A kind of network element alarming suppressing method and system
Technical field
The invention belongs to Internet technical fields, and in particular to a kind of network element alarming suppression technology.
Background technology
With the rapid development of the development of internet, especially mobile Internet, the data of network element device sharply increase, net
The alarm quantity of element device also sharply increases therewith, and alarm windstorm happens occasionally, and causes network congestion, business data transmission by
Resistance, brings huge challenge, while causing huge traffic lost to enterprise to the maintenance work of network element device, so how
The alarm windstorm problem of effective solution network element, including the generation of alarm windstorm is avoided in advance, while ensureing warning information again
Integrality be particularly important in network operation work especially for the network element device of Very Important Person.
Current usual way:In network element or webmaster side, the same alarm is counted, the frequency for alerting generation arrives
Up to after certain threshold value, such as 50 times/second, alarm is put into its " in alarm windstorm list ", has alarm to generate and deposit when follow-up
When being in alarm windstorm list, the alarm is directly abandoned.
Above-mentioned way, there are two distinct disadvantages:First, simple when judging that alarm exists when its " in alarm windstorm list "
Single abandons alarm, destroys the integrality of alarm report, is unable to real embodiment alarm present situation:Upper-level system can not be learnt down
Whether layer network element device also is continuing that alarm windstorm occurs;It can not learn the seriousness of alarm windstorm.Secondly, alarm is not provided
Tactful treatment measures when i.e. alarm is more frequent before storm occurs reduce the generation of alarm windstorm.
Existing technology mainly considers after alarm windstorm occurs, and discard processing is carried out to alarm, to reduce alarm
Quantity is unable to real embodiment alarm present situation, it is contemplated that actual use scene it is done so that destroying the integrality of alarm report
In, network maintenance staff is it should be understood that the present situation alerted, ability accurate evaluation network condition;It additionally needs and occurs in alarm windstorm
Before take some measures and reduce alarm windstorm.
Invention content
The technical problems to be solved by the invention are:Alarm windstorm occur before, lack classification it is other to alarm carry out at inhibition
Reason reduces the problem of mechanism of alarm windstorm;And in the prior art, when alarm windstorm occurs, only simply announcement
It is alert to abandon, the problem of destroying the integrality of alarm report, be unable to real embodiment alarm present situation, to solve the above problems, this hair
It is bright to propose a kind of network element alarming suppressing method and system.
The present invention solve the technical solution that its technical problem uses for:A kind of network element alarming suppressing method, including following step
Suddenly:
A, the frequency that alarm and alarm from network element occur is received;
B, judge whether the frequency that alarm occurs meets the alarm conditions that alarm inhibits strategy, C thened follow the steps if meeting,
It is no to then follow the steps D;
C, the alert processing method of strategy is inhibited to handle alarm according to alarm;
D, the first warning information is reported.
Further, first warning information is warning content.
Further, further include step A0, configuration alarm inhibition strategy, including alarm conditions and corresponding alarming processing
Method;It includes that frequently alarm inhibits strategy and alarm windstorm processing strategy, the frequent alarm to inhibit that the alarm, which inhibits strategy,
Strategy and alarm windstorm processing strategy are divided into several grades according to the frequency that alarm occurs, and each grade is arranged at corresponding alarm
Reason method.
Further, when alerting occurrence frequency and meeting the alarm conditions for frequently alerting inhibition strategy, according to frequent alarm
The alert processing method of strategy configuration is inhibited to handle the alarm.
Further, when alarm occurrence frequency meets the alarm conditions of alarm windstorm processing strategy, the step C is also wrapped
Include the total degree that alarm occurs in the frequency and a cycle that statistics alarm occurs.
The present invention also provides a kind of network element alarming suppression systems, including:Alarm statistics module, alarm inhibit tactical management mould
Block, alarm statistics monitor module and alarm report module;
The alarm statistics module, the frequency occurred for counting alarm and corresponding alarm;
The alarm inhibits policy management module, inhibits strategy for configuring alarm, including alarm conditions and corresponding
Alert processing method;The alarm inhibition strategy includes frequent alarm inhibition strategy and alarm windstorm handles strategy, described frequent
Alarm inhibits strategy and alarm windstorm processing strategy to be divided into several grades according to the frequency that alarm occurs, and each grade setting corresponds to
Alert processing method;
The alarm statistics monitor module, for the warning information according to alarm statistics module, judge whether to meet alarm
Inhibit the frequent alarm in policy management module that strategy or alarm windstorm is inhibited to handle tactful, and according to corresponding processing method at
Reason alarm;
The alarm report module is used for upward layer managing system report and alarm information.
Further, it further includes receiving unit that the alarm statistics, which monitor module, and alarm statistics module is come from for receiving
Alarm and alarm occur frequency.
Further, it further includes alarm inquiry unit that the alarm statistics, which monitor module, for according to the alarm received
The frequency queries alarm of generation inhibits policy management module, judges whether alarm meets frequently alarm and inhibit strategy or alarm windstorm
Processing strategy, and inquiry data are returned, the inquiry data are corresponding alert processing method.
Further, it further includes alarming processing unit that the alarm statistics, which monitor module, for according to alarm inquiry unit
The inquiry data processing of return alerts;
The result that the alarm inquiry unit returns is:Alarm meets frequently alarm and strategy or alarm is inhibited to meet alarm
Storm processing strategy or alarm, which are unsatisfactory for frequently alerting, to be inhibited strategy and is unsatisfactory for alarm windstorm processing strategy.
Further, when alerting occurrence frequency and meeting the alarm conditions for frequently alerting inhibition strategy, alarming processing list
Member inhibits the alert processing method of strategy configuration according to frequent alarm, and the alarm is periodically sent to alarm report module;Work as announcement
When alert occurrence frequency meets the alarm conditions of alarm windstorm processing strategy, frequency that the statistics alarm of alarming processing unit occurs and
Total degree occurs for the alarm in a cycle, and statistical information is periodically transmitted to alarm report module;When alarm occurs
When frequency is unsatisfactory for frequently alarm inhibition strategy and is unsatisfactory for the alert processing method that alarm windstorm processing strategy is configured, directly
Alarm is sent to alarm report module.
Beneficial effects of the present invention:The network element alarming processing method and system of the present invention passes through before alarm windstorm generation
The inhibition strategy of different stage, reduces the total amount of alarm report, effectively reduces the generation of alarm windstorm;Alarm windstorm occurs
Afterwards, warning information is counted, and according to preconfigured tactful periodically report and alarm statistical information, to greatest extent
The integrality that ensure that alarm.The present invention network element alarming suppressing method and system, reduce client because network storm and
The traffic lost being subject to, while the alarm statistics information after alarm windstorm generation, it is network-like in progress to network maintenance staff
Condition provides effective reference when assessing, and improves the accuracy and specific aim of Network status assessment, further enhances network
Maintenance efficiency.
Description of the drawings
Fig. 1 is the network element alarming process flow figure of the embodiment of the present invention.
Fig. 2 is the frequent alert processing method flow chart of the embodiment of the present invention.
Fig. 3 is the alarm windstorm process flow figure of the embodiment of the present invention.
Fig. 4 is the network element alarming processing system schematic block diagram of the embodiment of the present invention.
Specific implementation mode
For ease of those skilled in the art understand that the present invention technology contents, below in conjunction with the accompanying drawings with specific embodiment pair
The present invention is further elaborated.
It is as shown in Figure 1 the flow chart of the network element alarming processing method of the embodiment of the present invention, specifically includes following steps:
S1:Receive the frequency that alarm and alarm from network element occur;
S2:Judge whether the frequency that alarm occurs meets the alarm conditions that alarm inhibits strategy, is thened follow the steps if meeting
S3, it is no to then follow the steps S4;
S3:The alert processing method of strategy is inhibited to handle alarm according to alarm;
S4:Report the first warning information.
Wherein, it includes that frequently alarm inhibits strategy and alarm windstorm processing strategy that alarm, which inhibits strategy, by that will alert frequency
Rate is divided into several grades, and alert processing method is arranged in corresponding each grade.When alert frequency reaches first threshold and less than the
When two threshold values, strategy is inhibited using frequent alarm;When alert frequency reaches second threshold, strategy is handled using alarm windstorm,
Otherwise when alert frequency is relatively low, i.e., when not up to alarm inhibits the alarm conditions of strategy, using directly reporting the first warning information
Mode, first warning information be warning content.
Such as when setting first threshold is 10 per second, second threshold is 50 per second, then by being carried out to alert frequency
It divides, frequently alarm inhibits strategy can be as shown in table 1 for the configuration:
Table 1
Alert the condition met |
Processing method |
11-20 items are per second |
Send within 5 seconds primary alarm |
21-30 items are per second |
Send within 10 seconds primary alarm |
31-40 items are per second |
Send within 15 seconds primary alarm |
41-50 items are per second |
Send within 20 seconds primary alarm |
The configuration alarm windstorm processing strategy can be as shown in table 2:
Table 2
Alert the condition met |
Processing method |
50-100 items are per second |
Send an alarm statistics information within 10 seconds |
100-200 items are per second |
Send an alarm statistics information within 30 seconds |
200 it is per second more than |
Send an alarm statistics information within 60 seconds |
Be illustrated in figure 2 the frequent alarming processing flow chart of the embodiment of the present invention, specifically include it is following step by step:
S31:It alerts occurrence frequency and meets frequently alarm inhibition processing strategy;
S32:The processing method of strategy processing strategy is inhibited to handle warning information according to corresponding frequent alarm;
S33:Timing reports the second warning information, and second warning information is warning content.
Such as it is 18 per second to listen to alarm occurrence frequency, then according to corresponding processing method:Send within 5 seconds primary alarm
Information.
Be illustrated in figure 3 the alarm windstorm process chart of the embodiment of the present invention, specifically include it is following step by step:
S31`:Alarm occurrence frequency meets alarm windstorm processing strategy;
S32`:The processing method that strategy is handled according to alarm windstorm, counts the statistical information of the alarm, statistical information is main
Including:Alert the sum of the generation in the frequency and a cycle occurred;
S33`:According to the processing method of alarm windstorm strategy setting, the first warning information is periodically sent to alarm
Reporting module, first warning information are alarm statistics information.
Such as it is 180 per second to listen to alarm occurrence frequency, then according to corresponding processing method:Send within 30 seconds primary accuse
Alert statistical information, counts the total degree of occurrence frequency and generation of the alarm within 30 second period, then reports one within every 30 seconds
The occurrence frequency of secondary alarm and the generation total degree in 30 second period.
When alarm occurrence frequency is unsatisfactory for frequently alerting, and strategy or alarm windstorm is inhibited to handle strategy, directly upper report
Alert information, such as it is 3 per second to listen to alarm occurrence frequency, then has both been unsatisfactory for frequently alarm and has inhibited strategy or be unsatisfactory for alerting
Storm processing strategy, then directly report warning information.
It is illustrated in figure 4 the network element alarming suppression system schematic block diagram of the embodiment of the present invention, the present invention also provides a kind of nets
Member alarm suppression system, the system include:Alarm statistics module, alarm inhibit policy management module, alarm statistics to monitor module
And alarm report module;
The alarm statistics module, the frequency occurred for counting alarm and alarm.The alarm statistics module can be set
It sets in network element side network element or webmaster side.
The alarm inhibits policy management module, inhibits strategy for configuring alarm, including alarm conditions and corresponding
Alert processing method;The alarm inhibition strategy includes frequent alarm inhibition strategy and alarm windstorm handles strategy, described frequent
Alarm inhibits strategy and alarm windstorm processing strategy to be divided into several grades according to the frequency that alarm occurs, and each grade setting corresponds to
Alert processing method.
The alarm statistics monitor module, for the information according to alarm statistics module, judge whether that meeting alarm inhibits
Frequent alarm in policy management module inhibits strategy or alarm windstorm processing strategy, and is handled and accused according to corresponding processing method
Alert information.Specific warning information is divided into different situations according to the processing method of alarm later and illustrates.
The alarm report module is used for upward layer managing system report and alarm information.
The alarm statistics monitor module:Receiving unit, query unit and processing unit;The receiving unit,
The warning information from alarm statistics module is received, and alarm occurrence frequency is forwarded to query unit;The query unit is used
According to alarm occurrence frequency query warning inhibit policy management module, judge alarm whether meet frequently alarm inhibit strategy or
Alarm windstorm processing strategy, and inquiry data are returned, the inquiry data are the alignment processing method of alarm;The processing is single
Member, for according to corresponding alert processing method processing alarm in inquiry data.
The data that the alarm inquiry unit returns are divided into:Alarm, which meets frequently to alert, inhibits strategy or alarm to meet announcement
Police conduct handles strategy cruelly or alarm is unsatisfactory for frequently alerting and inhibits strategy and be unsatisfactory for these three tactful data of alarm windstorm processing.
When alerting occurrence frequency and meeting the alarm conditions for frequently alerting inhibition strategy, processing unit is according to frequent alarm suppression
The alert processing method of system strategy configuration handles the alarm, and sends alarm to alarm report module timing.
When alarm occurrence frequency meets the alarm conditions of alarm windstorm processing strategy, processing unit statistics alarm generation frequency
Total degree occurs for the alarm in rate and a cycle, and alarm statistics are downstream sent to alarm report mould information cycle
Block.
When alarm occurrence frequency had both been unsatisfactory for frequently alerting the alarm conditions for inhibiting tactful or was unsatisfactory for alarm windstorm processing
When the alarm conditions of strategy, processing unit is directly to alarm report module report and alarm.
The network element alarming suppressing method and system of the present invention passes through the inhibition plan of different stage before alarm windstorm generation
Slightly, the total amount of alarm report is reduced, the generation of alarm windstorm is effectively reduced;Alarm windstorm occur after, to warning information into
It has gone statistics, and according to preconfigured strategy periodically report and alarm statistical information, ensure that alarm to greatest extent
Integrality.The network element alarming suppressing method and system of the present invention, reduces the traffic lost that client is subject to because of network storm,
Alarm statistics information after alarm windstorm generation simultaneously, has provided to network maintenance staff when carrying out Network status assessment
The reference of effect improves the accuracy and specific aim of Network status assessment, further enhances the maintenance efficiency of network.And this
The method and system of invention the network systems such as banking software system, telesoftware system, public security software systems it is huge, to network
Security requirement is high, requires network maintainability to have a clear superiority in high industry.
Those of ordinary skill in the art will understand that the embodiments described herein, which is to help reader, understands this hair
Bright principle, it should be understood that protection scope of the present invention is not limited to such specific embodiments and embodiments.For ability
For the technical staff in domain, the invention may be variously modified and varied.All within the spirits and principles of the present invention, made by
Any modification, equivalent substitution, improvement and etc. should be included within scope of the presently claimed invention.