WO2011026342A1

WO2011026342A1 - Processing method and processing device for alarm storm

Info

Publication number: WO2011026342A1
Application number: PCT/CN2010/072663
Authority: WO
Inventors: 江有志
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-09-01
Filing date: 2010-05-12
Publication date: 2011-03-10
Also published as: CN101636000A

Abstract

A processing method and a processing device for alarm storm are provided by the invention, the method involves the following steps: acquiring frequency and duration of reported alarms (S101); and judging that an alarm storm is generated when the frequency and the duration of the reported alarms are both larger than respective preset threshold values (S102), the alarm storm is processed according to a set rule (S103). The processing device comprises an alarm processing-setting unit, an alarm information obtaining unit, an alarm storm judging unit and an alarm storm processing unit. The generation of the alarm storm is judged according to the frequency and the duration of the alarms; and the alarm storm generated by known or unknown alarms is processed, thereby the flexibility, the stability and the consistency of network management system are improved. In addition, the alarms are recovered by transferring the alarms after the alarm storm is finished, thereby avoiding discarding some alarms with significance and effectively reducing the load of a server terminal.

Description

Processing method and processing device for alarm storm

The present invention relates to the field of mobile communications, and in particular to a method and a processing apparatus for an alarm storm in a network management system. Background technique

As one of the important management functions provided by the TMN (Telecommunications Management Network Model) architecture, the stability of the alarm management directly affects the stability of the entire network management system. The most important impact on the stability and processing efficiency of the alarm management module is the alarm storm. When the alarm storm comes, it will consume a lot of system resources, causing the network management system to reflect slowness or even collapse. The alarm storm is a problem that any network management system should face. If there is no effective processing method, the alarm storm will bring irreparable damage.

In the current network management system, the alarm storm is mainly used to suppress certain types of alarms by using customized alarm rules. After the alarms of the specified type are reported to the NMS, they are discarded or saved to the database. It does not show up to the client.

The above method has the following drawbacks: It can only block the alarms that may be caused by the experience that may cause the alarm storm. For the unknown type of alarm, there is no processing capability. When an unknown type of alarm storm comes, the system has no time to react, causing the network management system to reflect sluggishness or even collapse. In addition, when an alarm storm is masked, if all the alarms are directly discarded during the alarm storm, some important alarms may be discarded, which may affect the system usage. If the alarm is saved to the database, but it is not displayed to the client, the server still needs to do the processing, which can not effectively reduce the load on the server. Summary of the invention

The technical problem to be solved by the present invention is to provide a processing method and a processing device for an alarm storm capable of adaptively processing an alarm storm without losing key data and improving the flexibility, stability, and consistency of the network management system. It is used to solve the problem that the prior art cannot handle an unknown type of alarm storm, or can effectively reduce the load on the server side, and may discard some important alarms.

In order to solve the above technical problem, the technical solution of the present invention is implemented as follows:

A method for processing an alarm storm, the method comprising the following steps:

Obtain the frequency and duration of the reported police;

When the frequency and the duration of the alarm are greater than the corresponding threshold, the alarm storm is determined to be generated, and the alarm storm is processed according to the set rule.

The method for processing an alarm storm according to a set rule includes: discarding, or transferring, the alarm to the file system.

After the alarm is transferred to the file system, the method further includes the following steps: after the alarm storm ends, the report to the file system is restored to an alarm object and inserted into the file system. Go to the historical alarm library.

While the alarm storm is processed, the method further includes:

An alarm storm alarm is generated to prompt the user to generate an alarm storm.

The information included in the alarm storm alarm includes: an alarm name, a frequency, and a duration of the alarm storm.

A processing device for alarm storm, the device comprising:

An alarm information acquiring unit, configured to acquire a frequency and a duration of the reported alarm;

The alarm storm judging unit is configured to determine whether an alarm storm is generated according to the frequency and duration of the alarm, and the corresponding threshold value, which is obtained by the alarm information acquiring unit, and the alarm storm processing unit is configured to generate an alarm storm. After the alarm storm is set Rule is processed.

The alarm storm processing unit includes at least one of the following:

The alarm discarding subunit is configured to discard the upper report alarm that generates an alarm storm.

The alarm dump sub-unit is configured to store the alarm report of the alarm storm into the file system. The alarm storm processing unit further includes:

The alarm recovery sub-unit is configured to restore the alarm file to the file system when the alarm storm is over, and restore the alarm object to the alarm object and insert it into the historical alarm library.

The processing device further includes:

The alarm recovery setting unit is configured to restore some or all of the alarms that are transferred to the file system when recovering from the file system.

The alarm information acquiring unit includes:

a counter, configured to record the number of the reported alarms and the time when the alarm is reported; the alarm storm processor is configured to receive the reported alarm and update the counter.

The processing device further includes:

The alarm processing setting unit is configured to set a frequency threshold and a duration threshold for reporting the alarm, and set a method for processing the alarm storm according to the setting rule.

The beneficial effects of the present invention are as follows:

The alarm storm generated by the known or unknown alarm can be processed to improve the flexibility, stability, and consistency of the network management system. After the alarm storm is over, the alarm is restored to avoid discarding some important alarms, which also effectively reduces the negative of the server.

DRAWINGS

1 is a flowchart of a method for processing an alarm storm according to a first embodiment of the present invention;

2 is a flowchart of a method for processing an alarm storm according to a second embodiment of the present invention; 3 is a schematic structural diagram of an alarm storm processing device according to a third embodiment of the present invention; FIG. 4 is a schematic structural diagram of an alarm storm processing device according to a fourth embodiment of the present invention;

5 is a structural diagram of a subsystem of an alarm storm processing apparatus according to a fifth embodiment of the present invention; FIG. 6 is a flowchart of an alarm processing in an alarm storm processing method according to an embodiment of the present invention;

FIG. 7 is a flowchart of a background processing thread in an alarm storm processing method according to an embodiment of the present invention. detailed description

In order to solve the problem that the prior art is not suitable for the alarm storm, the present invention provides a method and a processing device for processing an alarm storm. The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

The characteristic of the alarm storm is that the alarm is reported in a large amount in a short period of time, which consumes a large amount of system resources and causes the system to crash. If we perform a pre-processing before the network management system receives the alarm report and does not actually process the alarm, it is considered that the alarm storm occurs when the alarm is reported to a higher frequency for a period of time. Or dump to the file system, it can effectively remove the garbage data, reduce the load on the network management system.

The core idea of the present invention is to dynamically determine whether an alarm storm is generated based on the frequency and duration of the reported police. When an alarm storm occurs, the reported alarm is not sent to the alarm module for processing, but is directly discarded or dumped to the file system. After being dumped to the file system, after the alarm storm has passed, the user can manually restore the alarm data dumped to the file system and convert it into a historical alarm for the user to view.

FIG. 1 is a first embodiment of the present invention. In this embodiment, the method for processing an alarm storm includes the following steps:

S101, first obtain the frequency and duration of the reported alarm. The frequency of the alarm is reported by recording the number of alarms, and recording the occurrence time of each alarm. After calculating, the frequency of the alarm is reported; and the duration of the alarm is recorded. 5102. Determine whether an alarm storm is generated. The specific steps are as follows: Compare the frequency and duration of the upper report alarm obtained in step S101 with the frequency threshold of the upper report alarm and the duration of the upper report alarm set in the system, respectively, only when step S101 When the frequency and duration of the upper reported alarms are greater than their respective thresholds, it is determined that the alarm storm is generated; when only one of them exceeds the set threshold, or both of them do not exceed the set threshold, Then it is determined that no alarm storm has occurred. That is, it is assumed that the frequency of the upper report alarm set in the system is 50 per second, and the duration of the reported alarm is 10 seconds, then the frequency of obtaining the reported alarm in step S101 is greater than 50 per second. If the duration of the upper 4 艮 alarms obtained in step S101 is greater than 10 seconds, it is determined that the alarm storm is generated; if the frequency of obtaining the reported alarm in step S101 is not more than 50 per second, or the upper 4 obtained in step S101 If the duration of the 艮 alarm is less than 10 seconds, it is determined that no alarm storm has occurred. When the alarm storm is generated, go to step S103, otherwise, go to step S104.

5103. Process the alarm storm according to the set rules. The method for processing the alarm storm according to the set rule in this step may be any method effective for the alarm storm processing, for example, directly discarding the report alarm, or saving the alarm to the database, or alerting the report. Save to the file system.

5104, the end. The end of this step refers to the judgment of the police report and the end of the processing. It is not the end of all the procedures. After the end of this step, the upper report police in the next time period needs to be monitored to obtain the next The frequency and duration of the alarm are reported in the time period, that is, the loop steps S101 to S104.

By judging whether the alarm storm is generated based on the frequency and duration of the alarm, the alarm storm can be accurately determined and the alarm is not known or unknown. This greatly improves the system's ability to handle alarm storms.

Figure 2 is a second embodiment of the present invention. In this embodiment, the method for processing an alarm storm includes the following steps: Steps S201, S202, and S205 are respectively performed with steps S101 and S102 in Embodiment 1,

S104 is the same and will not be described in detail here. After determining that the alarm storm is generated, the following steps are included:

S203, the alarm is transferred to the file system. When dumping the alert object to the file system, this embodiment uses a third-party package Xstream to assist with processing. Xstream is a simple and practical class library for converting between serialized objects and XML (Extensible Markup Language) objects. It has the following features: Flexible and easy to use, no mapping, high speed and stability , clear and easy to understand. In this embodiment, the Xstream is used to convert the alarm object into an XML file and store it in the file system. When the recovery is completed, the alarm object is extracted and restored by the XML file.

S204: After the alarm storm ends, the alarm file that is transferred to the file system is restored from the file system to an alarm object, and inserted into the historical alarm library. In this step, you can view the alarm storms that have been saved in the file system. You can select one of the alarms to recover the alarms. You can choose to restore some or all alarms and recover the alarm storm by analyzing the corresponding files. The recovered alarm will enter the historical alarm library for future viewing.

After testing, the time it takes to dump the alarm directly to the file system is one-twentieth of the time it takes for the alarm to go through the processing chain of the entire network management system, which can greatly save the processing time and the load of the network management, which is beneficial to Keep the system stable when the alarm storm comes.

In the same manner as the step S103 of the embodiment 1 and the step S203 of the embodiment 2, the following steps are further included:

An alarm storm alarm is generated. The detailed information includes alarms, alarm duration, frequency, and other information, which prompts the user to generate an alarm storm.

FIG. 3 is a third embodiment of the present invention. In this embodiment, the alarm storm processing apparatus includes the following structure:

The alarm information obtaining unit 31 is configured to acquire the frequency and the duration of the alarm. The alarm storm determining unit 32 is configured to receive the alarm report according to the alarm information acquiring unit 31. The frequency and duration of the alarm are determined to determine whether an alarm storm has occurred. The specific judgment method is as follows: comparing the frequency and duration of the upper report alarm obtained by the alarm information acquisition unit 31 with the frequency threshold value of the upper report alarm and the duration of the report alarm duration set in the system, respectively, When the frequency and duration of the upper reported alarm obtained by the alarm information acquiring unit 31 are both greater than the respective thresholds, it is determined that the alarm storm is generated; only one of them exceeds the set threshold, or both of them do not exceed the setting thereof. When the threshold is exceeded, it is determined that no alarm storm has occurred. That is, if the frequency of the upper 4 艮 alarms set in the system is 60, and the duration of the upper 4 艮 alarm is 8 seconds, the alarm information acquiring unit 31 obtains the frequency of the reported alarm is greater than If the duration of the upper report alarm obtained by the alarm information acquisition unit 31 is greater than 8 seconds, it is determined that the alarm storm is generated; if the alarm information acquisition unit 31 obtains the frequency of the reported alarm is not more than 60 per second, or When the duration of the alarm received by the alarm information acquiring unit 31 is less than 8 seconds, it is determined that no alarm storm is generated.

The alarm storm processing unit 33 is configured to process the alarm storm according to a set rule after the alarm storm is generated. The processing method of the alarm storm processing unit 33 for processing the alarm storm according to the set rule may be any method effective for the alarm storm processing, for example, directly discarding the report alarm, or saving the alarm to the database, or reporting the alarm The police transferred to the file system.

FIG. 4 is a fourth embodiment of the present invention. In this embodiment, the alarm storm processing apparatus includes the following structure:

The alarm information acquiring unit 41 is configured to acquire the frequency and duration of the alarm. The alarm information acquiring unit 41 further includes a counter 411 and an alarm storm processor 412. The counter 411 is configured to record the number of reported alarms and report the alarm. The occurrence time; the alarm storm processor 412 is configured to receive the reported alarm and update the counter.

The alarm storm judging unit 42 is configured to determine whether an alarm storm is generated according to the frequency and duration of the upper reported alarm acquired by the alarm information acquiring unit 41. In the embodiment, the alarm storm judging unit 42 has the same structure, function, and function as the alarm storm judging unit 32 in the third embodiment. It will not be repeated here.

The alarm storm processing unit 43 is configured to process the alarm storm according to a set rule after the alarm storm is generated.

The alarm storm processing device of this embodiment further includes an alarm processing setting unit 44 and an alarm recovery setting unit 45. The alarm processing setting unit 44 is configured to set a frequency threshold and a duration threshold of the upper report alarm, and set a method for processing the alarm storm; the alarm recovery setting unit 45 is configured to set the file to be transferred to the file system. When it is reported that the police recover from the file system, some or all of them are restored.

The alarm storm processing unit 43 further includes an alarm discarding subunit 431, an alarm dump subunit 432, and an alarm recovery subunit 433. The alarm storm processing unit 43 processes the alarm storm according to the setting rule. Specifically, when the alarm processing setting unit 44 sets the method for processing the alarm storm to discard the alarm, the alarm is lost after the alarm storm is generated. The discarded sub-unit 431 discards the upper report alarm that generates the alarm storm. When the alarm processing setting unit 44 sets the method for processing the alarm storm to save the alarm to the file system, after the alarm storm is generated, the alarm is turned The storage sub-unit 432 transfers the upper report alarm that generated the alarm storm to the file system. When the alarm recovery setting unit 45 sets the upper report alarm file system to be dumped to the file system, the alarm recovery sub-unit 433 will transfer the file to the file system to report the police file system after the alarm storm ends. The alarm object is restored and inserted into the historical alarm library.

The implementation of the above-mentioned embodiments of the present invention may be implemented by hardware or software, or may be implemented by a combination of software and hardware. A specific example (Example 5) implemented by software and hardware is given below.

As shown in FIG. 5, the alarm storm processing apparatus in this embodiment is implemented according to a C/S structure, which includes a client and a server.

The client includes an alarm storm processing rule setting dialog box, which provides an interface for setting alarm storm processing rule information, including the following contents: 1. The name of the rule, and its description.

2. Sub-rule attribute: This option selects which sub-rule to use when the alarm storm is used to process the alarm. The options that can be selected are directly discarded and dumped to the file system.

3. Rule attribute: Here we select the alarm storm processing rule to start under what circumstances. There are two durations and frequencies to be set. When the alarm reporting frequency reaches a certain threshold and continues for a period of time, the system will automatically The alarm storm processing rule is started. When one of the reporting frequency or duration does not meet the condition, the system automatically suspends the rule. For example, we can define the rules to be initiated when the alarm is reported to reach 50 per second for 10 seconds.

4. At the same time, there is an "Alarm Storm Recovery" menu. When the user clicks, an "Alarm Storm Recovery" dialog box will appear. If the alarm storm is selected, the dump to the file system will be displayed. This interface will display the current file system. If there are alarm storms that are dumped during the period, the user can manually select the alarms in a certain period of time to recover. The recovered alarms will enter the historical alarm database for later viewing. The user can choose to restore some or all of them. Alarm.

The server-side alarm storm processing rule processing includes the following:

1. Alarm Storm Processor: Receives alarms sent from the alarm background and updates the counter.

2. Counter: Record the number of alarms and the time when the alarm occurred.

3. Background processing thread: Check the counter periodically to determine whether the frequency and duration of the alarm reach the threshold to determine whether to activate the sub-processor.

4. Sub-processor: Managed by the background processing thread to perform the task of shielding the alarm storm.

The Alarm Storm Manager contains the following:

1. Alarm Storm Manager: It records all alarm storms that are dumped to the file system, returns the information of these alarms in response to the client's request, and restores them from the file system to alarm objects and inserts them into the historical alarm database.

The alarm processing procedure is as follows: The background processing flow is mainly divided into two. One is the processing of the alarm alarm by the alarm storm processor, and the other is the processing flow of the background processing thread.

The processing flow of the alarm storm processor on the report alarm is shown in Figure 6:

After the network management system receives a reported alarm, the alarm module sends it to the alarm storm processor for processing.

The alarm storm processor updates the counter. Note that this is not a simple counter, not only to record the number of alarms, but also to record the occurrence time of each alarm, in order to calculate the duration and frequency of the alarm.

The process of spooling threads in the background is shown in Figure 7:

First, the background processing thread starts, view the alarm counter, and calculate the alarm frequency in the previous period, that is, the number of alarms per second, and check whether the alarm frequency is always higher than the set threshold.

If the alarm frequency is higher than the set threshold, it is necessary to determine whether there is a sub-processor that is already present and active.

If there is no sub-processor, a new sub-processor is created and activated. The sub-processor then performs the task of suppressing the alarm storm and generates a new alarm storm alarm. The detailed information includes the alarm that caused the alarm storm. Information such as duration, frequency, etc., prompts the user to generate an alarm storm.

If there is already a sub-processor but it is not active, it will be activated and a new alarm storm alarm will also be generated.

If there is already a sub-processor and is active, you need to update the information of the alarm storm alarm generated before, including duration, frequency, and so on.

If the alarm frequency is not higher than the threshold, it is determined whether there is a sub-processor that has been created and is active, and if so, the rule processor is suspended and the previously generated alarm storm alarm is restored. If not, no processing is done.

After processing, the background processing thread enters the sleep state, and waits for a period of time to repeat the execution. On the operation, such as waiting for 1 second.

The recovery process of the alarm storm is as follows:

The user clicks on the client "Alarm Storm Recovery" menu. The server-side alarm storm manager returns the alarm storm information stored in the file system of the current system to the client.

The user selects the alarm storm to be recovered on the client. The server alarm storm manager analyzes the corresponding file, restores the alarm storm, and inserts it into the historical alarm database.

In summary, it can be seen that the foregoing embodiment can determine the alarm storm generated according to the frequency and duration of the alarm, and can process the alarm storm generated by the known or unknown alarm to improve the flexibility of the network management system. Stability and consistency. In addition, after the alarm is dumped, the alarm is restored after the alarm storm is over, and some important alarms are discarded. This reduces the load on the server.

While the preferred embodiments of the present invention have been disclosed for purposes of illustration, those skilled in the art will recognize that various modifications, additions and substitutions are possible, and the scope of the invention should not be limited to the embodiments described above.

Claims

Claim

A method for processing an alarm storm, characterized in that the method comprises the following steps: obtaining a frequency and duration of reporting an alarm;

The method for processing an alarm storm according to claim 1, wherein the method for processing an alarm storm according to a set rule comprises: discarding or transferring the report alarm to a file system .

The method for processing an alarm storm according to claim 2, wherein after the uploading the upper alarm to the file system, the method further comprises the following steps:

After the alarm storm ends, the alarm file that is transferred to the file system is restored to the alarm object from the file system and inserted into the historical alarm database.

The method of processing the alarm storm according to any one of claims 1 to 3, wherein, while the alarm storm is processed, the method further includes:

A device for processing an alarm storm, characterized in that the device comprises:

The alarm storm judging unit is configured to determine whether an alarm storm is generated according to the frequency and duration of the alarm, and the corresponding threshold value, which is obtained by the alarm information acquiring unit, and the alarm storm processing unit is configured to generate an alarm storm. Afterwards, the alarm storm is processed according to a set rule.

The alarm storm processing device according to claim 5, wherein the alarm storm processing unit comprises at least one of the following: The alarm discarding subunit is configured to discard the upper report alarm that generates an alarm storm.

The alarm dump sub-unit is configured to store the alarm report of the alarm storm into the file system.

The alarm storm processing unit of claim 6, wherein the alarm storm processing unit further comprises:

The device for processing an alarm storm according to claim 7, wherein the processing device further comprises:

The apparatus for processing an alarm storm according to any one of claims 5 to 8, wherein the alarm information acquisition unit comprises:

The device for processing an alarm storm according to claim 5, wherein the processing device further comprises: