RU2777616C2 - System, device and method for compression of alarm log, and data carrier - Google Patents

Abstract

FIELD: communication technology.

SUBSTANCE: method includes stages, at which: a set of statistical data of alarm logs is received and divided into a set of subsets based on a time tag; clustering is processed by types of alarm signals in the set; the set of data of alarm logs to be processed is compressed based on at least one of association rules.

EFFECT: increase in the accuracy of network monitoring due to the reduction in the provided number of alarm logs, obtained by compression and filtration of invalid or excessive logs.

37 cl, 13 dwg

Description

The field of technology to which the invention belongs

The present invention relates to the field of communication technologies and, in particular, to a system, apparatus and method for compressing an alarm log and a storage medium.

State of the art

The communication network includes a large number of network devices. These network devices generate a large number of alarm logs daily. The alarm log is information generated by a network device when a fault occurs. The alarm log typically includes information such as the ID of the network device that generated the alarm log, the type of alarm (used to indicate a failure occurring on the network device), and the time stamp of the alarm log generated. Each network device reports the generated alarm log to the alarm log processing device. The network monitoring engineer analyzes the alarm log on the device to process the alarm log, detects a fault existing in the communication network, and informs the network maintenance engineer for processing.

With the rapid development of communication technologies, the scale of various types of communication networks is now increasing, the structures of communication networks are becoming more complex, the types and number of network devices in communication networks are increasing. A large number of network devices generate massive alarm logs, and most alarm logs are invalid or redundant alarm logs. If all alarm logs generated by network devices are presented to the network monitoring engineer, the analytical workload of the network monitoring engineer will be significant. Therefore, the alarm logs cannot be effectively tracked and analyzed, and the fault existing in the network cannot be detected in a timely manner. Therefore, in order to improve the efficiency of the network monitoring engineer, it is necessary to effectively compress the alarm logs and filter out some invalid or redundant alarm logs to reduce the number of alarm logs presented to the network monitoring engineer.

In related technology, an alarm log compression method is provided, comprising: obtaining alarm log statistics according to an automatic method for obtaining data from a set of frequently used items to set an association rule between different types of alarms; then determining, by a professional technician, the accuracy of the association rule, and determining the major alarm type and minor alarm type in each association rule; and after generating the alarm logs, presenting to the network monitoring engineer, based on a given association rule, an alarm log whose alarm type is the major alarm type, and filtering the alarm log of the minor alarm type to compress the alarm logs . In the same association rule, a fault that occurs on a network device and is indicated by a minor alarm type is caused by a fault that occurs on a network device and is indicated by a major alarm type.

However, in a related technology, in the process of setting an association rule between different types of alarms according to an automatic method for obtaining a set of frequently used items to determine a set of frequently used items, the statistics of the alarm logs must be viewed multiple times. When there is a large amount of alarm log statistics, the acquisition efficiency is relatively low. Additionally, since some types of alarms occur at a relatively low frequency in a real implementation, the degree of support for a set of commonly used elements must be relatively low to complete the establishment of association rules for different types of alarms. A lower degree of support results in more defined sets of frequently used elements and more association rules based on sets of frequently used elements. Thus, the relatively low degree of support results in a large number of association rules obtained through the get operation. Therefore, the time cost is relatively large in the process of determining the accuracy of the association rule and in the process of determining the basic type of alarms in the association rule.

Disclosure of the essence of the invention

Embodiments of the present invention provide an alarm log compression method, system, apparatus, and storage medium to solve the technical problem that, in the related technology, the association rule acquisition efficiency is relatively low and the time cost is relatively high. Technical solutions are as follows.

According to a first aspect, the present disclosure provides an alarm log compression method applied to a compression device, and the method includes:

obtaining a set of alarm log statistics generated by the first network device in the communication network, where the alarm log statistics set includes a plurality of alarm log statistics, and each alarm history log includes an alarm type and generation timestamp;

splitting a set of alarm log statistics into a plurality of subsets of alarm log statistics based on the timestamps of generation of the alarm log statistics in the alarm log statistics set, where all of the alarm log statistics in each subset of statistics the alarm log statistics are sequential in time sequence, and the combined set of the plurality of alarm history subsets includes all of the alarm history statistics in the alarm history history set;

determining a correspondence between an alarm type in the set of alarm log statistics and a plurality of subsets of alarm log statistics;

performing clustering processing on alarm types in the alarm log statistics set based on the match, to generate at least one association rule, receiving each association rule includes a major alarm type and at least one minor alarm type, which associated with each other; and

compressing the plurality of alarm logs to be processed based on at least one association rule to obtain an alarm log whose alarm type is the root cause alarm type.

It should be noted that in the present invention, the set of alarm log statistics is divided into a plurality of subsets of alarm log statistics based on the time stamps of generating the alarm log statistics. Since all alarm log statistics in each alarm log statistics subset are sequential in time sequence, a temporal correlation between alarm types can be obtained based on each alarm log statistics subset to obtain an association rule. In the data acquisition process, it is only necessary to look at the alarm types in the set of alarm log statistics subsets obtained by splitting based on the generation time stamp, then the correspondence between each alarm type and the set of alarm log statistics subsets is determined, and clustering processing may be performed for the type of alarms based on the match to generate an association rule. Compared with the related technology, the present invention does not require multiple viewing of alarm log statistics, and the efficiency of obtaining an association rule is improved. Further, in the present invention, the number of association rules derived from the temporal correlation between alarm types is much smaller than the number of association rules derived from the set of frequently used elements in the related technology. Therefore, the time spent in the process of determining the accuracy of the association rule and in the process of determining the basic type of alarms in the association rule is reduced.

Alternatively, determining the correspondence between an alarm type in a set of alarm log statistics and a plurality of subsets of alarm log statistics includes:

obtaining all alarm types in the set of alarm log statistics to obtain the first set of alarm types; and determining a time sequence vector of each alarm type in the first set of alarm types, where each time sequence vector is used to reflect the correspondence between the corresponding alarm type and a plurality of alarm log statistics subsets, where for the time sequence vector corresponding to each alarm type signals, the values in the time sequence vector are in a one-to-one correspondence with a plurality of alarm log statistics subsets, the values in the time sequence vector include at least one of a first value and a second value, with the first value being used to indicate that the alarm type is in the corresponding alarm log statistics subset, the second value is used to indicate that the alarm type is not present is not present in the corresponding alarm log statistics subset, and the first value is different from the second value.

The definition of the time sequence vector for each alarm type in the first set of alarm types includes:

performing a time sequence vector determination procedure for each alarm type in the first alarm type set.

The procedure for determining the time sequence vector includes:

successively determining the presence of an alarm type in a plurality of subsets of alarm log statistics; and

determining a time sequence vector of the alarm type based on the detection result.

Accordingly, performing the alarm type clustering processing on the alarm log statistics set based on the match to generate at least one association rule includes:

performing clustering processing on all alarm types in the first alarm type set based on the time sequence vectors of all alarm types to generate at least one association rule.

It should be noted that a time window is obtained by dividing, and an alarm type time sequence vector is set to determine the correspondence between each alarm type and a plurality of alarm log statistics subsets. The method is simple and effective.

The first method for performing clustering processing on all alarm types in the first alarm type set based on the time sequence vectors of all alarm types to generate at least one association rule includes:

performing a clustering operation on the first set of alarm types, wherein the clustering operation includes:

setting a target alarm type set and a second alarm type set, where both the target alarm type set and the second alarm type set are empty sets;

adding any alarm type in the first alarm type set to the target alarm type set and deleting from the first alarm type set the alarm type added to the target alarm type set;

repeating the determination procedure until the first alarm type set is an empty set, and determining the target alarm type set as an association rule; and

after repeatedly executing the determination procedure when the second set of alarm types is not empty, repeatedly performing a clustering operation using the second set of alarm types as a new first set of alarm types; or

after repeatedly executing the determination procedure when the second set of alarm types is empty, terminating the execution of the clustering operation.

The determination procedure includes:

calculating the correlation between the alarm type to be processed and the target alarm type set, based on the time sequence vector of the alarm type to be processed and the time sequence vectors of all alarm types in the target alarm type set, where the alarm type to be processed is alarm is any alarm type in the first alarm type set other than the alarm types in the target alarm type set; and

when the correlation exceeds a predetermined correlation threshold, adding an alarm type to be processed to the target alarm type set to obtain an updated target alarm type set, and deleting the alarm type to be processed from the first alarm type set; or

when the correlation does not exceed the predetermined correlation threshold, adding the type of alarms to be processed to the second set of alarm types, and deleting the type of alarms to be processed from the first set of alarm types.

A second method for performing clustering processing on all alarm types in the first alarm type set based on the time sequence vectors of all alarm types to generate at least one association rule includes:

marking a target alarm type in the first alarm type set, where the target alarm type is any alarm type in the first alarm type set; and

performing a clustering operation on the first set of alarm types, wherein the clustering operation includes:

executing the determination procedure repeatedly until all alarm types in the first set of alarm types have been viewed; and

after repeating the determination procedure, if there is an alarm type that is not checked in the first set of alarm types, defining any alarm type that is not checked at all as a new target alarm type, marking the new target alarm type and repeatedly performing the clustering operation, with different target types of alarms having different marks; or

after repeatedly executing the determination procedure, in the absence of an alarm type that is not checked in the first set of alarm types, terminating the clustering operation and generating at least one association rule based on the first set of alarm types, where the same mark is set for all alarm types in each association rule.

The determination procedure includes:

determining, as the target alarm type set, a set including all alarm types in the first alarm type set that have the same mark as the target alarm type;

calculating the correlation between the alarm type to be processed and the target alarm type set based on the time sequence vector of the alarm type to be processed and the time sequence vectors of all alarm types in the target alarm type set, where the alarm type, to be processed is any alarm type in the first alarm type set other than the alarm types in the target alarm type set; and

a flag of the type of alarms to be processed when the correlation is greater than a predetermined correlation threshold, where the flag of the type of alarms to be processed is the same as the flag of the target alarm type.

Alternatively, calculating the correlation between the alarm type to be handled and the target alarm type set, based on the time sequence vector of the alarm type to be processed and the time sequence vectors of all alarm types in the target alarm type set signals include:

calculating the correlation between the alarm type to be handled and each alarm type in the target alarm type set according to the Pearson correlation coefficient formula, where the Pearson correlation coefficient formula is:

, где

, where

представляет корреляцию между типом

аварийного сигнала и типом

аварийного сигнала,

представляет ковариацию между

и

,

представляет стандартное отклонение

,

представляет стандартное отклонение

,

представляет вектор временной последовательности типа

аварийного сигнала и

представляет вектор временной последовательности типа

аварийного сигнала; и

represents the correlation between the type

alarm and type

alarm,

represents the covariance between

and

,

represents the standard deviation

,

represents the standard deviation

,

represents a time sequence vector of type

alarm and

represents a time sequence vector of type

emergency signal; and

calculating the correlation between the alarm type to be handled and the target alarm type set based on the correlation between the alarm type to be processed and each alarm type in the target alarm type set according to the average correlation calculation formula, where the formula is mean correlation calculations:

, где

, where

указывает корреляцию между типом

аварийного сигнала и целевым набором R типов аварийных сигналов, и

указывает количество типов аварийных сигналов в целевом наборе R типов аварийных сигналов.

indicates the correlation between the type

alarm and the target set R of alarm types, and

indicates the number of alarm types in the target set R of alarm types.

Alternatively, obtaining a set of alarm log statistics generated by the first network device in the communication network includes:

pre-processing the statistics of the alarm log generated by the first network device in the first predetermined time period to remove redundant information from the statistics of each alarm log to obtain a set of statistics of the alarm logs.

Alternatively, the statistics of each alarm log is represented in the format of two (M, t) tuples, M represents the alarm log information, t represents the generation timestamp, and the alarm log information includes at least an alarm type field; and a first network device identifier field.

Alternatively, the alarm log statistics in the alarm log statistics set have a time variance relationship, and splitting the alarm log statistics set into a plurality of alarm log statistics subsets based on the timestamps of the generation of the alarm log statistics of alarms in the alarm log statistics set using the sliding window method includes:

obtaining a set of alarm log statistics generation timestamps in the alarm log statistics set; and

classifying the alarm log statistics into a plurality of subsets of the alarm log statistics based on a set of generation timestamps, a predetermined time window length, and a sliding window step using a sliding window method where the sliding window step does not exceed the time window length.

In addition, the method further includes:

obtaining a set of alarm logs to be processed generated by a second network device in the communication network in a second predetermined time period, where the set of alarm logs to be processed includes a plurality of alarm logs to be processed, and each alarm log to be be processed, includes the type of alarm and the timestamp of the generation; and

generating at least one alarm event based on the set of alarm logs to be processed, where each alarm event is used to indicate alarm logs of the same alarm type that are generated by the second network device.

It should be noted that when the alarm event is recovered, statistics of the alarm log information can be obtained at the level of detail of the alarm event, thereby improving the accuracy and reliability of the alarm log information obtained by collecting the statistics.

Alternatively, generating at least one alarm event based on the set of alarm logs to be processed includes:

for each type of alarms in the set of alarm logs to be processed, obtaining a target alarm log that is in the set of alarm logs to be processed and which belongs to the alarm type; separately calculating an occurrence time interval between each two target alarm logs in the set of alarm logs to be processed that are adjacent in time sequence; and restoring into one alarm event based on the time interval of occurrence between each two target alarm logs, the target alarm logs in the set of alarm logs to be processed that belong to the same alarm event.

Alternatively, restoring into a single alarm event, based on the time interval of occurrence between every two target alarm logs, the target alarm logs in the set of alarm logs to be processed that belong to the same alarm event, includes into yourself:

calculating an estimated time interval between two target alarm logs using an exponential moving average method, where the two target alarm logs are any two target alarm logs that are adjacent in time sequence, the two target alarm logs include in a first alarm log and a second alarm log itself, and the first alarm log is generated before the second alarm log;

determining whether a time interval of occurrence between the two target alarm logs and the estimated time interval satisfies a predetermined condition; and

when the occurrence time interval between the two target alarm logs and the estimated time interval satisfies the predetermined condition, determining that the second alarm log belongs to the alarm event to which the first alarm log belongs, and aggregating the second alarm log into an alarm event which owns the first alarm log; or

when the occurrence time interval between the two target alarm logs and the estimated time interval does not satisfy the predetermined condition, determining that the second alarm log does not belong to the alarm event to which the first alarm log belongs.

, оценочный временной интервал

составляет

, и заданное условие составляет

, гдеAlternatively, the time interval between two target alarm logs is

, estimated time interval

is

, and the given condition is

, where

является меткой времени генерирования второго журнала регистрации аварийных сигналов,

является меткой времени генерирования первого журнала регистрации аварийных сигналов,

, k является целым числом больше 1 и

является положительным числом.

is the timestamp when the second alarm log was generated,

is the timestamp of the generation of the first alarm log,

, k is an integer greater than 1 and

is a positive number.

It should be noted that before determining whether the time interval of occurrence between the two target alarm logs and the estimated time interval satisfies a predetermined condition, the method further includes:

when the occurrence time interval between the two target alarm logs is less than or equal to the predetermined minimum time interval threshold, determining that the second alarm log belongs to the alarm event to which the first alarm log belongs; or

when the time interval of occurrence between the two target alarm logs exceeds the predetermined maximum time interval threshold, determining that the second alarm log does not belong to the alarm event that the first alarm log belongs to, where

,

является минимальным пороговым значением временного интервала, и

является максимальным пороговым значением временного интервала.

,

is the minimum time interval threshold, and

is the maximum time interval threshold.

In addition, after determining that the second alarm log does not belong to the alarm event that owns the first alarm log, the method further includes:

completing the recovery of the alarm event to which the first alarm log belongs, and initializing a new alarm event; and

aggregating the second alarm log into a new alarm event.

Optionally, the alarm event includes an alarm type and at least one of an occurrence start time, an occurrence end time, an average time interval of occurrence, and the number of times the alarm log occurred in the alarm event.

Compressing a plurality of alarm logs to be processed based on at least one association rule to obtain an alarm log whose alarm type is a root cause alarm type includes:

compressing at least one alarm event based on at least one association rule to obtain at least one target alarm event, where each target alarm event is used to specify an alarm log whose alarm type is the alarm type main the reasons.

Accordingly, after compressing at least one alarm event to obtain at least one target alarm event, the method further includes:

outputting at least one alarm target event for displaying at least one alarm target event to a network monitoring engineer.

According to a second aspect, the present disclosure provides an alarm log compression apparatus applied to the compression apparatus, and the apparatus includes:

a first obtaining module, configured to obtain a set of alarm log statistics generated by a first network device in the communication network, where the set of alarm log statistics includes a plurality of alarm log statistics, and each alarm history log includes alarm type and generation time stamp;

a partitioning module, configured to divide the set of alarm log statistics into a plurality of subsets of alarm log statistics based on the time stamps of generating the alarm log statistics in the set of alarm log statistics, where all the alarm log statistics the alarms in each alarm log statistics subset are consecutive in time sequence, and the combined set of the plurality of alarm log statistics subsets includes all of the alarm log statistics in the alarm log statistics set;

a determining module, configured to determine a correspondence between an alarm type in the set of alarm log statistics and a plurality of subsets of alarm log statistics;

a clustering module, configured to perform clustering processing on alarm types in the alarm log statistics set based on a match, to generate at least one association rule, where each association rule includes a main alarm type and, by at least one minor type of alarms that are associated with each other; and

a compressor configured to compress a plurality of alarm logs to be processed based on at least one association rule to obtain an alarm log whose alarm type is a root cause alarm type.

Alternatively, the definition module includes:

an acquisition sub-module configured to acquire all types of alarms in the set of alarm log statistics to obtain a first set of alarm types; and

a determination sub-module configured to determine a time sequence vector of each alarm type in the first set of alarm types, where each time sequence vector is used to reflect the correspondence between the corresponding alarm type and a plurality of alarm log statistics subsets.

For the time sequence vector corresponding to each alarm type, the values in the time sequence vector are in a one-to-one correspondence with a plurality of alarm log statistics subsets, the values in the time sequence vector include at least one of the first value and second value, the first value is used to indicate that the alarm type is present in the corresponding alarm log statistics subset, the second value is used to indicate that the alarm type is not present in the corresponding alarm log statistics subset, and the first value is different from second meaning.

Alternatively, the determination submodule is configured to:

perform the time sequence vector determination procedure for each alarm type in the first set of alarm types.

The procedure for determining the time sequence vector includes:

sequentially determining the presence of an alarm type in a plurality of subsets of alarm log statistics; and

determining a time sequence vector of the alarm type based on the detection result.

Alternatively, the clustering module is configured to:

perform clustering processing on all alarm types in the first alarm type set based on the time sequence vectors of all alarm types to generate at least one association rule.

Alternatively, the clustering module is further configured to:

perform a clustering operation on the first set of alarm types, wherein the clustering operation includes:

setting a target alarm type set and a second alarm type set, where both the target alarm type set and the second alarm type set are empty sets;

adding any alarm type in the first alarm type set to the target alarm type set and deleting from the first alarm type set the signal type added to the target alarm type set;

repeatedly executing the determination procedure until the first alarm type set is empty, and determining the target alarm type set as an association rule; and

after repeatedly executing the determination procedure when the second set of alarm types is not empty, repeatedly performing a clustering operation using the second set of alarm types as a new first set of alarm types; or

after repeatedly executing the determination procedure when the second set of alarm types is an empty set, terminating the execution of the clustering operation.

The determination procedure includes:

calculating the correlation between the alarm type to be processed and the target alarm type set, based on the time sequence vector of the alarm type to be processed and the time sequence vectors of all alarm types in the target alarm type set, where the alarm type to be processed is alarm type is any alarm type in the first alarm type set other than the alarm types in the target alarm type set; and

when the correlation exceeds a predetermined correlation threshold, adding an alarm type to be processed to the target alarm type set to obtain an updated target alarm type set, and deleting the alarm type to be processed from the first alarm type set; or

when the correlation does not exceed the predetermined correlation threshold, adding the type of alarms to be processed to the second set of alarm types, and deleting the type of alarms to be processed from the first set of alarm types.

Alternatively, the clustering module is further configured to:

mark the target alarm type in the first alarm type set, where the target alarm type is any alarm type in the first alarm type set; and

perform a clustering operation on the first set of alarm types, wherein the clustering operation includes:

executing the determination procedure repeatedly until all alarm types in the first set of alarm types have been viewed; and

after performing the determination procedure repeatedly, if there is an alarm type that is not checked in the first set of alarm types, define as the new target alarm type any unchecked alarm type as the new target alarm type, and repeatedly perform the clustering operation, while different target types of alarms have different marks; or

after repeatedly executing the determination procedure, in the absence of an alarm type that is not checked in the first set of alarm types, terminate the clustering operation and generate at least one association rule based on the first set of alarm types, where one and the same the same checkbox is set for all types of alarms in each association rule.

The determination procedure includes:

determining, as the target alarm type set, a set including all alarm types in the first alarm type set that have the same mark as the target alarm type;

calculating the correlation between the type of alarms to be processed and the set of target alarm types, based on the time sequence vector of the alarm type to be processed and the time sequence vectors of all alarm types in the target alarm type set, where the alarm type, to be processed is any alarm type in the first alarm type set other than the alarm types in the target alarm type set; and

the flag of the type of alarms to be processed when the correlation is greater than the predetermined correlation threshold, where the flag of the type of alarms to be processed is the same as the flag of the target alarm type.

Alternatively, the clustering module is further configured to:

calculate the correlation between the alarm type to be handled and each alarm type in the set of target alarm types according to the Pearson correlation coefficient formula, where the Pearson correlation coefficient formula is:

, где

, where

представляет корреляцию между типом

аварийного сигнала и типом

аварийного сигнала,

представляет ковариацию между

и

,

представляет стандартное отклонение

,

представляет стандартное отклонение

,

представляет вектор временной последовательности типа

аварийного сигнала и

представляет вектор временной последовательности типа

аварийного сигнала; и

represents the correlation between the type

alarm and type

alarm,

represents the covariance between

and

,

represents the standard deviation

,

represents the standard deviation

,

represents a time sequence vector of type

alarm and

represents a time sequence vector of type

emergency signal; and

calculate the correlation between the type of alarms to be processed and the set of target alarm types based on the correlation between the type of alarms to be processed and each alarm type in the set of target alarm types according to the average correlation calculation formula, where the formula is average correlation calculations:

, где

, where

указывает корреляцию между типом

аварийного сигнала и целевым набором R типов аварийных сигналов, и

указывает количество типов аварийных сигналов в наборе R целевого типа аварийных сигналов.

indicates the correlation between the type

alarm and the target set R of alarm types, and

specifies the number of alarm types in set R of the target alarm type.

Alternatively, the first acquisition module is configured to:

preprocessing the statistics of the alarm log generated by the first network device in the first predetermined time period to remove redundant information from the statistics of each alarm log to obtain a set of statistics of the alarm logs.

Alternatively, the statistics of each alarm log is in the format of two (M, t) tuples, M represents the alarm log information, t represents the generation time stamp, and the alarm log information includes at least an alarm type field; and an alarm network device ID field.

Alternatively, the alarm log statistics in the alarm log statistics set have a partial temporal order relationship, and the partitioning submodule is configured to:

obtain a set of alarm log statistics generation time stamps in the alarm log statistics set; and

classifying the alarm log statistics into a plurality of subsets of the alarm log statistics based on the set of generation timestamps, a predetermined time window length, and a sliding window step, where the sliding window step does not exceed the time window length.

Alternatively, the device further includes:

a second obtaining module configured to obtain a set of alarm logs to be processed generated by a second network device in the communication network in a second predetermined time period, where the set of alarm logs to be processed includes a plurality of alarm logs to be processed and each log the alarm log to be processed includes the type of alarm and the timestamp of the generation; and

a generating module configured to generate at least one alarm event based on the set of alarm logs to be processed, where each alarm event is used to indicate alarm logs of the same alarm type that are generated second network device.

Alternatively, the generation module includes:

a recovery sub-module configured to perform an alarm event recovery procedure for each set of alarm logs to be processed, wherein the alarm event recovery process includes:

a receiving unit configured to: for each type of alarms in the alarm log set to be processed, obtain the target alarm log that is in the alarm log set to be processed and which belongs to the alarm type ;

a calculation unit configured to separately calculate an occurrence time interval between each two target alarm logs in the set of alarm logs to be processed that are contiguous in time sequence; and

a recovery unit configured to recover into one alarm event based on the time interval of occurrence between each two target alarm logs, the target alarm logs in the set of alarm logs to be processed that belong to the same event alarms.

Alternatively, the recovery unit is configured to:

compute an estimated time interval between two target alarm logs using an exponential moving average method, where the two target alarm logs are any two target alarm logs that are adjacent in time sequence, the two target alarm logs include a first alarm log and a second alarm log, and the first alarm log is generated before the second alarm log;

determine whether a time interval of occurrence between the two target alarm logs and the estimated time interval satisfies a predetermined condition; and

when the occurrence time interval between the two target alarm logs and the estimated time interval satisfies the predetermined condition, determine that the second alarm log belongs to the alarm event to which the first alarm log belongs, and aggregate the second alarm log into an alarm event which owns the first alarm log; or

when the occurrence time interval between the two target alarm logs and the estimated time interval does not satisfy the predetermined condition, determine that the second alarm log does not belong to the alarm event to which the first alarm log belongs.

времени возникновения между двумя целевыми журналами регистрации аварийных сигналов составляет

, оценочный интервал

времени составляет

, и заданное условие равно

, гдеAlternatively, interval

time of occurrence between two target alarm logs is

, estimated interval

time is

, and the given condition is equal to

, where

является отметкой времени генерирования второго журнала регистрации аварийных сигналов,

является отметкой времени генерирования первого журнала регистрации аварийных сигналов,

, k является целым числом больше 1 и

является положительным числом.

is the time stamp of the generation of the second alarm log,

is the timestamp of the generation of the first alarm log,

, k is an integer greater than 1 and

is a positive number.

Alternatively, the recovery unit is further configured to:

when the occurrence time interval between the two target alarm logs is less than or equal to the predetermined minimum time interval threshold value, determining that the second alarm log belongs to the alarm event to which the first alarm log belongs; or

when the time interval of occurrence between two target alarm logs exceeds the specified maximum time interval threshold, determine that the second alarm log does not belong to the alarm event that the first alarm log belongs to, where

,

является минимальной пороговой величиной временного интервала, и

является максимальной пороговой величиной временного интервала.

,

is the minimum time interval threshold, and

is the maximum time interval threshold.

Alternatively, the recovery unit is further configured to:

finish restoring the alarm event to which the first alarm log belongs, and initialize a new alarm event; and

aggregate the second alarm log into a new alarm event.

Optionally, the alarm event includes an alarm type and at least one of an occurrence start time, an occurrence end time, an average occurrence time interval, and the number of times the alarm log occurred in the alarm event.

Alternatively, the compression module is configured to:

compress at least one alarm event based on at least one association rule to obtain at least one alarm target event, where each alarm target event is used to specify an alarm log whose alarm type is is the root cause alarm type.

Alternatively, the device further includes:

an output module configured to output the at least one alarm target event for displaying the at least one alarm target event to a network monitoring engineer.

Alternatively, the second network device and the first network device are the same network device; or the second network device and the first network device are different network devices of the same type.

According to a third aspect, the present invention provides an alarm log compression system, where the system includes a compressor, and the compressor includes an apparatus according to the second aspect; and

the compressing device is configured to compress a plurality of alarm logs generated by at least one network device in the communication network.

Alternatively, the compressor is further configured to display alarm information obtained after compression of the plurality of alarm logs.

Alternatively, the system further includes a network manager;

the compressing device is further configured to output, to the network management device, alarm information obtained after compressing the plurality of alarm logs; and

the network manager is configured to display alarm information.

Alternatively, the alarm information is displayed as a graph.

According to a fourth aspect, the present disclosure provides an alarm log compression apparatus, in which the apparatus includes a memory, a processor, and a computer program stored in the memory that can be executed on the processor, and when the processor executes the computer program, an alarm log compression method is implemented. signals according to the first aspect.

According to a fifth aspect, the present disclosure provides a computer-readable storage medium, where the computer-readable storage medium stores an instruction, and when the instruction is executed by the processor, the alarm log compression method according to the first aspect is implemented.

Beneficial effects obtained from the technical solutions presented in the embodiments of the present invention include at least the following:

Finally, according to the alarm log compression method, apparatus and system, and storage medium provided in the embodiments of the present invention, an association rule is obtained based on a temporal correlation between alarm types. In the data acquisition process, it is only necessary to look at the alarm types in the set of alarm log statistics subsets obtained by splitting based on the generation timestamp, and then determine the correspondence between each alarm type and the set of alarm log statistics subsets, for example, after determining the time sequence vector of each alarm type, clustering processing for the alarm type based on the match may be performed to generate an association rule. Compared with the related technology, the present invention does not require multiple viewing of alarm log statistics, and the efficiency of obtaining an association rule is improved. Further, in the present invention, the number of association rules derived from the temporal correlation between alarm types is much smaller than the number of association rules derived from the set of commonly used elements in the related technology. Therefore, the time spent in the process of determining the accuracy of the association rule and the process of determining the main type of alarms in the association rule is reduced. Additionally, the alarm event is recovered based on the time interval of the alarm log occurrence, and finally the target alarm event used to specify the alarm log whose alarm type is the root cause alarm type is displayed to the network monitoring engineer. This greatly reduces the amount of alarm log information provided to the network monitoring engineer and ensures the accuracy and reliability of the information.

Brief description of the drawings

1 is a diagram of an alarm log compression system according to an embodiment of the present invention;

2 is a flowchart of a method for compressing an alarm log according to an embodiment of the present invention;

3 is a diagram of dividing a set of alarm log statistics into a plurality of subsets of alarm log statistics according to an embodiment of the present invention;

4 is a flowchart of another alarm log compression method according to an embodiment of the present invention;

Fig. 5A is a flowchart of an alarm event recovery method according to an embodiment of the present invention;

5B is an alarm target event interface diagram according to an embodiment of the present invention;

6 is a flowchart of yet another alarm log compression method according to an embodiment of the present invention;

Fig. 7A is a diagram of an alarm log compressor according to an embodiment of the present invention;

Fig. 7B is a diagram of a determination module according to an embodiment of the present invention;

FIG. 7C is a diagram of another alarm log compressor according to an embodiment of the present invention;

Fig.7D is a diagram of a generating unit according to an embodiment of the present invention;

7E is a diagram of another alarm log compressor according to an embodiment of the present invention; and

8 is an object diagram of an alarm log compressor according to an embodiment of the present invention.

Implementation of the invention

For the purpose of explaining in detail the objectives, technical solutions and advantages of the present invention, implementations of the present invention are described in detail below with reference to the accompanying drawings.

In related technology, in order to reduce the number of alarm logs presented to a network monitoring engineer, three methods of compressing alarm logs are provided, which respectively include the following: first, when the number of alarm logs generated by a network device in a given exceeds the set threshold value, it is determined that a significant increase in the number of alarms occurs during this period of time, and the alarm log processing device directly discards the alarm log generated after the number of alarm logs generated by the network device reaches a predetermined threshold. Secondly, the alarm logs of the same type that are generated in a given period of time are summed and counted, and the information obtained after collecting the statistics is presented to the network monitoring engineer. For example, alarm logs generated within 12 hours are summarized and counted, statistics are collected on information such as the number of occurrences of alarm logs of the same type and the average interval of occurrence, and information such as the number of occurrences of alarm logs of alarms corresponding to each alarm type and generated within 12 hours and the average interval of occurrence, is provided to the network monitoring engineer. Third, alarm log statistics are obtained in advance according to a method of automatically obtaining frequently used items to establish an association rule between different types of alarms, then an alarm log whose type is the root cause alarm type is provided to the network monitoring engineer. based on a predetermined association rule, and the alarm log of the minor alarm type is filtered to compress the alarm logs.

However, in the first method, only the number of alarm logs is reduced, and the discarded alarm log may include valid alarm information. Therefore, the actual alarm information is lost. Additionally, the alarm information presented to the network monitoring engineer still includes a large number of redundant alarm logs, and the reliability of alarm log compression is relatively low. In the second method, multiple independent alarm events can occur (each alarm event includes multiple alarm logs of the same alarm type whose time interval is less than a predetermined time threshold) in a given time period, and when the alarm logs alarms of the same type that are generated in a given period of time are summed and counted, information about each alarm event cannot be obtained. Consequently, the information provided to the network monitoring engineer is distorted. In the third method, the time spent on the process of determining the accuracy of the association rule and the process of determining the main type of alarms in the association rule is relatively large.

An embodiment of the present invention provides an alarm log compression system to solve a technical problem in related technology. As shown in FIG. 1, the alarm log compression system includes a compressor 01. The compressor 01 is configured to compress a plurality of alarm logs generated by at least one network device in a communication network.

The compressor 01 may be a single server, a server cluster including multiple servers, or a cloud computing service center. The at least one network device may include a router, a switch, a security system, a load balancer, an access gateway device, and the like. This is not limited in the present invention. The compressor 01 establishes a connection with at least one network device using a wireless or wired network, and all alarm logs generated by at least one network device in the workflow are transferred to the compressor 01.

Alternatively, as shown in FIG. 1, the alarm log compression system may further include a network management device 02. The network manager 02 establishes a connection with the compressor 01 using a wireless or wired network. The compressor 01 is further configured to output to the network manager 02 alarm information obtained by compressing a plurality of alarm logs generated by the at least one network device. The network control device 02 is configured to display alarm information, so that a network monitoring engineer views the alarm information. In addition, the network manager 02 may be further configured to: generate an appropriate alarm reset table after the network monitoring engineer determines the actual alarm information, where the alarm reset table includes a correspondence between the alarm information and the maintenance engineer network, and alarm information feedback to the appropriate network maintenance engineer to service the corresponding network device. The network management device 02 may be a single server, a server cluster including multiple servers, or a cloud computing service center.

In actual use, the compressor 01 and the network manager 02 may be devices independent of each other, or the network manager 02 may be integrated into the compressor 01. In this case, the compressor 01 may be further configured to display alarm information obtained after compression of a plurality of alarm logs generated by at least one network device.

According to the alarm log compression methods provided in the embodiments of the present invention, the main alarm type alarm log can be displayed to the network monitoring engineer, and the alarm event can be further recovered to display the main alarm type alarm event to the monitoring engineer. networks. Fig. 2, Fig. 4 and Fig. 6 are used as examples for description in embodiments of the present invention. In the alarm log compression method shown in FIG. 2, after determining the association rule between alarm types in the association rule acquisition method, the alarm log is compressed based on the association rule, and finally the alarm log of the main alarm type is displayed. network monitoring engineer. In the alarm log compression method shown in FIG. 4, the association rule between alarm types is determined by the association rule acquisition method, after the alarm event is recovered by the alarm event recovery method, the alarm event is compressed based on the association rule. and finally, the alarm event of the main alarm type is displayed to the network monitoring engineer. In the alarm log compression method shown in FIG. 6, after the association rule between alarm types is determined in the association rule acquisition method, the alarm log of the minor alarm type in the alarm log to be processed first is filtered based on the association rule, then the alarm event is recovered using the alarm log of the main alarm type in the alarm event recovery method, and finally the alarm event of the main alarm type is displayed to the network monitoring engineer. Compared with the alarm log compression method shown in FIG. 2, in the alarm log compression methods shown in FIG. 4 and FIG. 6, the alarm logs are counted at the alarm event detail level to further reduce information related to the alarm log displayed to the network monitoring engineer. In a real implementation, after an alarm event is recovered by the alarm event recovery method of the present invention, all alarm events are directly displayed to the network monitoring engineer. Details are not described in this document. The following describes methods for compressing the alarm log using FIG. 2, FIG. 4, and FIG. 6 as examples.

2 is a flowchart of a method for compressing an alarm log according to an embodiment of the present invention. The method is applied to a compression device. The compression device may be the compression device 01 shown in FIG. As shown in figure 2, the method may include the following steps.

Step 201: Obtain an alarm log history set generated by the first network device in the communication network, where the alarm history history set includes a plurality of alarm history statistics, and each alarm history log includes type of alarms and timestamp of generation.

The communication network includes at least one network device, and the first network device may be any network device in the communication network. In an actual implementation, the compressor may receive a plurality of alarm log statistics generated by a plurality of network devices in a communication network, and separately perform the following steps 202 to 204 for each alarm log statistics. Each network device has one set of alarm log statistics. This is not limited to this embodiment of the present invention.

Alternatively, a method for obtaining a set of alarm log statistics generated by each network device in a communication network may include:

preprocessing the alarm log statistics generated by the first network device in the first predetermined time period to remove redundant information from each alarm log history to obtain a set of alarm log statistics corresponding to each network device.

It should be noted that the original alarm log generated by the network device typically contains the type of alarm, the timestamp of generation, the Identifier (ID) of the alarm network device, and some redundant information. The alarm log statistics generated by the network device are pre-processed so that each alarm log statistics only includes the alarm type, generation time stamp, and alarm network device ID to facilitate subsequent processing of the alarm log statistics . Consequently, operating costs are reduced and work efficiency is improved.

Alternatively, each alarm log statistics may be represented in the format of 2 tuples (M, t), M represents alarm log information, t represents a generation time stamp, and alarm log information includes, at least an alarm type field and a first network device identifier field. For example, it is assumed that the alarm log statistics generated by the first network device can be represented as (dgd437slhw3m: TCP authentication failed, 14:22:08) after preprocessing, where dgd437slhw3m is the ID field of the first network device, TCP authentication failed is the alarm type and 14:22:08 is the timestamp of the generation. This alarm log indicates that at 14:22:08 a "TCP Authentication Failed" occurs on network device ID dgd437slhw3m.

In this embodiment of the present invention, the first predetermined time period is the elapsed time period (namely, the statistical time period). For example, the pre-processing of the statistics of the alarm log generated by the first network device in the first given time period may be the pre-processing of the set of statistics of the alarm log generated by the first network device in the last month.

Step 202: Divide the set of alarm log statistics into a plurality of alarm log statistics subsets based on the alarm log statistics generation timestamps in the alarm log statistics set.

All alarm log statistics in each subset of alarm log statistics are sequential in time sequence. To be specific, each alarm log statistics subset includes a plurality of alarm log statistics generated within a given time period. Further, the combined set of the plurality of alarm log statistics subsets includes all of the alarm log statistics in the alarm log statistics set.

Alternatively, the alarm log statistics in the alarm log statistics set may have a partial temporal order relationship. Specifically, the set of alarm log statistics may be a series of alarm statistics including a series of alarm log statistics that have a partial temporal order relationship. The time range of the alarm statistics sequence may be [T _s , T _e ], where T _s represents the start time of the alarm log statistics sequence, and T _e indicates the end time of the alarm log statistics sequence. The fact that the alarm log statistics in the alarm log set have a partial temporal order relationship means that the generation time of the alarm log statistics that is in the alarm log statistics set and that is after any of the alarm log statistics alarm log, after the time any alarm log statistics are generated, or the time any alarm log statistics are generated.

Accordingly, a method for dividing a set of alarm log statistics into a plurality of subsets of alarm log statistics based on the time stamps of generating the alarm log statistics in the alarm log statistics set may include:

obtaining a set of alarm log statistics generation timestamps in the alarm log statistics set; and classifying the alarm log statistics into a plurality of subsets of the alarm log statistics based on a set of generation timestamps, a predetermined time window length, and a window sliding step using a sliding window technique where the window sliding step does not exceed the time window length.

Alternatively, the alarm log statistics generation time stamp set in the alarm log statistics set is {tk; k is a positive integer}, the time window duration is win and the window sliding step is step. In this case, the alarm log statistics are classified by the start time t ₁ of the alarm statistics set, so that the time window of the first alarm log statistics subset is [t ₁ , win), the time window of the second alarm log statistics subset of alarms is [t ₁ + step, win + step), and by analogy until the time window end time of the last subset of alarm log statistics is greater than or equal to the end time t _n of the alarm log statistics set.

For example, FIG. 3 is a diagram of dividing a set of alarm log statistics into a plurality of subsets of alarm log statistics according to an embodiment of the present invention. As shown in FIG. 3, duration win = 3 time windows, step = 2 window slips, the alarm log statistics generation timestamp set in the alarm log statistics set is {tk; k is a positive integer} and the alarm types are A, B, C, and D. The time windows of the set of alarm log statistics subsets obtained by dividing the set of alarm log statistics sequentially are w1 = {t1, t2, t3}, w2 = {t3, t4, t5}, … and wm = {…, tn}. The set of alarm types corresponding to time window w ₁ is {A, B, C}, the set of alarm types corresponding to time window w ₂ is {C, A, D} and the set of alarm types corresponding to time window w _m , is equal to {D, C, A}.

In a real implementation, after obtaining the set of alarm log statistics generation timestamps in the alarm log statistics set, the set of alarm log statistics can be directly partitioned based on the generation timestamp set. For example, assuming the generation timestamp set includes 12 generation timestamps, the set of alarm log statistics can be divided into four alarm log statistics subsets, each alarm log statistics subset includes alarm logs The alarm statistics corresponding to the three generation timestamps and the three generation timestamps corresponding to each alarm log subset are sequential in time sequence.

Step 203: determine a correspondence between the type of alarm in the set of alarm log statistics and the plurality of subsets of alarm log statistics.

Alternatively, a method for determining a correspondence between an alarm type in a set of alarm log statistics and a plurality of subsets of alarm log statistics includes:

obtaining all types of alarms in the set of statistical data of the alarm logs to obtain the first set of types of alarms; and determining a time sequence vector of each alarm type in the first set of alarm types, where each time sequence vector is used to reflect the correspondence between the corresponding alarm type and a plurality of alarm log statistics subsets, where for the time sequence vector corresponding to each type alarms, the values in the time sequence vector are in a one-to-one correspondence with a plurality of alarm log statistics subsets, the values in the time sequence vector include at least one of a first value and a second value, the first value is used to indicate that the corresponding alarm type is in the corresponding subset of the alarm history log, the second value is used to indicate that the corresponding the alarm type is not in the corresponding alarm history log subset and the first value is different from the second value.

Alternatively, the process of determining the time sequence vector of each alarm type in the first alarm type set may include: performing a time sequence vector determination procedure for each alarm type in the first alarm type set.

The procedure for determining the time sequence vector includes: successively determining the presence of an alarm type in a plurality of alarm log statistics subsets; and determining an alarm type time sequence vector based on the detection result.

For example, with reference to the example, in step 202, all alarm types in the alarm log statistics set are obtained, and the first alarm type set obtained is I = {A, B, C, D}. The first value is assumed to be 1 and the second value is 0. For the set of alarm log statistics subsets resulting from the split shown in FIG. 3, the type A alarm time sequence vector can be represented as v _A = (1 , 1, …, 1), the type B alarm time sequence vector can be represented as v _B = (1, 0,. …, 0), the type C alarm time sequence vector can be represented as v _C = (1, 1, …, 1) and the type D alarm time sequence vector can be represented as v _D = ( 0, 1, …, 1).

Step 204: perform alarm type clustering processing in the alarm log statistics set based on the match to generate at least one association rule, where each association rule includes a main alarm type and at least one minor alarm type that are associated with each other.

In the same association rule, a failure that occurs on a network device and is indicated by a minor alarm type is caused by a failure that occurs on a network device and is indicated by a major alarm type. Alternatively, after determining the time sequence vector of each alarm type in the first alarm type set, clustering processing may be performed for all alarm types based on the time sequence vectors for all alarm types in the first alarm type set to generate at least at least one association rule.

Alternatively, clustering processing may be performed for all types of alarms using a Temporal Correlation Clustering (TCC) clustering algorithm to generate at least one association rule. In this embodiment of the present invention, the following two methods for performing clustering processing for all types of alarms using the TCC algorithm to generate an association rule are used as examples for description. Ways include:

The first way to generate an association rule involves:

performing a clustering operation on the first set of alarm types, wherein the clustering operation includes:

S21a. Set the target alarm type set and the second alarm type set, with both the target alarm type set and the second alarm type set being empty sets.

S22a. Add any alarm type in the first alarm type set to the target alarm type set and remove from the first alarm type set the alarm type added to the target alarm type set.

S23a. Repeat the determination procedure until the first alarm type set is empty and define the target alarm type set as the association rule.

The determination procedure includes:

S231a. Compute the correlation between the alarm type to be handled and the target alarm type set, based on the time sequence vector for the alarm type to be processed and the time sequence vectors of all alarm types in the target alarm type set, where the type to be processed is alarm type is any alarm type in the first alarm type set other than the alarm types in the target alarm type set.

S232a. When the correlation exceeds the specified correlation threshold, add the alarm type to be handled to the target alarm type set to obtain an updated target alarm type set, and remove the alarm type to be handled from the first alarm type set .

S233a. If the correlation does not exceed the predefined correlation threshold, add the type of alarms to be processed to the second set of alarm types and remove the type of alarms to be processed from the first set of alarm types.

S24a. After repeatedly executing the determination procedure when the second set of alarm types is not empty, repeatedly perform the clustering operation using the second set of alarm types as the new first first set of alarm types.

S25a. After repeatedly executing the determination procedure when the second set of alarm types is empty, stop executing the clustering operation.

For example, the clustering operation execution algorithm for the first alarm type set in the above method is as follows:

TCC (I) // I is the set of the first type of alarms

{

аварийных сигналов из IRandomly choose one type

alarms from I

целевого типа аварийных сигналов и набор

второго типа аварийных сигналов.Set set

target alarm type and set

second type of alarms.

аварийных сигналовFor all types

alarms

{

// Пороговое значение является заданным If a

// Threshold is set

correlation threshold

в RAdd

in R

More

в

Add

in

}

// Выполнить рекурсивный вызов, чтобы выполнить операцию кластеризации для оставшегося набора

второго типа аварийных сигналов

// Make a recursive call to perform a clustering operation on the remaining set

second type of alarms

// Возвратить все правила ассоциации, полученные в результате кластеризации, выполненной для первого набора типов аварийных сигналов.return

// Return all association rules resulting from the clustering performed on the first set of alarm types.

}

The second way to generate an association rule includes:

marking a target alarm type in the first alarm type set, where the target alarm type is any alarm type in the first alarm type set; and performing a clustering operation on the first set of alarm types, wherein the clustering operation includes:

S21b. Execute the definition procedure repeatedly until all alarm types in the first set of alarm types have been viewed.

The determination procedure includes:

S211b. Define as the target alarm type set a set that includes all alarm types in the first alarm type set that have the same label as the target alarm type.

S212b. Calculate the correlation between the alarm type to be handled and the target alarm type set, based on the time sequence vector of the alarm type to be processed and the time sequence vectors of all alarm types in the target alarm type set, where the alarm type, to be processed is any alarm type in the first alarm type set other than the alarm types in the target alarm type set.

S213b. Flag the type of alarms to be handled if the correlation is greater than the specified correlation threshold, where the flag of the alarm type to be processed is the same as the flag of the target alarm type.

S22b. After repeating the procedure for determining when there is an unchecked alarm type in the first set of alarm types, define any unchecked alarm type as the new target alarm type, mark the new target alarm type, and repeatedly perform the clustering operation, with different types of target alarms having different marks.

S23b. After executing the determination procedure repeatedly, if there is no alarm type that is not flagged in the first alarm type set, stop executing the clustering operation and generate at least one association rule based on the first alarm type set where the same flag is set for all alarm types in each association rule.

Alternatively, in steps S231a and S212b, calculating the correlation between the type of alarms to be processed and the target set of alarm types based on the time sequence vector of the alarm type to be processed and the time sequence vectors of all alarm types in the set target alarm types includes:

1. Compute the correlation between the alarm type to be handled and each alarm type in the target alarm type set according to the Pearson correlation coefficient formula, where the Pearson correlation coefficient formula is:

, где

, where

представляет корреляцию между типом

аварийного сигнала и типом

аварийного сигнала,

представляет ковариацию между

и

,

представляет стандартное отклонение

,

представляет стандартное отклонение

,

представляет вектор временной последовательности типа

аварийного сигнала и

представляет вектор временной последовательности типа

аварийного сигнала.

represents the correlation between the type

alarm and type

alarm,

represents the covariance between

and

,

represents the standard deviation

,

represents the standard deviation

,

represents a time sequence vector of type

alarm and

represents a time sequence vector of type

alarm.

2. Calculate the correlation between the alarm type to be handled and the target alarm type set based on the correlation between the alarm type to be handled and each alarm type in the target alarm type set according to the average correlation calculation formula , where the formula for calculating the average correlation is:

, где

, where

указывает корреляцию между типом

аварийного сигнала и целевым набором R типов аварийных сигналов, и

указывает количество типов аварийных сигналов в наборе R целевого типа аварийных сигналов.

indicates the correlation between the type

alarm and the target set R of alarm types, and

specifies the number of alarm types in set R of the target alarm type.

For example, in step S23a, when the first alarm type set is the empty set, in other words, after all alarm types in the first alarm type set have been passed, and it is assumed that the target alarm type set is Rk = { i1, i2, ..., ik}, the corresponding association rule includes a set of k elements (namely, Rk), indicating that there is a strong correlation between the alarm logs of the k alarm types in Rk. Each ik element represents one type of alarm.

.It should be noted that the combined set of all association rules obtained by clustering performed on the first alarm type set includes all alarm types in the first alarm type set. For example, all association rules obtained by clustering performed on the first set of alarm types include {R1, ..., Rk}. In this case

.

Step 205: Compress the plurality of alarm logs to be processed based on at least one association rule to obtain an alarm log whose alarm type is the root cause alarm type.

Alternatively, the plurality of alarm logs to be processed may be alarm logs generated by the second network device. The second network device and the first network device may be the same network device, or the second network device and the first network device may be different network devices of the same type. It's not limited. These types are the same, include the same models and/or the same types. For example, both the first network device and the second network device may be security systems, or both the first network device and the second network device may be model A0 security systems.

Alternatively, after at least one association rule has been generated, one skilled in the art may analyze and determine the major alarm type and the minor alarm type in the association rule, or may compute a correlation between any alarm type in the association rule and another type. association rule, define the alarm type with the highest correlation with another alarm type as the primary alarm type, and define an alarm type other than the primary alarm type in the association rule as a minor alarm type. The method for determining the major alarm type and the minor alarm type in the association rule is not limited in this embodiment of the present invention.

For example, the association rule is assumed to be {LinkDown_Active, MSTP_PORT_STATE_FORWARDING, MSTP_PORT_STATE_LEARNING, MSTP_PROPORT_ROLE_CHANGE, MSTP_PORT_STATE_DISCARDING}. After the expert analyzes the association rule, it is found that a port failure (alarm type is LinkDown_Active) causes the Multiple Spanning Tree Protocol (MSTP) module to intermittently shut down frequently. Therefore, it can be determined that LinkDown_Active is the primary alarm type, and the other alarm type in the association rule is an alarm type of the corresponding type (minor alarm type) that occurs at the same time as the primary alarm type. Based on the association rule, only the alarm log with the LinkDown_Active alarm type is compressed, and the alarm log with the minor alarm type is filtered for the alarm logs to be processed.

In a real implementation, since network devices of the same type can compress, using the same association rule, alarm logs generated by network devices in the process of obtaining an association rule, the association rule does not need to be obtained for alarm log statistics generated by each network device, several network devices are selected from a plurality of network devices of the same type, and an association rule is obtained for the statistics of the alarm log generated by the network devices. Therefore, it is possible to reduce the time spent on obtaining the association rule.

Finally, according to the alarm log compression method provided in this embodiment of the present invention, an association rule is obtained based on a temporal correlation between alarm types. In the data acquisition process, it is only necessary to look at the alarm types in the set of alarm log statistics subsets obtained by splitting based on the generation timestamp, and then determine the correspondence between each alarm type and the set of alarm log statistics subsets, for example, after determining the time sequence vector of each alarm type, and clustering processing may be performed on the alarm type based on the match to generate an association rule. Compared with the related technology, the present invention does not require multiple viewing of alarm log statistics, and the efficiency of obtaining association rules is improved. Moreover, in the present invention, the number of association rules derived from the temporal correlation between alarm types is much less than the number of association rules derived from the set of frequently used elements in the related technology. Therefore, the time spent in the process of determining the accuracy of the association rule and in the process of determining the basic type of alarms in the association rule is reduced.

4 is a flowchart of another alarm log compression method according to an embodiment of the present invention. The method is applied to a compression device. The compression device may be the compression device 01 shown in FIG. As shown in figure 4, the method may include the following steps.

Step 401: Obtain an alarm log history set generated by the first network device in the communication network, where the alarm history history set includes a plurality of alarm log statistics, and each alarm log history includes type of alarms and timestamp of generation.

For the implementation process of this step, refer to step 201. Again, details are not described here.

Step 402: Divide the set of alarm log statistics into a plurality of subsets of alarm log statistics based on the alarm log statistics generation timestamps in the alarm log statistics set.

For the implementation process of this step, refer to step 202. Again, details are not described here.

Step 403: determine a correspondence between the alarm type in the set of alarm log statistics and the plurality of alarm log statistics subsets.

For the implementation process of this step, refer to step 203. Again, details are not described here.

Step 404: perform alarm type clustering processing in the alarm log statistics set based on the match to generate at least one association rule, where each association rule includes a main alarm type and at least one minor alarm type that are associated with each other.

For the implementation process of this step, refer to step 204. Again, details are not described here.

Step 405: Obtain an alarm log set to be processed generated by a second network device in the communication network in a second predetermined time period, where the alarm log set to be processed includes a plurality of alarm logs to be processed, and each log to be processed alarms includes the type of alarm and the timestamp when it was generated.

Alternatively, the second network device and the first network device may be the same network device; or the second network device and the first network device may be different network devices of the same type.

The original alarm log generated by the network device typically contains the type of alarm, the timestamp of generation, the identifier (identifier, ID) of the alarm network device, and some redundant information. In this embodiment of the present invention, the received alarm log to be processed can be pre-processed to remove redundant information from the original alarm log to obtain a set of alarm logs to be processed to facilitate subsequent processing of the processed log. alarms. Consequently, operating costs are reduced and work efficiency is improved.

For example, it is contemplated that the alarm logs to be processed generated by the second network device in the second predetermined time period may include: {(TCP authentication failed, 14:22:08), (TCP authentication failed, 14:22:38 ), (TCP authentication failed, 14:23:25), (TCP authentication failed, 21:18:20), (TCP authentication failed, 21:19:18), (TCP authentication failed, 21:19:55)} . These alarm logs to be processed indicate the alarm logs whose alarm types are associated with TCP authentication failure.

In this embodiment of the present invention, the second predetermined time period is the elapsed time period. For example, the pre-processing of the alarm log to be processed generated by each network device in the second predetermined time period may be pre-processing every 12 hours of the alarm log to be processed generated by each network device within 12 hours.

Step 406: Generate at least one alarm event based on the set of alarm logs to be processed, where each alarm event is used to indicate alarm logs of the same type that are generated by the second network device.

Alternatively, a method for generating at least one alarm event based on a set of alarm logs to be processed may include:

for each type of alarms in the set of alarm logs to be processed, obtaining a target alarm log that is in the set of alarm logs to be processed and which belongs to the alarm type; separately calculating an occurrence time interval between each two target alarm logs in the set of alarm logs to be processed that are adjacent in time sequence; and recovering into one alarm event based on the time interval of occurrence between each two target alarm logs, the target alarm logs in the set of alarm logs to be processed that belong to the same alarm event.

Optionally, the alarm event may include an alarm type and at least one of an occurrence start time, an occurrence end time, an average occurrence time interval, and the number of times the alarm log occurred in the alarm event. In a real implementation, the alarm event may further include generation timestamps (including start and end times of occurrence) of all alarm logs. It's not limited.

For example, at block 405, the set of alarm logs to be processed generated by the second network device in the second predetermined time period include two independent events in which TCP authentication fails and which are respectively in two time periods: {14:22 :08-14:23:25} and {21:18:20-21:19:55}. The set of alarm logs to be processed can be recovered into two alarm events: {TCP authentication failed, 14:22:08, 14:22:38, 14:23:25} and {TCP authentication failed, 21:18:20, 21:19:18, 21:19:55}. Each alarm event includes the type of alarms and the timestamp when each alarm log was generated.

и k является положительным целым числом.Alternatively, timestamps for generating alarm logs to be processed, which are generated by the second network device in a second predetermined time period, and which have a partial time order relationship, respectively, t ₀ , t ₁ , ... and t _n , and intervals times of occurrence between the alarm logs to be processed are s ₁ , s ₂ , …, s _i , … and s _n , respectively, where

and k is a positive integer.

Alternatively, as shown in FIG. 5A, a method for recovering alarms into one event based on the time interval of occurrence between every two target alarm logs, the target alarm logs in the set of alarm logs to be processed that belong to one and the same alarm event may include:

Step 4061: calculate an estimated time interval between two target alarm logs using an exponential moving average method, where the two target alarm logs are any two target alarm logs that are adjacent in time sequence, the two target alarm logs signals include a first alarm log and a second alarm log, and the first alarm log is generated before the second alarm log.

времени возникновения между двумя целевыми журналами регистрации аварийных сигналов равен

, оценочный временной интервал

между двумя целевыми журналами регистрации аварийных сигналов, который вычисляется способом экспоненциального скользящего среднего (Exponential Weighted Moving Average, EWMA)

,

является отметкой времени генерирования второго журнала регистрации аварийных сигналов,

является отметкой времени генерирования первого журнала регистрации аварийных сигналов,

и

. В этом случае k является целым числом больше 1.Interval

the time of occurrence between two target alarm logs is

, estimated time interval

between two target alarm logs calculated using the Exponential Weighted Moving Average (EWMA) method

,

is the time stamp of the generation of the second alarm log,

is the timestamp of the generation of the first alarm log,

and

. In this case, k is an integer greater than 1.

Alternatively, the parameter α may be configured based on the actual requirement, and the specific value of α is not limited.

Step 4062: determine if the time interval of occurrence between two target alarm logs is less than or equal to a predetermined minimum time interval threshold; and, when the time interval of occurrence between the two target alarm logs is less than or equal to the predetermined minimum time interval threshold, execute step 4065; or, when the time interval of occurrence between the two target alarm logs is greater than the specified minimum time interval threshold, execute step 4063.

Step 4063: determine if the time interval between the two target alarm logs exceeds a predetermined maximum time interval threshold; and, when the time interval of occurrence between the two target alarm logs is greater than the predetermined maximum time interval threshold, execute step 4066; or, when the time interval between the two target alarm logs does not exceed the specified maximum time interval threshold, execute step 4064.

Step 4064: determine if the occurrence time interval between the two target alarm logs and the estimated time interval satisfies a predetermined condition; and, when the time interval of occurrence between the two target alarm logs and the estimated time interval satisfies the predetermined condition, execute step 4065; or, when the time interval of occurrence between the two target alarm logs and the estimated time interval do not satisfy the predetermined condition, execute step 4066.

, где

является положительным числом,

,

является пороговым значением минимального временного интервала и

является пороговым значением максимального временного интервала.Referring to step 4061, given by the condition may be

, where

is a positive number,

,

is the threshold value of the minimum time interval and

is the threshold value of the maximum time interval.

Step 4065: determine that the second alarm log belongs to the alarm event that owns the first alarm log, and aggregate the second alarm log into an alarm event that owns the first alarm log.

In addition, after step 4065, return to step 4061 to continue determining whether the next target alarm log belongs to the same alarm event that owns the first alarm log and the second alarm log to view the target alarm event. For example, k = k + 1, and return to step 4061.

For example, it is assumed that the alarm event to which the first alarm log belongs is {(TCP authentication failed, 14:22:08), (TCP authentication failed, 14:22:38)}. When it is determined that the second alarm log (TCP authentication failure, 14:23:25) belongs to the alarm event that owns the first alarm log, the second alarm log is aggregated into the alarm event that owns the first alarm log. alarms, and the alarm event can be updated to {(TCP authentication failed, 14:22:08), (TCP authentication failed, 14:22:38), (TCP authentication failed, 14:23:25)}.

Step 4066: determine that the second alarm log does not belong to the alarm event that owns the first alarm log.

For example, it is assumed that the alarm event that owns the first alarm log is {(TCP authentication failed, 14:22:08), (TCP authentication failed, 14:22:38), (TCP authentication failed, 14:23 :25)}. When it is determined that the second alarm log (TCP authentication failure, 21:18:20) does not belong to the alarm event that owns the first alarm log, recovery of the alarm event that owns the first alarm log is completed by other In other words, the alarm event recovery is complete.

Step 4067: initialize a new alarm event and aggregate the second alarm log into a new alarm event.

In addition, after executing step 4067, return to step 4061 to continue determining whether the next alarm target event belongs to the alarm event that owns the second alarm log to view the alarm target event. For example, k = k + 1, and return to step 4061.

Alternatively, steps 4062 and 4063 may not be performed. It's not limited.

It should be noted that, in order to reconstruct an alarm event based on the time interval of occurrence between alarm logs, the alarm log statistics can be obtained with the alarm event details, thereby improving the accuracy and reliability of the alarm log information obtained by collection of statistical data.

Step 407: Compress at least one alarm event based on at least one association rule to obtain at least one alarm target event, where each alarm target event is used to specify an alarm log, whose alarm type is the root cause alarm type.

Step 408: Output at least one alarm target event to display at least one alarm target event to a network monitoring engineer.

For example, FIG. 5B is an alarm target event interface diagram according to an embodiment of the present invention. As shown in FIG. 5B, after the alarm log generated by each network device is compressed by the alarm log compression method shown in FIG. 4, the target alarm event M obtained by restoring the alarm log of the main alarm type is displayed, and each alarm target event includes information such as host name (alarm network device ID), number of occurrences, and root cause log (primary alarm type).

It should be noted that the sequence of steps of the alarm log compression method provided in this embodiment of the present invention can be appropriately adjusted. For example, step 405 and step 406 may be performed before step 401, or a step may be added or removed, respectively, as appropriate. Any mode of modification easily understood by one skilled in the art within the technical scope disclosed in the present invention should be within the protection scope of the present invention. Therefore, details are not described again.

Finally, according to the alarm log compression method provided in the embodiments of the present invention, an association rule is obtained based on a temporal correlation between alarm types. In the data acquisition process, it is only necessary to look at the alarm types in the set of alarm log statistics subsets obtained by splitting based on the generation timestamp, and then determine the correspondence between each alarm type and the set of alarm log statistics subsets, for example, after determining the time sequence vector of each alarm type, clustering processing may be performed on the alarm type based on the match to generate an association rule. Compared with the related technology, the present invention does not require multiple viewing of alarm log statistics, and the efficiency of obtaining association rules is improved. Moreover, in the present invention, the number of association rules derived from the temporal correlation between alarm types is much smaller than the number of association rules derived from the set of frequently used elements in the related technology. Therefore, the time spent in the process of determining the accuracy of the association rule and in the process of determining the basic type of alarms in the association rule is reduced. In addition, the alarm event is recovered based on the alarm log occurrence time interval, and finally the target alarm event used to specify the alarm log whose alarm type is the main type is displayed to the network monitoring engineer. This greatly reduces the amount of alarm log information provided to the network monitoring engineer and ensures that the information is accurate and reliable.

6 is a flowchart of yet another alarm log compression method according to an embodiment of the present invention. The method is applied to a compression device. The compression device may be the compression device 01 shown in FIG. As shown in Fig.6, the method may include the following steps.

Step 501: Obtain an alarm log history set generated by the first network device in the communication network, where the alarm history history set includes a plurality of alarm history statistics, and each alarm history log includes a type alarm and timestamp of generation.

For the implementation process of this step, refer to step 201. Again, details are not described here.

Step 502: Divide the set of alarm statistics into a plurality of subsets of alarm statistics based on the time stamps of the generation of the alarm statistics in the set of alarm statistics.

For the implementation process of this step, refer to step 202. Again, details are not described here.

Step 503: Determine a correspondence between the alarm type in the set of alarm log statistics and the plurality of alarm log statistics subsets.

For the implementation process of this step, refer to step 203. Again, details are not described here.

Step 504: Perform alarm type clustering processing in the alarm log statistics set based on a match to generate at least one association rule, where each association rule includes a main alarm type and at least one minor alarm type that are associated with each other.

For the implementation process of this step, refer to step 204. Again, details are not described here.

Step 505: Obtain all alarm logs to be processed generated by the second network device in the communication network in a second predetermined time period, where each alarm log to be processed includes an alarm type and a generation time stamp.

Alternatively, the second network device and the first network device may be the same network device; or the second network device and the first network device may be different network devices of the same type.

Step 506: filter the minor type alarm log in all alarm logs to be processed based on at least one association rule to obtain a set of alarm logs to be processed, including the alarm log the main type of alarms.

Step 507: Generate at least one alarm event based on the set of alarm logs to be processed, where each alarm event is used to indicate alarm logs of the same alarm type that are generated by the second network device.

For the implementation process of this step, refer to step 406. Again, details are not described here.

Step 508: Output at least one alarm target event to display at least one alarm target event to a network monitoring engineer.

It should be noted that the minor type alarm log in all alarm logs to be processed is filtered out, so that the number of alarm logs to be processed can be greatly reduced. In addition, the alarm event is recovered on the basis that the time spent in the alarm event recovery process is reduced and the compression efficiency is further improved.

Fig. 7A is a diagram of an apparatus for compressing an alarm log according to an embodiment of the present invention. The device is applied to the device for compression. As shown in FIG. 7A, device 60 includes:

the first obtaining module 601, configured to obtain a set of alarm log statistics generated by the first network device in the communication network, where the set of alarm log statistics includes a plurality of alarm log statistics, and each alarm log history alarms includes the type of alarms and the timestamp of the generation;

a partitioning module 602, configured to partition the set of alarm log statistics into a plurality of subsets of the alarm log statistics based on the time stamps of generating the alarm log statistics in the set of alarm log statistics, where all the alarm log statistics alarms in each alarm log statistics subset are sequential in time sequence, and the combined set of the plurality of alarm log statistics subsets includes all alarm log statistics in the alarm log statistics set;

a determination module 603, configured to determine a correspondence between an alarm type in the set of alarm log statistics and a plurality of subsets of alarm log statistics;

a clustering module 604, configured to perform clustering processing on alarm types in the alarm log statistics set based on a match, to generate at least one association rule, where each association rule includes a main alarm type, and, at least one minor type of alarms that are associated with each other; and

a compressor 605, configured to compress a plurality of alarm logs to be processed based on at least one association rule to obtain an alarm log whose alarm type is the root cause alarm type.

Alternatively, as shown in FIG. 7B, the determination module 603 may include:

a receiving sub-module 6031, configured to obtain all types of alarms in the set of alarm log statistics to obtain the first set of alarm types; and

determination sub-module 6032, configured to determine a time sequence vector of each alarm type in the first set of alarm types, where each time sequence vector is used to reflect the correspondence between the corresponding alarm type and a plurality of alarm log statistics subsets.

For the time sequence vector corresponding to each alarm type, the values in the time sequence vector are in a one-to-one correspondence with a plurality of alarm log statistics subsets, the values in the time sequence vector include at least one of the first value and the second value, the first value is used to indicate that the alarm type exists in the corresponding alarm log statistics subset, the second value is used to indicate that the alarm type does not exist in the corresponding alarm log statistics subset, and the first value is different from the second values.

Alternatively, the determination submodule may be further configured to:

perform the time sequence vector determination procedure for each alarm type in the first set of alarm types.

The procedure for determining the time sequence vector includes:

successively determining the presence of an alarm type in a plurality of subsets of alarm log statistics; and

determining an alarm type time sequence vector based on the detection result.

Accordingly, the clustering module may be configured to:

perform clustering processing on all alarm types in the first alarm type set based on the time sequence vectors of all alarm types to generate at least one association rule.

In addition, the clustering module can be further configured to:

perform a clustering operation on the first set of alarm types, wherein the clustering operation includes:

setting a target alarm type set and a second alarm type set, where both the target alarm type set and the second alarm type set are empty sets;

adding any alarm type in the first alarm type set to the target alarm type set and deleting from the first alarm type set the alarm type added to the target alarm type set;

repeatedly performing the determination procedure until the first set of alarm types is empty, and determining the target set of alarm types as an association rule; and

after repeatedly executing the determination procedure when the second set of alarm types is not empty, repeatedly performing a clustering operation using the second set of alarm types as a new first set of alarm types; or

after repeatedly executing the determination procedure when the second set of alarm types is empty, terminating the execution of the clustering operation.

The determination procedure includes:

calculating the correlation between the alarm type to be processed and the target alarm type set, based on the time sequence vector of the alarm type to be processed and the time sequence vectors of all alarm types in the target alarm type set, where the alarm type to be processed is alarm type is any alarm type in the first alarm type set other than the alarm types in the target alarm type set; and

when the correlation exceeds a predetermined correlation threshold, adding an alarm type to be processed to the target alarm type set to obtain an updated target alarm type set, and deleting the alarm type to be processed from the first alarm type set; or

when the correlation does not exceed the predetermined correlation threshold, adding the type of alarms to be processed to the second set of alarm types, and deleting the type of alarms to be processed from the first set of alarm types.

Alternatively, the clustering module may be further configured to:

mark the target alarm type in the first alarm type set, where the target alarm type is any alarm type in the first alarm type set; and

perform a clustering operation on the first set of alarm types, wherein the clustering operation includes:

repeating the determination procedure until all alarm types in the first set of alarm types have been viewed; and

after repeating the determination procedure, if there is an alarm type that is unchecked in the first set of alarm types, determine any unchecked alarm type as the new target alarm type, mark the new target alarm type, and repeatedly perform the clustering operation, while different types of target alarms have different marks; or

after repeatedly executing the determination procedure, if there is no alarm type that is not flagged in the first set of alarm types, stop executing the clustering operation and generate at least one association rule based on the first set of alarm types, where one and the same the same checkbox is set for all types of alarms in each association rule.

The determination procedure includes:

defining, as the target alarm type set, a set including all alarm types in the first alarm type set that have the same label as the target alarm type;

calculating the correlation between the alarm type to be processed and the target alarm type set based on the time sequence vector of the alarm type to be processed and the time sequence vectors of all alarm types in the target alarm type set, where the alarm type, to be processed is any alarm type in the first alarm type set other than the alarm types in the target alarm type set; and

the flag of the type of alarms to be processed when the correlation is greater than the predetermined correlation threshold, where the flag of the type of alarms to be processed is the same as the flag of the target alarm type.

Alternatively, the clustering module may be further configured to:

calculate the correlation between the alarm type to be handled and each alarm type in the target alarm type set according to the Pearson correlation coefficient formula, where the Pearson correlation coefficient formula is:

, где

, where

представляет корреляцию между типом

аварийного сигнала и типом

аварийного сигнала,

представляет ковариацию между

и

,

представляет стандартное отклонение

,

представляет стандартное отклонение

,

представляет вектор временной последовательности типа

аварийного сигнала и

представляет вектор временной последовательности типа

аварийного сигнала; и

represents the correlation between the type

alarm and type

alarm,

represents the covariance between

and

,

represents the standard deviation

,

represents the standard deviation

,

represents a time sequence vector of type

alarm and

represents a time sequence vector of type

emergency signal; and

calculate the correlation between the alarm type to be processed and the target alarm type set based on the correlation between the alarm type to be processed and each alarm type in the target alarm type set according to the average correlation calculation formula, where the formula is average correlation calculations:

, где

, where

указывает корреляцию между типом

аварийного сигнала и набором целевого типа R аварийных сигналов, и

указывает количество типов аварийных сигналов в наборе R целевого типа аварийных сигналов.

indicates the correlation between the type

alarm and a target type R alarm set, and

specifies the number of alarm types in set R of the target alarm type.

Alternatively, the first acquisition module may be configured to:

pre-process the alarm log statistics generated by the first network device in the first predetermined time period to remove redundant information from each alarm log statistics to obtain a set of alarm log statistics.

Each statistical alarm log is represented in a two-tuple format (M, t), M represents alarm log information, t represents a generation time stamp, and the alarm log information includes at least a type field alarm and an alarm network device ID field.

Alternatively, the alarm log statistics in the alarm log statistics set have a partial temporal order relationship, and the splitter may be configured to:

obtaining a set of timestamps for generating the alarm log statistics in the alarm log statistics set; and

classify the alarm log statistics into a plurality of alarm log statistics subsets based on the set of generation timestamps, a predetermined time window length, and a window slide step where the window slide step is no greater than the time window length.

Alternatively, as shown in FIG. 7C, device 60 further includes:

a second obtaining module 606, configured to obtain a set of alarm logs to be processed generated by a second network device in the communication network in a second predetermined time period, where the set of alarm logs to be processed includes a plurality of alarm logs to be processed, and each alarm log to be processed includes an alarm type and a timestamp of generation; and

a generating module 607, configured to generate at least one alarm event based on the set of alarm logs to be processed, where each alarm event is used to indicate alarm logs of the same type that are generated by the second network device.

Alternatively, as shown in FIG. 7D, generation module 607 may include:

a recovery sub-module 6071, configured to perform an alarm event recovery procedure for each set of alarm logs to be processed, where the alarm event recovery process includes:

an acquisition unit 71a, configured to: for each type of alarms in the alarm log set to be processed, obtain the target alarm log that is in the alarm log set to be processed and which belongs to the alarm type;

a calculation unit 71b configured to separately calculate an occurrence time interval between each two target alarm logs in the set of alarm logs to be processed that are adjacent in time sequence; and

a recovery unit 71c configured to recover into one alarm event based on the time interval of occurrence between each two target alarm logs, the target alarm logs in the set of alarm logs to be processed that belong to the same alarm event.

The recovery unit can be configured to:

compute an estimated time interval between two target alarm logs using an exponential moving average method, where the two target alarm logs are any two target alarm logs that are adjacent in time sequence, the two target alarm logs include a first alarm log and a second alarm log, and the first alarm log is generated before the second alarm log;

determine whether a time interval of occurrence between the two target alarm logs and the estimated time interval satisfies a predetermined condition; and

when the occurrence time interval between the two target alarm logs and the estimated time interval satisfies the predetermined condition, determine that the second alarm log belongs to the alarm event to which the first alarm log belongs, and aggregate the second alarm log into an alarm event signals. which owns the first alarm log; or

when the occurrence time interval between the two target alarm logs and the estimated time interval do not satisfy the predetermined condition, determine that the second alarm log does not belong to the alarm event to which the first alarm log belongs.

времени возникновения между двумя целевыми журналами регистрации аварийных сигналов составляет

, оценочный временной интервал

составляет

, и заданное условие составляет

, гдеAlternatively, interval

the time of occurrence between two target alarm logs is

, estimated time interval

is

, and the given condition is

, where

является отметкой времени генерирования второго журнала регистрации аварийных сигналов,

является отметкой времени генерирования первого журнала регистрации аварийных сигналов,

, k является целым числом больше 1 и

является положительным числом.

is the time stamp of the generation of the second alarm log,

is the timestamp of the generation of the first alarm log,

, k is an integer greater than 1 and

is a positive number.

In addition, the recovery unit can be further configured to:

when the occurrence time interval between the two target alarm logs is less than or equal to the predetermined minimum time interval threshold value, determining that the second alarm log belongs to the alarm event to which the first alarm log belongs; or

when the time interval of occurrence between two target alarm logs exceeds the specified maximum time interval threshold, determine that the second alarm log does not belong to the alarm event that the first alarm log belongs to, where

,

является минимальным пороговым значением временного интервала, и

является максимальным пороговым значением временного интервала.

,

is the minimum time interval threshold, and

is the maximum time interval threshold.

Alternatively, the recovery unit may be further configured to:

finish restoring the alarm event to which the first alarm log belongs, and initialize a new alarm event; and

aggregate the second alarm log into a new alarm event.

Optionally, the alarm event includes an alarm type and at least one of an occurrence start time, an occurrence end time, an average occurrence time interval, and the number of times the alarm log occurred in the alarm event.

Alternatively, the compression module may be configured to:

compress at least one alarm event based on at least one association rule to obtain at least one alarm target event, where each alarm target event is used to specify an alarm log, an alarm type which is the root cause alarm type.

In addition, as shown in FIG. 7E, device 60 may further include:

an output module 608, configured to output the at least one alarm target event to display the at least one alarm target event to a network monitoring engineer.

Alternatively, the second network device and the first network device are the same network device; or the second network device and the first network device are different network devices of the same type.

Finally, according to the alarm log compression apparatus provided in the embodiments of the present invention, an association rule is obtained based on a temporal correlation between alarm types. In the data acquisition process, it is only necessary to look at the alarm types in the set of alarm log statistics subsets obtained by splitting based on the generation timestamp, and then determine the correspondence between each alarm type and the set of alarm log statistics subsets, for example, after determining the time sequence vector of each alarm type, clustering processing may be performed on the alarm type based on the match to generate an association rule. Compared with the related technology, the present invention does not require multiple viewing of alarm log statistics, and the efficiency of obtaining association rules is improved. Moreover, in the present invention, the number of association rules derived from the temporal correlation between alarm types is much smaller than the number of association rules derived from the set of frequently used elements in the related technology. Therefore, the time spent in the process of determining the accuracy of the association rule and in the process of determining the basic type of alarms in the association rule is reduced. In addition, an alarm event is recovered based on the time interval of occurrence of the alarm log, and finally, the target alarm event used to specify the alarm log whose alarm type is the main type is displayed to the network monitoring engineer. This greatly reduces the amount of alarm log information provided to the network monitoring engineer and ensures that the information is accurate and reliable.

An embodiment of the present invention provides an apparatus for compressing an alarm log. As shown in FIG. 8, the device 07 includes a memory 071, a processor 072, and a computer program that is stored in the memory 071 and that can be executed on the processor 072, and when the processor 072 executes the computer program, alarm log compression methods are implemented in the embodiments of the present invention. .

Alternatively, device 07 further includes a communication bus 073 and a communication interface 074.

Processor 072 includes one or more processing cores. The processor 072 runs a computer program and a block for performing various functional applications and data processing.

The memory 071 may be configured to store a computer program and block. In particular, the memory may store an operating system and an application program module required for at least one function. The operating system may be an operating system such as a real-time operating system (Real Time eXecutive, RTX), LINUX, UNIX, WINDOWS, or OS X.

A plurality of communication interfaces 074 may be used, and the communication interface 074 is configured to communicate with another storage device or network device. For example, in this embodiment of the present invention, the communication interface 074 may be configured to receive an alarm log sent by a network device in a communication network.

The memory 071 and the communication interface 074 are separately connected to the processor 072 via a communication cable 073.

An embodiment of the present invention provides a computer-readable storage medium. The computer-readable storage medium stores the instruction, and when the instruction is executed by the processor, the alarm log compression methods are implemented in the method embodiments of the present invention.

One skilled in the art will understand that all or some of the steps of the embodiments may be implemented in hardware or in a program that instructs the appropriate equipment. The program may be stored on a computer-readable storage medium. The storage medium may be read only memory, a magnetic disk, an optical disk, or the like.

The above descriptions are only possible embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions or improvements made without departing from the spirit and principle of the present invention shall be within the protection scope of the present invention.

Claims (160)

1. An alarm log compression method implemented by an alarm log compression device, comprising the steps of: receiving a set of alarm log statistics generated by the first network device in the communication network, wherein the alarm log statistics set contains a plurality of alarm log statistics, and each alarm log statistics contains an alarm type and a generation time stamp ; separating the set of alarm log statistics into a plurality of subsets of alarm log statistics based on the generation timestamps of the alarm log statistics in the alarm log statistics set, all of the alarm log statistics in each subset of statistics the alarm log statistics are sequential in time sequence and the combined set of the plurality of alarm history subsets contains all of the alarm history statistics in the alarm history history set; determining a correspondence between the type of alarms in the alarm log statistics set and the plurality of alarm log statistics subsets; performing clustering processing on alarm types in the alarm log statistics set, based on a match, to generate at least one association rule, each association rule containing a major alarm type and at least one minor alarm type associated with each other. with a friend; and compressing the plurality of alarm log data to be processed based on at least one of the association rules to obtain alarm log data having an alarm type that is a root cause alarm type. 2. The method of claim 1, wherein the step of determining a correspondence between an alarm type in a set of alarm log statistics and a plurality of alarm log statistics subsets comprises sub-steps of: getting all types of alarms in the alarm log statistics set to obtain a first set of alarm types; and defining a time sequence vector of each alarm type in the first set of alarm types, each time sequence vector being used to reflect the correspondence between the corresponding alarm type and a plurality of alarm log statistics subsets, wherein for the time sequence vector corresponding to each alarm type, the values in the time sequence vector are in a one-to-one correspondence with a plurality of alarm log statistics subsets, the values in the time sequence vector contain at least one of a first value and a second value, where the first a value is used to indicate that the alarm type exists in the corresponding subset of the alarm history logs, and a second value is used to indicate that the alarm type does not exist in the corresponding subset of alarm logs and the first value is different from the second value. 3. The method of claim 2, wherein the step of determining the time sequence vector of each alarm type in the first set of alarm types comprises a sub-step of: performing the procedure for determining the time sequence vector for each type of alarms in the first set of types of alarms, and the procedure for determining the time sequence vector contains the steps in which: successively determine the presence of the type of alarms in a plurality of subsets of statistical data of the alarm logs; and determining an alarm type time sequence vector based on the detection result. 4. The method according to claim 2 or 3, wherein the step of performing clustering processing for alarm types in the set of alarm log statistics based on a match to generate at least one association rule comprises a sub-step of: performing clustering processing for all alarm types in the first alarm type set based on the time sequence vectors of all alarm types to generate at least one association rule. 5. The method of claim 4, wherein the step of performing clustering processing on all alarm types in the first set of alarm types, based on the time sequence vectors of all alarm types, to generate at least one association rule, comprises a sub-step of: perform clustering operations for the first set of alarm types, wherein the clustering operations comprise: setting a target alarm type set and a second alarm type set, both the target alarm type set and the second alarm type set being empty sets; adding any alarm type in the first alarm type set to the target alarm type set and deleting from the first alarm type set the alarm type added to the target alarm type set; repeatedly performing the determination procedure until the first set of alarm types is empty, and determining the target set of alarm types as an association rule; and repeatedly executing, after repeatedly executing the determination procedure when the second set of alarm types is not an empty set, clustering operations using the second set of alarm types as a new first set of alarm types; or terminating, after repeatedly executing the determination procedure when the second set of alarm types is an empty set, performing a clustering operation; wherein The determination procedure contains the steps in which: computing a correlation between the alarm type to be processed and the target alarm type set based on the alarm type time sequence vector to be processed and the time sequence vectors of all alarm types in the target alarm type set, the alarm type to be processed , is any alarm type in the first alarm type set other than the alarm types in the target alarm type set; and, when the correlation exceeds a predetermined correlation threshold, adding an alarm type to be processed to a target alarm type set to obtain an updated target alarm type set, and deleting an alarm type to be processed from the first alarm type set; or, when the correlation does not exceed the predetermined correlation threshold, adding an alarm type to be processed to the second alarm type set, and removing the alarm type to be processed from the second alarm type set. 6. The method of claim 4, wherein the step of performing clustering processing on all alarm types in the first set of alarm types, based on the time sequence vectors of all alarm types, to generate at least one association rule, comprises a sub-step of: marking a target alarm type in the first alarm type set, wherein the target alarm type is any alarm type in the first alarm type set; and perform clustering operations for the first set of alarm types, in which the clustering operation contains: repeating the determination procedure until all alarm types in the first set of alarm types have been viewed; and after running the determination procedure repeatedly, if there is an alarm type that is unchecked in the first set of alarm types, defining any unchecked alarm type as the new target alarm type, marking the new target alarm type, and repeatedly performing the clustering operation, in which different target types of alarms have different marks; or after repeatedly executing the determination procedure, in the absence of an alarm type that is not checked in the first set of alarm types, terminating the clustering operation and generating at least one association rule based on the first set of alarm types in which the same a flag is set for all types of alarms in each association rule; a The determination procedure contains the steps in which: determining, as the target alarm type set, a set containing all alarm types in the first alarm type set having the same mark as the target alarm type; calculating the correlation between the type of alarms to be processed and the target set of alarm types based on the vector of the time sequence of the type of alarms to be processed, and the time sequence of all types of alarms in the target set of alarm types, and the type of alarms to be processed, is any alarm type in the first alarm type set other than the alarm types in the target alarm type set; and marking the type of alarms to be processed when the correlation exceeds the predetermined correlation threshold, wherein the flag of the alarm type to be processed is the same as the flag of the target alarm type. 7. The method according to claim 5 or 6, wherein the step of calculating the correlation between the type of alarms to be processed and the target set of alarm types based on the time sequence vector of the type of alarms to be processed and the time sequence vectors of all types of alarms in set of target alarm types contains sub-steps where: calculating the correlation between the alarm type to be processed and each alarm type in the set of target alarm types according to the Pearson correlation coefficient formula, the Pearson correlation coefficient formula being:

, where

represents the correlation between the type

alarm and type

alarm,

represents the covariance between

and

,

represents the standard deviation

,

represents the standard deviation

,

represents a time sequence vector of type

alarm and

represents a time sequence vector of type

emergency signal; and calculating a correlation between the alarm type to be processed and the target alarm type set based on the correlation between the alarm type to be processed and each alarm type in the target alarm type set according to the average correlation calculation formula, wherein the average correlation calculation formula correlations

, where

indicates the correlation between the type

alarm and the target set R of alarm types and

indicates the number of alarm types in the target set R of alarm types. 8. The method according to any one of claims 1 to 7, wherein the step of obtaining a set of alarm log statistics generated by the first network device in the communication network comprises the sub-step of preprocessing the alarm log statistics generated by the first network device in the first predetermined time period to remove redundant information from each alarm log statistics to obtain a set of alarm log statistics. 9. The method according to any one of claims 1-8, in which each alarm log statistics are in a two-tuple format (M, t), where M is the alarm log information and t is the generation timestamp, where the alarm log information contains at least an alarm type field. signal and the ID field of the first network device. 10. The method of any one of claims 1 to 9, wherein the alarm log statistics in the alarm log set have a partial temporal order relationship, and the step of dividing the alarm log statistics set into a plurality of subsets of the alarm log statistics alarms based on the timestamps of generating the alarm log statistics in the alarm log statistics set, comprises sub-steps of: obtaining a set of timestamps for generating alarm log statistics in the alarm log statistics set; and classifying the statistics of the alarm logs into a plurality of subsets of the statistical data of the alarm logs based on the set of generation timestamps, the predetermined time window duration, and the sliding window step using the sliding window technology, wherein the sliding window step does not exceed the time window duration. 11. The method of claim 1, further comprising, before the step of compressing the plurality of alarm logs, the steps of: receiving a set of alarm logs to be processed generated by a second network device in the communication network in a second predetermined time period, wherein the set of alarm logs to be processed contains a plurality of alarm logs to be processed and each alarm log to be processed, contains the type of alarm and the timestamp when it was generated; and generating at least one alarm event based on the set of alarm logs to be processed, each alarm event being used to indicate the same type of alarm logs generated by the second network device; wherein compressing the plurality of alarm logs comprises a sub-step of compressing at least one alarm event based on at least one association rule to obtain at least one target alarm event, each target alarm event being used to specify an alarm log having an alarm type that is an alarm type root cause signals. 12. The method of claim 11, wherein the step of generating at least one alarm event based on the set of alarm logs to be processed comprises sub-steps of: obtaining, for each type of alarms in the set of alarm logs to be processed, a target alarm log in the set of alarm logs to be processed and related to the alarm type; performing a separate calculation of an occurrence time interval between each two target alarm logs in the set of alarm logs to be processed that are adjacent in time sequence; and restoring, in one alarm event, based on the time interval of occurrence between each two target alarm logs, the target alarm logs in the set of alarm logs to be processed and related to one alarm event. 13. The method of claim 12, wherein the step of recovering, in one alarm event, based on the time interval of occurrence between every two target alarm logs, the target alarm logs in the set of alarm logs to be processed and belonging to one alarm event, contains sub-steps in which: calculating an estimated time interval between two target alarm logs using an exponential moving average method, wherein the two target alarm logs are any two target alarm logs adjacent in time sequence, where the two target alarm logs comprising a first alarm log and a second alarm log, the first alarm log being generated prior to the second alarm log; determining whether an occurrence time interval between the two target alarm logs and the estimated time interval satisfies a predetermined condition; and determining when the occurrence time interval between the two target alarm logs and the estimated time interval satisfies the predetermined condition that the second alarm log belongs to the alarm event to which the first alarm log belongs, and aggregates the second alarm log into an alarm event which owns the first alarm log; or determining when the occurrence time interval between the two target alarm logs and the estimated time interval does not satisfy the predetermined condition that the second alarm log does not belong to the alarm event to which the first alarm log belongs. 14. The method according to claim 13, in which the interval

the time of occurrence between two target alarm logs is

, estimated time interval

is

, and the given condition is

, where

is the time stamp of the generation of the second alarm log,

is the timestamp of the generation of the first alarm log,

, k is an integer greater than 1 and

is a positive number. 15. The method of claim 14, further comprising, before the step of determining whether the time interval of occurrence between the two target alarm logs and the estimated time interval satisfies a predetermined condition, comprises sub-steps of: determining when an occurrence time interval between two target alarm logs is less than or equal to a predetermined minimum time interval threshold value that the second alarm log belongs to an alarm event to which the first alarm log belongs; or determining when a time interval of occurrence between two target alarm logs exceeds a predetermined maximum time interval threshold value that the second alarm log does not belong to the alarm event to which the first alarm log belongs, wherein

,

is the minimum time interval threshold, and

is the maximum time interval threshold. 16. The method according to any one of claims 13-15, further comprising, after determining that the second alarm log does not belong to the alarm event to which the first alarm log belongs, the steps of: completing restoring the alarm event to which the first alarm log belongs and initializing a new alarm event; and aggregating the second alarm log into a new alarm event. 17. The method according to any one of claims 11-16, in which the alarm event comprises an alarm type and at least one of an occurrence start time, an occurrence end time, an average time interval of occurrence, and a number of times the alarm log occurs in the alarm event. 18. The method of any one of claims 11-17, further comprising, after compressing at least one alarm event to obtain at least one target alarm event, outputting at least one alarm target event. 19. The method according to any one of claims 11-18, in which the second network device and the first network device are the same network device, or the second network device and the first network device are different network devices of the same type. 20. An alarm log compression device, comprising: a first obtaining module configured to obtain a set of alarm log statistics generated by a first network device in the communication network, wherein the set of alarm log statistics contains a plurality of alarm log statistics, and each alarm log statistics contains a type alarm and time stamp of generation; a separating module configured to divide the set of alarm log statistics into a plurality of subsets of the alarm log statistics based on the time stamps of generating the alarm log statistics in the set of alarm log statistics, wherein all of the alarm log statistics the alarms in each alarm log statistics subset are consecutive in time sequence, and the combined set of the plurality of alarm log statistics subsets contains all of the alarm log statistics in the alarm log statistics set; a determining module, configured to determine a correspondence between an alarm type in the set of alarm log statistics and a plurality of subsets of alarm log statistics; a clustering module configured to perform clustering processing on alarm types in a set of alarm log statistics based on a match to generate at least one association rule, each association rule comprising a major alarm type and at least one minor alarm type signals associated with each other; a compressor configured to compress a plurality of alarm log data to be processed based on at least one of the association rules to obtain alarm log data having an alarm type that is a root cause alarm type. 21. The apparatus of claim 20, wherein the determination module comprises: a receiving sub-module configured to obtain all types of alarms in the alarm log statistics set to obtain a first set of alarm types; and a determination sub-module configured to determine a time sequence vector of each alarm type in the first set of alarm types, each time sequence vector being used to reflect the correspondence between the corresponding alarm type and a plurality of alarm log statistics subsets, wherein for the time sequence vector corresponding to each alarm type, the values in the time sequence vector are in a one-to-one correspondence with the set of alarm log statistics subsets, the values in the time sequence vector contain at least one of the first value and the second value, the first value is used to indicate that the alarm type is in the corresponding alarm log statistics subset, and the second value is used to indicate that the alarm type is not in the corresponding alarm log statistics subset, with the first value different from the second value. 22. The apparatus of claim 21, wherein the determination submodule is configured to implementation of the procedure for determining the time sequence vector for each type of alarms in the first set of types of alarms, while the procedure for determining the time sequence vector contains the steps in which: performing a sequential determination of the presence of the type of alarms in a plurality of subsets of statistical data logs of the alarm logs; and determining an alarm type time sequence vector based on the detection result. 23. The device according to claim 21 or 22, in which the clustering module is configured to performing clustering processing for all alarm types of the first set of alarm types, based on the time sequence vectors of all alarm types in accordance with the clustering algorithm associated with the time sequence, to generate at least one association rule. 24. The apparatus of claim 23, wherein the clustering module is further configured to performing a clustering operation for a first set of alarm types, the clustering operation comprising: setting a target alarm type set and a second alarm type set, both the target alarm type set and the second alarm type set being empty sets; adding any alarm type in the first alarm type set to the target alarm type set and deleting, from the first alarm type set, the alarm type added to the target alarm type set; repeatedly performing the determination procedure until the first set of alarm types becomes an empty set, and determining the target set of alarm types as an association rule; and repeatedly executing, after repeatedly executing the determination procedure when the second set of alarm types is not an empty set, clustering operations using the second set of alarm types as a new first set of alarm types; or terminating the execution of the clustering operation after repeatedly executing the determination procedure when the second set of alarm types is an empty set; a the determination procedure contains: calculating a correlation between the alarm type to be processed and the target alarm type set, based on the time sequence vector of the alarm type to be processed and the time sequence vectors of all alarm types in the target alarm type set, whereby the alarm type to be processed alarm type is any alarm type in the first alarm type set other than the alarm types in the target alarm type set; and, when the correlation exceeds a predetermined correlation threshold, adding an alarm type to be processed to the target alarm type set to obtain an updated target alarm type set, and deleting the alarm type to be processed from the first alarm type set; or, when the correlation does not exceed the predetermined correlation threshold, adding the type of alarms to be processed to the second set of alarm types, and deleting the type of alarms to be processed from the first set of alarm types. 25. The apparatus of claim 23, wherein the clustering module is further configured to: marking a target alarm type in the first alarm type set, wherein the target alarm type is any alarm type in the first alarm type set; and performing a clustering operation for a first set of alarm types, wherein the clustering operation comprises: executing the determination procedure repeatedly until all alarm types in the first set of alarm types have been viewed; and after repeating the determination procedure, if there is an alarm type that is unchecked in the first set of alarm types, determining, as a new target alarm type, any unchecked alarm type, marking the new target alarm type signals and repeatedly performing the clustering operation, while different types of target alarms have different marks; or after repeatedly executing the determination procedure, if there is no alarm type that is not flagged in the first set of alarm types, terminating the clustering operation and generating at least one association rule based on the first set of alarm types, while the same a flag is set for all types of alarms in each association rule; a the determination procedure contains: defining as the target alarm type set a set containing all alarm types in the first alarm type set having the same mark as the target alarm type; calculating a correlation between the alarm type to be processed and the target alarm type set based on the alarm type time sequence vector to be processed and the time sequence vectors of all alarm types in the target alarm type set, the alarm type to be processed , is any alarm type in the first alarm type set other than the alarm types in the target alarm type set; and flag of the type of alarms to be processed when the correlation exceeds the predetermined correlation threshold, wherein the flag of the type of alarms to be processed is the same as the flag of the target alarm type. 26. The apparatus of claim 24 or 25, wherein the clustering module is further configured to: calculating the correlation between the alarm type to be processed and each alarm type in the target alarm type set according to the Pearson correlation coefficient formula, whereby the Pearson correlation coefficient formula is:

, where

represents the correlation between the type

alarm and type

alarm,

represents the covariance between

and

,

represents the standard deviation

,

represents the standard deviation

,

represents a time sequence vector of type

alarm and

represents a time sequence vector of type

emergency signal; and calculating the correlation between the alarm type to be processed and the target alarm type set based on the correlation between the alarm type to be processed and each alarm type in the target alarm type set according to the average correlation calculation formula, wherein the average correlation calculation formula correlations

, where

indicates the correlation between the type

alarm and the target set R of alarm types and

indicates the number of alarm types in the target set R of alarm types. 27. An apparatus according to any one of claims 20-26, wherein the first acquisition module is configured to: pre-processing the alarm log statistics generated by the first network device in the first predetermined time period to remove redundant information from each alarm log statistics to obtain a set of alarm log statistics. 28. The device according to any one of paragraphs 20-27, in which each alarm log statistics are in a two-tuple format (M, t) where M is the alarm log information and t is the time stamp of generation and the alarm log information contains at least an alarm type field and an alarm network device ID field. 29. The apparatus of any one of claims 20-28, wherein the alarm log statistics in the alarm log statistics set have a partial temporal order relationship, wherein the partitioning module is configured to: obtaining a set of alarm log statistics generation timestamps in the alarm log statistics set; and classifying the alarm log statistics into a plurality of subsets of the alarm log statistics based on a set of generation timestamps, a predetermined time window length, and a sliding window step, wherein the sliding window step does not exceed the time window length. 30. The device according to claim 20, further comprising: a second obtaining module, configured to obtain a set of alarm logs to be processed generated by a second network device in the communication network in a second predetermined time period, wherein the set of alarm logs to be processed comprises a plurality of alarm logs to be processed and each to be processed the alarm log contains the type of alarms and the timestamp of the generation; and a generating module configured to generate at least one alarm event based on the set of alarm logs to be processed, each alarm event being used to indicate the same type of alarm logs as those generated by the second network device; wherein the compression module is configured to compressing at least one alarm event based on at least one association rule to obtain at least one target alarm event, each target alarm event being used to specify an alarm log having an alarm type that is an alarm type main reason. 31. The apparatus of claim 30, wherein the generation module comprises a recovery sub-module configured to perform an alarm event recovery procedure for each set of alarm logs to be processed, the alarm event recovery process comprising: the acquisition unit is configured, for each type of alarms in the set of alarm logs to be processed, to obtain a target alarm log in the set of alarm logs to be processed related to the type of alarms; the calculation unit is configured to separately calculate an occurrence time interval between each two target alarm logs in the set of alarm logs to be processed that are adjacent in time sequence; and the recovery unit is configured to recover, in one alarm event, based on the time interval of occurrence between each two target alarm logs, the target alarm logs in the set of alarm logs to be processed and belonging to the same alarm event . 32. The apparatus of claim 31, wherein the recovery unit is configured to: calculating an estimated time interval between two target alarm logs using an exponential moving average method, where the two target alarm logs are any two target alarm logs adjacent in time sequence, the two target alarm logs contain the first log alarm logs and a second alarm log and a first alarm log generated before the second alarm log; determining whether a time interval of occurrence between the two target alarm logs and the estimated time interval satisfies a predetermined condition; and determining when the time interval of occurrence between the two target alarm logs and the estimated time interval satisfies a predetermined condition that the second alarm log belongs to the alarm event to which the first alarm log belongs, and aggregating the second alarm log into an alarm event which owns the first alarm log; or determining when the occurrence time interval between the two target alarm logs and the estimated time interval does not satisfy the predetermined condition that the second alarm log does not belong to the alarm event to which the first alarm log belongs. 33. The apparatus of claim 32, wherein the recovery unit is further configured to: completing recovery of the alarm event to which the first alarm log belongs, and initiating a new alarm event; and aggregating the second alarm log into a new alarm event. 34. The device according to any one of claims 30-33, in which the alarm event comprises an alarm type and at least one of an occurrence start time, an occurrence end time, an average time interval of occurrence, and a number of times the alarm log occurred in the alarm event. 35. The device according to any one of claims 30-34, in which the device further comprises an output module configured to output at least one alarm target event. 36. The device according to any one of claims 30-35, in which the second network device and the first network device are the same network device, or the second network device and the first network device are different network devices of the same type. 37. A computer-readable storage medium storing instructions that cause, when executed by the processor, an implementation of the alarm log compression method according to any one of claims 1-19.

Images