Filtering approach for network system alarms

• US 7,389,345 B1
• Filed: 03/26/2003
• Issued: 06/17/2008
• Est. Priority Date: 03/26/2003
• Status: Active Grant

• Current Assignee: T-Mobile Innovations LLC (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Adams, Mark
• Primary Examiner(s): Follansbee; John
• Assistant Examiner(s): Patel; Dhairya A
• Application Number:
  US10/400,112
• Time in Patent Office: 1,910 Days
• Field of Search: 709/224, 709/223
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0622 based on time
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

A method for creating an updateable report representing the alarm status of a network. Network alarms are categorized based on the source and type of alarm, the alarms are placed in a filtering system based on source and type, selected alarms are replaced with alarm representations, and a report is updated with alarm representations. The filtering system comprises non-temporal, temporal, and linkage-based filtering. Non-temporal filtering includes de-duplication, clear message mapping, and classification. Temporal filtering includes frequency-based and cycling-based filtering. Linkage-based filtering includes internal linkage-based and external linkage-based filtering. The network can comprise the interconnected networks of an enterprise or of a single domain of an enterprise. The domain can comprise a business domain or operating system domain. The network can comprise a group of client computers connected to a server computer. The report can be displayed on a computer screen or can be sent to another location for further processing.

Claims

1. A method for creating an updateable report representing the alarm status of a network comprising:

categorizing all alarms generated in the network based on the source and type of alarm;

placing the alarms in at least one filtering system based on source and type, wherein the filtering system replaces selected alarms with alarm representations, and wherein the filtering system includes each of a group of filtering systems comprising;

a temporal filtering system, wherein the temporal filtering system includes at least one temporal filter that is selected from a group of temporal filters comprising;

a frequency-based filter that generates a temporal alarm representation that replaces multiple alarms in response to a quantity of the multiple alarms exceeding a threshold within a period of time; and

a cycling-based filter that generates a second temporal alarm representation that replaces multiple alarms in response to a quantity of cycles of the multiple alarms exceeding a threshold within a period of time, wherein each cycle of the multiple alarms includes generating an alarm followed by clearing the alarm; and

a linkage-based filtering system, wherein the linkage-based filtering system generates a linkage-based alarm representation that replaces sympathetic alarms generated by portions of the network impacted by a failure of a first portion of the network; and

updating a report with the alarm representations.

2. The method of claim 1, wherein the linkage-based filtering system is an external linkage-based filtering system such that the portions of the network include elements within the network and the first portion of the network includes a first element in the network.

3. The method of claim 1, wherein the group of filtering systems further comprises:

a non-temporal filtering system.

4. The method of claim 3, wherein the group of filtering systems further comprises:

a classification filtering system.

5. The method of claim 3, wherein the non-temporal filtering system includes at least one non-temporal filter that is selected from a group of non-temporal filters comprising a de-duplication filter and a clear message mapping filter.

6. The method of claim 5, wherein the non-temporal filtering system includes each of the de-duplication filter and the clear message mapping filter.

7. The method of claim 5, wherein the de-duplication filtering system generates a de-duplication alarm representation that masks alarms that are repeated while an alarm condition is maintained, and

wherein the clear message mapping filtering system that removes alarms or alarm representations in response to receiving a clear message from an originator of the alarms or alarms replaced by the alarm representations.

8. The method of claim 3, wherein the non-temporal filtering system includes at least one non-temporal filter that is selected from a group of non-temporal filters comprising a de-duplication filter, a clear message mapping filter, and a classification filter.

9. The method of claim 8, wherein the non-temporal filtering system includes each of the de-duplication filter, the clear message mapping filter, and the classification filter.

10. The method of claim 3, wherein the non-temporal filtering system includes each of a group of non-temporal filters comprising a de-duplication filter and a clear message mapping filter and wherein the temporal filtering system includes each of the frequency-based filter and a cycling-based filter.

11. The method of claim 1, wherein the linkage-based filtering system includes at least one linkage-based filter that is selected from a second group of linkage-based filters comprising an internal linkage-based filter, wherein the portions of the network include components within an element and the first portion of the network includes a first component in the element, and an external linkage-based filter, wherein the portions of the network include elements within the network and the first portion of the network includes a first element in the network.

12. The method of claim 11, wherein the linkage-based filtering system includes each of the internal linkage-based filter and the external linkage-based filter.

13. The method of claim 1, wherein the temporal filtering system includes each of the frequency-based filter and the cycling-based filter.

14. The method of claim 1, wherein the network comprises the interconnected networks of an enterprise.

15. The method of claim 1, wherein the network comprises the interconnected networks of a single domain of an enterprise.

16. The method of claim 15, wherein the domain comprises a business domain of the enterprise.

17. The method of claim 15, wherein the domain comprises an operating system domain of the enterprise.

18. The method of claim 1, wherein the network comprises a group of client computers connected to a server computer.

19. The method of claim 1, wherein the report is displayed on a computer screen.

20. The method of claim 1, wherein the report is sent to another location for further processing.

21. A method for creating an updateable report representing the alarm status of a network comprising:

categorizing all alarms generated by one or more elements in a network based on the source and type of alarm;

placing the alarms in at least one filtering system based on source and type, wherein the filtering system replaces selected alarms with alarm representations, and wherein the filtering system includes each of a group of filtering systems comprising;

a non-temporal filtering system wherein the non-temporal filtering system includes at least one non-temporal filter that is selected from a group of non-temporal filters comprising;

a de-duplication filter that generates a de-duplication alarm representation that masks alarms that are repeated while an alarm condition is maintained; and

a clear message mapping filter that removes alarms or alarm representations in response to receiving a clear message from the one or more elements that originally generated the alarms or alarms replaced by the alarm representations; and

an external linkage-based filtering system that generates a linkage-based alarm representation that replaces sympathetic alarms generated by elements of the network impacted by a failure of a first element of the network; and

updating a report with the alarm representations.

22. The method of claim 21, wherein the non-temporal filtering system includes at least one non-temporal filter that is selected from a group of non-temporal filters comprising the de-duplication filter, the clear message mapping filter, and a classification filter.

23. The method of claim 22, wherein the non-temporal filtering system includes each of the de-duplication filter, the clear message mapping filter, and the classification filter.

24. The method of claim 23, wherein the classification filter masks alarms based on a source of the alarms, types of elements generating the alarms, a location of elements generating the alarms, or a type of the alarms.

25. The method of claim 21, wherein the non-temporal filtering system includes each of the de-duplication filter and the clear message mapping filter.

26. A method for creating an updateable report representing the alarm status of a network comprising:

categorizing all alarms generated in a network based on the source and type of alarm;

placing the alarms in at least one filtering system based on source and type, wherein the filtering system replaces selected alarms with alarm representations, and wherein the filtering system includes each of a group of filtering systems comprising;

a de-duplication filtering system that generates a de-duplication alarm representation that masks alarms that are repeated while an alarm condition is maintained;

a clear message mapping filtering system that removes alarms or alarm representations in response to receiving a clear message from an originator of the alarms or alarms replaced by the alarm representations;

a frequency-based filtering system that generates a temporal alarm representation that replaces multiple alarms in response to a quantity of the multiple alarms exceeding a threshold within a period of time; and

a cycling-based filtering system that generates a second temporal alarm representation that replaces multiple alarms in response to a quantity of cycles of the multiple alarms exceeding a threshold within a period of time, wherein each cycle of the multiple alarms includes generating an alarm followed by generating a clear message; and

updating a report with the alarm representations.

27. The method of claim 26, wherein the group of filtering systems further comprises:

a classification filtering system that masks alarms based on a source of the alarms, types of elements generating the alarms, a location of elements generating the alarms, or a type of the alarms.

28. A method for monitoring the alarm status of a network comprising:

capturing alarms generated by elements of the network;

applying at least one filter to the alarms wherein the filter generates alarm representations for selected alarms and wherein the filters include each of a group of filters comprising;

non-temporal filters, wherein the non-temporal filters include at least one non-temporal filter that is selected from a group of non-temporal filters comprising;

a de-duplication filter that generates a de-duplication alarm representation that masks alarms that are repeated while an alarm condition is maintained; and

a clear message mapping filter that removes alarms or alarm representations in response to receiving a clear message from corresponding ones of the elements that originally generated the alarms or alarms replaced by the alarm representations;

temporal filters, wherein the temporal filters include at least one temporal filter selected from a group of temporal filters comprising;

a frequency-based filter that generates a temporal alarm representation that replaces multiple alarms in response to a quantity of the multiple alarms exceeding a threshold within a period of time; and

a cycling-based filter that generates a second temporal alarm representation that replaces multiple alarms in response to a quantity of cycles of the multiple alarms exceeding a threshold within a period of time, wherein each cycle of the multiple alarms includes generating an alarm followed by clearing the alarm; and

linkage-based filters, wherein the linkage-based filters generate a linkage-based alarm representation that replaces sympathetic alarms generated by portions of the network impacted by a failure of a first portion of the network;

displaying the generated alarm representations and a selection of the alarms which have passed through the filters;

monitoring the display; and

taking action in response to the displayed alarm representations and alarms.

29. The method of claim 28, wherein the non-temporal filters include at least one non-temporal filter selected from a group of non-temporal filters comprising the de-duplication filter, the clear message mapping filter, and a classification filter.

30. The method of claim 29, wherein the non-temporal filters include each of the de-duplication filter, the clear message mapping filter, and the classification filter.

31. The method of claim 29, wherein the classification filter masks alarms based on a source of the alarms, types of elements generating the alarms, a location of elements generating the alarms, or a type of the alarms.

32. The method of claim 28, wherein the linkage-based filters include at least one linkage-based filter selected from a group of linkage-based filters comprising an internal linkage-based filter and an external linkage-based filter.

33. The method of claim 32, wherein linkage-based filters includes each of the internal linkage-based filter and the external linkage-based filter.

34. The method of claim 28, wherein the non-temporal filters include each of the de-duplication and the clear message mapping filter.

35. The method of claim 28, wherein the temporal filters include each of the frequency-based filter and the cycling-based filter.

36. The method of claim 28, wherein the non-temporal filters include each of the de-duplication filter and the clear message mapping filter and wherein the temporal filters include each of the frequency-based filter and the cycling-based filter.

37. The method of claim 28, further comprising human monitors generating alarm representations and grouping selected alarms subordinate to the alarm representations.