KR20050002263A - System and method for managing network failure - Google Patents

Abstract

PURPOSE: A defect management system for network management and a method therefor are provided to track a position of a defect by using an object tree ID for a network element and a double filtering process when the defect is generated in a network resource, thereby easily perceiving correlations between network elements while exactly and quickly processing the defect. CONSTITUTION: A local gateway device(100) comprises as follows. A ping tester(110) conducts an ICMP ping test with network equipments, and transmits tested results. An SNMP processor(120) collects port states of each equipment and trap information by accessing the network equipments with an SNMP, and transmits collected results. A log information processor(130) transmits event information that converts remote log information transmitted from the network equipments in data type. The first filter(140) analyzes information transmitted from tester(110), the processor(120) or the log information processor(130) to first filter the analyzed information, and groups defect events of all ports included in the equipments to transmit the grouped events to a defect management system.

Description

Fault management system and its method in network management {SYSTEM AND METHOD FOR MANAGING NETWORK FAILURE}

The present invention relates to a failure management system and method in network management for failure management in large networks.

Most Internet services are using IP services, and in order to perform these services, network operators generally adopt new services by configuring networks with routers or switches.

Recently, due to the successful launch of the high-speed Internet service, the network elements using routers or switches are rapidly increasing, and they have already formed large networks.

Most Internet environments in Korea accept subscriber's traffic in access networks using various access technologies such as Ethernet, leased lines, and wireless LANs, and transfer them to the backbone network consisting of switches and routers to access servers in the backbone network, Connect with other ISPs or connect to overseas lines.

A network management system that maintains a network of IP-based devices is designed to provide a switch and router device for accommodating subscribers, and a backbone device for transporting traffic to server groups, other ISP operators, or overseas lines. You must quickly and accurately identify and take action.

Therefore, the network management system should be equipped with a system that can monitor the nation-wide situation by simultaneously handling tens of thousands to hundreds of thousands of ports at the same time, instead of managing a few devices in a large IP network.

To do this, network management systems need to quickly extract, process and analyze tens of thousands to hundreds of thousands of fault data in large IP networks to find out the devices or ports that cause the correct faults.

However, the conventional network management system does not have the system to monitor the national situation by simultaneously handling tens of thousands to hundreds of thousands of devices at the same time, and network operators also have complex services, especially the function of failure and performance management, an operation management function. The situation is not integrated.

Increasingly, the number of switch or router devices and their ports, which are network elements, is increasing exponentially with the acceptance of various services. There is a problem that the cost burden is too large.

The technical problem to be achieved by the present invention is to provide a system and method for managing a failure in network management that can track the exact location of a failure when a failure occurs in a large IP network, and can perform a quick failure treatment for a large failure.

1 illustrates a configuration of a network management system to which the present invention is applied.

2 and 3 illustrate the configuration of a failure management system in network management according to an embodiment of the present invention.

4 illustrates a structure of an object tree ID applied to the present invention.

5A to 5H illustrate a process of assigning an object tree ID applied to the present invention.

6 shows a structure of a hierarchy ID applied to the present invention.

7 is a flowchart illustrating a failure management method in network management according to an embodiment of the present invention.

In order to solve this problem, the present invention performs accurate and fast failure processing through object tree ID and double filtering when a failure occurs in a large network.

The system for managing a failure in network management according to the first aspect of the present invention collects failure event information from a network device, first filters the failure event information, and transmits a single group of failure events within the same period. ; And secondly filtering out fault events transmitted from the local gateway device, among the fault events, fault information of the network equipment, port, and link related fault events are processed, and a large fault related fault event is tracked by the location of the corresponding fault. It includes a failure management server that handles failures, including objects that are correlated with the failed object.

The regional gateway device,

A ping tester for performing a periodic Internet Control Message Protocol (ICMP) ping test to the network equipment and transmitting the test result; An SNMP processor which accesses the network device using a simple network management protocol (SNMP), periodically collects port state and trap information of each device, and transmits the collection result; A log information processor for transmitting event information obtained by converting the remote log information transmitted from the network equipment into a data form used in the system; And first filtering and analyzing information transmitted from the ping tester, the SNMP processor, or the log information processor, and when a failure situation related to the network equipment is detected, failure management of all ports belonging to the corresponding equipment is grouped into a single group. It is desirable to include a primary filter that sends to the server.

The SNMP processor may include an operation state monitoring unit that reads an operation state of the network device during a setting cycle and collects information on whether a port of each network device is up / down; And a trap parsing unit for parsing the trap information transmitted from the network equipment, converting the trap information into a data form used in the system, and transmitting the converted event information to the primary filter.

The failure management server,

A resource object manager that manages the network equipment in the form of physical and logical object trees, and manages an object tree ID by assigning an ID to each object; A buffer for storing a failure event transmitted from the local gateway device; An alarm processor that monitors a failure event in the buffer and extracts the failure event for each type of failure; A link failure handler configured to process a failure event belonging to a link among the failure events stored in the buffer as a link failure; A secondary filter that examines whether a large failure of an event transmitted after the alarm processing is performed by the alarm processor or the link failure processor, and tracks the location of the large failure object using the object tree ID of the resource object manager; And a large failure manager that handles large failures for all object tree IDs below the large failure object through the secondary filter.

The object tree ID of the resource object manager is preferably divided into an object ID indicating a physical and logical correlation of the object and a hierarchy ID indicating a high level relationship of the object.

The object ID is preferably generated by assigning a network identification number, a device identification number, a link identification number, a chassis identification number, a module identification number, a card identification number, a port identification number, and a logical port identification number.

Preferably, the object ID is defined such that an object of a lower level includes an object ID of an upper level to which it belongs.

When the primary filter detects a failure of an object tree ID belonging to a specific level by using the object tree ID of the resource object manager, it is preferable to ignore a failure situation of an object tree ID belonging to a lower level of the object tree ID. .

A failure management method in network management according to a second aspect of the present invention includes the steps of: A) collecting failure event information from network equipment, and classifying the failure event information for each type of failure occurrence; B) extracting the fault event information related to the failure of the network equipment and the port in step A) and performing alarm processing; And C) disabling failure events related to a large failure in step A), including the objects that are correlated with the failure object by tracking the location of the failure object.

In the collecting of the failure data in the step A), the gateway device for each region periodically monitoring the failure with the network equipment first filters the failure data, and when a failure state related to the network equipment is detected, all the devices belonging to the corresponding equipment are detected. It is desirable to send a single group of failure events on the port.

In the step A), the categorizing of the failure event may include assigning a unique ID to each entity of the network device to generate a physical and logical object tree ID, and analyzing the failure event using the object tree ID to generate a failure. It is desirable to check the type and location.

The filtering of the failure event may include disregarding a failure state of an object tree ID belonging to a lower level of the object tree ID when detecting a failure of the object tree ID belonging to a specific level using the object tree ID. desirable.

In the step C), the processing of the large fault comprises: a) receiving an event for the alarm processing result of the step B) and performing secondary filtering to investigate whether there is a large failure, and using the object tree ID to determine the large failure. Tracking the location of the failed object; And b) performing a large failure processing on all object tree IDs below the large failure object through the second filtering result of step a).

The object tree ID is preferably divided into an object ID indicating a physical and logical correlation of the object and a hierarchy ID indicating a high level relationship of the object. Preferably, the object ID is defined such that an object of a lower level includes an object ID of an upper level to which the object ID belongs.

The object ID is generated by assigning a network identification number, a device identification number, a link identification number, a chassis identification number, a module identification number, a card identification number, a port identification number, and a logical port identification number in this order.

The object ID is generated by using a unique ID assigned to the network identification number for each service domain, and the device identification number is generated by attaching a local headquarter, a local number, a type of equipment, and a serial number to which the corresponding device belongs. The link identification number is defined as a logical object belonging to each device, the chassis identification number is defined as a physical object belonging to each device, the module identification number is defined as a physical object belonging to each chassis, and the card identification number It is preferable to define a physical object belonging to each module, the port identification number is defined as a physical object belonging to the device, and the logical port identification number is preferably defined as a logical object belonging to each port.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention. Like parts are designated by like reference numerals throughout the specification.

1 illustrates a configuration of a network management system to which the present invention is applied.

As shown in FIG. 1, the network management system includes an interworking management device 10, a GUI (Graphic User Interface) management device 20, a rights and account management device 30, and a server management device 40. , A failure management device 50, a performance management device 60, a configuration management device 70, and a database 80.

The failure management device 50 detects the detection, separation, and abnormal operation of a failure, the performance management device 60 evaluates that the communication can be performed efficiently, and the configuration management device 80 manages the management of the network equipment configuration. In charge.

As such, the network management system has three methods for collecting data for detecting a failure.

First, the data collection method for fault detection is to establish a data communication network for fault detection, which is expensive and has a disadvantage in that a fault situation is not detected when a fault occurs in the management network itself. .

Secondly, the data collection method for fault detection divides the network management system into a central server and a regional gateway system to generate all the raw fault data in the regional gateway system, and the result is collected from the central server and processed into fault data. It is.

Third, the central server collects and processes all the data related to the failure, which has the disadvantage that the server has to perform very well and it is difficult to find a server suitable for managing a large network.

First, a failure management system in network management according to an embodiment of the present invention applies the second method proposed above to perform failure management of a large network including a general IP network.

2 and 3 illustrate the configuration of a failure management system in network management according to an embodiment of the present invention.

2 and 3, a failure management system in network management according to an embodiment of the present invention includes a local gateway device 100 and a failure management server 200.

The regional gateway device 100 collects the fault event information from the network equipment, first filters the fault event information, and transmits the fault events in a single group.

The regional gateway device 100 uses the following four methods to check whether a network device and a port belonging to the device are faulty.

1. PING (packet internet groper) performs ICMP PING test on the equipment, and if there is no ECHO or time out, it is recognized as a fault condition.

2. SNMP polling periodically polls the ifOperStatus item in the IF table using SNMP, and checks whether the port of the device has failed. If it cannot be bound to SNMP, it is recognized as the failure of the device.

3. SNMP trap (TRAP) designates the gateway device 100 that exists in each region as a trap host, forwards and collects SNMP trap information generated from the equipment, and links up and down, which are standard traps. ) Is used for port failure, cold start and warm start for device failure.

4. The remote log (SYSLOG) is a function that can remotely transmit the log managed by the device, by designating the SYSLOG host as the gateway device 100 existing by region in the device to log information maintained by the device Receive remotely. The local gateway device 100 extracts information related to the activation / deactivation of the port from among the log information and utilizes the port failure information, and extracts the information related to the abnormality of the device to utilize the device failure information.

As such, the local gateway device 100 may include, but is not limited to, a ping tester 110, an SNMP processor 120, a log information (SYSLOG) processor 130, and a primary filter 140.

The ping tester 110 performs a periodic Internet Control Message Protocol (ICMP) ping test with the network equipment, and transmits the test result to the primary filter 140.

The SNMP processor () is divided into an operation state monitoring unit 121 and a trap parsing unit 122. The operation state monitoring unit 121 includes IP address information and set community information of each device during a set period T. Connect to the device using Simple Network Management Protocol (SNMP).

After that, the operation status monitoring unit 121 reads ifOperStatus (SNMP OID (Object ID) value: 1.3.6.1.2.1.2.2.1.8) to determine whether the port of each device is up / down. Information is collected and sent to the primary filter 140.

The trap parsing unit 122 parses the information according to the definition of the type registered for use in the network management system among the plurality of trap information collected by the network equipment, converts the information into a format used by the network management system, and generates an event. The event information is transmitted to the primary filter 140.

The SYSLOG processor 130 changes the remote log information transmitted from the device to a setting value of the log server daemon of the local gateway device 100 and stores the data in a specific file format, and then parses the remote log information stored in the network. The event is converted into a format used in the equipment and eventized, and the event information is transmitted to the primary filter 140.

The primary filter 140 manages failure profiles of all objects managed by each local gateway device 100 and performs a primary filtering operation.

That is, the primary filter 140 is a trap caused by the down of the network equipment, or by performing a ping test several times to the representative IP of the network equipment, the down of the equipment is detected, or the equipment from the log information of the network equipment that is transmitted remotely If a failure condition due to a physical error is monitored, all ports belonging to the equipment are recognized as down.

Thus, the primary filter 140 groups the port failure events belonging to the failed network equipment and all the failure events belonging to the same period as one group and transmits them to the failure management server 200.

As such, when the primary filter 140 processes failure events within the same period as a single group, the burden of communication and the load on the system between the local gateway device 100 and the failure management server 200 are reduced.

On the other hand, the failure management server 200 secondary filtering failure events transmitted from the local gateway device 100, network equipment and port, link-related failure events to handle the failure alarm, large failure-related failure events of the corresponding failure It tracks the location and handles failures including objects that are correlated with the failed object.

Such a failure management server includes, but is not limited to, a buffer 210, a resource object manager 220, an alarm handler 230, a link failure handler 250, a large failure manager 260, as shown in FIG. 3. Does not.

The buffer 210 stores a failure event transmitted from the local gateway device. In this case, the buffer 210 may make the failure event information into a table of the database 80, may be made using a system memory, or may be stored in a file form. The buffer 210 stores fault event information by utilizing an optimal method in consideration of the operating environment of each system.

The resource object manager manages network devices in the form of physical and logical object tree IDs.

The object tree ID may be classified into an object ID indicating a physical and logical correlation of an object and a hierarchy ID indicating a high level relationship of the object.

4 illustrates a structure of an object tree ID applied to the present invention, and FIGS. 5A to 5H illustrate a process of assigning an object tree ID applied to the present invention.

The resource object manager 220 manages physical or logical objects in a tree form, as shown in FIG. 4, by assigning a unique key value to all objects.

The object ID has a root at the top level and includes a network identification number, a device identification number, a link identification number, a chassis identification number, a module identification number, a card identification number, a port identification number, and a logical port identification number. Are given in turn.

The resource object manager 220 first divides network resources according to various needs such as WLAN, macro service, ntopia, backbone, access system, etc. for each service domain. These network resources are also useful for generating faults, performance and various reports for each service in network management systems.

The network identification number is assigned according to the domain. For example, Nespot is used as 1, Metro Ethernet access service is 2, ntopia service is 3, backbone is 4, access network is 5, and so on. (FIG. 5A)

The identification number of the equipment is assigned 2, and the unique ID of the equipment is generated as a unique object ID by attaching the regional headquarters and the local number, and the type and serial number of the equipment (FIG. 5B).

In other words, the equipment identification number is domain (1 digit) + object identifier (1 digit) + regional headquarters (2 digits) + local number (3 digits) + equipment type (2 digits) + serial number (3 digits). For example, 4.2 4243512005 .

Since the link is a logical object and belongs to each device, but has no meaning for a single device, the link identification number is defined as a logical object belonging to each device and classified into the same level as the device (FIG. 5C).

For example, the link identification number is assigned 3, and the domain (1 digit) + object identifier (1 digit) + serial number is assigned 8 digits. In one example, the link identification number is given as 4.3 00000032 .

The link is meaningful only when the value of the power port exists, so it contains a combination value of the ports to be power, or stores the value in each table record of the database 80.

Chassis is a physical object belonging to each device, so it is used at the next level of equipment. The chassis identification number is assigned to 4, and the chassis index (chas) value is represented by 2 digits (FIG. 5D). . (Example) 4.24243512005.4 01

A module is a physical object belonging to the chassis, so it is used at the level after the chassis, and the module identification number is assigned to 5 (Fig. 5E). (Example) 4. 24243512005.401.5 02

Since the card is a physical object belonging to the module, it is used at the level after the module, and the card identification number is assigned to 6 (FIG. 5F).

The card identification number is given as module object tree ID + object identifier (1 digit) + index (2 digits), for example 4.24243512005.401.501.6 12 . (Fig. 5g)

The port is a physical object belonging to the device, and the port identification number is assigned to 7, which is assigned to the device object tree ID + object identifier (1 digit) + port type (2 digits) + sequence (4 digits) (FIG. 5H). (Example) 4.24243512005.7 010005

Logical ports are logical objects belonging to each port, so they are used at the level after the port, and the logical port identification number is assigned to eight. At this time, the logical port identification number is given as a port object tree ID + object identifier (1 digit) + ifnumber (5 digits), and the interface number (ifnumber) is expressed together. (Example) 4. 24243512005.7010005.8 00001

Logical ports include sub ports and virtual LANs.

As such, the object ID allows the object of each lower level to be defined including the object ID of the higher level to which it belongs. Therefore, the object ID makes it possible to intuitively know where each object exists in the tree as shown in FIG. 4 and what inclusion relationship it has.

These object IDs alone do not reveal the correlation between devices and ports.

FIG. 6 illustrates a structure of a hierarchy ID applied to the present invention. As shown in FIG. 6, the resource object manager 220 uses a hierarchy ID assigned an ID for each hierarchy for each device. The hierarchy ID is used for correlation between the devices belonging to the link.

In this way, the resource object manager 220 stores the object ID and the hierarchy ID of the equipment to be played in the profile that stores the information of the link, and the primary filter 140 or the secondary filter 240 stores the resource object manager 220. ) Reads the object ID and hierarchy ID from and uses it for filtering.

That is, the primary filter 140 or the secondary filter 240 uses a value such as 4.300000032 (link tree ID) + higher device hierarchy ID + lower device hierarchy ID, and the corresponding link is located at a certain position in the network for all links. Intuitively knows which devices exist and which links link them.

When the primary filter 140 detects a failure of an object ID belonging to a higher level by using the object tree ID of the resource object manager 220, the failure of the lower level is very significant because the failure of the lower level of the corresponding object ID is meaningless. You can filter easily.

When the object filter ID is not used in the primary filter 140, event processing for a port belonging to a device is performed, but it is difficult to determine a correlation between logical ports and a device and a port to which the logical port belongs.

The alarm processor 230 constantly monitors the buffer 210, extracts a fault event, performs alarm processing, and then sends the event to the secondary filter 240.

The alarm to be extracted from the alarm processor 230 is mainly a link, and this link information does not exist in the local gateway device 100 but manages only the failure management server 200.

Therefore, the link failure handler 250 extracts a failure event belonging to the link from the object tree ID of the failure event delivered from the local gateway device 100, and alarms the corresponding link as a failure, and filters the event as a secondary filter 240. To pass).

The reason why the link failure handler 250 immediately alarms the link failure is that failures of each link must be processed quickly.

The secondary filter 240 has a large failure profile information to track the exact location of the failure, the large failure manager 260 performs a failure processing for the large failure through the location of the failure tracked by the secondary filter 240 do.

The network management operator takes priority over other alarms when an alarm processing request for a fault event in a large fault profile occurs.

At this time, the large failure profile has information such as object ID, hierarchy ID, type, occurrence time, and the like.

Here, the type is a method for redundancy of the link in the lower hierarchy direction based on the equipment. In most cases, network operators operate redundant links to the backbone network in order to increase the survivability of the network. Therefore, when a failure occurs on one link, it automatically bypasses the path through another path to prepare for a large failure.

In the absence of link redundancy, all objects with a lower hierarchy ID are treated as a failure. This is a large failure that prevents data from being transferred to other ISPs or foreign lines through all objects in the lower hierarchy, unless there is actually redundancy.

If there is redundancy in the link, if all the upstream ports of the lower devices of the link are down using the object tree ID of the port, all objects in the lower hierarchy are treated as a failure. This is because the Internet automatically bypasses through rerouting when one path is down through routing to prevent the overall network failure.

Therefore, when one of the two redundant links fails, only the corresponding port and link fail. The recovery process of failures is similarly performed in sequence.

Next, the operation of the failure management system in network management according to an embodiment of the present invention will be described in detail with reference to FIG. 7.

7 is a flowchart illustrating a failure management method in network management according to an embodiment of the present invention.

As shown in FIG. 7, when a failure occurs in a network resource, the local gateway device 100 collects a failure event by using the ping tester 110, the SNMP processor 120, and the SYSLOG processor 130 (S1).

The primary filter 140 first filters a failure event using an object tree ID to filter out failure events for all ports belonging to the corresponding device in case of a device failure, and processes events belonging to the same period as a group. , S3)

Failure events not filtered by the primary filter 140 are transmitted to the failure management server 200 and stored in the buffer 210 (S4).

The alarm processor 230 continuously monitors the buffer 210 and reads each fault event to alarm the fault event of the device and the port, and processes it to be utilized in the GUI management apparatus 20 or another system to be interlocked. (S5).

The secondary filter 240 secondaryly filters the failure event to investigate whether the failure event for the corresponding port corresponds to the link (S6), discards the failure event if the failure is not for the link (S7), and If there is a failure, the link failure handler 250 performs an alarm process (S8).

The secondary filter 240 examines whether a failure event is an event affecting a large failure, and in the case of a large failure, the large failure manager 260 uses an object tree ID for all object tree IDs below the current hierarchy ID. The failure is processed and information is transmitted to the GUI management apparatus 20 and other systems. (S9, S10)

The failure processed by the above alarm handles the object in the failure profile and provides information to the GUI management device 20 or the interworking management device 10 for interworking with other systems to propagate the failure situation.

As described above, the embodiment of the present invention uses a mixture of object IDs and hierarchy IDs without using a complex event correlation system in a large IP network to identify an accurate fault location with simple and good performance. It can be used as a countermeasure for large-scale obstacles.

Although the preferred embodiment of the present invention has been described in detail above, the present invention is not limited thereto, and various other changes and modifications are possible.

As described above, the system and method for managing a failure in network management according to the present invention has a correlation between network elements by tracking and managing the location of a failure by using dual filtering and an object tree ID for a network element when a failure occurs in a network resource. Easily identified, accurate and rapid fault handling can be achieved and large faults can be handled without considering the correlation of complex fault events.

In addition, the failure management system and method in the network management according to the present invention has the effect that the network operator can obtain the trust from the subscribers by performing a reliable and rapid failure processing to operate the network stably.

Claims (17)

A local gateway device collecting failure event information from a network device, first filtering the failure event information, and transmitting a single group of failure events within the same period; And Secondary filtering of failure events transmitted from the local gateway device, the network equipment and port, link-related failure events of the failure events to handle the failure alarm, large failure-related failure events to track the location of the failure Fault management server that handles faults including objects that are correlated with originating objects Failure management system in the network management comprising a. The method of claim 1, The regional gateway device, A ping tester for performing a periodic Internet Control Message Protocol (ICMP) ping test to the network equipment and transmitting the test result; An SNMP processor which accesses the network device using a Simple Network Management Protocol (SNMP), periodically collects port status and trap information of each device, and transmits the collection result; A log information processor for transmitting event information obtained by converting the remote log information transmitted from the network equipment into a data form used in the system; And The information transmitted from the ping tester, the SNMP processor, or the log information processor is analyzed and filtered first, and when a failure situation related to the network equipment is detected, a failure event of all ports belonging to the corresponding equipment is grouped into the failure management server. Filter to send to Failure management system in the network management comprising a. The method of claim 2, The SNMP processor, An operation state monitoring unit configured to read an operation state of the network device during a setting period and collect information on whether a port of each network device is up / down; And A trap parsing unit for parsing the trap information transmitted from the network equipment, converting the trap information into a data form used in the system, and transmitting the converted event information to the primary filter. Failure management system in the network management comprising a. The method of claim 1, The failure management server, A resource object manager that manages the network equipment in the form of physical and logical object trees, and manages an object tree ID by assigning an ID to each object; A buffer for storing a failure event transmitted from the local gateway device; An alarm processor that monitors a failure event in the buffer and extracts the failure event for each type of failure; A link failure handler configured to process a failure event belonging to a link among the failure events stored in the buffer as a link failure; A secondary filter that examines whether a large failure of an event transmitted after the alarm processing is performed by the alarm processor or the link failure processor, and tracks the location of the large failure object using the object tree ID of the resource object manager; And Large failure manager that handles large failures for all object tree IDs below the large failure object through the secondary filter Failure management system in the network management comprising a. The method of claim 1, The object tree ID of the resource object manager, And an object ID indicating a physical and logical correlation of the object and a hierarchy ID indicating a high level relationship of the object. The method of claim 5, The object ID is, A failure in network management, which is generated by assigning a network identification number, a device identification number, a link identification number, a chassis identification number, a module identification number, a card identification number, a port identification number, and a logical port identification number. Management system. The method of claim 5, The object ID is a failure management system in the network management, characterized in that the lower level object is defined including the object ID of the higher level to which it belongs. The method according to claim 1 or 4, The primary filter, When detecting a failure of an object tree ID belonging to a specific level by using the object tree ID of the resource object manager, the failure situation of the object tree ID belonging to a lower level of the object tree ID is ignored. Management system. A) collecting fault event information from network equipment and classifying the fault event information according to the type of fault occurrence; B) extracting the fault event information related to the failure of the network equipment and the port in step A) and performing alarm processing; And C) a step of processing a large failure including the objects correlated with the failure object by tracking the location of the failure object for the failure event related to a large failure in step A) Failure management method in the network management comprising a. The method of claim 9, Collecting fault data in the step A), The gateway device for each region periodically monitoring the failure by the network equipment first filters the failure data, and when a failure situation related to the network equipment is detected, a failure group of all ports belonging to the corresponding equipment is transmitted in a single group. To manage faults in network management The method of claim 9, Categorizing the failure event in the step A), In network management, a unique ID is assigned to each entity of the network device to generate a physical and logical object tree ID, and the failure event is analyzed using the object tree ID to identify the type and location of the failure. How to manage faults. The method according to claim 10 or 11, wherein The first step of filtering the fault event, And detecting a failure state of an object tree ID belonging to a lower level of the object tree ID when detecting a failure of an object tree ID belonging to a specific level by using the object tree ID. The method according to claim 9 or 11, In the step C), the step of handling the large fault, a) receiving an event for the alarm processing result of step B) and performing secondary filtering to investigate whether there is a large failure, and tracking the location of the large failure object using the object tree ID; And b) performing a large failure processing on all object tree IDs below the large failure object through the second filtering result of step a). Failure management method in the network management comprising a. The method of claim 11, The object tree ID is, And an object ID indicating a physical and logical correlation of the object and a hierarchy ID indicating a high level relationship of the object. The method of claim 13, The object ID is a failure management method of the network management, characterized in that the lower level object is defined including the object ID of the upper level to which it belongs. The method of claim 13, The object ID is, A failure in network management, which is generated by assigning a network identification number, a device identification number, a link identification number, a chassis identification number, a module identification number, a card identification number, a port identification number, and a logical port identification number. How to manage. The method of claim 16, The object ID is, The network identification number is generated using a unique ID assigned to each service domain, The equipment identification number is generated by attaching the local headquarters and local number, the type of equipment, and the serial number to which the equipment belongs. The link identification number is defined as a logical object belonging to each device, The chassis identification number is defined as a physical object belonging to each device, Define a physical object belonging to each chassis of the module identification number, The card identification number is defined as a physical object belonging to each module, The port identification number is defined as a physical object belonging to the device, And the logical port identification number is defined as a logical object belonging to each port.