CN1278516C - Treatment method of flash cut worning in network management system - Google Patents
Treatment method of flash cut worning in network management system Download PDFInfo
- Publication number
- CN1278516C CN1278516C CN 02117971 CN02117971A CN1278516C CN 1278516 C CN1278516 C CN 1278516C CN 02117971 CN02117971 CN 02117971 CN 02117971 A CN02117971 A CN 02117971A CN 1278516 C CN1278516 C CN 1278516C
- Authority
- CN
- China
- Prior art keywords
- alarm
- disconnected
- flash
- muscle
- time
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Lifetime
Links
Landscapes
- Emergency Alarm Devices (AREA)
- Alarm Systems (AREA)
Abstract
The present invention discloses a treatment method of flash cut warnings in network management systems. The method judges whether warnings have flash cut or not through frequency generated by the warnings; after the flash cut occurs, a first warning is reserved and is marked in the starting state of the flash cut; subsequent warnings are filtered; then, time intervals generated by the subsequent flash cut warnings are counted; when the time intervals are larger than preset flash cut end time and no new warning occurs, the method judges that the flash cut warnings are ended; the flash cut state of the flash cut warnings is modified as the end state of the flash cut. The present invention makes the number of treated warnings largely reduced in the correlation analysis of the warnings by specially treating and analyzing the flash cut warnings. Consequently, the analysis of the warnings is timely and accurate. The present invention can be used for rapidly positioning and eliminating the warnings, and enhances network management capability.
Description
Technical field
The processing method that the present invention relates to alarm in the network management system specifically, relates to the processing method of flash alarm in the network management system.
Background technology
Along with the continuous expansion of network size, alarm quantity is also more and more.Because professional characteristic easily produces a large amount of flash alarms on the transmission equipment, cause the blast of alarm quantity.Above-mentioned flash alarm is meant, the situation that repeatedly produces and finish appears in identical alarm in the short period of time; Identical alarm is meant that alarm identifier symbol (ID) is identical and occurs in alarm on the same channels.
The general alarm that all directly managed devices is reported of prior art is saved in database, have plenty of through behind the correlation analysis and be saved in database again, but all can't handle and discern for flash alarm at present, so that need to safeguard many alarm datas that do not have practical significance, not only reduced the processing speed of network management, and flooded important alarm, hindered failure location and recovery.
Summary of the invention
The object of the present invention is to provide the processing method of flash alarm in a kind of network management system,, strengthen the disposal ability of network management to filter flash alarm.
The present invention is achieved through the following technical solutions:
The processing method of flash alarm in a kind of network management system, this method may further comprise the steps at least:
A) network management center judges according to the frequency of identical alarm generation whether alarm begins to take place to dodge to break in the regular hour, if then keep first the alarm that flash alarm takes place, the sudden strain of a muscle off-state that this alarm is set disconnects primary state for dodging, to dodge and disconnect the beginning state and be stored in record alert database and alarm accordingly in the record, filter its follow-up identical alarm; Otherwise, buffer memory and counting are carried out in this alarm, return A), finish until this time period;
B) statistics has been in the time interval of dodging the follow-up identical alarm that disconnects primary state, whether judgement time reaches the predetermined disconnected concluding time threshold value of sudden strain of a muscle at interval, if the disconnected state of sudden strain of a muscle that this alarm then is set disconnectedly finishes attitude for dodging, otherwise returns B) handle next bar flash alarm record.
Wherein, described steps A further comprises:
A01) set in advance flash alarm information table, alarm statistics table and alarm time-delay buffer memory;
A02) network management center judges according to the flash alarm information table whether each bar alarm of being received is in the disconnected state that dodges, if not, then increase the count value of this alarm in the alarm statistics table, then execution in step A03); Otherwise revise the corresponding disconnected recorded information of sudden strain of a muscle of this alarm in the flash alarm information table, this alarm of filtering then, execution in step A04);
A03) judge whether the frequency that this alarm produces reaches the disconnected frequency of sudden strain of a muscle, if then the time-delay buffer memory is alarmed in scanning, keep first flash alarm, the disconnected state of the sudden strain of a muscle of alarm is set to dodge the disconnection primary state, and delete identical alarm, in the flash alarm information table, add the disconnected record of sudden strain of a muscle of this alarm then; Otherwise deposit alarm in alarm time-delay buffer memory;
A04) receive next alarm.
Wherein, described step B further comprises:
B01) scanning flash alarm information table dodges disconnected timing of writing down in its time information of increasing to each bar in the flash alarm information table;
B02) whether the time of judging above-mentioned timing reaches the predetermined disconnected concluding time threshold value of sudden strain of a muscle, then removes the disconnected record of this sudden strains of a muscle if reach from the flash alarm information table, and the disconnected state of the sudden strain of a muscle of alarm is set to dodge the end attitude of breaking, and carries out B03 again); Otherwise directly carry out B03);
B03) judge in the flash alarm information table that all dodge disconnected record and whether all dispose, if end process then, otherwise return step B01).
Further, described step B also comprises: scanning alarm time-delay buffer memory will reach the alarm deletion of delay time, and reduce the count value in the alarm statistics table.Steps A 02) the corresponding disconnected recorded information of sudden strain of a muscle of this alarm in the described modification flash alarm information table comprises that modification has been in the warning information in the disconnected record of sudden strain of a muscle of the alarm correspondence of dodging disconnected state, and its time information simultaneously resets.The described frequency that produces according to identical alarm judges whether alarm begins to dodge disconnected step and comprises, network management center judges whether the warning count value in the alarm statistics table disconnects the beginning threshold value greater than the sudden strain of a muscle of setting, if break greater than then taking place to dodge.Be set in the described flash alarm information table and preserve all and dodged disconnected warning information.Be set in the described alarm statistics table the identical alarm in the alarm time-delay buffer memory is counted.Be set in the described alarm time-delay buffer memory all are alarmed the time of buffer memory appointments.Described flash alarm information table comprises temporal information, the warning information that dodges disconnected record at least.It is identical to set alarm identifier symbol (ID), and the alarm that occurs on the same channels is identical alarm.
The present invention identifies flash alarm according to the generation frequency of alarm from minor alarm, the alarm that is received according to the alarm blink state processing in the flash alarm information table, disconnected alarm has been dodged in timing analysis, the flash alarm that filtering is follow-up, suppressed flash alarm to greatest extent, make the alarm number of in alarm correlation analysis, handling descend significantly, thereby make alert analysis more promptly and accurately, can faster location and remove alarm, and then improve the disposal ability and the speed of network management.
Description of drawings
Fig. 1 is a receiving alarm process chart of the present invention;
Fig. 2 is a timing analysis flow chart of the present invention.
Embodiment
For make purpose of the present invention, technical scheme, and advantage clearer, below with reference to the accompanying drawing embodiment that develops simultaneously, the present invention is described in more detail.
The processing of the whole flash alarm of the present invention comprises receiving alarm and two flow processs of timing analysis, it is identical by identifier (ID) is set, and the alarm that occurs on the same channels is identical alarm, and an alarm time-delay buffer memory, alarm statistics table and flash alarm information table are set realize analysis and filtration to flash alarm.Wherein, alarm time-delay buffer memory is used for guaranteeing that all alarms are all in time of buffer memory buffer memory appointment; The alarm statistics table then is used for the identical alarm of buffer memory is counted; The flash alarm information table then is used to preserve the information that flash alarm has taken place for all.
Referring to shown in Figure 1, Fig. 1 is a receiving alarm process chart of the present invention.To the alarm of newly being collected,, judge whether this alarm has been in the disconnected state of sudden strain of a muscle, promptly judges whether there is identical alarm in the flash alarm information table earlier according to the flash alarm information table.If be in the alarm of dodging disconnected state, the correspondence of then revising this alarm in the flash alarm information table is dodged the warning information of disconnected record, and its time information that resets abandons this alarm then with its timing time that resets; Otherwise, in the alarm statistics table, increase the counting of this alarm, and judge whether the count value of this alarm disconnects the threshold value that begins greater than sudden strain of a muscle, judge promptly whether the number of times that this alarm produces reaches the disconnected frequency of sudden strain of a muscle; If greater than, illustrate that then this alarm begins sudden strain of a muscle and breaks, at this moment scan alarm time-delay buffer memory, keep first alarm, to delete the identical alarm of this alarm, and be changed to sudden strain of a muscle disconnection primary state, this sudden strain of a muscle disconnection primary state is stored in record alert database and alarms in the record accordingly; In the flash alarm information table, increase the disconnected record of sudden strain of a muscle of this alarm again; If the count value of this alarm disconnects the beginning threshold value less than dodging, then this alarm is put into alarm time-delay buffer memory.
Referring to shown in Figure 2, Fig. 2 is a timing analysis flow chart of the present invention.Dodged disconnected alarm for differentiating for taking place, carry out timing analysis and handle.At first, execution in step 201, scanning alarm time-delay buffer memory will reach the alarm deletion of delay time, and revise the warning count value in the alarm statistics table, promptly reduce the counting in the alarm statistics table; Then, execution in step 202, scanning flash alarm information table dodges the disconnected timing time that writes down in its time information of increasing to each bar in the flash alarm information table, to add up the time interval that follow-up alarm produces; Execution in step 203, judging whether timing time reaches the disconnected concluding time threshold value of predetermined sudden strain of a muscle and do not have new alarm produces, if execution in step 204 then, judge that this dodges the corresponding alarm blink of disconnected record and finishes, from the flash alarm information table, remove the disconnected record of the corresponding sudden strain of a muscle of this alarm, and the alarm of correspondence is set to dodge the disconnected attitude that finishes, and the disconnected end of this sudden strains of a muscle attitude is stored in record alert database and alarms in the record accordingly; Otherwise execution in step 205 judges whether the disconnected record of sudden strains of a muscle all in the flash alarm information table disposes, if stop timing analysis process then, otherwise return execution in step 202.
The present invention is not limited to the concrete introduction of the foregoing description.The present invention can further upgrade, and perhaps new in addition to feature disclosed in this invention combination also can be upgraded or newly makes up any method disclosed in this invention or process.
Claims (11)
1, the processing method of flash alarm in a kind of network management system is characterized in that this method may further comprise the steps at least:
A) network management center judges according to the frequency of identical alarm generation whether alarm begins to take place to dodge to break in the regular hour, if then keep first the alarm that flash alarm takes place, the sudden strain of a muscle off-state that this alarm is set disconnects primary state for dodging, to dodge and disconnect the beginning state and be stored in record alert database and alarm accordingly in the record, filter its follow-up identical alarm; Otherwise, buffer memory and counting are carried out in this alarm, return A), finish until this time period;
B) statistics has been in the time interval of dodging the follow-up identical alarm that disconnects primary state, whether judgement time reaches the predetermined disconnected concluding time threshold value of sudden strain of a muscle at interval, if the disconnected state of sudden strain of a muscle that this alarm then is set disconnectedly finishes attitude for dodging, otherwise returns B) handle next bar flash alarm record.
2, processing method according to claim 1 is characterized in that, described steps A further comprises:
A01) set in advance flash alarm information table, alarm statistics table and alarm time-delay buffer memory;
A02) network management center judges according to the flash alarm information table whether each bar alarm of being received is in the disconnected state that dodges, if not, then increase the count value of this alarm in the alarm statistics table, then execution in step A03); Otherwise revise the corresponding disconnected recorded information of sudden strain of a muscle of this alarm in the flash alarm information table, this alarm of filtering then, execution in step A04);
A03) judge whether the frequency that this alarm produces reaches the disconnected frequency of sudden strain of a muscle, if then the time-delay buffer memory is alarmed in scanning, keep first flash alarm, the disconnected state of the sudden strain of a muscle of alarm is set to dodge the disconnection primary state, and delete identical alarm, in the flash alarm information table, add the disconnected record of sudden strain of a muscle of this alarm then; Otherwise deposit alarm in alarm time-delay buffer memory;
A04) receive next alarm.
3, processing method according to claim 1 is characterized in that, described step B further comprises:
B01) scanning flash alarm information table dodges disconnected timing of writing down in its time information of increasing to each bar in the flash alarm information table;
B02) whether the time of judging above-mentioned timing reaches the predetermined disconnected concluding time threshold value of sudden strain of a muscle, disconnectedly removes to remove the alarming information table the disconnected record of this sudden strains of a muscle if reach then from dodging, and the disconnected state of the sudden strain of a muscle of alarm is set to dodge the end attitude of breaking, and carries out B03 again); Otherwise directly carry out B03);
B03) judge in the flash alarm information table that all dodge disconnected record and whether all dispose, if end process then, otherwise return step B01).
4, according to claim 1 or 3 described processing methods, it is characterized in that described step B further comprises: scanning alarm time-delay buffer memory will reach the alarm deletion of delay time, and reduce the count value in the alarm statistics table.
5, processing method according to claim 2, it is characterized in that, steps A 02) the corresponding disconnected recorded information of sudden strain of a muscle of this alarm in the described modification flash alarm information table comprises that modification has been in the warning information in the disconnected record of sudden strain of a muscle of the alarm correspondence of dodging disconnected state, and its time information simultaneously resets.
6, processing method according to claim 1 and 2, it is characterized in that, the described frequency that produces according to identical alarm judges whether alarm begins to dodge disconnected step and comprise, network management center judges that whether the warning count value in the alarm statistics table disconnects the beginning threshold value greater than the sudden strain of a muscle of setting, if disconnected greater than then taking place to dodge.
7, processing method according to claim 2 is characterized in that, is set in the described flash alarm information table to preserve all and dodged disconnected warning information.
8, processing method according to claim 2 is characterized in that, is set in the described alarm statistics table the identical alarm in the alarm time-delay buffer memory is counted.
9, processing method according to claim 2 is characterized in that, is set in the described alarm time-delay buffer memory all are alarmed the time of buffer memory appointments.
According to claim 2,3 or 7 described processing methods, it is characterized in that 10, described flash alarm information table comprises temporal information, the warning information that dodges disconnected record at least.
11, processing method according to claim 1 is characterized in that, it is identical to set alarm identifier symbol (ID), and the alarm that occurs on the same channels is identical alarm.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 02117971 CN1278516C (en) | 2002-05-27 | 2002-05-27 | Treatment method of flash cut worning in network management system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 02117971 CN1278516C (en) | 2002-05-27 | 2002-05-27 | Treatment method of flash cut worning in network management system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN1462130A CN1462130A (en) | 2003-12-17 |
| CN1278516C true CN1278516C (en) | 2006-10-04 |
Family
ID=29742426
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN 02117971 Expired - Lifetime CN1278516C (en) | 2002-05-27 | 2002-05-27 | Treatment method of flash cut worning in network management system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN1278516C (en) |
Families Citing this family (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN100426896C (en) * | 2004-03-16 | 2008-10-15 | 华为技术有限公司 | Method for judging broken link of Link Access Procedure on D-channel (LAPD) |
| CN100461688C (en) * | 2004-10-11 | 2009-02-11 | 华为技术有限公司 | Method for treating alarm message |
| CN100417085C (en) * | 2005-04-08 | 2008-09-03 | 华为技术有限公司 | Prompt tone playing method in network management system |
| CN100458859C (en) * | 2005-05-31 | 2009-02-04 | 华为技术有限公司 | Method for processing alarm information |
| CN100433647C (en) * | 2005-10-20 | 2008-11-12 | 华为技术有限公司 | Warning managing method and system |
| CN101917296B (en) * | 2006-01-27 | 2012-08-15 | 华为技术有限公司 | Alarm system and network manager |
| CN101009586B (en) * | 2006-01-27 | 2010-09-08 | 华为技术有限公司 | Processing method for alarm filtering condition in the alarming system |
| CN101098349B (en) * | 2006-06-27 | 2010-05-12 | 中兴通讯股份有限公司 | Warning count filtering method between network manager system and network element management system |
| CN101102217B (en) * | 2006-07-07 | 2010-06-09 | 中兴通讯股份有限公司 | Processing method for duplicate alert and discontinuous reporting and monitoring in telecom network management system |
| CN101247254B (en) * | 2007-02-16 | 2010-11-03 | 大唐移动通信设备有限公司 | Method and device for suppression alarm windstorm |
| CN101267473B (en) * | 2007-03-16 | 2010-12-08 | 中兴通讯股份有限公司 | A processing method for surge alarm |
| CN101141292B (en) * | 2007-05-22 | 2010-12-08 | 中兴通讯股份有限公司 | Method of implementing alarm automatic refreshment in network management system |
| CN101446914B (en) * | 2007-11-26 | 2011-01-19 | 阿里巴巴集团控股有限公司 | Database monitoring method and device |
| CN101547113B (en) * | 2008-03-27 | 2011-10-26 | 中兴通讯股份有限公司 | System, device and method for filtering warning information |
| CN101860450B (en) * | 2010-03-29 | 2014-11-05 | 中兴通讯股份有限公司 | Method and device for querying alarm |
| CN104159130A (en) * | 2014-08-18 | 2014-11-19 | 成都北相赛勃科技有限公司 | Distributed multimedia recreation equipment, emergency alarm system and method |
| CN105357032A (en) * | 2015-10-14 | 2016-02-24 | 烽火通信科技股份有限公司 | Method for combining history warning quantities of oscillation flash warnings |
| CN107181604B (en) * | 2016-03-09 | 2020-06-02 | 华为技术有限公司 | Generation method of alarm association rule, alarm compression method and device |
| CN111555917A (en) * | 2020-04-26 | 2020-08-18 | 四川爱创科技有限公司 | Alarm information processing method and device based on cloud platform |
| CN114430562B (en) * | 2022-02-10 | 2023-08-08 | 中盈优创资讯科技有限公司 | Method and device for clearing 5G alarm in real time and clearing delay |
-
2002
- 2002-05-27 CN CN 02117971 patent/CN1278516C/en not_active Expired - Lifetime
Also Published As
| Publication number | Publication date |
|---|---|
| CN1462130A (en) | 2003-12-17 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN1278516C (en) | Treatment method of flash cut worning in network management system | |
| US7248681B2 (en) | System and method for real-time fraud detection within a telecommunication network | |
| CN101282340B (en) | Method and apparatus for processing network attack | |
| CN102263670A (en) | Alarm message reporting and processing method and device | |
| CN102625349A (en) | Method for processing data under alarm storm | |
| WO2007067549A2 (en) | Method and system for real time detection of threats in high volume data streams | |
| CN114124478B (en) | Method and system for detecting abnormal industrial control flow of power system | |
| CN1477509A (en) | Process automatic restoring method | |
| CN108320255A (en) | A kind of information processing method and device | |
| CN110177031B (en) | SDN network-based data monitoring control system and monitoring control method thereof | |
| CN110806924B (en) | Network processing method and device based on CPU occupancy rate | |
| CN109309577A (en) | Alert processing method, apparatus and system for SDN network | |
| CN102201927A (en) | Alarm information processing method and device | |
| CN113010367A (en) | Monitoring method and monitoring system for JAVA process garbage recovery | |
| CN116800691A (en) | Cache data segmentation processing method, system and storage medium | |
| CN101465041A (en) | Method for automatically shielding frequent alarm | |
| CN110988584A (en) | Intelligent monitoring and automatic control system for electric power system | |
| CN113596050B (en) | Abnormal flow separation and filtration method, system, storage medium and electronic equipment | |
| CN104284164A (en) | Intelligent security and protection monitoring system | |
| CN114338346A (en) | Alarm message processing method and device and electronic equipment | |
| CN114253819A (en) | User operation monitoring method and device and related equipment | |
| CN210405509U (en) | Efficient community security center | |
| CN112839075A (en) | Data transmission method applied to acquisition equipment and related device | |
| CN114244584B (en) | Method and device for realizing automatic suppression and protection based on network equipment log | |
| CN114513626A (en) | Multimedia playing method and device, electronic equipment and computer readable storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CX01 | Expiry of patent term |
Granted publication date: 20061004 |
|
| CX01 | Expiry of patent term |