Topology-based reasoning apparatus for root-cause analysis of network faults

• US 7,043,661 B2
• Filed: 10/17/2001
• Issued: 05/09/2006
• Est. Priority Date: 10/19/2000
• Status: Active Grant

• Current Assignee: Tti-Team Telecom International Limited
• Original Assignee: Tti-Team Telecom International Limited
• Inventors: Mallal, Shlomo, Kaftan, Nir, Valadarsky, Doron, Lifshitz, Yuval, Virtser, Alexander, Bregman, Lev, Kouperchimdt, Igor, Pridor, Adir, Pavlenko, Alexander
• Primary Examiner(s): Beausoliel, Robert
• Assistant Examiner(s): MCCARTHY, CHRISTOPHER S
• Application Number:
  US09/978,846
• Publication Number:
  US 20020111755A1
• Time in Patent Office: 1,665 Days
• Field of Search: 714/4, 714/43, 702/58, 702/59, 379/15.05, 709/318
• US Class Current: 714/4.1
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04Q 3/0075 Fault management techniques

Abstract

A root cause analysis system operative in conjunction with fault management apparatus, the system includes a topology-based reasoning system (TRS) operative to topologically analyze alarms in order to identify at least one root cause thereof.

Claims

1. A root cause analysis system operative in conjunction with fault management apparatus, the system comprising:

a topology-based reasoning system (TRS) operative to topologically analyze alarms in order to identify at least one root cause thereof,

wherein conditional probabilities derived from assuming that various probable causes are the root cause, are compared, in order to select one of the probable causes as the root cause.

2. A system according to claim 1 wherein said probable causes comprise faults in a network.

3. A system according to claim 1 wherein said probable causes comprise faults in a data communications network.

4. A system according to claim 1 and also comprising fault management apparatus.

5. A system according to claim 1 and also comprising a rule-based expert system (BS) operative to analyze alarms in order to identify root causes thereof.

6. A system according to claim 1 wherein the operation of TRS is at least partly rule-based.

7. A system according to claim 6 wherein at least one rule governing operation of the TRS can be changed without disrupting TRS operation.

8. A system according to claim 1 wherein the operation of TRS is at least partly relation-based.

9. A system according to claim 1 wherein the TRS is operative to represent the topology of a network being analyzed for faults as a graph.

10. A system according to claim 9 wherein said graph is held in memory.

11. A system according to claim 10 wherein said memory comprises random access memory.

12. A system according to claim 9 wherein said TRS is operative to traverse said graph in order to find the root cause and in order to find all the alarms that belong to a root cause.

13. A system according to claim 1 and also comprising a large network whose topology is being analyzed.

14. A system according to claim 13 wherein said large network comprises a national network.

15. A system according to claim 13 wherein said large network compnses a network operated by PTT (post-telecom and telegraph).

16. A system according to claim 1 wherein said TRS is operative to identify root causes for more than one network fault simultaneously.

17. A system according to claim 1 wherein said TRS is operative to check all probable causes before selecting a root-cause.

18. A system according to claim 1 wherein said TRS is operative to make at least one root-cause decision based at least partly on the following parameter:

the distance between the location in the network of the suspected root-cause and the point of origin of each alarm related to it.

19. A system according to claim 1 wherein said TRS is operative to make at least one root-cause decision based at least partly on the following parameter:

the amount of alarms in the incoming group of alarms that are explained by that root-cause.

20. A system according to claim 1 wherein said TRS is operative to make at least one root-cause decision based at least partly on the following parameter:

the amount of alarms received out of all the alarms that system expects for that root cause.

21. A system according to claim 1 wherein said TRS is operative to anticipate at least one expected alarm associated with at least one respective fault type, and wherein said TRS is capable of deciding that at least one particular fault type has occurred, even if less than all of the expected alarms associated with said at least one particular fault type have actually occurred within an incoming alarm stream.

22. A system according to claim 1 wherein said TRS is operative to identify at least one incoming alarm generated by at least one network maintenance activity.

23. A system according to claim 1 wherein said TRS is application independent.

24. A system according to claim 1 wherein said probable causes comprise faults in a telecommunications network.

25. A system according to claim 1 wherein said TRS is operative to analyze at least one incoming alarm to determine a network element associated therewith.

26. A system according to claim 25 wherein said TRS comprises a table storing the manufacturer of each network element and wherein, upon encountering an incoming alarm associated with a network element, said TRS is operative to look up the manufacturer associated with said alarm.

27. A system according to claim 25 wherein said network element comprises a logical object.

28. A system according to claim 25 wherein said network element comprises a physical object.

29. A system according to claim 1 wherein said TRS is operative to identify a first root cause of at least one alarm and subsequently identify a second root cause based on at least one additional alarm which has arrived subsequently.

30. A system according to claim 1 wherein the TRS is operative to represent, using a graph, the topology of an expected alarm flow pattern through a network being analyzed for faults.

31. A system according to claim 1 wherein said TRS is operative to cluster incoming alarms into groups based at least partly on the alarms'"'"' time of arrival.

32. A system according to claim 1 wherein said TRS is operative to utilize knowledge regarding a bell-shaped distribution of alarms associated with each fault, in order to cluster alarm into groups each associated with a different fault.

33. A system according to claim 1 wherein said TRS is operative to cluster incoming alarms into groups based at least partly on the topologic distance between the alarms.

34. A system according to claim 1 wherein said TRS is operative to update network topology data on-line, without disruption to TRS operation.

35. A system according to claim 1 and also comprising a rule definition GUI operative to provide a user with a set of rule component options presented in natural language from which a rule can be composed.

36. A system according to claim 1 wherein said TRS automatically adjusts to changing network topology.

37. A system according to claim 1 wherein said TRS is part of a network control system.

38. A system according to claim 1 and also comprising an event stream including a sequence of events, less than all of which are deemed alarms, and wherein said TRS can be connected to the event stream directly.

39. A system according to claim 1 wherein said TRS imitates the flow of alarms in the network, thereby allowing anyone with good knowledge of the alarm flow in a given network type to generate the rules for that network type.

40. A system according to claim 1 wherein said TRS issues ‘

derived’

alarms to describe root causes when no incoming alarm accurately does so.

41. A system according to claim 1 wherein said TRS results are sent to a fault management GUI without requiring the operator to look at a separate correlation screen.

42. A system according to claim 1 wherein said TRS stores its decision results in a history database, thereby allowing users to review the decision results and associated alarm groups, after the faults that generated these decisions and alarm groups have already been resolved.

43. A system according to claim 1 wherein said TRS comprises a rule set.

44. A root cause analysis method operative in conjunction with fault management apparatus, the method comprising:

performing topology-based reasoning including topologically analyzing alarms in order to identify at least one root cause thereof; and

adapting said topology-based reasoning for use with a different type of network by adding at least one rule to an existing rule set employed in the course of said performing topology-based reasoning.

45. A method according to claim 44 and also comprising providing an output indication of at least one identified root cause.

46. A system according to claim 45 wherein said rule set comprises a first rule associated with a first network element manufacturer and a second rule associated with a second network element manufacturer.

47. A root cause analysis system operative in conjunction with fault management apparatus, the system comprising:

a topology-based reasoning system (TRS) operative to topologically analyze alarms in order to identify at least one root cause thereof,

wherein said TRS is operative to make at least one root-cause decision based at least partly on the following parameter;

the distance between the location in the network of the suspected root-cause and the point of origin of each alarm related to it.

48. A root cause analysis system operative in conjunction with fault management apparatus, the system comprising:

a topology-based reasoning system (TRS) operative to topologically analyze alarms in order to identify at least one root cause thereof,

wherein said TRS is operative to make at least one root-cause decision based at least partly on the following parameter;

the amount of alarms received out of all the alarms that system expects for that root cause.

49. A root cause analysis system operative in conjunction with fault management apparatus, the system comprising:

a topology-based reasoning system (TRS) operative to topologically analyze alarms in order to identify at least one root cause thereof,

wherein said TRS is operative to identify at least one incoming alarm generated by at least one network maintenance activity.

50. A root cause analysis system operative in conjunction with fault management apparatus, the system comprising:

a topology-based reasoning system (TRS) operative in topologically analyze alarms in order to identify at least one root cause thereof; and

an event stream including a sequence of events, less than all of which are deemed alarms,

wherein said TRS can be connected to the event stream directly.

51. A root cause analysis system operative in conjunction with fault management apparatus, the system comprising:

a topology-based reasoning system (TRS) operative in topologically analyze alarms in order to identify at least one root cause thereof,

wherein said TRS imitates the flow of alarms in the network, thereby allowing anyone with good knowledge of the alarm flow in a given network type to generate the rules for that network type.