WO2011017955A1 - Procede d'analyse de donnees d'alarme et systeme associe - Google Patents

Procede d'analyse de donnees d'alarme et systeme associe Download PDF

Info

Publication number
WO2011017955A1
WO2011017955A1 PCT/CN2010/072901 CN2010072901W WO2011017955A1 WO 2011017955 A1 WO2011017955 A1 WO 2011017955A1 CN 2010072901 W CN2010072901 W CN 2010072901W WO 2011017955 A1 WO2011017955 A1 WO 2011017955A1
Authority
WO
WIPO (PCT)
Prior art keywords
alarm
alarms
subsets
subset
root
Prior art date
Application number
PCT/CN2010/072901
Other languages
English (en)
Chinese (zh)
Inventor
张清
李进
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2011017955A1 publication Critical patent/WO2011017955A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0681—Configuration of triggering conditions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/104—Peer-to-peer [P2P] networks

Definitions

  • the present invention relates to the field of telecommunication network management fault management, and more particularly to a method and system for analyzing alarm data based on an end-to-end model in a telecommunications network management, especially a national-level large-scale integrated network management system.
  • the integrated network management system is built on the basis of each professional telecommunications network management system, and realizes data concentration, management and analysis across the professional network through standard interfaces.
  • the fault management needs to display an active alarm that reflects the fault status of the NE device on the interface, so that maintenance personnel can perform corresponding routine maintenance according to these alarms to ensure stable operation of the telecommunication network. Since the activity alarms on each professional network management system have a certain data size (K-order), the number of them is quite large after the centralized network management (10K orders of magnitude), so many active alarms can not be effectively displayed on the interface, operation and maintenance People can't handle it either. According to the actual operation experience, the faulty network element device is a minority.
  • the master device When a network element device (herein referred to as the master device) fails and reports an alarm, other network element devices that are connected to the network element are connected. (including inter-professional network elements) will also generate a series of alarms, these alarms are actually redundant alarms, which should be suppressed by the alarm compression on the master device. In this way, the number of active alarms in the integrated network management system can be effectively reduced, so that the operation and maintenance personnel can accurately locate the faulty network element and distribute the trouble ticket to the relevant personnel for network maintenance.
  • the master device When a network element device (herein referred to as the master device) fails and reports an alarm, other network element devices that are connected to the network element are connected. (including inter-professional network elements) will also generate a series of alarms, these alarms are actually redundant alarms, which should be suppressed by the alarm compression on the master device. In this way, the number of active alarms in the integrated network management system can be effectively reduced, so that the operation and maintenance personnel can accurately locate the faulty network element and distribute the
  • the alarm compression is mainly based on the processing logic or association rules customized by the hardware experts to provide business knowledge.
  • the system confirms the correlation between the alarms according to these predefined association rules, and filters the redundant alarms.
  • the integrated network management manages the network element equipment of each professional, and the connection between the network element equipment ultimately depends on the implementation of the on-site engineering. It is not realistic to rely solely on the experts to provide the association rules, the workload is large, the efficiency is low, and the number of rules is relatively limited.
  • the technical problem to be solved by the present invention is to provide a method and system for analyzing alarm data, which can automatically determine the association rule between the root alarm and the redundant alarm, and then can use the root alarm to compress and suppress. Corresponding redundant alarms.
  • the present invention provides a method for analyzing alarm data, which is applied to a system including an end-to-end model indicating a connection relationship of network elements, including:
  • the historical alarm data collection is divided into multiple alarm subsets according to the NE type and the alarm cause.
  • the NE types of all alarms in the same alarm subgroup are the same as the alarm causes.
  • the alarm subsets are divided into two or two, and for each of the two alarm subsets, if the calculated two alarm subsets are greater than the first threshold in the historical alarm data set, And determining, for each of the two alarm subsets, the conditional probability that the alarm in the other alarm subset exists simultaneously with the second threshold, if yes, if the alarm exists in the alarm subset
  • the alarm in the alarm subset determined as a condition is a root alarm relative to the alarm in another alarm subset.
  • the above method may also have the following features:
  • the alarm in the alarm subset of the root alarm is shielded from the alarm in the other alarm subset in which the root alarm is a redundant alarm.
  • the above method may also have the following features:
  • the support degree is a ratio of the total number of alarms of the union of the two alarm subsets to the total number of alarms of the historical alarm data collection.
  • the method may also have the following characteristics: the conditional probability is that the alarm of the one of the two alarm subsets exists, and the number of alarms existing in the alarm subset of the other alarm subset and the conditional condition The proportion of the number of alarms in the alarm subset.
  • the foregoing method may further have the following feature: in the step of determining whether the alarm in the alarm subset exists, whether the condition probability of the simultaneous presence of the alarm in the other alarm subset is greater than the second threshold, if The absolute value of the time difference of the alarm occurrence in the two alarm subsets is smaller than the first time factor, and when the fault is eliminated, the absolute value of the time difference of the alarm elimination in the two alarm subsets is less than the second time factor, then the two are determined.
  • the alarms in the alarm subset exist at the same time.
  • the present invention further provides a system for analyzing alarm data, including an end-to-end model having a connection relationship indicating a network element, the system further comprising:
  • the split unit is configured to divide the historical alarm data into a plurality of alarm subsets according to the network element type and the alarm cause.
  • the network element types of all the alarms in the same alarm subset are the same as the alarm causes.
  • the support degree calculation unit is configured to set the alarm subset obtained by dividing the split unit into two or two Combining, calculating the support degree of the two alarm subsets in each combination in the historical alarm data ensemble;
  • the confidence calculation unit is configured to: if the support degree calculated by the support degree calculation unit is greater than the first threshold, For each of the two alarm subsets, calculate the conditional probability that the alarms exist in the other alarm subset under the condition that the alarm exists in the alarm subset;
  • a determining unit configured to determine, if the conditional probability calculated by the confidence calculation unit is greater than a second threshold, determining that the alarm in the alarm subset as a condition in the process of calculating the conditional probability by the confidence calculation unit is relative to another The root alarm of an alarm in a subset of alarms.
  • a shielding unit configured to determine, by the determining unit, an alarm in the alarm subset of the root alarm as an alarm in the other alarm subset of the root alarm that is a redundant alarm.
  • the above system may also have the following features:
  • the confidence calculation unit includes:
  • the determining module is configured to: if the absolute value of the time difference of the alarms in the two alarm subsets is less than the first time factor, and the absolute value of the time difference of the alarm elimination in the two alarm subsets is less than the second when the fault is eliminated The time factor determines that the alarms in the two alarm subsets exist simultaneously;
  • a recording module configured to: if the determining module determines that the alarms in the two alarm subsets exist simultaneously, record the number of alarms that exist in the two alarm subsets simultaneously;
  • the calculation module is configured to calculate a ratio of the number of alarms existing in the two alarm subsets recorded by the recording module to the number of alarms in each of the two alarm subsets.
  • the method and system for analyzing alarm data can perform alarm data mining analysis on a large number of historical alarms stored in a database, and can automatically discover association rules between root alarms and redundant alarms, and then can be used.
  • the root alarm is used to shield or compress the suppression of the relative redundancy alarm, which can effectively reduce the number of active alarms in the integrated network management system, so that the operation and maintenance personnel can accurately locate the faulty network element, and then dispatch the trouble ticket to the relevant personnel for network maintenance.
  • Figure 1 is a schematic diagram of a typical end-to-end model connection
  • FIG. 2 is a schematic diagram of a system for analyzing alarm data according to an embodiment of the present invention
  • 3 is a flow chart of a method for analyzing alarm data according to an embodiment of the present invention
  • FIG. 4 is a flow chart showing an application example of a method for analyzing alarm data according to the present invention.
  • End-to-end is the logical communication link between source and destination. This logical link may go through a very complicated physical route, as shown in Figure 1, which is a typical end-to-end model connection.
  • the end-to-end model management of the integrated network management primarily manages the end-to-end logical connections across multiple network elements and the physical connections between the adjacent network elements based on the logical connections.
  • the method for analyzing alarm data provided by the present invention mainly utilizes the existing massive historical alarm data sent by the network element in the end-to-end model and the connection relationship of the network elements in the end-to-end model, and realizes the automatic determination of the root alarm through data mining. Association rules for redundant alarms.
  • FIG. 2 is a schematic diagram of a system for analyzing alarm data according to an embodiment of the present invention.
  • the system 2 for alarm data analysis in the embodiment of the present invention includes an end-to-end model, and the network element connection relationship can be obtained from the end-to-end model, as shown in FIG. 2 Show that the system includes:
  • the splitting unit 20 is configured to divide the historical alarm data into a plurality of alarm subsets according to the network element type and the alarm cause.
  • the network element types of all the alarms in the same alarm subset are the same as the alarm causes.
  • the support degree calculation unit 21 is configured to arbitrarily combine the two or two alarm subsets obtained by the split unit 20, and calculate the support degree of the two alarm subsets in each combination in the historical alarm ensemble.
  • a confidence calculation unit 22 configured to calculate, in the alarm subset, each of the two alarm subsets, if the support degree calculated by the support calculation unit 21 is greater than the first threshold The conditional probability that the alarm is present in the other alarm subset under the condition that the alarm exists; the determining unit 23 is configured to determine that the conditional probability calculated by the confidence calculation unit 22 is greater than the second threshold The degree calculation unit 22 calculates the alarm in the alarm subset as a condition in the conditional probability process as the root alarm relative to the alarm in the other alarm subset.
  • the confidence calculation unit 22 includes a determination module 221, a recording module 222, and a calculation module 223. If the support degree is greater than the first specified value, the determining module 221 determines whether the alarms in the two alarm subsets exist simultaneously. If the time difference between the alarms in the two alarm subsets occurs The absolute value is less than the first time factor, and when the fault is eliminated, the absolute value of the time difference of the alarm elimination in the two alarm subsets is less than the second time factor, the determining module 221 determines the alarms in the two alarm subsets.
  • the recording module 222 records the alarms that exist in the two alarm subsets, and the calculation module 223 calculates the number of alarms that are recorded simultaneously and the The ratio of the number of alarms in one alarm subset of the two alarm subsets.
  • the system further includes: a shielding unit configured to set an alarm mask in the alarm subset determined by the determining unit to be a root alarm with respect to the another alarm subset in which the root alarm is a redundant alarm
  • FIG. 3 is a flow chart of a method of alert data analysis in accordance with an embodiment of the present invention. As shown in FIG. 3, the method for analyzing root alarm data in the embodiment of the present invention includes:
  • Step S101 the massive historical alarm data collection is divided into multiple alarm subsets according to the network element type and the alarm cause, and the network element types of all the alarms in the same alarm subset are the same as the alarm causes.
  • Each historical alarm data includes multiple alarms of different NE types and different alarm causes.
  • Each alarm data includes multiple important attributes: NE location, severity, and network. Meta type, alarm type, generation time, and alarm cause.
  • the total historical alarm data can be regarded as a complete set.
  • the set of network element types existing in the system is N ⁇ r ⁇ r ⁇ r ⁇ , ..., n ; . , ... ⁇
  • the Cartesian product of the network element type ⁇ and the alarm cause C can be divided into multiple alarm subsets A Wi , Ci , A i , c 2 nj Cj o
  • Step S102 Combine the obtained subset of alarms arbitrarily, and calculate the support degree of the two alarm subsets in each combination in the historical alarm ensemble;
  • the support level of any two alarm subsets in the historical alarm ensemble can be expressed as:
  • the first threshold can be set by the user or the expert according to the actual situation.
  • Step S103 if the support degree in the step S102 is greater than the first threshold, the alarm subset of the two alarm subsets is respectively calculated under the condition that the alarm exists in the alarm subset, and the other alarm subset alarm Conditional probability of existence at the same time;
  • the first threshold may be set by the user or the expert according to the actual situation; the conditional probability indicates the ratio of the number of alarms existing in the two alarm subsets to the number of alarms in the alarm subset as conditions.
  • NE type ⁇ ⁇ network element present on the alarm reason under conditions alarm c y the NE type alarm reasons exist NE n x of the alarm and NE type c y is [eta]; ⁇
  • the network element has a probability that the alarm caused by the alarm is present at the same time. This will involve the determination that the alarms exist in two different alarm subsets.
  • the absolute value of the time difference between two alarms in two different alarm subsets is less than the first time factor T1 and the alarm is cleared after the fault is processed
  • the absolute value of the time difference is less than the set second time factor T2 (the first time factor T1 and the second time factor T2 are specified according to specific system conditions, the default value is 1 minute), then it is determined that the two alarms exist simultaneously.
  • Step S104 If the condition probability in step S103 is greater than the second threshold, determine that the alarm in the alarm subset as a condition in the process of calculating the condition probability is a root alarm relative to the alarm in the other alarm subset.
  • the network element type ⁇ if the alarm of the alarm cause c y exists on the network element of the network element type n x in the step S103, the network element type ⁇ ;
  • the conditional probability of the alarm is greater than the second threshold (the second threshold can be set by the user or the expert according to the actual situation), and then the alarm in the alarm subset can be determined to be the root alarm relative to the alarm in the middle, and the same end is
  • the alarm in ⁇ /3 ⁇ 4, ⁇ in the end connection is a redundant alarm, which can then be used to mask or suppress the relative redundant alarms in the same end-to-end connection.
  • the greater the value of the above conditional probability that is, the greater the confidence, indicating the subset of alarms.
  • Alarm and alarm subsets in The stronger the correlation between the alarms in the end, then on the same end-to-end connection,
  • the root fault is a network element in which the alarm occurring in the alarm subset ⁇ exists, and the alarm can be determined to be a relative root alarm, and the root alarm can be used to shield or suppress the relative redundant alarm.
  • the associated alarm classifications k ni , Cj and A , C y whose support is greater than a specified value (for example: 1% ) and whose confidence is greater than a specified value (for example: 80% ) are listed. After being filtered, it is added to the integrated network management system. It can be used as the root alarm.
  • the network element type is ⁇ ⁇
  • the alarm cause c y alarm to shield or compress the relative redundant alarm on an end-to-end connection.
  • the element type is ⁇ ; • The alarm is caused by an alarm).
  • the computational complexity of the massive historical alarm data is solved, and the rooting alarm can be automatically analyzed based on the alarm mining of the network element connection relationship in the end-to-end model, and it can be determined that the root fault is present in the analysis.
  • the rooting alarm can be automatically analyzed based on the alarm mining of the network element connection relationship in the end-to-end model, and it can be determined that the root fault is present in the analysis.
  • On one of the NEs where the root alarm is located find the association rule between the root alarm and the redundancy alarm based on the end-to-end connection, and greatly improve the alarm compression ratio of the integrated network management.
  • FIG. 4 is a flow chart showing an application example of a method of alarm data analysis according to the present invention, including:
  • Step S01 Put the historical alarm data into the historical alarm table HisAlarm, and then perform data cleaning, mainly to clear the alarm data and the repeated alarm data with abnormal time.
  • Step S02 Statistics history alarm table The number of records of historical alarm data in HisAlarm M.
  • Step S03 Create multiple alarm sub-tables HisAlarm_[NetypeID]_[CauseID] according to the NE type NetypelD and the Cartesian product cycle of the cause of the cause.
  • Step S04 The alarm sub-table of the statistical network element type ⁇ ⁇ and the alarm cause is C
  • the number of records of the alarm record Record_[ ⁇ ⁇ ]" in HisAlarmJ ⁇ ⁇ ]"] is iV i" x , c y .
  • Step S05 According to the alarm sub-list HisAlarm_[ ⁇ ⁇ ]" C y ] and the alarm sub-list HisAlarmJ ⁇ ._ [ C ] Constructs the alarm record R ecor d_[ ⁇ ⁇ ]_[ C y ] and the associated alarm sub-list associated with the alarm record Record_[ n ; ]_[ C ] ] Corelation_[ ⁇ ; ]_[ C ⁇ ] ⁇ ⁇ ]_[ C y ], the specific method is as follows:
  • end-to-end model in the end-to-end management of the system, which records all end-to-end connection information, which is the network element through which an end-to-end connection passes.
  • the network elements where Record—[ ⁇ ; ⁇ ⁇ [ ( ⁇ ;! and Record_[ ⁇ ⁇ ]_[ ] are the network element ⁇ _[ ⁇ . ]” c ] and the network element E_[ ⁇ ⁇ ]_[ C y
  • ⁇ _[ ⁇ ; ⁇ ]_[ ] and NE_[ ⁇ ⁇ ]_[ C y ] exist in any end-to-end connection, it indicates that the network elements of the two alarm records are connected.
  • Step S06 Count the number of records of the associated alarm in the Corelation_[ n ; . ]"n x ]_[ C y ] table
  • Step S07 Clear all intermediate tables and summarize all the analysis results according to M, M 3 ⁇ 4, c v , and confidence
  • M is the number of records of historical alarms
  • ⁇ is the number of records in which the network element type is ⁇ ; ⁇ and the cause of the alarm is;
  • ⁇ x , c y is the number of records of the alarm whose network element type is the alarm cause C y ;
  • M is the number of records of historical alarms
  • the alarm number of Cy and the same end-to-end connection have the number of records with the NE type being ⁇ ; and the alarm cause is the simultaneous occurrence of the alarm.
  • Step S08 If the above-mentioned confidence level is greater than the second threshold, it may be determined that the alarm in the alarm subset as a condition is a root alarm relative to the alarm in another alarm subset, and the root alarm may be used to shield the relative redundancy alarm. ;
  • the analysis method can perform alarm data mining and analysis on the massive historical alarm data stored in the database based on the connection relationship of the network elements of the end-to-end model in the system, and can automatically discover the association rules of the root alarm and the redundant alarm, and then The root alarm is used to compress and suppress the corresponding redundant alarms, which can effectively reduce the number of active alarms in the integrated network management system, so that the operation and maintenance personnel can accurately locate the faulty network element and distribute the trouble ticket to the relevant personnel for network maintenance.
  • the method and system for analyzing alarm data provided by the present invention solves the problem of computational complexity of massive historical alarm data, and can automatically perform alarm mining based on the connection relationship of network elements in the end-to-end model to analyze the root alarm, which can be determined.
  • the root fault is the one of the network elements in which the root alarm is analyzed.
  • the association rule between the root alarm and the redundant alarm based on the end-to-end connection is found, which greatly improves the alarm compression ratio of the integrated network management. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

L'invention concerne un procédé d'analyse de données d'alarme et un système associé. Ce procédé, appliqué dans un système doté d'un modèle poste à poste indiquant une relation de connexion d'éléments de réseau, consiste : à diviser un ensemble de données complet d'alarmes historiques en une pluralité de sous-ensembles d'alarmes en fonction de types d'éléments de réseau et de causes d'alarme (S101); à combiner deux sous-ensembles d'alarmes divisés et à calculer un degré de support de deux sous-ensembles d'alarmes dans chaque type de combinaison à l'intérieur de l'ensemble de données complet d'alarmes historiques (S102); si le degré de support est supérieur à un premier seuil, en fonction de chaque sous-ensemble d'alarmes de ces deux sous-ensembles, à calculer les probabilités conditionnelles de présence d'alarmes dans d'autres sous-ensembles d'alarmes, dans la présence simultanée d'alarmes de chaque sous-ensemble, respectivement (S103); si la probabilité conditionnelle est supérieure à un deuxième seuil, à déterminer que les alarmes du sous-ensemble d'alarmes, qui servent de conditions, sont des alarmes principales par rapports aux alarmes d'autres sous-ensembles (S104).
PCT/CN2010/072901 2009-08-10 2010-05-18 Procede d'analyse de donnees d'alarme et systeme associe WO2011017955A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200910165845.5 2009-08-10
CN200910165845.5A CN101997709B (zh) 2009-08-10 2009-08-10 一种根告警数据分析的方法及其系统

Publications (1)

Publication Number Publication Date
WO2011017955A1 true WO2011017955A1 (fr) 2011-02-17

Family

ID=43585918

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2010/072901 WO2011017955A1 (fr) 2009-08-10 2010-05-18 Procede d'analyse de donnees d'alarme et systeme associe

Country Status (2)

Country Link
CN (1) CN101997709B (fr)
WO (1) WO2011017955A1 (fr)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103916260A (zh) * 2013-01-08 2014-07-09 中国移动通信集团浙江有限公司 一种告警关联的装置及方法
CN104518905A (zh) * 2013-10-08 2015-04-15 华为技术有限公司 一种故障定位方法及装置
CN105577404A (zh) * 2014-10-14 2016-05-11 中国移动通信集团山东有限公司 一种网络告警信息关联处理方法及装置
WO2020182051A1 (fr) * 2019-03-08 2020-09-17 华为技术有限公司 Procédé de reconnaissance d'une alarme de cause profonde probable, appareil et support de stockage informatique

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104753861A (zh) * 2013-12-27 2015-07-01 中国电信股份有限公司 安全事件处理方法和装置
CN105827422B (zh) * 2015-01-06 2018-12-07 中国移动通信集团上海有限公司 一种确定网元告警关联关系的方法及装置
CN105187255B (zh) * 2015-09-29 2018-08-14 华为技术有限公司 故障分析方法、故障分析装置和服务器
CN106250288A (zh) * 2016-07-29 2016-12-21 浪潮软件集团有限公司 一种基于数据挖掘的根告警分析识别方法
CN108600009B (zh) * 2018-04-25 2021-03-30 北京思特奇信息技术股份有限公司 一种基于告警数据分析的网络告警根源定位方法
CN108847994B (zh) * 2018-07-25 2021-10-15 山东中创软件商用中间件股份有限公司 基于数据分析的告警定位方法、装置、设备以及存储介质
CN109687999A (zh) * 2018-12-11 2019-04-26 山东中创软件商用中间件股份有限公司 一种告警故障的关联分析方法、装置及设备
CN112073208B (zh) 2019-05-25 2022-01-14 成都华为技术有限公司 一种告警分析方法、装置、芯片系统、存储介质
CN111267908A (zh) * 2020-02-26 2020-06-12 深圳市中兴系统集成技术有限公司 一种应用于轨道交通的集中告警系统及告警处理方法
CN114050974B (zh) * 2021-10-15 2023-06-23 中国联合网络通信集团有限公司 一种拓扑准确度的确定方法、装置及计算机可读存储介质

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101247269A (zh) * 2008-03-05 2008-08-20 中兴通讯股份有限公司 一种自动发现判定冗余告警的关联规则的方法
CN101355451A (zh) * 2008-09-09 2009-01-28 中兴通讯股份有限公司 一种告警相关性分析方法及系统

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100531052C (zh) * 2006-03-13 2009-08-19 中国电信股份有限公司 一种用于多厂商dwdm网管系统的根告警分析方法

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101247269A (zh) * 2008-03-05 2008-08-20 中兴通讯股份有限公司 一种自动发现判定冗余告警的关联规则的方法
CN101355451A (zh) * 2008-09-09 2009-01-28 中兴通讯股份有限公司 一种告警相关性分析方法及系统

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103916260A (zh) * 2013-01-08 2014-07-09 中国移动通信集团浙江有限公司 一种告警关联的装置及方法
CN104518905A (zh) * 2013-10-08 2015-04-15 华为技术有限公司 一种故障定位方法及装置
CN105577404A (zh) * 2014-10-14 2016-05-11 中国移动通信集团山东有限公司 一种网络告警信息关联处理方法及装置
CN105577404B (zh) * 2014-10-14 2019-03-15 中国移动通信集团山东有限公司 一种网络告警信息关联处理方法及装置
WO2020182051A1 (fr) * 2019-03-08 2020-09-17 华为技术有限公司 Procédé de reconnaissance d'une alarme de cause profonde probable, appareil et support de stockage informatique

Also Published As

Publication number Publication date
CN101997709B (zh) 2014-03-12
CN101997709A (zh) 2011-03-30

Similar Documents

Publication Publication Date Title
WO2011017955A1 (fr) Procede d'analyse de donnees d'alarme et systeme associe
JP7100155B2 (ja) アラームログ圧縮方法、装置、およびシステム、並びに記憶媒体
CN110661659B (zh) 一种告警方法、装置、系统及电子设备
US10666525B2 (en) Distributed multi-data source performance management
US20200259716A1 (en) Hierarchical network analysis service
US10108411B2 (en) Systems and methods of constructing a network topology
CN113328872B (zh) 故障修复方法、装置和存储介质
US20200106690A1 (en) Adaptive metric collection, storage, and alert thresholds
US11012461B2 (en) Network device vulnerability prediction
JP6097889B2 (ja) 監視システム、監視装置、および検査装置
US20170277727A1 (en) Identification of distinguishing compound features extracted from real time data streams
CN110535713B (zh) 监控管理系统以及监控管理方法
US20200341868A1 (en) System and Method for Reactive Log Spooling
CN105610648A (zh) 一种运维监控数据的采集方法及服务器
WO2022127435A1 (fr) Procédé et appareil de traitement d'alarmes, dispositif et support de stockage lisible
CN114461792A (zh) 告警事件关联方法、装置、电子设备、介质及程序产品
CN108304293A (zh) 一种基于大数据技术的软件系统监控方法
CN113595776B (zh) 监控数据处理方法与系统
US11789804B1 (en) Identifying the root cause of failure observed in connection to a workflow
US9898357B1 (en) Root cause detection and monitoring for storage systems
CN113409876A (zh) 一种故障硬盘的定位方法及系统
CN113254313A (zh) 一种监控指标异常检测方法、装置、电子设备及存储介质
CN109388546B (zh) 处理应用程序的故障的方法、装置和系统
CN114422324B (zh) 一种告警信息的处理方法、装置、电子设备及存储介质
TWI712880B (zh) 資訊服務可用性管理方法及系統

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 10807900

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 10807900

Country of ref document: EP

Kind code of ref document: A1