System and method for fault diagnosis using distributed alarm correlation

• US 7,257,744 B2
• Filed: 03/16/2004
• Issued: 08/14/2007
• Est. Priority Date: 03/17/2003
• Status: Active Grant

• Current Assignee: SubCom, LLC
• Original Assignee: Tyco Telecommunications Us Incorporated (Johnson Controls International plc)
• Inventors: Liss, Jonathan M., Sabet, Sameh A., Deverin, Jeffrey A.
• Primary Examiner(s): Baderman; Scott
• Assistant Examiner(s): Truong; Loan
• Application Number:
  US10/802,255
• Publication Number:
  US 20040230868A1
• Time in Patent Office: 1,246 Days
• Field of Search: 714/26, 714/43, 714/25, 714/57
• US Class Current: 714/56
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis

Abstract

A system and method for diagnosing faults in a communication network using a distributed alarm correlation system. The alarm correlation system may include node-level alarm correlation tools (ACTs) located at nodes in the network to provide node-level alarm correlation producing node-level correlation results. The node-level ACTs may share diagnostic knowledge with other node-level alarm correlation tools at other nodes. Each of the node-level ACTs may also share the diagnostic knowledge and the node-level correlation results with a higher-level ACT. The higher-level ACT may provide higher-level alarm correlation to produce higher-level correlation results.

Claims

1. A method for diagnosing faults in a communication network using distributed alarm correlation, said method comprising:

receiving alarm data locally at network nodes in said communication network;

correlating said alarm data locally at each of said network nodes using an associated node-level alarm correlation tool and diagnostic knowledge stored in an associated node-level knowledge base to produce correlation results identifying a root cause of a fault determined at each of said network nodes;

reporting said correlation results produced locally at said network nodes to respective users at respective said network nodes;

adding new diagnostic knowledge provided by at least one of said users to one of said node-level knowledge bases, said new diagnostic knowledge being obtained by said at least one of said users using said correlation results associated with at least one of said network nodes;

replicating said new diagnostic knowledge to at least one other node-level knowledge base associated with at least one other said network node; and

reporting said new diagnostic knowledge and said correlation results produced locally at said network nodes to a higher-level alarm correlator; and

correlating said root causes determined at said network nodes using said higher-level alarm correlator to find a higher-level root cause.

2. The method of claim 1 wherein said correlating said alarm data comprises using user-defined correlation rules to find said root causes.

3. The method of claim 1 wherein said new diagnostic knowledge comprises a new correlation rule.

4. The distributed alarm correlation system of claim 3 wherein each of said node-level alarm correlation tools comprises local topology configuration information.

5. The method of claim 1 wherein said new diagnostic knowledge comprises at least one of a root cause, an alarm definition, and a corrective action.

6. The method of claim 1 wherein said alarm data comprises alarm data generated by network elements in said communication network.

7. The method of claim 1 wherein said diagnostic knowledge comprises local topology configuration information.

8. The method of claim 1 wherein said diagnostic knowledge comprises alarm definitions and correlation rules.

9. The method of claim 1 further comprising:

adding said diagnostic knowledge to a node knowledge base at said other said network nodes.

10. The method of claim 1 further comprising:

reporting said higher-level root cause to a user of said higher-level alarm correlator; and

adding higher-level diagnostic knowledge provided by said user at said higher-level alarm correlator to a higher-level knowledge base in said higher-level alarm correlator.

11. The method of claim 1 further comprising receiving and storing local topology configuration information at respective said network nodes.

12. A distributed alarm correlation system for diagnosing faults in a communication network, said distributed alarm correlation system comprising:

a plurality of node-level alarm correlation tools located at nodes in said communication network, wherein each of said node-level alarm correlation tools is configured to provide node-level alarm correlation to produce node-level correlation results identifying a root cause of a fault determined at an associated one of said nodes and to share new diagnostic knowledge produced by a user of said node-level alarm correlation tool using said node-level correlation results with other of said node-level alarm correlation tools at other nodes; and

at least one higher-level management level alarm correlation tool located at a network management center in said communication network, wherein each of said node-level alarm correlation tools is configured to share said new diagnostic knowledge and said node-level correlation results with said higher-level management level alarm correlation tool, and wherein said higher-level management level alarm correlation tool is configured to provide higher-level alarm correlation to produce higher-level correlation results identifying a higher-level root cause.

13. The distributed alarm correlation system of claim 12 wherein each of said node-level alarm correlation tools comprises alarm definitions defining alarm groups categorizing alarms generated in said communication network.

14. The distributed alarm correlation system of claim 12 wherein each of said node-level alarm correlation tools includes a local knowledge base.

15. The distributed alarm correlation system of claim 12 wherein each said higher-level alarm correlation tool includes a higher-level knowledge base.

16. The distributed alarm correlation system of claim 12 wherein each of said node-level alarm correlation tools includes an alarm correlator for correlating network element alarm data with locally stored topology configuration information using user-defined correlation rules.

17. A machine-readable medium storing an executable set of software instructions that are executable by a computer system to cause the computer system to perform a method of fault diagnosis in a communication network said method comprising:

receiving alarm data locally at network nodes in said communication network;

correlating said alarm data locally at each of said network nodes using an associated node-level alarm correlation tool and diagnostic knowledge stored in an associated node-level knowledge base to produce correlation results identifying a root cause of a fault determined at each of said network nodes;

reporting said correlation results produced locally at said network nodes to respective users at respective said network nodes;

adding new diagnostic knowledge provided by at least one of said users to one of said node-level knowledge bases, said new diagnostic knowledge being obtained by said at least one of said users using said correlation results associated with at least one of said network nodes;

replicating said new diagnostic knowledge to at least one other node-level knowledge base associated with at least one other said network nodes; and

reporting said new diagnostic knowledge and said correlation results produced locally at said network nodes to a higher-level alarm correlator; and

correlating said root causes determined at said network nodes using said higher-level alarm correlator to find a higher-level root cause.

18. The machine-readable medium of claim 17, wherein said method further comprises:

reporting said higher-level root cause to a user of said higher-level alarm correlator; and

adding higher-level diagnostic knowledge provided by said user at said higher-level alarm correlator to a higher-level knowledge base in said higher-level alarm correlator.