WO2019001312A1 - Procédé et appareil de réalisation d'association d'alarme, et support d'informations lisible par ordinateur - Google Patents

Procédé et appareil de réalisation d'association d'alarme, et support d'informations lisible par ordinateur Download PDF

Info

Publication number
WO2019001312A1
WO2019001312A1 PCT/CN2018/091931 CN2018091931W WO2019001312A1 WO 2019001312 A1 WO2019001312 A1 WO 2019001312A1 CN 2018091931 W CN2018091931 W CN 2018091931W WO 2019001312 A1 WO2019001312 A1 WO 2019001312A1
Authority
WO
WIPO (PCT)
Prior art keywords
alarm
stored
attribute information
information
association
Prior art date
Application number
PCT/CN2018/091931
Other languages
English (en)
Chinese (zh)
Inventor
王骅
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2019001312A1 publication Critical patent/WO2019001312A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H04L41/065—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis involving logical or physical relationship, e.g. grouping and hierarchies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0686—Additional information in the notification, e.g. enhancement of specific meta-data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/069—Management of faults, events, alarms or notifications using logs of notifications; Post-processing of notifications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/40—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using virtualisation of network functions or resources, e.g. SDN or NFV entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/40—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection

Definitions

  • the present disclosure relates to the field of communications technologies, and in particular, to a method, apparatus, and computer readable storage medium for implementing alarm association.
  • an alarm When a hardware or software failure occurs in a communication system, it is usually reported by reporting the alarm information.
  • the alarm object is usually specified, that is, which object is faulty.
  • an alarm usually includes the fault occurrence time and alarm level (for example, fatal, serious, general, prompt, etc.) , attribute information of the alarm object.
  • the attribute information may include information about the alarm object, the cause of the fault, the impact of the fault, and the like.
  • the attribute information of the virtual machine port failure alarm may include a virtual machine name, a port name, an alarm cause, and a fault location description.
  • each alarm is usually displayed in a list, that is, all generated alarms are displayed in a list.
  • communication systems are hierarchical, and failure of an underlying software or hardware module often results in failure of one or more software or hardware modules in the upper layer.
  • the display mode of such a list obviously cannot represent the relationship between alarms, and it is necessary to manually analyze which alarm indicates the most fundamental fault, which is too complicated.
  • the concept of an alarm tree is also proposed in the art, that is, the association relationship between the alarms is presented in a tree-like manner.
  • the fault indicated by the root node alarm is the root cause of the alarm of the upper node. If the fault indicated by the root node alarm is fixed, the fault indicated by the alarm of the upper node can be repaired.
  • the alarm tree is currently generated by a preset script. For example, the developer writes such a script for implementing the alarm association for the alarm of the object A: if an alarm for the object A occurs, then it is checked whether there is an alarm for the object B; if there is an alarm for the object B, Then it is determined whether the identifier of the object B is equal to the value of the parameter X in the alarm for the object A; if equal, the alarm for the object A is used as a sub-alarm for the alarm of the object B.
  • the above-mentioned scripts for implementing alarm correlation need to be manually written, which is time-consuming and labor-intensive.
  • the types of alarms are not only numerous but also complicated, so the way of generating alarm trees is too cumbersome and complicated. defect.
  • the alarm for the object A may be caused by multiple reasons.
  • a script for implementing alarm correlation is prepared for the alarm of the object A to check whether the multiple alarms are root alarms.
  • a large amount of script modification work will be involved.
  • the implementation of the alarm association relies heavily on the parameters carried by the alarm. For example, the alarm for the object A must carry the parameter X. If it is not carried, the alarm for the object B cannot be associated.
  • the embodiments of the present disclosure provide a method, an apparatus, and a computer readable storage medium for implementing alarm association.
  • the technical solution is as follows:
  • a method for implementing an alarm association comprising:
  • VNF virtual network function
  • the target has stored alarms, including:
  • the alarm level of the stored alarm is greater than the alarm level of the alarm, and the alarm is determined as a sub-alarm of the stored alarm.
  • the performing a polling search in the at least one stored alarm according to the first attribute information of the first alarm object has an associated relationship with the stored alarms, including:
  • the alarm level of the alarm is greater than the alarm level of the stored alarm, and the alarm is determined as the root alarm of the stored alarm.
  • the present disclosure also provides an artificial intelligence-based fuzzy text analysis capability, and performs a query of a suspected alarm associated with the received alarm. It also supports the push notification of the suspected alarms that are queried for manual confirmation.
  • the method further includes:
  • the attribute information is fuzzy-matched with at least one identifier information of the at least one alarm object, where the at least one alarm object corresponds to the at least one stored alarm ;
  • the method further includes:
  • the method further includes:
  • the type information of the alarm, the first identification information, the first attribute information, the alarm, and the at least one target have been Store the association relationship of alarms;
  • a device for implementing an alarm association is provided, and the device is configured to implement the method for implementing alarm association according to the above first aspect.
  • a third aspect provides a computer readable storage medium, where the storage medium stores at least one instruction, at least one program, a code set, or a set of instructions, the at least one instruction, the at least one program, and the code A set or set of instructions is loaded and executed by the processor to implement the method of implementing an alarm association as described in any of the first aspects above.
  • a fourth aspect provides an apparatus for implementing an alarm association, the apparatus comprising a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, the at least one instruction, The at least one program, the set of codes, or the set of instructions is loaded and executed by the processor to implement the method of implementing an alarm association as described in any of the first aspects above.
  • the association analysis module After the association analysis module receives an alarm, it sends a data query request for the alarm to the VNF to obtain all attribute information of the alarm object indicated by the alarm from the VNF, and then the association analysis module obtains all the attribute information according to the obtained attribute.
  • a polling search is performed in the at least one stored alarm in the alarm database, so that the stored alarm associated with the alarm storage is obtained. Since the alarm association does not depend on the associated script, the manual writing and maintenance are greatly reduced. It saves time and effort by implementing the workload of the associated script associated with the alarm. Even in the case of a communication system with a large number of alarm types and complicated relationships, the association between alarms can be relatively simple.
  • the embodiment of the present disclosure is to query the VNF for all the attribute information of the alarm object, and use the attribute information of the queried alarm object to perform alarm association. Therefore, the situation that the alarm association is heavily dependent on the parameters carried by the alarm does not occur. That is, regardless of whether the newly received alarm carries the specified parameter, it can be associated with the alarm with which it has an associated relationship.
  • FIG. 1 is a system architecture diagram of an NFV according to an embodiment of the present disclosure
  • FIG. 2 is a schematic diagram of a module composition and a workflow of a method for implementing alarm association according to an embodiment of the present disclosure
  • FIG. 3 is a flowchart of a method for implementing alarm association according to an embodiment of the present disclosure
  • FIG. 4 is a schematic flowchart of implementing alarm association according to an embodiment of the present disclosure
  • FIG. 5 is a schematic diagram of an association between alarms according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic diagram of an example of implementing alarm association according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of an apparatus for implementing alarm association according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of an apparatus for implementing alarm association according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of an apparatus for implementing alarm association according to an embodiment of the present disclosure.
  • the method for implementing alarm association provided by the embodiment of the present disclosure is applied to a network function virtualization (NFV) system architecture.
  • NFV network function virtualization
  • NFV technology can be simply understood as the migration of the functions of the various network elements used in the telecommunication network from the current dedicated hardware platform to the general Commercial Off The Shelf (COTS) server.
  • COTS Commercial Off The Shelf
  • each network element used in the telecommunication network can be transformed into a stand-alone application, which can be flexibly deployed on a unified infrastructure platform built by standards-based servers, storage, and switches, and through virtualization technology to the infrastructure.
  • Hardware device resource pooling and virtualization providing virtual resources to upper-layer applications, enabling application and hardware decoupling, enabling each application to rapidly increase virtual resources to achieve rapid expansion of system capacity, or to rapidly reduce virtual resources to achieve shrinkage
  • the purpose of system capacity greatly enhances the flexibility of the network.
  • the common COTS server is used to form a shared resource pool. The newly developed services do not need to be separately deployed with hardware devices, which greatly shortens the time for new services to go online.
  • the foundation of NFV technology includes cloud computing technology and virtualization technology.
  • Hardware devices such as general-purpose COTS computing/storage/network can be decomposed into multiple virtual resources through virtualization technology for use by various applications in the upper layers.
  • virtualization technology Through the virtualization technology, the decoupling between the application and the hardware is realized, so that the virtual resource supply speed is greatly increased.
  • the cloud computing technology the elastic scalability of the application can be realized, and the virtual resource is matched with the service load, which not only improves the virtual resource. Utilize efficiency and improve system response rate.
  • the NFV system 100 includes an NFV Management and Orchestration (NFV MANO) 101, an NFV Infrastructure (NFVI) 130, and a plurality of Virtual Network Functions (VNF) 108, and more.
  • NFV MANO NFV Management and Orchestration
  • NFVI NFV Infrastructure
  • VNF Virtual Network Functions
  • Element Management (EM) 122 Network Services, VNF and Infrastructure Description (VNF and Infrastructure Description) 126, and Operation-Support System/Business Support System (OSS/BSS) 124.
  • EM Element Management
  • EM Network Services
  • VNF and Infrastructure Description VNF and Infrastructure Description
  • OSS/BSS Operation-Support System/Business Support System
  • the NFV management and orchestration system 101 includes an NFV Orchestrator (NFVO) 102, one or more VNF Managers (VNFMs) 104, and a Virtualized Infrastructure Manager (VIM) 106.
  • the NFVI 130 includes computing hardware 112, storage hardware 114, network hardware 116, virtualization layer, virtual computing 110, virtual storage 118, and virtual network 120.
  • Network services, VNF and infrastructure descriptions 126 and OSS/BSS 124 are discussed further in the ETSI GS NFV 002 V1.1.1 standard.
  • the NFV Management and Orchestration System (NFV MANO) 101 is used to perform monitoring and management of the VNF 108 and NFVI 130.
  • the NFVO 102 may implement network services (e.g., L2 and L3VPN services) on the NFVI 130, may also perform resource related requests from one or more VNFMs 104, send configuration information to the VNFM 104, and collect status information for the VNF 108.
  • NFVO 102 can communicate with VIM 106 to enable resource allocation and/or reservation and to exchange configuration and status information for virtualized hardware resources.
  • the VNFM 104 can manage one or more VNFs 108.
  • the VNFM 104 can perform various management functions such as instantiating, updating, querying, scaling, and/or terminating the VNF 108 and the like.
  • the VIM 106 can perform resource management functions such as managing the allocation of infrastructure resources (eg, adding resources to virtual containers) and operational functions (such as collecting NFVI failure information).
  • the VNFM 104 and the VIM 106 can communicate with each other for resource allocation and exchange of configuration and status information of virtualized hardware resources.
  • the NFVI 130 includes hardware resources, software resources, or a combination of both to complete the deployment of the virtualized environment.
  • hardware resources and virtualization layers are used to provide virtualized resources, such as virtual machines and other forms of virtual containers, for VNF 108.
  • Hardware resources include computing hardware 112, storage hardware 114, and network hardware 116.
  • Computing hardware 112 may be off-the-shelf hardware and/or user-customized hardware used to provide processing and computing resources.
  • Storage hardware 114 may be storage capacity provided within the network or storage capacity resident in storage hardware 114 itself (local storage located within the server). In one implementation, the resources of computing hardware 112 and storage hardware 114 may be grouped together.
  • Network hardware 116 can be a switch, a router, and/or any other network device configured to have switching functionality.
  • Network hardware 116 can span multiple domains and can include multiple networks interconnected by one or more transport networks.
  • the virtualization layer in NFVI 130 can abstract hardware resources from the physical layer and decouple VNF 108 to provide virtualization resources to VNF 108.
  • the virtual resource layer includes virtual computing 110, virtual memory 118, and virtual network 120.
  • Virtual computing 110 and virtual storage 118 may be provided to VNF 108 in the form of virtual machines, and/or other virtual containers.
  • one or more VNFs 108 can be deployed on a virtual machine.
  • the virtualization layer abstracts network hardware 116 to form a virtual network 120, which may include a virtual switch that is used to provide connectivity between virtual machines and other virtual machines.
  • the transport network in network hardware 116 can be virtualized using a centralized control plane and a separate forwarding plane (eg, software defined network, SDN).
  • VNFM 104 can interact with VNF 108 and EM 122 to manage the lifecycle of the VNF and exchange configuration and status information.
  • the VNF 108 can be configured to virtualize at least one network function performed by one physical network device.
  • the VNF 108 can be configured to provide functions of different network elements in an IP Multimedia Subsystem (IMS) network, such as proxy call session control functions (Proxy-Call Session Control Funtion). , P-SCSCF), the server call session control function (S-CSCF) or the network function of the Home Subscriber Server (HSS).
  • IMS IP Multimedia Subsystem
  • P-SCSCF proxy call session control functions
  • S-CSCF server call session control function
  • HSS Home Subscriber Server
  • the EM 122 is configured to manage one or more VNFs 108.
  • FIG. 2 is a schematic diagram of a module composition and a workflow of a method for implementing alarm association according to an embodiment of the present disclosure.
  • the apparatus for implementing alarm association provided by the embodiment of the present disclosure includes an alarm receiving module, an association analysis module, an alarm storage module, and an alarm display module.
  • the alarm receiving module is connected to the association analysis module, and the association analysis module is respectively connected to the alarm storage module and the alarm display module.
  • the alarm receiving module is configured to receive the alarm (1) sent by the VNF, and forward the received alarm to the association analysis module (2).
  • the association analysis module is configured to query the VNF for the attribute information of the alarm object indicated by each alarm (3) by using the data query script corresponding to each alarm.
  • the data query script is specifically used for data extraction and query.
  • association analysis module is further configured to query, according to the received attribute information for the alarm, an alarm that has occurred in the alarm storage module to perform association analysis (4). Then, the association analysis module stores the alarm and its associated result to the alarm storage module (5) and pushes it to the alarm display module (6).
  • the alarm storage module is used to store alarms, attribute information of alarm objects, and association relationships between alarms.
  • the alarm display module is used to display the relationship between each alarm and each alarm to the operation and maintenance personnel.
  • the association analysis module After receiving an alarm, the association analysis module sends a data query request for the alarm to the VNF to obtain all attribute information of the alarm object indicated by the alarm from the VNF, and then associates the analysis module. According to the obtained attribute information, the polling is performed in the at least one stored alarm in the alarm database, so that the stored alarm is associated with the alarm storage. Therefore, the workload of manually writing and maintaining the associated scripts for implementing alarms is greatly reduced, saving time and effort. Even in the case of a communication system with a large number of alarm types and complicated relationships, the association between alarms can be relatively simple.
  • the embodiment of the present disclosure is to query the VNF for all the attribute information of the alarm object, and use the attribute information of the queried alarm object to perform alarm association. Therefore, the situation that the alarm association is heavily dependent on the parameters carried by the alarm does not occur. That is, regardless of whether the newly received alarm carries the specified parameter, it can be associated with the alarm with which it has an associated relationship.
  • FIG. 3 is a flowchart of a method for implementing alarm association according to an embodiment of the present disclosure.
  • the execution body of the method for implementing alarm correlation is the association analysis module shown in FIG. 2 above.
  • the method flow provided by the embodiment of the present disclosure includes:
  • the association analysis module After receiving an alarm, acquires a data query script of the alarm, and invokes the data query script to send a data query request for the alarm to the VNF, where the data query request includes at least the first indication of the alarm indication.
  • the first identification information of the alarm object is not limited to the association analysis module.
  • the alarm received by the association analysis module is forwarded by the alarm receiving module, that is, after the software or hardware failure occurs in the NFV system, the VNF sends an alarm to the alarm receiving module, and the alarm receiving module is responsible for The collected alarms are forwarded to the association analysis module for subsequent association analysis.
  • the embodiment of the present disclosure also has a preset script.
  • the script is referred to as a data query script in the embodiment of the present disclosure, and can be used to query the VNF for the attribute information of the alarm object. That is, after receiving an alarm sent by the alarm receiving module, the association analysis module automatically acquires the data query script of the alarm, and invokes the data query script to send a data query request for the alarm to the VNF, requesting the VNF to return the clause. All attribute information of the first alarm object indicated by the alarm.
  • the data query script of the embodiment of the present disclosure is only used for extracting data in an alarm or querying the VNF for attribute information of an alarm object, that is, only for data extraction and data collection, which is related to the prior art.
  • the scripts used to implement alarm correlation are different, and there is no need to make settings related to the association between alarms.
  • the data query request further includes the first identifier information of the first alarm object indicated by the alarm.
  • the first identifier information of the first alarm object is used to identify the first alarm object to distinguish the first alarm object from other alarm objects.
  • the association analysis module receives the first attribute information returned by the VNF for the first alarm object.
  • the first attribute information is obtained by the VNF according to the first identification information after receiving the data query request.
  • the association analysis module can obtain the most complete attribute information of the first alarm object by sending the foregoing data query request to the VNF. In this way, even if the attribute information received by the association analysis module does not carry all the attribute information of the first alarm object, for example, only a small number of key attribute information, such as the first identification information carrying only the first alarm object, The service parameters of the alarm object, the referenced other objects, and the calling resources are not carried, and the alarm association cannot be implemented. The problem that the alarm association is heavily dependent on the parameters carried by the alarm is solved in the prior art.
  • the embodiment of the present disclosure obtains the association relationship between the alarms by querying the VNF for the attribute information of the alarm object, without relying on the parameters carried by the alarm itself.
  • the alarm association is also dependent on the manual preset script. The embodiment of the present disclosure saves the workload of manually writing and maintaining the script associated with the alarm, and implements automatic association of alarms.
  • the attribute information of the first alarm object may include multiple attributes, and each attribute is composed of the attribute name + attribute value.
  • FIG. 4 shows an execution flow of an alarm implementation association process.
  • the obtained first attribute information may include, for example, attribute name 1 + attribute value 1, attribute name 2+ attribute value 2, attribute name 3+ attribute. Value 3 and so on.
  • the type of the alarm object is used to indicate which type of fault the corresponding alarm belongs to.
  • the type of the alarm object may be a signaling link, a module, an IP address, and the like, which is not specifically limited in this embodiment of the present disclosure.
  • step 301 and step 302 complete the receiving of the alarm and the query of the first attribute information of the first alarm object, and then, as shown in FIG. 4, the polling may be performed according to the first attribute information that is queried.
  • the alarms are stored in the alarm library to correlate alarms. For the implementation process, see step 303 below.
  • the association analysis module performs a polling search in the at least one stored alarm according to the first attribute information of the first alarm object, and obtains a target stored alarm that is associated with the alarm.
  • the embodiments of the present disclosure collectively refer to all stored alarms stored in the alarm storage module by using an alarm library.
  • this alarm is used as a sub-alarm of the stored alarm.
  • condition 1 in FIG. If the alarm meets the following judgment conditions, the alarm is used as a sub-alarm of the stored alarm:
  • the alarm level of the stored alarm is greater than the alarm level of the alarm that has just been received, the alarm is determined as the sub-alarm of the stored alarm.
  • this alarm acts as a root alarm for the stored alarm.
  • the alarm acts as a root alarm for the stored alarm:
  • the alarm is determined as the root alarm of the stored alarm.
  • the alarm level is used as a sub-alarm of this alarm.
  • the alarm level is carried in each alarm as a mandatory option. Therefore, after receiving an alarm, the alarm level of the alarm can be obtained directly from the content carried by the alarm.
  • the embodiment of the present disclosure supports storing the alarm, the attribute information of the corresponding alarm object, and the association relationship between the alarms to the alarm storage module. And the relationship between the alarm and the alarm is pushed to the alarm display module, so that the alarm display module displays the relationship between the alarm and the alarm to the operation and maintenance personnel.
  • the association analysis module obtains at least one target associated with the alarm
  • the type information, the first identification information, the first attribute information, and the alarm are generated.
  • the association relationship between the stored alarms of a target is stored in the alarm storage module, and the relationship between the type information of the alarm, the first identification information, and the alarm between the alarm and the at least one target alarm is generated by the alarm display module. Displayed on the alarm display interface.
  • the relationship between the alarm and the alarm A and the alarm B is as an example.
  • the alarm storage module stores the alarm, Store it in the form of the following list.
  • the association between alarms is displayed in a tree view on the alarm display interface. Taking the current alarm as the alarm C, the association between the alarm A, the alarm B, and the alarm C can be displayed through the tree diagram shown in FIG. 5.
  • the operation and maintenance personnel may further modify the association relationship automatically analyzed by the association analysis module, for example, the association relationship automatically analyzed by the association analysis module may be rejected, and the association analysis module automatically records the operation and maintenance personnel. The result of the veto, and the veto alarm will no longer be associated.
  • the embodiment of the present disclosure may also discover the between the alarms by using the artificial intelligence fuzzy recognition technology to compare the attribute information of the newly received alarm with the identification information of the at least one alarm object that has been stored. Suspected associations, and the result of manual confirmation of these suspected associations as the next association rule.
  • the embodiment of the present disclosure utilizes the text analysis capability of the artificial intelligence fuzzy recognition technology to blur the attribute name and attribute value of the first alarm object indicated by the alarm and the identification information of the at least one alarm object with the stored alarm indication.
  • the comparison and the stored alarm with high similarity are also regarded as suspected alarms associated with this alarm.
  • the alarm display module can distinguish the alarms that are actually associated with the above-mentioned identified alarms, such as specifically identifying the suspected alarms. In this way, the operation and maintenance personnel can manually confirm whether there is a real relationship between the suspected alarm and the alarm. For a certain suspected alarm, if the suspected alarm is manually associated with the newly received alarm, the alarm storage module also stores the association relationship between the two.
  • the attribute information is fuzzyly compared with at least one piece of identification information of the at least one alarm object.
  • the at least one alarm object corresponds to at least one stored alarm, that is, the at least one alarm object is from at least one stored alarm. If the similarity between the attribute information and the identifier information of any one of the at least one alarm object is greater than a preset threshold, the alarm corresponding to any one of the alarm objects is determined as a suspected alarm associated with the alarm.
  • the preset threshold may be 90% or 95%, etc., and the embodiment of the present disclosure does not specifically limit this.
  • the alarm display module displays the type information of the suspected alarm and the identifier information of the suspected alarm, and displays an association confirmation prompt message for the suspected alarm; if the operation and maintenance personnel subsequently receive the association relationship with the suspected alarm After the operation is confirmed, the alarm storage module stores the association between the alarm and the suspect alarm.
  • the alarm receiving module receives a signaling link failure alarm sent by the VNF, and forwards the signaling link failure alarm to the association analysis module.
  • the association analysis module finds a module failure alarm in the alarm storage module.
  • the alarm level of the module fault alarm > the alarm level of the signaling link fault, so the signaling link fault alarm is used as the sub-alarm of the module fault alarm.
  • each alarm carries a parameter about the alarm level of this alarm. Through the parameter correlation analysis module, the alarm level of the above module failure alarm and signaling link failure alarm can be obtained.
  • the process for determining the suspected alarm based on the artificial intelligence fuzzy recognition technology is as follows:
  • the alarm storage module will record the IP collision alarm and the IP address conflict alarm when the IP address conflict alarm is associated with the IP address conflict alarm.
  • the "IP address" in the identification information of the object is the same. On the other hand, if the acknowledgment is not performed manually, there is no relationship between the IP conflict alarm and the signaling link failure alarm.
  • the method provided by the embodiment of the present disclosure after the association analysis module receives an alarm, sends a data query request for the alarm to the VNF to obtain all attribute information of the alarm object indicated by the alarm from the VNF, and then associates the analysis module. According to the obtained attribute information, the polling is performed in the at least one stored alarm in the alarm database, so that the stored alarm is associated with the alarm storage. Therefore, the workload of manually writing and maintaining the associated scripts for implementing alarms is greatly reduced, saving time and effort. Even in the case of a communication system with a large number of alarm types and complicated relationships, the association between alarms can be relatively simple.
  • the embodiment of the present disclosure is to query the VNF for all the attribute information of the alarm object, and use the attribute information of the queried alarm object to perform alarm association. Therefore, the situation that the alarm association is heavily dependent on the parameters carried by the alarm does not occur. That is, regardless of whether the newly received alarm carries the specified parameter, it can be associated with the alarm with which it has an associated relationship.
  • FIG. 7 is a schematic structural diagram of an apparatus for implementing alarm association according to an embodiment of the present disclosure.
  • the device includes:
  • the alarm receiving module 701 is configured to: after receiving an alarm, obtain a data query script of the alarm; and invoke the data query script to send a data query request for the alarm to the VNF, where the data query request includes at least First identifier information of the first alarm object indicated by the alarm; receiving first attribute information returned by the VNF for the first alarm object, where the first attribute information is received by the VNF After the query request is obtained according to the first identifier information;
  • the association analysis module 702 is configured to perform a polling search in the at least one stored alarm according to the first attribute information of the first alarm object, and obtain a target stored alarm that is associated with the alarm.
  • the association analysis module 702 is configured to store an alarm for each of the at least one stored alarm, if the second identifier information of the second alarm object that is stored by the stored alarm is If an attribute information of the first attribute information matches, and the alarm level of the stored alarm is greater than the alarm level of the alarm, the alarm is determined as a sub-alarm of the stored alarm.
  • the association analysis module 702 is configured to: for each of the at least one stored alarm, if one attribute of the second attribute information of the second alarm object indicated by the stored alarm is stored The information is matched with the first identifier information of the first alarm object, and the alarm level of the alarm is greater than the alarm level of the stored alarm, and the alarm is determined as the root alarm of the stored alarm.
  • the association analysis module 702 is further configured to: perform fuzzy matching on the attribute information with the at least one identifier information of the at least one alarm object for each piece of attribute information in the first attribute information.
  • the at least one alarm object corresponds to the at least one stored alarm; if the similarity between the attribute information and the identification information of any one of the at least one alarm object is greater than a preset threshold, The alarm corresponding to any one of the alarm objects is determined to be a suspected alarm associated with the alarm.
  • the apparatus further includes:
  • the alarm display module 703 is configured to display the type information of the suspected alarm and the identifier information of the suspected alarm, and display an association confirmation prompt message for the suspected alarm;
  • the alarm storage module 704 is configured to store an association relationship between the alarm and the suspected alarm after receiving an association confirmation operation for the suspected alarm.
  • the alarm storage module 704 is configured to: after obtaining at least one target stored alarm associated with the alarm, the type information of the alarm, the first identifier information, and the first An attribute information, an association relationship between the alarm and the at least one target stored alarm is stored;
  • the alarm display module 703 is configured to display the type information of the alarm, the first identification information, and the association relationship between the alarm and the at least one target stored alarm.
  • the association analysis module After receiving an alarm, the association analysis module sends a data query request for the alarm to the VNF to obtain all attribute information of the alarm object indicated by the alarm from the VNF, and then associates the analysis module. According to the obtained attribute information, the polling is performed in the at least one stored alarm in the alarm database, so that the stored alarm is associated with the alarm storage. Therefore, the workload of manually writing and maintaining the associated scripts for implementing alarms is greatly reduced, saving time and effort. Even in the case of a communication system with a large number of alarm types and complicated relationships, the association between alarms can be relatively simple.
  • the embodiment of the present disclosure is to query the VNF for all the attribute information of the alarm object, and use the attribute information of the queried alarm object to perform alarm association. Therefore, the situation that the alarm association is heavily dependent on the parameters carried by the alarm does not occur. That is, regardless of whether the newly received alarm carries the specified parameter, it can be associated with the alarm with which it has an associated relationship.
  • the device that implements the alarm association provided by the foregoing embodiment implements the alarm association
  • only the division of each functional module is used as an example.
  • the foregoing function may be allocated by different functional modules according to requirements. Completion, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.
  • the method for implementing the alarm association provided by the foregoing embodiment is the same as the method for implementing the alarm association. The specific implementation process is described in detail in the method embodiment, and details are not described herein again.
  • FIG. 9 is a schematic structural diagram of an apparatus 900 for implementing alarm correlation according to an embodiment of the present disclosure.
  • the apparatus 900 includes a processor, a communication interface, a memory, and a communication bus, and may further include an input/output interface, wherein the processor, the memory, the input/output interface, and the communication interface complete communication with each other through the communication bus.
  • the memory stores at least one instruction, at least one program, code set or instruction set
  • the processor is configured to execute at least one instruction, at least one program, code set or instruction set stored on the memory, to implement the implementation described in the foregoing embodiment.
  • the method associated with the alarm is described in the foregoing embodiment.
  • a computer readable storage medium storing a computer program, such as a memory storing a computer program, the at least one instruction, the at least one program, the code set or the instruction set being executed by the processor
  • a computer program such as a memory storing a computer program
  • the at least one instruction such as a code set or the instruction set being executed by the processor
  • the computer readable storage medium may be a Read-Only Memory (ROM), a Random Access Memory (RAM), or a Compact Disc Read-Only Memory (CD-ROM).
  • CD-ROM Compact Disc Read-Only Memory
  • a person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium.
  • the storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

L'invention concerne un procédé et un appareil de réalisation d'association d'alarme, et un support d'informations lisible par ordinateur, qui se rapportent au domaine technique des communications. Le procédé consiste : à acquérir, après réception d'une alarme, un script d'interrogation de données de l'alarme ; à invoquer le script d'interrogation de données, et à envoyer une requête d'interrogation de données concernant l'alarme à une VNF, la requête d'interrogation de données comprenant au moins des premières informations d'identification concernant un premier objet d'alarme indiqué par l'alarme ; à recevoir des premières informations d'attribut, renvoyées par la VNF, concernant le premier objet d'alarme ; et selon les premières informations d'attribut concernant le premier objet d'alarme, à effectuer une interrogation et une recherche dans au moins une alarme mémorisée, et à obtenir une alarme mémorisée cible ayant une relation d'association avec l'alarme. Étant donné que l'invention réalise le cas où l'association d'alarme n'a pas besoin de dépendre d'un script associé, la charge de travail de compilation manuelle et la maintenance d'un script associé pour réaliser l'association d'alarme sont considérablement réduites, économisant ainsi du temps comme de la main d'œuvre. Même pour un système de communication comportant un grand nombre de types d'alarme et des relations complexes, l'association entre des alarmes peut également être achevée plus facilement.
PCT/CN2018/091931 2017-06-28 2018-06-20 Procédé et appareil de réalisation d'association d'alarme, et support d'informations lisible par ordinateur WO2019001312A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710507468.3A CN109150572B (zh) 2017-06-28 2017-06-28 实现告警关联的方法、装置以及计算机可读存储介质
CN201710507468.3 2017-06-28

Publications (1)

Publication Number Publication Date
WO2019001312A1 true WO2019001312A1 (fr) 2019-01-03

Family

ID=64740370

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/091931 WO2019001312A1 (fr) 2017-06-28 2018-06-20 Procédé et appareil de réalisation d'association d'alarme, et support d'informations lisible par ordinateur

Country Status (2)

Country Link
CN (1) CN109150572B (fr)
WO (1) WO2019001312A1 (fr)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109933582A (zh) * 2019-03-11 2019-06-25 国家电网有限公司 数据处理方法及装置
CN110209914A (zh) * 2019-06-13 2019-09-06 腾讯科技(成都)有限公司 一种信息查询方法及相关装置
CN111756582A (zh) * 2020-07-07 2020-10-09 上海新炬网络技术有限公司 基于nfv日志告警的业务链监控方法
CN112054988A (zh) * 2019-06-06 2020-12-08 富士通株式会社 存储介质、通信方法和通信装置
CN113157536A (zh) * 2021-05-26 2021-07-23 中国银行股份有限公司 一种告警分析方法、装置、设备和存储介质
CN114094708A (zh) * 2021-11-25 2022-02-25 广东电网有限责任公司东莞供电局 一种电网设备关联告警方法及系统
CN114721912A (zh) * 2021-01-04 2022-07-08 腾讯科技（深圳）有限公司 一种数据分析方法、装置、设备及介质

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113448809A (zh) * 2020-03-24 2021-09-28 伊姆西Ip控股有限责任公司 管理应用系统中的消息的方法、设备和计算机程序产品
CN111488997A (zh) * 2020-04-14 2020-08-04 中国联合网络通信集团有限公司 自动运维方法、装置、设备及存储介质
CN114143165A (zh) * 2020-08-14 2022-03-04 北京达佳互联信息技术有限公司 业务报警方法、装置、服务器、存储介质及程序产品
CN112583643A (zh) * 2020-12-14 2021-03-30 浪潮云信息技术股份公司 一种跨设备告警关联方法
CN117978516A (zh) * 2024-02-21 2024-05-03 北京火山引擎科技有限公司 告警数据处理方法、装置、介质及电子设备
CN118012661B (zh) * 2024-04-08 2024-08-02 杭州长川科技股份有限公司 测试告警监控装置、方法和测试机

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120011517A1 (en) * 2010-07-08 2012-01-12 Virginia Smith Generation of operational policies for monitoring applications
CN105337758A (zh) * 2014-08-15 2016-02-17 中兴通讯股份有限公司 告警处理方法、装置、nms、oss及ems
CN106250288A (zh) * 2016-07-29 2016-12-21 浪潮软件集团有限公司 一种基于数据挖掘的根告警分析识别方法

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100343818C (zh) * 2004-08-24 2007-10-17 华为技术有限公司 一种告警相关性屏蔽方法
CN1992636B (zh) * 2005-12-29 2010-04-21 华为技术有限公司 一种处理告警信息的系统及方法
CN105591784A (zh) * 2014-10-24 2016-05-18 中兴通讯股份有限公司 告警处理方法及装置
AU2015382846B2 (en) * 2015-02-12 2018-10-04 Huawei Technologies Co., Ltd. Alarm information processing method, related device and system
CN105119736B (zh) * 2015-07-15 2019-01-18 华为技术有限公司 网络功能虚拟化架构中数据检查的方法和装置
CN105677759B (zh) * 2015-12-30 2019-11-12 国家电网公司 一种信息通信网络中的告警关联性分析方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120011517A1 (en) * 2010-07-08 2012-01-12 Virginia Smith Generation of operational policies for monitoring applications
CN105337758A (zh) * 2014-08-15 2016-02-17 中兴通讯股份有限公司 告警处理方法、装置、nms、oss及ems
CN106250288A (zh) * 2016-07-29 2016-12-21 浪潮软件集团有限公司 一种基于数据挖掘的根告警分析识别方法

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109933582A (zh) * 2019-03-11 2019-06-25 国家电网有限公司 数据处理方法及装置
CN112054988A (zh) * 2019-06-06 2020-12-08 富士通株式会社 存储介质、通信方法和通信装置
CN110209914A (zh) * 2019-06-13 2019-09-06 腾讯科技(成都)有限公司 一种信息查询方法及相关装置
CN110209914B (zh) * 2019-06-13 2024-04-12 腾讯科技(成都)有限公司 一种信息查询方法及相关装置
CN111756582A (zh) * 2020-07-07 2020-10-09 上海新炬网络技术有限公司 基于nfv日志告警的业务链监控方法
CN111756582B (zh) * 2020-07-07 2022-12-02 上海新炬网络技术有限公司 基于nfv日志告警的业务链监控方法
CN114721912A (zh) * 2021-01-04 2022-07-08 腾讯科技（深圳）有限公司 一种数据分析方法、装置、设备及介质
CN113157536A (zh) * 2021-05-26 2021-07-23 中国银行股份有限公司 一种告警分析方法、装置、设备和存储介质
CN114094708A (zh) * 2021-11-25 2022-02-25 广东电网有限责任公司东莞供电局 一种电网设备关联告警方法及系统
CN114094708B (zh) * 2021-11-25 2024-06-18 广东电网有限责任公司东莞供电局 一种电网设备关联告警方法及系统

Also Published As

Publication number Publication date
CN109150572B (zh) 2020-07-24
CN109150572A (zh) 2019-01-04

Similar Documents

Publication Publication Date Title
WO2019001312A1 (fr) Procédé et appareil de réalisation d'association d'alarme, et support d'informations lisible par ordinateur
WO2020253347A1 (fr) Procédé, dispositif et système de gestion de grappe de conteneurs
WO2021017301A1 (fr) Procédé et appareil de gestion sur la base d'une grappe kubernetes, et support de mémoire lisible par ordinateur
WO2021017279A1 (fr) Procédé et appareil de gestion de la sécurité de grappe fondés sur kubernetes et un domaine de réseau, et support de stockage
US20200382362A1 (en) Alarm information processing method, related device, and system
US10491453B2 (en) Correlating computing network events
WO2017148326A1 (fr) Procédé et dispositif de gestion de ressource
IL268670A (en) Automatic detection of server clusters
US12035156B2 (en) Communication method and apparatus for plurality of administrative domains
CN109324892B (zh) 分布式管理方法、分布式管理系统及装置
CN112579552A (zh) 日志存储及调用方法、装置及系统
CN112068953B (zh) 一种云资源精细化管理溯源系统及方法
US11336502B2 (en) Deriving network device and host connection
CN112765246A (zh) 任务处理方法、装置、电子设备和存储介质
CN110995489A (zh) 大数据平台服务器管理方法、装置、服务器及存储介质
CN115220992A (zh) 接口变更监控方法、装置、计算机设备和存储介质
CN107656999B (zh) 呼叫历史追溯方法、装置、电子设备、存储介质
CN111858079B (zh) 分布式锁迁移方法、装置及电子设备、存储介质
CN114756301A (zh) 日志处理方法、装置和系统
WO2020077585A1 (fr) Procédé et appareil d'instanciation de service de vnf
WO2018099301A1 (fr) Procédé et dispositif d'analyse de données
US20240070002A1 (en) Hang detection models and management for heterogenous applications in distributed environments
CN114844957B (zh) 链路报文转换方法、装置、设备、存储介质和程序产品
US20240340215A1 (en) Discovering and retrieving management data in a telecommunications network
CN114666231B (zh) 一种多云环境下可视化运维管理方法、系统及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18822984

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18822984

Country of ref document: EP

Kind code of ref document: A1