WO2011116615A1

WO2011116615A1 - Processing method for alarm level and alarm server

Info

Publication number: WO2011116615A1
Application number: PCT/CN2010/079837
Authority: WO
Inventors: 董波; 王巍; 胡刚; 丁丽洁; 张玲东; 陈子晔; 刘晓宇; 伏晓海
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-03-24
Filing date: 2010-12-15
Publication date: 2011-09-29
Also published as: CN102201928A

Abstract

A processing method for alarm level and an alarm server are provided by the present invention, said method includes the following steps: configuring alarm level adjustment information (S102); the alarm server receives an alarm and performs recording (S104); the alarm server adjusts the alarm level according to the recorded information and the pre-configured alarm level adjustment information (S106). The present invention enhances the security of the system.

Description

The present invention relates to the field of communications, and in particular to an alarm level processing method and an alarm server. BACKGROUND OF THE INVENTION A fault management system mainly observes and analyzes status information reported by each network element, and timely and accurately discovers abnormal conditions in network operation, accurately locates faults, isolates faults, and resolves faults. The most important function in the fault management system is the alarm function. This function is generally sent to the alarm server after the alarm collection process receives the alarm from the alarm source. After receiving the alarm from the alarm collection process, the alarm server adds the alarm. After the analysis and processing, the alarm database is updated, and a message is sent to notify the client interface such as WEB to perform real-time update display. In the existing fault management system, each type of alarm has been set according to its impact on the entire system, and is set to a corresponding fixed alarm level (for example, the correspondence can be written in the alarm configuration library), and the alarm server For the collected alarm code, the read alarm configuration database matches the corresponding relationship, updates the current alarm database, and sends a message to notify the client interface such as WEB to perform real-time refresh display. It can be seen from the above that in the existing fault management system, the alarm level of each alarm code is fixed. Some alarms have a low level. Even if the alarm is repeated, it is easy to be ignored. However, recurring low-level alarms may mean that important situations have occurred. For example, illegal molecular malicious brute force systems are assigned to peripheral devices. The password (the alarm level of the wrong password is not high). In the existing fault management system, it is easy to ignore the repeated alarms, which may cause security risks. SUMMARY OF THE INVENTION A primary object of the present invention is to provide an alarm level processing scheme to solve at least one of the above problems. According to an aspect of the present invention, an alarm level processing method is provided, the method comprising the steps of: pre-configuring information of an alarm level adjustment; receiving an alarm by the alarm server, and performing the recording The alarm server adjusts the alarm level based on the recorded information and the pre-configured information of the alarm level adjustment. Further, the alarm server receives the alarm and records the number of times the alarm is received, and adjusts the level of the alarm if the number of times reaches a pre-configured threshold. Further, the number of times the alarm server records the received alarm includes: the alarm server determines whether the time interval between the currently received alarm and the previous received alarm meets a predetermined condition, and if the determination result is yes, the alarm server Increase the number of records, otherwise the number of records will remain the same. Further, the alarm server receives the alarm, records the time when the alarm is received, and determines the time interval from the previous time when the alarm is received according to the time, and adjusts the level of the alarm if the time interval meets the pre-configured time interval. Further, the alarm server adjusts the alarm level according to the recorded information and the pre-configured alarm level adjustment information, including: the alarm server pre-configures the threshold level of the alarm level, and determines whether the adjusted alarm level exceeds the threshold value. When the threshold is exceeded, the level of the alarm is set to the threshold. Further, the method further includes: after the alarm server determines to adjust the level of the alarm, the alarm server sends the alarm to the alarm client. According to another aspect of the present invention, an alarm server is further provided, including: a configuration module, configured to configure information for adjusting an alarm level; a recording module, configured to receive an alarm, and perform recording; and an adjustment module, configured to record The information and the pre-configured alarm level adjustment information adjust the level of the alarm. Further, the recording module records the number of times the alarm is received, and the adjustment module adjusts the level of the alarm if the number of times reaches a pre-configured threshold. Further, the foregoing alarm server further includes: a determining module, configured to determine whether a time interval between the currently received alarm and the previously received alarm meets a predetermined condition; and the recording module determines that the judgment result of the module is yes , increase the number of records, otherwise the number of records will remain the same. Further, the recording module records the time when the alarm is received, and the adjusting module determines the time interval from the previous time receiving the alarm according to the time, and adjusts the level of the alarm if the time interval satisfies the pre-configured time interval. According to the present invention, the alarm server receives the alarm and records the information of the receiving operation. The alarm server adjusts the level of the alarm according to the information, and solves the problem that the system may have a security risk due to the fixed alarm level in the related art. It also implements the ability to configure the adjustment information of the alarm level to make the processing of the alarm more flexible. System security is enhanced by the present invention. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, In the drawings: FIG. 1 is a flowchart of a method for processing an alarm level according to an embodiment of the present invention; FIG. 2 is a structural block diagram of an alarm level processing apparatus according to an embodiment of the present invention; FIG. 4 is a structural block diagram of an alarm level processing system according to an embodiment of the present invention; FIG. 5 is a flowchart showing a service implementation according to an embodiment of the present invention; and FIG. 6 is a flowchart according to the present invention. A flow chart of the operation of the configuration of the example. BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. In this embodiment, an alarm is processed, and FIG. 1 is a flowchart of an alarm level processing method according to an embodiment of the present invention. As shown in FIG. 1, the flow includes the following steps: Step 4: S 102 , configure the information of the alarm level adjustment; In step S104, the alarm server receives the alarm and performs recording. In this step, the alarm server can record the information about the action of receiving the alarm, for example, the time and the number of times the alarm is received, and the information of the alarm itself, such as the time information carried in the alarm. In step S106, the alarm server adjusts the level of the alarm according to the recorded information and the information of the pre-configured alarm level adjustment. For example, the recorded information may include previously recorded information that receives the same alarm and/or is currently received. information. Through the above steps S102 to S106, the alarm server can dynamically adjust the level of the alarm according to the condition that the alarm is received. Compared with the fixed level of the alarm in the prior art, it is possible to avoid ignoring the low level alarm and provide the security of the system. In addition, the above-mentioned steps can flexibly configure the information of the alarm level adjustment according to the actual situation, so as to improve the flexibility of the alarm server to process alarms. Preferably, the alarm server can adjust the level of the alarm by recording the number of times the alarm is received and when the number of times reaches a pre-configured threshold. The number of times used as the basis for adjusting the alarm level can effectively handle recurring alarms. For example, the password assigned to the peripheral device by the illegal molecular malicious brute force system can be found in time. Preferably, the alarm server can also record the time when the alarm is received, and determine the time interval from the previous time the alarm is received according to the current time of receiving the alarm, and adjust the alarm level according to the time interval. For example, one can be pre-configured. The time interval is: when the time interval for receiving the alarm meets the pre-configured time interval, the level of the alarm is adjusted, where the pre-configured time interval may be greater than or less than a pre-configured time interval, or Equal to the pre-configured time interval. Adjusting the alarm level according to the receiving time interval can improve the level of alarms that are frequently received in a short period of time, and can also reduce the level of alarms that have not been received for a long time. For example, if the interval between two received alarms is less than 1 minute, the level of the alarm is increased. If the interval between receiving the alarms exceeds 12 hours, the level of the alarm can be lowered. It should be noted that the receiving time of the alarm may be the time when the alarm server receives the alarm, for example, the time when the alarm collecting process collects the alarm in the alarm server; the receiving time of the alarm may also be the time carried by the alarm itself. For example, the time carried in the alarm. Of course, the combination may also be combined with the above adjustment manner. For example, the alarm server determines whether the time interval between the currently received alarm and the previous received alarm meets a predetermined condition, and if the determination result is yes, the alarm The server increases the number of records, otherwise the number of records is kept the same. When the number of times has accumulated to a certain value, adjust the level of the alarm. This can make the statistics of the number of alarms more effective. To prevent the alarm level from being increased or decreased in an unrestricted manner, the alarm server can set the threshold level of the alarm level and determine whether the level of the adjusted alarm exceeds the threshold. If the threshold is exceeded. , set the alarm level to the threshold. Preferably, the alarm server may send the alarm to the alarm client after determining the level of adjusting the alarm, so that the interaction between the alarm server and the alarm client may be reduced. In addition, after the alarm is restored, for example, after receiving the alarm recovery message corresponding to the alarm, the alarm server may restore the level of the alarm to a default level. The foregoing various embodiments may be implemented by adding an alarm level management module, and the alarm level management module may be configured in an alarm server. The alarm level can be set by the user. In order to make the user manage the alarm level more conveniently, the module can functionally include the following two parts: FIG. 2 is a structural block diagram of an alarm level processing apparatus according to an embodiment of the present invention. This will be described below in conjunction with FIG. 2. The first part dynamically updates the configuration part of the alarm level (configuration module 22). The part can be configured to perform at least one of the following: an alarm code selection of the upgrade level, an initial alarm level of the alarm code, an alarm level of the alarm code, and an alarm code. Increased alarm severity, alarm code alarm upgrade interval threshold, alarm code alarm upgrade frequency threshold, and whether the identifier is enabled. If the alarm code is configured with the information that needs to be dynamically raised, and the configuration is enabled, the alarm server dynamically adjusts the alarm level based on the information and the current alarm status. The alarm is sent to the alarm client. The alarm client receives the alarm. The news, real-time update display. This configuration section provides a user-friendly interface, an external interface, and an interface for user configuration. At the same time, the alarm system is more flexible and applicable, which can better meet the needs of users and improve product competitiveness. The second part is a service implementation part (or an alarm level processing device) that dynamically increases the alarm level. As shown in FIG. 2, the device includes: a recording module 24, configured to receive an alarm and record; The adjustment module 26 is coupled to the recording module 24 for adjusting the level of the alarm based on the recorded information and the pre-configured information of the alarm level adjustment. The recording module 24 can record the number of times the alarm is received, and the adjustment module 26 adjusts the level of the alarm when the number of times reaches the threshold. 3 is a block diagram of a preferred structure of an alarm level processing apparatus according to an embodiment of the present invention. The apparatus may further include: a determining module 32 connected to the recording module 24 for determining the currently received alarm and the previously received alarm. Whether or not the time interval satisfies the predetermined condition; if the judgment result of the determination module 32 is YES, the recording module 24 increases the number of times of recording, otherwise the number of times of maintaining the record does not change. The recording module 24 can also record the time when the alarm is received. The adjustment module 26 determines the time interval from the previous time receiving the alarm according to the time, and adjusts the level of the alarm if the time interval satisfies the pre-configured time interval. Through the above device, the alarm server can be added to the alarm buffer after receiving the alarm message, and determine whether the alarm level needs to be upgraded according to the newly obtained dynamic elevation alarm level configuration table and the current alarm table. If the alarm level needs to be improved, the alarm level is modified and a message is sent to the client to update the display on the interface. The alarm database is updated to achieve the purpose of dynamically increasing the alarm level. And, by using the foregoing device, the received multiple alarm information is compared with the configured lifting threshold and the lifting interval analysis, and the enhanced sending message is sent to the alarm client to update the real-time update interface, and the alarm server updates the real-time alarm database. The number of interactions between the alarm server and the alarm client, the alarm server, and the alarm database is reduced, thereby reducing the impact of frequent alarms on the system. The tables used in the present embodiment are exemplified below. Of course, the contents of the tables may be adjusted according to actual needs. The following is merely an exemplary description, and the present invention is not limited thereto. Dynamically enhanced alarm level configuration table: This table is used to record the user's demand for the alarm level. The alarm code, the initial alarm level, the alarm increment level, the upper limit of the alarm level, the alarm upgrade interval threshold, and the alarm upgrade frequency threshold. . The alarm code can be used as the unique index of the table. Current alarm table: This table is used to record the current alarm code, including: alarm description, time of occurrence, frequency of occurrence, current alarm level, and network element information. Historical alarm table: used to record the recovered alarm code, alarm description, time of occurrence, recovery time, and network element information. Alarm configuration table: Used to record the corresponding relationship between the alarm code and the alarm description. 4 is a schematic structural diagram of a structure of an alarm level processing system according to an embodiment of the present invention. The system includes the following modules: An alarm source 101: is composed of devices distributed in various places, service nodes, and the like, when they fail or When an alarm is required to be reported, an alarm message is sent to the alarm collection process 102. The alarm message may include: an alarm code, a module identifier, an alarm topic, an alarm level, and an alarm time. The alarm collection process 102: collects and receives the alarms from the distributed alarm source 101, and forwards the alarms to the alarm server 103. The alarm collection process 102 can be set in the alarm server 103. At the same time, the process can avoid a large number of alarm impact alarm servers 103. , there is an alarm buffer function. The alarm server 103 is a service core processing module of the fault management system, and is mainly responsible for receiving and processing the alarm information collected and forwarded from the alarm collection process 102. After receiving the alarm message, the alarm server 103 joins the alarm buffer, and determines whether the alarm level needs to be upgraded according to the newly obtained dynamic elevation alarm level configuration table and the current alarm table. The alarm client 104 is displayed in real time to update the interface, and the current alarm table in the alarm database 105 is updated to achieve the purpose of dynamically increasing the alarm level. The alarm client 104: provides a friendly user interface (for example, a WEB page, an alarm box, etc.), and the alarm client is an external interface implemented, and is also an communication path for the user to implement his own needs. The functions provided by the alert client 104 include:

1. Provide the user with an interface configuration that dynamically raises the alarm level. After the user determines the tampering configuration operation, the configuration is updated to the dynamic elevated alarm level configuration table in the alarm database 105; after the user performs the synchronization configuration operation, a message is sent to the alarm server 103. After receiving the message, the alarm server 103 updates the dynamic elevation alarm level configuration table in its own memory.

2. Display alarm information such as alarm code, module ID, alarm topic, alarm level, and alarm time to the user in real time.

3. Provide query history alarm function. Alarm database 105: A storage container for information such as alarm configuration data, current alarms, and historical alarms. The functions provided by the alarm database 105 include:

1. Receive the current alarm update request from the alarm server 103 and update the current alarm table.

2. Receiving a query request from the current alarm information when the alarm server 103 is started and dynamically raising the alarm level configuration information, and providing corresponding data.

3. Receive a dynamic elevation alarm level configuration update request from the alarm client 104, and update the dynamic elevation alarm level configuration table.

4. Receive the request from the alarm client 104 to dynamically raise the alarm level configuration, historical alarms, etc., and provide corresponding data. FIG. 5 is a flowchart of a service implementation according to an embodiment of the present invention. The process includes the following steps: Step S501: After receiving an alarm of an alarm source, the alarm collection process forwards the alarm to the alarm server, so as to avoid a large number of alarm impact alarm servers, After the alarm is buffered, the alarm server adds the alarm that is sent by the alarm collection process to the alarm buffer. Step S502: In the latest synchronization information of the alarm client, the alarm server obtains the dynamic elevation alarm level configuration table. The information is updated in the memory; in step S503, the alarm server determines, from the information obtained in step S502, whether the dynamic alarm level function of the alarm code is enabled. If not, the normal alarm process is started; if enabled, the step is performed. S 504; Step S504, the alarm server searches for the existence of the alarm code according to the current alarm table information in the memory. If not, the process proceeds to step S505. If yes, the alarm server obtains all the current alarm information of the alarm code. S506; Step S505, alarm service The alarm is generated according to the initial alarm level of the alarm code in the dynamic alarm level configuration table. If the information is obtained in step S506 and steps S503 and S504, the alarm server compares the two information, and determines that the alarm code alarm interval or frequency exceeds If the threshold is not exceeded, step S505 is performed; if yes, step S507 is performed; Step S507: When the alarm code alarm time interval or frequency exceeds the configured threshold, the alarm service semaphore alarm device increases the configured alarm increment level based on the current alarm level. After the upgrade is compared with the configured upper alarm threshold, if the upper limit is less than the upper limit, the increased alarm level is used. If the upper limit is greater than or equal to the upper limit, the upper alarm limit is used. In step S508, the alarm server processes the alarm in step 5. The level and other information sends a message to the client for real-time update display of the interface, and updates the alarm database. 6 is a flow chart showing the operation of a configuration according to an embodiment of the present invention, the flow comprising the following steps:

Increased police level

Step S601: The user who has the function of dynamically increasing the alarm level configuration operation is logged in to the alarm management client, and the alarm client reads the previous configuration information from the dynamic promotion alarm level configuration table of the alarm database and displays it on the interface. Step S602, The user selects an alarm code to raise the alarm level, and the interface displays the alarm topic corresponding to the alarm code, so that the user can confirm the correctness of the selection. Step S603, in the user demand, the alarm code selected in step S602 on the alarm client interface. Continue to modify the initial alarm level, the alarm increment level, the upper limit of the alarm level that can be upgraded, the alarm upgrade interval threshold, the alarm upgrade frequency threshold information, whether it is enabled, etc.

Advertise

After the step S604 is performed, after the modification or the adding operation of the step S603 is completed, the user clicks the OK button, and the alarm client updates the configuration information to the dynamic elevated alarm level configuration table of the alarm database. Step S605, complete the steps. After the operation of the S604, the user clicks the synchronization button, and the alarm client sends the configuration information to the alarm server in the form of a message. In step S606, the alarm server updates the information in the obtained dynamic elevation alarm level configuration table to the memory. , prepare for subsequent business process processing. A preferred embodiment will now be described in conjunction with the above-described embodiments and preferred embodiments thereof. The user is configured on the alarm client as shown in Table 1 below. Can be improved

Alarm description Initial report Alarm upgrade time

Alarm

Police level interval threshold

Level Limit threshold

ESME j § & earth

Mouth

201 notices

Loss of binding

0 police (1 level 3 minutes 2 times yes

Police {2 level}

It is required that the alarm code and the alarm description are in a one-to-one correspondence. The corresponding relationship is that the alarm source has been negotiated with the alarm client and stored in the alarm configuration table of the alarm database. When the user selects the alarm code, the alarm client will query the alarm configuration table to display the corresponding alarm description information to the user according to the alarm code. The following is a description of a pair of processing flows in the following table. The processing flow includes the following steps: Step S701, assuming that the fault management system does not currently have an alarm of "alarm code 2010-ESME binding failure ^: step S702, the alarm server receives the first 1 alarm code 2010, according to the alarm promotion configuration information, the alarm promotion function of the alarm code is enabled, and the alarm server retrieves the current alarm table information in the memory, but finds that the alarm code does not exist; the alarm server sends a message to The alarm client displays the interface and updates the alarm database (alarm code 2012, alarm level: level 1). After the processing is successful, the alarm server internally sets the alarm frequency to 0. Step S703, step S702, within 3 minutes after processing, The alarm server receives the alarm code 2010 for the second time. According to the alarm promotion configuration information, the alarm is found to be smaller than the alarm upgrade interval threshold. The alarm server does not process the fault. Step S704, after 3 minutes after the processing in step S703, the alarm server receives the third time. Go to alarm code 2010, and find that it is greater than the alarm upgrade interval threshold according to the alarm promotion configuration information. The alarm server internally receives the alarm frequency +1. According to the alarm promotion configuration information, it is found that the alarm is less than the alarm upgrade frequency threshold, and the alarm server does not process it. Step S705: After S3, the alarm server receives the alarm for the fourth time. code

In 2010, according to the alarm promotion configuration information, it is found that the alarm is upgraded to the alarm interval. The alarm is +1. The alarm is upgraded. The alarm is equal to the alarm upgrade threshold (2 times). The alarm server finds that the current alarm level (level 1) is less than the upper limit of the alarm level that can be upgraded (level 2). The alarm server sends a message to the alarm client for interface display and updates the alarm database (alarm code 2012, alarm level: 2) After the processing is successful, the alarm server internally sets the alarm frequency to 0.

10 P39895 Step S706, after 3 minutes of processing in step S705, the alarm server receives the alarm code 2010 for the fifth time, and according to the alarm promotion configuration information, it is found that the alarm is greater than the alarm update interval threshold, and the alarm frequency received by the alarm server is +1; According to the alarm promotion configuration information, the alarm server is found to be less than the alarm upgrade frequency threshold, and the alarm server does not process the processing. Step S707: After 3 minutes after the processing in step S706, the alarm server receives the alarm code for the sixth time.

In 2010, according to the alarm promotion configuration information, it is found that the alarm is upgraded to the alarm interval. The alarm is +1. The alarm is upgraded. The alarm is equal to the alarm upgrade threshold (2 times). The alarm server finds that the current alarm level (level 2) is equal to the upper limit of the alarm level that can be upgraded (level 2), and the alarm server does not process the processing. Step S708: After the alarm server receives the alarm recovery message of the alarm code 2010, the alarm server sends a message. The alarm client is displayed on the interface and the alarm database is updated (alarm code 2012, alarm recovery). After the processing is successful, the alarm server internally sets the alarm frequency to 0. At this point, the process returns to step 4 to gather S701. In summary, the above-mentioned embodiments solve the problem that the alarms in the related art are easily ignored due to the fixed alarm level, which causes the system to have security risks, thereby achieving the effect of enhancing system security. Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module. Thus, the invention is not limited to any particular combination of hardware and software. The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the scope of the present invention are intended to be included within the scope of the present invention.

Claims

Claim

An alarm level processing method, which is characterized by comprising the following steps:

Pre-configure information about alarm level adjustment;

The alarm server receives the alarm and records it;

The alarm server adjusts the level of the alarm according to the recorded information and the pre-configured information of the alarm level adjustment.

2. The method according to claim 1, wherein the alarm server receives the alarm and records the number of times the alarm is received, and adjusts if the number reaches a pre-configured threshold. The level of the alarm.

The method according to claim 2, wherein the number of times the alarm server records the receipt of the alarm includes:

The alarm server determines whether the time interval between the currently received alarm and the previously received alarm meets a predetermined condition, and if the determination result is yes, the alarm server will record The number of times increases, otherwise the number of times the record is maintained is unchanged.

The method according to claim 1, wherein the alarm server receives the alarm, records the time when the alarm is received, and determines, according to the time, that the alarm was received the previous time. The time interval, the level of the alarm is adjusted if the time interval satisfies a pre-configured time interval.

The method according to any one of claims 1 to 4, wherein the information recorded by the alarm server and the pre-configured information of the alarm level adjustment adjust the level of the alarm includes:

The alarm server pre-configures a threshold value of the level of the alarm, and determines whether the level of the adjusted alarm exceeds the threshold. If the threshold is exceeded, the alarm is The level is set to the threshold.

The method according to any one of claims 1 to 4, further comprising: after the alarm server determines to adjust the level of the alarm, the alarm server sends the alarm to the alarm client.

7. An alarm server, comprising:

A configuration module, configured to configure information about alarm level adjustment;

a recording module, configured to receive an alarm and record;

The adjustment module is configured to adjust the level of the alarm by using the information recorded and the pre-configured information of the alarm level adjustment.

The alarm server according to claim 7, wherein the recording module records the number of times the alarm is received, and the adjusting module adjusts the alarm if the number of times reaches a pre-configured threshold. Level.

The alarm server according to claim 8, further comprising: a determining module, configured to determine whether a time interval between the currently received alarm and the previously received alarm meets a predetermined condition ;

The recording module increases the number of times of recording when the determination result of the determination module is YES, otherwise the number of times of maintaining the record does not change.

The alarm server according to claim 7, wherein the recording module records the time when the alarm is received, and the adjusting module determines, according to the time, a time interval from the previous receipt of the alarm, And adjusting the level of the alarm if the time interval satisfies a pre-configured time interval.