Incremental alarm correlation method and apparatus

• US 6,604,208 B1
• Filed: 04/07/2000
• Issued: 08/05/2003
• Est. Priority Date: 04/07/2000
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Tse, Edwin, Gosselin, Nicolas
• Primary Examiner(s): Beausoliel, Robert
• Assistant Examiner(s): MASKULINSKI, MICHAEL C
• Application Number:
  US09/545,541
• Time in Patent Office: 1,215 Days
• Field of Search: 714/4, 714/25, 714/48, 714/43, 714/47
• US Class Current: 714/4.12
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04Q 2213/13054 Expert system
• CPC Class Codes: H04Q 2213/13163 Fault alarm
• CPC Class Codes: H04Q 2213/13349 Network management
• CPC Class Codes: H04Q 3/0075 Fault management techniques

Abstract

Alarms are processed in view of an historical context to determine instances of correlation such that alarms are partitioned into correlation sets where the alarms within one set have a high probability of being caused by the same network fault. As each new alarm is received, a check is made to se whether a managed object originating that alarm is a member of a previous set and is already in an alarmed state. If so, the alarm is added to that managed object. If not, a set is built containing that alarmed managed object and its related managed objects as determined from consideration of alarm propagation rules and network topology. That set is then compared with previously built sets to determine the existence of any correlation as measured by whether the sets share managed objects in common or satisfy some other correlation test. When such correlation is found, the sets are merged together to form a larger set relating to the same network fault.

Claims

1. A fault management system serving a network containing a plurality of network elements, comprising:

a database storing alarm propagation rules for the plurality of network elements;

a factory operating to apply the alarm propagation rules with respect to an indication of a certain one of the network elements being in an alarmed state to build a set containing not only that certain network element but also network elements related thereto by alarm propagation considerations; and

a correlator having an historical context containing sets previously built by the set factory for previously handled alarms and responding to a current alarm to cause the factory to build a new set, merge the new set with one of the previously built sets in the historical context if there exists a likelihood that the current alarm and the previously handled alarm are caused by the same network fault.

2. The system as in claim 1 wherein the correlator responds to the current alarm by first determining in connection with the historical context whether the network element for that alarm is a member in an alarmed state of any of the sets previously built by the set factory for previously handled alarms, and if so adding the current alarm to the historical context and skipping the building of a new set.

3. The system as in claim 1 wherein the correlator merges sets into the historical context if a network element is shared in common between the new set for the current alarm and a previously built set relating to a previously handled alarm.

4. The system as in claim 1 wherein the correlator merges sets into the historical context if a network element in the new set for the current alarm and a network element for a previously built set relating to a previously handled alarm meet some specified correlation relationship.

5. The system as in claim 4 wherein the specified correlation relationship is defined by an operator of the network.

6. The system as in claim 1 wherein the correlator operates in an event driven manner to respond on an alarm-by-alarm basis to new alarms by creating a new set and merging the new set into the historical context of previous sets.

7. A method for alarm correlation with respect to an historical context containing sets previously built for previously handled alarms, each set containing not only a network element in an alarmed state but also network elements related to that network element by alarm propagation considerations, the method comprising the steps of:

receiving a current alarm from a certain network element;

building a new set for that current alarm containing not only that certain network element but also other network elements related thereto by alarm propagation considerations; and

merging the new set with one of the previously built sets in the historical context if there exists a likelihood that the current alarm and the previously handled alarm are caused by the same network fault.

8. The method of claim 7 further comprising the step of repeating the steps of claim 7 on an event driven alarm-by-alarm basis for each newly received alarm.

9. The method of claim 7 wherein the step of receiving comprises the steps of:

determining in connection with the historical context whether the certain network element is a member in an alarmed state of any of the previously built sets of the historical context; and

if so, adding the current alarm to the historical context and skipping the remaining steps of claim 7 for that current alarm.

10. The method as in claim 7 wherein the step of merging comprises the step of merging the new set into the historical context if a network element is shared in common between the new set for the current alarm and a previously built set relating to a previously handled alarm.

11. The method as in claim 7 wherein the step of merging comprises the step of merging the new set into the historical context if a network element in the new set for the current alarm and a network element for a previously built set relating to a previously handled alarm meet some specified correlation relationship.

12. The method as in claim 11 wherein the specified correlation relationship is defined by an operator of a network being managed by the alarm correlation method.