Alarm correlation in a large communications network

• US 6,253,339 B1
• Filed: 10/28/1998
• Issued: 06/26/2001
• Est. Priority Date: 10/28/1998
• Status: Expired due to Term

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Tse, Edwin, Gosselin, Nicolas
• Primary Examiner(s): Iqbal, Nadeem
• Application Number:
  US09/181,583
• Time in Patent Office: 972 Days
• Field of Search: 714/47, 714/48, 714/4, 714/8, 714/20, 714/25, 714/26, 714/39, 714/51, 714/15, 370/216, 370/241, 370/242, 340/825.16, 340/825.07, 340/508, 340/501
• US Class Current: 714/47.1
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04Q 2213/13103 Memory
• CPC Class Codes: H04Q 2213/13106 Microprocessor, CPU
• CPC Class Codes: H04Q 2213/13162 Fault indication and localisation
• CPC Class Codes: H04Q 2213/13163 Fault alarm
• CPC Class Codes: H04Q 2213/13349 Network management
• CPC Class Codes: H04Q 3/0075 Fault management techniques

Abstract

A system and method of correlating alarms from a plurality of network elements (NEs) in a large communications network. A plurality of uncorrelated alarms are collected by an alarm collector from alarm reporters. An alarm correlator then partitions the alarms into correlated alarm clusters such that alarms of one cluster have a high probability that they are caused by one network fault. The partitioning of the alarms is performed by creating alarm sets, expanding the alarm sets into alarm domains, and merging the alarm domains into alarm clusters if predefined conditions are met. The sets are formed by selecting an alarmed NE at the highest network hierarchy level which is not tagged, finding all of its contained NEs, and finding NEs that are peer-related to those contained NEs that are in an alarmed state. The sets are expanded into domains by finding NEs that are not in an alarmed state which contain the highest level alarmed NE in each alarm set. The domains are merged into one alarm cluster if the two domains have at least one common NE, at least one of the common NEs is not tagged, and the majority of the NEs contained by the non-tagged common NE are in an alarmed state.

Claims

1. A system for correlating alarms from a plurality of network elements (NEs) in a large communications network, said system comprising:

a plurality of alarm reporters that report alarms from the NEs when faults are detected; and

an alarm correlator that partitions the alarms into correlated alarm clusters such that alarms of one cluster have a high probability that they are caused by one network fault;

said alarm correlator including;

means for creating an alarm set by selecting an alarmed NE at the highest hierarchy level which is not tagged, finding all lower level NEs that are contained in the selected alarmed NE, finding all peer-related NEs for each alarmed lower level NEs and placing the highest level alarmed NE and all the found contained and peer-related NEs in the set; and

means for creating additional alarm sets by repeating the steps for creating the alarm set for each alarmed NE in the network which is not tagged.

2. The system for correlating alarms of claim 1 further comprising an alarm collector that collects and stores alarms from the alarm reporters and provides uncorrelated alarms to the alarm correlator.

3. The system for correlating alarms of claim 1 wherein the alarm correlator also includes means for finding faulty NEs which are not reporting alarm states while a majority of their contained NEs are reporting alarmed states.

4. The system for correlating alarms of claim 3 wherein the alarm correlator also includes means for merging two sets into one alarm cluster if the two sets have at least one common NE, at least one common NE is not tagged, and a majority of the NEs contained by the non-tagged common NE are in an alarmed state.

5. In a large communications network having a plurality of network elements (NEs), a method of correlating alarms from the NEs comprising the steps of:

collecting a plurality of uncorrelated alarms from the NEs; and

partitioning the alarms into correlated alarm clusters such that alarms of one cluster have a high probability that they are caused by one network fault, wherein the steps of partitioning the alarms include;

creating a plurality of alarm sets;

expanding the alarm sets into a plurality of alarm domains; and

merging the plurality of alarm domains into alarm clusters if predefined conditions are met.

6. The method of correlating alarms of claim 5 wherein the step of creating a plurality of alarm sets includes the steps of:

creating a first alarm set, said step of creating a first alarm set comprising;

selecting an alarmed NE at the highest network hierarchy level which is not tagged;

finding all lower level NEs that are contained in the selected alarmed NE;

finding all peer-related NEs for each contained lower level NE which is in an alarmed state; and

placing the highest level alarmed NE and all the found contained and peer-related NEs in the first set; and

creating additional alarm sets, said step of creating additional alarm sets comprising;

selecting additional alarmed NEs in the network which are not tagged; and

repeating the steps for creating the first alarm set for each selected additional alarmed NE in the network which is not tagged.

7. The method of correlating alarms of claim 6 wherein the step of expanding the alarm sets into a plurality of alarm domains includes the step of finding NEs that are not in an alarmed state which contain the highest level alarmed NE in each alarm set.

8. The method of correlating alarms of claim 7 wherein the step of finding NEs that are not in an alarmed state which contain the highest level alarmed NE in each alarm set includes the step of expanding the alarm sets to create alarm domains, the step of expanding the alarm sets including the steps of:

(a) selecting one of the alarm sets;

(b) selecting an alarmed NE which is at the highest network hierarchy level in the selected set;

(c) finding all NEs that are span-related to the selected alarmed NE;

(d) finding all NEs that are span-related to each of the found NEs that are span-related to the selected alarmed NE;

(e) adding all the found span-related NEs to the alarm set to create an alarm domain; and

(f) repeating steps (b) through (e) for all of the alarm sets.

9. The method of correlating alarms of claim 8 wherein the step of merging the plurality of alarm domains into alarm clusters if predefined conditions are met includes the steps of:

determining that two alarm domains have at least one common NE;

determining that the common NE is not tagged; and

determining that a majority of the NEs contained by the non-tagged common NE are in an alarmed state.