WO2009033391A1

WO2009033391A1 - Method, managing equipment, managed equipment and system for controlling alarm flow

Info

Publication number: WO2009033391A1
Application number: PCT/CN2008/072101
Authority: WO
Inventors: Youyu Jiang; Yixin Chen
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-09-04
Filing date: 2008-08-22
Publication date: 2009-03-19
Also published as: CN101114945B; CN101114945A

Abstract

A method for controlling the alarm flow is provided, and the method first uses a managing equipment to inform a managed equipment of the alarm processing ability of the managing equipment, and then the managed equipment submits the alarm to the managing equipment by adopting the corresponding alarm flow according to the alarm processing ability of the managing equipment. A managing equipment, managed equipment and system for controlling the alarm flow are also provided.

Description

控制告警流量的方法、管理设备、被管设备和*** 技术领域 Method for controlling alarm traffic, management device, managed device and system

本发明涉及网络管理技术，特别涉及控制告警流量的方法、管理设备、被管设备和***。 The present invention relates to network management technologies, and in particular, to a method, a management device, a managed device, and a system for controlling alarm traffic.

背景技术 Background technique

世界信息化的浪潮促使电信技术飞速发展，新型的交换技术、传输技术层出不穷。经过几十年的不断发展，电信网络的规模越来越大，网络管理的复杂程度也越来越高，如何实现科学高效的电信网络管理，确保向用户提供高质量的服务，成为全球通信服务商的一个重要课题。 The wave of informationization in the world has promoted the rapid development of telecommunications technology, and new types of switching technologies and transmission technologies have emerged one after another. After decades of continuous development, the scale of telecommunication networks is getting larger and larger, and the complexity of network management is getting higher and higher. How to realize scientific and efficient telecommunication network management, ensuring high-quality services to users and becoming a global communication service An important topic for business.

故障管理是网络管理的主要功能之一，网络管理***承担着接收设备故障告警，分析之后将告警信息展示给用户的任务，以使用户能够及时地了解设备的故障状态。运营商为了保证业务的正常，要求第一时间得知设备所出现的故障，然后迅速地排除故障，才能保证为客户提供高质量的服务。 Fault management is one of the main functions of network management. The network management system assumes the fault of the receiving device and displays the alarm information to the user after analysis, so that the user can know the fault status of the device in time. In order to ensure the normal operation of the service, the operator needs to know the fault of the equipment at the first time and then quickly eliminate the fault to ensure the high quality service for the customer.

当前，通信网络的规模都十分庞大，网络结构也很复杂。通常，少数网络设备出现的故障，网管***都能正常地处理。但是如果网络中的多个设备同时出现故障，例如网络中的关键链路出现故障时，众多设备将同时向网管 ***发出告警，众多的告警将超出网管***的处理能力，这种现象被形象地称为网络告警风暴。 At present, the scale of communication networks is very large, and the network structure is also very complicated. Usually, the faults of a few network devices can be handled normally by the network management system. However, if multiple devices in the network fail at the same time, for example, when a critical link in the network fails, many devices will simultaneously send an alarm to the network management system. Many alarms will exceed the processing capacity of the network management system. This phenomenon is visually It is called a network alarm storm.

现有技术中存在两种处理网络告警风暴的方案，下面分别予以介绍：第一种方案：在网络告警风暴发生时进行告警抑制，具体包括以下步骤： In the prior art, there are two schemes for handling network alarm storms, which are respectively described below. The first scheme: Performing alarm suppression when a network alarm storm occurs, specifically including the following steps:

1、丟弃无法处理的告警，保证网管***的正常运行，同时生成新的告警，以提示用户：由于出现了网络告警风暴，导致告警数据丟失； 1. Discard the alarms that cannot be processed to ensure the normal operation of the network management system and generate new alarms to prompt the user: The alarm data is lost due to the network alarm storm.

2、用户通过网管***提供的告警同步功能，与设备进行告警同步，以找回丟失的告警数据；或，在告警风暴结束后，网管***自动与设备进行告警同步。在实现本发明的过程中，发明人发现，现有技术中至少存在以下技术问题： 2. The user synchronizes with the device through the alarm synchronization function provided by the network management system to retrieve the lost alarm data. Or, after the alarm storm ends, the network management system automatically synchronizes alarms with the device. In the process of implementing the present invention, the inventors have found that at least the following technical problems exist in the prior art:

该方案中，由于网管***丟弃了告警数据，导致用户无法及时获知设备所出现的故障，从而不能及时排除故障，进而影响正常业务的提供。而且，丟弃的告警数据需要进行告警同步才能找回，这又可能引发新的网络告警风暴，导致出现死循环。 In this solution, because the network management system discards the alarm data, the user cannot know the faults in the device in time, so that the fault cannot be eliminated in time, which may affect the provision of normal services. Moreover, the discarded alarm data needs to be synchronized to retrieve the alarm, which may trigger a new network alarm storm, resulting in an infinite loop.

第二种方案：预先进行告警屏蔽，以减少设备上报的告警。该方案所屏蔽的告警通常是频繁发生告警的设备所产生的告警，或不需要关注的告警。 The second solution: The alarm is masked in advance to reduce the alarms reported by the device. The alarms that are shielded by the solution are usually alarms generated by devices that frequently generate alarms, or alarms that do not require attention.

在实现本发明的过程中，发明人发现，现有技术中至少存在以下技术问题： In the process of implementing the present invention, the inventors have found that at least the following technical problems exist in the prior art:

通过告警屏蔽来解决网络告警风暴，存在如下缺点： The alarm is used to solve the network alarm storm. The following disadvantages exist:

1、由于告警屏蔽之后，设备将不再上报被屏蔽的告警，因此，只能屏蔽不需要处理的告警，而不能屏蔽需要处理的告警；但实际上，很可能是这些需要处理的告警导致了网络告警风暴的发生。 1. After the alarm is masked, the device will not report the blocked alarm. Therefore, only the alarms that need not be processed can be blocked, but the alarms that need to be processed cannot be blocked. However, it is likely that these alarms need to be processed. The occurrence of a network alarm storm.

2、单个设备出现告警并不会引发网络告警风暴，引发网络告警风暴的主要原因是网络中的众多设备同时出现告警，而哪些设备出现哪些告警是无法预知的，所以，通过告警屏蔽只能减少出现网络风暴的概率，不能从根本上避免网络风暴的出现。 2. The alarm of a single device does not cause a network alarm storm. The main cause of the network alarm storm is that many devices on the network have alarms at the same time, and which devices have alarms that are unpredictable. Therefore, the alarm mask can only be reduced. The probability of a network storm cannot fundamentally avoid the occurrence of network storms.

由上述分析可见，现有处理网络告警风暴的方案均不能很有效地控制告警流量，并且，在处理过程中还将导致告警数据的丟失。 It can be seen from the above analysis that the existing solutions for handling network alarm storms cannot effectively control the alarm traffic, and the alarm data will be lost during the processing.

发明内容 Summary of the invention

本发明实施例提供一种控制告警流量的方法，以有效地控制告警流量，并解决网络告警风暴的问题。 Embodiments of the present invention provide a method for controlling alarm traffic to effectively control alarm traffic and solve the problem of network alarm storm.

本发明实施例还提供一种控制告警流量的管理设备，以有效地控制告警流量，并解决网络告警风暴的问题。 The embodiment of the invention further provides a management device for controlling alarm traffic, so as to effectively control alarm traffic and solve the problem of network alarm storm.

本发明实施例还提供一种控制告警流量的被管设备，以有效地控制告警流量，并解决网络告警风暴的问题。 The embodiment of the invention further provides a managed device for controlling alarm traffic to effectively control an alarm. Traffic, and solve the problem of network alarm storms.

本发明实施例还提供一种控制告警流量的***，以有效地控制告警流量，并解决网络告警风暴的问题。 The embodiment of the invention further provides a system for controlling alarm traffic to effectively control alarm traffic and solve the problem of network alarm storm.

为达到上述目的，本发明实施例的技术方案具体是这样实现的：一种控制告警流量的方法，包括： To achieve the above objective, the technical solution of the embodiment of the present invention is specifically implemented as follows: A method for controlling alarm traffic, including:

管理设备将自身告警处理能力通知被管设备； The management device notifies the managed device of its own alarm processing capability;

管理设备接收被管设备上报的告警，所述告警是由被管设备根据管理设备的告警处理能力，釆用相应的告警流量向管理设备上报的。 The management device receives the alarm reported by the managed device, and the alarm is reported by the managed device according to the alarm processing capability of the management device, and is reported to the management device by using the corresponding alarm traffic.

本发明实施例忠还提供了另一种控制告警流量的方法，包括： The embodiment of the present invention further provides another method for controlling alarm traffic, including:

被管设备获取管理设备当前的告警处理能力； The managed device acquires the current alarm processing capability of the management device;

被管设备根据管理设备当前的告警处理能力，釆用相应的告警流量向管理设备上报告警。 The managed device reports the alarm to the management device based on the current alarm processing capability of the management device.

一种控制告警流量的管理设备，包括： A management device for controlling alarm traffic, including:

第一流量控制模块，用于确定所述管理设备当前的告警处理能力，并将所述告警处理能力通知被管设备； a first flow control module, configured to determine a current alarm processing capability of the management device, and notify the managed device of the alarm processing capability;

告警接收模块，用于接收被管设备上报的告警，所述告警是由被管设备根据管理设备当前的告警处理能力，釆用相应的告警流量向管理设备上报的。 The alarm receiving module is configured to receive an alarm reported by the managed device, where the alarm is reported by the managed device to the management device according to the current alarm processing capability of the management device.

一种控制告警流量的被管设备，包括： A managed device that controls alarm traffic, including:

第二流量控制模块，用于获取管理设备当前的告警处理能力，并根据所述管理设备当前的告警处理能力，确定相应的告警流量； a second flow control module, configured to acquire a current alarm processing capability of the management device, and determine a corresponding alarm traffic according to the current alarm processing capability of the management device;

告警上报模块，用于以所述告警流量向管理设备上报告警。 The alarm reporting module is configured to report an alarm to the management device by using the alarm traffic.

一种控制告警流量的***，包括本发明实施例所述管理设备和被管设备。由上述技术方案可见，本发明实施例所公开的控制告警流量的方法中，通过管理设备将自身的告警处理能力通知被管设备，并由被管设备根据管理设备的告警处理能力，动态地控制被管设备向管理设备上报告警的流量，从而根据管理设备当前的处理能力对被管设备上报的告警流量实现了有效的控制，避免了网络告警风暴的发生，并解决了网络告警风暴的问题。在本发明实施例所公开的控制告警流量的管理设备中，通过增加第一流量控制模块，并由第一流量控制模块确定该管理设备的告警处理能力，进而将该告警处理能力及时通知被管设备，实现了根据管理设备的告警处理能力控制被管设备上报告警的流量，避免了网络告警风暴的发生，并解决了网络告警风暴的问题。 A system for controlling alarm traffic includes the management device and the managed device according to the embodiment of the present invention. According to the foregoing technical solution, in the method for controlling alarm traffic disclosed in the embodiment of the present invention, the management device notifies the managed device of the alarm processing capability, and the managed device dynamically controls according to the alarm processing capability of the management device. The managed device reports the alarm traffic to the management device, so that the alarm traffic reported by the managed device is effectively controlled according to the current processing capability of the management device. The system avoids the occurrence of network alarm storms and solves the problem of network alarm storms. In the management device for controlling the alarm traffic disclosed in the embodiment of the present invention, the first flow control module is added, and the first flow control module determines the alarm processing capability of the management device, and then the alarm processing capability is notified in time. The device implements the alarm processing capability of the management device to control the alarm traffic on the managed device, avoids the occurrence of the network alarm storm, and solves the problem of the network alarm storm.

并且，在本发明实施例所公开的控制告警流量的被管设备中，通过第二流量控制模块及时地获取管理设备当前的告警处理能力，并由第二流量控制模块根据管理设备的告警处理能力，通知告警上报模块以与所述告警处理能力相应的告警流量上报告警，实现了根据管理设备的告警处理能力控制告警流量，避免了网络告警风暴的发生，并解决了网络告警风暴的问题。 In addition, in the managed device that controls the alarm traffic disclosed in the embodiment of the present invention, the second traffic control module acquires the current alarm processing capability of the management device in time, and the second flow control module performs the alarm processing capability according to the management device. The notification alarm reporting module reports the alarm on the alarm traffic corresponding to the alarm processing capability, and implements the alarm traffic according to the alarm processing capability of the management device, avoids the occurrence of the network alarm storm, and solves the problem of the network alarm storm.

此外，本发明实施例所公开的控制告警流量的***中，釆用本发明实施例所公开的管理设备和被管设备组成了一种能够根据管理设备的告警处理能力，控制被管设备上报告警的流量的网络管理***，有效地控制了告警流量，避免了网络告警风暴的发生，并解决了网络告警风暴的问题。 In addition, in the system for controlling alarm traffic disclosed in the embodiments of the present invention, the management device and the managed device disclosed in the embodiments of the present invention constitute a type of device capable of controlling the report on the managed device according to the alarm processing capability of the management device. The network management system of the police traffic effectively controls the alarm traffic, avoids the occurrence of network alarm storms, and solves the problem of network alarm storms.

附图说明 DRAWINGS

图 1为本发明实施例中控制告警流量方法的流程示意图。 FIG. 1 is a schematic flowchart of a method for controlling alarm traffic according to an embodiment of the present invention.

图 2 为本发明一较佳实施例中告警上报方式随告警处理状态变化的示意图。 FIG. 2 is a schematic diagram of a manner in which an alarm reporting manner changes with an alarm processing state according to a preferred embodiment of the present invention.

图 3为现有网络管理层次模型示意图。 Figure 3 is a schematic diagram of an existing network management hierarchy model.

图 4为现有网络管理层次模型的一个较佳实例示意图。 FIG. 4 is a schematic diagram of a preferred example of an existing network management hierarchy model.

图 5为本发明实施例中控制告警流量的管理设备的组成结构示意图。图 6为本发明实施例中控制告警流量的被管设备的组成结构示意图。图 7为本发明一较佳实施例中控制告警流量的***的组成结构示意图。图 8为本发明另一较佳实施例中控制告警流量的***的组成结构示意图。具体实施方式为使本发明的目的、技术方案及优点更加清楚明白，以下参照附图并举实施例，对本发明作进一步详细说明。 FIG. 5 is a schematic structural diagram of a structure of a management device for controlling alarm traffic according to an embodiment of the present invention. FIG. 6 is a schematic structural diagram of a managed device for controlling alarm traffic according to an embodiment of the present invention. FIG. 7 is a schematic structural diagram of a system for controlling alarm traffic according to a preferred embodiment of the present invention. FIG. 8 is a schematic structural diagram of a system for controlling alarm traffic according to another preferred embodiment of the present invention. detailed description The present invention will be further described in detail below with reference to the accompanying drawings.

图 1为本发明实施例中控制告警流量方法的流程示意图。参见图 1 , 该方法包括以下步骤： FIG. 1 is a schematic flowchart of a method for controlling alarm traffic according to an embodiment of the present invention. Referring to Figure 1, the method includes the following steps:

步骤 101 : 管理设备将自身告警处理能力通知被管设备； Step 101: The management device notifies the managed device of its own alarm processing capability;

步骤 102: 被管设备根据管理设备的告警处理能力，釆用相应的告警流量向管理设备上报告警。 Step 102: The managed device reports the alarm to the management device according to the alarm processing capability of the management device.

至此，结束本实施例中控制告警流量方法的流程。 So far, the flow of the method for controlling the alarm flow in this embodiment is ended.

本发明实施例中，引入了 "告警处理能力" 这一概念。具体而言：告警处理能力是根据管理设备当前正在处理的告警流量、管理设备所能够处理的最大告警流量等因素确定的，它能够实时地反映管理设备当前处理告警的能力。 In the embodiment of the present invention, the concept of "alarm processing capability" is introduced. Specifically, the alarm processing capability is determined according to factors such as the alarm traffic currently being processed by the management device and the maximum alarm traffic that the management device can handle. It can reflect the ability of the management device to process alarms in real time.

本发明实施例中，管理设备可以釆取如下两种方式将其自身的告警处理能力通知被管设备： In the embodiment of the present invention, the management device may notify the managed device of its own alarm processing capability by using the following two methods:

第一种方式：管理设备将其自身当前的告警处理能力直接发送给被管设备。 The first way: The management device sends its own current alarm processing capability directly to the managed device.

第二种方式：管理设备预先在被管设备上为所述管理设备当前的告警处理能力设置相应的管理接口；然后由管理设备以自身当前的告警处理能力实时地或周期性地更新所述管理接口；这样，被管设备就可以从所述管理接口获取管理设备当前的告警处理能力。 The second mode: the management device sets a corresponding management interface for the current alarm processing capability of the management device on the managed device in advance; and then the management device updates the management in real time or periodically with its current alarm processing capability. The interface can obtain the current alarm processing capability of the management device from the management interface.

在上述第二种方式中，所述管理接口可以根据管理设备与被管设备之间所釆用的协议来设置。例如，若管理设备与被管设备之间釆用简单网络管理协议（SNMP ), 则较佳地，可以为管理设备的告警处理能力定义相应的管理信息库（MIB )节点作为所述管理接口。 In the second mode described above, the management interface may be set according to a protocol used between the management device and the managed device. For example, if a simple network management protocol (SNMP) is used between the management device and the managed device, preferably, a corresponding management information base (MIB) node may be defined as the management interface for the alarm processing capability of the management device.

基于上述两种方式，管理设备可以釆取多种不同的形式将其自身当前的告警处理能力通知被管设备，下面分别予以介绍：第一种形式：管理设备将其自身当前正在处理的告警流量通知被管设备。这种情况下，被管设备通常需要预先获知管理设备所能够处理的最大告警流量，这样才能确定管理设备当前的告警处理能力。 Based on the above two methods, the management device can notify the managed device of its current alarm processing capability in a variety of different forms. The first form: The management device notifies the managed device of the alert traffic it is currently processing. In this case, the managed device usually needs to know in advance the maximum alarm traffic that the management device can handle, so as to determine the current alarm processing capability of the management device.

第二种形式：管理设备将其自身当前正在处理的告警流量与管理设备所能够处理的最大告警流量的比值通知被管设备。 The second form: The management device notifies the managed device of the ratio of the alarm traffic it is currently processing to the maximum alarm traffic that the management device can handle.

第三种形式：管理设备将其自身当前的告警处理状态通知被管设备。通常，所述告警处理状态是根据管理设备当前正在处理的告警流量与管理设备所能够处理的最大告警流量的比值确定的。 The third form: The management device notifies the managed device of its current alarm processing status. Generally, the alarm processing status is determined according to the ratio of the alarm traffic currently being processed by the management device to the maximum alarm traffic that the management device can handle.

当釆取上述第一种和第二种形式时，即：当釆取管理设备当前正在处理的告警流量与管理设备所能够处理的最大告警流量的比值，来表征管理设备当前的告警处理能力时，可以在被管设备上设置比值范围与告警流量的对应关系，被管设备直接根据管理设备所通知的比值来确定釆用哪种告警流量上报告警。还有另一种方式：在被管设备中设置比值范围与告警处理状态之间的对应关系，并设置告警处理状态与告警流量的对应关系，被管设备在上报告警时，首先由被管设备根据管理设备所通知的比值确定相应的告警处理状态，再由所述确定的告警处理状态确定相应的告警流量，最后釆用所述告警流量上报告警。 When the first and second forms are taken, that is, when the ratio of the alarm traffic currently being processed by the management device to the maximum alarm traffic that can be processed by the management device is captured, the current alarm processing capability of the management device is characterized. The correspondence between the ratio range and the alarm traffic can be set on the managed device, and the managed device directly determines which alarm traffic is used to report the alarm according to the ratio notified by the management device. There is another way: set the correspondence between the ratio range and the alarm processing status in the managed device, and set the correspondence between the alarm processing status and the alarm flow. When the managed device reports the alarm, it is first managed. The device determines a corresponding alarm processing state according to the ratio notified by the management device, determines the corresponding alarm traffic by the determined alarm processing state, and finally reports the alarm on the alarm traffic.

上述引入了 "告警处理状态" 来衡量管理设备当前处理告警的能力。具体而言 , 就是： The above describes the "alarm processing status" to measure the ability of the management device to currently handle alarms. Specifically, it is:

预先划分多个比值范围，为每个比值范围设置对应的告警处理状态；然后实时统计管理设备当前正在处理的告警流量，计算管理设备当前正在处理的告警流量与管理设备所能够处理的最大告警流量的比值，确定所述比值所属的比值范围，将所述比值范围所对应的告警处理状态确定为所述管理设备当前的告警处理状态。 Pre-dividing multiple ratio ranges, setting corresponding alarm processing status for each ratio range; then real-time counting the alarm traffic currently being processed by the management device, and calculating the alarm traffic currently being processed by the management device and the maximum alarm traffic that the management device can handle. The ratio of the ratio to which the ratio belongs is determined, and the alarm processing state corresponding to the ratio range is determined as the current alarm processing state of the management device.

在实际应用中，可以根据各种不同的标准划分不同的告警处理状态。较佳地，可以将告警处理状态分为四种：空闲状态、正常状态、忙状态和过载状态，并为每种告警处理状态划分相应的比值范围。例如，可以按照如下标准划分告警处理状态： In practical applications, different alarm processing states can be divided according to various standards. Preferably, the alarm processing status can be divided into four types: idle state, normal state, busy state, and overload. Status, and divide the corresponding ratio range for each alarm processing status. For example, the alarm processing status can be divided according to the following criteria:

空闲状态：表示管理设备只有很少的告警需要处理，例如：若管理设备当前正在处理的告警流量低于管理设备所能够处理的最大告警处理流量的 Idle state: Indicates that the management device has only a few alarms to be processed, for example: If the management device is currently processing alarm traffic that is lower than the maximum alarm processing traffic that the management device can handle.

45%, 可以将管理设备当前的告警处理状态确定为空闲状态； 45%, the current alarm processing status of the management device can be determined as an idle state;

正常状态：表示管理设备存在一定的当前告警需要处理，例如：若管理设备当前正在处理的告警流量处于管理设备所能够处理的最大告警处理流量的 45%至 75%之间，可以将管理设备当前的告警处理状态确定为正常状态；忙状态：表示管理设备忙于处理告警，告警流量已经接近告警处理能力的极限，例如：若管理设备当前正在处理的告警流量高于管理设备所能够处理的最大告警处理流量的 75%, 但是低于 100%, 可以将管理设备当前的告警处理状态确定为忙状态； Normal status: Indicates that the current alarm exists on the management device. For example: If the alarm traffic currently being processed by the management device is between 45% and 75% of the maximum alarm processing traffic that the management device can handle, you can manage the device. The alarm processing status is determined to be a normal state; the busy status: indicates that the management device is busy processing the alarm, and the alarm traffic is close to the limit of the alarm processing capability, for example: if the management device is currently processing the alarm traffic higher than the maximum alarm that the management device can handle. Processing 75% of the traffic, but less than 100%, the current alarm processing status of the management device can be determined to be busy;

过载状态：表示网管***处理能力已经跟不上设备上报告警的流量，例如：若管理设备当前正在处理的告警流量已超过管理设备所能够处理的最大告警处理流量的 100%, 可以将管理设备当前的告警处理状态确定为过载状态。 Overload status: Indicates that the network management system's processing capability cannot keep up with the traffic reported on the device. For example: If the management device is currently processing alarm traffic that exceeds 100% of the maximum alarm processing traffic that the management device can handle, you can manage the device. The current alarm processing status is determined to be an overload status.

上述 45%、 75%和 100%等数据均只是举例说明，在实际应用中，可以按照其他可行的标准来划分不同的告警处理状态。 The above data of 45%, 75% and 100% are only examples. In practical applications, different alarm processing states can be classified according to other feasible standards.

在实际应用中，可以根据需要实时地为各种告警处理状态设置与之相应的告警流量，并设置告警处理状态变化时被管设备所釆取的动作。当被管设备上报告警时，可以根据管理设备当前的告警处理状态确定与之相应的告警流量，并以所确定的告警流量向管理设备上报告警。本发明所述上报告警的流量也可以理解为上报告警的方式。较佳地，针对上述四种告警处理状态可以设置三种告警上报方式：正常上报告警、上报重要告警和緩存所有告警。 In an actual application, the alarm traffic corresponding to each alarm processing state may be set in real time according to requirements, and the action taken by the managed device when the alarm processing state changes may be set. When the alarm is reported on the managed device, the alarm traffic corresponding to the current alarm processing status of the management device is determined, and the alarm is reported to the management device by the determined alarm traffic. The traffic reported above in the present invention can also be understood as the manner in which the police are reported. Preferably, three types of alarm reporting modes can be set for the above four alarm processing states: the alarm is reported normally, the important alarm is reported, and all alarms are cached.

其中，正常上报告警：被管设备正常地向管理设备上报告警； Wherein, the police are reported normally: the managed device reports the alarm to the management device normally;

上报重要告警：被管设备仅向管理设备上报重要的告警，緩存除重要告警之外的告警；针对这种告警上报方式，可以预先在配置文件中配置哪些告警是重要告警； Reporting important alarms: The managed device reports only important alarms to the management device. An alarm other than the alarm; for the alarm reporting method, you can configure which alarms are important alarms in the configuration file in advance;

緩存所有告警：被管设备停止上报告警，并将所有告警緩存。 Cache all alarms: The managed device stops reporting alarms and caches all alarms.

针对上述四种告警处理状态与三种告警上报方式，可以设置如下所示对应关系，即设置如下所示告警上报策略： For the above four alarm processing states and the three alarm reporting modes, you can set the corresponding relationship as follows: Set the alarm reporting policy as follows:

当管理设备当前的告警处理状态为空闲状态或正常状态时，被管设备正常地向管理设备上报告警； When the current alarm processing status of the management device is an idle state or a normal state, the managed device reports the alarm to the management device normally;

当管理设备当前的告警处理状态为忙状态时，被管设备仅向管理设备上报重要告警，緩存除所述重要告警之外的所有告警； When the current alarm processing status of the management device is in a busy state, the managed device reports only important alarms to the management device, and caches all alarms except the important alarms.

当管理设备当前的告警处理状态为过载状态时，被管设备緩存所有告警；当管理设备当前的告警处理状态由过载状态或忙状态转为空闲状态或正常状态时，被管设备上报緩存的告警。 When the current alarm processing status of the management device is the overload status, the managed device caches all alarms. When the current alarm processing status of the management device changes from the overload status or the busy status to the idle status or the normal status, the managed device reports the cached alarm. .

在实际应用中，当然也可以根据需要设置其他的告警上报方式，相应地，也可以釆取其他方式设置告警处理状态与告警上报方式的对应关系。 In an actual application, it is also possible to set other alarm reporting methods as required. Accordingly, other methods may be used to set the correspondence between the alarm processing status and the alarm reporting manner.

按照上述对应关系将得到如图 2 所示的、本发明一较佳实施例中告警上报方式随告警处理状态变化的示意图。图 2表示： According to the above correspondence, a schematic diagram of the alarm reporting manner changing with the alarm processing state in the preferred embodiment of the present invention as shown in FIG. 2 is obtained. Figure 2 shows:

1、当管理设备的告警处理状态由空闲状态或正常状态变为过载状态时，被管设备釆取緩存所有告警的告警上报方式，緩存所有的告警； 1. When the alarm processing status of the management device changes from the idle state or the normal state to the overload state, the managed device captures the alarm reporting manner of buffering all the alarms, and caches all the alarms;

2、当管理设备的告警处理状态由过载状态变为空闲状态或正常状态时，被管设备釆取正常上报告警的告警上报方式，重新上报緩存的告警，并在完成重新上报告警之后，正常上报后续告警； 2. When the alarm processing status of the management device changes from the overload state to the idle state or the normal state, the managed device retrieves the alarm reporting method of the normal reporting alarm, re-states the cached alarm, and after completing the re-reporting alarm, The subsequent alarm is reported normally.

3、当管理设备的告警处理状态由空闲状态或正常状态变为忙状态时，被管设备釆取上报重要告警的告警上报方式，仅上报策略中规定的重要告警，緩存除重要告警之外的其他告警； 3. When the alarm processing status of the management device changes from the idle state or the normal state to the busy state, the managed device retrieves the alarm reporting method that reports the important alarms, and only reports the important alarms specified in the policy, and caches the alarms other than the important alarms. Other alarms;

4、当管理设备的告警处理状态由忙状态变为空闲状态或正常状态时，被管设备釆取正常上报告警的告警上报方式，重新上报緩存的告警，并在完成重新上报告警之后，正常上报后续告警； 4. When the alarm processing status of the management device changes from the busy state to the idle state or the normal state, the managed device retrieves the alarm reporting manner of the normal alarm, and reports the cached alarm again. After the alarm is reported again, the subsequent alarm is reported normally;

5、当管理设备的告警处理状态由忙状态变为过载状态时，被管设备釆取緩存所有告警的告警上报方式，緩存所有的告警； 5. When the alarm processing status of the management device changes from the busy state to the overload state, the managed device captures the alarm reporting mode of all the alarms and caches all the alarms.

6、当管理设备的告警处理状态由过载状态变为忙状态时，被管设备釆取上报重要告警的告警上报方式，仅上报策略中规定的重要告警，緩存除重要告警之外的其他告警。 6. When the alarm processing status of the management device changes from the overload status to the busy status, the managed device retrieves the alarm reporting method that reports the important alarms. Only the important alarms specified in the policy are reported, and other alarms other than the important alarms are cached.

由上述实施例可见，在本发明实施例所公开的控制告警流量的方法中，管理设备可以实时地将自身的告警处理能力通知被管设备，这样，被管设备就可以根据管理设备的实时告警处理能力调整向管理设备上报告警的流量，从而有效避免了网络告警风暴的发生。 It can be seen from the above embodiments that, in the method for controlling alarm traffic disclosed in the embodiment of the present invention, the management device can notify the managed device of its own alarm processing capability in real time, so that the managed device can perform real-time alarm according to the management device. The processing capability adjusts the alarm traffic to the management device, thus effectively avoiding the network alarm storm.

并且，管理设备可以根据一定的策略控制其告警处理能力的散播范围。例如，管理设备可以将其告警处理能力通过广播的方式发送给其所辖的所有被管设备；管理设备也可以只将其告警处理能力通知符合某些特定条件的被管设备。 Moreover, the management device can control the spread range of its alarm processing capability according to a certain policy. For example, the management device can broadcast its alarm processing capability to all managed devices under its jurisdiction by broadcasting; the management device can also notify its managed device of its alarm processing capability only to certain specific conditions.

下面对本发明实施例技术方案所适用的场景进行简要说明。 The scenario applicable to the technical solution of the embodiment of the present invention is briefly described below.

图 3为现有网络管理层次模型示意图。图 3所示层次模型中，由下往上依次包括：物理网元层、网元维护层、网络管理层和应用层，各层功能如下：物理网元层：包括电信骨干网上的各种网元设备，例如电话交换机、同步数字系列（SDH )、准同步数字系列（PDH )、数字交叉连接设备（DXC )、数字数据网络（DDN ) 节点机、接入网设备等。物理网元层中的网元设备通过非标准接口向上一层提供各类网元信息，当网元设备出现故障时将上报告警到网元维护层的网管***。 Figure 3 is a schematic diagram of an existing network management hierarchy model. In the hierarchical model shown in Figure 3, from bottom to top, the physical network element layer, the network element maintenance layer, the network management layer, and the application layer are in turn. The functions of each layer are as follows: Physical network element layer: includes various networks on the telecommunications backbone network. Meta-devices, such as telephone switches, Synchronous Digital Hierarchy (SDH), Plesiochronous Digital Hierarchy (PDH), Digital Cross-Connect Equipment (DXC), Digital Data Network (DDN) node machines, access network equipment, and the like. The network element device in the physical NE layer provides various types of NE information to the upper layer through a non-standard interface. When the NE device fails, it reports the network management system of the NE maintenance layer.

网元维护层：与骨干网的各类网元设备或它们的网管设备进行通信和协议翻译，对各类网元信息进行标准化处理，并保存在本地数据库；釆取主动和被动两种方式向网络管理层提供标准化的信息数据；并向用户提供网元故障告警、网元维护的操作界面。该层的网管***接收物理网元的告警，显示给用户，并将告警上报到网络管理层的网管***。 NE maintenance layer: Communicates and translates with various network element devices of the backbone network or their network management devices, normalizes various types of network element information, and saves them in a local database. The network management layer provides standardized information data; and provides an operation interface for the network element fault alarm and network element maintenance to the user. The network management system of the layer receives the alarm of the physical network element and displays Give the user, and report the alarm to the network management system of the network management layer.

网络管理层：综合各类网元标准化信息，建立全网层次的标准信息处理模型，并在信息处理模型的基础上建立智能分析决策***、专家处理***、知识数据库等，为应用层提供各类信息输出接口。该层的网管***接收网元维护层的网管***的告警。 Network management layer: Integrate all kinds of network element standardization information, establish a standard information processing model at the whole network level, and build an intelligent analysis decision system, expert processing system, knowledge database, etc. on the basis of the information processing model to provide various types for the application layer. Information output interface. The network management system of the layer receives the alarm of the network management system of the maintenance layer of the NE.

图 1所示本发明控制告警流量的方法可以用于图 3所示层次模型中。具体而言：网元维护层的网管***可以使用图 1 所示方法控制网元设备的告警流量，网络管理层的网管***可以使用图 1 所示方法控制网元维护层的网管 ***的告警流量。 The method of controlling alarm traffic of the present invention shown in Fig. 1 can be used in the hierarchical model shown in Fig. 3. Specifically, the network management system of the network element maintenance layer can control the alarm traffic of the network element device by using the method shown in Figure 1. The network management system of the network management layer can control the alarm traffic of the network management system of the maintenance layer of the network element by using the method shown in Figure 1. .

图 3 所示层次模型中，网元维护层的网管***可以是网元管理*** ( EMS ) , 网络管理层的网管***可以是网络管理***（ NMS )。以 EMS 和 NMS构造网络管理***，可以形成如图 4所示的网络管理层次模型。图 4所示网络层次模型中各网络设备的工作过程如下： In the hierarchical model shown in Figure 3, the network management system of the network element maintenance layer may be an element management system (EMS), and the network management system of the network management layer may be a network management system (NMS). The network management system is constructed by EMS and NMS, and the network management hierarchy model shown in Figure 4 can be formed. The working process of each network device in the network hierarchy model shown in Figure 4 is as follows:

网元设备：在出现故障后上报告警到 EMS。 NE device: Reports an EMS to the EMS after a failure.

EMS: 包括故障处理模块和北向接口模块，其中，故障处理模块负责接收网元设备的告警；北向接口模块负责与 NMS建立连接，并将网元设备的告警转发到 NMS。 The EMS includes a fault processing module and a northbound interface module. The fault processing module is responsible for receiving alarms from the network element device. The northbound interface module is responsible for establishing a connection with the NMS and forwarding the alarm of the network element device to the NMS.

NMS: 接收来自于 EMS北向接口的告警数据。建立连接，物理设备釆用 SNMP TRAP/INFORM的方式上报告警； EMS通过 SNMP TRAP/INFORM的方式向 NMS上报告警。 NMS: Receives alarm data from the northbound interface of the EMS. The connection is established, and the physical device reports the alarm in the manner of SNMP TRAP/INFORM; the EMS reports the alarm to the NMS through the SNMP TRAP/INFORM.

将图 1所示本发明控制告警流量的方法应用于图 4所示模型中，则 EMS 可以作为管理设备，网元设备可以作为被管设备，由 EMS控制网元设备的告警流量； NMS可以作为管理设备， EMS可以作为被管设备，由 NMS控制 EMS 的告警流量。 The method for controlling the alarm traffic of the present invention shown in FIG. 1 is applied to the model shown in FIG. 4, and the EMS can be used as a management device, and the network element device can be used as a managed device, and the EMS controls the alarm traffic of the network element device; Management equipment, EMS can be used as a managed device, and the NMS controls the alarm traffic of the EMS.

由上述实施例可见，本发明实施例所公开的控制告警流量的方法中，通过管理设备将自身的告警处理能力通知被管设备，并由被管设备根据管理设备的告警处理能力，釆用与所述告警处理能力相应的告警流量向管理设备上报告警，从而对告警流量实现了有效的控制，避免了网络告警风暴的发生。 It can be seen from the foregoing embodiment that, in the method for controlling alarm traffic disclosed in the embodiment of the present invention, The management device notifies the managed device of the alarm processing capability, and the managed device reports the alarm to the management device by using the alarm traffic corresponding to the alarm processing capability according to the alarm processing capability of the management device, thereby Effective control is implemented to avoid network alarm storms.

并且，本发明技术方案在发现网络告警风暴的迹象时，緩存告警数据，使得告警数据不会丟失，并在网络告警风暴解除后主动重新上报告警数据，无需人工干预，有效解决了网络告警风暴中的告警数据丟失问题。 Moreover, the technical solution of the present invention caches the alarm data when the network alarm storm is found, so that the alarm data is not lost, and the police alarm data is automatically re-reported after the network alarm storm is removed, and the network alarm storm is effectively solved without manual intervention. Alarm data loss in the problem.

此外，本发明技术方案具有通用性，可以在基于各种网络管理协议的系统中实现，且实现简单、方便，对现有管理设备和被管设备的改造很少。 In addition, the technical solution of the present invention has versatility, can be implemented in a system based on various network management protocols, and is simple and convenient to implement, and has few modifications to existing management devices and managed devices.

以上详细说明了本发明控制告警流量方法的具体实施方式，下面对本发明控制告警流量的管理设备、被管设备和***进行介绍。 The specific implementation manner of the method for controlling the alarm traffic of the present invention is described in detail above. The following describes the management device, the managed device and the system for controlling the alarm traffic of the present invention.

图 5 为本发明实施例中控制告警流量的管理设备的组成结构示意图。为简明起见，图 5仅示出管理设备中、与控制被管设备告警流量相关的模块，即管理设备中故障处理模块的组成结构，对于管理设备中的其他模块并未详细示出。参见图 5 , 该管理设备不仅包括：告警接收模块 510和告警分析模块 520 , 还包括：第一流量控制模块 530。 FIG. 5 is a schematic structural diagram of a structure of a management device for controlling alarm traffic according to an embodiment of the present invention. For the sake of brevity, FIG. 5 only shows the modules related to the alarm traffic of the managed device in the management device, that is, the components of the fault handling module in the management device, which are not shown in detail for other modules in the management device. Referring to FIG. 5, the management device includes: an alarm receiving module 510 and an alarm analysis module 520, and further includes: a first flow control module 530.

其中，告警接收模块 510: 接收来自于被管设备的告警数据，并将各种不同格式的告警数据转换为统一格式的告警数据发送给告警分析模块 520。通常，由于各被管设备可能是由不同厂家生产的，这些被管设备所产生的告警数据不一定是遵循同一协议标准的，此时，告警接收模块可以根据管理设备内部所釆用的协议将其转化为统一的格式发送给告警分析模块 520。 The alarm receiving module 510: receives the alarm data from the managed device, and converts the alarm data of different formats into a unified format and sends the alarm data to the alarm analysis module 520. Generally, since each managed device may be produced by different manufacturers, the alarm data generated by these managed devices does not necessarily follow the same protocol standard. In this case, the alarm receiving module may be based on the protocol used within the management device. It is converted to a unified format and sent to the alarm analysis module 520.

告警分析模块 520: 分析接收到的告警数据，在分析完毕之后进行持久化保存，并将告警数据显示给用户。本实施例中，所述告警分析模块的功能与现有技术相同，在此不再赘述。 The alarm analysis module 520: analyzes the received alarm data, performs persistent storage after the analysis is completed, and displays the alarm data to the user. In this embodiment, the function of the alarm analysis module is the same as that in the prior art, and details are not described herein again.

第一流量控制模块 530: 用于确定管理设备当前的告警处理能力，并将告警处理能力通知被管设备。 The first flow control module 530 is configured to determine a current alarm processing capability of the management device, and notify the managed device of the alarm processing capability.

图 5所示第一流量控制模块 530中，可以包括：确定子模块 531 , 用于确定所述管理设备当前的告警处理能力；能力通知子模块 532 ,用于将管理设备当前的告警处理能力直接发送给被管设备，或用于以管理设备当前的告警处理能力，更新被管设备上与所述管理设备当前的告警处理能力相应的管理接口。 The first flow control module 530 shown in FIG. 5 may include: The determining sub-module 531 is configured to determine a current alarm processing capability of the management device, and the capability notification sub-module 532 is configured to directly send the current alarm processing capability of the management device to the managed device, or to manage the current alarm of the device. Processing capability, updating a management interface on the managed device corresponding to the current alarm processing capability of the management device.

对应于上述管理设备通知被管设备的第一种形式，所述确定子模块 531 , 可以用于统计管理设备当前正在处理的告警流量，将所述告警流量作为所述管理设备当前的告警处理能力。 Corresponding to the first form of the management device notifying the managed device, the determining sub-module 531 can be used to collect the alarm traffic currently being processed by the management device, and use the alarm traffic as the current alarm processing capability of the management device. .

对应于上述管理设备通知被管设备的第二种形式，所述确定子模块 531 , 可以用于计算管理设备当前正在处理的告警流量与管理设备所能够处理的最大告警流量的比值，将所述比值作为所述管理设备当前的告警处理能力。 Corresponding to the second form of the management device notifying the managed device, the determining submodule 531 may be configured to calculate a ratio of the alarm traffic currently being processed by the management device to the maximum alarm traffic that the management device can process, The ratio is used as the current alarm processing capability of the management device.

对应于上述管理设备通知被管设备的第三种形式，所述确定子模块 531 , 可以用于根据管理设备当前正在处理的告警流量与管理设备所能够处理的最大告警流量的比值，确定管理设备当前的告警处理状态，并将所述管理设备当前的告警处理状态作为所述管理设备当前的告警处理能力。为实现上述确定管理设备当前的告警处理状态的功能，可以具体将确定子模块 531 划分为如下单元： Corresponding to the third form of the management device notifying the managed device, the determining submodule 531 may be configured to determine the management device according to a ratio of the alarm traffic currently being processed by the management device to the maximum alarm traffic that the management device can process. The current alarm processing status, and the current alarm processing status of the management device is used as the current alarm processing capability of the management device. To implement the above function of determining the current alarm processing state of the management device, the determining submodule 531 may be specifically divided into the following units:

设置子单元，用于划分多个比值范围，为每个比值范围设置一个对应的告警处理状态，并将所述比值范围与告警处理状态的对应关系提供给状态确定子单元； The setting subunit is configured to divide a plurality of ratio ranges, set a corresponding alarm processing state for each ratio range, and provide a correspondence relationship between the ratio range and the alarm processing state to the state determining stator unit;

统计子单元，用于统计管理设备当前正在处理的告警流量，并将所述统计得到的管理设备当前正在处理的告警流量发送给比值计算子单元； a statistical sub-unit, configured to collect, by the management device, the alarm traffic currently being processed by the device, and send the alarm traffic currently being processed by the management device to the ratio calculation sub-unit;

比值计算子单元，用于根据来自于统计子单元的所述管理设备当前正在处理的告警流量，计算管理设备当前正在处理的告警流量与管理设备所能够处理的最大告警流量的比值，并将所述计算得到的比值发送给状态确定子单元； a ratio calculation subunit, configured to calculate, according to an alarm traffic currently being processed by the management device from the statistical subunit, a ratio of an alarm traffic currently being processed by the management device to a maximum alarm traffic that the management device can process, and The calculated ratio is sent to the state determining subunit;

状态确定子单元，根据来自于比值计算子单元的比值、以及设置子单元所提供的比值范围与告警处理状态的对应关系，确定所述比值所属的比值范围，并将所属比值范围所对应的告警处理状态确定为管理设备当前的告警处理状态。 a state determining subunit, calculating a ratio based on the ratio from the ratio, and setting a subunit The ratio of the ratio range to the alarm processing state is determined, the ratio range to which the ratio belongs is determined, and the alarm processing state corresponding to the ratio range is determined as the current alarm processing state of the management device.

上述统计子单元在统计管理设备当前正在处理的告警流量时，可以通过实时监测告警接收模块和告警分析模块所处理的告警流量来实现。 The statistics sub-unit can be implemented by monitoring the alarm traffic processed by the alarm receiving module and the alarm analysis module in real time when the alarm traffic of the management device is currently being processed.

图 5所示管理设备可以是 EMS, 此时，被管设备为网元设备；图 5所示管理设备还可以是 NMS, 此时，被管设备为 EMS。 The management device shown in Figure 5 can be an EMS. In this case, the managed device is a network element device. The management device shown in Figure 5 can also be an NMS. In this case, the managed device is an EMS.

由上述实施例可见，本发明通过在管理设备中增加第一流量控制模块，并由第一流量控制模块实时监测告警接收模块和告警分析模块所处理的告警流量，确定该管理设备的告警处理能力，进而将该告警处理能力及时地通知被管设备，实现了根据管理设备的告警处理能力控制告警流量，避免了网络告警风暴的发生。 It can be seen from the above embodiment that the first flow control module is added to the management device, and the first traffic control module monitors the alarm traffic processed by the alarm receiving module and the alarm analysis module in real time, and determines the alarm processing capability of the management device. Then, the alarm processing capability is notified to the managed device in time, and the alarm traffic is controlled according to the alarm processing capability of the management device, thereby avoiding the occurrence of the network alarm storm.

并且，在发现网络告警风暴的迹象时，被管设备将通过管理设备通知的告警处理能力緩存告警数据，如此，解决了网络告警风暴中的告警数据丟失问题。 Moreover, when an indication of a network alarm storm is found, the managed device caches the alarm data by the alarm processing capability notified by the management device, thus solving the problem of alarm data loss in the network alarm storm.

图 6 为本发明实施例中控制告警流量的被管设备的组成结构示意图。参见图 6, 该被管设备不仅包括：告警上报模块 610, 还包括：第二流量控制模块 620。 FIG. 6 is a schematic structural diagram of a managed device for controlling alarm traffic according to an embodiment of the present invention. Referring to FIG. 6, the managed device includes: an alarm reporting module 610, and a second flow control module 620.

其中，第二流量控制模块 620, 用于获取管理设备当前的告警处理能力，并根据所述管理设备当前的告警处理能力，确定相应的告警流量； The second flow control module 620 is configured to obtain a current alarm processing capability of the management device, and determine a corresponding alarm traffic according to the current alarm processing capability of the management device.

告警上报模块 610 ,用于以所述第二流量控制模块 620确定的告警流量向管理设备上报告警。 The alarm reporting module 610 is configured to report an alarm to the management device by using the alarm traffic determined by the second flow control module 620.

图 6所示第二流量控制模块 620中，可以包括： The second flow control module 620 shown in FIG. 6 may include:

能力获取子模块 621 ,用于接收来自于管理设备的所述管理设备当前的告警处理能力，或用于从与所述管理设备当前的告警处理能力相应的管理接口获取管理设备当前的告警处理能力，所述管理设备当前的告警处理能力是由管理设备更新到所述管理接口的； a capability acquisition submodule 621, configured to receive a current advertisement from the management device of the management device The alarm processing capability is used to obtain the current alarm processing capability of the management device from the management interface corresponding to the current alarm processing capability of the management device, where the current alarm processing capability of the management device is updated by the management device to the management interface. of;

流量确定子模块 622 , 用于根据所述管理设备当前的告警处理能力，确定相应的告警流量。 The traffic determining sub-module 622 is configured to determine a corresponding alarm traffic according to the current alarm processing capability of the management device.

对应于上述管理设备通知被管设备的第一种形式，所述能力获取子模块 621获取到的管理设备当前的告警处理能力是：管理设备当前正在处理的告警流量。 Corresponding to the first form of the management device notifying the managed device, the current alarm processing capability of the management device acquired by the capability acquisition sub-module 621 is: the alarm traffic currently being processed by the management device.

对应于上述管理设备通知被管设备的第二种形式，所述能力获取子模块 621获取到的管理设备当前的告警处理能力是：所述管理设备当前正在处理的告警流量与管理设备所能够处理的最大告警流量的比值； Corresponding to the second form of the management device notifying the managed device, the current alarm processing capability of the management device acquired by the capability acquisition sub-module 621 is: the alarm traffic currently being processed by the management device and the management device can process Ratio of the maximum alarm traffic;

此时，图 6所示被管设备中可以进一步包括：第一存储模块 630 , 用于存储预先设置的比值范围与告警处理状态的对应关系； At this time, the managed device shown in FIG. 6 may further include: a first storage module 630, configured to store a correspondence between a preset ratio range and an alarm processing state;

所述流量确定子模块 622中可以进一步包括： The traffic determining sub-module 622 may further include:

第一单元 623 ,根据设置的比值范围与告警处理状态的对应关系，确定与所述管理设备当前正在处理的告警流量与管理设备所能够处理的最大告警流量的比值相应的告警处理状态，并将所述告警处理状态通知第二单元 624。 The first unit 623 determines, according to the correspondence between the set ratio range and the alarm processing state, an alarm processing state corresponding to a ratio of the alarm traffic currently being processed by the management device to the maximum alarm traffic that the management device can process, and The alarm processing status notifies the second unit 624.

对应于上述管理设备通知被管设备的第三种形式，所述能力获取子模块 621获取到的管理设备当前的告警处理能力是：所述管理设备当前的告警处理状态，所述流量确定子模块 622中无需包括第一单元 623 , 包括第二单元 624 即可。 Corresponding to the third form of the management device notifying the managed device, the current alarm processing capability of the management device acquired by the capability acquisition sub-module 621 is: the current alarm processing state of the management device, and the traffic determination sub-module The first unit 623 need not be included in the 622, and the second unit 624 is included.

所述第二单元 624 ,用于根据设置的告警处理状态与告警流量之间的对应关系，确定与所述告警处理状态相应的告警流量，并将所述告警流量通知告警上报模块 610。 The second unit 624 is configured to determine an alarm traffic corresponding to the alarm processing state according to the corresponding relationship between the set alarm processing state and the alarm traffic, and notify the alarm reporting module 610 of the alarm traffic.

此时，所述被管设备中可以进一步包括第二存储模块 640, 用于存储告警处理状态与告警流量之间的对应关系，并向第二单元 624提供所述告警处理状态与告警流量之间的对应关系。 At this time, the managed device may further include a second storage module 640, configured to store a correspondence between the alarm processing state and the alarm traffic, and provide the alarm processing to the second unit 624. Correspondence between status and alarm traffic.

较佳地，在管理设备当前的告警处理状态为空闲状态或正常状态时，所述第二单元 624, 用于通知告警上模块 610正常地向管理设备上告警；所述告警上报模块 610, 用于根据所述第二单元 624的通知，正常地向管理设备上报告警； Preferably, when the current alarm processing state of the management device is an idle state or a normal state, the second unit 624 is configured to notify the alarming module 610 to normally alert the management device; the alarm reporting module 610, Reporting the alarm to the management device normally according to the notification of the second unit 624;

在管理设备当前的告警处理状态为忙状态时，所述第二单元 624 , 用于通知告警上报模块 610仅向管理设备上报重要告警，緩存除所述重要告警之外的所有告警；所述告警上报模块 610 , 用于根据所述第二单元 624的通知，仅向管理设备上报重要告警，将除所述重要告警之外的所有告警緩存； When the current alarm processing status of the management device is in a busy state, the second unit 624 is configured to notify the alarm reporting module 610 to report only the important alarms to the management device, and cache all the alarms except the important alarms; The reporting module 610 is configured to report only the important alarms to the management device according to the notification of the second unit 624, and cache all the alarms except the important alarms;

在管理设备当前的告警处理状态为过载状态时，所述第二单元 624 , 用于通知告警上报模块 610緩存所有告警；所述告警上报模块 610, 用于根据所述第二单元 624的通知，将所有告警緩存。 When the current alarm processing state of the management device is an overload state, the second unit 624 is configured to notify the alarm reporting module 610 to cache all the alarms. The alarm reporting module 610 is configured to notify the second unit 624 according to the notification. Cache all alarms.

进一步地，第二单元 624中可以包括： Further, the second unit 624 can include:

状态变化判断子单元 625 ,用于接收能力获取子模块 621发送的管理设备当前的告警处理状态，当所述管理设备当前的告警处理状态为空闲状态或正常状态时，判断所述当前的告警处理状态的前一个告警处理状态是否为过载状态或忙状态，若是，则通知告警上报模块 610上报緩存的告警； The state change judging sub-unit 625 is configured to receive the current alarm processing state of the management device sent by the capability acquiring sub-module 621, and determine the current alarm processing when the current alarm processing state of the management device is an idle state or a normal state. Whether the state of the previous alarm processing state of the state is an overload state or a busy state, and if so, notifying the alarm reporting module 610 to report the buffered alarm;

所述告警上报模块 610用于根据所述状态变化判断子单元 625的通知将緩存的告警向管理设备上报。 The alarm reporting module 610 is configured to report the buffered alarm to the management device according to the notification of the state change determining sub-unit 625.

图 6所示被管设备可以是网元设备，此时，管理设备为 EMS; 图 6所示被管设备还可以是 EMS, 此时，管理设备为 NMS。 The managed device shown in Figure 6 can be a network element device. In this case, the management device is an EMS. The managed device can also be an EMS. In this case, the management device is an NMS.

由上述实施例可见，本发明通过在被管设备中增加第二流量控制模块，并由第二流量控制模块根据管理设备发送的告警处理能力，通知告警上报模块以与所述告警处理能力相应的告警流量上报告警，实现了根据管理设备的告警处理能力控制告警流量，避免了网络告警风暴的发生。 It can be seen from the foregoing embodiment that the present invention adds a second flow control module to the managed device, and the second flow control module notifies the alarm reporting module to correspond to the alarm processing capability according to the alarm processing capability sent by the management device. Alarms are reported on the alarm traffic. The alarm traffic is controlled according to the alarm processing capability of the management device, which avoids the occurrence of network alarm storms.

并且，在发现网络告警风暴的迹象时，被管设备将通过管理设备通知的告警处理能力緩存告警数据，如此，解决了网络告警风暴中的告警数据丟失问题。 And, when an indication of a network alarm storm is discovered, the managed device will notify through the management device. The alarm processing capability caches alarm data, thus solving the problem of alarm data loss in the network alarm storm.

由图 5所示管理设备和图 6所示被管设备可以构成本发明控制告警流量的***。下面通过两个实施例说明本发明控制告警流量***的具体实施方式。 The management device shown in Fig. 5 and the managed device shown in Fig. 6 can constitute the system for controlling alarm traffic of the present invention. The specific implementation of the control alarm flow system of the present invention will be described below by means of two embodiments.

图 7 为本发明一较佳实施例中控制告警流量的***的组成结构示意图。参见图 7, 网元管理***（EMS )是本***中的管理设备，网元设备八、 B、 C是本***中的被管设备。 FIG. 7 is a schematic structural diagram of a system for controlling alarm traffic according to a preferred embodiment of the present invention. Referring to Figure 7, the element management system (EMS) is the management device in the system, and the network element devices 8, B, and C are the managed devices in the system.

图 7所示 EMS包括告警接收模块、告警分析模块和第一流量控制模块，各模块之间的结构关系与图 5 所示管理设备中各模块之间的结构关系相同，在此不再赘述。图 7所示各网元设备包括告警上模块和第二流量控制模块，各模块之间的结构关系与图 6 所示被管设备中各模块之间的结构关系相同，请参见相应部分的描述。图 7所示***的告警上报流程包括以下步骤： The EMS includes the alarm receiving module, the alarm analyzing module, and the first flow control module. The structural relationship between the modules is the same as that of the modules in the management device shown in Figure 5, and is not described here. Each of the network element devices shown in FIG. 7 includes an alarm upper module and a second flow control module. The structural relationship between the modules is the same as the structural relationship between the modules in the managed device shown in FIG. 6. Please refer to the description of the corresponding part. . The alarm reporting process of the system shown in Figure 7 includes the following steps:

A、网元设备从 MIB上定义为 "管理设备当前的告警处理能力" 的节点中，获取 EMS的告警处理状态。 A. The NE device obtains the alarm processing status of the EMS from the node that is defined as the current alarm processing capability of the management device.

B、当网元设备有新告警产生时，根据 MIB节点上的告警处理状态，确定与之相应的告警上报流量。 B. When a new alarm is generated on the NE device, the alarm reporting traffic is determined according to the alarm processing status on the MIB node.

C、网元设备以所述确定的告警上报流量向 EMS上报网元设备的故障。本步骤中，网元设备可以根据该网元设备与 EMS之间所遵循的协议，釆用该协议中定义的标准方式上>¾故障。例如，可以通过简单网络管理协议 ( SNMP ) 中的 SNMP TRAP/INFORM等方式上报故障。 C. The network element device reports the fault of the network element device to the EMS by reporting the traffic to the EMS. In this step, the network element device can use the standard method defined in the protocol according to the protocol followed by the network element device and the EMS. For example, the fault can be reported by SNMP TRAP/INFORM in the Simple Network Management Protocol (SNMP).

D、 EMS的告警接收模块接收到告警，并进行格式转换。 D. The EMS alarm receiving module receives the alarm and performs format conversion.

E、告警分析模块对接收到的告警进行分析处理，并持久化和显示到用户界面。 E. The alarm analysis module analyzes and processes the received alarm and persists and displays it to the user interface.

F、流量控制模块实时统计告警接收模块的告警接收情况和告警分析模块的告警处理情况，得出管理设备当前的告警处理状态。 F. The traffic control module collects the alarm receiving status and alarm analysis module of the alarm receiving module in real time. The alarm processing status is obtained, and the current alarm processing status of the management device is obtained.

G、当流量控制模块检测到 EMS的告警处理状态发生变化时，通过 SNMP 广播的方式，将告警处理状态的变化通知网络中的所有网元设备； G. When the flow control module detects that the alarm processing status of the EMS changes, the SNMP broadcast mode is used to notify all network element devices in the network of changes in the alarm processing status.

H、循环到执行步骤八。 H. Loop to step 8.

通过上述流程可以看出，网元设备都是依据 EMS的告警处理状态来上报告警的。当 EMS 的处理能力不足时，网元设备将緩存部分和全部告警，等 EMS的告警处理能力恢复之后再继续上报告警，这样将避免网络告警风暴的发生，有效控制告警流量，并解决网络告警风暴中的告警数据丟失问题。 Through the above process, it can be seen that the NE device reports alarms according to the alarm processing status of the EMS. When the processing capability of the EMS is insufficient, the NE device caches some and all alarms, and then resumes reporting alarms after the EMS alarm processing capability is restored. This will prevent network alarm storms, effectively control alarm traffic, and resolve network alarms. Alarm data loss in the storm.

图 8为本发明另一较佳实施例中控制告警流量的***的组成结构示意图。参见图 8,网络管理***（NMS )是本***中的管理设备，网元管理***（EMS ) 是本***中的被管设备。 NMS和 EMS的组成结构分别与图 5所示管理设备和图 6所示被管设备相同，在此不再赘述。 FIG. 8 is a schematic structural diagram of a system for controlling alarm traffic according to another preferred embodiment of the present invention. Referring to Figure 8, the Network Management System (NMS) is the management device in the system, and the Network Element Management System (EMS) is the managed device in the system. The components of the NMS and the EMS are the same as those of the management device shown in Figure 5 and the managed device shown in Figure 6, and are not described here.

图 8所示***中， EMS通过北向接口模块将网元设备的告警上报到 NMS; NMS实时计算出自身告警处理状态，并设置到 EMS的 MIB节点上，由 EMS 根据 NMS的告警处理状态确定上报告警的方式。 In the system shown in Figure 8, the EMS reports the alarm of the NE device to the NMS through the northbound interface module. The NMS calculates the alarm processing status in real time and sets it to the MIB node of the EMS. The EMS determines the alarm processing status based on the NMS. The way to report the police.

由上述实施例可见，釆用本发明实施例所公开的管理设备和被管设备可以组成一种能够根据管理设备的告警处理能力，控制被管设备上报告警方式的网络管理***，有效地控制了告警流量，避免了网络告警风暴的发生，并解决了网络告警风暴中的告警数据丟失问题。 It can be seen from the above embodiments that the management device and the managed device disclosed in the embodiments of the present invention can form a network management system capable of controlling the alarm mode of the managed device according to the alarm processing capability of the management device, and effectively control the network management system. The alarm traffic is used to avoid the occurrence of network alarm storms and solve the problem of alarm data loss in the network alarm storm.

本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的程序可存储于一计算机可读取存储介质中，该程序在执行时，可包括如上述各方法的实施例的流程。其中，所述的存储介质可为磁碟、光盘、只读存储记忆体（ Read-Only Memory, ROM )或随机存储记忆体 ( Random Acces s Memory, RAM )等。 A person skilled in the art can understand that all or part of the process of implementing the above embodiment method can be completed by a computer program to instruct related hardware, and the program can be stored in In a computer readable storage medium, the program, when executed, may include the flow of an embodiment of the methods described above. The storage medium may be a magnetic disk, an optical disk, a Read-Only Memory (ROM), or a Random Acces s Memory (RAM).

以上所述仅为本发明的较佳实施例而已，并非用于限定本发明的保护范围。凡在本发明的精神和原则之内所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。 The above description is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalents, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

权利要求书 Claim

1、一种控制告警流量的方法，其特征在于，包括： A method for controlling alarm traffic, characterized by comprising:

管理设备将自身当前的告警处理能力通知被管设备； The management device notifies the managed device of its current alarm processing capability;

管理设备接收被管设备上报的告警，所述告警是由被管设备根据管理设备当前的告警处理能力，釆用相应的告警流量向管理设备上报的。 The management device receives the alarm reported by the managed device, and the alarm is reported by the managed device to the management device according to the current alarm processing capability of the management device.

2、根据权利要求 1所述的方法，其特征在于，所述管理设备将自身当前的告警处理能力通知被管设备的步骤为： The method according to claim 1, wherein the step of the management device notifying the managed device of the current alarm processing capability is:

管理设备将自身当前的告警处理能力直接发送给被管设备。 The management device sends its current alarm processing capability directly to the managed device.

3、根据权利要求 1所述的方法，其特征在于，还包括： 3. The method according to claim 1, further comprising:

管理设备预先在被管设备上为所述管理设备当前的告警处理能力设置相应的管理接口； The management device sets a corresponding management interface on the managed device for the current alarm processing capability of the management device.

所述管理设备将自身当前的告警处理能力通知被管设备的步骤为：管理设备以自身当前的告警处理能力更新所述管理接口，使得被管设备从所述管理接口获取管理设备当前的告警处理能力。 The step of the management device notifying the managed device of the current alarm processing capability is: the management device updates the management interface with its current alarm processing capability, so that the managed device obtains the current alarm processing of the management device from the management interface. ability.

4、根据权利要求 2或 3所述的方法，其特征在于， 4. A method according to claim 2 or 3, characterized in that

所述管理设备当前的告警处理能力为：管理设备当前正在处理的告警流量与管理设备所能够处理的最大告警流量的比值。 The current alarm processing capability of the management device is: a ratio of the alarm traffic currently being processed by the management device to the maximum alarm traffic that the management device can handle.

5、根据权利要求 2或 3所述的方法，其特征在于， 5. A method according to claim 2 or 3, characterized in that

所述管理设备当前的告警处理能力为管理设备当前的告警处理状态，所述管理设备将自身当前的告警处理能力通知被管设备的步骤前，还包括：根据管理设备当前正在处理的告警流量与管理设备所能够处理的最大告警流量的比值，确定管理设备当前的告警处理状态。 The current alarm processing capability of the management device is the current alarm processing state of the management device. Before the step of the management device notifying the current device of the alarm processing capability, the management device further includes: according to the alarm traffic currently being processed by the management device. The ratio of the maximum alarm traffic that can be processed by the management device determines the current alarm processing status of the management device.

6、根据权利要求 5所述的方法，其特征在于，还包括： 6. The method according to claim 5, further comprising:

预先划分至少一个比值范围，为每个比值范围设置对应的告警处理状态；所述根据管理设备当前正在处理的告警流量与管理设备所能够处理的最大告警流量的比值，确定管理设备当前的告警处理状态的步骤包括：统计管理设备当前正在处理的告警流量； Pre-dividing at least one ratio range, and setting a corresponding alarm processing state for each ratio range; the alarm traffic currently processed according to the management device and the maximum processing capacity of the management device The step of determining the current alarm processing status of the management device includes: comparing the alarm traffic currently being processed by the management device;

计算管理设备当前正在处理的告警流量与管理设备所能够处理的最大告警流量的比值； Calculating the ratio of the alarm traffic currently being processed by the management device to the maximum alarm traffic that the management device can handle;

确定所述比值所属的比值范围； Determining a range of ratios to which the ratio belongs;

将所述比值范围所对应的告警处理状态确定为所述管理设备当前的告警处理状态。 The alarm processing status corresponding to the ratio range is determined as the current alarm processing status of the management device.

7、一种控制告警流量的方法，其特征在于，包括： 7. A method for controlling alarm traffic, characterized by comprising:

8、根据权利要求 7所述的方法，其特征在于，所述被管设备获取管理设备当前的告警处理能力的步骤为： The method according to claim 7, wherein the step of the managed device acquiring the current alarm processing capability of the management device is:

被管设备接收来自于管理设备的所述管理设备当前的告警处理能力。 The managed device receives the current alarm processing capability of the management device from the management device.

9、根据权利要求 7所述的方法，其特征在于，所述被管设备获取管理设备当前的告警处理能力的步骤为： The method according to claim 7, wherein the step of the managed device acquiring the current alarm processing capability of the management device is:

被管设备从管理接口获取管理设备当前的告警处理能力；所述管理接口是由管理设备设置在被管设备上的，所述管理设备当前的告警处理能力是由管理设备更新到所述管理接口的。 The managed device obtains the current alarm processing capability of the management device from the management interface; the management interface is set by the management device on the managed device, and the current alarm processing capability of the management device is updated by the management device to the management interface. of.

10、根据权利要求 7 所述的方法，其特征在于，所述管理设备当前的告警处理能力为：管理设备当前正在处理的告警流量与管理设备所能够处理的最大告警流量的比值； The method according to claim 7, wherein the current alarm processing capability of the management device is: a ratio of the alarm traffic currently being processed by the management device to the maximum alarm traffic that the management device can handle;

所述被管设备根据管理设备当前的告警处理能力，釆用相应的告警流量向管理设备上报告警的步骤包括： The step of the managed device reporting the alarm to the management device by using the corresponding alarm traffic according to the current alarm processing capability of the management device includes:

被管设备根据设置的比值范围与告警流量的对应关系，确定与所述管理设备当前正在处理的告警流量与管理设备所能够处理的最大告警流量的比值对应的告警流量，并以所述告警流量向管理设备上报告警； The managed device determines, according to the correspondence between the set ratio range and the alarm traffic, the ratio of the alarm traffic currently being processed by the management device to the maximum alarm traffic that can be processed by the management device. Alarm traffic, and report the alarm to the management device with the alarm traffic;

或者，被管设备根据设置的比值范围与告警处理状态的对应关系，确定与所述管理设备当前正在处理的告警流量与管理设备所能够处理的最大告警流量的比值相应的告警处理状态；根据设置的告警处理状态与告警流量的对应关系，釆用与所述告警处理状态相应的告警流量向管理设备上告警。 Or the managed device determines, according to the correspondence between the set ratio range and the alarm processing state, an alarm processing state corresponding to a ratio of the alarm traffic currently being processed by the management device to the maximum alarm traffic that the management device can process; Corresponding relationship between the alarm processing status and the alarm traffic, and alarming the alarm traffic corresponding to the alarm processing status to the management device.

11、根据权利要求 7 所述的方法，其特征在于，所述管理设备当前的告警处理能力为：管理设备当前的告警处理状态， The method according to claim 7, wherein the current alarm processing capability of the management device is: the current alarm processing status of the management device,

根据设置的告警处理状态与告警流量的对应关系，釆用与所述告警处理状态相应的告警流量向管理设备上报告警。 According to the corresponding relationship between the set alarm processing state and the alarm traffic, the alarm traffic corresponding to the alarm processing state is used to report the alarm to the management device.

12、根据权利要求 10或 11所述的方法，其特征在于，所述根据设置的告警处理状态与告警流量的对应关系，釆用与所述告警处理状态相应的告警流量向管理设备上报告警的步骤包括： The method according to claim 10 or 11, wherein, according to the corresponding relationship between the set alarm processing state and the alarm traffic, the alarm traffic corresponding to the alarm processing state is used to report the alarm to the management device. The steps include:

当管理设备当前的告警处理状态为空闲状态或正常状态时，被管设备正常地向管理设备上报告警； When the current alarm processing status of the management device is the idle state or the normal state, the managed device reports the alarm to the management device normally.

当管理设备当前的告警处理状态为忙状态时，被管设备向管理设备上报重要告警，緩存除所述重要告警之外的所有告警； When the current alarm processing status of the management device is a busy state, the managed device reports a critical alarm to the management device, and caches all alarms except the important alarm.

当管理设备当前的告警处理状态为过载状态时，被管设备緩存所有告警。 When the current alarm processing status of the management device is overloaded, the managed device caches all alarms.

13、根据权利要求 12所述的方法，其特征在于，在所述被管设备緩存告警之后，进一步包括： The method according to claim 12, further comprising: after the managed device caches the alarm, further comprising:

被管设备获取管理设备当前的告警处理状态，若所述当前的告警处理状态为空闲状态或正常状态，且所述当前的告警处理状态的前一个告警处理状态为过载状态或忙状态，则被管设备上报緩存的告警。 The managed device obtains the current alarm processing state of the management device. If the current alarm processing state is an idle state or a normal state, and the previous alarm processing state of the current alarm processing state is an overload state or a busy state, The alarm reported by the device is cached.

14、一种控制告警流量的管理设备，其特征在于，包括： 14. A management device for controlling alarm traffic, characterized in that:

第一流量控制模块（ 530 ), 用于确定所述管理设备当前的告警处理能力，并将所述告警处理能力通知被管设备； The first flow control module (530) is configured to determine a current alarm processing capability of the management device, And notifying the managed device of the alarm processing capability;

告警接收模块（510 ), 用于接收被管设备上报的告警，所述告警是由被管设备根据管理设备当前的告警处理能力，釆用相应的告警流量向管理设备上报的。 The alarm receiving module (510) is configured to receive an alarm reported by the managed device, and the alarm is reported to the management device by the managed device according to the current alarm processing capability of the management device.

15、根据权利要求 14所述的管理设备，其特征在于，所述第一流量控制模块（ 530 ) 包括： The management device according to claim 14, wherein the first flow control module (530) comprises:

确定子模块（531 ), 用于确定所述管理设备当前的告警处理能力；能力通知子模块（ 532 ), 用于将所述管理设备当前的告警处理能力直接发送给被管设备，或者以所述管理设备当前的告警处理能力，更新被管设备上与所述管理设备当前的告警处理能力相应的管理接口。 a determining sub-module (531), configured to determine a current alarm processing capability of the management device; a capability notification sub-module (532), configured to send the current alarm processing capability of the management device directly to the managed device, or The current alarm processing capability of the management device is updated, and the management interface corresponding to the current alarm processing capability of the management device on the managed device is updated.

16、一种控制告警流量的被管设备，其特征在于，包括： 16. A managed device for controlling alarm traffic, characterized by comprising:

第二流量控制模块（620 ), 用于获取管理设备当前的告警处理能力，并根据所述管理设备当前的告警处理能力，确定相应的告警流量； The second flow control module (620) is configured to acquire a current alarm processing capability of the management device, and determine a corresponding alarm traffic according to the current alarm processing capability of the management device;

告警上报模块（610 ), 用于以所述告警流量向管理设备上报告警。 The alarm reporting module (610) is configured to report an alarm to the management device by using the alarm traffic.

17、根据权利要求 16所述的被管设备，其特征在于，所述第二流量控制模块（ 620 ) 包括： The managed device according to claim 16, wherein the second flow control module (620) comprises:

能力获取子模块 ( 621 ) , 用于接收来自于管理设备的所述管理设备当前的告警处理能力，或用于从与所述管理设备当前的告警处理能力相应的管理接口获取管理设备当前的告警处理能力，所述管理设备当前的告警处理能力是由管理设备更新到管理接口的； The capability acquisition sub-module (621) is configured to receive the current alarm processing capability of the management device from the management device, or to obtain a current alarm of the management device from a management interface corresponding to the current alarm processing capability of the management device. Processing capability, the current alarm processing capability of the management device is updated by the management device to the management interface;

流量确定子模块（622 ), 用于根据所述管理设备当前的告警处理能力，确定相应的告警流量。 The traffic determining sub-module (622) is configured to determine a corresponding alarm traffic according to the current alarm processing capability of the management device.

18、一种控制告警流量的***，其特征在于，包括如权利要求 14所述的控制告警流量的管理设备和如权利要求 16所述的控制告警流量的被管设备。 A system for controlling alarm traffic, comprising: a management device for controlling alarm traffic according to claim 14; and a managed device for controlling alarm traffic according to claim 16.