WO2016095408A1

WO2016095408A1 - Controller and method for processing alarm relevance

Info

Publication number: WO2016095408A1
Application number: PCT/CN2015/078388
Authority: WO
Inventors: 陈俏钢; 肖红运
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-12-18
Filing date: 2015-05-06
Publication date: 2016-06-23
Also published as: CN105790972B; CN105790972A

Abstract

Disclosed in the embodiments of the present invention are a controller and a method for processing alarm relevance. The method comprises: when a controller receives an alarm reported by a southbound interface, alarm relevance analysis is performed on said alarm and the current alarms within network range of the present controller; if the result of the alarm relevance analysis is that a root alarm is found, then the controller suppresses the report of said alarm. The controller comprises an alarm analysis module and an alarm processing module.

Description

Controller and alarm correlation processing method

Technical field

This document relates to the network technology managed by the SDN (Software Defined Network) controller, and more particularly to a scheme for using the controller to perform alarm correlation processing.

Background technique

In a communication network, a network consists of a number of communication device nodes, which are called network elements. The network elements are connected by communication lines, including fiber optic cables and the like. The network elements are distributed in various regions, some in the communication building laboratory in the city, and some network elements are in remote areas. However, the devices of these network elements need to be configured, maintained, and monitored. It is impossible to assign them to each location. This requires a central network management system, which is placed in the central computer room to configure and maintain various nodes on the network through remote communication. monitor.

Managing the network through the controller is an emerging network management control system. In this control system, the control functions of the service resources in the traditional network management are separated, and only the service resources are concerned. Controllers can be hierarchically organized in a tree to correlate large-scale networks. The domain controller (D-Controller, DC for short) of the network element is directly managed. The super controller (S-Controller, SC for short) does not directly manage the network element but manages the domain controller. Then, through the virtual network management provided by the domain controller, the management of the actual network is realized. As shown in Figure 1, in an application scenario, the controller forms a tree management system, and the upper layer is the SC, the underlying DC partition management domain, and the management communication network and the network element. In addition to the southbound and network devices managed by the interface, the northbound interface allows the application layer's network APP to access the network management, and can also operate through the side interface, with the EMS network element management system, the NMS network management system, or the OSS. Support system communication management information. The network APP is an actual business application to the network, and it uses the resources provided by the control to issue requests for service establishment, deletion, or modification. The controller establishes, deletes, or modifies services according to the request of the network APP, and monitors the alarm and performance of the service. As shown in Figure 2, the DC directly manages the communication network, while the SC manages the DC, and can also communicate with the traditional network management system, and finally provides the APP with resources and services.

During the actual operation of the network, faults may be encountered, or interference may be received and communication quality may be degraded. Once this is sent. The device will report an alarm. Since the direct communication of the network device is closely related, a device or a part of the resource has a fault report alarm, which will cause a large area of the network to generate an alarm. A lot of alarms are generated. For network administrators, it is difficult to find so many alarms for the real cause of the failure. The occurrence of a fault in the network triggers an alarm that directly reflects the fault. At the same time, a series of alarms are triggered because the fault affects other devices or services. Alarm A raises alarm B. Alarm A is the root alarm and alarm B is the derivative alarm.

In the network controlled by the SDN controller, due to the control characteristics of the SDN controller, it only cares about the resources related to the service, and because of the division of the rights, it is not always possible to see all the resources related to the service. Under such conditions, it is more difficult to analyze the cause of the failure through a large number of alarms obtained, which is more difficult than the traditional network management system.

Summary of the invention

The embodiment of the invention provides a controller and an alarm correlation processing method to solve the problem of low alarm analysis efficiency in the related art.

An embodiment of the present invention provides a method for alarm correlation processing, including:

When receiving the alarm reported by the southbound interface, the controller performs alarm correlation analysis on the alarm and the existing alarm in the network range of the controller;

When the result of the alarm correlation analysis is that the root cause alarm is found, the controller suppresses the reporting of the alarm.

Optionally, the foregoing method further includes:

When the result of the alarm correlation analysis is that the root cause alarm is not found, the controller reports the alarm to the upper controller or the application; or

When the result of the alarm correlation analysis is that the root cause alarm is not found, the controller determines whether to report the alarm to the upper layer controller or the application according to the pre-configured alarm analysis policy.

Optionally, in the foregoing method, the alarm analysis policy includes at least one or more of the following information:

Whether the alarms of the service intermediate nodes are reported, the alarms report the quantity control information, and the alarms report the priority information.

Optionally, in the foregoing method, when the result of the alarm correlation analysis is that the root cause alarm is not found, The step of the controller determining whether to report the alarm to the upper controller or the application according to the pre-configured alarm analysis policy includes:

The service of determining the alarm is determined. If all the nodes of the service in which the alarm is located are all within the control range of the controller, and the resource of the alarm is an intermediate point of the service, the controller is configured according to the pre-configured The alarm analysis policy determines whether the alarm is reported.

Optionally, in the foregoing method, when the result of the alarm correlation analysis is that the root cause alarm is not found, the step of the controller determining whether to report the alarm to the upper layer controller or the application according to the pre-configured alarm analysis policy includes:

The service of determining the alarm is determined. If all the nodes of the service in which the alarm is located are within the control range of the controller, and the resource of the alarm is the source and sink endpoint of the service, the alarm is used as a priority. The highest alarm is reported to the upper-layer controller or the application, and the derivative alarm triggered by the alarm is detected in the intermediate node of the service. If there is a derivative alarm triggered by the alarm, the controller may The alarm is changed from the reporting state to the suppression state.

The analysis determines the service in which the alarm is located, and if some nodes of the service in which the alarm is located are within the control range of the controller, analyze whether there is an alarm that triggers the alarm in the upstream of the service of the alarm resource, and if so, the suppression If the alarm does not exist, the controller determines whether to report the alarm according to the pre-configured alarm analysis policy.

Optionally, the foregoing method further includes:

When the alarm correlation analysis result is that the root cause alarm is found, the alarm and the found root source alarm are recorded as associated alarms.

Optionally, the foregoing method further includes:

The controller receives the query for the partial part alarm or all the alarms initiated by the network application APP or the upper layer controller through the query interface, and returns a corresponding alarm according to the received command.

The embodiment of the invention further provides a controller, including:

The alarm analysis module is configured to perform an alarm correlation analysis between the alarm and an existing alarm in the network scope of the controller when the controller receives the alarm reported by the southbound interface;

The alarm processing module is configured to suppress the reporting of the alarm when the root cause alarm is found as a result of the alarm correlation analysis.

Optionally, in the foregoing controller, the alarm processing module is further configured to report the alarm to an upper-layer controller or an application, or according to a pre-configured alarm, when the root cause alarm is not found as a result of the alarm correlation analysis. The analysis policy determines whether the alarm is reported to the upper controller or application.

Optionally, in the above controller, the alarm processing module determines whether to report the alarm to the upper controller or the application according to the pre-configured alarm analysis policy when the result of the alarm correlation analysis is that the root alarm is not found. :

The alarm processing module analyzes and determines the service in which the alarm is located. If all the nodes of the service in which the alarm is located are all within the control range of the controller, and the resource of the alarm is an intermediate point of the service, the The pre-configured alarm analysis policy determines whether the alarm is reported.

The alarm processing module analyzes and determines the service in which the alarm is located. If all the nodes of the service in which the alarm is located are all within the control range of the controller, and the resource of the alarm is the source and sink endpoint of the service, The alarm is reported to the upper-layer controller or the application as the highest-priority alarm, and the derivative alarm caused by the alarm is detected in the intermediate node of the service. If the alarm generated by the alarm is generated, the controller The alarm of the intermediate node is modified from the reporting state to the suppression state.

The alarm processing module analyzes and determines the service where the alarm is located. If some nodes of the service where the alarm is located are within the control range of the controller, analyze whether the upstream service of the alarm resource is upstream. There is an alarm that triggers the alarm. If yes, the alarm is suppressed. If not, the controller determines whether to report the alarm according to the pre-configured alarm analysis policy.

Optionally, the controller further includes:

The alarm record module is configured to record the alarm and the found root cause alarm as associated alarms when the root cause alarm is found in the alarm correlation analysis result.

Optionally, the controller further includes:

The query module is configured to receive a query for a part of the alarm or all alarms initiated by the network application APP or the upper layer controller through the query interface, and return a corresponding alarm according to the received command.

The embodiment of the invention further provides a computer readable storage medium storing program instructions, which can be implemented when the program instructions are executed.

The technical solution of the embodiment of the present application analyzes the direct interaction relationship of the alarms, analyzes the root cause alarms, and then filters out the more important alarms, and reports the filtered alarms to the upper controller or the application layer. This greatly reduces the number of alarm reports and directly identifies the most likely cause of root failure, thereby improving the efficiency of alarm analysis.

BRIEF abstract

1 is a schematic diagram of a related art SDN controller management control network;

2 is a schematic diagram of a relationship between a controller and other entities in a related art SDN network;

FIG. 3 is a schematic flowchart of alarm correlation processing in the embodiment;

4 is a flowchart of alarm reporting and analysis of services across multiple DCs in the embodiment;

FIG. 5 is a schematic diagram of an internal module of the controller in the embodiment.

Embodiments of the invention

It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments of the present application may be combined with each other arbitrarily.

Example 1

This embodiment provides a method for alarm correlation processing, which mainly includes the following operations:

When the controller receives the alarm reported by the southbound interface, it performs alarm correlation analysis on the alarm and the existing alarms in the network range of the controller.

When the result of the alarm correlation analysis is that the root cause alarm is found, the controller suppresses the report of the alarm.

In addition, if the result of the alarm correlation analysis is that the root cause alarm is not found, the controller can take different operation processing. For example, the controller may report the alarm to the upper-layer controller or the application, or determine whether to report the alarm to the upper-layer controller or the application according to the pre-configured alarm analysis policy.

The alarm analysis strategy involved in the embodiment includes at least one or more of the following information:

When the alarm correlation analysis result is that the root alarm is not found, the controller determines whether to report the alarm to the upper controller or the application according to the pre-configured alarm analysis policy as follows:

First, analyze and determine the service where the alarm is located;

If all the nodes of the service in the alarm are in the control range of the controller, and the alarm resource is the intermediate point of the service, the controller determines whether to report the alarm according to the pre-configured alarm analysis policy.

If all the nodes in the service of the alarm are in the control range of the controller, and the alarm resource is the source and sink endpoint of the service, the controller reports the alarm with the highest priority to the upper controller or application, and analyzes the alarm. If there is a derivative alarm triggered by the alarm, the controller needs to modify the alarm of the intermediate node from the reporting state to the suppression state.

If the node where the alarm is located is in the control range of the controller, you need to further analyze whether the alarm is generated in the upstream of the service of the alarm resource. If it exists, the alarm is suppressed. If it does not exist, the controller then The pre-configured alarm analysis policy determines whether the alarm is reported.

It should be noted that, according to the pre-configured alarm analysis policy, the controller determines whether to report an alarm, and if it is determined according to any one of the pre-configured alarm analysis strategies, it is determined that the alarm needs to be reported. The alarm can be reported. The alarm is reported only when all the reporting conditions in the pre-configured alarm analysis policy are met. The alarm can be reported when the multiple reporting conditions in the pre-configured alarm analysis policy are met. That is, the manner of determining whether to report the alarm according to the alarm analysis policy may be various, and the embodiment does not impose any limitation on this.

Other solutions also propose that, based on the above method, the recording operation can be added to facilitate subsequent alarm management operations. That is, when the root cause alarm is found in the alarm correlation analysis result, the alarm and the found root alarm are recorded as associated alarms.

Optionally, the query function may also be provided, that is, the controller receives the network application APP or the command of the upper layer controller to query part of the alarm or all the alarms through the query interface, and returns a corresponding alarm according to the received command.

The implementation process of the above method will be described below with reference to the accompanying drawings.

First, in conjunction with FIG. 3, a process for performing alarm correlation processing in an alternative embodiment is described. The process includes the following processing steps:

Step 301: The network application or the upper controller sends a command to the controller to configure an alarm analysis policy.

The alarm analysis policy may include whether the alarm of the service intermediate node is reported, the number of alarms reported (including, for example, the number of alarms reported by each service), and the alarm reporting priority (including, for example, the priority of certain types of alarm reporting).

Step 302: The controller receives the alarm reported by the southbound interface. The alarm may be sent from the device network element or the lower layer controller. After receiving the alarm, the alarm is forwarded to the alarm analysis module for processing. The reported alarm has a unique alarm identifier.

Step 303: The alarm analysis module performs alarm correlation analysis on the existing alarms in the network range of the control by using the newly received alarms;

Step 3 above includes a flexible combination of some or all of the sub-steps below.

Step 303.1, starting from the resource generating the alarm, the alarm may be triggered by a service layer resource failure of the resource. Recursively search for service layer resources, check whether the service layer resources have alarms and whether the alarm is a root cause alarm. Going down until there is no more underlying service resources and can trigger The alarm of this alarm is up to now. If found, the alarm that the resource just found is the source of the alarm found in this analysis.

In step 303.2, the service where the alarm is located is analyzed, and all nodes are in the control range of the controller. If yes, it is analyzed whether the resource of the alarm is in the middle of the service. If it is the intermediate point, according to the alarm analysis strategy of step 301, the intermediate point is not reported, or the alarm severity of the intermediate point is lower than or equal to the source and sink endpoints. If the severity of the alarm does not continue to be reported, or the priority is not reported, or the number of alarms is limited, the policy is processed according to the policy.

Analyze the alarms of the source and destination endpoints of the service to check whether the endpoint has an alarm that triggers the alarm.

Record the alarm ID of the found endpoint as the root cause alarm for this alarm.

If the resource of the alarm is the endpoint of the service, the alarm is sent according to the alarm analysis policy in step 301, and the newly received alarm is reported as a higher-priority alarm, and the intermediate node of the service is analyzed. If it exists, the alarm of the intermediate point changes from the reporting state to the suppression state.

In step 303.3, if the analysis is that the service in which the alarm is located is only partially controlled by the controller. If the service layer alarm is generated according to step 303.1, the alarm is generated. If the alarm is generated, the upstream alarm is triggered.

In step 303.4, if the root cause alarm is not found in the analysis of the previous steps, and the alarm policy is not received, the alarm is directly reported. If the root cause alarm is found in the previous analysis and is recorded as an associated alarm and is suppressed according to the alarm policy, the alarm is not reported. In the suppression state, the alarm still exists, but it is not reported automatically. The detected alarms associated with each other are marked with the alarm ID of the found alarm source as an associated alarm.

Step 304: If the controller manages multiple lower-layer controllers, and the reported alarm is located across multiple lower-layer controllers, after the root cause alarm is obtained, the command may be sent to the lower-layer controller to provide the analyzed Associate the alarm identifier of the root alarm and instruct the lower controller to suppress the derived alarm. Reduce the amount of alarm reporting.

Step 305: If the alarm correlation information sent by the upper controller is received, and the root source alarm is found in the alarm reported by the controller, the controller suppresses the alarm.

Step 306, the network application APP or the upper layer controller can query part of the alarm or all the alarms through the query interface, and the controller returns the result according to the query condition. The alarms suppressed in the previous alarm analysis can also be queried.

The following takes an alarm generated in a service spanning multiple SCs as an example to illustrate another example of the alarm association processing method.

As shown in Figure 4. The connection between NE1, NE2 and NE6 indicates the service of an APP. The service A endpoint is at NE1, the Z endpoint is at NE6, and the NE2, NE3, NE4, and NE5 are directly managed by DC1, DC2, and DC3, respectively. The upper layer is managed by an SC, and the dotted line in the figure indicates the management relationship. Assume that an alarm Alarm1 is generated in the network element 1, and is reported from the network element 1 to the DC1, which is affected by the alarm1, and NE2, NE3, and NE4 also generate the alarms Alarm2, Alarm3, and Alarm4 respectively (the thick arrow in the figure indicates the alarm). In this scenario, the process of alarm correlation processing is as follows:

Step 1: When DC1 receives Alarm1 (arrow No. 1 in the figure), the analysis finds that the service layer alarm is not found and Alarm1 is triggered, and the resource is the endpoint of the service, then the alarm has no root cause alarm and is directly reported (2 in the figure) Arrow)

Step 2: When DC1 receives alarm2 (arrow No. 3 in the figure), it is found that NE2 does not find the service layer alarm to trigger Alarm2, but the service endpoint NE1 has alarm1, which will trigger alarm2, then record Alarm1 as the associated alarm and suppress Alarm2;

Step 3: When DC2 receives Alarm3 (arrow No. 4 in the figure), it is found that NE3 does not find the service layer alarm and raises Alarm3, and Alarm3 is not at the end of the service. The service endpoint is not in the control scope of the controller. The root cause alarm was not found and reported directly (arrow No. 6 in the figure);

Step 4: When DC2 receives Alarm4 (arrow No. 5 in the figure), it is found that NE4 does not find the service layer alarm and raises Alarm4, and Alarm4 is not at the end of the service. The service endpoint is not in the control scope of the controller. The root cause alarm was not found and reported directly (arrow No. 6 in the figure);

Step 5: After the SC receives the alarms Alarm3 and alarm4 (arrow No. 6 in the figure), the analysis finds that NE3 and NE4 have not found the service layer alarm and triggered Alarm3, Alarm4, but the service endpoint NE1 exists. Alarm1 will trigger alarm3, Alarm4. Then record Alarm1 as the associated alarm, and suppress Alarm3, alarm4, and notify DC2 to suppress (arrow No. 7 in the figure);

Step 6: The final APP only receives the alarm1 of NE1 (the arrow No. 9 in the figure), and achieves the purpose of finding the root cause alarm and reducing the alarm reporting amount;

Step 7: For some kind of needs, when the APP cares about a certain service, it may need to query all the related alarms, and then send an inquiry command to query all the alarms of the service, including the suppressed alarm. The controller returns the response layer by layer and reports it to the APP after the SC is summarized.

Example 2

This embodiment provides a controller, as shown in FIG. 5, including at least the following modules:

The alarm processing module is configured to suppress the reporting of the alarm when the result of the alarm correlation analysis is that the root cause alarm is found.

In addition, the alarm processing module is further configured to: when the result of the alarm correlation analysis is that the root cause alarm is not found, the alarm may be reported to the upper-layer controller or the application, or the alarm is analyzed according to the pre-configured alarm analysis policy. Upper controller or application.

The processing of the alarm processing module includes:

First, the service of the alarm is determined. If all the nodes of the service are in the control range of the controller, and the alarm resource is the intermediate point of the service, determine whether to report the report according to the pre-configured alarm analysis policy. Alarm.

If all the nodes of the service are in the control range of the controller, and the alarm resource is the source and sink endpoint of the service, the alarm with the highest priority is reported to the upper controller or application, and analyzed. Whether there is a derivative alarm triggered by the alarm in the intermediate node of the service. If there is a derivative alarm triggered by the alarm, the alarm of the intermediate node is changed from the reporting state to the suppression state.

If a part of the node where the alarm is located is within the control range of the controller, analyze whether there is an alarm that triggers the alarm in the upstream of the service of the alarm resource. If yes, the alarm is suppressed. If not, according to the pre-configured The alarm analysis policy determines whether the alarm is reported.

It is to be noted that, when the alarm processing module determines whether to report the alarm according to the pre-configured alarm analysis policy, the alarm processing module may report the alarm according to any one of the pre-configured alarm analysis policies. The alarm may be reported only when multiple or all of the pre-configured alarm analysis policies are met. This embodiment does not limit the specific reporting principle.

Optionally, the foregoing apparatus may further include an alarm recording module, where the module is configured to record the alarm and the found root source alarm as associated alarms when the root cause alarm is found in the alarm correlation analysis result.

The device may further include a querying module, configured to receive a query for a part of the alarm or all the alarms initiated by the network application APP or the upper layer controller by using the query interface, and return a corresponding alarm according to the received command.

One of ordinary skill in the art will appreciate that all or a portion of the steps described above can be accomplished by a program that instructs the associated hardware, such as a read-only memory, a magnetic or optical disk, and the like. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the foregoing embodiment may be implemented in the form of hardware or in the form of a software function module. This application is not limited to any specific combination of hardware and software.

Industrial applicability

The technical solution of the embodiment of the present application greatly reduces the number of alarm reports, and directly finds out the most likely cause of root failure, thereby improving the efficiency of alarm analysis.

Claims

A method for alarm correlation processing, including:

When receiving the alarm reported by the southbound interface, the controller performs alarm correlation analysis on the alarm and the existing alarm in the network range of the controller;

When the result of the alarm correlation analysis is that the root cause alarm is found, the controller suppresses the reporting of the alarm.
The method of claim 1 further comprising:

When the result of the alarm correlation analysis is that the root cause alarm is not found, the controller reports the alarm to the upper controller or the application; or

When the result of the alarm correlation analysis is that the root cause alarm is not found, the controller determines whether to report the alarm to the upper layer controller or the application according to the pre-configured alarm analysis policy.
The method of claim 2 wherein said alert analysis strategy comprises at least one or more of the following:

Whether the alarms of the service intermediate nodes are reported, the alarms report the quantity control information, and the alarms report the priority information.
The method of claim 2 or 3, wherein, when the result of the alarm correlation analysis is that the root cause alarm is not found, the controller determines whether to report the alarm to the upper controller or according to the pre-configured alarm analysis policy. The steps of the application include:

The service of determining the alarm is determined. If all the nodes of the service in which the alarm is located are all within the control range of the controller, and the resource of the alarm is an intermediate point of the service, the controller is configured according to the pre-configured The alarm analysis policy determines whether the alarm is reported.
The method of claim 4, wherein, when the result of the alarm correlation analysis is that the root cause alarm is not found, the controller determines whether to report the alarm to the upper controller or the application according to the pre-configured alarm analysis policy. The steps include:

The service of determining the alarm is determined. If all the nodes of the service in which the alarm is located are within the control range of the controller, and the resource of the alarm is the source and sink endpoint of the service, the alarm is used as a priority. The highest alarm is reported to the upper controller or application and analyzed in the service. The intermediate node has a derivative alarm caused by the alarm. If there is a derivative alarm caused by the alarm, the controller changes the alarm of the intermediate node from the reporting state to the suppression state.
The method of claim 4, wherein, when the result of the alarm correlation analysis is that the root cause alarm is not found, the controller determines whether to report the alarm to the upper controller or the application according to the pre-configured alarm analysis policy. The steps include:

The analysis determines the service in which the alarm is located, and if some nodes of the service in which the alarm is located are within the control range of the controller, analyze whether there is an alarm that triggers the alarm in the upstream of the service of the alarm resource, and if so, the suppression If the alarm does not exist, the controller determines whether to report the alarm according to the pre-configured alarm analysis policy.
The method of claim 4 or 5 or 6, further comprising:

When the alarm correlation analysis result is that the root cause alarm is found, the alarm and the found root source alarm are recorded as associated alarms.
The method of claim 7 further comprising:

The controller receives the query for the partial part alarm or all the alarms initiated by the network application APP or the upper layer controller through the query interface, and returns a corresponding alarm according to the received command.
A controller comprising:

The alarm analysis module is configured to perform an alarm correlation analysis between the alarm and an existing alarm in the network scope of the controller when the controller receives the alarm reported by the southbound interface;

The alarm processing module is configured to suppress the reporting of the alarm when the root cause alarm is found as a result of the alarm correlation analysis.
The controller of claim 9

The alarm processing module is further configured to report the alarm to the upper-layer controller or the application when the root cause alarm is not found, or determine whether to report the alarm according to the pre-configured alarm analysis policy. Give the upper controller or application.
The controller of claim 10, wherein the alarm processing module determines whether to report the alarm to the upper controller or the application according to the pre-configured alarm analysis policy when the root cause alarm is not found. Means:

The alarm processing module analyzes and determines the service in which the alarm is located. If all the nodes of the service in which the alarm is located are all within the control range of the controller, and the resource of the alarm is an intermediate point of the service, the The pre-configured alarm analysis policy determines whether the alarm is reported.
The controller of claim 11, wherein the alarm processing module determines whether to report the alarm to the upper controller or the application according to the pre-configured alarm analysis policy when the result of the alarm correlation analysis is that the root alarm is not found. Means:

The alarm processing module analyzes and determines the service in which the alarm is located. If all the nodes of the service in which the alarm is located are all within the control range of the controller, and the resource of the alarm is the source and sink endpoint of the service, The alarm is reported to the upper-layer controller or the application as the highest-priority alarm, and the derivative alarm caused by the alarm is detected in the intermediate node of the service. If the alarm generated by the alarm is generated, the controller The alarm of the intermediate node is modified from the reporting state to the suppression state.
The controller of claim 11, wherein the alarm processing module determines whether to report the alarm to the upper controller or the application according to the pre-configured alarm analysis policy when the result of the alarm correlation analysis is that the root alarm is not found. Means:

The alarm processing module analyzes and determines the service in which the alarm is located. If some nodes of the service where the alarm is located are within the control range of the controller, analyze whether the alarm upstream of the service of the alarm resource has an alarm that triggers the alarm. If yes, the controller suppresses the alarm. If not, the controller determines whether to report the alarm according to the pre-configured alarm analysis policy.
The controller of claim 11 or 12 or 13, the controller further comprising:

The alarm record module is configured to record the alarm and the found root cause alarm as associated alarms when the root cause alarm is found in the alarm correlation analysis result.
The controller of claim 14, the controller further comprising:

The query module is configured to receive a query for a part of the alarm or all alarms initiated by the network application APP or the upper layer controller through the query interface, and return a corresponding alarm according to the received command.
A computer readable storage medium storing program instructions that, when executed, implement the method of any of claims 1-8.