CN105991332A - Alarm processing method and device - Google Patents

Abstract

The invention discloses an alarm processing method and device, wherein the method comprises: a controller receives an alarm from a network device; the controller analyzes the alarm to obtain an analysis result; the controller processes the alarm according to the analysis result , through the present invention, the problem of not only untimely alarm processing in the related art, but also low performance of upper-layer network equipment caused by a large number of alarms is solved, and the effect of efficient and timely alarm processing is achieved.

Description

Alarm processing method and device

technical field

The present invention relates to the communication field, in particular to an alarm processing method and device.

Background technique

In a communication network, the network is composed of many communication device nodes, and these network nodes are called network elements. Network elements are connected through communication lines, including various forms such as optical fiber cables. The network elements are scattered in various regions, some are in the communication building laboratories in the city, and some are in remote areas. However, the equipment of these network elements needs to be configured, maintained and monitored, and it is impossible to send people on duty everywhere. In this way, a central network management system is required, placed in the central computer room, and configured, maintained and monitored for each node on the network through remote communication. monitor.

Network management through controllers can be realized by a new emerging network management control system. In this control system, the control function of service resources in traditional network management is separated, and only focus on service resources. Controllers can be organized hierarchically in a tree-like fashion for associating large-scale networks. Among them, the one that directly manages network elements can be called a domain controller (Domain Controller, or D-Controller, referred to as DC); while the upper-layer controller (Super Controller, or S-Controller, referred to as SC) does not directly manage network elements. , but to manage the domain controller, and then realize the management of the actual network through the virtual network management provided by the domain controller. Figure 1 is a schematic diagram of a network that uses a controller to manage and control the network in related technologies. As shown in Figure 1, in an application scenario, the controller forms a tree management system, the upper layer is SC, and the lower layer DC divides the management domain to manage the communication network. and network elements. In addition to southbound and network device management through the interface, the controller also has a northbound interface that allows the network APP (Application) at the application layer to access the network for network management. It can also be connected to the network management plane (including: network element management system ( Element Management System (EMS for short), Network Management System (NMS for short), or Operation Support System (OSS for short)) communicate management information. The network APP is the actual business application of the network. It uses the resources provided by the controller to send requests for business establishment, deletion and modification. The controller establishes, deletes, and modifies services according to network APP requests, and monitors service alarms and performance. Figure 2 is a schematic diagram of the relationship between a controller and other network entities in a Software Defined Network (SDN) network in the related art. As shown in Figure 2, the DC directly manages the communication network, while the SC manages the DC, and at the same time It can also communicate with traditional network management systems, and finally provide resources and services to APP.

During the actual operation of the network, failures may occur, or interference may be received and the communication quality may decline. Once this condition is sent, the network device will report an alarm. Since the direct communication of network devices is closely related, if a device or a part of resources fails and reports an alarm, it will cause a large area of the network to generate alarms. Generates a very high volume of alerts. For network administrators, it is difficult to find out the real fault cause with so many alarms. The occurrence of a fault in the network will trigger an alarm that directly reflects the fault, and at the same time, a series of alarms will be triggered because the fault affects other devices or services. For example, alarm A triggers alarm B, alarm A is the root alarm, and alarm B is a derived alarm.

In a traditional network, alarms are generated by devices, and the network controller directly forwards the alarms to the upper-layer network equipment that handles the alarms after receiving the alarms. If there are too many, it will cause the problem of low performance of upper-layer network equipment.

Contents of the invention

The present invention provides an alarm processing method and device to at least solve the problem in the related art that not only the alarm processing is not timely, but also the performance of the upper layer network equipment is low due to the large number of alarms.

According to one aspect of the present invention, an alarm processing method is provided, including: a controller receives an alarm from a network device; the controller analyzes the alarm to obtain an analysis result; the controller obtains an analysis result according to the analysis As a result, the alarm is processed.

Preferably, the controller analyzes the alarm to obtain the analysis result including at least one of the following: According to the cause of the alarm that generates the alarm, analyze whether the alarm has an impact on the service managed by the controller. According to the above analysis results; according to the relationship between the resources that generate the alarm and the resources occupied by the business managed by the controller, analyze whether the alarm has an impact on the business managed by the controller. Analyze the results.

Preferably, according to the relationship between the resources that generate the alarm and the resources occupied by the business managed by the controller, the analysis of whether the alarm has an impact on the business managed by the controller is obtained by analyzing The result includes one of the following: when the root resource generating the alarm is not occupied by the service managed by the controller, and no sub-resource corresponding to the root resource is occupied by the service managed by the controller , it is determined that the alarm has no impact on the business managed by the controller; the root resource that generates the alarm is not occupied by the business managed by the controller, but the sub-resource corresponding to the root resource is occupied by the If the service managed by the controller is occupied by the controller, determine that the alarm has an impact on the service managed by the controller; if the root resource generating the alarm is not occupied by the service managed by the controller, the The sub-resources corresponding to the root resource are not occupied by the services managed by the controller, but there is a mapping relationship between the root resource and/or the sub-resources corresponding to the root resource and the services managed by the controller , determine that the alarm has an impact on the service managed by the controller; if the root resource that generates the alarm is occupied by the service managed by the controller, determine that the alarm has an impact on the service managed by the controller impact on said business.

Preferably, the processing of the alarm by the controller according to the analysis result includes one of the following: according to the cause of the alarm, it is analyzed that the alarm has no impact on the services managed by the controller , suppressing the alarm; determining that the alarm has no impact on the business managed by the controller according to the relationship between the resources that generate the alarm and the resources occupied by the business managed by the controller In this case, suppress the alarm; if the root resource that generates the alarm is not occupied by the business managed by the controller, but the sub-resource corresponding to the root resource is occupied by the business managed by the controller In this case, the alarm is derived as a sub-resource derived alarm; when the root resource generating the alarm is not occupied by the business managed by the controller, the sub-resource corresponding to the root resource is not managed by the controller In the case that the root resource and/or the sub-resource corresponding to the root resource has a mapping relationship with the service managed by the controller, according to the mapping relationship, the alarm is derived as a relationship derived Alarm: when the root resource generating the alarm is occupied by the service managed by the controller, directly report the alarm to the upper-layer network device.

Preferably, in the case of deriving the alarm, it further includes: recording the association relationship between the alarm and the derived alarm after derivation, wherein the derived alarm includes: sub-resource derived alarm and/or relationship Derived alarms: reporting the derived alarms and the associated relationship to an upper-layer network device, and/or providing the associated relationship for query by network element devices in the controller management system.

Preferably, after the controller processes the alarm according to the analysis result, it further includes: according to the state change of the network element equipment caused by the alarm, or the state change of the object representing the resource in the alarm , generating a status notification of the network element device or the resource-representing object; reporting the generated status notification of the network element device or the resource-representing object to an upper-layer network device.

According to another aspect of the present invention, an alarm processing device is provided, which is applied to a controller, including: a receiving module, configured to receive an alarm from a network device; an analysis module, configured to analyze the alarm to obtain an analysis Result; a processing module, configured to process the alarm according to the analysis result.

Preferably, the analysis module includes at least one of the following: a first analysis unit, configured to analyze and obtain the analysis result of whether the alarm has an impact on the service managed by the controller according to the cause of the alarm that generates the alarm; The second analysis unit is configured to analyze whether the alarm affects the service managed by the controller according to the relationship between the resource generating the alarm and the resource occupied by the service managed by the controller of the analysis results.

Preferably, the second analysis unit includes one of the following: a first determining subunit, configured to generate the alarm when the root resource is not occupied by the service managed by the controller and does not correspond to the root resource When the sub-resources of the controller are occupied by the business managed by the controller, it is determined that the alarm has no impact on the business managed by the controller; the second determination subunit is configured to generate the alarm at the root If the resource is not occupied by the service managed by the controller, but the sub-resource corresponding to the root resource is occupied by the service managed by the controller, it is determined that the alarm is for the service managed by the controller produce an impact; the third determining subunit is configured to generate the alarm root resource is not occupied by the business managed by the controller, and the sub-resource corresponding to the root resource is not occupied by the business managed by the controller Occupied, but in the case that the root resource and/or the sub-resource corresponding to the root resource has a mapping relationship with the service managed by the controller, determine that the alarm has an impact on the service managed by the controller; The fourth determining subunit is configured to determine that the alarm has an impact on the service managed by the controller when the root resource generating the alarm is occupied by the service managed by the controller.

Preferably, the processing module includes one of the following: a first suppressing unit, configured to suppress the Suppressing the alarm; the second suppression unit is configured to determine that the alarm does not affect the business managed by the controller according to the relationship between the resources that generate the alarm and the resources occupied by the business managed by the controller In the case of an impact, suppress the alarm; the first derivation unit is configured to generate the root resource that generates the alarm is not occupied by the service managed by the controller, but the sub-resource corresponding to the root resource is occupied by In the case that the service managed by the controller is occupied, the alarm is derived as a sub-resource derived alarm; the second derivation unit is configured to generate the root resource of the alarm is not occupied by the service managed by the controller , the sub-resources corresponding to the root resource are not occupied by the services managed by the controller, but there is a mapping relationship between the root resource and/or the sub-resources corresponding to the root resource and the services managed by the controller In some cases, according to the mapping relationship, the alarm is derived into a relationship-derived alarm; the first reporting unit is configured to directly generate the alarm when the root resource generating the alarm is occupied by the service managed by the controller. The alarm is reported to the upper layer network device.

Preferably, the processing module further includes: a recording unit, configured to record the correlation between the alarm and the derived derived alarm when derivation processing is performed on the alarm, wherein the derived alarm includes: Sub-resource-derived alarms and/or relationship-derived alarms; a second reporting unit, configured to report the derived alarms and the association relationship to an upper-layer network device, and/or a providing unit, configured to provide the association relationship for the The network element device query in the controller management system is described above.

Preferably, the device further includes: a generating module, configured to generate the network element device or the representative resource according to the state change of the network element device caused by the alarm, or the state change of the object representing the resource of the alarm. A status notification of a resource object; a reporting module, configured to report the generated status notification of the network element device or the object representing the resource to an upper-layer network device.

Preferably, the controller includes at least one of the following: a domain controller DC and a super controller SC, wherein the SC is an upper controller of the DC.

Through the present invention, a controller is used to receive an alarm from a network device; the controller analyzes the alarm to obtain an analysis result; the controller processes the alarm according to the analysis result, which solves the problem of related technologies In this method, not only the alarms are not processed in time, but also the performance of the upper-layer network equipment is low when there are a large number of alarms, and the effect of efficient and timely alarm processing is achieved.

Description of drawings

The accompanying drawings described here are used to provide a further understanding of the present invention and constitute a part of the application. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations to the present invention. In the attached picture:

FIG. 1 is a schematic diagram of a network using a controller to manage and control a network in the related art;

FIG. 2 is a schematic diagram of the relationship between the controller and other network entities in the SDN network in the related art;

Fig. 3 is a flowchart of an alarm processing method according to an embodiment of the present invention;

Fig. 4 is a structural block diagram of an alarm processing device according to an embodiment of the present invention;

Fig. 5 is a preferred structural block diagram of the analysis module 44 in the alarm processing device according to an embodiment of the present invention;

6 is a preferred structural block diagram of the second analysis unit 54 in the analysis module 44 of the alarm processing device according to an embodiment of the present invention;

Fig. 7 is a preferred structural block diagram 1 of the processing module 46 in the alarm processing device according to an embodiment of the present invention;

FIG. 8 is a second preferred structural block diagram of the processing module 46 in the alarm processing device according to an embodiment of the present invention;

Fig. 9 is a preferred structural block diagram of an alarm processing device according to an embodiment of the present invention;

10 is a schematic structural diagram of a controller alarm analysis module according to an embodiment of the present invention;

Fig. 11 is a schematic diagram of alarm reporting processing according to the preferred embodiment 1 of the present invention;

Fig. 12 is a schematic diagram of alarm reporting processing according to the second preferred embodiment of the present invention.

detailed description

Hereinafter, the present invention will be described in detail with reference to the drawings and examples. It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

In this embodiment, a method for processing an alarm is provided. FIG. 3 is a flowchart of a method for processing an alarm according to an embodiment of the present invention. As shown in FIG. 3 , the process includes the following steps:

In step S302, the controller receives an alarm from a network device. It should be noted that the network device may be the network element device itself that generates the alarm, or may be a controller device;

Step S304, the controller analyzes the alarm to obtain an analysis result;

Step S306, the controller processes the alarm according to the analysis result.

Through the above steps, the controller analyzes and processes the received alarms, which solves the problem in the related technology that not only the alarms are not processed in time, but also the performance of the upper-layer network equipment is low when there are a large number of alarms, thereby achieving This ensures efficient and timely handling of alarms.

Preferably, when the controller analyzes the alarm to obtain the analysis result, different analysis basis is used, and the analysis result can also be different. For example, according to the alarm cause of the alarm, it can be analyzed whether the alarm has an impact on the business managed by the controller The analysis result of the alarm can also be obtained based on the relationship between the resources that generate the alarm and the resources occupied by the business managed by the controller to obtain the analysis result of whether the alarm has an impact on the business managed by the controller.

According to the relationship between the resources that generate the alarm and the resources occupied by the business managed by the controller, when analyzing whether the alarm has an impact on the business managed by the controller, one of the following can be included: If the resource is not occupied by the business managed by the controller, and no sub-resource corresponding to the root resource is occupied by the business managed by the controller, it is determined that the alarm will not affect the business managed by the controller; If it is not occupied by the business managed by the controller, but the sub-resource corresponding to the root resource is occupied by the business managed by the controller, it is determined that the alarm has an impact on the business managed by the controller; The service managed by the controller is occupied, and the sub-resources corresponding to the root resource are not occupied by the services managed by the controller, but the root resource and/or the sub-resources corresponding to the root resource have a mapping relationship with the service managed by the controller, and the alarm is determined. It has an impact on the business managed by the controller; in the case that the root resource generating the alarm is occupied by the business managed by the controller, it is determined that the alarm has an impact on the business managed by the controller.

When the controller processes the alarm according to the analysis results, the alarm processing is different according to the analysis results. The following example illustrates that the alarm can be suppressed in the following situations: for example, based on the alarm cause, the analysis results are When the alarm has no impact on the business managed by the controller, the alarm is suppressed; another example is to determine the impact of the alarm on the controller management based on the relationship between the resources that generate the alarm and the resources occupied by the business managed by the controller. Suppress the alarm when the business is not affected; the alarm can be derived in the following cases: For example, when the root resource that generates the alarm is not occupied by the business managed by the controller, but the sub When the resource is occupied by the business managed by the controller, the alarm is derived as a sub-resource-derived alarm; for example, if the root resource that generates the alarm is not occupied by the business managed by the controller, the sub-resource corresponding to the root resource is also not The business managed by the controller is occupied, but the root resource and/or the sub-resources corresponding to the root resource have a mapping relationship with the business managed by the controller, according to the mapping relationship, the alarm is derived as a relationship-derived alarm; in addition, when the alarm is generated When the root resource of the controller is occupied by the business managed by the controller, the alarm is directly reported to the upper-layer network device. It should be noted that the upper-layer network device here is a relative concept. For example, when the controller DC receives the alarm, the upper-layer network device is the upper-layer network device SC of the controller DC. For example, when the upper-layer network When the device SC receives the alarm, the upper-layer network device is the upper-layer network device NMS of the SC.

It should be noted that, in the case of deriving the alarm, it is also possible to: record the association relationship between the alarm and the derived derived alarm, wherein the derived alarm includes: a sub-resource derived alarm and/or a relationship derived alarm; Derived alarms and associated relationships are reported to upper-layer network devices, and/or associated relationships are provided for query by network element devices in the controller management system.

In addition, after the alarm is processed according to the analysis result, the following processing may also be included: according to the state change of the network element device caused by the alarm, or the state change of the object representing the resource in the alarm, generate the network element device or the object representing the resource status notification; report the generated status notification of the network element device or the object representing the resource to the upper-layer network device.

This embodiment also provides an alarm processing device, which is used to implement the above embodiments and preferred implementation manners, and what has been described will not be repeated. As used below, the term "module" may be a combination of software and/or hardware that realizes a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementations in hardware, or a combination of software and hardware are also possible and contemplated.

Fig. 4 is a structural block diagram of an alarm processing device according to an embodiment of the present invention. As shown in Fig. 4, the device can be applied to a controller, including a receiving module 42, an analyzing module 44 and a processing module 46, and the device will be described below .

The receiving module 42 is used to receive an alarm from the network device; the analysis module 44 is connected to the above receiving module 42, and is used to analyze the alarm to obtain an analysis result; the processing module 46 is connected to the above analysis module 44, and is used to Analyze the results and handle the alarms.

Fig. 5 is a preferred structural block diagram of an analysis module 44 in an alarm processing device according to an embodiment of the present invention. As shown in Fig. 5, the analysis module 44 includes at least one of the following: a first analysis unit 52, a second analysis unit 54, and The analysis module 44 will be described.

The first analysis unit 52 is used to analyze and obtain the analysis result of whether the alarm has an impact on the business managed by the controller according to the cause of the alarm; the second analysis unit 54 is used to analyze the resource and the resource managed by the controller according to the alarm. The relationship between the resources occupied by the business can be analyzed to obtain the analysis result of whether the alarm has an impact on the business managed by the controller.

FIG. 6 is a preferred structural block diagram of the second analysis unit 54 in the analysis module 44 of the alarm processing device according to an embodiment of the present invention. As shown in FIG. 6 , the second analysis unit 54 includes one of the following: a first determination subunit 62 , the second determination subunit 64 , the third determination subunit 66 , and the fourth determination subunit 68 , the second analysis unit 54 will be described below.

The first determining subunit 62 is configured to determine the impact of the alarm on the control when the root resource that generates the alarm is not occupied by the business managed by the controller, and no sub-resource corresponding to the root resource is occupied by the business managed by the controller. The business managed by the controller does not have an impact; the second determination subunit 64 is used for the case where the root resource that generates the alarm is not occupied by the business managed by the controller, but the sub-resource corresponding to the root resource is occupied by the business managed by the controller Next, it is determined that the alarm has an impact on the business managed by the controller; the third determining subunit 66 is used to determine that the root resource that generates the alarm is not occupied by the business managed by the controller, and the sub-resources corresponding to the root resource are not managed by the controller is occupied by the business, but there is a mapping relationship between the root resource and/or the sub-resources corresponding to the root resource and the business managed by the controller, it is determined that the alarm has an impact on the business managed by the controller; the fourth determination subunit 68 is used to In the case that the root resource generating the alarm is occupied by the service managed by the controller, it is determined that the alarm has an impact on the service managed by the controller.

Fig. 7 is a preferred structural block diagram 1 of the processing module 46 in the alarm processing device according to an embodiment of the present invention. As shown in Fig. 7, the processing module 46 includes one of the following: a first suppressing unit 70, a second suppressing unit 72, a A derivation unit 74, a second derivation unit 76, and a first reporting unit 78. The processing module 46 will be described below.

The first suppression unit 70 is configured to suppress the alarm based on the analysis of the cause of the alarm and shows that the alarm has no impact on the business managed by the controller; the second suppression unit 72 is configured to suppress the alarm based on the resource and When the relationship between the resources occupied by the business managed by the controller determines that the alarm does not affect the business managed by the controller, the alarm is suppressed; the first derivation unit 74 is used to control the root resource that generates the alarm In the case that the service managed by the controller is occupied, but the sub-resource corresponding to the root resource is occupied by the service managed by the controller, the alarm is derived as a sub-resource derived alarm; the second derivation unit 76 is used to generate the alarm if the root resource is not It is occupied by the business managed by the controller, and the sub-resources corresponding to the root resource are not occupied by the business managed by the controller, but there is a mapping relationship between the root resource and/or the sub-resources corresponding to the root resource and the business managed by the controller , deriving the alarm into a relationship-derived alarm according to the mapping relationship; the first reporting unit 78 is configured to directly report the alarm to the upper-layer network device when the root resource generating the alarm is occupied by a service managed by the controller.

FIG. 8 is a second preferred structural block diagram of the processing module 46 in the alarm processing device according to an embodiment of the present invention. As shown in FIG. 8 , the processing module 46 includes the first derivative module 74 and/or the first derivative module 76, It also includes: a recording unit 82 , a second reporting unit 84 and/or a providing unit 86 , and the processing module 46 will be described below.

The recording unit 82 is configured to record the association relationship between the alarm and the derived alarm when deriving the alarm, wherein the derived alarm includes: a sub-resource derived alarm and/or a relationship derived alarm; the second report The unit 84 is configured to report the derived alarm and the associated relationship to the upper-layer network device, and/or the providing unit 86 is configured to provide the associated relationship for query by the network element devices in the controller management system.

Fig. 9 is a preferred structural block diagram of an alarm processing device according to an embodiment of the present invention. As shown in Fig. 9, in addition to all the modules shown in Fig. 4, the device also includes: a generating module 92 and a reporting module 94, as follows The device is described.

The generation module 92 is connected to the above-mentioned processing module 46, and is used to generate a status notification of the network element device or the object representing the resource according to the state change of the network element device caused by the alarm, or the state change of the object representing the resource in the alarm; report The module 94 is connected to the generating module 92, and is configured to report the generated status notification of the network element device or the object representing the resource to the upper layer network device.

Preferably, the controller may include at least one of the following: a domain controller DC and a super controller SC, wherein the SC is an upper controller of the DC. It should be pointed out that there can be multiple SCs. From the perspective of DC, SCs are upper-level controllers. If there are SCs above SCs, the upper ones are higher-level controllers. This is a relative relationship.

In the network controlled by the SDN controller, due to the control characteristics of the SDN controller, it only cares about service-related resources, and due to the division of rights, the original alarm may be generated by resources that are not related to the service, or the controller does not The management service is generated, but it will have an impact on the service managed by the controller, resulting in service failure or quality degradation. Since the main core of the controller is to perform business management, the network management system or the control plane does not generate alarms for equipment resources and services. The controller generates alarms about the affected services. In addition, in addition to alarm derivation, the controller also needs to analyze the impact of the alarm on the business, and continue to report the alarm.

A brief description of the scheme is given below.

An alarm analysis module is added in the network controller. FIG. 10 is a schematic structural diagram of the controller alarm analysis module according to an embodiment of the present invention. As shown in FIG. 10 , the alarm analysis module performs the analysis and processing of the following steps:

Step 1: After the device detects a fault, it generates an alarm and reports it to the controller and network management at the same time.

Step 2: After the controller receives the device alarm, it analyzes and processes it, including a flexible combination of one or more of the following sub-steps:

Step 2.1: Classify according to the cause of the alarm. Some of the reasons for the alarm have no impact on the business. If one of the reasons for the alarm is received, the alarm can not be processed or suppressed. Such alarm reasons include but are not limited to: temperature alarms, voltage alarms, smoke alarms, etc., which are not listed one by one. The alarms that the controller needs to handle include but are not limited to: LOS (Loss of Signal), DEG (Degraded Signal), LOC (Loss of Connectivity/Loss of Connection), AIS (Alarm Indication Signal).

Step 2.2: Analyze the alarm and find that the resource that generates the alarm is not the resource occupied by the business, nor will it affect the resource occupied by the business. Such an alarm can also be ignored or suppressed. Such resources include but are not limited to: power supply modules, fan modules, backplane buses, etc. are not listed one by one. The resources that the controller needs to handle to generate alarms include but are not limited to: physical ports, connection endpoints, path endpoints, logical endpoints, flow points, and flow point pools.

Step 2.3: Analyze the alarm and find that the resource that generates the alarm is not directly occupied by the business, but there are sub-resources under the resource that are occupied by the business. The alarm can be derived as an alarm for the sub-resources occupied by the business, and then the controller sends the derived alarm Report to the upper controller and network management plane. The original alarm can continue to be reported or not reported according to the implementation needs.

Step 2.4: Analyze the alarm and find that the resource that generates the alarm is the resource occupied by the service. The reported alarm directly belongs to the service alarm, and there is no need to make a derivation, and continue to report the alarm to the upper controller and network management plane.

Step 2.5: Analyze the alarm and find that the resource that generates the alarm does not have a direct correspondence with the resource object of the business, but has an indirect mapping relationship (for example, virtualization), and the controller derives the Alarms of service resources, and then the controller reports the derived alarms to the upper control and network management planes. The original alarm can continue to be reported or not reported according to the implementation needs.

Step 2.6: Analyze the alarm and find that the alarm is a network element alarm, but the controller is not interested in the alarm, but is interested in the state change of the network element caused by the alarm, the controller suppresses or discards the alarm, generates a status notification, and modifies Local network element status, and report the status notification to the upper controller and network management plane.

Step 2.7: For new alarms derived from the controller, record the corresponding relationship between the original alarm and the derived alarm, and provide it when reporting the alarm, or provide a query, so that the network management plane can perform root cause analysis, find out the root cause of the fault, and repair and repair it. Troubleshoot.

Step 3: After the EMS receives the original alarm from the device and the derived alarm from the controller, it can perform local storage, display, confirmation, comment, etc. management, and the EMS reports both alarms to the NMS/OSS.

Step 4: After the upper-layer controller receives the derived alarm reported by the lower-layer controller, it uses the analysis and processing method in step 2 to perform local analysis and processing, and reports the result to APP and OSS/NMS.

Step 5: After the APP receives the service alarm, it is used for interface display and service quality evaluation.

Step 6: OSS/NMS receives the original alarms reported by the EMS, derived alarms, and derived alarms reported from the upper controller, and conducts a comprehensive analysis, including analysis of alarm correlations, root cause analysis, etc., for network operation, maintenance, and troubleshooting. Provide basis for faults, billing, etc.

The method for processing device resource alarms through the controller includes analyzing, processing, deriving, and continuing to report to other systems after receiving the alarm. Provides an efficient and feasible alarm processing method for the controller to process alarms, which meets the purpose of business management.

The following takes an alarm generated in a service across multiple controllers as an example to illustrate the alarm analysis and processing method.

Preferred embodiment one

Fig. 11 is a schematic diagram of the alarm reporting process according to the first preferred embodiment of the present invention. As shown in Fig. 11, the domain controllers DC1 and DC2 divide the regional management communication network, and the super controller SC manages DC1 and DC2 as the upper controller . The two management domains connect NE1, NE2 to NE6 to form a communication network. The connection from NE1 to NE6 represents a service concerned by the APP. The service A endpoint is at NE1, Z endpoint is at NE6, and the service passes through NE2, NE3, NE4, and NE5 in the middle, and is directly managed by DC1 and DC2 respectively. The dotted line in the figure indicates the management relationship. DC1, DC2, and SC have paired network management systems respectively. Suppose an alarm Alarm1 is generated on NE 1, and alarms are also generated on several other NEs.

Step 1: NE1 detects a fault, the smoke detector senses that the smoke exceeds the limit, the smoke detection module generates an alarm alarm1, and reports to DC1 and EMS1 at the same time.

Step 2: DC1 analyzes after receiving Alarm1, and the analysis module analyzes the cause of the alarm, and finds that the cause of the alarm of alarm1 is a smoke alarm, which is irrelevant to the service, so DC1 ignores the alarm.

Step 3: NE2 detects a fault, and the fan module finds that the fan speed is abnormal, generates an alarm alarm2, and reports it to DC1 and EMS1 at the same time.

Step 4: DC1 analyzes after receiving alarm2, and the analysis module analyzes the alarm source, and finds that the resource generated by alarm2 is a fan module, which has nothing to do with the business, so DC1 ignores the alarm.

Step 5: The OTN optical port of NE1 is faulty, and the OTN has a signal degradation alarm, generates an alarm alarm3, and reports it to DC1 and EMS1 at the same time.

Step 6: DC1 analyzes after receiving alarm3, and the analysis module analyzes the OTN port. Although this resource is not directly used by the service, the sub-channel ODU1-1 under the OTN is used by the service 1, and DC1 derives the ODU1-1 resource. Deterioration alarm alarm4, and record the correspondence between alarm3-alarm4, and then DC1 reports alarm4 to SC and EMS1, with the association of alarm3-alarm4 attached.

Step 7: EMS received alarm1, alarm2, alarm3, alarm4 in total. While performing traditional EMS alarm management, report these alarms to NMS/OSS1.

Step 8: The SC receives the alarm alarm4, and the analysis module finds that the alarm resource ODU1 and the service 1 are virtualized and mapped to the service 2 in the SC, and ODU1 is virtualized into LTP1. The derivation module SC derives alarm5 of the LTP1 resource from alarm4, and records the corresponding relationship between alarm4 and alarm5. The SC reports alarm5 to the app and NMS/OSS1 with the alarm4-alarm5 association.

Step 9: NMS/OSS1 receives alarm1, alarm2, alarm3, alarm4, alarm5 in total. Since there is already a derivative corresponding relationship of alarm3-alarm4-alarm5, NMS/OSS1 can easily analyze that alarm3 is the root alarm, and the maintenance personnel need to be notified to repair the device and troubleshoot the fault.

Step 10: After the APP receives alarm5, it knows that its business 2 generates alarm 5, and business 2 is affected. App users use this to communicate and coordinate with network operators.

Alarms generated by NE3 and NE4 are similarly processed in DC2, EMS2, and NMS/OSS2.

Preferred embodiment two

Fig. 12 is a schematic diagram of the alarm reporting process according to the second preferred embodiment of the present invention. As shown in Fig. 12, a network element NE1 in the network is managed by the implemented domain controller DC1 and managed by the EMS1 network management system at the same time. NE1 generates An alarm a, the result processing flow is as follows

Step 1: NE1 detects a fault and reports alarm a.

Step 2: DC1 analyzes alarm a, analyzes the cause and source of the alarm, finds that the sub-resource of alarm a is used by the service, discards alarm a according to the analysis result, derives alarm b, and then reports alarm b to the upper layer Controller SC1, and network management system EMS1.

Step 3: After EMS1 receives alarm a and alarm b, both alarm a and b are reported to upper network management OSS1.

Step 4: After SC1 receives the alarm b reported by DC1, it analyzes according to the cause and source of the alarm, and finds that the resource of alarm b becomes the logical object obj1 after being virtualized. They belong to the virtualized mapping relationship, and SC1 discards them. Alarm b generates alarm c. SC1 reports alarm c to app and OSS1 at the same time.

Step 5: The app receives the alarm notification and learns that the abstract object obj1 in its own business has an alarm c. For the purpose of troubleshooting, the app sends a request to OSS1 to query all alarms and related relationships.

Step 6: OSS1 queries the alarm association relationship from SC1, and obtains the association relationship between alarm b and alarm c.

Step 7: OSS1 queries the alarm association relationship from EMS1.

Step 8: EMS1 finds the relationship between alarm a and alarm b from DC1. Report to OSS1.

Step 9: OSS1 summarizes and obtains the association relationship of alarms a, b, and c, and reports to APP.

Step 10: The app gets all alarms a, b, c from the query response and knows that a is the root alarm. It is used to notify the operation and maintenance personnel to repair the device and troubleshoot the fault.

Obviously, those skilled in the art should understand that each module or each step of the above-mentioned present invention can be realized by a general-purpose computing device, and they can be concentrated on a single computing device, or distributed in a network formed by multiple computing devices Alternatively, they may be implemented in program code executable by a computing device so that they may be stored in a storage device to be executed by a computing device, and in some cases in an order different from that shown here The steps shown or described are carried out, or they are separately fabricated into individual integrated circuit modules, or multiple modules or steps among them are fabricated into a single integrated circuit module for implementation. As such, the present invention is not limited to any specific combination of hardware and software.

The above are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (13)

1. An alarm processing method, characterized in that, comprising: The controller receives an alarm from the network device; The controller analyzes the alarm to obtain an analysis result; The controller processes the alarm according to the analysis result. 2. The method according to claim 1, wherein the controller analyzes the alarm to obtain the analysis result including at least one of the following: According to the cause of the alarm that generates the alarm, analyze and obtain the analysis result of whether the alarm has an impact on the business managed by the controller; The analysis result of whether the alarm affects the service managed by the controller is obtained by analyzing the relationship between the resource generating the alarm and the resource occupied by the service managed by the controller. 3. The method according to claim 2, characterized in that, according to the relationship between the resources that generate the alarm and the resources occupied by the business managed by the controller, it is analyzed whether the alarm has an impact on the control The analysis result that affects the business managed by the server includes one of the following: If the root resource that generates the alarm is not occupied by the service managed by the controller, and no sub-resource corresponding to the root resource is occupied by the service managed by the controller, determine that the alarm is The business managed by the controller will not be affected; If the root resource that generates the alarm is not occupied by the service managed by the controller, but the sub-resource corresponding to the root resource is occupied by the service managed by the controller, determine that the alarm has a significant impact on the The said business managed by the controller has an impact; The root resource that generates the alarm is not occupied by the service managed by the controller, and the sub-resource corresponding to the root resource is not occupied by the service managed by the controller, but the root resource and/or the If there is a mapping relationship between the sub-resource corresponding to the root resource and the service managed by the controller, determine that the alarm has an impact on the service managed by the controller; If the root resource that generates the alarm is occupied by the service managed by the controller, it is determined that the alarm affects the service managed by the controller. 4. The method according to claim 3, wherein the processing of the alarm by the controller according to the analysis result includes one of the following: Suppressing the alarm when it is analyzed based on the cause of the alarm that the alarm has no impact on services managed by the controller; When it is determined according to the relationship between the resource generating the alarm and the resource occupied by the service managed by the controller that the alarm has no impact on the service managed by the controller, performing an alarm on the alarm inhibition; In the case that the root resource that generates the alarm is not occupied by the service managed by the controller, but the sub-resource corresponding to the root resource is occupied by the service managed by the controller, derive the alarm as a sub-resource Resource-derived alerts; The root resource that generates the alarm is not occupied by the service managed by the controller, and the sub-resource corresponding to the root resource is not occupied by the service managed by the controller, but the root resource and/or the If there is a mapping relationship between the sub-resource corresponding to the root resource and the service managed by the controller, deriving the alarm into a relationship-derived alarm according to the mapping relationship; When the root resource generating the alarm is occupied by the service managed by the controller, directly report the alarm to the upper-layer network device. 5. The method according to claim 4, further comprising: Recording the association relationship between the alarm and the derived alarm after derivation, wherein the derived alarm includes: a sub-resource derived alarm and/or a relationship derived alarm; Reporting the derived alarm and the association relationship to an upper-layer network device, and/or providing the association relationship for query by network element devices in the controller management system. 6. The method according to any one of claims 1 to 5, further comprising: after the controller processes the alarm according to the analysis result: generating a status notification of the network element device or the object representing the resource according to the state change of the network element device caused by the alarm, or the state change of the object representing the resource in the alarm; Reporting the generated status notification of the network element device or the object representing the resource to the upper layer network device. 7. An alarm processing device, characterized in that being applied to a controller includes: A receiving module, configured to receive an alarm from a network device; An analysis module, configured to analyze the alarm to obtain an analysis result; A processing module, configured to process the alarm according to the analysis result. 8. The device according to claim 7, wherein the analysis module comprises at least one of the following: The first analysis unit is configured to analyze and obtain the analysis result of whether the alarm has an impact on the business managed by the controller according to the cause of the alarm that generates the alarm; The second analysis unit is configured to analyze whether the alarm has an impact on the service managed by the controller according to the relationship between the resource generating the alarm and the resource occupied by the service managed by the controller of the analysis results. 9. The device according to claim 8, wherein the second analysis unit comprises one of the following: The first determining subunit is configured to: when the root resource generating the alarm is not occupied by the service managed by the controller, and no sub-resource corresponding to the root resource is occupied by the service managed by the controller case, determining that the alarm has no impact on the service managed by the controller; The second determining subunit is configured to: when the root resource generating the alarm is not occupied by the service managed by the controller, but the subresource corresponding to the root resource is occupied by the service managed by the controller , determining that the alarm has an impact on the service managed by the controller; The third determining subunit is configured to: when the root resource generating the alarm is not occupied by the service managed by the controller, and the subresource corresponding to the root resource is not occupied by the service managed by the controller, but If there is a mapping relationship between the root resource and/or the sub-resource corresponding to the root resource and the service managed by the controller, determine that the alarm has an impact on the service managed by the controller; The fourth determining subunit is configured to determine that the alarm has an impact on the service managed by the controller when the root resource generating the alarm is occupied by the service managed by the controller. 10. The device according to claim 9, wherein the processing module comprises one of the following: A first suppression unit, configured to suppress the alarm when it is analyzed according to the cause of the alarm that the alarm has no impact on the business managed by the controller; A second suppressing unit, configured to determine that the alarm does not affect the service managed by the controller according to the relationship between the resources that generate the alarm and the resources occupied by the service managed by the controller Next, suppress the alarm; The first derivation unit is configured to: when the root resource generating the alarm is not occupied by the service managed by the controller, but the sub-resource corresponding to the root resource is occupied by the service managed by the controller, deriving the alert as a sub-resource derived alert; The second derivation unit is configured to generate the alarm. The root resource is not occupied by the service managed by the controller, and the sub-resource corresponding to the root resource is not occupied by the service managed by the controller. If there is a mapping relationship between the root resource and/or the sub-resource corresponding to the root resource and the service managed by the controller, deriving the alarm into a relationship-derived alarm according to the mapping relationship; The first reporting unit is configured to directly report the alarm to an upper-layer network device when the root resource generating the alarm is occupied by a service managed by the controller. 11. The device according to claim 10, further comprising: The recording unit is configured to record the association relationship between the alarm and the derived alarm after derivative processing is performed on the alarm, wherein the derived alarm includes: a sub-resource derived alarm and/or a relationship derivation alarm; A second reporting unit, configured to report the derived alarm and the association relationship to an upper-layer network device, and/or a providing unit, configured to provide the association relationship for query by network element devices in the controller management system . 12. The device according to any one of claims 7 to 11, further comprising: A generating module, configured to generate a status notification of the network element device or the object representing the resource according to the state change of the network element device caused by the alarm, or the state change of the object representing the resource in the alarm; A reporting module, configured to report the generated status notification of the network element device or the object representing the resource to an upper-layer network device. 13. The device according to any one of claims 7 to 11, wherein the controller comprises at least one of the following: a domain controller DC, a super controller SC, wherein the SC is the DC upper controller.