to ON before the recovery confirmation, and then the recovery confirmation is executed. It is characterized in that duplication execution of restoration confirmation is suppressed by turning OFF.

The function of performing the recovery confirmation is further
A flag for recording and managing the restoration confirmation result is provided, and after the restoration confirmation is executed, success and failure are recorded and managed as a restoration confirmation result, so that the result of planned construction can be managed.

  FIG. 12 is a diagram illustrating an example of the appearance of the alarm management device according to the above embodiment.

  In FIG. 12, an alarm management device 200 includes a system unit 910, a CRT (Cathode Ray Tube) display device 901, a keyboard (K / B) 902, a mouse 903, a compact disc device (CDD) 905, a printer device 906, and a scanner device 907. These are connected by a cable. Further, the alarm management apparatus 200 is connected to the FAX machine 932 and the telephone 931 via a cable, and is connected to the Internet 940 via a local area network (LAN) 942 and a gateway 941.

  FIG. 13 is a diagram illustrating an example of a hardware configuration of the alarm management device according to the embodiment.

  In FIG. 13, the alarm management apparatus 200 includes a CPU 911 that executes a program. The CPU 911 receives a ROM (Read Only Memory) 913, a RAM (Random Access Memory) 914, a communication board 915, a CRT display device 901, a K / B 902, a mouse 903, a FDD (Flexible Disk Drive) 904, and a bus 912. A device 920, a CDD 905, a printer device 906, and a scanner device 907 are connected.

  The RAM 914 is an example of a volatile memory. The ROM 913, the FDD 904, the CDD 905, and the magnetic disk device 920 are examples of nonvolatile memories. These are examples of a storage device or a storage unit.

  The communication board 915 is connected to a FAX machine 932, a telephone 931, a LAN 942, and the like. The communication board 915 is an example of an input device, an input unit, an output device, or an output unit.

  For example, the K / B 902, the scanner device 907, the FDD 904, and the like are examples of an input device or an input unit. For example, the CRT display device 901 is an example of an output device or an output unit.

  Here, the communication board 915 is not limited to the LAN 942 but may be directly connected to the Internet 940 or a WAN (Wide Area Network) such as ISDN (Integrated Services Digital Network). When directly connected to a WAN such as the Internet 940 or ISDN, the alarm management device 200 is connected to a WAN such as the Internet 940 or ISDN, and the gateway 941 is not necessary.

  The magnetic disk device 920 stores an operating system (OS) 921, a window system 922, a program group 923, and a file group 924. The program group 923 is executed by the CPU 911, the OS 921, and the window system 922.

  The program group 923 stores a program for executing a function described as “˜unit” in the description of the above-described embodiment. The program is read and executed by the CPU 911.

  For example, the CPU 911 is an example of a processing device or a processing unit.

  In the file group 924, what is described as “˜data”, “˜information”, and “˜result” in the description of the above-described embodiment is stored as a file or a part thereof.

  In addition, the arrows in the flowchart described in the description of the above-described embodiment mainly indicate data input / output, and for the data input / output, data includes a magnetic disk device 920, an FD (Flexible Disk), an optical disk, It is recorded on other recording media such as CD (compact disc), MD (mini disc), DVD (Digital Versatile Disk). Alternatively, it is transmitted through a signal line or other transmission medium.

  In addition, what is described as “˜unit” in the description of the above-described embodiment may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented by software alone, hardware alone, a combination of software and hardware, or a combination of firmware.

  Further, the program for implementing the above-described embodiment may be stored using a recording device using another recording medium such as the magnetic disk device 920, FD, optical disk, CD, MD, DVD, or the like.

1 is a diagram illustrating an example of a configuration of a system according to a first embodiment. 1 is a block diagram illustrating a configuration of an alarm management device according to a first embodiment. 6 is a flowchart showing an example of the operation of the alarm management device according to the first embodiment. FIG. FIG. 3 is a sequence diagram showing processing of the system according to the first embodiment. 6 is a diagram illustrating an example of a failure alarm in the first embodiment. FIG. 6 is a diagram illustrating an example of a failure alarm in the first embodiment. FIG. 6 is a diagram illustrating an example of construction information in Embodiment 1. FIG. 6 is a block diagram illustrating a configuration of an alarm management device according to Embodiment 2. FIG. FIG. 10 is a flowchart showing an example of operation of the alarm management device according to the second embodiment. 10 is a sequence diagram showing processing of a system according to Embodiment 2. FIG. 6 is a diagram illustrating an example of construction restoration confirmation information in Embodiment 2. FIG. It is a figure which shows an example of the external appearance of the alarm management apparatus in each embodiment. It is a figure which shows an example of the hardware constitutions of the alarm management apparatus in each embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 Monitoring object router, 101 Monitoring object server, 102 Management terminal, 103 Monitoring side router, 104 Fault log information recording apparatus, 105 Construction information management apparatus, 106 Network monitoring apparatus, 107 Server monitoring apparatus, 108 Monitoring object, 200 Alarm management apparatus , 201 Monitoring device, 202 Fault alarm, 203 Alarm storage function, 204 Alarm judgment function, 205 Recovery confirmation function, 206 Alarm information, 207 Construction information, 208 Construction recovery confirmation information, 209 Recovery alarm, 210 Processing device, 211 Storage device, 212 alarm reception unit, 213 construction information reading unit, 214 judgment unit, 215 output unit, 216 construction information setting unit, 901 CRT display device, 902 K / B, 903 mouse, 904 FDD, 905 CDD, 906 printer Device, 907 scanner device, 910 system unit, 911 CPU, 912 bus, 913 ROM, 914 RAM, 915 communication board, 920 magnetic disk device, 921 OS, 922 window system, 923 program group, 924 file group, 931 telephone, 932 FAX machine, 940 Internet, 941 gateway, 942 LAN.

Claims (9)

Monitoring a plurality of devices connected to the network, and when a failure occurs in any of the plurality of devices, monitoring target identification information for identifying the device and failure occurrence time information indicating the occurrence time of the failure; An alarm receiver for receiving fault alarms including:
Construction information including construction target identification information for identifying a device to be constructed among the plurality of devices, construction start time information indicating a scheduled start time of the construction, and construction end time information indicating a planned end time of the construction A construction information reading unit that reads construction information including construction target identification information that identifies the same device as the monitoring target identification information included in the failure alarm received by the alarm reception unit, from a storage device that stores
The processing device compares the failure occurrence time information included in the failure alarm received by the alarm receiving unit with the construction start time information included in the construction information read by the construction information reading unit and the construction end time information. (1) When the failure occurrence time is between the scheduled start time and the scheduled finish time of the construction, it is determined that the failure has occurred due to the construction, and (2) the failure has occurred. When the period from the time to the scheduled start time of the construction is not more than a predetermined time and (3) When the period from the scheduled completion time of the construction to the occurrence time of the failure is not more than a predetermined time, It is determined that there is a possibility that the failure has occurred due to the influence of the construction , and the construction is carried out in a period different from the schedule . (4) In other cases, the failure occurs due to other than the construction Shi A determination unit that determines that
Included in the failure alarm received by the alarm receiving unit when the construction is carried out in a period different from the schedule and the determination unit determines that the failure may have occurred due to the construction. An alarm management device comprising: an output unit that outputs output information indicating that there is a possibility that the failure has occurred due to the construction work on a device corresponding to the monitored object identification information.   The output unit performs the failure of the failure by the processing device when the construction is carried out in a period different from the schedule and the determination unit determines that the failure may have occurred due to the influence of the construction. The alarm management apparatus according to claim 1, wherein a difference between the occurrence time and the scheduled start time or the end time of the construction is calculated, and output information indicating the calculation result is output. The failure alarm includes failure content information indicating the content of the failure,
The construction information includes failure feature information indicating a feature of a failure that occurs due to the influence of the construction,
The determination unit compares the failure content information included in the failure alarm received by the alarm reception unit and the failure feature information included in the construction information read by the construction information reading unit by the processing device, Determine whether the failure indicates the characteristics of the failure caused by the construction,
The output unit is a case where the determination unit determines that the failure has occurred due to a cause other than the construction, and the determination unit indicates that the failure does not indicate a characteristic of the failure that occurs due to the influence of the construction. If it is determined, according to claim 1, characterized in that an output information indicating that the failure has occurred in the device corresponding to the monitored identification information included in the received fault alarm by the alarm receiver or 2. The alarm management device according to 2. When the determination unit determines that the failure has occurred due to reasons other than the construction, the output unit includes the device corresponding to the monitoring target identification information included in the failure alarm received by the alarm reception unit. The alarm management device according to claim 1 or 2 , wherein output information indicating that a failure has occurred is output. When the determination unit determines that the failure has occurred due to the construction, the output unit applies the construction to the device corresponding to the monitoring target identification information included in the failure alarm received by the alarm reception unit. alarm management apparatus as claimed in any one of said failure under the influence of outputting the output information indicating occurrence of claim 1, wherein up to 4. The alarm receiving unit compares the current time with the construction end time information included in the construction information read by the construction information reading unit by the processing device, and the current time has passed the planned construction end time. If there is a device, the device corresponding to the construction object identification information included in the construction information read by the construction information reading unit is monitored every predetermined period, and the device is detected from a failure that has occurred in the device due to the construction. There when restored, it receives the recovery alarm comprising monitoring subject identification information for identifying the device,
The output unit claims 1 to 5, which apparatus corresponding to the monitored identification information included in the received recovered alarm by the alarm receiver is characterized and Turkey to output the output information indicating that the recovery The alarm management device according to any one of the above . The construction information includes restoration information indicating whether or not a device corresponding to construction target identification information included in the construction information read by the construction information reading unit has been restored,
The alarm management device further includes:
Set the recovery information included in the construction information including the construction target identification information for identifying the same device as the monitoring target identification information included in the recovery alarm received by the alarm receiver from the construction information stored in the storage device with a construction information setting unit that,
The determination unit refers to the restoration information included in the construction information read by the construction information reading unit by the processing device , and sets the construction target identification information included in the construction information read by the construction information reading unit. It determines whether the associated device has already recovered,
The alarm receiving unit monitors the device when the determination unit determines that the device corresponding to the construction object identification information included in the construction information read by the construction information reading unit has not yet been restored. The alarm management device according to claim 6 . The construction information includes restoration information indicating whether or not a device corresponding to construction target identification information included in the construction information read by the construction information reading unit has been restored,
The alarm management device further includes:
Set the recovery information included in the construction information including the construction target identification information for identifying the same device as the monitoring target identification information included in the recovery alarm received by the alarm receiver from the construction information stored in the storage device With a construction information setting section
The output unit outputs output information indicating whether or not a device on which the construction is performed is restored among the plurality of devices based on the restoration information included in the construction information read by the construction information reading unit. The alarm management device according to claim 6 . The alarm reception unit of the alarm management device monitors a plurality of devices connected to the network, and when any of the plurality of devices fails, the monitoring target identification information for identifying the device and the failure An alarm reception step for receiving a failure alarm including failure occurrence time information indicating the occurrence time of
The construction information reading unit of the alarm management device has construction target identification information for identifying a device to be constructed among the plurality of devices, construction start time information indicating the planned construction start time, and scheduled construction completion time. Construction information including construction target identification information for identifying the same device as the monitoring target identification information included in the failure alarm received by the alarm receiver from a storage device that stores construction information including construction completion time information indicating A construction information reading step for reading
The determination unit included in the alarm management device includes, by the processing device, failure occurrence time information included in the failure alarm received by the alarm reception unit and construction start time information included in the construction information read by the construction information reading unit. (1) When the failure occurrence time is between the scheduled start time and the scheduled completion time of the construction, it is determined that the failure has occurred due to the construction. (2) a period from the failure occurrence time to the scheduled start time of the construction is equal to or less than a predetermined time; and (3) a period from the planned construction end time to the failure occurrence time is a predetermined time. the a case where the time or less, the work is performed in different periods scheduled, and determines that the failure by the influence of the work is likely to have occurred, in the case of (4) others, before A determination step for determining that the failure has occurred for reasons other than the construction work ;
When the output unit included in the alarm management device is implemented in a period different from the schedule, and the determination unit determines that the failure may have occurred due to the work, the alarm reception is performed. An output step of outputting output information indicating that the failure may have occurred due to the construction work to a device corresponding to the monitoring target identification information included in the failure alarm received by the unit, Alarm management method to do.

Images