WO2011157012A1

WO2011157012A1 - Method for generating alarm association graph and device thereof, and method for determining association alarm and device thereof

Info

Publication number: WO2011157012A1
Application number: PCT/CN2010/077229
Authority: WO
Inventors: 林伟
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-06-18
Filing date: 2010-09-21
Publication date: 2011-12-22
Also published as: CN102291247A

Abstract

A method and device for generating an alarm association graph, and a method and device for determining association alarms are disclosed. The method for generating an alarm association graph includes the following steps: determining successively two topologic nodes connected physically according to a network equipment topologic graph; acquiring all the alarms currently contained in the two topologic nodes respectively, and searching the alarms therein having association relationships; classifying the alarms having association relationships according to alarm properties, and generating an alarm collection for each alarm type; determining that an association relationship exists between the alarm collection of a first alarm type and the alarm collection of a second alarm type when the calculated probability of the occurrence of the association relationship between the alarm collection of the first alarm type and the alarm collection of the second alarm type, exceeds a first preset probability value,, and displaying the association relationship on the alarm association graph. The method could reflect the association relationships between the alarms simply and directly, and not be restricted to the network size, and be extended easily.

Description

Alarm association graph generation method, device and associated alarm determination method and device

The present invention relates to the field of network management technologies, and in particular, to an alarm association graph generation method, an alarm association graph generation device, an associated alarm determination method, and an associated alarm determination device. Background technique

With the rapid development of communication network technology, communication services are becoming more and more abundant, from the initial telegraph and telephone services to the Internet Protocol (IP, Internet Protocol) and multimedia services. The diversification of communication services is accompanied by a diversification of the types of devices in the communication network, which makes it increasingly difficult to manage and maintain the communication network.

In a communication network, there is an association between each network device. When one of the network devices fails, an alarm is reported. The network device that has a relationship with the failed network device also reports related alarms. It can be seen that the correlation between alarms is particularly important for the management of the entire network. For example, a simple application of an alarm correlation can find the root cause alarm from the massive alarms, that is, find the root cause of the fault.

The existing alarm correlation analysis technology mainly analyzes the alarm association by rules, but the rules need to be predefined. If an alarm can cause a chain reaction of the associated alarms, multiple rules need to be established correspondingly, and the association relationship between different alarms is determined. The complexity is high and the intuitiveness is poor. The network scale is expanding continuously, and the number of rules is bound to increase correspondingly. It is difficult to maintain the network. Summary of the invention

The invention provides a method for generating an alarm association graph, which is used for simply and directly reflecting the association relationship between alarms, and is not limited to the network scale, and is easy to expand. The method includes:

Determining, according to the topology diagram of the network device, two top nodes having physical connections; Obtaining all the alarms that the two top nodes currently have, and finding an alarm with an association relationship;

The alarms of the associated relationship are classified according to the alarm attribute, and the probability of the association between the alarm set of the first alarm type and the alarm set of the second alarm type calculated by each alarm type exceeds the first preset probability. When the value is determined, the alarm set of the first alarm type is associated with the alarm set of the second alarm type, and the association relationship is displayed on the alarm association map.

The present invention also provides a method for determining an association alarm by applying an alarm association graph, which is used to simply and directly reflect the association relationship between alarms, and is not limited to the network scale, and is easy to expand. The method includes:

Determining an alarm type of the alarm when an alarm occurs on the network device;

In the generated alarm association diagram, the alarm set of the other alarm types associated with the alarm type of the alarm type is the same, and the alarm association diagram includes the association relationship between the alarm sets of the alarm types.

Among the alarms included in the alarm set of the associated alarm type, an alarm associated with the alarm is determined.

The present invention also provides an alarm correlation graph generating device for simply and directly reflecting the association relationship between the alarms, and is not limited to the network scale and is easy to expand. The device includes:

a first determining unit, configured to sequentially determine, according to the topology diagram of the network device, two top nodes that have physical connections;

An acquiring unit, configured to separately obtain all the alarms currently existing by the two topology nodes, and search for an alarm having an association relationship therein;

a classification unit, configured to classify alarms having an association relationship according to an alarm attribute, and form an alarm set of each alarm type; a display unit, configured to determine an alarm set of the first alarm type when the probability of occurrence of the association between the calculated alarm set of the first alarm type and the alarm set of the second alarm type exceeds the first preset probability value The alarm set of the two alarm types has an association relationship, and the association relationship is displayed on the alarm association graph.

The present invention also provides an apparatus for applying an alarm correlation map generating device to perform an associated alarm determination, which is used to simply and directly reflect the association relationship between alarms, and is not limited to the network scale and is easy to expand. The device includes:

a second determining unit, configured to determine an alarm type of the alarm when an alarm occurs on the network device;

a search unit, configured to search, in the generated alarm association diagram, an alarm set of other alarm types associated with the alarm set of the alarm type of the alarm, where the alarm association diagram includes an association relationship between alarm sets of each alarm type ;

And a third determining unit, configured to determine, in the alarm included in the alarm set of the associated alarm type, an alarm associated with the alarm.

According to the method provided by the present invention, when an alarm occurs on the network device, determining the alarm type of the alarm, and searching for the alarm set of other alarm types associated with the alarm set having the same alarm type as the alarm in the generated alarm association map, The alarm association diagram includes an association relationship between alarm sets of each alarm type, and an alarm associated with the alarm is determined in an alarm included in the associated alarm set of each alarm type. The association alarm determination method provided by the embodiment of the present invention determines the other alarms associated with the generated alarms by using the alarm association graph. The alarm association graph can directly and effectively reflect the association of the alarm sets of different alarm types by using the characteristics of the image display. Relationships, after receiving an alarm, directly refer to the alarm association graph, and do not need to analyze the alarm association through a predefined rule, which can simply and effectively reflect the association relationship between the alarms, and determine other associations associated with the received alarms. The alarm is used to reduce the complexity of the association between alarms. Because the alarm association graph does not depend on the NE, it is not hard coded by the internal program of the NE. It can be modified according to the actual situation. Therefore, when the network is expanded or reduced, it can be modified according to the increase or decrease of network devices in the network. It is not limited to the network scale and is easy to expand. The alarm correlation graph can be more accurate and fast. Find the source fault. DRAWINGS

FIG. 1 is a flowchart of a method for determining an associated alarm according to an embodiment of the present invention;

2 is an alarm association diagram according to an embodiment of the present invention;

FIG. 3 is a flowchart of a method for generating an alarm association graph in a method for determining an associated alarm according to an embodiment of the present invention;

4 is a connection diagram of an alarm management system according to an embodiment of the present invention;

FIG. 5 is a flowchart of a method for generating an alarm association graph according to an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of a first associated alarm determining apparatus according to an embodiment of the present invention; FIG. 7 is a schematic structural diagram of a second associated alarm determining apparatus according to an embodiment of the present invention; FIG. 9 is a schematic structural diagram of a fourth associated alarm determining apparatus according to an embodiment of the present invention; FIG. 10 is a schematic structural diagram of a first alarm correlation graph generating apparatus according to an embodiment of the present invention; ;

FIG. 11 is a schematic structural diagram of a second alarm correlation graph generating apparatus according to an embodiment of the present invention. detailed description

The alarm correlation analysis technology mentioned in the prior art analyzes the alarm association by using predefined rules. In the case of a large number of rules, the association relationship between different alarms is high in complexity, difficult to implement, and poor in intuitiveness. If the number of rules is increased, the maintenance of the network is difficult. To solve the above technical problem of the existing alarm correlation analysis technology, the embodiment of the present invention provides an association alarm determination method, which uses the alarm association diagram to determine and generate an alarm. Associated other Alarms and alarm correlation graphs can easily and effectively reflect the relationship between alarms. They are not limited to network scale and are easy to expand. They can find source faults more accurately and quickly.

The specific processing flow of the associated alarm determining method provided by the embodiment of the present invention is as shown in FIG. 1 , and includes the following steps:

Step 101: When an alarm occurs on the network device, determine an alarm type of the alarm.

Step 102: Search for an alarm set of other alarm types associated with the alarm type of the alarm type in the generated alarm association diagram, where the alarm association diagram includes an association relationship between alarm sets of each alarm type.

Step 103: Determine an alarm associated with the alarm in the alarm included in the alarm set of the associated alarm type.

In the implementation, the alarm has multiple alarm attributes. For example, multiple alarm attribute types, such as alarm code, alarm level, alarm occurrence time, and alarm recovery time, can be classified into different alarm types. Each alarm has its own alarm type. Step 101: When the network device generates an alarm, the alarm type of the alarm is determined first, for example, a critical alarm or a reminder alarm. The specific alarm type depends on the actual situation.

In the implementation of the step 102, the alarm association diagram of the alarm type associated with the alarm type of the alarm is searched for, and the alarm association diagram includes the association relationship between the alarm sets of the alarm types. For more detailed and straightforward description of the alarm correlation diagram, refer to Figure 2, which shows the association between alarms of different alarm types, that is, there is only one alarm in each alarm set. Specifically, in this example, There are alarms of the alarm types of 0, A, B, C, D, and E, and there is a topology relationship between the network devices belonging to the 0, A, B, C, D, and E alarms. In the specific implementation, there may be one alarm in each alarm set, or multiple alarms, or there may be no such alarms, depending on the circumstances.

According to FIG. 2, it is not necessary to analyze the alarm association by using a predefined rule, and the association relationship between the alarms can be obtained directly from the image, when different network devices in the network emit more When an alarm is generated, the association between different alarms can be learned in a straightforward manner, and the complexity of determining the association relationship between alarms is reduced.

In the implementation, the alarm association graph is generated by using a plurality of methods, for example, generating an alarm association graph according to the binary tree principle, and generating an alarm association graph according to different alarm severity levels, and generating an alarm association graph by using other principles. A method for generating an alarm correlation graph is provided. The specific processing flow is as shown in FIG. 3, and includes the following steps:

Step 301: Determine two top nodes of the physical connection according to the topology diagram of the network device.

Step 302: Obtain all the alarms currently existing by the two topology nodes, and find an alarm with an association relationship.

Step 303: Classify the alarms with the associated relationship according to the alarm code and/or the alarm level, and identify the alarm types as different alarm types.

Step 304: Determine the alarm set and the second alarm of the first alarm type when the calculated probability that the association between the alarm set of the first alarm type and the alarm set of the second alarm type exceeds the first preset probability value The type of alarm set has an association relationship and is displayed on the alarm association graph.

In the implementation, the alarms of the network device usually include two parts. One part is the processed alarm, which is usually stored in the historical alarm database, and the other part is the alarm that has not been processed. It is usually stored in the current alarm cache. In the figure, the historical alarm database and the data in the current alarm cache are analyzed.

In an embodiment, the step 302 is configured to obtain all the alarms that the two topology nodes currently have, and find the alarms that have the associated relationship, including: acquiring all the alarms currently owned by the two topology nodes, and analyzing the The alarm that a topology node has with the alarm of the second topology node in time is used to find an alarm with an association relationship.

When implemented, analyze the alarms of the first topology node and the advertisements of the second topology node. In the accompanying relationship of the police, look for the alarms with the associated relationship. The specific processing flow is as follows:

Calculating an alarm occurrence time difference and an alarm recovery time difference between the first alarm of the first topology node and the second alarm of the second topology node, and the alarm occurrence time difference is the occurrence time of the second alarm and the occurrence of the first alarm The difference in time, the alarm recovery time difference is the difference between the recovery time of the second alarm and the recovery time of the first alarm.

Determining that the first alarm is associated with the second alarm when the alarm time difference is greater than 0, less than the preset time difference, and the alarm recovery time difference is greater than 0, less than the preset recovery time difference, and the alarm level of the first alarm is not less than the alarm level of the second alarm. relationship.

The specific generation of the alarm correlation diagram is described in detail with a specific example:

4, if the current topology node is A, with alarm a, 4, the alarm occurrence time of the alarm a is Ta, the alarm recovery time Ta2, the alarm level is Sa, if the topology node B associated with the topology node A has an alarm b, the alarm occurrence time is Tb, the alarm recovery time is Tb2, and the alarm level is Sb. If 0<Tb - Ta<m, 0<Tb2 - Ta2<n (m is the preset time difference, n is the preset recovery time difference) ), and Sa>=Sb, it is considered that the alarm a is associated with the alarm b, and the alarm b is generated along with the generation of the alarm a, and is restored and restored.

计算 Calculate all the alarms of node A and all the alarms of node B by the above method, find the alarms with association relationship, refine the classifications TA and TB, and then calculate the probability of the association relationship according to the classification conditions, if the probability is greater than r (r is the first The preset probability value, which is assumed to be 90%, and of course other values, is considered to be related to the alarm of the TA type and the alarm of the TB type.

In the implementation of step 302, the probability of occurrence of the association between the alarm set of one alarm type and the alarm set of another alarm type is as follows: The number of alarms satisfying the alarm set of one alarm type is used as a denominator, and the alarm set is The number of alarms that have an association relationship between the alarm sets of another alarm type is taken as a numerator, and the calculated value is the calculated probability.

In an embodiment, the relationship between the alarm sets of the two types of alarm types is calculated. There may be a certain deviation between the probability of the second preset probability value (usually referring to the actual probability), and the probability of occurrence of the association between the calculated alarm set of the first alarm type and the alarm set of the second alarm type and the second If the preset probability value does not match, the probability of occurrence of the association between the calculated alarm set of the first alarm type and the alarm set of the second alarm type is adjusted according to the second preset probability value, for example, if the second preset If the probability value is less than the calculated probability, the calculated probability is lowered. Similarly, if the second preset probability value is greater than the calculated probability, the calculated probability is increased.

In the embodiment of the present invention, in order to make the association relationship obtained according to the alarm association graph more accurate, the alarm association map needs to be periodically updated, and the update period may be one hour, one day, or one month, and the specific update time is specific according to the specific Depending on the situation. Usually in a one-day cycle to meet the accuracy requirements.

After the alarm association graph is updated, when a new alarm occurs on the network device, the updated alarm association map is used to search for an alarm set of other alarm types associated with the alarm set of the same type of the new alarm; Among the alarms included in the alarm set of the alarm type, the alarm associated with the new alarm is determined.

In an implementation, the associated alarm determination method provided by the embodiment of the present invention may be used to create an alarm management system, including the following parts: a network device, a current alarm cache, a historical alarm database, an alarm association graph, an alarm correlation analysis engine, and an alarm analysis engine. User interface, please refer to Figure 4 for the specific connection relationship. The functions of each part are as follows:

Network device: The network device is a managed device in the system. When the network device runs out of fault, an alarm is generated and the alarm is reported to the network management system.

Historical Alarm Database: Saves all historical alarm data generated by the network device.

The alarm correlation analysis engine analyzes the historical alarm database and the data in the current alarm cache to obtain the alarm association relationship.

Network device topology: A location relationship diagram based on the physical location of a network device. Alarm correlation diagram: Used to save the analysis and get the alarm association relationship.

Current alarm cache: The current alarm generated by the network device is saved. The current alarm is an alarm that has not been processed. The device fault corresponding to the current alarm has not been eliminated.

Alarm Analysis Engine: The alarm analysis engine analyzes and processes the alarm data in the current alarm cache according to the alarm correlation graph to find the root alarm.

User interface: An alarm interface that is displayed to the user. The alarm association graph and root alarm are displayed on the interface to facilitate network maintenance personnel to maintain the view, analyze the association relationship on the association graph, and locate the fault.

When the alarm management system shown in Figure 4 is used, the process of the specific associated alarm determination method is as follows:

Step 1: Use the current alarm cache and historical alarm database to collect alarm data generated by network devices.

Step 2: Analyze and mine the alarm data, and find the association relationship between the alarm data based on the network device topology map.

Step 3: Generate an alarm correlation diagram by using the association relationship between the alarm data.

Step 4: Use the generated alarm correlation graph to analyze and process the current alarms on the network to find the root alarm and quickly locate the fault.

Step 5: For the newly generated current alarm and historical alarm mining analysis, repeat the second step and the third step to obtain the association relationship, continuously correct the alarm correlation diagram, and realize the automatic learning function to improve the accuracy.

Using the associated alarm determination method provided by the embodiment of the present invention, how to determine the associated alarm is described in a specific implementation. Referring to FIG. 2, the network devices belonging to the A, B, C, D, E, and 0 types of alarms have a topology association, according to The arrow points in the direction, and the probability that the pointed alarm is accompanied by the occurrence of the alarm pointing to it is greater than the first preset probability value. For example, the type A alarm occurs, and the probability that the type D alarm must occur is 98%. Based on the same inventive concept, the embodiment of the present invention further provides a method for generating an alarm association graph. The specific processing flow is as shown in FIG. 5, and includes the following steps:

Step 501: Determine two top nodes of the physical connection according to the topology diagram of the network device.

Step 502: Obtain all the alarms currently existing by the two topology nodes, and find an alarm with an association relationship.

Step 503: Classify the alarms with the associated relationship according to the alarm code and/or the alarm level, and identify the alarm types as different alarm types.

Step 504: Determine an alarm set and a second alarm of the first alarm type when the calculated probability of occurrence of the association between the alarm set of the first alarm type and the alarm set of the second alarm type exceeds the first preset probability value The type of alarm set has an association relationship and is displayed on the alarm association graph.

In an embodiment, when the step 503 is implemented, the alarms that are currently associated with the two topology nodes are respectively obtained, and the alarms with the associated relationship are found. The specific processing flow is as follows: The time difference between the alarm and the second alarm that is generated by the second topology node and the alarm recovery time difference. The time difference between the alarm occurrence time is the difference between the occurrence time of the second alarm and the occurrence time of the first alarm, and the alarm recovery time difference is the second. The difference between the recovery time of the alarm and the recovery time of the first alarm.

In an embodiment, the calculated probability of the association between the alarm sets of the two types of alarm types may be different from the second preset probability value (usually the actual probability), and the calculated alarm of the alarm type is calculated. When the probability of occurrence of the association between the set and the alarm set of another alarm type does not match the second preset probability value, the calculated result is calculated according to the second preset probability value pair. The probability of the association between the alarm type and another alarm type is adjusted. For example, if the second preset probability value is less than the calculated probability, the calculated probability is lowered, and similarly, if the second preset probability is The value is greater than the calculated probability and the calculated probability is increased.

Based on the same inventive concept, an embodiment of the present invention further provides an associated alarm determining apparatus. The specific structure is as shown in FIG. 6, and includes the following steps:

a second determining unit 601, configured to determine an alarm type of the alarm when an alarm occurs on the network device;

The searching unit 602 is configured to search, in the generated alarm association diagram, an alarm set of other alarm types associated with the alarm set of the same type of the alarm, and the alarm association diagram includes an association relationship between the alarm sets of the alarm types.

The third determining unit 603 is configured to determine, in the alarm included in the alarm set of the associated alarm type, an alarm associated with the alarm.

In an embodiment, as shown in FIG. 7, the searching unit 602 may include:

The first determining subunit 701 is configured to sequentially determine, according to the network device topology, two top nodes that have physical connections.

The obtaining sub-unit 702 is configured to separately obtain all the alarms currently owned by the two topology nodes, and find an alarm having an association relationship therein.

The identifier sub-unit 703 is configured to classify the alarms with the associated relationship according to the alarm code and/or the alarm level, and identify the alarm types as the alarm sets of the alarm types.

The display sub-unit 704 is configured to determine an alarm set of the first alarm type when the calculated probability that the association between the alarm set of the first alarm type and the alarm set of the second alarm type exceeds the first preset probability value There is an association relationship with the alarm set of the second alarm type, and is displayed on the alarm association graph.

In an embodiment, as shown in FIG. 8, the obtaining subunit 702 specifically includes:

The calculating module 801 is configured to calculate a first alarm and a second topology that the first topology node has The difference between the alarm occurrence time and the alarm recovery time difference between the second alarms of the node, the difference between the alarm occurrence time and the time when the second alarm occurs, and the alarm recovery time difference is the recovery time of the second alarm and the first The difference between the recovery time of the alarm.

The determining module 802 is configured to determine, when the alarm time difference is greater than 0, less than the preset time difference, and the alarm recovery time difference is greater than 0, less than the preset recovery time difference, and the alarm level of the first alarm is not less than the alarm level of the second alarm, determining the first alarm and The second alarm has an association relationship.

In an embodiment, as shown in FIG. 7, the display sub-unit 704 is further configured to: when the calculated association between the alarm set of the alarm type and the alarm set of another alarm type occurs, and the second When the preset probability value does not match, the calculated probability of occurrence of the association relationship is adjusted according to the second preset probability value.

In an embodiment, as shown in FIG. 9, the associated alarm determining apparatus may further include: an updating unit 901, configured to periodically update the alarm association map.

The searching unit 602 is further configured to: when the network device generates a new alarm, use the updated alarm association map to search for an alarm set of other alarm types associated with the alarm set of the same alarm type as the new alarm.

The third determining unit 603 is further configured to: determine an alarm associated with the new alarm in the alarm included in the associated alarm set of each alarm type.

Based on the same inventive concept, the embodiment of the present invention further provides an alarm correlation graph generating device. The specific structure is as shown in FIG. 10, and includes:

The first determining unit 1001 is configured to sequentially determine, according to the network device topology, two top nodes that have physical connections.

The obtaining unit 1002 is configured to separately obtain all the alarms currently owned by the two topology nodes, and search for an alarm having an association relationship therein.

The classification unit 1003 is configured to classify the alarms having the associated relationship according to the alarm attribute, and identify the alarm types as different alarm types, and form an alarm set of each alarm type. The display unit 1004 is configured to determine, when the calculated probability of occurrence of the association between the alarm set of the first alarm type and the alarm set of the second alarm type exceeds the first preset probability value, determine the alarm set of the first alarm type The alarm set of the second alarm type has an association relationship and is displayed on the alarm association map.

In an embodiment, the classification unit 1003 is specifically configured to: classify alarms having an association relationship according to an alarm code and/or an alarm level.

In an embodiment, the obtaining unit 1002 is specifically configured to: obtain all the alarms currently owned by the two top nodes, and analyze the alarms of the first topology node and the alarms of the second topology node in time. The associated relationship, find the alarm with the associated relationship.

In an embodiment, as shown in FIG. 11, the obtaining unit 1002 specifically includes:

The calculation sub-unit 1101 is configured to calculate an alarm occurrence time difference and an alarm recovery time difference between the first alarm that is included in the first topology node and the second alarm that is included in the second topology node, and the alarm occurrence time difference is the occurrence of the second alarm. The difference between the time and the occurrence time of the first alarm, and the alarm recovery time difference is the difference between the recovery time of the second alarm and the recovery time of the first alarm.

The second determining subunit 1102 is configured to: when the alarm occurrence time difference is greater than 0, less than the preset time difference, and the alarm recovery time difference is greater than 0, less than the preset recovery time difference, and the alarm severity of the first alarm is not less than the alarm level of the second alarm, An alarm has an association relationship with the second alarm.

In an embodiment, as shown in FIG. 10, the display unit 1004 is further configured to: when the calculated relationship between the alarm set of the first alarm type and the alarm set of the second alarm type occurs, and the second When the preset probability value does not match, the calculated probability of occurrence of the association relationship is adjusted according to the second preset probability value.

According to the method provided by the embodiment of the present invention, when an alarm occurs on the network device, the alarm type of the alarm is determined, and an alarm of another alarm type associated with the same alarm type of the alarm type is found in the generated alarm association map. The set, the alarm association graph includes the association relationship between the alarm sets of each alarm type, and the alarms included in the alarm set of each associated alarm type. The alarm associated with the alarm is determined. The association alarm determination method provided by the embodiment of the present invention determines the other alarms associated with the generated alarms by using the alarm association graph. The alarm association graph can directly and effectively reflect the association of the alarm sets of different alarm types by using the characteristics of the image display. Relationships, after receiving an alarm, directly refer to the alarm association graph, and do not need to analyze the alarm association through a predefined rule, which can simply and effectively reflect the association relationship between the alarms, and determine other associations associated with the received alarms. The alarm is used to reduce the complexity of the association between alarms. Because the alarm association graph does not depend on the network element, it is not hard coded by the internal program of the network element, but can be modified according to the actual situation. Therefore, when the network is expanded or reduced. The network device can be modified according to the increase or decrease of network devices in the network. It is not limited to the network scale and is easy to expand. The alarm correlation graph can be used to find the source fault more accurately and quickly.

Further, in order to ensure the accuracy of the association relationship obtained according to the alarm association graph, in the embodiment of the present invention, the alarm association graph is periodically updated.

Further, the alarm correlation diagram is generated by analyzing and synthesizing the existing alarm data, and the association relationship included in the alarm association diagram can be used to intuitively provide a decision basis for the user, for example, to find the root cause alarm; the alarm association diagram is provided for the maintenance personnel. Intuitive association relationship, according to requirements, can dynamically correct the association relationship; and the alarm association graph is generated through the topology relationship of the network device, and can be more effective when the association relationship is searched and located; The root cause alarm is determined in the case of lower computational complexity; the alarm association graph can automatically learn automatically according to the latest alarm data, so that the association relationship is more accurate, and the root source alarm search and analysis is more accurate. The spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and modifications of the invention

Claims

Claim

A method for generating an alarm correlation graph, the method comprising:

Determining, according to the topology diagram of the network device, two top nodes having a physical connection; respectively acquiring all the alarms currently existing by the two top nodes, and searching for an alarm having an association relationship;

2. The method according to claim 1, wherein classifying the alarms having the associated relationship according to the alarm attribute comprises:

Classify alarms with associations based on alarm codes and/or alarm levels.

The method according to claim 1, wherein each of the alarms currently associated with the two topological nodes is obtained, and the alarms having the associated relationship are:

Obtain all the alarms that the two top nodes currently have, analyze the time-related relationship between the alarms of the first topology node and the alarms of the second topology node, and find the alarms with the associated relationship.

The method according to claim 3, wherein the searching for an alarm having an association relationship therein comprises:

Calculating an alarm occurrence time difference and an alarm recovery time difference between the first alarm of the first topology node and the second alarm of the second topology node; the alarm occurrence time difference is the occurrence time of the second alarm and the first alarm The difference between the occurrence time and the alarm recovery time difference is the difference between the recovery time of the second alarm and the recovery time of the first alarm; When the alarm occurrence time difference is greater than 0 and less than the preset occurrence time difference, the alarm recovery time difference is greater than 0, and is less than the preset recovery time difference, and the alarm level of the first alarm is not less than the alarm level of the second alarm, the first alarm and the second alarm are determined. Have an association.

The method according to claim 1, wherein after determining that the alarm set of the first alarm type is associated with the alarm set of the second alarm type, displaying the same on the alarm association map, the method further includes: :

When the calculated probability of occurrence of the association between the alarm set of the first alarm type and the alarm set of the second alarm type does not match the second preset probability value, the calculated association is calculated according to the second preset probability value The probability of a relationship occurring is adjusted.

6. A method for determining an associated alarm, the method comprising:

Determining the type of the alarm of the alarm when an alarm occurs on the network device;

7. An alarm correlation map generating device, the device comprising:

a classification unit, configured to classify alarms having an association relationship according to an alarm attribute, and form an alarm set of each alarm type;

a display unit, configured to determine, when the calculated probability of occurrence of the association between the alarm set of the first alarm type and the alarm set of the second alarm type exceeds the first preset probability value, The alarm type alarm set is associated with the second alarm type alarm set, and the association relationship is displayed on the alarm association graph.

The device according to claim 7, wherein the classifying unit is further configured to classify the alarms having the associated relationship according to the alarm code and/or the alarm level.

The device according to claim 7, wherein the acquiring unit is further configured to acquire all the alarms currently owned by the two top nodes, and analyze the alarms and the second information of the first topology node. The alarms of the alarms of the topology nodes in time are used to find alarms with associated relationships.

The device according to claim 9, wherein the acquiring unit further comprises:

a calculation subunit, configured to calculate an alarm occurrence time difference and an alarm recovery time difference between the first alarm that is included in the first topology node and the second alarm that is included in the second topology node; the alarm occurrence time difference is the second alarm The difference between the occurrence time and the occurrence time of the first alarm, where the alarm recovery time difference is the difference between the recovery time of the second alarm and the recovery time of the first alarm;

The second determining sub-unit is configured to: when the alarm occurrence time difference is greater than 0 and less than the preset occurrence time difference, the alarm recovery time difference is greater than 0, and less than the preset recovery time difference, and the alarm severity of the first alarm is not less than the alarm level of the second alarm, There is an association relationship between the first alarm and the second alarm.

The device according to claim 7, wherein the display unit is further configured to: when the calculated relationship between the alarm set of the first alarm type and the alarm set of the second alarm type occurs, When the second preset probability value does not match, the calculated probability of occurrence of the association relationship is adjusted according to the second preset probability value.

12. An apparatus for determining an associated alarm, the apparatus comprising:

a search unit, configured to search for an alarm class with the alarm in the generated alarm association diagram An alarm set of other alarm types associated with the same type of alarm set, and the alarm association diagram includes an association relationship between alarm sets of each alarm type;