JPH087723B2 - Event report processing circuit - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an event report processing circuit, and more particularly to an event report processing method in a network management system in which event report processing is performed by a management target that owns notification conditions and notification destinations of event reports.

[0002]

2. Description of the Related Art Conventionally, in this type of event report processing method, as shown in FIG. 3, management objects (EFDs) existing in the system at the time of event reporting are taken out one by one and designated by notification conditions. Checking if the attribute is in the received event report.

That is, when the event report processing circuit receives the event report, it acquires one pre-registered management target (step 21 in FIG. 3). The event report processing circuit checks whether the received event report satisfies the notification condition of the acquired management target (step 22 in FIG. 3).

In this check processing, first, it is checked whether or not all the attributes indicated in the notification condition of the management target are included in the event report, and if they are included, the type of attribute and the range of the value of the attribute are checked. Conditions (Filter Item)
m) is compared (step 22 in FIG. 3).

Next, when the notification condition is defined by the logical expression of the above condition, a logical operation is performed based on the comparison result of each condition (step 22 in FIG. 3). If the calculation result is false (step 23 in FIG. 3), it is determined whether or not there is an unchecked management target (step 25 in FIG. 3).

If the operation result is true (step 23 in FIG. 3), the received event report is notified to the notification destination specified in the management target (step 24 in FIG. 3), and the management target not checked is checked. Is determined (step 25 in FIG. 3).

If there is an unchecked management target, the process returns to step 21 to acquire the next management target, and the above processing is repeated. If no unchecked management target remains, the process ends. in this way,
In the event report processing circuit, the above processing is performed for all management targets existing in the network management system.

[0008]

In the above-described conventional event report processing method, combinations of attributes included in one management target notification condition and conditions such as the type of attribute and the range of the value of the attribute are different from each other. If it exists also in the management target, the same comparison process is repeated, and there is a problem that the event report process takes time.

SUMMARY OF THE INVENTION An object of the present invention is to provide an event report processing circuit which solves the above problems and can speed up the event report processing.

[0010]

An event report processing circuit according to the present invention defines a notification destination to which an input event report is to be notified and a notification condition of the event report to the notification destination as an attribute of the event report. Storage means for storing each of the event reports, extraction means for extracting the notification condition and the notification destination corresponding to the attribute of the event report from the storage means when the event report is input, and the event report extracted by the extraction means Determining means for determining whether the notification condition is satisfied, and a notification extracted by the extracting means for the event report when the determining means determines that the notification condition extracted by the extracting means is satisfied. Means for notifying the notification destination corresponding to the condition.

[0011]

An embodiment of the present invention will be described with reference to the drawings.

FIG. 1 is a diagram showing the configuration of an embodiment of the present invention. In the figure, an extraction means 1 of an event report processing circuit according to an embodiment of the present invention includes a management target corresponding to an attribute of an event report received from a list of management targets (EFD) registered in the storage means 4 for each attribute. To extract.

The judging means 2 judges whether or not the received event report satisfies the management condition notification condition extracted by the extracting means 1. When the determination means 2 determines that the notification condition is satisfied, the notification means 3 notifies the event report to the notification destination of the management target.

FIG. 2 is a diagram showing a configuration example of the storage means 4 of FIG. In the figure, the storage means 4 stores conditions such as an attribute name and a type of the attribute and a range of values of the attribute (hereinafter referred to as Filter).
rItem) and the management target name are associated with each other and registered as an EFD list.

Here, efd1 in the figure has a notification condition of "notify an alarm having an alarm occurrence time of 1993/05/25, 9:00 or later and an alarm importance of 3 or more."

Further, efd2 has a notification condition that "a type of alarm is a transmission level decrease and an alarm of which the generation time is 1993/04/25 or later is notified."
Furthermore, efd3 has a notification condition that "the alarm type is a power supply abnormality, and an alarm is generated before the time 12:00 on May 25, 1993/05/25."

These managed objects efd1 to efd1 to 3 are arranged in the storage means 4 as shown in FIG. 2, arranged by attribute names such as "alarm occurrence time", "alarm type", and "alarm importance". Will be done.

The operation of one embodiment of the present invention will be described with reference to FIGS. 1 and 2. Hereinafter, FIG.
In the network management system in which the management targets efd1 to efd3 as shown in (3) are registered, an event report process when an event report having the attribute names "alarm occurrence time" and "alarm type" occurs will be described.

When the event report is received, the extraction means 1
Checks whether the attribute names “alarm occurrence time” and “alarm type” included in the event report exist in the EFD list of the storage unit 4 (step 11 in FIG. 1).

As a result of the check, the extracting means 1 filters the attributes that are judged to exist in the EFD list.
All tems are compared (step 12 in FIG. 1). That is, the Filter It of the attribute name "alarm occurrence time"
In the case of em, since the conditions of the extraction unit 1 are “≦ (after)” and “≧ (before)”, the extraction means 1 compares the time after the alarm occurrence time with the time before the alarm occurrence time.

Further, the Fil of the attribute name "alarm type"
In the case of ter Item, the extraction unit 1 has the condition “=
(Equal) ”, so a comparison is made as to whether the alarm types are equal.

After that, the extraction means 1 extracts the management object of the notification condition including all the attributes of the event report (step 1 in FIG. 1).
3). In this case, the extraction unit 1 extracts efd2 and efd3 as the management targets of the notification condition including all the attribute names “alarm occurrence time” and “alarm type” that the event report has.

The extraction means 1 is the washed-out management target efd2.
One of efd3 is acquired and passed to the determination means 2 (see FIG. 1).
Step 14). At this time, the extraction means 1 controls the management target ef.
The data d2 and the management target efd3 are passed to the determination means 2 in this order.

The determination means 2 is the Filt performed by the extraction means 1.
er Item based on the comparison processing result e
The logical operation designated by the notification condition of fd2 is performed (step 15 in FIG. 1), and it is determined whether the logical operation result (judgment result of the notification condition) is true (step 16 in FIG. 1).

At this time, the judging means 2 performs a logical operation between the comparison result of ".ltoreq. (After)" for the "alarm occurrence time" and the comparison result of "= (equal)" for the "alarm type" (in this case, AND operation) is performed. That is, in the determination means 2, the alarm occurrence time is 1993/04.
After / 25, it is determined whether the type of alarm is a decrease in transmission level.

When the judging means 2 judges that the logical operation result is true, it passes the received event report to the notifying means 3,
The notification means 3 transmits the received event report to the notification destination specified by the management target efd2 (step 17 in FIG. 1).

When the judgment means 2 judges that the logical operation result is false, or when the notification means 3 sends the event report to the notification destination, whether the management target washed out by the extraction means 1 remains. Is determined (step 18 in FIG. 1).

If there is any remaining management object, the extraction means 1 transfers the remaining management target to the judgment means 2, and if there is no remaining one, the event report processing ends. In this case, assuming that the management target efd3 remains, the extraction target 1 passes the management target efd3 to the determination unit 2.

The determination unit 2 performs the Filter Iterate performed by the extraction unit 1 in the same manner as the processing of the management target efd2.
Based on the comparison processing result of m, the logical operation specified in the notification condition of the management target efd3 is performed (step 1 in FIG. 1).
5), it is determined whether or not the logical operation result (notification condition determination result) is true (step 16 in FIG. 1).

At this time, the judging means 2 performs a logical operation between the comparison result of "≧ (previous)" for the "alarm occurrence time" and the comparison result of "= (equal)" for the "alarm type" (in this case, AND operation) is performed. That is, in the determination means 2, the alarm occurrence time is 1993/05 /
Before / 25, 12:00, it is determined whether the alarm type is power supply abnormality.

When the judging means 2 judges that the logical operation result is true, it passes the received event report to the notifying means 3,
The notification means 3 transmits the received event report to the notification destination designated by the management target efd3 (step 17 in FIG. 1).

When the judging means 2 judges that the logical operation result is false, or when the notifying means 3 sends the event report to the notification destination, whether the management target washed out by the extracting means 1 remains. Is determined (step 18 in FIG. 1).

If it remains, the extraction means 1 passes the remaining management target to the judgment means 2, and if it does not remain, the event report processing ends. In this case, if no management target remains, the event report process ends.

As described above, in one embodiment of the present invention, the Filter Items are compared with the attributes determined to exist in the EFD list based on the attribute names "alarm occurrence time" and "alarm type" included in the received event report. Is all done.

Therefore, in the Filter Item comparison process, the condition “≦≦ alarm condition” of the attribute name “alarm occurrence time” is set.
(After) ”and“ ≧ (before) ”, and“ = (equal) ”that is the condition for the attribute name“ alarm type ”
It is sufficient to perform the comparison processing three times with the comparison processing for.

On the other hand, in the conventional example, it is performed for all the management targets in the network management system including the attribute names “alarm occurrence time” and “alarm type” included in the received event report.

Therefore, the comparison processing for the condition “≦ (or later)” of the attribute name “alarm occurrence time” of the management target efd1 and the condition of “≦ (or later)” of the attribute name “alarm occurrence time” of the management target efd2 are performed. ) ”And a comparison process for“ = (equal) ”which is a condition of the attribute name“ alarm type ”and a“ ≧ (previous) ”which is a condition of the attribute name“ alarm occurrence time ”of the management target efd3. The comparison process and the comparison process for “= (equal)” which is the condition of the attribute name “alarm type” are required to be compared five times.

In this way, the management targets are sorted by attribute and registered in the storage means 4, and the management means of the notification condition including all the attributes included in the received event report is extracted by the extraction means 1. The determination unit 2 determines whether the notification condition is satisfied by performing a logical operation specified in the extracted notification condition of the management target, and when it is determined that the notification condition is satisfied, the event report is notified. By notifying the corresponding management target notification destination from No. 3, the filter in the management target existing in the network management system
The item comparison process is the minimum necessary process.

Therefore, it is possible to shorten the time from the reception of the event report to the determination of the notification condition and the notification of the event report to the notification destination, and to speed up the event report processing.

[0040]

As described above, according to the present invention, the notification destination to which the input event report is to be notified and the notification condition to the notification destination of the event report are stored for each attribute of the event report,
The notification condition and the notification destination corresponding to the attribute of the event report are extracted when the event report is input, and the notification condition that the event report is extracted when it is determined that the event report satisfies the extracted notification condition By notifying the notification destination corresponding to, there is an effect that the event report processing can be speeded up.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration of an exemplary embodiment of the present invention.

FIG. 2 is a diagram showing a configuration example of a storage unit in FIG.

FIG. 3 is a flowchart showing a conventional event report process.

[Explanation of symbols]

 1 Extraction Means 2 Judgment Means 3 Notification Means 4 Storage Means

Claims (2)

[Claims] 1. Storage means for storing a notification destination to be notified of the input event report and a notification condition of the event report to the notification destination for each attribute of the event report, and a storage unit for storing the event report. Extraction means for extracting the notification condition and the notification destination corresponding to the attribute of the event report from the storage means at the time of input, and a determination means for determining whether the event report satisfies the notification condition extracted by the extraction means And a means for notifying the event report to the notification destination corresponding to the notification condition extracted by the extracting means when the determining means determines that the notification condition extracted by the extracting means is satisfied. An event report processing circuit characterized by the above. 2. The means for extracting, when inputting the event report, means for extracting an attribute including at least the attribute name and the range of values of the attribute of the event report, and the notification corresponding to the extracted attribute. The event report processing circuit according to claim 1, further comprising: a condition and a means for extracting the notification destination from the storage means.