WO2024007631A1 - 故障根因告警定位方法、故障告警模式构建方法和设备 - Google Patents
故障根因告警定位方法、故障告警模式构建方法和设备 Download PDFInfo
- Publication number
- WO2024007631A1 WO2024007631A1 PCT/CN2023/083733 CN2023083733W WO2024007631A1 WO 2024007631 A1 WO2024007631 A1 WO 2024007631A1 CN 2023083733 W CN2023083733 W CN 2023083733W WO 2024007631 A1 WO2024007631 A1 WO 2024007631A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- alarm
- fault
- root
- preset
- alarms
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 117
- 238000010276 construction Methods 0.000 title claims abstract description 42
- 238000004590 computer program Methods 0.000 claims description 25
- 238000003860 storage Methods 0.000 claims description 21
- 230000015654 memory Effects 0.000 claims description 16
- 238000013473 artificial intelligence Methods 0.000 claims description 7
- 238000004220 aggregation Methods 0.000 description 53
- 230000002776 aggregation Effects 0.000 description 46
- 238000010586 diagram Methods 0.000 description 42
- 238000005065 mining Methods 0.000 description 40
- 238000004458 analytical method Methods 0.000 description 14
- 238000012545 processing Methods 0.000 description 13
- 238000004422 calculation algorithm Methods 0.000 description 12
- 238000007726 management method Methods 0.000 description 11
- 230000008569 process Effects 0.000 description 11
- 238000004891 communication Methods 0.000 description 8
- 238000001914 filtration Methods 0.000 description 8
- 238000004088 simulation Methods 0.000 description 7
- 238000012360 testing method Methods 0.000 description 7
- 230000003287 optical effect Effects 0.000 description 6
- 238000005516 engineering process Methods 0.000 description 5
- 239000013589 supplement Substances 0.000 description 5
- 230000000694 effects Effects 0.000 description 4
- 238000012423 maintenance Methods 0.000 description 4
- 238000012544 monitoring process Methods 0.000 description 4
- 238000009825 accumulation Methods 0.000 description 3
- 230000005540 biological transmission Effects 0.000 description 3
- 230000001364 causal effect Effects 0.000 description 3
- 238000009826 distribution Methods 0.000 description 3
- 230000006872 improvement Effects 0.000 description 3
- 230000004931 aggregating effect Effects 0.000 description 2
- 238000010219 correlation analysis Methods 0.000 description 2
- 238000002372 labelling Methods 0.000 description 2
- 238000010295 mobile communication Methods 0.000 description 2
- 239000000047 product Substances 0.000 description 2
- 230000035939 shock Effects 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- 230000001052 transient effect Effects 0.000 description 2
- 239000012190 activator Substances 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000010924 continuous production Methods 0.000 description 1
- 238000009795 derivation Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 239000000835 fiber Substances 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 238000009533 lab test Methods 0.000 description 1
- 230000007774 longterm Effects 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 238000003672 processing method Methods 0.000 description 1
- 238000000926 separation method Methods 0.000 description 1
- 230000007723 transport mechanism Effects 0.000 description 1
- 238000012384 transportation and delivery Methods 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
- 238000013024 troubleshooting Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0677—Localisation of faults
Definitions
- the present application relates to the field of communication technology, and in particular, to a fault root cause alarm locating method, a fault alarm mode construction method and equipment.
- Root alarms can be used to quickly and effectively perform fault analysis. and processing, therefore, root alarm location is crucial. Then, when a fault occurs, the equipment and services related to the fault will also generate a large number of non-root alarms in a short period of time. Such alarms are referred to as derivative alarms; a large number of derivative alarms will submerge the root alarms, causing serious problems. Affects the efficiency of operation and maintenance personnel in handling faults.
- the embodiments of the present application provide a fault root cause alarm locating method, a fault alarm mode construction method and equipment, which can improve the accuracy of root alarm locating.
- a fault root cause alarm locating method which includes: obtaining an aggregate fault, splitting the aggregate fault to obtain multiple sub-faults; for each of the sub-faults, according to the sub-fault The fault and a plurality of preset fault alarm modes determine a target root alarm in the sub-fault, wherein each of the preset fault alarm modes includes a preset root alarm and a preset derivative alarm corresponding to the preset root alarm. ; Merge the target root alarms in all the sub-faults to obtain the final root alarm.
- embodiments of the present application also provide a method for constructing a fault alarm mode, which is used to construct the preset fault alarm mode in the fault root cause alarm positioning method described above; the method for constructing the fault alarm mode
- the method includes: obtaining alarm association rules, wherein the alarm association rules include multiple parent alarms and child alarms directly associated with each of the parent alarms; determining a target parent alarm from the multiple parent alarms, and filtering out related The target parent alarm is directly associated and the target child alarm is indirectly associated; the preset fault alarm mode is constructed according to the target parent alarm and the target child alarm, wherein the preset fault alarm mode Assume that the root alarm is the target parent alarm, and the preset derived alarm in the preset fault alarm mode is the target child alarm.
- embodiments of the present application also provide a network device, including: a memory, a processor, and a computer program stored on the memory and executable on the processor.
- the processor executes the computer program.
- the program implements the fault root cause alarm locating method and/or the fault alarm mode construction method as described previously.
- embodiments of the present application also provide a computer-readable storage medium that stores computer-executable instructions.
- the computer-executable instructions are used to execute the fault root cause alarm locating method and/or the fault as described above.
- Alarm mode construction method is used to execute the fault root cause alarm locating method and/or the fault as described above.
- embodiments of the present application also provide a computer program product, including a computer program or computer instructions.
- the computer program or computer instructions are stored in a computer-readable storage medium, and the processor of the computer device obtains the information from the computer program or computer instructions.
- the computer readable storage medium reads the computer program or the computer instructions, and the processor executes the computer program or the computer instructions, so that the computer device performs the fault root cause alarm locating method as described above. /or fault alarm mode construction method.
- the embodiment of this application will first split the aggregate fault into sub-faults, and use the preset fault alarm mode to match the sub-faults to obtain each sub-fault. The corresponding target root alarm is then merged into the target root alarms of all sub-faults to obtain the final root alarm.
- the embodiments of this application can solve the problem that there is no propagation relationship between different fault alarms, and implement a method of splitting and merging faults, splitting the aggregated faults, locating the root alarms for sub-faults, and then merging the root alarms of the sub-faults. , which can improve the accuracy of root alarm location.
- Figure 1 is a schematic diagram of an implementation environment for executing a fault root cause alarm locating method and/or a fault alarm mode construction method provided by an embodiment of the present application;
- Figure 2 is a flow chart of a fault root cause alarm locating method provided by an embodiment of the present application
- Figure 3 is a specific step diagram of an embodiment of the aggregation fault splitting method in step S100 of Figure 2;
- Figure 4 is a specific step diagram of another embodiment of the aggregation fault splitting method in step S100 of Figure 2;
- Figure 5 is a specific step diagram for sorting and filtering multiple sub-faults provided by an embodiment of the present application
- Figure 6 is a specific step diagram for determining a target root alarm based on the first matching degree provided by an embodiment of the present application
- Figure 7 is a specific step diagram for adjusting the fault alarm in the sub-fault according to the second matching degree according to an embodiment of the present application
- Figure 8 is a specific step diagram for adjusting fault alarms in sub-faults provided by an embodiment of the present application.
- Figure 9 is a specific step diagram for adjusting fault alarms in sub-faults provided by another embodiment of the present application.
- Figure 10 is a specific step diagram of merging target root alarms to obtain the final root alarm provided by an embodiment of the present application
- Figure 11 is a specific step diagram of merging target root alarms to obtain the final root alarm provided by another embodiment of the present application.
- Figure 12 is a flow chart of a fault alarm mode construction method provided by an embodiment of the present application.
- Figure 13 is a flow chart for constructing a fault alarm mode by simulating fault modes according to an embodiment of the present application
- Figure 14 is a specific step diagram for updating multiple preset fault alarm modes according to a simulated fault alarm mode according to an embodiment of the present application
- Figure 15 is a specific step diagram for updating multiple preset fault alarm modes according to a simulated fault alarm mode according to another embodiment of the present application
- Figure 16 is a specific step diagram for updating multiple preset fault alarm modes according to simulated fault alarm modes according to another embodiment of the present application
- Figure 17 is a specific step diagram for updating multiple preset fault alarm modes according to a simulated fault alarm mode according to another embodiment of the present application.
- Figure 18 is a flow chart for constructing a fault alarm mode through artificial intelligence according to an embodiment of the present application.
- Figure 19 is a specific step diagram for updating multiple preset fault alarm modes according to historical fault alarm modes according to an embodiment of the present application
- Figure 20 is a specific step diagram for updating multiple preset fault alarm modes according to historical fault alarm modes provided by another embodiment of the present application.
- Figure 21 is a specific step diagram for updating multiple preset fault alarm modes according to historical fault alarm modes provided by another embodiment of the present application.
- Figure 22 is a specific step diagram for updating multiple preset fault alarm modes according to historical fault alarm modes provided by another embodiment of the present application.
- Figure 23 is an overall structural diagram of an intelligent fault handling system provided by an embodiment of the present application.
- Figure 24 is a flow chart of fault alarm pattern mining provided by an embodiment of the present application.
- Figure 25 is an example diagram of a fault alarm mode provided by an embodiment of the present application.
- Figure 26 is a flow chart of a fault root cause alarm locating method based on a fault alarm mode provided by an embodiment of the present application
- Figure 27 is a flow chart of a fault alarm pattern matching method provided by an embodiment of the present application.
- Figure 28 is a flow chart of fault alarm pattern mining provided by an embodiment of the present application.
- Figure 29 is a flow chart of root alarm positioning based on fault alarm pattern matching provided by an embodiment of the present application.
- Figure 30 is an example diagram of PTN resource topology and fault alarm provided by an embodiment of the present application.
- Figure 31 is a flow chart of sub-fault alarm mode matching provided by an embodiment of the present application.
- Figure 32 is a schematic structural diagram of a network device provided by an embodiment of the present application.
- Root alarms can be used to Fast and effective fault analysis and processing, therefore, root alarm location is crucial.
- the equipment and services related to the fault will also generate a large number of non-root alarms in a short period of time.
- Such alarms are referred to as derivative alarms; a large number of derivative alarms will submerge the root alarms, seriously affecting The efficiency of operation and maintenance personnel in handling faults.
- intelligent fault processing is a technology that performs fault analysis from the fault dimension; its goal is to aggregate the alarms caused by a fault, referred to as fault aggregation, so that only one aggregated fault can be analyzed to avoid analyzing the entire fault. Simultaneous analysis of network alarms facilitates root alarm location and fault analysis and processing, thereby improving operation and maintenance efficiency and reducing operation and maintenance costs.
- alarm correlation analysis is an important method for locating fault root alarms. It uses the propagation or causal relationship between alarms to determine the root alarm.
- AI Artificial Intelligence, artificial intelligence
- alarm correlation rules often cannot cover all alarms, and due to the rapid development of telecommunications networks, New products and technologies are constantly being produced, and the improvement of alarm association rules is a long-term and continuous process; moreover, the mining of alarm association rules requires accurate annotation, which is difficult.
- the location of intelligent fault root alarms often only analyzes aggregated fault alarms, which requires the aggregation of fault alarms to be accurate and comprehensive; however, for telecommunications networks, especially those with complex transmission network types, when fault alarms are aggregated, it is necessary to Alarms related to this fault will inevitably have less or more aggregation. Directly using alarm correlation analysis to analyze aggregated alarms will affect the accuracy of root alarm location.
- embodiments of the present application provide a fault root cause alarm locating method, a fault alarm mode construction method, network equipment, computer-readable storage media and computer program products.
- the fault alarm mode construction method of the embodiment of the present application which can not only make full use of existing alarm correlation rules, but also facilitate the use of simulated faults or artificial intelligence methods for mining, ensuring the efficiency of pattern mining; compared with alarm correlation rules, using fault alarm patterns to locate root alarms has a certain degree of fault tolerance ability.
- the fault root cause alarm locating method of the embodiment of the present application is different from the existing unified processing of fault alarms. The embodiment of the present application will first split the fault into sub-faults according to business or topology.
- fault alarm pattern matching is used to locate the root alarm.
- fault alarm pattern matching is used to merge sub-fault alarms, and finally the root alarm is obtained.
- a secondary analysis and adjustment is performed on the current processing fault and its related faults to solve the problem of too many or too few fault alarms.
- Figure 1 is a schematic diagram of an implementation environment for executing a fault root cause alarm locating method and/or a fault alarm pattern construction method provided by an embodiment of the present application.
- the implementation environment includes but is not limited to the telecommunications device 110 and the management and control device 120 , where the telecommunications device 110 and the management and control device 120 are communicatively connected.
- the above-mentioned telecommunications device 110 may be a general network device.
- the telecommunications equipment 110 may be, but is not limited to, PTN (Packet Transport Network, packet transport network) equipment or OTN (Optical transport network, optical transport network) equipment, etc., or may also be a switch or router, etc.
- PTN Packet Transport Network
- OTN Optical transport network, optical transport network
- the embodiment of the present application is suitable for The type of equipment of the telecommunications equipment 110 is not specifically limited.
- the telecommunications network to which the telecommunications equipment 110 belongs in the embodiment of this application may be a bearer network PTN network, an OTN network or a data center.
- the embodiment of this application does not specifically limit the network type of the telecommunications network to which the telecommunications equipment 110 belongs.
- the above-mentioned management and control device 120 can be one or several servers, or a server cluster, or other network devices with fault root cause alarm locating capabilities and fault alarm mode construction capabilities. This embodiment of the present application does not specifically limit the device type of the management and control device 120 .
- the implementation environment also includes but is not limited to a data transmission network 130, where the data transmission network 130 is a network connecting the management and control equipment 120 and the telecommunications equipment 110, and is used to transmit alarms and logs generated by the telecommunications equipment 110. After the data is transmitted to the management and control device 120, it can also be used to send various network instructions of the management and control device 110 to the corresponding telecommunications device 120.
- the data transmission network 130 is a network connecting the management and control equipment 120 and the telecommunications equipment 110, and is used to transmit alarms and logs generated by the telecommunications equipment 110. After the data is transmitted to the management and control device 120, it can also be used to send various network instructions of the management and control device 110 to the corresponding telecommunications device 120.
- the implementation environment for executing the fault root cause alarm positioning method and/or the fault alarm mode construction method can be applied to 3G communication network systems, LTE communication network systems, 5G communication network systems, and 6G communication networks. system and subsequently evolved mobile communication network systems, etc. This embodiment does not specifically limit this.
- Figure 2 is a flow chart of a fault root cause alarm locating method provided by an embodiment of the present application.
- the fault root cause alarm locating method can be applied to but is not limited to the management and control equipment in Figure 1, which can include but is not limited to Step S100, step S200 and step S300.
- Step S100 Obtain the aggregate fault, split the aggregate fault, and obtain multiple sub-faults
- Step S200 For each sub-fault, determine the target root alarm in the sub-fault according to the sub-fault and multiple preset fault alarm modes, where each preset fault alarm mode includes a preset root alarm and a preset root alarm corresponding to the preset root alarm. Default derived alarm;
- Step S300 Combine the target root alarms in all sub-faults to obtain the final root alarm.
- the embodiment of the present application will first split the aggregate fault into sub-faults, and use the preset fault alarm mode to match the sub-faults to obtain The target root alarm corresponding to each sub-fault is finally merged to obtain the final root alarm.
- the embodiments of this application can solve the problem that there is no propagation relationship between different fault alarms, and implement a method of splitting and merging faults, splitting the aggregated faults, locating the root alarms for sub-faults, and then merging the root alarms of the sub-faults. , which can improve the accuracy of root alarm location.
- the method of splitting aggregation faults in the above step S100 may include but is not limited to the two implementations in Figure 3 and Figure 4, respectively as follows:
- Figure 3 is a specific step diagram of an embodiment of the aggregation fault splitting method in step S100 of Figure 2; regarding the above-mentioned step S100 of splitting the aggregation fault to obtain multiple sub-faults, it may include But it is not limited to step S410.
- Step S410 Split the aggregate fault according to the service type to obtain multiple sub-faults.
- Figure 4 is a specific step diagram of another embodiment of the aggregation fault splitting method in step S100 of Figure 2; regarding the above-mentioned step S100 of splitting the aggregation fault to obtain multiple sub-faults, you can Including but not limited to step S420.
- Step S420 Split the aggregate fault according to the network topology to obtain multiple sub-faults.
- the embodiments of this application can split aggregate faults according to business types or network topologies.
- Alarms for fault aggregation are located in different business types or network topologies. There is no propagation relationship between alarms of different business types or network topologies.
- the embodiment of this application implements a fault splitting and merging method, splitting aggregated faults according to business types or network topology relationships, locating root alarms for sub-faults, and then merging the root alarms of the sub-faults to improve root alarm positioning. accuracy.
- Figure 5 is a specific step diagram for sorting and filtering multiple sub-faults provided by an embodiment of the present application; after obtaining multiple sub-faults in the above step S100, the fault root cause alarm locating method It may also include but is not limited to step S510 and step S520.
- Step S510 Determine the number of alarms in each sub-fault, and sort all sub-faults according to the number of alarms from most to least;
- Step S520 When the first m sub-faults include all fault alarms in the aggregate fault, select the first m sub-faults as target sub-faults to determine the final root alarm from the target sub-faults, where m is a positive integer.
- the subfaults are sorted from the largest to the smallest number of alarms they contain. If the first few subfaults already contain all alarms, the subsequent subfaults are deleted.
- Figure 6 is a specific step diagram for determining a target root alarm based on the first matching degree provided by an embodiment of the present application; regarding the determination based on sub-faults and multiple preset fault alarm modes in the above step S200
- the target root alarm in the sub-fault may include but is not limited to step S610, step S620, step S630 and step S640.
- Step S610 Obtain the priority of each preset fault alarm mode, and select the target preset fault alarm mode from multiple preset fault alarm modes in order of priority from high to low;
- Step S620 Match the target preset fault alarm mode with the subfault to obtain the root alarm and non-root alarm in the subfault;
- Step S630 Determine the first matching degree based on the non-root alarm and the preset derived alarm in the target preset fault alarm mode, where the first matching degree is the intersection of the non-root alarm and the preset derived alarm and the non-root alarm. ratio;
- Step S640 Until the first matching degree is greater than the first preset threshold, use the root alarm as the target root alarm.
- the embodiment of the present application selects the target preset fault alarm mode from multiple preset fault alarm modes in order of priority from high to low, then matches the root alarm in the subfault, and determines the non-standard fault alarm mode in the subfault.
- the root alarm, then the non-root alarm and the preset derivative alarm in the target preset fault alarm mode determine the first matching degree. If the first matching degree is greater than the first preset threshold, the root alarm is used as the target root alarm; if If the first matching degree is less than or equal to the first preset threshold, then the preset fault alarm mode of the next priority is used as the next target preset fault alarm mode, and similar matching steps are performed.
- the first preset threshold may be set in advance, and the embodiment of the present application does not specifically limit the value of the first preset threshold.
- Figure 7 is a specific step diagram for adjusting the fault alarm in the sub-fault according to the second matching degree provided by an embodiment of the present application; in the above step S640, the root alarm is used as the target root alarm.
- the fault root cause alarm locating method may also include but is not limited to step S710, step S720 and step S730.
- Step S710 Determine a second matching degree based on the non-root alarm and the preset derived alarm in the target preset fault alarm mode, where the second matching degree is between the intersection of the non-root alarm and the preset derived alarm and the preset derived alarm. ratio;
- Step S720 If the second matching degree is less than or equal to the second preset threshold, obtain the associated fault corresponding to the aggregated fault;
- Step S730 Adjust the fault alarm in the sub-fault according to the associated fault, the target preset fault alarm mode and the sub-fault.
- the embodiment of the present application will determine the second matching degree based on the non-root alarm and the preset derived alarm in the target preset fault alarm mode. If the second matching degree is less than or equal to the second preset threshold, then the fault alarm in the sub-fault is adjusted according to the associated fault, the target preset fault alarm mode and the sub-fault; if the second matching degree is greater than the second preset threshold, there is no need to adjust the fault alarm in the sub-fault .
- the second preset threshold may be set in advance, and the embodiment of the present application does not specifically limit the value of the second preset threshold.
- the target preset fault alarm mode and the sub-fault in the above step S730 may include but is not limited to the two implementation situations in Figure 8 or Figure 9, respectively as follows :
- Figure 8 is a specific step diagram for adjusting fault alarms in sub-faults provided by an embodiment of the present application; regarding the preset fault alarm mode and sub-fault according to the associated fault, target and sub-fault in the above step S730, Adjusting the fault alarm in the sub-fault may include but is not limited to step S810 and step S820.
- Step S810 When the associated fault and the preset derived alarm in the target preset fault alarm mode include the target fault alarm, and the subfault does not include the target fault alarm;
- Step S820 Adjust the target fault alarm from a related fault to a sub-fault.
- Figure 9 is a specific step diagram for adjusting fault alarms in sub-faults provided by another embodiment of the present application; regarding the preset fault alarm mode and sub-faults based on associated faults and targets in the above step S730, Adjusting the fault alarm in the sub-fault may include but is not limited to step S910 and step S920.
- Step S910 When the preset derived alarm in the associated fault and target preset fault alarm mode does not include the target fault alarm, and the subfault includes the target fault alarm;
- Step S920 Adjust the target fault alarm from a sub-fault to a related fault.
- step S300 of merging the target root alarms in all sub-faults to obtain the final root alarm may include but is not limited to the two implementations in Figure 10 or Figure 11, which are as follows:
- Figure 10 is a specific step diagram for merging target root alarms to obtain the final root alarm provided by an embodiment of the present application; regarding the merging of target root alarms in all sub-faults in the above step S300, Obtaining the final report may include but is not limited to step S1000.
- Step S1000 When the target root alarms in all sub-faults are consistent, the target root alarm is used as the final root alarm.
- Figure 11 is a specific step diagram of merging target root alarms to obtain the final root alarm provided by an embodiment of the present application; regarding the merging of target root alarms in all sub-faults in the above step S300, Obtaining the final report may include but is not limited to step S1100 and step S1120.
- Step S1110 When the target root alarms in all sub-faults are inconsistent, obtain all target root alarms and all non-root alarms in all sub-faults;
- Step S1120 Delete the intersection of all target root alarms and all non-root alarms from all target root alarms to obtain the final root alarm.
- the fault root cause alarm locating method of the embodiments of this application includes but is not limited to the following technical effects:
- the embodiment of this application implements a fault splitting and merging method, and aggregates faults according to business or topology relationships. Split the fault, locate the root alarm for the sub-faults, and then merge the root alarms of the sub-faults to improve the accuracy of root alarm location.
- the pattern matching method is used to realize the root alarm positioning of sub-faults and the merger of root alarms of sub-faults.
- the root alarms and derived alarm clusters are matched separately. There is no need to match two alarms. It has higher universality and improves This improves the accuracy of root alarm location.
- various matching algorithms are supported, such as the Rete algorithm, which ensures the efficiency of pattern matching.
- Figure 12 is a flow chart of a fault alarm mode construction method provided by an embodiment of the present application; the fault alarm mode construction method is used to construct a preset in the fault root cause alarm positioning method of any of the above embodiments.
- the fault alarm mode may include but is not limited to step S1200, step S1300 and step S1400.
- Step S1200 Obtain alarm association rules, where the alarm association rules include multiple parent alarms and child alarms directly associated with each parent alarm;
- Step S1300 Determine the target parent alarm from multiple parent alarms, and filter out the target child alarms that are directly related or indirectly related to the target parent alarm;
- Step S1400 Construct a preset fault alarm mode based on the target parent alarm and the target sub-alarm, where the preset root alarm in the preset fault alarm mode is the target parent alarm, and the preset derivative alarm in the preset fault alarm mode is the target sub-alarm. Alert.
- the embodiment of the present application can be based on pattern mining of alarm association rules, mainly using accumulated alarm association rules to construct a basic fault alarm pattern.
- Figure 13 is a flow chart for constructing a fault alarm mode by simulating a fault mode provided by an embodiment of the present application; in the above step S1400, a preset fault alarm is constructed based on the target parent alarm and the target child alarm.
- the fault alarm mode construction method may also include but is not limited to step S1510, step S1520 and step S1530.
- Step S1510 Obtain the simulated root alarm and the simulated derived alarm corresponding to the simulated root alarm;
- Step S1520 Construct a simulated fault alarm mode based on the simulated root alarm and the simulated derived alarm;
- Step S1530 Update multiple preset fault alarm modes according to the simulated fault alarm mode.
- embodiments of the present application can use a test environment or a simulation environment to manually create or simulate faults based on pattern mining of simulated data, and the generated fault alarm mode can be used as a supplement and improvement to the basic fault alarm mode.
- Figure 14 is a specific step diagram for updating multiple preset fault alarm modes according to a simulated fault alarm mode according to an embodiment of the present application; regarding the above-mentioned step S1530 of updating multiple preset fault alarm modes according to a simulated fault alarm mode,
- the preset fault alarm mode is updated, which may include but is not limited to step S1611 and step S1612.
- Step S1611 When the simulated root alarm and the preset root alarm are consistent;
- Step S1612 Add derivative alarms that exist in the simulated fault alarm mode but do not exist in the preset fault alarm mode to the preset fault alarm mode. In police mode.
- Figure 15 is a specific step diagram for updating multiple preset fault alarm modes according to a simulated fault alarm mode provided by another embodiment of the present application; Regarding the above step S1530, updating multiple preset fault alarm modes according to the simulated fault alarm mode Update a preset fault alarm mode, which may include but is not limited to step S1621, step S1622 and step S1623.
- Step S1621 When the simulated root alarm is a subset of the preset root alarm
- Step S1622 Use the simulated fault alarm mode as a new preset fault alarm mode
- Step S1623 Add derivative alarms that exist in the simulated fault alarm mode but do not exist in the preset fault alarm mode to the preset fault alarm mode.
- Figure 16 is a specific step diagram for updating multiple preset fault alarm modes according to a simulated fault alarm mode provided by another embodiment of the present application; Regarding the above step S1530, updating multiple preset fault alarm modes according to the simulated fault alarm mode Update a preset fault alarm mode, which may include but is not limited to step S1631 and step S1632.
- Step S1631 When the preset root alarm is a subset of the simulated root alarm
- Step S1632 Set the simulated fault alarm mode as a new preset fault alarm mode.
- Figure 17 is a specific step diagram for updating multiple preset fault alarm modes according to the simulated fault alarm mode provided by another embodiment of the present application; Regarding the above step S1530, updating multiple preset fault alarm modes according to the simulated fault alarm mode Update a preset fault alarm mode, which may include but is not limited to step S1641 and step S1642.
- Step S1641 When the simulated root alarm does not exist in the preset fault alarm mode;
- Step S1642 Set the simulated fault alarm mode as a new preset fault alarm mode.
- Figure 18 is a flow chart for constructing a fault alarm mode through artificial intelligence provided by an embodiment of the present application; in the above step S1400, a preset fault alarm is constructed based on the target parent alarm and the target child alarm.
- the fault alarm mode construction method may also include but is not limited to step S1710, step S1720 and step S1730.
- Step S1710 Obtain historical fault alarms and generate historical aggregated faults based on the historical fault alarms
- Step S1720 Use artificial intelligence to mine historical fault alarm patterns from historical aggregated faults
- Step S1730 Update multiple preset fault alarm modes according to historical fault alarm modes.
- the embodiments of this application are capable of AI pattern mining based on fault aggregation alarms, using historical alarms of the monitoring network to aggregate historical alarms into faults based on fault dimensions, and then use AI algorithms to perform pattern mining based on the aggregated faults.
- Figure 19 is a specific step diagram for updating multiple preset fault alarm modes according to historical fault alarm modes provided by one embodiment of the present application; regarding the above-mentioned step S1730 of updating multiple preset fault alarm modes according to historical fault alarm modes,
- the preset fault alarm mode is updated, which may include but is not limited to step S1811 and step S1812.
- Step S1811 When the root alarm in the historical fault alarm mode is consistent with the preset root alarm
- Step S1812 Add derivative alarms that exist in the historical fault alarm mode but do not exist in the preset fault alarm mode to the preset fault alarm mode.
- Figure 20 is a specific step diagram for updating multiple preset fault alarm modes based on historical fault alarm modes provided by another embodiment of the present application; Regarding the above step S1730, updating multiple preset fault alarm modes based on historical fault alarm modes Update a preset fault alarm mode, which may include but is not limited to step S1821, step S1822 and step S1823.
- Step S1821 When the root alarm in the historical fault alarm mode is a subset of the preset root alarm
- Step S1822 Use the historical fault alarm mode as a new preset fault alarm mode
- Step S1823 Add derivative alarms that exist in the historical fault alarm mode but do not exist in the preset fault alarm mode to the preset fault alarm mode.
- Figure 21 is a specific step diagram for updating multiple preset fault alarm modes based on historical fault alarm modes provided by another embodiment of the present application; Regarding the above step S1730, updating multiple preset fault alarm modes based on historical fault alarm modes Update a preset fault alarm mode, which may include but is not limited to step S1831 and step S1832.
- Step S1831 When the preset root alarm is a subset of root alarms in the historical fault alarm mode;
- Step S1832 Use the historical fault alarm mode as a new preset fault alarm mode.
- Figure 22 is a specific step diagram for updating multiple preset fault alarm modes according to historical fault alarm modes provided by another embodiment of the present application; regarding the above-mentioned step S1730 of updating multiple preset fault alarm modes according to historical fault alarm modes, Update a preset fault alarm mode, which may include but is not limited to step S1841 and step S1842.
- Step S1841 When the root alarm in the historical fault alarm mode does not exist in the preset fault alarm mode
- Step S1842 Use the historical fault alarm mode as a new preset fault alarm mode.
- the fault alarm mode construction method of the embodiment of the present application includes but is not limited to the following technical effects:
- the fault alarm mode is defined as the relationship between the root alarm and the derived alarm.
- the derived alarm is an alarm group, which is generated after the root alarm is generated. There is no need to consider the relationship between the derived alarms. Therefore, when mining fault alarm patterns, it is only necessary to aggregate alarms of one type of fault and mark the root alarm. There is no need to dig out the relationship between two alarms, which greatly reduces the difficulty of mining alarm relationships.
- faults can be created or simulated in the test environment, and the relevant alarms generated by the faults are used as a fault alarm mode.
- the root alarm is marked, and other alarms are regarded as derived alarms, and based on the root alarm, they are combined with the existing fault alarms. Compare modes, add new fault alarm modes, or modify existing fault alarm modes.
- fault root cause alarm positioning method and fault alarm mode construction method various embodiments of the overall structure of the intelligent fault handling system of the present application are proposed below.
- Figure 23 is an overall structural diagram of an intelligent fault handling system provided by an embodiment of the present application.
- the system includes but is not limited to an alarm collection module 210, an alarm aggregation module 220, a root alarm positioning module 230, a resource knowledge graph 240 and a fault alarm pattern library 250.
- the functions of each module are as follows:
- the alarm collection module 210 is mainly responsible for alarm collection, filtering, backfilling and distribution of the monitoring network.
- the alarm collection module 210 includes but is not limited to an alarm filtering sub-module 211, an alarm backfilling sub-module 212 and an alarm distribution sub-module 213.
- the main purpose of the alarm filtering sub-module 211 is to filter redundant or invalid alarms, including invalid alarms. , flash alarm, shock alarm, system configured ignorable alarm, etc.
- the main purpose of the alarm backfill sub-module 212 is to add some fields to the alarm, such as the business affected by the alarm, the management and control domain to which the alarm belongs, etc., in order to facilitate alarm aggregation and root alarm location.
- the main purpose of the alarm distribution sub-module 213 is to distribute alarms according to different dimensions in order to process alarms in parallel and ensure the processing efficiency of the system. For example, they can be distributed according to the control domain of the network or according to services.
- the alarm aggregation module 220 is mainly responsible for aggregating alarms that affect the same business or have topological relationships within the same time period, and analyze them according to the fault dimension.
- the aggregated fault may contain one or more sub-faults at the same time.
- the alarm aggregation module 220 includes but is not limited to a fault aggregation sub-module 221 and a conflict merging sub-module 222.
- the main purpose of the fault aggregation sub-module 221 is to select appropriate aggregation methods according to different network types to aggregate alarms. , the purpose is to aggregate alarms of the same dimension together. For example, for SPN static service path scenarios, alarms can be aggregated according to the spatiotemporal method of service and time dimensions.
- the main purpose of the conflict merging sub-module 222 is to conflict merge the results of aggregation in different aggregation methods to form a major fault event. For example, merge multiple faults that occur in the same time period and affect the same business. These faults can occur. on different network elements, boards or interfaces.
- the root alarm locating module 230 is mainly responsible for analyzing the alarms aggregated according to the fault dimension and finding the root alarm of the fault.
- the same fault may contain one or more root alarms.
- the root alarm locating module 230 includes but is not limited to a fault correlation sub-module 231, a pattern matching sub-module 232 and a root alarm recommendation sub-module 233.
- the main purpose of the fault correlation sub-module 231 is: according to time and business or topology dimensions,
- the main purpose of finding faults that are related to the analyzed faults is to perform secondary analysis on over- or under-aggregated alarms in the fault aggregation module during the pattern matching process to improve the accuracy of root alarm location and perform fault aggregation alarms.
- the main purpose of the pattern matching sub-module 232 is to adopt a fault splitting and merging scheme. First, split the fault into sub-faults according to the business or topology dimension, and then use the accumulated fault alarm pattern library to adopt a pattern matching algorithm.
- Root alarm recommendation sub-module 233 performs fault matching, including root alarm matching and derived alarm matching, and divide derived alarm matching into primary matching and secondary matching; at the same time, during pattern matching, alarm adjustments for associated faults are performed, improving the accuracy of fault aggregation and root alarm positioning. sex.
- the main purpose of the root alarm recommendation sub-module 233 is to merge the root alarms of sub-faults. When merging, the merging method is consistent with the above-mentioned pattern matching method, and finally the root alarm of the fault is obtained.
- For the resource knowledge graph 240 it is mainly to solve the problems of traditional network management systems, such as scattered, duplicated, missing, and low query efficiency of topology and business data. It stores network and business data hierarchically and uniformly in the graph database to meet the needs of resources and business. Quickly check requirements.
- the fault alarm pattern library 250 can store fault alarm patterns of various types of faults, including root alarms and derivative alarms.
- the derivative alarms are alarm clusters, and there is no need to mine the propagation relationship between the derivative alarms.
- fault alarm mode construction method of the embodiment of the present application includes three fault alarm mode mining methods.
- the mining of fault alarm patterns fully considers the application of existing alarm correlations and the mining of new fault alarm patterns.
- Mining includes three methods, namely mining based on alarm correlation relationships, mining simulated faults, and mining based on AI.
- mining based on alarm correlation relationships namely mining based on alarm correlation relationships
- mining simulated faults namely mining based on AI.
- mining based on AI namely mining based on AI.
- the mined fault alarm pattern is used to calculate the alarm weight and is used in root alarm location scenarios where fault alarm pattern matching fails.
- the fault alarm mode is a set of alarms caused by a single fault, which contains one or more root alarms and a derived alarm cluster. There is no need to learn the correlation between alarms. Therefore, the fault alarm is greatly reduced. Difficulty of pattern mining.
- the alarm association rule refers to the association or causal relationship between two alarms.
- various major fields such as bearer network SPN, have accumulated a large number of alarm association rules based on manual experience or AI algorithms.
- Typical fault scenarios and root alarm selection First, select a typical alarm for the analyzed network, such as the PTN network, as the root alarm of the fault alarm mode. For example, you can select the operator's dispatch alarm as the root alarm.
- Root alarm labeling For the alarm cluster generated above, mark the selected typical alarms as root alarms. Other alarms will generate a type of fault alarm mode as derivative alarms of this root alarm.
- the second fault module mining method is directly generated from typical faults, making full use of test or simulated fault alarm data as a supplement to the basic fault alarm mode. Specifically, it includes the following steps:
- test environment or simulation environment to artificially create or simulate a typical fault and obtain relevant alarms caused by this fault.
- Fault aggregation Aggregate the collected historical alarms into faults one by one.
- a resource knowledge graph is constructed for the resources or business objects where historical alarms are located to facilitate resource and business query and assist in generating aggregation of fault alarms.
- Fault alarm pattern mining using AI methods, such as frequent itemsets, to mine alarm item sets that meet the support count for aggregated faults. Because in actual networks, the frequency of root alarms is often low. If a general mining algorithm is used, many root alarms will be filtered out. Therefore, it is necessary to filter out faults with typical alarms and then perform pattern mining on the filtered faults.
- Root alarm labeling For faults mined by AI, experts need to mark root alarms, save the faults marked with root alarms, and generate fault alarm mode a.
- the fault root cause alarm locating method in the embodiment of the present application as shown in Figure 26, the fault is first split into sub-faults according to business or topology, and for the sub-faults, fault alarm mode matching is used to locate the root alarm. Finally, fault alarm pattern matching is used to merge sub-fault alarms, and finally the root alarm is obtained. Specifically, it includes but is not limited to the following steps one to seven.
- Step 1 Fault correlation is a fault that has time and business or topology correlation with this fault.
- faults belong to the same business or topology; in terms of time, faults occur within a period of time before and after the fault, such as a fault within ten minutes.
- the purpose of fault correlation is to solve the problem of fault aggregation errors. During fault aggregation, it is inevitable that some alarms of the same fault will be aggregated to other faults, or alarms of other faults will be aggregated to this fault. If correlation processing is not performed, it will Affects the accuracy of root alarm location.
- Step 2 Split by business or topology, which is based on fault aggregation. Splitting by business is preferred. For example, if a fault affects multiple businesses, it can be split according to the business and the alarms belong to different businesses; when splitting, the alarms are classified one by one according to the business. When all the alarms have been distributed, the splitting is stopped. Split all affected businesses.
- Step 3 After the fault is split, multiple sub-faults are generated, and the root alarm is located for each sub-fault.
- Step 4 Extract the alarm identifier. Extract the identifier of each alarm to match the identifier of the fault alarm mode. This identifier is unique to the network. For example, for a PTN network, the alarm type is the resource type where the alarm is located + the alarm code.
- Step 5 Pattern matching, the purpose is to determine the root alarm and derivation of the sub-fault.
- the specific matching method is shown in Figure 27, including but not limited to the steps:
- Root alarm matching is to compare the root alarm in the fault alarm mode with the sub-fault alarm to confirm whether the root alarm is included in the sub-fault Alarm in progress.
- the Rete algorithm such as drools, can be used to set the priority of pattern matching.
- Derived alarm main matching is to select the fault alarm mode with successful root alarm matching and perform derived alarm matching. It is to match the intersection of the derivative alarm of the fault alarm mode and the sub-fault alarm with the sub-fault alarm. This is because the derived alarms of the fault alarm mode are relatively complete, while the alarms of sub-faults will inevitably have the problem of alarm loss or under-aggregation during fault aggregation. Therefore, the derived alarms are matched with the sub-fault alarms and the derived fault alarm modes respectively. Alarms are matched. This step of matching is sub-fault alarm matching.
- Adjustment of associated fault alarms According to the derived alarms in the fault alarm mode, query the same alarm type in the associated faults, and then make a comprehensive judgment based on the time and space dimensions. If the relevant alarms meet the requirements, then the alarms in this part of the associated faults ( If alarm set C) is likely to belong to this fault, alarm set C is temporarily included in this fault, and at the same time, C is deleted from the associated faults.
- Step 6 Merge and analyze fault root alarms. Merge the root alarms of multiple sub-faults. When merging root alarms, the fault alarm mode is also used for analysis. If each sub-fault alarm exists in the fault alarm mode library, use the steps Method six is used to locate the secondary root alarm; otherwise, the root alarms are merged directly.
- Step 7 Output the root alarm. Based on the result of merging the sub-fault root alarms in Step 6, output the root alarm as the recommended root alarm for the fault.
- fault root cause alarm locating method and fault alarm mode construction method Based on the above implementation environment, fault root cause alarm locating method and fault alarm mode construction method, specific embodiments of the fault root cause alarm locating method and fault alarm mode construction method of the present application are proposed below.
- Figure 28 is a flow chart of fault alarm pattern mining provided by an embodiment of the present application; it uses the fault alarm pattern mined by existing alarm association rules as the basic model, and uses simulated data and AI to mine the pattern. It is the supplementary mode, including but not limited to step S2010 to step S2040.
- the fault alarm mode consists of root alarms and derived alarms.
- the root alarm is a direct alarm of the fault and can be used to locate the root cause of the fault.
- the port signal loss alarm that appears is the root cause alarm.
- a large number of other alarms appear, such as the flexible Ethernet port not connected alarm and the flexible Ethernet PHY frame. Loss alarms, tunnel switching alarms, fast rerouting alarms, etc., then the alarms of this fault are grouped together.
- the port signal loss alarm is a root alarm, and other alarms are derivative alarms, generating a type of fault alarm mode.
- Step S2010 Pattern mining based on alarm association rules mainly uses accumulated alarm association rules to build a basic fault alarm pattern. Because telecommunications networks are changing with each passing day, new alarms are constantly appearing, and alarm correlation rules require the continuous accumulation of expert experience and the continuous mining of AI. Therefore, general alarm correlation rules are often difficult to cover all fault scenarios and need to be supplemented by other methods.
- Alarm association rules are the propagation or causal relationship between two alarms. The occurrence of the first alarm often leads to the occurrence of the second alarm. The first alarm is defined as a parent alarm, and the second alarm is defined as a child alarm.
- a schematic table of alarm association rules is shown in Table 1:
- the first step is to select alarms for typical faults in the monitoring network.
- Resource type + alarm code can uniquely identify a type of alarm, which can be expressed as resource type_alarm code. For example, you can refer to the dispatch alarm of the telecommunications network.
- typical alarms include board dislocation 33_62, Ethernet Physical Interface (ETPI) Loss of Signal (LOS) 4203_8, Ethernet Physical Interface (ETPI) Ethernet port not connected 4203_37, L3VPN peer L3VPN Peer unreachable alarm 577_3511, because 577_3511 is a service alarm, which is generally the result of a fault, and is not regarded as a typical fault alarm here.
- the second step is to use the typical alarm as the root alarm and search for sub-alarms level by level as derivative alarms of the root alarm. For example, take 33_62 as the root alarm, and other alarms in the table are derivative alarms, and aggregate the alarms together , identifies the root alarm, which is the fault alarm mode of board dislocation.
- the fault alarm mode of Ethernet Physical Interface (ETPI) Loss of Signal (LOS) is generated; in particular, when the Ethernet physical port fails, 203_8 and 203_37 are often direct alarms of the fault.
- EPI Ethernet Physical Interface
- LOS Loss of Signal
- the third step is to set the priority of fault alarm modes.
- the main purpose is to sort the faults and set different weights to solve the conflict problem of fault alarm mode matching.
- the sorting of fault alarm modes is mainly based on root alarms.
- the derived alarms of mode 1 in Table 2 include root alarms of other modes, and mode 1 has the highest priority.
- This method is the main method for sorting fault alarm modes; in addition, modes Mode 3 and Mode 4 do not have propagation modes, and the two modes have the same priority; Mode 2 is a combination of Mode 3 and Mode 4, and has a higher priority than Mode 2 and Mode 3.
- the priorities of the fault alarm modes in Table 2 are as follows: Mode 1>Mode 2>Mode 3/4, and the priorities of the four fault alarm modes are modified to 1, 2, 3, and 3 respectively.
- Step S2020 pattern mining based on simulation data mainly uses a test environment or simulation environment to manually create or simulate faults, and the generated fault alarm patterns are used to supplement and improve the basic fault alarm patterns.
- the test environment or simulation environment can be a laboratory test environment or a specially built fault simulation environment to ensure that the network configuration is clean and complete.
- Artificially created or simulated faults refer to various types of manual operations that cause various faults, such as plugging and unplugging optical fibers, turning off port fiber activators, modifying communication IP addresses, etc. Only one type of fault is created at a time, and then the generated Alarm data is analyzed.
- the first step is to gradually query the mode of the current mode library from high to low according to the priority of the fault alarm mode in the mode library, check whether the root alarm of the new mode already exists in the current fault alarm mode, and obtain the root alarm containing all the root alarms of the new mode. All modes;
- the root alarms completely match, that is, the type and number of root alarms are consistent, use the derived alarms of the new mode to improve the derived alarms of the corresponding mode in the pattern library.
- the derived alarms that are improved will exist in the new mode but not in the mode.
- the derived alarms of the corresponding patterns in the library are added to the corresponding patterns in the pattern library.
- the new mode root alarm is a subset of the existing mode root alarm
- the new mode is added to the mode library.
- a new fault alarm mode is added to the current fault library.
- the derived alarms of the new mode are added to include the new mode.
- the existing fault alarm mode of the root alarm In the existing fault alarm mode of the root alarm.
- the new pattern is directly added to the pattern library, and a new fault alarm pattern is added to the current pattern library.
- the query result is empty, it means that the new pattern does not exist in the current pattern library, and the new pattern is directly included in the fault alarm pattern library.
- the fourth step is to set the priority for the newly added mode in the fault alarm mode library.
- the setting method is the same as that in step S2010. Among them, the priority is only set for the new mode.
- the existing modes in the mode library do not need to be updated.
- the priorities of the two modes are respectively P 1 and P 2 , then the priority of the new fault alarm mode is (P 1 +P 2 )/2.
- Step S2030 AI pattern mining based on fault aggregation alarms uses historical alarms of the monitoring network to aggregate historical alarms into faults based on fault dimensions, and then uses AI algorithms to perform pattern mining based on the aggregated faults.
- the main methods are as follows:
- the first step is to aggregate historical alarms into faults.
- a resource knowledge graph is first constructed to facilitate resource and business query and assist in generating aggregation of fault alarms.
- the resource knowledge graph or other methods are used to aggregate historical alarms into faults according to time and resource relationships.
- the third step is to use AI methods to mine fault alarm patterns, in which the frequent itemset method can be used. For aggregated faults, mine alarm item sets that match the support count.
- the fourth step is to mark the root alarm by experts for the mined fault alarm mode, and use other alarms as derivative alarms as newly identified faults.
- the fifth step is to use the method in step S2020 to add the newly identified fault to the current fault alarm pattern library.
- Step S2040 Update the newly generated or improved fault alarm mode to the fault alarm mode library, and at the same time, generate a new fault alarm mode query method, or update the existing fault alarm mode query method.
- Figure 29 is a flow chart of root alarm positioning based on fault alarm mode matching provided by an embodiment of the present application
- the target object is an aggregate fault
- the aggregate fault is the collected alarm data, Aggregated according to fault dimensions.
- Alarm filtering is to filter out the collected alarms of the management and control network and filter out alarms that are not related to faults, as well as flapping alarms, intermittent alarms, etc.
- fault aggregation is to aggregate faults for different alarm types, with the purpose of Alarms generated by a fault are aggregated into the fault. For example, alarms can be aggregated according to time and business or topology dimensions.
- the root alarm locating method based on fault alarm pattern matching includes but is not limited to step S2110 to step S2150.
- Step S2110 Fault splitting: split the aggregate fault into multiple sub-faults according to business or topology dimensions.
- the main reason for fault splitting is that when fault conflicts are merged, different sub-faults, because they affect the same business or have the same topology equipment, are merged together. There is no propagation relationship between these sub-fault alarms. If the entire fault is processed at the same time, When analyzing faults, wrong root alarms and derivative alarms are often identified, seriously affecting the accuracy of root alarm location.
- the first step is to split the fault according to the business or network topology affected by the fault.
- Alarms for the same business can be split according to the main and backup links.
- the fault can be divided into sub-fault one and sub-fault two.
- Sub-fault one includes input optical power limit exceeding alarm, derived alarm 11, derived alarm 12, derived alarm 13, derived alarm 31, derived alarm 32 ;
- Subfault two includes the port Down alarm, derivative alarm 21, derivative alarm 22, derivative alarm 23, derivative alarm 31, and derivative alarm 32.
- the second step is subfault selection, in which the subfaults are sorted from the largest to the smallest number of alarms they contain. If the first few subfaults already contain all alarms, the subsequent subfaults are deleted. For example, according to the first step, a fault is split into n sub-faults and sorted by alarms. If the first m sub-faults already contain all fault alarms, only these m sub-faults are selected.
- Step S2120 Extract the alarm identifier. Extract the unique identifier of the alarm.
- the identifier is consistent with the identifier of the fault alarm pattern library and is used for matching the fault alarm mode. For example, for a PTN network, the alarm identifier is resource type restype + alarm code alarmCode.
- Step S2130 sub-fault alarm pattern matching, is to match the fault alarm with the alarm in the pattern library.
- the root alarm is matched first. After the root alarm is successfully matched, the derived alarm is matched. After the match is successful, the root alarm and the derived alarm are output. .
- auxiliary matching can adjust fault aggregation, react on fault aggregation, and improve the accuracy of fault aggregation. sex. As shown in Figure 30, the two sub-faults output an optical power over-limit alarm and a port Down alarm respectively as the root alarms of the two sub-faults.
- Step S2140 Merge sub-fault root alarms. Analyze and merge the root alarms identified by the sub-faults. The merging of sub-fault root alarms is not a simple merging, and the method of step S2130 is used to perform secondary identification of root alarms and obtain the final root alarm. For the two sub-faults in Figure 30, merge them directly. This fault has two root alarms.
- Step S2150 Output the root alarm after merging the sub-faults as the root alarm of the fault for root cause analysis of intelligent faults.
- Figure 31 is a flow chart of sub-fault alarm mode matching provided by an embodiment of the present application; according to the priority of the fault alarm mode, first confirm that all root alarms of the fault alarm mode exist in the sub-fault, and then Then use the derived alarms of the fault alarm mode to match the sub-fault non-root alarms according to the primary matching and auxiliary matching methods, and finally obtain the root alarm of the sub-fault.
- the sub-fault alarm pattern matching method includes but is not limited to step S2210 to step S2260.
- Step S2210 Root alarm matching. Root alarms are matched according to the priority of the fault alarm mode in the fault alarm mode library.
- each fault alarm pattern is sorted, thereby ensuring the matching sequence of fault alarm patterns and eliminating the problem of matching conflicts.
- mode 1 has a higher priority than mode 2.
- the sub-fault alarm contains root alarms of both mode 1 and mode 2. When matching root alarms, mode 1 is matched first.
- the existing pattern matching algorithm can be used.
- the Rete algorithm can be used to automatically perform pattern matching.
- Step S2220 Derived alarm main matching means that after the root alarm is successfully matched, the derived alarm of the fault alarm mode is used to match the non-root alarms of the sub-fault. If the matching accuracy does not reach the set threshold, the pattern matching fails. , continue matching other patterns. For the threshold, set it based on manual experience. For example, you can set the matching degree to 80%.
- the primary matching object of the derived alarm is the non-root alarm of the sub-fault. This is because when fault aggregation occurs, due to network configuration or aggregation algorithm problems, there are often too many or too few fault alarms; and the derivative alarms of the fault alarm mode Relatively accurate and complete, triggered from the perspective of derivative alarm improvement, priority is given to matching non-root alarms of sub-faults.
- the alarm set other than the current fault root alarm is A
- the set of derivative alarms of the fault alarm mode is B
- Step S2230 the auxiliary matching of derived alarms refers to the auxiliary matching performed after the root alarm and the derived alarm are successfully matched.
- the purpose of the auxiliary matching is not to improve the matching accuracy, but to adjust the aggregate fault alarm to improve the accuracy of the aggregate fault. sex.
- the under-aggregation problem can be adjusted through fault correlation; the multi-aggregation problem will not be processed by this fault and will be solved through association. Troubleshooting is completed.
- the threshold is set according to manual experience, for example, it can take a value of 80%.
- An associated fault refers to a fault that has a time, business or topological relationship with the current fault.
- Alarms with multiple or few fault alarms are often alarms of associated faults, or alarms of this fault are aggregated into associated faults. If the fault alarm mode derived alarm, such as alarm type C, is missing in the subfault but exists in the associated fault, alarm C is likely to be mistakenly aggregated into the associated fault and should be adjusted from the associated fault to this fault; similarly, the derived fault The alarm does not exist but the sub-fault exists, such as alarm D, which is likely to be added to this fault by mistake. Alarm D should be adjusted to the related fault after this fault. The analysis and adjustment of alarm D will not be processed during the sub-fault analysis. , and perform analysis and adjustment during associated fault processing.
- Step S2240 Recommend sub-fault root alarms and derived alarms. Based on the above process judgment, the root alarm of the sub-fault and the corresponding derived alarms can be obtained and input into the next process.
- Step S2250 merge sub-fault root alarms.
- the root alarms of the multiple sub-faults need to be merged. If the root alarms of multiple sub-faults are consistent, this alarm is the root alarm of the fault; otherwise, merge the sub-fault root alarms and derived alarms respectively to generate a root alarm list R and a derived alarm list D, and then combine the root and derived alarms. The intersection of , is deleted from the root alarm list and serves as the root alarm of the fault.
- Step S2260 Output the root alarm of the sub-fault, and output the root alarm and derivative alarms analyzed above as the root alarm and derivatives of the sub-fault, ending the process.
- Figure 32 is a schematic structural diagram of a network device provided by an embodiment of the present application; an embodiment of the present application also discloses a network device 400, including: a memory 420, a processor 410 and a storage medium.
- a computer program is stored in the memory 420 and can be run on the processor 410.
- the processor 410 runs the computer program, it executes the fault root cause alarm locating method and/or the fault alarm mode construction method as in any of the previous embodiments.
- the memory 420 can be used to store non-transitory software programs and non-transitory computer executable programs.
- memory 420 may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid-state storage device.
- the memory 420 optionally includes memory located remotely relative to the processor 410, and these remote memories may be connected to the implementation environment through a network. Examples of the above networks include, but do not Limited to the Internet, intranet, local area network, mobile communication network and their combinations.
- the network device 400 in this embodiment can correspond to the BIER observation point or collector in the implementation environment of the embodiment as shown in Figure 1. Both belong to the same application concept, so they have the same implementation principles and beneficial effects. , will not be described in detail here.
- the non-transient software programs and instructions required to implement the fault root cause alarm locating method of the above embodiment are stored in the memory 420. When executed by the processor 410, the fault root cause alarm locating method of the above embodiment is executed.
- non-transient software programs and instructions required to implement the fault warning mode construction method of the above embodiment are stored in the memory 420, and when executed by the processor 410, the fault warning mode construction method of the above embodiment is executed.
- the specific implementation manner and technical effects of the network device 400 in the embodiment of the present application can correspond to the specific implementation methods and technical effects of the above-mentioned fault root cause alarm locating method and/or fault alarm mode construction method.
- an embodiment of the present application also discloses a computer-readable storage medium in which computer-executable instructions are stored.
- the computer-executable instructions are used to execute the fault root cause alarm locating method and/or as in any of the previous embodiments. Method for constructing fault alarm mode.
- an embodiment of the present application also discloses a computer program product, which includes a computer program or computer instructions.
- the computer program or computer instructions are stored in a computer-readable storage medium.
- the processor of the computer device reads the computer program from the computer-readable storage medium.
- the computer program or computer instructions are obtained, and the processor executes the computer program or computer instructions, causing the computer device to perform the fault root cause alarm locating method and/or the fault alarm mode construction method as in any of the previous embodiments.
- Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, Digital Versatile Disk (DVD) or other optical disk storage, magnetic cassettes, tapes, disk storage or other magnetic storage devices, or may Any other medium used to store the desired information and that can be accessed by a computer.
- communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media .
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Alarm Systems (AREA)
- Emergency Alarm Devices (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
本申请公开了一种故障根因告警定位方法、故障告警模式构建方法和设备,其中,故障根因告警定位方法包括:获取聚合故障,对聚合故障进行拆分,得到多个子故障;对于每个所述子故障,根据所述子故障和多个预设故障告警模式确定所述子故障中的目标根告警,其中,每个所述预设故障告警模式包括预设根告警和与所述预设根告警对应的预设衍生告警;对所有所述子故障中的所述目标根告警进行合并,得到最终根告警。
Description
相关申请的交叉引用
本申请基于申请号为202210801417.2、申请日为2022年7月8日的中国专利申请提出,并要求该中国专利申请的优先权,该中国专利申请的全部内容在此引入本申请作为参考。
本申请涉及通信技术领域,尤其是一种故障根因告警定位方法、故障告警模式构建方法和设备。
在电信网络中,当一个故障发生时,往往会产生一个或多个与故障直接相关的告警,这类告警称为故障的根因告警,简称为根告警,利用根告警可以快速有效进行故障分析和处理,因此,根告警定位至关重要。然后,当一个故障发生时,与此故障相关的设备和业务,在短时间内也会产生大量的非根告警,这类告警,简称为衍生告警;大量的衍生告警将根告警淹没其中,严重影响运维人员处理故障的效率。
发明内容
本申请实施例提供了一种故障根因告警定位方法、故障告警模式构建方法和设备,能够提高根告警定位的准确性。
一方面,本申请实施例提供了一种故障根因告警定位方法,包括:获取聚合故障,对所述聚合故障进行拆分,得到多个子故障;对于每个所述子故障,根据所述子故障和多个预设故障告警模式确定所述子故障中的目标根告警,其中,每个所述预设故障告警模式包括预设根告警和与所述预设根告警对应的预设衍生告警;对所有所述子故障中的所述目标根告警进行合并,得到最终根告警。
另一方面,本申请实施例还提供了一种故障告警模式构建方法,用于构建如前面所述的故障根因告警定位方法中的所述预设故障告警模式;所述故障告警模式构建方法包括:获取告警关联规则,其中,所述告警关联规则包括多个父告警和与每个所述父告警直接关联的子告警;从所述多个父告警中确定目标父告警,并筛选出与所述目标父告警直接关联和间接关联的目标子告警;根据所述目标父告警和所述目标子告警构建所述预设故障告警模式,其中,所述预设故障告警模式中的所述预设根告警为所述目标父告警,所述预设故障告警模式中的所述预设衍生告警为所述目标子告警。
另一方面,本申请实施例还提供了一种网络设备,包括:存储器、处理器及存储在所述存储器上并可在所述处理器上运行的计算机程序,所述处理器执行所述计算机程序时实现如前面所述的故障根因告警定位方法和/或故障告警模式构建方法。
另一方面,本申请实施例还提供了一种计算机可读存储介质,存储有计算机可执行指令,所述计算机可执行指令用于执行如前面所述的故障根因告警定位方法和/或故障告警模式构建方法。
另一方面,本申请实施例还提供了一种计算机程序产品,包括计算机程序或计算机指令,所述计算机程序或所述计算机指令存储在计算机可读存储介质中,计算机设备的处理器从所述计算机可读存储介质读取所述计算机程序或所述计算机指令,所述处理器执行所述计算机程序或所述计算机指令,使得所述计算机设备执行如前面所述的故障根因告警定位方法和/或故障告警模式构建方法。
本申请实施例中,区别于现有的针对故障告警的统一处理,本申请实施例首先会将聚合故障拆分为子故障,针对子故障,利用预设故障告警模式进行匹配,得到每个子故障对应的目标根告警,最后再对所有子故障的目标根告警进行合并,得到最终根告警。本申请实施例能够对于不同故障告警之间不具备传播关系问题,实现了故障拆分合并的方法,将聚合故障进行拆分,针对子故障进行根告警定位,再对子故障的根告警进行合并,从而能够提升根告警定位的准确性。
图1是本申请一个实施例提供的用于执行故障根因告警定位方法和/或故障告警模式构建方法的实施环境的示意图;
图2是本申请一个实施例提供的故障根因告警定位方法的流程图;
图3是图2的步骤S100中的聚合故障拆分方式的一个实施例的具体步骤图;
图4是图2的步骤S100中的聚合故障拆分方式的另一个实施例的具体步骤图;
图5是本申请一个实施例提供的对多个子故障进行排序和筛选的具体步骤图;
图6是本申请一个实施例提供的根据第一匹配度确定目标根告警的具体步骤图;
图7是本申请一个实施例提供的根据第二匹配度对子故障中的故障告警进行调整的具体步骤图;
图8是本申请一个实施例提供的对子故障中的故障告警进行调整的具体步骤图;
图9是本申请另一个实施例提供的对子故障中的故障告警进行调整的具体步骤图;
图10是本申请一个实施例提供的对目标根告警进行合并以得到最终根告警的具体步骤图;
图11是本申请另一个实施例提供的对目标根告警进行合并以得到最终根告警的具体步骤图;
图12是本申请一个实施例提供的故障告警模式构建方法的流程图;
图13是本申请一个实施例提供的通过模拟故障方式来构建故障告警模式的流程图;
图14是本申请一个实施例提供的根据模拟故障告警模式对多个预设故障告警模式进行更新的具体步骤图;
图15是本申请另一个实施例提供的根据模拟故障告警模式对多个预设故障告警模式进行更新的具体步骤图;
图16是本申请另一个实施例提供的根据模拟故障告警模式对多个预设故障告警模式进行更新的具体步骤图;
图17是本申请另一个实施例提供的根据模拟故障告警模式对多个预设故障告警模式进行更新的具体步骤图;
图18是本申请一个实施例提供的通过人工智能方式来构建故障告警模式的流程图;
图19是本申请一个实施例提供的根据历史故障告警模式对多个预设故障告警模式进行更新的具体步骤图;
图20是本申请另一个实施例提供的根据历史故障告警模式对多个预设故障告警模式进行更新的具体步骤图;
图21是本申请另一个实施例提供的根据历史故障告警模式对多个预设故障告警模式进行更新的具体步骤图;
图22是本申请另一个实施例提供的根据历史故障告警模式对多个预设故障告警模式进行更新的具体步骤图;
图23是本申请一个实施例提供的智能故障处理***的总体结构图;
图24是本申请一个实施例提供的故障告警模式挖掘的流程图;
图25是本申请一个实施例提供的故障告警模式的示例图;
图26是本申请一个实施例提供的基于故障告警模式的故障根因告警定位方法的流程图;
图27是本申请一个实施例提供的故障告警模式匹配方法的流程图;
图28为本申请一个实施例提供的故障告警模式挖掘的流程图;
图29为本申请一个实施例提供的基于故障告警模式匹配的根告警定位的流程图;
图30为本申请一个实施例提供的PTN资源拓扑及故障告警的示例图;
图31为本申请一个实施例提供的子故障告警模式匹配的流程图;
图32是本申请一个实施例提供的网络设备的结构示意图。
为了使本申请的目的、技术方法及优点更加清楚明白,以下结合附图及实施例,对本申请进行进一步详细说明。应当理解,此处所描述的具体实施例仅用以解释本申请,并不用于限定本申请。
需要说明的是,虽然在流程图中示出了逻辑顺序,但是在某些情况下,可以以不同于流程图中的顺序执行所示出或描述的步骤。说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象,而不必用于描述特定的顺序或先后次序。
在一些情形下,在电信网络中,当一个故障发生时,往往会产生一个或多个与故障直接相关的告警,这类告警称为故障的根因告警,简称为根告警,利用根告警可以快速有效进行故障分析和处理,因此,根告警定位至关重要。然而,当一个故障发生时,与此故障相关的设备和业务,在短时间内也会产生大量的非根告警,这类告警简称为衍生告警;大量的衍生告警将根告警淹没其中,严重影响运维人员处理故障的效率。
另外,关于智能故障处理,就是从故障维度出发,进行故障分析的技术;其目标是将一个故障导致的告警聚合在一起,简称故障聚合,从而只针对一个个聚合的故障进行分析,避免对全网告警同时分析,便于根告警的定位和故障的分析处理,从而提升运维效率,降低运维成本。
另外,关于告警关联分析,是故障根告警定位的重要方法,它利用告警之间的传播或因果关系,确定根告警。通过专家经验的积累及AI(Artificial Intelligence,人工智能)挖掘,各个领域已经积累了大量的告警关联规则。然而,告警关联规则往往不能覆盖所有告警,并且由于电信网络发展日新月异,不
断有新的产品和技术产生,告警关联规则的完善是一个长期持续的过程;而且,告警关联规则的挖掘,需要进行准确性标注,存在一定的难度。
与此同时,智能故障根告警的定位,往往只针对聚合的故障告警进行分析,这需要故障告警的聚合准确而全面;然而对于电信网络,特别是传输网络类型复杂,故障告警聚合的时候,针对此故障的相关告警,难免存在少聚或多聚的情况,直接利用告警关联分析针对聚合的告警进行分析,将会影响根告警定位准确性。
对此,本申请实施例提供了一种故障根因告警定位方法、故障告警模式构建方法、网络设备、计算机可读存储介质和计算机程序产品,其中,对于本申请实施例的故障告警模式构建方法,既可以充分利用已有的告警关联规则,又便于利用模拟故障或人工智能方法进行挖掘,保障了模式挖掘效率;相对于告警相关性规则,利用故障告警模式进行根告警定位,具备一定的容错能力。另外,对于本申请实施例的故障根因告警定位方法,不同于现有的针对故障告警的统一处理,本申请实施例首先会将故障按照业务或者拓扑拆分为子故障,针对子故障,利用故障告警模式匹配,进行根告警定位,最后利用故障告警模式匹配,进行子故障告警的合并,最终得到根告警。在故障匹配过程中,对当前处理故障及其具备关联关系的故障进行了二次分析调整,解决故障告警多聚或少聚问题。
下面结合附图,对本申请实施例作进一步阐述。
如图1所示,图1是本申请一个实施例提供的用于执行故障根因告警定位方法和/或故障告警模式构建方法的实施环境的示意图。
在图1的示例中,该实施环境包括但不限于电信设备110和管控设备120,其中,电信设备110和管控设备120之间通信连接。
在一实施例中,关于上述的电信设备110,可以为通用的网络设备。具体地,电信设备110可以但不限于为PTN(Packet Transport Network,分组传送网络)设备或者OTN(Optical transport network,光传送网络)设备等,也可以为交换机或者路由器等设备,本申请实施例对电信设备110的设备类型不作具体限定。另外,本申请实施例的电信设备110所属的电信网络,可以为承载网PTN网络、OTN网络或者数据中心等,本申请实施例对电信设备110所属电信网络的网络类型不作具体限定。
另外,在一实施例中,关于上述的管控设备120,可以为一台或几台服务器,或者为服务器集群,也可以为其他具备故障根因告警定位能力和故障告警模式构建能力的网络设备,本申请实施例对管控设备120的设备类型不作具体限定。
另外,在一实施例中,该实施环境还包括但不限于数据传输网络130,其中,数据传输网络130为连接管控设备120和电信设备110的网络,用于将电信设备110产生的告警、日志等数据传送到管控设备120,也可以用于将管控设备110的各类网络指令发送到对应的电信设备120。
另外,图1中的示例仅仅为本申请一个实施例的应用场景,不作为本申请应用场景的限制。
本领域技术人员可以理解的是,用于执行故障根因告警定位方法和/或故障告警模式构建方法的实施环境可以应用于3G通信网络***、LTE通信网络***、5G通信网络***、6G通信网络***以及后续演进的移动通信网络***等,本实施例对此并不作具体限定。
本领域技术人员可以理解的是,图1中示出的实施环境并不构成对本申请实施例的限定,可以包括比图示更多或更少的部件,或者组合某些部件,或者不同的部件布置。
基于上述实施环境,下面提出本申请的故障根因告警定位方法的各个实施例。
如图2所示,图2是本申请一个实施例提供的故障根因告警定位方法的流程图,该故障根因告警定位方法可以应用但不限于图1中的管控设备,可以包括但不限于步骤S100、步骤S200和步骤S300。
步骤S100、获取聚合故障,对聚合故障进行拆分,得到多个子故障;
步骤S200、对于每个子故障,根据子故障和多个预设故障告警模式确定子故障中的目标根告警,其中,每个预设故障告警模式包括预设根告警和与预设根告警对应的预设衍生告警;
步骤S300、对所有子故障中的目标根告警进行合并,得到最终根告警。
具体地,本申请实施例中,区别于现有的针对故障告警的统一处理,本申请实施例首先会将聚合故障拆分为子故障,针对子故障,利用预设故障告警模式进行匹配,得到每个子故障对应的目标根告警,最后再对所有子故障的目标根告警进行合并,得到最终根告警。本申请实施例能够对于不同故障告警之间不具备传播关系问题,实现了故障拆分合并的方法,将聚合故障进行拆分,针对子故障进行根告警定位,再对子故障的根告警进行合并,从而能够提升根告警定位的准确性。
另外,关于上述步骤S100中的对聚合故障的拆分方式,可以包括但不限于图3和图4中的两种实施情况,分别如下:
如图3所示,图3是图2的步骤S100中的聚合故障拆分方式的一个实施例的具体步骤图;关于上述步骤S100中的对聚合故障进行拆分,得到多个子故障,可以包括但不限于步骤S410。
步骤S410、根据业务类型对聚合故障进行拆分,得到多个子故障。
如图4所示,图4是图2的步骤S100中的聚合故障拆分方式的另一个实施例的具体步骤图;关于上述步骤S100中的对聚合故障进行拆分,得到多个子故障,可以包括但不限于步骤S420。
步骤S420、根据网络拓扑对聚合故障进行拆分,得到多个子故障。
具体地,本申请实施例能够根据业务类型或者网络拓扑对聚合故障进行拆分,针对故障聚合的告警位于不同业务类型或者网络拓扑,不同业务类型或者网络拓扑的告警之间不具备传播关系问题,本申请实施例实现了故障拆分合并的方法,将聚合故障按照业务类型或者网络拓扑关系进行拆分,针对子故障进行根告警定位,再对子故障的根告警进行合并,提升了根告警定位的准确性。
另外,如图5所示,图5是本申请一个实施例提供的对多个子故障进行排序和筛选的具体步骤图;在上述步骤S100中的得到多个子故障之后,该故障根因告警定位方法还可以包括但不限于步骤S510和步骤S520。
步骤S510、确定每个子故障中的告警数量,并按照告警数量由多到少对所有子故障进行排序;
步骤S520、在前m个子故障包括聚合故障中的所有故障告警的情况下,选择前m个子故障作为目标子故障,以从目标子故障中确定最终根告警,其中,m为正整数。
具体地,将子故障按照包含的告警数量由多到少进行排序,如果前几个子故障已经包含所有告警,则将后面的子故障删除。
另外,如图6所示,图6是本申请一个实施例提供的根据第一匹配度确定目标根告警的具体步骤图;关于上述步骤S200中的根据子故障和多个预设故障告警模式确定子故障中的目标根告警,可以包括但不限于步骤S610、步骤S620、步骤S630和步骤S640。
步骤S610、获取每个预设故障告警模式的优先级,并按照优先级由高到低的顺序从多个预设故障告警模式中选择目标预设故障告警模式;
步骤S620、将目标预设故障告警模式与子故障进行匹配,得到子故障中的根告警和非根告警;
步骤S630、根据非根告警和目标预设故障告警模式中的预设衍生告警确定第一匹配度,其中,第一匹配度为非根告警和预设衍生告警的交集与非根告警之间的比值;
步骤S640、直到第一匹配度大于第一预设阈值,将根告警作为目标根告警。
具体地,本申请实施例会按照优先级由高到低的顺序从多个预设故障告警模式中选择目标预设故障告警模式,然后匹配得到子故障中的根告警,并确定子故障中的非根告警,接着再非根告警和目标预设故障告警模式中的预设衍生告警确定第一匹配度,如果该第一匹配度大于第一预设阈值,则将根告警作为目标根告警;如果该第一匹配度小于或等于第一预设阈值,则按照下一优先级的预设故障告警模式作为下一个目标预设故障告警模式,并执行上述类似的匹配步骤。
其中,第一预设阈值可以为预先设置的,本申请实施例对第一预设阈值的取值不作具体限定。
另外,如图7所示,图7是本申请一个实施例提供的根据第二匹配度对子故障中的故障告警进行调整的具体步骤图;在上述步骤S640中的将根告警作为目标根告警之后,该故障根因告警定位方法还可以包括但不限于步骤S710、步骤S720和步骤S730。
步骤S710、根据非根告警和目标预设故障告警模式中的预设衍生告警确定第二匹配度,其中,第二匹配度为非根告警和预设衍生告警的交集与预设衍生告警之间的比值;
步骤S720、在第二匹配度小于或等于第二预设阈值的情况下,获取与聚合故障对应的关联故障;
步骤S730、根据关联故障、目标预设故障告警模式和子故障,对子故障中的故障告警进行调整。
具体地,确定了目标根告警之后,本申请实施例会根据非根告警和目标预设故障告警模式中的预设衍生告警确定第二匹配度,如果该第二匹配度小于或等于第二预设阈值,则根据关联故障、目标预设故障告警模式和子故障,对子故障中的故障告警进行调整;如果该第二匹配度大于第二预设阈值,则无需对子故障中的故障告警进行调整。
其中,第二预设阈值可以为预先设置的,本申请实施例对第二预设阈值的取值不作具体限定。
另外,关于上述步骤S730中的根据关联故障、目标预设故障告警模式和子故障,对子故障中的故障告警进行调整,可以包括但不限于图8或者图9中的两种实施情况,分别如下:
如图8所示,图8是本申请一个实施例提供的对子故障中的故障告警进行调整的具体步骤图;关于上述步骤S730中的根据关联故障、目标预设故障告警模式和子故障,对子故障中的故障告警进行调整,可以包括但不限于步骤S810和步骤S820。
步骤S810、当关联故障和目标预设故障告警模式中的预设衍生告警包括目标故障告警,并且子故障中没有包括目标故障告警;
步骤S820、将目标故障告警由关联故障调整到子故障。
如图9所示,图9是本申请另一个实施例提供的对子故障中的故障告警进行调整的具体步骤图;关于上述步骤S730中的根据关联故障、目标预设故障告警模式和子故障,对子故障中的故障告警进行调整,可以包括但不限于步骤S910和步骤S920。
步骤S910、当关联故障和目标预设故障告警模式中的预设衍生告警没有包括目标故障告警,并且子故障中包括目标故障告警;
步骤S920、将目标故障告警由子故障调整到关联故障。
另外,关于上述步骤S300中的对所有子故障中的目标根告警进行合并,得到最终根告,可以包括但不限于图10或者图11中的两种实施情况,分别如下:
如图10所示,图10是本申请一个实施例提供的对目标根告警进行合并以得到最终根告警的具体步骤图;关于上述步骤S300中的对所有子故障中的目标根告警进行合并,得到最终根告,可以包括但不限于步骤S1000。
步骤S1000、当所有子故障中的目标根告警一致,将目标根告警作为最终根告警。
如图11所示,图11是本申请一个实施例提供的对目标根告警进行合并以得到最终根告警的具体步骤图;关于上述步骤S300中的对所有子故障中的目标根告警进行合并,得到最终根告,可以包括但不限于步骤S1100和步骤S1120。
步骤S1110、当所有子故障中的目标根告警不一致,获取所有子故障中的所有目标根告警和所有非根告警;
步骤S1120、从所有目标根告警中删去所有目标根告警和所有非根告警的交集,得到最终根告警。
基于上述各个实施例的故障根因告警定位方法,本申请实施例的故障根因告警定位方法包括但不限于如下技术效果:
首先,针对故障聚合的告警位于不同业务或者拓扑,不同业务或者拓扑的告警之间不具备传播关系问题,本申请实施例实现了故障拆分合并的方法,将聚合故障,按照业务或拓扑关系,进行拆分,针对子故障进行根告警定位,再对子故障的根告警进行合并,提升了根告警定位的准确性。
其次,利用模式匹配方法,实现了子故障的根告警定位和子故障的根告警合并,对根告警和衍生告警簇分别进行匹配,不需要两两告警进行匹配,具备更高的普适性,提升了根告警定位的准确性。其中,在模式匹配时,支持各类匹配算法,例如Rete算法,保证了模式匹配的效率。
再次,针对故障告警聚合时,存在的告警多聚或少聚问题,在模式匹配过程中,对分析故障及具备时间和业务或者拓扑关联的故障,进行了二次分析和告警调整,反作用于聚合故障,提升了故障聚合告警的准确性。
基于上述实施环境和故障根因告警定位方法,下面提出本申请的故障告警模式构建方法的各个实施例。
如图12所示,图12是本申请一个实施例提供的故障告警模式构建方法的流程图;该故障告警模式构建方法用于构建上述任一实施例的故障根因告警定位方法中的预设故障告警模式,可以包括但不限于步骤S1200、步骤S1300和步骤S1400。
步骤S1200、获取告警关联规则,其中,告警关联规则包括多个父告警和与每个父告警直接关联的子告警;
步骤S1300、从多个父告警中确定目标父告警,并筛选出与目标父告警直接关联和间接关联的目标子告警;
步骤S1400、根据目标父告警和目标子告警构建预设故障告警模式,其中,预设故障告警模式中的预设根告警为目标父告警,预设故障告警模式中的预设衍生告警为目标子告警。
具体地,本申请实施例可以基于告警关联规则的模式挖掘,主要利用已经积累的告警关联规则,构建基础的故障告警模式。
另外,如图13所示,图13是本申请一个实施例提供的通过模拟故障方式来构建故障告警模式的流程图;在上述步骤S1400中的根据目标父告警和目标子告警构建预设故障告警模式之后,该故障告警模式构建方法还可以包括但不限于步骤S1510、步骤S1520和步骤S1530。
步骤S1510、获取模拟根告警和与模拟根告警对应的模拟衍生告警;
步骤S1520、根据模拟根告警和模拟衍生告警构建模拟故障告警模式;
步骤S1530、根据模拟故障告警模式对多个预设故障告警模式进行更新。
具体地,本申请实施例能够基于模拟数据的模式挖掘,利用测试环境或模拟环境,进行人工制造或模拟故障,生成的故障告警模式,用作基础故障告警模式的补充和完善。
另外,关于上述步骤S1530中的根据模拟故障告警模式对多个预设故障告警模式进行更新,可以包括但不限于图14至图17中的四种实施情况,分别如下:
如图14所示,图14是本申请一个实施例提供的根据模拟故障告警模式对多个预设故障告警模式进行更新的具体步骤图;关于上述步骤S1530中的根据模拟故障告警模式对多个预设故障告警模式进行更新,可以包括但不限于步骤S1611和步骤S1612。
步骤S1611、当模拟根告警和预设根告警一致;
步骤S1612、将存在于模拟故障告警模式而不存在于预设故障告警模式的衍生告警添加至预设故障告
警模式中。
如图15所示,图15是本申请另一个实施例提供的根据模拟故障告警模式对多个预设故障告警模式进行更新的具体步骤图;关于上述步骤S1530中的根据模拟故障告警模式对多个预设故障告警模式进行更新,可以包括但不限于步骤S1621、步骤S1622和步骤S1623。
步骤S1621、当模拟根告警为预设根告警的子集;
步骤S1622、将模拟故障告警模式作为新的预设故障告警模式;
步骤S1623、将存在于模拟故障告警模式而不存在于预设故障告警模式的衍生告警添加至预设故障告警模式中。
如图16所示,图16是本申请另一个实施例提供的根据模拟故障告警模式对多个预设故障告警模式进行更新的具体步骤图;关于上述步骤S1530中的根据模拟故障告警模式对多个预设故障告警模式进行更新,可以包括但不限于步骤S1631和步骤S1632。
步骤S1631、当预设根告警为模拟根告警的子集;
步骤S1632、将模拟故障告警模式作为新的预设故障告警模式。
如图17所示,图17是本申请另一个实施例提供的根据模拟故障告警模式对多个预设故障告警模式进行更新的具体步骤图;关于上述步骤S1530中的根据模拟故障告警模式对多个预设故障告警模式进行更新,可以包括但不限于步骤S1641和步骤S1642。
步骤S1641、当模拟根告警没有存在于预设故障告警模式中;
步骤S1642、将模拟故障告警模式作为新的预设故障告警模式。
另外,如图18所示,图18是本申请一个实施例提供的通过人工智能方式来构建故障告警模式的流程图;在上述步骤S1400中的根据目标父告警和目标子告警构建预设故障告警模式之后,该故障告警模式构建方法还可以包括但不限于步骤S1710、步骤S1720和步骤S1730。
步骤S1710、获取历史故障告警,并根据历史故障告警生成历史聚合故障;
步骤S1720、采用人工智能方式从历史聚合故障中挖掘得到历史故障告警模式;
步骤S1730、根据历史故障告警模式对多个预设故障告警模式进行更新。
具体地,本申请实施例能够基于故障聚合告警的AI模式挖掘,利用监控网络的历史告警,基于故障维度,将历史告警聚合为一个个故障,然后针对聚合的故障,利用AI算法进行模式挖掘。
另外,关于上述步骤S1730中的根据历史故障告警模式对多个预设故障告警模式进行更新,可以包括但不限于图19至图22中的四种实施情况,分别如下:
如图19所示,图19是本申请一个实施例提供的根据历史故障告警模式对多个预设故障告警模式进行更新的具体步骤图;关于上述步骤S1730中的根据历史故障告警模式对多个预设故障告警模式进行更新,可以包括但不限于步骤S1811和步骤S1812。
步骤S1811、当历史故障告警模式中的根告警和预设根告警一致;
步骤S1812、将存在于历史故障告警模式而不存在于预设故障告警模式的衍生告警添加至预设故障告警模式中。
如图20所示,图20是本申请另一个实施例提供的根据历史故障告警模式对多个预设故障告警模式进行更新的具体步骤图;关于上述步骤S1730中的根据历史故障告警模式对多个预设故障告警模式进行更新,可以包括但不限于步骤S1821、步骤S1822和步骤S1823。
步骤S1821、当历史故障告警模式中的根告警为预设根告警的子集;
步骤S1822、将历史故障告警模式作为新的预设故障告警模式;
步骤S1823、将存在于历史故障告警模式而不存在于预设故障告警模式的衍生告警添加至预设故障告警模式中。
如图21所示,图21是本申请另一个实施例提供的根据历史故障告警模式对多个预设故障告警模式进行更新的具体步骤图;关于上述步骤S1730中的根据历史故障告警模式对多个预设故障告警模式进行更新,可以包括但不限于步骤S1831和步骤S1832。
步骤S1831、当预设根告警为历史故障告警模式中的根告警的子集;
步骤S1832、将历史故障告警模式作为新的预设故障告警模式。
如图22所示,图22是本申请另一个实施例提供的根据历史故障告警模式对多个预设故障告警模式进行更新的具体步骤图;关于上述步骤S1730中的根据历史故障告警模式对多个预设故障告警模式进行更新,可以包括但不限于步骤S1841和步骤S1842。
步骤S1841、当历史故障告警模式中的根告警没有存在于预设故障告警模式中;
步骤S1842、将历史故障告警模式作为新的预设故障告警模式。
基于上述各个实施例的故障告警模式构建方法,本申请实施例的故障告警模式构建方法包括但不限于如下技术效果:
将故障告警模式定义为根告警和衍生告警的关系,衍生告警为一个告警组,均在根告警产生后产生,不需要考虑衍生告警之间的关系。因此,在故障告警模式挖掘时,只需将一类故障的告警聚合起来,标注出根告警,不必挖掘两两告警之间的关系,大大降低告警关系挖掘的难度。
首先,利用已有的告警关联规则,构建初步的故障告警模式。以重要的告警为根告警,例如,可以选择运营商的派单告警,利用告警相关性规则,逐级找到此告警的所有相关告警,作为衍生告警。这样,既充分利用了现有的基于专家和AI挖掘的告警关联规则,又获得了需要的故障告警模式。
其次,可以在测试环境制造或者模拟故障,将故障产生的相关告警,作为一个故障告警模式,根据故障的类型,标注根告警,其他告警作为衍生告警,并根据根告警,与已有的故障告警模式比较,增加新的故障告警模式,或者修改现有的故障告警模式。
再次,可以利用已经形成的历史告警,按照时间和业务类型或者拓扑维度聚合为一个个故障;考虑到重大故障,在网络中发生的次数相对较少,不同于告警相关性的挖掘,模式匹配的挖掘相对简单,只关注具备重要告警的相关故障,结合频繁项集等AI方法,获取故障告警模式;故障告警模式只需挖掘告警簇,标注出根告警,不需要挖掘出两两告警之间的关系,从而大大降低了挖掘难度。
基于上述实施环境、故障根因告警定位方法和故障告警模式构建方法,下面提出本申请的智能故障处理***总体结构的各个实施例。
如图23所示,图23是本申请一个实施例提供的智能故障处理***的总体结构图。该***包括但不限于告警采集模块210、告警聚合模块220、根告警定位模块230、资源知识图谱240和故障告警模式库250,其各个模块的功能分别如下:
对于告警采集模块210,主要负责监控网络的告警采集、过滤、回填和分发。其中,告警采集模块210包括但不限于告警过滤子模块211、告警回填子模块212和告警分发子模块213,其中,告警过滤子模块211的主要目的是:过滤冗余或无效告警,包括无效告警、闪断告警、震荡告警、***配置的可忽略告警等。告警回填子模块212的主要目的是:为了便于告警聚合和根告警定位,在告警中增加部分字段,如告警影响的业务、告警所属的管控域等。告警分发子模块213的主要目的是:为了告警并行处理,保证***的处理效率,而将告警按照不同的维度进行分发,例如可以按照网络的管控域进行分发或按业务分发等。
对于告警聚合模块220,主要负责将同一时间段内,影响同一业务或具备拓扑关系的告警,聚合在一起,按照故障维度进行分析,聚合故障可能同时包含一个或多个子故障。其中,告警聚合模块220包括但不限于故障聚合子模块221和冲突合并子模块222,其中,故障聚合子模块221的主要目的是:根据不同的网络类型,选用合适的聚合方法,进行告警的聚合,目的是将同一维度的告警聚合在一起。例如,针对SPN静态业务路径场景,可以按照业务和时间维度的时空方法,进行告警的聚合。冲突合并子模块222的主要目的是:将不同聚合方式聚合的结果进行冲突合并,形成故障大事件,例如,将发生在同一时间段内,影响同一业务的多个故障进行合并,这些故障可以发生在不同网元、单板或接口。
对于根告警定位模块230,主要负责将按照故障维度聚合的告警同一分析,找到故障的根告警,同一个故障可能含有一个或多个根告警。其中,根告警定位模块230包括但不限于故障关联子模块231、模式匹配子模块232和根告警推荐子模块233,其中,故障关联子模块231的主要目的是:按照时间和业务或者拓扑维度,找到与分析故障具有关联关系的故障,主要目的,是模式匹配过程中,针对故障聚合模块多聚或少聚的告警进行二次分析,以提升根告警定位的准确性,并进行故障聚合告警的调整,从而反作用于聚合故障。例如,按照时间维度进行故障聚合时,因不同类型故障的告警发生的时间差别较大,某个故障的告警,有可能聚合到其他故障,或者将其他故障的告警聚合到本故障。模式匹配子模块232的主要目的是:采用了故障拆分和合并的方案,首先,按照业务或拓扑维度,将故障拆分为子故障,然后利用已经积累的故障告警模式库,采用模式匹配算法进行故障匹配,包括根告警匹配和衍生告警匹配,又将衍生告警匹配分为主匹配和辅匹配;同时,在模式匹配时,进行关联故障的告警调整,提升了故障聚合和根告警定位的准确性。根告警推荐子模块233的主要目的是:针对子故障的根告警进行合并,合并时,合并方法与上述的模式匹配方法一致,最后获得故障的根告警。
对于资源知识图谱240,主要是为了解决传统的网管***,拓扑和业务数据保存分散、重复、缺失、查询效率低等问题,将网络和业务的数据分层统一存储在图数据库,满足资源和业务快速查询需求。
对于故障告警模式库250,可以保存各类故障的故障告警模式,包括根告警和衍生告警,衍生告警为告警簇,不需要挖掘衍生告警之间的传播关系。
基于上述智能故障处理***总体结构,下面提出本申请的故障告警模式构建方法和故障根因告警定位方法的各个实施例。
关于本申请实施例的故障告警模式构建方法,如图24所示,包括三种故障告警模式挖掘方式。
故障告警模式的挖掘,充分考虑了现有告警关联的应用,以及新的故障告警模式的挖掘,挖掘包括三种方法,即基于告警关联关系挖掘、模拟故障挖掘,以及基于AI挖掘,同时,针对挖掘的故障告警模式,进行告警权重的计算,用于故障告警模式匹配失败的根告警定位场景。
如图25所示,故障告警模式为一个单一故障导致的告警集合,其中,包含一个或多个根告警,一个衍生告警簇,不需要学习告警之间的关联关系,因此,大大降低了故障告警模式挖掘的难度。
对于第一种故障模块挖掘方法,充分利用了现有的告警关联规则,生成基础的故障告警模式。经过人工经验的积累和利用AI的挖掘,现在各个领域积累了大量的告警关联规则,故障告警模式挖掘之一,就是从现有的告警关联规则中获取。针对不同的网络,选取典型的故障场景和告警,以选取的告警为根告警,按照关联规则,逐级查询关联告警,作为根告警的衍生告警,即为一个故障告警模式。具体包括如下步骤:
1、选取已有的告警关联规则,该告警关联规则是指两两告警之间的关联或因果关系。截止目前,各大领域,如承载网SPN,均基于人工经验或AI算法,积累了大量的告警关联规则。
2、典型故障场景和根告警选择,首先,针对所分析的网络,如PTN网络,选择典型的告警,作为故障告警模式的根告警,例如,可以选择运营商的派单告警,作为根告警。
3、从根告警开始,进行衍生告警的抽取。从选取的根告警开始,获得此告警的关联告警,作为衍生告警,再以获得的衍生告警为基础,继续查询其关联告警,直至获取所有相关告警。
4、根告警标注,针对上述生成的告警簇,将开始选择的典型告警,进行标注,作为根告警,其他告警,为此根告警的衍生告警,生成一类故障告警模式。
对于第二种故障模块挖掘方法,从典型故障中直接生成,充分利用了测试或模拟的故障告警数据,作为基础故障告警模式的补充。具体包括如下步骤:
1、人工模拟故障,可以利用产品测试的数据,也可以专门进行故障模拟。利用测试环境或者模拟环境,人工制造或模拟一个典型故障,获得此故障导致的相关告警。
2、根据经验,将此故障无关告警过滤,如震荡告警等。
3、人工标注此故障的根告警,其他告警作为衍生告警,作为初步的故障告警模式,如模式a。
4、进行故障告警模式的比对和优化。比对时,按照根告警进行匹配,如根告警存在于故障告警模式库中,如故障告警模式A,则利用新生成的模式a对故障告警模式A进行优化。这是因为现存的告警关联规则往往不够全面,难以涵盖所有的场景和告警,从而导致基于告警关联规则生成的基础故障告警模式不够全面,因此,可以将模式a的衍生告警合并到模式A。如果模式a的根告警在模式库中不存在,则直接将模式a存入模式库,作为一种新挖掘的故障告警模式。
对于第三种故障模块挖掘方法,可以利用历史告警进行故障聚合,然后采用AI算法挖掘,此方法,同样作为基础故障告警模式的补充。具体包括如下步骤:
1、聚合故障,将采集的历史告警,聚合为一个个的故障。其中,针对历史告警所在的资源或者业务对象,构建资源知识图谱,便于资源和业务的查询,辅助生成故障告警的聚合。利用资源知识图谱或者其他方式,将历史告警,按照时间和资源关系,聚合成一个个的故障。
2、故障告警模式挖掘,利用AI方法,如频繁项集,针对聚合的故障,挖掘符合支持度计数的告警项集。因为实际网络中,根告警出现的频率往往较低,如果采用一般的挖掘算法,很多根告警被过滤掉,因此,需要将具备典型告警的故障筛选出来,再对筛选的故障进行模式挖掘。
3、根告警标注,针对AI挖掘的故障,需要专家进行标注根告警,将标注根告警的故障进行保存,生成故障告警模式a。
4、进行故障告警模式的比对和优化,与上述第二种故障告警模式挖掘方法中的处理方法一致,在此不再赘述。
另外,关于本申请实施例的故障根因告警定位方法,可以如图26所示,首先将故障按照业务或者拓扑拆分为子故障,针对子故障,利用故障告警模式匹配,进行根告警定位,最后利用故障告警模式匹配,进行子故障告警的合并,最终得到根告警。具体包括但不限于如下步骤一至七。
步骤一、故障关联,是与此故障具备时间和业务或者拓扑关联关系的故障。在业务或者拓扑维度上,属于同一业务或者拓扑的故障;在时间上,是此故障前后发生一段时间内故障,如十分钟内的故障。故障关联的目的,是解决故障聚合错误问题,在故障聚合时,难免将同一故障的部分告警,聚合到其他故障,或者将其他故障的告警,聚合到本故障,如果不进行关联处理,则会影响根告警定位的准确性。
步骤二、按业务或者拓扑拆分,是根据故障聚合的方式进行故障拆分,优选按照业务进行拆分。例如,一个故障影响多个业务,可以按照业务进行拆分,将告警归属于不同个业务;在拆分时,按照业务逐个进行告警分类,当所有告警已经均分配完毕后,停止拆分,不必将所有影响业务均进行拆分。
步骤三、故障拆分后,生成多个子故障,针对每个子故障进行根告警的定位。
步骤四、告警标识提取,提取每个告警的标识,以便和故障告警模式的标识进行匹配,此标识网络唯一,例如,针对PTN网络,告警类型为告警所在的资源类型+告警码。
步骤五、模式匹配,目的是确定子故障的根告警和衍生,具体匹配方法如图27所示,包括但不限于步骤:
1、根告警匹配,是将故障告警模式的根告警与子故障告警进行比对,确认根告警是否包含在子故障
告警中。其中,为了提升匹配效率,可以采用Rete算法,如drools,设置模式匹配的优先级。
2、衍生告警主匹配,是选取根告警匹配成功的故障告警模式,进行的衍生告警匹配。是将故障告警模式的衍生告警与子故障告警的交集,与子故障告警进行匹配。这是因为,故障告警模式的衍生告警相对比较完善,而子故障的告警,在故障聚合时,难免存在告警丢失或少聚问题,所以,衍生告警匹配,分别与子故障告警和故障告警模式衍生告警进行匹配,此步匹配为子故障告警匹配。
例如,子故障告警,根告警之外的告警集合为A,故障告警模式衍生告警的集合为B,则主匹配匹配度为M主=(A∩B)/A,即上述的第一匹配度;辅匹配匹配度为M辅=(A∩B)/B,即上述的第二匹配度。
3、选择衍生告警主匹配成功的模式,继续进行衍生告警辅匹配度,如辅匹配度大于阈值,则结束判断,输出根告警和衍生告警;否则,进行关联故障查询和调整。
4、关联故障告警调整,根据故障告警模式中的衍生告警,在关联故障中进行相同告警类型查询,再结合时间空间维度进行综合判断,如果相关告警符合要求,则这部分关联故障中的告警(如告警集合C)很可能归属于本故障,将告警集合C暂时纳入本故障,同时,将C在关联故障中删除。
5、输出子故障的根和衍生告警。
步骤六、故障根告警合并分析,将多个子故障的根告警,进行合并,在根告警合并时,同样利用故障告警模式进行分析,如果各个子故障告警存在于故障告警模式库中,则采用步骤六的方法进行二次根告警定位,否则,直接进行根告警的合并。
步骤七、根告警输出,根据步骤六的子故障根告警合并的结果,输出根告警,作为故障的推荐根告警。
基于上述实施环境、故障根因告警定位方法和故障告警模式构建方法,下面提出本申请的故障根因告警定位方法和故障告警模式构建方法的具体实施例。
如图28所示,图28为本申请一个实施例提供的故障告警模式挖掘的流程图;其以已有的告警关联规则挖掘的故障告警模式为基础模式,利用模拟数据及AI挖掘出的模式为补充模式,包括但不限于步骤S2010至步骤S2040。
故障告警模式由根告警和衍生告警组成,根告警为此故障的直接告警,可以用于故障根因的定位。示例的,针对承载网PTN网络,当设备端口连接出现问题时,出现的端口信号丢失告警为根因告警,同时出出现大量的其他告警,如灵活以太网端口未连接告警、灵活以太网PHY帧丢失告警、隧道倒换告警、快速重路由告警等,则将此故障的告警聚在一起,端口信号丢失告警为根告警,其他告警为衍生告警,生成一类故障告警模式。
步骤S2010,基于告警关联规则的模式挖掘,主要利用已经积累的告警关联规则,构建基础的故障告警模式。因为电信网络日新月异,不断有新的告警出现,并且告警关联规则需要专家经验的不断积累及AI的持续挖掘,所以,一般的告警关联规则往往难以覆盖所有故障场景,需要借助其他方式进行补充。
告警关联规则是两两告警之间的传播或因果关系,第一个告警的产生,往往会导致第二个告警的出现,第一个告警定义为父告警,第二个告警定义为子告警,告警关联规则的示意表,如表一所示:
表一
第一步,选取监控网络的典型故障的告警,资源类型+告警码可以唯一标识一类告警,可以表示为资源类型_告警码,例如,可以参考电信网络的派单告警。以表一数据为例,典型告警包括单板脱位33_62、以太网物理接口(ETPI)信号丢失(LOS)4203_8、以太网物理接口(ETPI)Ethernet端口未连接4203_37、L3VPN对端L3VPN Peer不可达告警577_3511,因为577_3511为业务告警,一般是故障导致的结果,在此不作为典型故障告警。
第二步,以的典型告警为根告警,逐级进行子告警搜索,作为根告警的衍生告警,例如,以33_62为根告警,表格中的其他告警均为衍生告警,将的告警聚合在一起,标识出根告警,就是单板脱位的故障告警模式。同样的,以203_8为根告警,生成以太网物理接口(ETPI)信号丢失(LOS)的故障告警模式;特别的,因以太网物理端口出现故障时,203_8和203_37往往均为故障的直接告警,这两个告警,可以均作为一个故障的根告警。采用方法,可以生成各类故障的故障告警模式,故障优先级默认为0,故障示意表如表二所示:
表二
第三步,故障告警模式优先级设置,主要目的是将故障排序,设置不同的权重,用于解决故障告警模式匹配的冲突问题。故障告警模式的排序以根告警为主,例如,表二的模式1的衍生告警包含其他模式的根告警,模式1的优先级最高,此类方式为故障告警模式排序的主要方法;另外,模式3和模式4不具备传播模式,这两个模式优先级一致;模式2为模式3和模式4的组合,优先级高于模式2和模式3。按照此方法,表二故障告警模式的优先级以此为:模式1>模式2>模式3/4,修改4个故障告警模式的优先级分别为1,2,3,3。
步骤S2020,基于模拟数据的模式挖掘,主要是利用测试环境或模拟环境,进行人工制造或模拟故障,生成的故障告警模式,用作基础故障告警模式的补充和完善。
测试环境或模拟环境,可以为实验室测试环境,也可以为专门搭建的故障模拟环境,保证网络配置干净完善。的人工制造或模拟故障,是指人为进行各类操作,造成各种故障,如插拔光纤,关闭端口光纤激活器,修改通讯IP地址等,每次只制造一种类型故障,然后对生成的告警数据进行分析。
聚合上述故障的告警数据,人工标注根告警,其他告警作为衍生告警,即生成一种故障告警模式;其中,对上述人为故障生成的告警,进行过滤,过滤掉与对应故障无关的告警。
将上述获得的新的故障告警模式数据,补充到故障告警模式库,具体步骤为:
第一步,按照模式库中的故障告警模式优先级,自高向低逐渐查询当前模式库的模式,查询新模式根告警是否已经存在于当前故障告警模式中,获取含有新模式所有根告警的所有模式;
第二步,若查询结果非空,则对不同的场景分别进行处理。
如果根告警完全匹配,即根告警类型和数量一致,则利用新模式的衍生告警,对模式库中对应模式的衍生告警进行完善,的衍生告警完善,是将存在于新模式而不存在于模式库中对应模式的衍生告警,补充到模式库中对应的模式中。
如果新模式根告警为现有模式根告警的子集,则将新模式补充到模式库中,当前故障库增加一个新的故障告警模式,同时,将新模式的衍生告警,补充到包含新模式根告警的现有故障告警模式中。
如果现有模式根告警为新模式根告警的子集,或者两者根告警有交集,此类场景,将新模式直接补充到模式库中,当前模式库增加一个新的故障告警模式。
第三步,若查询结果为空,说明新模式不存在于当前模式库中,直接将新模式纳入到故障告警模式库中。
第四步,针对故障告警模式库中新增的模式,进行优先级设置,设置方法同步骤S2010的方法。其中,仅针对新增的模式进行优先级设置,模式库中已存在的模式不需要更新,经过查询,如果新模式优先级位于模式库的两个模式之间,两个模式的优先级分别为P1和P2,则新增故障告警模式的优先级为(P1+P2)/2。
步骤S2030,基于故障聚合告警的AI模式挖掘,利用监控网络的历史告警,基于故障维度,将历史告警聚合为一个个故障,然后针对聚合的故障,利用AI算法进行模式挖掘。主要方法如下:
第一步,将历史告警聚合为一个个故障,其中,按照历史告警所在的资源/业务对象,优先构建资源知识图谱,以方便资源和业务的查询,辅助生成故障告警的聚合。其中,利用资源知识图谱或者其他方式,将历史告警,按照时间和资源关系,聚合成一个个的故障。
第二步,将具备典型告警的故障筛选出来,便于故障告警模式的挖掘。
第三步,利用AI方法进行故障告警模式挖掘,其中,可使用频繁项集方法。针对聚合的故障,挖掘符合支持度计数的告警项集。
第四步,针对挖掘的故障告警模式,由专家进行根告警标注,其他告警作为衍生告警,作为新识别的故障。
第五步,采用步骤S2020中的方法,将新识别的故障,补充到当前故障告警模式库中。
步骤S2040,将新生成或完善的故障告警模式,更新到故障告警模式库,同时,生成新的故障告警模式查询方法,或者更新现有的故障告警模式查询方法。
另外,如图29所示,图29为本申请一个实施例提供的基于故障告警模式匹配的根告警定位的流程图;其针对的对象为聚合故障,的聚合故障,是将采集的告警数据,按照故障维度聚合在一起。包括告警过滤、故障聚合和冲突合并过程。的告警过滤,是将采集到的管控网络的告警,过滤掉与故障无关的告警,以及震荡告警、闪断告警等;的故障聚合,是针对不同的告警类型进行的故障聚合,目的是将一个故障产生的告警聚合到该故障中,例如,告警可以按照时间和业务或者拓扑维度进行聚合,针对不同的业务或者拓扑,采用滑动时间窗口,进行故障聚合;的冲突合并,是将影响相同业务或同一拓扑设备的不同故障,合并为同一个故障,例如,两个故障影响同一个业务,则将两个故障合并为一个故障。具体地,该基于故障告警模式匹配的根告警定位方法,包括但不限于步骤S2110至步骤S2150。
步骤S2110,故障拆分,将聚合故障按照业务或拓扑维度拆分为多个子故障。故障拆分主要有原因是,在故障冲突合并时,不同的子故障,因为影响同一业务,或者具备同样的拓扑设备,合并在一起,这些子故障告警之间不具备传播关系,如果同时进行整个故障进行分析,往往识别出错误的根告警和衍生告警,严重影响根告警定位的准确性。
为了说明故障拆分过程,以本申请的一个实施例进行说明,例如针对PTN网络的静态业务场景,其资源和业务拓扑如图30所示,在故障聚合时,图30中示例告警,因为影响同一业务,所有的告警聚合为一个故障,而此故障,实际上同时存在端口A输入光功率越限和端口B Down两个不同的子故障。
第一步,按照故障影响的业务或网路拓扑进行故障拆分,针对同一业务的告警,可以按照主备链路进行拆分。例如,针对图30的故障,故障可以拆分为子故障一和子故障二,子故障一包含输入光功率越限告警、衍生告警11、衍生告警12、衍生告警13、衍生告警31、衍生告警32;子故障二包含端口Down告警、衍生告警21、衍生告警22、衍生告警23、衍生告警31、衍生告警32。
第二步,子故障选择,其中,将子故障按照包含的告警数量由多到少进行排序,如果前几个子故障已经包含所有告警,则将后面的子故障删除。例如,按照第一步将一个故障拆分为n个子故障,并按照告警排序,如果前m个子故障已经包含所有的故障告警,则只选择此m个子故障。
步骤S2120,告警标识提取,提取告警的唯一标识,标识和故障告警模式库的标识一致,用于故障告警模式的匹配,例如针对PTN网络,告警标识为资源类型restype+告警码alarmCode。
步骤S2130,子故障告警模式匹配,是将故障告警与模式库的告警进行匹配,优先进行根告警匹配,根告警匹配成功后,再进行衍生告警的匹配,匹配成功后,输出根告警和衍生告警。在衍生告警匹配时,分为主匹配和辅匹配,其中,辅匹配可以对故障聚合进行调整,反作用于故障聚合,提升故障聚合的准确
性。如图30所示的两个子故障,分别输出光功率越限告警和端口Down告警,作为两个子故障的根告警。为了详细说明匹配过程,具体的流程,后面结合图31详细描述。
步骤S2140,子故障根告警合并,针对子故障识别的根告警,进行分析合并。子故障根告警的合并,并不是简单的合并,而且采用步骤S2130的方法,进行根告警的二次识别,获取最终的根告警。针对图30的两个子故障,直接进行合并,此故障具备两个根告警。
步骤S2150,将子故障合并后的根告警输出,作为故障的根告警,用于智能故障的根因分析。
另外,如图31所示,图31为本申请一个实施例提供的子故障告警模式匹配的流程图;按照故障告警模式优先级,首先确认故障告警模式的所有根告警存在于子故障中,然后再利用故障告警模式的衍生告警,按照主匹配和辅匹配的方式,去匹配子故障非根告警,最终获取子故障的根告警。具体地,该子故障告警模式匹配方法包括但不限于步骤S2210至步骤S2260。
步骤S2210,根告警匹配,按照故障告警模式库中故障告警模式的优先级,进行根告警的匹配。
在故障告警模式库生成时,针对各个故障告警模式进行了排序,从而保证了故障告警模式匹配的顺序,消除了匹配冲突问题。例如,模式一的优先级高于模式二,子故障告警中,同时包含模式一和模式二的根告警,在进行根告警匹配时,优先匹配模式一。
其中,为了保证匹配效率,可以采用现有的模式匹配算法,其中,可以采用Rete算法,自动进行模式匹配。
步骤S2220,衍生告警主匹配,是指根告警匹配成功后,利用故障告警模式的衍生告警,对子故障的非根告警进行匹配,如果匹配准确性达不到设置的阈值,则此模式匹配失败,继续进行其他模式的匹配。对于阈值,根据人工经验设置,如可设置匹配度为80%。
衍生告警主匹配的对象是子故障的非根告警,这是因为,在故障聚合时,因为网络配置或聚合算法问题,往往存在故障告警多聚或少聚的情况;而故障告警模式的衍生告警相对准确而且完善,从衍生告警完善角度触发,优先针对子故障的非根告警进行匹配,例如,当前故障根告警之外的告警集合为A,故障告警模式衍生告警的集合为B,则主匹配匹配度为M主=(A∩B)/A,如果匹配度满足预设的阈值,则继续进行辅助匹配,否则,继续进行根告警的匹配。
步骤S2230,衍生告警辅助匹配,是指在根告警和衍生告警主匹配成功后,进行的辅助匹配,辅助匹配的目的,不是提升匹配准确性,而是进行聚合故障告警调整,提升聚合故障的准确性。
衍生告警辅助匹配,针对的对象为故障告警模式的衍生告警,辅助匹配匹配度为M辅=(A∩B)/B。如辅匹配度大于阈值,则进入下一个流程,否则,说明故障聚合可能存在少聚或多聚问题,少聚问题,可以通过故障关联进行调整;多聚问题,本故障不做处理,通过关联故障的处理来完成。阈值按照人工经验设置,例如可以取值为80%。
关联故障,是指与当前故障存在时间和业务或者拓扑关系的故障,故障告警多聚或少聚的告警,往往为关联故障的告警,或者本故障的告警聚合到关联故障中。如果故障告警模式衍生告警,如告警类型C,在子故障中缺失,但存在于关联故障中,告警C很可能被误聚合到关联故障中,应该从关联故障调整到本故障;同理,衍生告警不存在,但子故障存在的告警,如告警D,很可能被错误加入本故障,告警D应该在本故障调整到关联故障,告警D的分析和调整,在子故障分析时,不做处理,而在关联故障处理时进行分析和调整。
步骤S2240,子故障根告警和衍生告警推荐,根据上述流程判断,可以获得子故障的根告警,以及对应的衍生告警,一并输入到下一个流程。
步骤S2250,子故障根告警合并,其中,当故障拆分为多个子故障时,需要将多个子故障的根告警进行合并。若多个子故障的根告警一致,则此告警为故障的根告警;否则,将子故障根告警和衍生告警分别进行合并,生成根告警列表R和衍生告警列表D,然后,将根和衍生告警的交集,在根告警列表中删除,作为故障的根告警。
步骤S2260,子故障根告警输出,将上述分析的根告警和衍生告警输出,作为子故障的根告警和衍生,结束流程。
另外,如图32所示,图32是本申请一个实施例提供的网络设备的结构示意图;本申请的一个实施例还公开了一种网络设备400,包括:存储器420、处理器410及存储在存储器420上并可在处理器410上运行的计算机程序,处理器410运行计算机程序时执行如前面任意实施例中的故障根因告警定位方法和/或故障告警模式构建方法。
存储器420作为一种非暂态计算机可读存储介质,可用于存储非暂态软件程序以及非暂态性计算机可执行程序。此外,存储器420可以包括高速随机存取存储器,还可以包括非暂态存储器,例如至少一个磁盘存储器件、闪存器件、或其他非暂态固态存储器件。在一些实施方式中,存储器420可选包括相对于处理器410远程设置的存储器,这些远程存储器可以通过网络连接至该实施环境。上述网络的实例包括但不
限于互联网、企业内部网、局域网、移动通信网及其组合。
本实施例中的网络设备400,可以对应为如图1所示实施例的实施环境中的BIER观察点或者采集器,两者属于相同的申请构思,因此两者具有相同的实现原理以及有益效果,此处不再详述。
实现上述实施例的故障根因告警定位方法所需的非暂态软件程序以及指令存储在存储器420中,当被处理器410执行时,执行上述实施例的故障根因告警定位方法。
或者,实现上述实施例的故障告警模式构建方法所需的非暂态软件程序以及指令存储在存储器420中,当被处理器410执行时,执行上述实施例的故障告警模式构建方法。
值得注意的是,本申请实施例的网络设备400的具体实施方式和技术效果,可对应参照上述故障根因告警定位方法和/或故障告警模式构建方法的具体实施方式和技术效果。
另外,本申请的一个实施例还公开了一种计算机可读存储介质,其中存储有计算机可执行指令,计算机可执行指令用于执行如前面任意实施例中的故障根因告警定位方法和/或故障告警模式构建方法。
此外,本申请的一个实施例还公开了一种计算机程序产品,包括计算机程序或计算机指令,计算机程序或计算机指令存储在计算机可读存储介质中,计算机设备的处理器从计算机可读存储介质读取计算机程序或计算机指令,处理器执行计算机程序或计算机指令,使得计算机设备执行如前面任意实施例中的故障根因告警定位方法和/或故障告警模式构建方法。
本领域普通技术人员可以理解,上文中所公开方法中的全部或某些步骤、***可以被实施为软件、固件、硬件及其适当的组合。某些物理组件或所有物理组件可以被实施为由处理器,如中央处理器、数字信号处理器或微处理器执行的软件,或者被实施为硬件,或者被实施为集成电路,如专用集成电路。这样的软件可以分布在计算机可读介质上,计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的,术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外,本领域普通技术人员公知的是,通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据,并且可包括任何信息递送介质。
Claims (15)
- 一种故障根因告警定位方法,包括:获取聚合故障,对所述聚合故障进行拆分,得到多个子故障;对于每个所述子故障,根据所述子故障和多个预设故障告警模式确定所述子故障中的目标根告警,其中,每个所述预设故障告警模式包括预设根告警和与所述预设根告警对应的预设衍生告警;对所有所述子故障中的所述目标根告警进行合并,得到最终根告警。
- 根据权利要求1所述的故障根因告警定位方法,其中,所述对所述聚合故障进行拆分,得到多个子故障,包括如下之一:根据业务类型对所述聚合故障进行拆分,得到多个子故障;根据网络拓扑对所述聚合故障进行拆分,得到多个子故障。
- 根据权利要求1所述的故障根因告警定位方法,其中,在所述得到多个子故障之后,所述故障根因告警定位方法还包括:确定每个所述子故障中的告警数量,并按照所述告警数量由多到少对所有所述子故障进行排序;在前m个所述子故障包括所述聚合故障中的所有故障告警的情况下,选择前m个所述子故障作为目标子故障,以从所述目标子故障中确定最终根告警,其中,所述m为正整数。
- 根据权利要求1所述的故障根因告警定位方法,其中,所述根据所述子故障和多个预设故障告警模式确定所述子故障中的目标根告警,包括:获取每个所述预设故障告警模式的优先级,并按照所述优先级由高到低的顺序从多个所述预设故障告警模式中选择目标预设故障告警模式;将所述目标预设故障告警模式与所述子故障进行匹配,得到所述子故障中的根告警和非根告警;根据所述非根告警和所述目标预设故障告警模式中的所述预设衍生告警确定第一匹配度,其中,所述第一匹配度为所述非根告警和所述预设衍生告警的交集与所述非根告警之间的比值;直到所述第一匹配度大于第一预设阈值,将所述根告警作为所述目标根告警。
- 根据权利要求4所述的故障根因告警定位方法,其中,在所述将所述根告警作为所述目标根告警之后,所述故障根因告警定位方法还包括:根据所述非根告警和所述目标预设故障告警模式中的所述预设衍生告警确定第二匹配度,其中,所述第二匹配度为所述非根告警和所述预设衍生告警的交集与所述预设衍生告警之间的比值;在所述第二匹配度小于或等于第二预设阈值的情况下,获取与所述聚合故障对应的关联故障;根据所述关联故障、所述目标预设故障告警模式和所述子故障,对所述子故障中的故障告警进行调整。
- 根据权利要求5所述的故障根因告警定位方法,其中,所述根据所述关联故障、所述目标预设故障告警模式和所述子故障,对所述子故障中的故障告警进行调整,包括如下至少之一:当所述关联故障和所述目标预设故障告警模式中的所述预设衍生告警包括目标故障告警,并且所述子故障中没有包括所述目标故障告警,将所述目标故障告警由所述关联故障调整到所述子故障;当所述关联故障和所述目标预设故障告警模式中的所述预设衍生告警没有包括目标故障告警,并且所述子故障中包括所述目标故障告警,将所述目标故障告警由所述子故障调整到所述关联故障。
- 根据权利要求1所述的故障根因告警定位方法,其中,所述对所有所述子故障中的所述目标根告警进行合并,得到最终根告警,包括如下至少之一:当所有所述子故障中的所述目标根告警一致,将所述目标根告警作为最终根告警;当所有所述子故障中的所述目标根告警不一致,获取所有所述子故障中的所有目标根告警和所有非根告警,并从所述所有目标根告警中删去所有目标根告警和所有非根告警的交集,得到最终根告警。
- 一种故障告警模式构建方法,用于构建权利要求1至7中任意一项所述故障根因告警定位方法中的所述预设故障告警模式;所述故障告警模式构建方法包括:获取告警关联规则,其中,所述告警关联规则包括多个父告警和与每个所述父告警直接关联的子告警;从所述多个父告警中确定目标父告警,并筛选出与所述目标父告警直接关联和间接关联的目标子告警;根据所述目标父告警和所述目标子告警构建所述预设故障告警模式,其中,所述预设故障告警模式中的所述预设根告警为所述目标父告警,所述预设故障告警模式中的所述预设衍生告警为所述目标子告警。
- 根据权利要求8所述的故障告警模式构建方法,其中,在所述根据所述目标父告警和所述目标子告警构建所述预设故障告警模式之后,所述故障告警模式构建方法还包括:获取模拟根告警和与所述模拟根告警对应的模拟衍生告警;根据所述模拟根告警和所述模拟衍生告警构建模拟故障告警模式;根据所述模拟故障告警模式对多个所述预设故障告警模式进行更新。
- 根据权利要求9所述的故障告警模式构建方法,其中,所述根据所述模拟故障告警模式对多个所述预设故障告警模式进行更新,包括如下至少之一:当所述模拟根告警和所述预设根告警一致,将存在于所述模拟故障告警模式而不存在于所述预设故障告警模式的衍生告警添加至所述预设故障告警模式中;当所述模拟根告警为所述预设根告警的子集,将所述模拟故障告警模式作为新的预设故障告警模式,并将存在于所述模拟故障告警模式而不存在于所述预设故障告警模式的衍生告警添加至所述预设故障告警模式中;当所述预设根告警为所述模拟根告警的子集,将所述模拟故障告警模式作为新的预设故障告警模式;当所述模拟根告警没有存在于所述预设故障告警模式中,将所述模拟故障告警模式作为新的预设故障告警模式。
- 根据权利要求8所述的故障告警模式构建方法,其中,在所述根据所述目标父告警和所述目标子告警构建所述预设故障告警模式之后,所述故障告警模式构建方法还包括:获取历史故障告警,并根据所述历史故障告警生成历史聚合故障;采用人工智能方式从所述历史聚合故障中挖掘得到历史故障告警模式;根据所述历史故障告警模式对多个所述预设故障告警模式进行更新。
- 根据权利要求11所述的故障告警模式构建方法,其中,所述根据所述历史故障告警模式对多个所述预设故障告警模式进行更新,包括如下至少之一:当所述历史故障告警模式中的根告警和所述预设根告警一致,将存在于所述历史故障告警模式而不存在于所述预设故障告警模式的衍生告警添加至所述预设故障告警模式中;当所述历史故障告警模式中的根告警为所述预设根告警的子集,将所述历史故障告警模式作为新的预设故障告警模式,并将存在于所述历史故障告警模式而不存在于所述预设故障告警模式的衍生告警添加至所述预设故障告警模式中;当所述预设根告警为所述历史故障告警模式中的根告警的子集,将所述历史故障告警模式作为新的预设故障告警模式;当所述历史故障告警模式中的根告警没有存在于所述预设故障告警模式中,将所述历史故障告警模式作为新的预设故障告警模式。
- 一种网络设备,包括:存储器、处理器及存储在所述存储器上并可在所述处理器上运行的计算机程序,其中,所述处理器执行所述计算机程序时实现权利要求1至7中任意一项所述的故障根因告警定位方法和/或权利要求8至12中任意一项所述的故障告警模式构建方法。
- 一种计算机可读存储介质,存储有计算机可执行指令,其中,所述计算机可执行指令用于执行权利要求1至7中任意一项所述的故障根因告警定位方法和/或权利要求8至12中任意一项所述的故障告警模式构建方法。
- 一种计算机程序产品,包括计算机程序或计算机指令,其中,所述计算机程序或所述计算机指令存储在计算机可读存储介质中,计算机设备的处理器从所述计算机可读存储介质读取所述计算机程序或所述计算机指令,所述处理器执行所述计算机程序或所述计算机指令,使得所述计算机设备执行权利要求1至7中任意一项所述的故障根因告警定位方法和/或权利要求8至12中任意一项所述的故障告警模式构建方法。
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202210801417.2 | 2022-07-08 | ||
CN202210801417.2A CN117411773A (zh) | 2022-07-08 | 2022-07-08 | 故障根因告警定位方法、故障告警模式构建方法和设备 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2024007631A1 true WO2024007631A1 (zh) | 2024-01-11 |
Family
ID=89454275
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2023/083733 WO2024007631A1 (zh) | 2022-07-08 | 2023-03-24 | 故障根因告警定位方法、故障告警模式构建方法和设备 |
Country Status (2)
Country | Link |
---|---|
CN (1) | CN117411773A (zh) |
WO (1) | WO2024007631A1 (zh) |
Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20040078683A1 (en) * | 2000-05-05 | 2004-04-22 | Buia Christhoper A. | Systems and methods for managing and analyzing faults in computer networks |
CN112395170A (zh) * | 2020-12-07 | 2021-02-23 | 平安普惠企业管理有限公司 | 智能故障分析方法、装置、设备及存储介质 |
CN112562276A (zh) * | 2020-11-25 | 2021-03-26 | 北京朗信智能科技有限公司 | 一种设备故障报警方法及*** |
CN113254254A (zh) * | 2021-07-14 | 2021-08-13 | 南京中兴新软件有限责任公司 | ***故障的根因定位方法、装置、存储介质及电子装置 |
CN114500229A (zh) * | 2021-12-30 | 2022-05-13 | 国网河北省电力有限公司信息通信分公司 | 基于时空信息的网络告警定位及分析方法 |
WO2022111659A1 (zh) * | 2020-11-30 | 2022-06-02 | 中兴通讯股份有限公司 | 告警方法、装置、设备及存储介质 |
-
2022
- 2022-07-08 CN CN202210801417.2A patent/CN117411773A/zh active Pending
-
2023
- 2023-03-24 WO PCT/CN2023/083733 patent/WO2024007631A1/zh unknown
Patent Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20040078683A1 (en) * | 2000-05-05 | 2004-04-22 | Buia Christhoper A. | Systems and methods for managing and analyzing faults in computer networks |
CN112562276A (zh) * | 2020-11-25 | 2021-03-26 | 北京朗信智能科技有限公司 | 一种设备故障报警方法及*** |
WO2022111659A1 (zh) * | 2020-11-30 | 2022-06-02 | 中兴通讯股份有限公司 | 告警方法、装置、设备及存储介质 |
CN112395170A (zh) * | 2020-12-07 | 2021-02-23 | 平安普惠企业管理有限公司 | 智能故障分析方法、装置、设备及存储介质 |
CN113254254A (zh) * | 2021-07-14 | 2021-08-13 | 南京中兴新软件有限责任公司 | ***故障的根因定位方法、装置、存储介质及电子装置 |
CN114500229A (zh) * | 2021-12-30 | 2022-05-13 | 国网河北省电力有限公司信息通信分公司 | 基于时空信息的网络告警定位及分析方法 |
Also Published As
Publication number | Publication date |
---|---|
CN117411773A (zh) | 2024-01-16 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN110659173B (zh) | 一种运维***及方法 | |
US10177998B2 (en) | Augmenting flow data for improved network monitoring and management | |
US9984128B2 (en) | Managing site-based search configuration data | |
US9124612B2 (en) | Multi-site clustering | |
WO2019223062A1 (zh) | ***异常的处理方法和*** | |
CN109787817A (zh) | 网络故障诊断方法、装置和计算机可读存储介质 | |
EP4155974A1 (en) | Knowledge graph construction method and apparatus, check method and storage medium | |
CN109981326B (zh) | 家庭宽带感知故障定位的方法及装置 | |
WO2017140084A1 (zh) | 测试方法及装置 | |
EP3637690B1 (en) | Service configuration-driven flow table method and device | |
CN106878038A (zh) | 一种通信网络中故障定位方法及装置 | |
CN112600719A (zh) | 告警聚类方法、装置及存储介质 | |
CN112769605A (zh) | 一种异构多云的运维管理方法及混合云平台 | |
CN113852476A (zh) | 确定异常事件关联对象的方法、装置及*** | |
US20220124021A1 (en) | Reachability matrix for network verification system | |
WO2024007631A1 (zh) | 故障根因告警定位方法、故障告警模式构建方法和设备 | |
CN114401516A (zh) | 一种基于虚拟网络流量分析的5g切片网络异常检测方法 | |
CN113542026A (zh) | 物联网设备故障定位方法、装置、设备及存储介质 | |
CN115314300A (zh) | 飞行训练模拟机数据分析*** | |
WO2020244306A1 (zh) | 告警上报方法及装置 | |
CN111953519A (zh) | 一种sdn网络流量可视化方法及装置 | |
WO2024114228A1 (zh) | 虚拟网络事件聚合方法及装置 | |
WO2022228062A1 (zh) | 网络故障分析方法、装置、设备及存储介质 | |
WO2024021603A1 (zh) | 故障处理方法、设备和存储介质 | |
US12052166B2 (en) | Predicting impending change to interior gateway protocol (IGP) metrics |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 23834414 Country of ref document: EP Kind code of ref document: A1 |