Method of labeling alarms to facilitate correlating alarms in a telecommunications network

• US 8,065,409 B2
• Filed: 02/18/2005
• Issued: 11/22/2011
• Est. Priority Date: 01/22/2002
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Shyu, Jackson
• Primary Examiner(s): Nguyen, Phuoc
• Assistant Examiner(s): Belani, Kishin G
• Application Number:
  US11/061,070
• Publication Number:
  US 20050166099A1
• Time in Patent Office: 2,468 Days
• Field of Search: 709/224
• US Class Current: 709/224
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0769 Readable error formats, e.g. cross-platform generic formats, human understandable formats
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis

Abstract

A method for generating compressed correlation key values for use in correlating alarms generated by network elements in a telecommunications network is disclosed. An alarm message generated by a network element is received. A context value in the alarm message is identified. A table that associates context values to correlation key value formulas is maintained. A formula specifying how to generate the correlation key value is retrieved from the table. Each formula may specify, for an associated context value, one or more ordinal positions of fields in the alarm message, a concatenation of which yields the correlation key value. The correlation key value is created based on the formula. A unique ordinal number is generated to represent the correlation key value, which acts as a context key. The alarm message and correlation key value are sent to an external system for use in correlating alarms.

Claims

1. An apparatus for generating an external correlation key value for use in correlating alarms emitted by network elements or system elements in a telecommunications network, the apparatus comprising a memory storing instructions which, when processed by one or more processors, causes:

receiving an alarm message generated by a network element or system element of the telecommunications network, wherein the alarm message is generated in response to one or more alarm conditions;

parsing the alarm message that is generated in response to the one or more alarm conditions to identify a particular context value in the alarm message;

after receiving and parsing the alarm message, using the particular context value in the alarm message as a key to retrieve, from a table that associates context values to internal correlation key value formulas, a particular internal correlation key value formula specifying how to generate, by using two or more values contained in the alarm message, an internal correlation key value for the alarm message;

after receiving and parsing the alarm message, using the particular internal correlation key value formula to generate, using information contained in the alarm message, a particular internal correlation key value for the alarm message;

generating a particular external correlation key value for the alarm message based on the particular internal correlation key value; and

sending both (a) data that represents the alarm message and (b) the particular external correlation key value to a network management system, wherein the external correlation key value allows the alarm message to be properly correlated.

2. An apparatus as recited in claim 1, wherein the alarm message is an SNMP message, the context value is an SNMP context string, and the particular external correlation key value is an ordinal number.

3. An apparatus as recited in claim 1, wherein the table is stored at a gateway that is logically located in the telecommunication network between the network element or system element and an Operational Support System of a telecommunications service provider.

4. An apparatus as recited in claim 1, wherein each formula in the table specifies, for an associated context value, one or more ordinal positions of fields in the alarm message.

5. An apparatus as recited in claim 1, wherein the memory stores additional instructions which, when processed by the one or more processors causes storing the particular internal correlation key value into an internal work area in the memory and generating the particular external correlation key value that uniquely represents the particular internal correlation key value.

6. An apparatus as recited in claim 1, wherein each formula in the table specifies, for an associated context value, one or more fields in the alarm message, a concatenation of which yields the particular internal correlation key value.

7. An apparatus as recited in claim 1, wherein each formula in the table specifies one or more pattern matching procedures to extract one or more fields from the alarm message, a concatenation of which yields the particular internal correlation key value.

8. An apparatus as recited in claim 1, wherein each formula in the table specifies, for an associated context value, one or more ordinal positions of fields in the alarm message and one or more references to objects in an external database system.

9. An apparatus as recited in claim 1, wherein each formula in the table specifies, for an associated context value, one or more ordinal positions of fields in the alarm message and one or more references to programmatic procedures that are stored in an external database system.

10. An apparatus as recited in claim 1, wherein each formula in the table specifies, for an associated context value, one or more ordinal positions of fields in the alarm message and one or more references to programmatic procedures that are stored in an external database system, and wherein a concatenation of the fields and a result value from execution of the programmatic procedures yields the particular internal correlation key value.

11. An apparatus as recited in claim 1, wherein generating the particular external correlation key value includes compressing the particular internal correlation key value such that the particular external correlation key value is stored in fewer bits than the particular internal correlation key value.

12. An apparatus as recited in claim 1, wherein the table is stored at a gateway that is logically located in the telecommunication network between the network element or system element, and an Operational Support System of a telecommunications service provider;

wherein each formula in the table specifies, for an associated context value, one or more ordinal positions of fields in the alarm message and one or more references to objects in an external database system that is accessible to the gateway; and

wherein a concatenation of the fields and objects yields the particular internal correlation key value; and

wherein the apparatus is further configured to compress the particular internal correlation key value such that the particular external correlation key value is stored in fewer bits than the particular internal correlation key value.

13. An apparatus as recited in claim 1, wherein the memory stores additional instructions which, when processed by the one or more processors, causes:

storing the particular internal correlation key value and particular external correlation key value in a persistent work area; and

retrieving the particular external correlation key value from the persistent work area.

14. An apparatus as recited in claim 1, wherein sending the data that represents the alarm message and the particular external correlation key value comprises sending an SNMP message to an Operational Support System that includes a complete SNMP object carrying the data that represents the alarm message and the particular external correlation key value in an SNMP field.

15. An apparatus as recited in claim 1, wherein sending the data that represents the alarm message and the particular external correlation key value comprises sending an XML file to an Operational Support System that includes the data that represents the alarm message and the particular external correlation key value identified by unique XML tags.

16. A method for generating an external correlation key value for use in correlating alarms emitted by network elements or system elements in a telecommunications network, the method comprising:

receiving an alarm message generated by a network element or system element of the telecommunications network, wherein the alarm message is generated in response to one or more alarm conditions;

parsing the alarm message that is generated in response to the one or more alarm conditions to identify a particular context value in the alarm message;

after receiving and parsing the alarm message, using the particular context value in the alarm message as a key to retrieve from a table that associates context values to internal correlation key value formulas, a particular internal correlation key value formula specifying how to generate, by using two or more values contained in the alarm message, an internal correlation key value for the alarm message;

after receiving and parsing the alarm message, using the particular internal correlation key value formula to generate, using information contained in the alarm message, a particular internal correlation key value for the alarm message;

generating a particular external correlation key for the alarm message value based on the particular internal correlation key value; and

sending both (a) data that represents the alarm message and (b) the particular external correlation key value to a network management system, wherein the external correlation key value allows the alarm message to be properly correlated;

wherein the method is performed by one or more computing devices.

17. A method as recited in claim 16, wherein the alarm message is an SNMP message, the context value is an SNMP context string, and the external correlation key value is an ordinal number.

18. A method as recited in claim 16, wherein the formula specifies, for an associated context value, one or more fields in the alarm message, a concatenation of which yields the particular internal correlation key value.

19. A method as recited in claim 16, wherein sending the data that represents the alarm message and the particular external correlation key value comprises sending an SNMP message to an Operational Support System that includes a complete SNMP object carrying the data that represents the alarm message and the particular external correlation key value in an SNMP field.

20. A method as recited in claim 16, wherein sending the data that represents the alarm message and the particular external correlation key value comprises sending an XML file to an Operational Support System that includes the data that represents the alarm message and the particular external correlation key value identified by unique XML tags.

21. A non-transitory computer-readable medium for generating an external correlation key value for use in correlating alarms emitted by network elements or system elements in a telecommunications network, the computer-readable volatile or non-volatile storage medium storing instructions which, when processed by one or more processors, cause:

receiving an alarm message generated by a network element or system element of the telecommunications network, wherein the alarm message is generated in response to one or more alarm conditions;

parsing the alarm message that is generated in response to the one or more alarm conditions to identify a particular context value in the alarm message;

after receiving and parsing the alarm message, using the particular context value in the alarm message as a key to retrieve, from a table that associates context values to internal correlation key value formulas, a particular internal correlation key value formula specifying how to generate, by using two or more values contained in the alarm message, an internal correlation key value for the alarm message;

after receiving and parsing the alarm message, using the particular internal correlation key value formula to generate, using information contained in the alarm message, a particular internal correlation key value for the alarm message; and

sending both (a) data that represents the alarm message and (b) the particular external correlation key value to a network management system, wherein the external correlation key value allows the alarm message to be properly correlated.

22. A non-transitory computer-readable medium as recited in claim 21, wherein the alarm message is an SNMP message, the context value is an SNMP context string, and the particular external correlation key value is an ordinal number.

23. A non-transitory computer-readable medium as recited in claim 21, wherein the formula specifies, for an associated context value, one or more fields in the alarm message, a concatenation of which yields the particular internal correlation key value.

24. A non-transitory computer-readable medium as recited in claim 21, wherein sending the data that represents the alarm message and the particular external correlation key value comprises sending an SNMP message to an Operational Support System that includes a complete SNMP object carrying the data that represents the alarm message and the particular external correlation key value in an SNMP field.

25. A non-transitory computer-readable medium as recited in claim 21, wherein sending the data that represents the alarm message and the particular external correlation key value comprises sending an XML file to an Operational Support System that includes the data that represents the alarm message and the particular external correlation key value identified by unique XML tags.

26. An apparatus for generating an external correlation key value for use in correlating alarms emitted by network elements or system elements in a telecommunications network, the apparatus comprising:

a receiver for receiving an alarm message generated by a network element or system element of the telecommunications network, wherein the alarm message is generated in response to one or more alarm conditions;

a parser for parsing the alarm message that is generated in response to the one or more alarm conditions to identify a particular context value in the alarm message;

a comparer for using, after receiving and parsing the alarm message, the particular context value in the alarm message as a key to retrieve from a table that associates context values to internal correlation key value formulas, a particular internal correlation key value formula specifying how to generate, by using two or more values contained in the alarm message, an internal correlation key value for the alarm message;

an internal key generator for using, after receiving and parsing the alarm message, the particular internal correlation key value formula to generate, using information contained in the alarm message, a particular internal correlation key value for the alarm message;

an external key generator for generating a particular external correlation key for the alarm message value based on the particular internal correlation key value; and

a communicator for sending both (a) data that represents the alarm message and (b) the particular external correlation key value to a network management system, wherein the external correlation key value allows the alarm message to be properly correlated.

27. An apparatus as recited in claim 26, wherein the alarm message is an SNMP message, the context value is an SNMP context string, and the particular external correlation key value is an ordinal number.

28. An apparatus as recited in claim 26, wherein the formula specifies, for an associated context value, one or more fields in the alarm message, a concatenation of which yields the particular internal correlation key value.

29. An apparatus as recited in claim 26, wherein sending the data that represents the alarm message and the particular external correlation key value comprises sending an SNMP message to an Operational Support System that includes a complete SNMP object carrying the data that represents the alarm message and the particular external correlation key value in an SNMP field.

30. An apparatus as recited in claim 26, wherein sending the data that represents the alarm message and the particular external correlation key value comprises sending an XML file to an Operational Support System that includes the data that represents the alarm message and the particular external correlation key value identified by unique XML tags.