JP3097058B2 - Communication network fault monitoring device - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention collects alarms generated from respective devices in a communication network, processes a plurality of alarms in association with each other, and monitors a failure of the communication network suitable for specifying a failure occurrence point. Regarding the device, particularly when one failure determination condition is satisfied, a subsequent alarm caused by the failure is
The present invention relates to a failure monitoring device for a communication network that is not added to failure determination of another assumed failure location.

[0002]

2. Description of the Related Art As a conventional failure monitoring device for a communication network,
For example, there is one proposed by the present applicant as Japanese Patent Application No. 4-44503 “failure monitoring device”. FIG. 2 shows a failure monitoring device proposed in the above application. In FIG. 1, reference numeral 1 denotes a service management node for inputting a customer's service specification definition and determining a deployment destination of a function for realizing the definition, 2 a service control node for performing call control of the service, and 3 a realization of the above-described service. A transmission network 4 composed of communication equipment or the like that provides element functions to perform the functions described above is an information transfer network between the above-mentioned nodes and the transmission network, and these constitute an intelligent network (communication network). Reference numeral 5 denotes a failure monitoring device that targets the above-described intelligent network for failure monitoring. The failure monitoring device 5 sends an error /
A communication control processing unit 6 for receiving a recovery alarm, an alarm classification processing unit 7 for classifying collected alarms for each supposed fault location, and a fault for determining whether a failure determination condition is satisfied for each supposed fault location A search processing unit 8, a service impact evaluation processing unit 9 for evaluating the degree of the influence of a failure for each service (not targeted in the present invention), and a measure procedure unit including an appropriate remedy execution procedure according to the evaluation result 1
0, and a database unit 11 for managing network configuration information. This conventional fault monitoring device classifies alarms collected from each device in a communication network for each assumed fault location so that even if a plurality of faults occur substantially simultaneously, it is possible to handle such faults. It is to determine in parallel whether a failure determination condition is satisfied for each failure location.

[0003]

According to the above-mentioned prior art, the collected alarms are classified by permitting duplication for each supposed fault location so that a plurality of faults can be dealt with almost simultaneously. Although it is possible to determine the satisfaction of the failure determination conditions in parallel, in reality, a plurality of alarms caused by one failure are used not only for the failure determination conditions for the correct assumed failure location, but also for the failure determination for other assumed failure locations. By taking this into account, there is a risk that the failure determination condition may be erroneously satisfied, and there is a problem that the processing does not operate only when a plurality of failures occur. The present invention solves the above problem, and when one failure determination condition is satisfied, a subsequent alarm caused by the failure is not added to the failure determination of another assumed failure location. It is intended to provide a failure monitoring device.

[0004]

SUMMARY OF THE INVENTION In order to achieve the above object, the present invention collects alarms from each device in a communication network, classifies them according to assumed failure locations, and assigns the alarms to any alarm group. A fault of a communication network having an alarm classification processing unit (7) for judging whether it belongs to and a fault search processing unit (8) composed of a plurality of fault judging means for judging a plurality of faults occurring substantially simultaneously in parallel is automatically detected. A failure monitoring device (5) for monitoring, when an alarm arrives, an identification means (12) for identifying whether or not the alarm is an alarm caused by a failure detected in advance; When the alarm is not an alarm caused by the detected failure, the alarm is notified to the failure search processing unit, and when the alarm is an alarm caused by the previously detected failure, the alarm is notified. It is characterized by a control means for controlling so as not to notify the serial fault search processing unit. Further, the failure search processing unit terminates the search for the suspected abnormal part if an alarm relating to each suspected abnormal part being searched in parallel does not newly arrive for a predetermined time (failure determination corresponding to the alarm group). Means for initializing the current state maintained by the means).

[0005]

In the fault monitoring device according to the present invention, the alarm classification processing unit classifies the collected alarms for each assumed fault location and determines which alarm group the alarm belongs to. The control means, if at least one of the determined alarm groups for which the failure determination condition has already been satisfied exists, determines the alarm to be a failure search processing unit (8).
For example, only the arrival log of the alarm is recorded in the storage unit (DB unit), and the process is terminated. On the other hand, when there is no alarm group that satisfies the failure determination condition, the failure notification means of the failure search processing unit (8) corresponding to each alarm group is notified of the arrival of the alarm. The failure determination means determines in parallel whether a failure determination condition is satisfied when the notification is received. here,
When one alarm belongs to a plurality of alarm groups, the failure determination means corresponding to each alarm group includes:
It is possible to operate in parallel, and even if one judging means judges a fault, the other fault judging means operating in parallel can continue the fault search while maintaining the current state, so that a plurality of faults can be Even if it occurs, you can deal with it without overlooking it.
However, in order to prevent erroneous establishment of the failure determination condition, if the failure determination is not established, the failure determination means corresponding to each alarm group sets a new alarm belonging to the alarm group during a certain time after the latest alarm arrival. If the alarm does not arrive, the current alarm is regarded as having no relation to the assumed failure location of the alarm group, and the current state maintained by the failure determination means corresponding to the alarm group is initialized.

[0006]

Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 shows an embodiment of a fault monitoring device according to the present invention and an intelligent network (communication network) to be monitored for the fault. The intelligent network includes service management nodes 1E and 1F for inputting a customer's service specification definition and determining where to deploy a function for realizing the definition, and service control nodes 2A, 2B, 2C and 2D for performing call control of the service. The information stored in each of the control nodes 2A, 2B, 2C, and 2D is also stored in another service control node, and is configured so that when a failure occurs, it can be quickly backed up by an external switching instruction.) , A communication network 3 comprising communication facilities for providing elemental functions for realizing the service
(In this embodiment, it is assumed that the transmission nodes are composed of transmission nodes 3G to 3J.) The information transfer network 4 between each of the above nodes and the transmission network (the exchanges in the transfer network are duplicated, and when one of the nodes fails, it is automatically The other is switched to the other.

Reference numeral 5 denotes a failure monitoring device which is a feature of the present invention, and a communication control processing unit 6 for transmitting / receiving an alarm or a command to / from each of the nodes and the transmission network, for classifying the alarm and extracting a suspected range. Alarm classification processing unit 7,
A failure search processing unit 8 for determining whether a failure determination condition is satisfied for each supposed failure location, a measure procedure unit 10 for performing an appropriate remedy according to the failure, and an alarm arrival log. An alarm DB (database) unit 11A for recording, a configuration DB unit 11B for managing network configuration information of a communication network to be monitored, and a failure DB for recording a failure location determined by the failure search processing unit Unit 11C, a measure DB unit 11D for recording the measures performed in the measure procedure unit, and a late arrival alarm identification process for identifying a late arrival alarm caused by a failure location already determined by the failure search processing unit It comprises a unit 12.
Here, the “late arrival alarm” is an alarm transmitted due to a certain cause of abnormality and arrives at the present failure monitoring device after the failure monitoring device detects the abnormality by another alarm. It means the alarm to be performed.

Next, the operation of the fault monitoring device 5 of the present invention in the system configured as described above will be described. In the following description, as an example, 13:18 on August 15, 1994
The communication device failure of the service control node 2A occurs every minute,
"Communication device error alarm" of service control node 2A
It is assumed that after the occurrence of the (alarm type number 42), the "communication error alarm for service control node" (alarm type number 28) from the service management node 1F arrives at the failure monitoring device with a delay of two minutes. First, the communication control processing unit 6
Is a device abnormality occurrence alarm (alarm information) of the service control node 2A itself transmitted by the service control node 2A.
Is received via the information transfer network 4.

The alarm information at this time is composed of time information, transmission source information, an alarm type number, and additional information (in the case of a device alarm, the communication destination node name is not stored) (see FIG. 10). An alarm information group stored in the alarm DB 11A is shown). As shown in FIG. 10, the alarm information does not store the communication destination node name in the case of “device alarm” and the additional information in the case of “communication alarm”. May or may not store the communication destination node name. For example, the communication destination node name is not stored in “communication error alarm for service management node (alarm type number 82)”. The communication destination node name in this case is obtained based on the “communication alarm correspondence table between the service management node and the service control node” in the configuration DB unit shown in FIG.

The communication control processing unit 6 extracts time information, an alarm type number, transmission source information, and additional information (not including a communication destination node name as described above) from the received alarm information, and performs an alarm classification process. Send to Part 7. The alarm classification processing unit 7 stores an alarm classification table as shown in FIG. 3 in which the correspondence between the alarm source, the alarm type number, and the determination condition ID of the failure determination processing is stored based on the extracted alarm type number and transmission source information. With reference to the information, the determination condition ID of the failure determination process to be started is extracted. In this case,
Since it is “communication device abnormality alarm” (alarm type number 42), 37
(Failure determination processing in which the assumed failure location is regarded as the communication device of the service control node) is extracted. The information (time information, alarm type number, transmission source information, additional information) and the determination condition ID (N pieces) extracted in this way are notified to the late arrival alarm identification processing unit 12.

Next, the processing operation of the late arrival alarm identification processing section 12 will be described with reference to FIG. The late arrival alarm identification processing unit 12 first finds the suspected abnormal node from the additional information and the transmission source information. In step 111 of FIG. 9, it is determined whether the alarm is a device alarm or a communication alarm. This determination is made based on the number of determination condition IDs received from the alarm classification processing unit 7. That is, when only one determination condition ID is received from the alarm classification processing unit 7, the device-related alarm is determined, and when a plurality of determination condition IDs are received, the communication-related alarm is determined. Usually, there are three suspected abnormal locations: a source node, an information transfer network, and a communication destination node). In the case of the device-related alarm as in the present embodiment (Step 111 in FIG. 9; YES), the node information of the transmission source is set as suspected abnormal node information (Step 112). For communication alarms,
This will be described when describing “communication error alarm for service control node” (alarm type number 28).

FIG. 4A shows the information of the suspected abnormal node in step 112, and the information of the currently continuing abnormal node, the assumed failure location, the abnormality detection time, and the determination condition ID of the failure determination processing are recorded in FIG. The failure DB unit 11C as shown is searched using the received determination condition ID = 37 of the failure determination processing as a key (step 113), and whether the alarm is a late arrival alarm of a detected failure is determined depending on whether there is a corresponding record. It is determined whether or not it is (step 114). In this embodiment, FIG. 4A shows the judgment condition ID =
Since there is no record corresponding to No. 37 and it is not a detected failure (NO in step 114), information on the alarm is stored in the alarm DB unit 11A (step 117).
At the same time, the failure search processing unit 8 is notified (step 116).

The failure search processing section 8 is provided with a failure determination means, and operates the failure determination means in parallel for each "determination condition ID" sent from the late arrival alarm identification processing section. Specifically, a work memory for each failure determination process is secured, and the work memory includes a failure determination condition table (non-rewritable) that can be uniformly applied to assumed failure locations (for each node type) as shown in FIG. , And a current state information maintenance table (updatable) required for failure determination for each suspected abnormal node as shown in FIG. According to the rules of the table shown in FIG. 5, first, the two conditions of the "alarm type to be noticed" = "communication device abnormality alarm" and "determination condition ID" = "37", which are the same as the arrived alarm, are keyed. Is selected, and the value to be added indicated in the “establishment condition addition value” of the selected record is “judgment condition ID” = “3” in the current state maintenance table shown in FIG.
7 "," suspicious abnormal node "=" service control node 2 "
A "(the node name obtained by the late arrival alarm identification processing unit 12) is selected, and the" establishment condition addition value "is added to the" current state value "in the current state information maintenance table,
The "last update time" is also updated to the time when the alarm arrives. The failure determination determines whether the “current state value” in the updated current state information maintenance table of FIG. 6 has reached the “establishment condition determination value” of the selected record in FIG. When the value of the "establishment condition determination value" is reached, it is determined that a failure has occurred. FIG.
If there is no corresponding record in the current state maintenance table shown in (1), a record in which the "current state value" is the value of the "satisfied condition addition value" is newly added. In addition, the current state information in which the “last update time” has passed a predetermined time is initialized (record deleted) by the initialization process that is periodically started. That is, in order to prevent erroneous establishment of the failure determination condition, when the failure determination condition is not satisfied, the failure determination means corresponding to each alarm group sets a new alarm belonging to the alarm group during a certain period of time after the latest alarm arrival. If no alarm arrives, it is assumed that the alarms so far have no relation to the fault location assumed by the alarm group, and the current state maintained by the failure determination means corresponding to the alarm group is initialized. .

In the case of this embodiment, the failure judgment condition of "judgment condition ID" = "37" is satisfied by the arrival of the alarm type number 42 "communication device abnormality alarm", so that the service control node 2A It is determined that the communication device has failed, and the failure DB unit 11C stores the failure as shown in FIG.
Information about the failure is added by one record. Also,
"Measures I" described in the "failure determination condition table" of FIG.
D "=" 135 "(meaning blockage in this embodiment)
According to the above, the action ID, the judgment condition ID,
A measure activation request is made by passing the abnormal node information. The measure procedure unit 10 performs the specified remedy in accordance with the measure ID of the measure activation request passed from the failure search processing unit 8,
The determination condition I is stored in the measure DB 11D as shown in FIG.
D, abnormal node information, measure ID, and measure execution time are additionally recorded (FIG. 7B). In FIG. 7B,
13:02, 5 minutes after the arrival of the “communications abnormality alarm”
An example in which the abnormal device is closed in three minutes is shown. Thus, a series of processes from the arrival of the “communication device abnormality alarm” to the implementation of the measure is completed.

On the other hand, the service management node 1F arrives at the failure monitoring device 5 at 13:20, two minutes after the "communication device abnormality alarm", the "communication abnormality alarm for service control node" (alarm type number 28). Is processed as follows. First, the communication control processing unit 6 receives the alarm information via the information transfer network 4. The communication control processing unit 6 sends the alarm type number, time information, and transmission source information to the alarm classification processing unit 7 in the same procedure as described above.
The alarm classification processing unit 7 refers to the alarm classification table shown in FIG.
8 and the fault condition determination process ID to be started by the alarm transmission source (service control node) 37 (described above) 52 (a fault determination process in which a supposed fault location is regarded as a communication device of the service management node) 74 (a supposed fault) A failure condition determination process ID for three failure determination processes, i.e., a failure determination process in which a part is regarded as an information transfer network, is extracted and notified to the late arrival alarm identification processing unit 12.

In the late arrival alarm identification processing unit 12, first,
A suspected abnormal node is obtained from the additional information and the transmission source information. In the case of a communication-type alarm as in this embodiment (Step 111 in FIG. 9; NO), if the additional information has information for identifying a communication partner, the information is used (Step 122). In the case of an alarm for which there is no information for identifying the other party, referring to the configuration DB unit 11B as shown in FIG.
Of a suspected abnormal node according to
3).

Here, FIG. 8 will be briefly described. FIG. 8 is an example of the configuration of a table in the configuration DB unit 11B representing the configuration of the intelligent network to be monitored for failure and an example of a record based on the present embodiment.
(A) is an alarm correspondence table communicated between the service management node and the service control node; (b) is an alarm correspondence table communicated between the service control node and the service control node; and (c) is a service control node to the transmission node. It is an alarm correspondence table communicated between. Main DB
The unit is provided to be used when the delayed arrival alarm identification processing unit 12 seeks a suspected abnormal node of a communication alarm. When there is a communication-related alarm, a pair of a communication source node name (communication destination node name) and a communication destination node name (communication source node name) is stored in a correspondence table relating to each. It is easy to determine the corresponding destination node name from the name. For example, it is used to obtain a destination node name of an alarm that does not have a communication destination node name in “alarm information”, such as “communication error alarm for service management node” (alarm type number 82).

In this embodiment, since the alarm information includes information for identifying the communication partner (the service control node 2A; see the lowermost row in FIG. 10) (step 121; YES), the "judgment condition ID" is set to "37". Service control node 2 according to
A, the service management node 1F is obtained in accordance with “determination condition ID” = “52” (step 122). Next, as shown in FIG. 4B, the abnormal node during which the abnormality is continuing, the assumed abnormal location, the abnormality detection time, and the determination condition ID of the failure determination process
Is stored in the failure DB unit 11 </ b> C in which “determination condition ID” =
A search is performed using “37”, “52”, and “74” as keys (step 113), and it is determined whether the alarm is a late arrival alarm of a detected failure (step 114). In the present embodiment, “judgment condition ID” = “37”, “52”
(Step 114; YE
S) Then, it is determined whether or not the abnormal node recorded in the record matches the suspected abnormal node indicated by the current reception alarm (step 118). In the present embodiment, since the abnormal node of the record corresponding to “judgment condition ID” = “37” represents the service control node 2A, it matches the suspected abnormal node (step 11).
8; YES).

Further, the above-mentioned measure DB 11D is searched for whether or not the measure for the failure has been implemented, using the judgment condition ID (37) and the abnormal node information (2A) as keys (step 119). In the case of this embodiment, at the time of arrival of the “communication error alarm for service control node” (alarm type number 28) (13:20 on August 15, 1994), measure D
The B section 11D is in the state shown in FIG. 7A, and no corresponding item is found, so that it is determined that the measure has not been performed (Step 120; NO). Therefore, the alarm is determined to be a late arrival alarm of the detected failure, and is not notified to the failure search processing unit 8 in the next stage, but is stored only in the alarm DB unit 11A (step 117). To end. FIG. 10 shows the data structure and record example of the alarm DB unit 11A at this time.

If there is a corresponding one in FIG. 7 (a), it is notified to the failure search processing unit 8 at the next stage (steps 115 and 116) and recorded in the alarm DB unit 11A. The following processes in the failure search processing unit 8 and the measure procedure unit 10 are performed in the same manner as described above. In order to facilitate understanding of the processing operation in each processing unit, interface signals between the processing units in the above-described processing are collectively shown in FIG. “N” in the figure is the number of matches when a plurality of “judgment condition IDs” are matched in the alarm classification processing unit by the arrival of one alarm. For example, in the case of the “communication abnormality alarm for service control node” (alarm type number 28) from the service management node 1F described above, “judgment condition ID” = “3”
"N" because "7", "52" and "74" match.
= "3".

The procedure for identifying a late arrival alarm when two alarms resulting from one failure have arrived has been described in detail with reference to FIG. The operation of the fault monitoring device according to the present invention is summarized as follows. First, the alarms are classified for each possible failure location, and when an alarm arrives, it is determined to which alarm group the alarm belongs. If at least one of the determined alarm groups has already satisfied the failure determination condition, only the arrival log of the alarm is recorded in the DB unit and the process is terminated. On the other hand, when there is no alarm group for which the failure determination condition is satisfied, the arrival of the alarm is notified to the failure determination means corresponding to each alarm group. The failure determination means determines in parallel whether a failure determination condition is satisfied when the notification is received. Here, when one alarm belongs to a plurality of alarm groups, the failure determination means corresponding to each alarm group can operate in parallel, and even if one determination means determines a failure, Since the other fault judging means operating in parallel can continue the fault search while maintaining the current state, even if a plurality of faults occur almost simultaneously, it is possible to cope with the fault without overlooking it. However, in order to prevent erroneous establishment of the failure determination condition, when the failure determination means is not established, the failure determination means corresponding to each alarm group sets a new alarm belonging to the alarm group during a certain time after the latest alarm arrival. If the alarm does not arrive, the current alarm is regarded as having no relation to the assumed failure location of the alarm group, and the current state maintained by the failure determination means corresponding to the alarm group is initialized.

[0022]

According to the present invention, when a failure determination condition for one failure location is satisfied, it is determined whether or not a subsequent collected alarm is an alarm caused by the failure, and an alarm caused by the failure is determined. If a new alarm does not arrive within a certain time after the arrival of the most recent alarm, the current state maintained by the failure determination means can be initialized. Since it is possible to prevent the erroneous establishment of the determination condition, it is possible to realize a failure monitoring device capable of performing a failure determination of a plurality of failure locations only when a plurality of failures occur at substantially the same time.
As a result, when one failure determination condition is satisfied,
Subsequent alarms resulting from the failure are not added to the failure determination of other supposed failure locations, and a remarkable operational effect can be obtained in that the failure determination condition is not erroneously satisfied.

[Brief description of the drawings]

FIG. 1 is a configuration example of a failure monitoring device of the present invention.

FIG. 2 is a configuration example of a conventional failure monitoring device.

FIG. 3 is a diagram showing a data structure and a record example of an alarm classification table maintained in an alarm classification processing unit 7;

FIG. 4 is a diagram illustrating a data structure and a record example of a failure DB unit 11C.

FIG. 5 is a diagram showing a data structure and a record example of a failure determination condition table maintained in a failure search processing unit 8;

FIG. 6 is a diagram showing a data structure and a record example of a current state information maintenance table maintained in a failure search processing unit 8;

FIG. 7 is a diagram showing a data structure and a record example of a measure DB unit 11D.

FIG. 8 is a diagram showing a data structure and a record example of a configuration DB unit 11B.

FIG. 9 is a diagram showing a processing algorithm of a late arrival alarm identification processing unit 12;

FIG. 10 is a diagram showing a data structure and an example of a record of an alarm DB unit 11A.

FIG. 11 is a diagram showing interface signals between processing units.

[Explanation of symbols]

1 (1E-1F): service management node, 2 (2A-2)
D): service control node, 3: transmission network, 4: information transfer network, 5: failure monitoring device, 6: communication control processing unit, 7: alarm classification processing unit, 8: failure search processing unit, 9: service influence degree Evaluation processing unit, 10: Measure procedure unit, 11: Database unit, 11A: Alarm database unit, 11B: Configuration database unit, 11C: Failure database unit, 11
D: Measure database section, 12: Late arrival alarm identification processing section

Claims (1)

(57) [Claims] 1. An alarm classification processing unit which collects alarms from respective devices in a communication network, classifies the alarms into possible failure locations, and determines which alarm group the alarms belong to. A fault monitoring device for automatically monitoring a fault in a communication network having a fault search processing unit comprising fault determining means for judging faults in parallel, wherein when an alarm arrives, an alarm caused by the fault detected in advance by the alarm is detected. Identification means for identifying whether or not the alarm is not an alarm resulting from the previously detected failure; and notifying the failure search processing unit of the alarm, and a control to control means so that the alarm does not notify the failure search processing section if it was an alarm due to the detected failure, the late of the failure search processing unit During the search in parallel judging means
Alarm related to each suspected abnormal location
Otherwise, the search for the suspected abnormal part is terminated.
And a means for monitoring the failure of the communication network .