Alarm correlation analysis method, apparatus and system
First Claim
1. An alarm correlation analysis method, wherein the method is applied in an alarm correlation analysis apparatus with two or more analysis engines running, and the method comprises:
- receiving an alarm reported by a network element device, wherein the alarm comprises an alarm identifier that can uniquely identify the alarm;
performing, by an analysis engine corresponding to an alarm analysis rule group that comprises an alarm indicated by the same alarm identifier, correlation analysis for the received alarm according to an alarm analysis rule in the alarm analysis rule group corresponding to the analysis engine when the alarm identifier of the received alarm is the same as an alarm identifier of any alarm in any alarm analysis rule that is comprised in an alarm analysis rule group corresponding to any one of the analysis engines, wherein a same alarm analysis rule group comprises correlated alarm analysis rules, one alarm analysis rule group corresponds to one analysis engine, the alarm analysis rule is used to indicate an interrelationship between different alarms, and multiple correlated alarm analysis rules all comprise at least an alarm with a same alarm identifier;
receiving a second alarm reported by another network element device, wherein the second alarm has a second alarm identifier, and wherein the second alarm identifier is the same as the alarm identifier; and
balancing loads of the two or more analysis engines, wherein each one of the two or more analysis engines has a current load of alarms, and wherein the second alarm is correlated with the one of the two or more analysis engines with a lowest current load of alarms.
1 Assignment
0 Petitions
Accused Products
Abstract
According to an alarm correlation analysis method, apparatus, and system, alarm analysis rules are grouped according to a certain policy; each alarm analysis rule group is correlated with one analysis engine, and the analysis engine performs, according to an alarm analysis rule in the alarm analysis rule group corresponding to the analysis engine, correlation analysis for an alarm that has a correlation with the alarm analysis rule group, so that multiple analysis engines implement concurrent analysis on a large quantity of alarms, thereby fully utilizing a multi-core resource, and improving efficiency of alarm correlation analysis.
10 Citations
26 Claims
-
1. An alarm correlation analysis method, wherein the method is applied in an alarm correlation analysis apparatus with two or more analysis engines running, and the method comprises:
-
receiving an alarm reported by a network element device, wherein the alarm comprises an alarm identifier that can uniquely identify the alarm; performing, by an analysis engine corresponding to an alarm analysis rule group that comprises an alarm indicated by the same alarm identifier, correlation analysis for the received alarm according to an alarm analysis rule in the alarm analysis rule group corresponding to the analysis engine when the alarm identifier of the received alarm is the same as an alarm identifier of any alarm in any alarm analysis rule that is comprised in an alarm analysis rule group corresponding to any one of the analysis engines, wherein a same alarm analysis rule group comprises correlated alarm analysis rules, one alarm analysis rule group corresponds to one analysis engine, the alarm analysis rule is used to indicate an interrelationship between different alarms, and multiple correlated alarm analysis rules all comprise at least an alarm with a same alarm identifier; receiving a second alarm reported by another network element device, wherein the second alarm has a second alarm identifier, and wherein the second alarm identifier is the same as the alarm identifier; and balancing loads of the two or more analysis engines, wherein each one of the two or more analysis engines has a current load of alarms, and wherein the second alarm is correlated with the one of the two or more analysis engines with a lowest current load of alarms. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. An alarm correlation analysis apparatus, comprising:
a computer processor configured to; receive an alarm reported by a network element device, wherein the alarm comprises an alarm identifier that can uniquely identify the alarm; perform, by using an analysis engine corresponding to an alarm analysis rule group that comprises an alarm indicated by the same alarm identifier, correlation analysis for the received alarm according to an alarm analysis rule in the alarm analysis rule group corresponding to the analysis engine when the alarm identifier of the received alarm is the same as an alarm identifier of any alarm in any alarm analysis rule that is comprised in an alarm analysis rule group corresponding to any one of the analysis engines, wherein a same alarm analysis rule group comprises correlated alarm analysis rules, one alarm analysis rule group corresponds to one analysis engine, the alarm analysis rule is used to indicate an interrelationship between different alarms, and multiple correlated alarm analysis rules all comprise at least an alarm with a same alarm identifier; and balance loads of two or more analysis engines, wherein the computer processor is configured to receive a second alarm reported by another network element device, wherein the second alarm has a second alarm identifier, wherein the second alarm identifier is the same as the alarm identifier, wherein each one of the two or more analysis engines has a current load of alarms, and wherein the second alarm is correlated with the one of the two or more analysis engines with a lowest current load of alarms. - View Dependent Claims (9, 10, 11, 12, 13, 14)
-
15. An alarm correlation analysis method, wherein the method is applied in an alarm correlation analysis apparatus with two or more analysis engines running, and the method comprises:
-
receiving an alarm reported by a network element device, wherein the alarm comprises an alarm identifier that can uniquely identify the alarm; performing, by an analysis engine corresponding to an alarm group that comprises an alarm identified by the same alarm identifier, correlation analysis for the received alarm according to an alarm analysis rule when the alarm identifier of the received alarm is the same as an alarm identifier of any alarm in any alarm group, wherein a same alarm group comprises correlated alarms, one alarm group corresponds to one analysis engine, and the correlated alarms refer to alarms generated by network element devices that belong to a same logical area, wherein the network element devices in the same logical area have a service correlation; receiving a second alarm reported by another network element device, wherein the second alarm has a second alarm identifier, and wherein the second alarm identifier is the same as the alarm identifier; and balancing loads of the two or more analysis engines, wherein each one of the two or more analysis engines has a current load of alarms, and wherein the second alarm is correlated with the one of the two or more analysis engines with a lowest current load of alarms. - View Dependent Claims (16, 17, 18, 19)
-
-
20. An alarm correlation analysis apparatus, comprising:
a computer processor configured to; receive an alarm reported by a network element device, wherein the alarm comprises an alarm identifier that can uniquely identify the alarm; perform, by using an analysis engine corresponding to an alarm group that comprises an alarm identified by the same alarm identifier, correlation analysis for the received alarm according to an alarm analysis rule when the alarm identifier of the received alarm is the same as an alarm identifier of any alarm in any alarm group, wherein a same alarm group comprises correlated alarms, one alarm group corresponds to one analysis engine, and the correlated alarms refer to alarms generated by network element devices that belong to a same logical area, wherein the network element devices in the same logical area have a service correlation; and balance loads of two or more analysis engines, wherein the computer processor is configured to receive a second alarm reported by another network element device, wherein the second alarm has a second alarm identifier, wherein the second alarm identifier is the same as the alarm identifier, wherein each one of the two or more analysis engines has a current load of alarms, and wherein the second alarm is correlated with the one of the two or more analysis engines with a lowest current load of alarms. - View Dependent Claims (21, 22, 23, 24)
-
25. A network management system, comprising:
-
an alarm correlation analysis apparatus; and at least one network element device that has a communication connection with the alarm correlation analysis apparatus, wherein the network element device is configured to report an alarm to the alarm correlation analysis apparatus when a fault occurs, and wherein the alarm correlation analysis apparatus comprises; a computer processor configured to; receive an alarm reported by a network element device, wherein the alarm comprises an alarm identifier that can uniquely identify the alarm; perform, by using an analysis engine corresponding to an alarm analysis rule group that comprises an alarm indicated by the same alarm identifier, correlation analysis for the received alarm according to an alarm analysis rule in the alarm analysis rule group corresponding to the analysis engine when the alarm identifier of the received alarm is the same as an alarm identifier of any alarm in any alarm analysis rule that is comprised in the alarm analysis rule group corresponding to any one of the analysis engines, wherein a same alarm analysis rule group comprises correlated alarm analysis rules, one alarm analysis rule group corresponds to one analysis engine, the alarm analysis rule is used to indicate an interrelationship between different alarms, and multiple correlated alarm analysis rules all comprise at least an alarm with a same alarm identifier; and balance loads of two or more analysis engines, wherein the computer processor is configured to receive a second alarm reported by another network element device, wherein the second alarm has a second alarm identifier, wherein the second alarm identifier is the same as the alarm identifier, wherein each one of the two or more analysis engines has a current load of alarms, and wherein the second alarm is correlated with the one of the two or more analysis engines with a lowest current load of alarms.
-
-
26. A network management system, comprising:
-
an alarm correlation analysis apparatus; and at least one network element device that has a communication connection with the alarm correlation analysis apparatus, wherein the network element device is configured to report an alarm to the alarm correlation analysis apparatus when a fault occurs, and wherein the alarm correlation analysis apparatus comprises; a computer processor configured to; receive an alarm reported by a network element device, wherein the alarm comprises an alarm identifier that can uniquely identify the alarm; perform, by using an analysis engine corresponding to an alarm group that comprises an alarm identified by the same alarm identifier, correlation analysis for the received alarm according to an alarm analysis rule when the alarm identifier of the received alarm is the same as an alarm identifier of any alarm in any alarm group, wherein a same alarm group comprises correlated alarms, one alarm group corresponds to one analysis engine, and the correlated alarms refer to alarms generated by network element devices that belong to a same logical area, wherein the network element devices in the same logical area have a service correlation; and balance loads of two or more analysis engines, wherein the computer processor is configured to receive a second alarm reported by another network element device, wherein the second alarm has a second alarm identifier, wherein the second alarm identifier is the same as the alarm identifier, wherein each one of the two or more analysis engines has a current load of alarms, and wherein the second alarm is correlated with the one of the two or more analysis engines with a lowest current load of alarms.
-
Specification