CN109150572B

CN109150572B - Method, device and computer readable storage medium for realizing alarm association

Info

Publication number: CN109150572B
Application number: CN201710507468.3A
Authority: CN
Inventors: 王骅
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2017-06-28
Filing date: 2017-06-28
Publication date: 2020-07-24
Anticipated expiration: 2037-06-28
Also published as: WO2019001312A1; CN109150572A

Abstract

The disclosure provides a method, a device and a computer readable storage medium for realizing alarm association, belonging to the technical field of communication. The method comprises the following steps: after receiving an alarm, acquiring a data query script of the alarm; calling a data query script, and sending a data query request aiming at the alarm to the VNF, wherein the data query request at least comprises first identification information of a first alarm object indicated by the alarm; receiving first attribute information which is returned by the VNF and aims at the first alarm object; and according to the first attribute information of the first alarm object, performing polling search in at least one stored alarm to obtain a target stored alarm which has an association relation with the alarm. Because the alarm association is realized without depending on the associated script, the workload of manually writing and maintaining the associated script for realizing the alarm association is greatly reduced, and the time and the labor are saved. Even if facing the communication system with a large number of alarm types and complex relation, the association between the alarms can be completed more simply.

Description

Method, device and computer readable storage medium for realizing alarm association

Technical Field

The present disclosure relates to the field of communications technologies, and in particular, to a method and an apparatus for implementing alarm association, and a computer-readable storage medium.

Background

When software and hardware faults occur in a communication system, reporting is usually performed by reporting alarm information. When a piece of alarm information is reported, it usually indicates the alarm object, i.e. it indicates which object has a fault, and in addition, the alarm usually also includes the fault occurrence time, the alarm level (for example, classified as fatal, serious, general, prompt, etc.), and the attribute information of the alarm object. The attribute information may include information about the alarm object, a fault cause, a fault influence, and the like. For example, the attribute information of the virtual machine port fault alarm may include a virtual machine name, a port name, an alarm reason, a fault location description, and the like.

It is common today to display the individual alarms in a list, i.e. all alarms that have been generated are displayed in one list. However, the communication system is hierarchical, and a failure of an underlying software or hardware module usually results in a failure of one or more upper software or hardware modules. The display mode of the list obviously cannot present the association relation between the alarms, and the additional manual analysis of which alarm indicates the most fundamental fault is required, so that the display mode is too complicated. For this reason, the concept of alarm tree is also proposed in the art, that is, the association relationship between the alarms is presented in a tree form. Thus, the failure indicated by the root node alarm is the root cause for the alarm of its upper leaf node. If the fault indicated by the alarm of the root node is repaired, the fault indicated by the alarm of the upper leaf node can be repaired together.

Wherein, the alarm tree is generated by presetting a script. As an example, a developer writes a script for implementing alarm association for an alarm of object A, such as: if an alarm for object A occurs, checking whether an alarm for object B exists; if there is an alarm for object B, determining if the identity of object B is equal to the value of parameter X in the alarm for object A; if so, the alarm for object A is treated as a sub-alarm for the alarm for object B.

In the course of implementing the present disclosure, the inventors found that the prior art has at least the following problems:

the script for realizing alarm association needs to be written manually, is time-consuming and labor-consuming, and particularly for a complex communication system, the alarm types are not only large in quantity but also complex in relation, so that the method for generating the alarm tree also has the defects of being too complicated and complex. For example, the alarm for the object a may be caused by various reasons, which requires writing a script for implementing alarm association for the alarm for the object a to query whether various alarms are root alarms thereof. In addition, when a new alarm occurs, if the alarm is associated with a large number of other alarms, a large amount of script modification work is involved. In addition, the alarm association is realized to depend heavily on parameters carried by the alarm. For example, the alarm for the object a must carry the parameter X, and if the alarm is not carried, the alarm for the object B cannot be associated.

Disclosure of Invention

In order to solve the problems of complex implementation and strong dependency of alarm association in the prior art, the embodiments of the present disclosure provide a method and an apparatus for implementing alarm association, and a computer-readable storage medium. The technical scheme is as follows:

in a first aspect, a method for implementing alarm association is provided, where the method includes:

after receiving an alarm, acquiring a data query script of the alarm;

calling the data query script, and sending a data query request for the alarm to a Virtual Network Function (VNF), where the data query request at least includes first identification information of a first alarm object indicated by the alarm;

receiving first attribute information, which is returned by the VNF and is aimed at the first alarm object, wherein the first attribute information is acquired by the VNF according to the first identification information after the VNF receives the data query request;

and performing polling search in at least one stored alarm according to the first attribute information of the first alarm object to obtain a target stored alarm having an association relation with the alarm.

After receiving an alarm, when polling the stored alarm, the method can be divided into the following two modes:

in a first possible implementation manner of the first aspect, the performing a polling search in at least one stored alarm according to the first attribute information of the first alarm object to obtain a target stored alarm having an association relationship with the alarm includes:

for each of the at least one stored alarm, if the second identification information of the second alarm object indicated by the stored alarm matches one of the first attribute information,

and if the alarm level of the stored alarm is greater than the alarm level of the alarm, determining the alarm as a sub-alarm of the stored alarm.

In view of the above, it is how to determine the present alarm as a sub-alarm of other stored alarms.

With reference to the first aspect, in a second possible implementation manner of the first aspect, the performing a polling search in at least one stored alarm according to the first attribute information of the first alarm object to obtain a target stored alarm having an association relationship with the alarm includes:

for each alarm in the at least one stored alarm, if one of the second attribute information of the second alarm object indicated by the stored alarm matches the first identification information of the first alarm object,

and if the alarm level of the alarm is greater than the alarm level of the stored alarm, determining the alarm as a root alarm of the stored alarm.

In view of the above, it is how to determine that the alarm is the root alarm of other stored alarms.

It should be noted that, in addition to the foregoing polling in stored alarms to determine associated alarms, the present disclosure also provides a fuzzy text analysis capability based on artificial intelligence to query suspected alarms associated with received alarms. And the inquired suspected alarm is supported to be pushed to identify for manual confirmation.

With reference to the first aspect, in a third possible implementation manner of the first aspect, the method further includes:

for each piece of attribute information in the first attribute information, carrying out fuzzy comparison on the attribute information and at least one piece of identification information of at least one alarm object, wherein the at least one alarm object corresponds to the at least one stored alarm;

if the similarity between the attribute information and the identification information of any one of the at least one alarm object is greater than a preset threshold, determining the alarm corresponding to any one of the alarm objects as a suspected alarm having an association relationship with the alarm.

With reference to the third possible implementation manner of the first aspect, in a fourth possible implementation manner of the first aspect, the method further includes:

displaying the type information of the suspected alarm and the identification information of the suspected alarm, and displaying an association relationship confirmation prompt message aiming at the suspected alarm;

and after receiving an association relationship confirmation operation aiming at the suspected alarm, storing the association relationship between the alarm and the suspected alarm.

With reference to the first aspect, the first or second possible implementation manner of the first aspect, in a fifth possible implementation manner of the first aspect, the method further includes:

after obtaining at least one target stored alarm having an association relation with the alarm, storing the type information of the alarm, the first identification information, the first attribute information, and the association relation between the alarm and the at least one target stored alarm;

and displaying the type information of the alarm, the first identification information and the association relationship between the alarm and the at least one target stored alarm.

In a second aspect, an apparatus for implementing alarm association is provided, where the apparatus is configured to implement the method for implementing alarm association described in the first aspect.

In a third aspect, there is provided a computer readable storage medium having stored therein at least one instruction, at least one program, a set of codes, or a set of instructions, which is loaded and executed by the processor to implement the method of implementing an alert association as described in any one of the above first aspects.

In a fourth aspect, an apparatus for implementing alarm association is provided, the apparatus comprising a processor and a memory, the memory having stored therein at least one instruction, at least one program, set of codes, or set of instructions, which is loaded and executed by the processor to implement the method for implementing alarm association as set forth in any one of the above first aspects.

The technical scheme provided by the embodiment of the disclosure has the following beneficial effects:

after the association analysis module receives an alarm, a data query request aiming at the alarm is sent to the VNF so as to acquire all attribute information of an alarm object indicated by the alarm from the VNF, and then the association analysis module performs polling search in at least one stored alarm in the alarm library according to the acquired all attribute information, so that the stored alarm in association relation with the alarm storage is acquired. Even if facing the communication system with a large number of alarm types and complex relation, the association between the alarms can be completed more simply.

In addition, the embodiment of the present disclosure queries all attribute information of the alarm object facing the VNF, and performs alarm association using the queried attribute information of the alarm object, so that a situation that the alarm association depends heavily on parameters carried by the alarm does not occur. That is, no matter whether the newly received alarm carries the specified parameter, the newly received alarm can be associated with the alarm having the association relationship with the newly received alarm.

Drawings

Fig. 1 is a system architecture diagram of an NFV provided by an embodiment of the present disclosure;

fig. 2 is a schematic diagram of module components and a workflow involved in a method for implementing alarm association according to an embodiment of the present disclosure;

FIG. 3 is a flowchart of a method for implementing alarm association according to an embodiment of the present disclosure;

FIG. 4 is a schematic flow chart illustrating an implementation of alarm association according to an embodiment of the present disclosure;

FIG. 5 is a schematic diagram of an association between alarms provided by an embodiment of the present disclosure;

FIG. 6 is a diagram illustrating an example of implementing alarm association according to an embodiment of the present disclosure;

FIG. 7 is a schematic structural diagram of an apparatus for implementing alarm association according to an embodiment of the present disclosure;

FIG. 8 is a schematic structural diagram of an apparatus for implementing alarm association according to an embodiment of the present disclosure;

fig. 9 is a schematic structural diagram of an apparatus for implementing alarm association according to an embodiment of the present disclosure.

Detailed Description

To make the objects, technical solutions and advantages of the present disclosure more apparent, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings.

Before explaining the embodiments of the present disclosure in detail, an application scenario and an implementation environment related to a method for implementing alarm association provided by the embodiments of the present disclosure are briefly explained.

The method for implementing alarm association provided by the embodiment of the present disclosure is applied to a Network Function Virtualization (NFV) system architecture. The NFV technology will first be briefly described.

As is known, conventional telecommunication systems are composed of various dedicated hardware devices, different applications using different hardware devices. However, as the network scale increases, the system becomes more complex, which brings many challenges, including the development of new services, online operation and maintenance of the system, resource utilization, and the like. In order to meet these challenges and utilize virtualization Technology and cloud computing Technology in the Information Technology (IT) industry, 13 major telecommunication operators in the World jointly release NFV white paper at the SDN and OpenFlow World convergence conference called by 10, 22/2012, and declare that ETSI establishes NFV ISG, and make demands and technical frameworks of NFV to promote the development of NFV.

Among them, NFV technology can be simply understood as migrating The functions of each network element used in a telecommunication network from The current dedicated hardware platform to a common Commercial Off The Shelf (COTS) server. Each network element used in the telecommunication network is converted into independent application through NFV technology, the network element can be flexibly deployed on a unified infrastructure platform constructed by other equipment such as a standard server, a storage and a switch, the resources of infrastructure hardware equipment are pooled and virtualized through virtualization technology, virtual resources are provided for upper-layer application, application and hardware decoupling is achieved, each application can rapidly increase the virtual resources to achieve the purpose of rapidly expanding the system capacity, or the virtual resources can be rapidly reduced to achieve the purpose of shrinking the system capacity, and the elasticity of the network is greatly improved. A shared resource pool is formed by adopting a universal COTS server, newly developed services do not need to be independently deployed with hardware equipment, and the online time of the new services is greatly shortened.

The foundation of NFV technology includes cloud computing technology and virtualization technology. Hardware devices such as a general COTS (chip on the fly) calculation/storage/network and the like can be decomposed into a plurality of virtual resources through a virtualization technology so as to be used by various upper-layer applications. The decoupling between the application and the hardware is realized through a virtualization technology, so that the virtual resource supply speed is greatly increased; by the cloud computing technology, elastic expansion of application can be achieved, matching of virtual resources and service loads is achieved, utilization efficiency of the virtual resources is improved, and response rate of a system is improved.

The following describes each component and architecture of the NFV system provided by the embodiments of the present disclosure.

Fig. 1 is a System architecture diagram of NFV, and the NFV System 100 may be implemented in various networks, such as a data center Network, an operator Network, or a local area Network, the NFV System 100 includes an NFV Management and Orchestration System (NFV MANO)101, NFV Infrastructure layer (NFV Infrastructure, NFVI) 130, Virtual Network Functions (VNF) 108, Element Management (EM) 122, Network services, VNF and Infrastructure Description (Network service, VNF and Infrastructure Description)126, and Operation Support Management System (Operation-Support System/Business System, OSS/BSS)124, wherein the NFV Management and Orchestration System 101 includes NFV (NFV Manager) 102, NFV Orchestration System 102, vnv Orchestration System 120, vnv Infrastructure Management (vnv) 118, vnv Infrastructure Management System 102, vnv Infrastructure Management System (vnv Management) and Virtual Network Management System (vnv) 114, vnv Infrastructure Management System (vnv Management) 114, vnv Infrastructure Management) 114, VNF and vnv Infrastructure Description (vnv) 118, vnv Infrastructure Management) 114, vnv Infrastructure Management (vnv) 114, vnv Management) and vnv Infrastructure Management System (vnv) 114, and vnv Management System (vnv) 114, and vnv Management System (vnv Management) 114, vnv Management System) 114, and Virtual Network Management System (vnv) storage System) 114, and vnv).

NFVO102 may implement network services on NFVI130 (e.g., L2 and L3 VPN services) and may also execute resource-related requests from one or more VNFMs 104, send configuration information to VNFMs 104, and collect status information of VNFs 108. additionally, NFVO102 may communicate with VIM106 to implement allocation and/or reservation of resources and exchange configuration and status information of virtualized hardware resources, the VNFMs 104 may manage one or more VNFMs 108. VNFMs 104 may perform various management functions, such as instantiating, updating, querying, scaling, and/or terminating VNFs 108, etc. VIM106 may perform resource management functions, such as managing allocation of infrastructure resources (e.g., adding resources to a virtual container) and operational functions (e.g., collecting NFVI fault information.) VIM 104 and VIM106 may communicate with each other to perform resource allocation and exchange status information of virtualized hardware resources.

The NFVI130 includes hardware resources, software resources, or a combination of both to complete the deployment of the virtualized environment. In other words, the hardware resources and virtualization layer are used to provide virtualized resources, e.g., as virtual machines and other forms of virtual containers, for VNF 108. The hardware resources include computing hardware 112, storage hardware 114, and network hardware 116. The computing hardware 112 may be commercially available hardware and/or custom hardware to provide processing and computing resources. The storage hardware 114 may be storage capacity provided within a network or storage capacity residing within the storage hardware 114 itself (local storage located within a server). In one implementation, the resources of the computing hardware 112 and the storage hardware 114 may be pooled together. The network hardware 116 may be a switch, a router, and/or any other network device configured with switching functionality. The network hardware 116 may span multiple domains and may include multiple networks interconnected by one or more transport networks.

A virtualization layer within NFVI130 may abstract hardware resources from the physical layer and decouple VNF108 to provide virtualized resources to VNF 108. The virtual resource layer includes virtual compute 110, virtual storage 118, and virtual network 120. Virtual compute 110 and virtual storage 118 may be provided to VNF108 in the form of virtual machines, and/or other virtual containers. For example, one or more VNFs 108 may be deployed on one Virtual Machine (Virtual Machine). The virtualization layer abstracts the network hardware 116 to form a Virtual network 120, and the Virtual network 120 may include Virtual switches (Virtual switches) that are used to provide connections between Virtual machines and other Virtual machines. In addition, the transport network in the network hardware 116 may be virtualized using a centralized control plane and a separate forwarding plane (e.g., software defined network, SDN).

As shown in fig. 1, VNFM104 may interact with VNF108 and EM122 to manage the VNF's lifecycle and exchange configuration and status information. VNF108 may be configured to virtualize at least one network function performed by one physical network device. For example, in one implementation, the VNF108 may be configured to provide functions of different network elements in an IP Multimedia Subsystem (IMS) network, such as a Proxy-Call Session Control Function (P-SCSCF), a Server-Call Session Control Function (S-CSCF), or a network Function of a Home Subscriber Server (HSS). EM122 is configured to manage one or more VNFs 108.

Fig. 2 is a schematic diagram of module components and a workflow involved in a method for implementing alarm association according to an embodiment of the present disclosure. As shown in fig. 2, the apparatus for implementing alarm association provided in the embodiment of the present disclosure includes an alarm receiving module, an association analysis module, an alarm storage module, and an alarm display module.

Referring to fig. 2, the alarm receiving module is connected to the association analysis module, and the association analysis module is connected to the alarm storage module and the alarm display module, respectively.

The alarm receiving module is used for receiving the alarm (1) sent by the VNF and forwarding the received alarm to the association analysis module (2). And the association analysis module is used for inquiring the attribute information (3) of the alarm object indicated by each alarm from the VNF by using the data inquiry script corresponding to each alarm. The data query script is specifically used for data extraction and query.

In addition, the association analysis module is further configured to query that an alarm has occurred in the alarm storage module according to the received attribute information for the alarm, so as to perform association relationship analysis (4). Then, the association analysis module stores the alarm and the association result thereof in an alarm storage module (5) and pushes the alarm and the association result thereof to an alarm display module (6).

The alarm storage module is used for storing alarms, attribute information of alarm objects and the incidence relation among the alarms. The alarm display module is used for displaying all alarms and the association relation among all the alarms to operation and maintenance personnel.

It should be noted that the above modules are all implemented by software, and may be used independently as an alarm management software tool, or may be added to EM or MANO in the NFV architecture as a software function. It should be noted that the above steps (1) to (6) correspond to the steps (1) to (6) marked in fig. 2.

According to the device provided by the embodiment of the disclosure, after the association analysis module receives an alarm, a data query request for the alarm is sent to the VNF, so that all attribute information of an alarm object indicated by the alarm is obtained from the VNF, and then the association analysis module performs polling search in at least one stored alarm in the alarm library according to all the obtained attribute information, so that the stored alarm in association relation with the alarm storage is obtained. Even if facing the communication system with a large number of alarm types and complex relation, the association between the alarms can be completed more simply.

Fig. 3 is a flowchart of a method for implementing alarm association according to an embodiment of the present disclosure. The main execution body of the method for realizing alarm association is the association analysis module shown in fig. 2. Referring to fig. 3 in conjunction with the execution flow of an alarm implementation association process shown in fig. 4, a method flow provided by the embodiment of the present disclosure includes:

301. after receiving an alarm, the association analysis module obtains a data query script of the alarm, calls the data query script, and sends a data query request for the alarm to the VNF, where the data query request at least includes first identification information of a first alarm object indicated by the alarm.

In the embodiment of the present disclosure, the alarm received by the association analysis module is forwarded by the alarm receiving module, that is, after a software or hardware fault occurs in the NFV system, the VNF sends an alarm to the alarm receiving module, and the alarm receiving module is responsible for forwarding the collected alarm to the association analysis module for subsequent association analysis.

For each alarm, a script is preset for the alarm, and this script is referred to as a data query script in the embodiment of the present disclosure, and may be used to query the VNF for attribute information of an alarm object. That is, after receiving an alarm sent by the alarm receiving module, the association analysis module automatically obtains the data query script of the alarm, and calls the data query script to send a data query request for the alarm to the VNF, so as to request the VNF to return all attribute information of the first alarm object indicated by the alarm.

It should be noted that the data query script in the embodiment of the present disclosure is only used for data extraction in the alarm or querying attribute information of an alarm object to the VNF, that is, is only used for data extraction and data collection, which is different from a script for implementing alarm association in the prior art, and does not need to set an association relationship between alarms.

The first identification information of the first alarm object is used to identify the first alarm object so as to distinguish the first alarm object from other alarm objects, for example, the first identification information may be "link name L NK 01".

302. And the association analysis module receives first attribute information which is returned by the VNF and aims at the first alarm object.

As described in step 301, the first attribute information is obtained by the VNF according to the first identification information after receiving the data query request. The association analysis module may obtain the most complete attribute information of the first alarm object by sending the data query request to the VNF. Therefore, even if all attribute information of the first alarm object is not carried in the alarm received by the association analysis module, for example, only a few key attribute information are carried, such as only the first identification information of the first alarm object, and the service parameters, the referenced other objects, the calling resources and the like of the first alarm object are not carried, the situation that alarm association cannot be realized does not occur, and the problem that the realization of alarm association in the prior art depends heavily on the parameters carried by the alarm is solved.

In other words, the embodiment of the present disclosure obtains the association relationship between alarms by querying the VNF for the attribute information of the alarm object, without depending on the parameters carried by the alarms themselves. In addition, compared with the mode that the alarm correlation is realized and the strength depends on the manually preset script in the prior art, the embodiment of the disclosure saves the workload of manually writing and maintaining the script for realizing the alarm correlation, and realizes the automatic correlation of the alarm.

In the embodiment of the present disclosure, the attribute information of the first alarm object may include a plurality of attributes, and each attribute is composed of an attribute name + an attribute value. Taking fig. 4 as an example, fig. 4 shows an execution flow of the association process for implementing an alarm. In fig. 4, after the first attribute information query of the first alarm object is performed, the obtained first attribute information may include, for example, an attribute name 1+ an attribute value 1, an attribute name 2+ an attribute value 2, an attribute name 3+ an attribute value 3, and the like. The type of the alarm object is used to indicate which type of fault the corresponding alarm belongs to, for example, the type of the alarm object may be a signaling link, a module, an IP address, and the like, which is not specifically limited in this embodiment of the disclosure.

In summary, the

above steps

301 and 302 complete the receiving of the alarms and the querying of the first attribute information of the first alarm object, and then, as shown in fig. 4, the stored alarms in the alarm library may be polled according to the queried first attribute information to perform association between the alarms, and the specific implementation process is shown in the following step 303.

303. And the association analysis module performs polling search in at least one stored alarm according to the first attribute information of the first alarm object to obtain a target stored alarm which has an association relation with the alarm.

In the embodiment of the present disclosure, the alarm library is used to collectively refer to all stored alarms stored in the alarm storage module.

In addition, as can be known from fig. 4, two situations are usually encountered when performing alarm association, one is that the alarm just received is a sub-alarm of other alarms, and the other is that the alarm just received is a root alarm of other alarms, so that when polling the alarm library to perform alarm association, the embodiment of the present disclosure provides the following two association relationship determination methods.

In the first way, this alarm is a sub-alarm of the stored alarms.

The first method corresponds to condition 1 in fig. 4. If the alarm satisfies the following criteria, then the alarm is treated as a sub-alarm for the stored alarm:

for each of the at least one stored alarm, if the second identification information of the second alarm object indicated by the one stored alarm matches one of the first attribute information,

and the alarm level of the stored alarm is greater than the alarm level of the alarm just received, the alarm is determined as a sub-alarm of the stored alarm.

In short, if the second identification information of the second alarm object of one stored alarm in the alarm library is the attribute name X + attribute value X of the first alarm object, and the alarm level > of the stored alarm is the alarm level of the alarm, the alarm is taken as a sub-alarm of the stored alarm.

In the second way, this alarm is used as the root alarm of the stored alarms.

The second method corresponds to condition 2 in fig. 4. If the alarm satisfies the following criteria, then the alarm is used as a root alarm for the stored alarm:

for each alarm in the at least one stored alarm, if one of the second attribute information of the second alarm object indicated by one stored alarm matches the first identification information of the first alarm object,

and the alarm level of the alarm is greater than the alarm level of the stored alarm, the alarm is determined as the root alarm of the stored alarm.

In short, if the attribute name Y + attribute value Y of the second alarm object indicated by one stored alarm in the alarm library is the first identification information of the first alarm object, and the alarm level of the stored alarm is less than the alarm level of the alarm, the stored alarm is taken as a sub-alarm of the alarm.

It should be noted that the alarm level is carried in each alarm as a necessary option, and therefore, after an alarm is received, the alarm level of the alarm can be directly obtained from the content carried by the alarm.

In another embodiment, after all stored alarms in the alarm library are polled, the embodiment of the disclosure supports storing the alarm, the attribute information of the corresponding alarm object, and the association relationship between the alarms in the alarm storage module, and pushing the alarm and the association relationship between the alarms to the alarm display module, so that the alarm display module displays the alarm and the association relationship between the alarms to the operation and maintenance staff.

In other words, after obtaining at least one target stored alarm having an association relationship with the alarm, the association analysis module further stores the type information, the first identification information, the first attribute information, and the association relationship between the alarm and the at least one target stored alarm in the alarm storage module, and displays the type information, the first identification information, and the association relationship between the alarm and the at least one target stored alarm on the alarm display interface through the alarm display module.

Taking the above type information as a signaling link, the first identification information as a link name L NK01, and the association relationship between the alarm and the alarms a and B as an example, the alarm storage module may store the alarm in the form of the following list when storing the alarm.

TABLE 1

Of course, other storage manners may also be adopted, and this is not particularly limited in the embodiments of the present disclosure. For example, the association relationship between alarms is displayed on the alarm display interface through a tree diagram. Taking the current alarm as the alarm C as an example, the association relationship among the alarm a, the alarm B and the alarm C can be displayed through the tree diagram shown in fig. 5.

In another embodiment, the operation and maintenance personnel may further modify the association relationship automatically analyzed by the association analysis module, for example, the association relationship automatically analyzed by the association analysis module may be rejected, and the association analysis module may automatically record the rejection result of the operation and maintenance personnel, and may not correlate the rejected alarm.

In another embodiment, the suspected association relationships between alarms can be found by comparing the attribute information of the newly received alarm with the identification information of at least one alarm object indicated by the stored alarm through an artificial intelligence fuzzy recognition technology, and the result of the artificial confirmation of the suspected association relationships can be used as the rule of the next association.

That is, in the embodiment of the present disclosure, the text analysis capability of the artificial intelligence fuzzy recognition technology is utilized to perform fuzzy comparison between the attribute name and the attribute value of the first alarm object indicated by the alarm and the identification information of at least one alarm object indicated by the stored alarm, and the stored alarm with high similarity is also used as the suspected alarm having the association relationship with the alarm.

In addition, after the suspected alarms are pushed to the alarm display module, when the alarm display module displays the suspected alarms, the suspected alarms can be distinguished from the determined alarms which really have the association relationship, for example, the suspected alarms are specially identified. Thus, the operation and maintenance personnel can confirm whether the suspected alarms are actually associated with the alarm or not manually. For a suspected alarm, if the suspected alarm is manually confirmed to have an association relationship with the newly received alarm, the alarm storage module also stores the association relationship between the suspected alarm and the newly received alarm.

The above process can be summarized as follows:

and for each piece of attribute information in the first attribute information of the newly received alarm, carrying out fuzzy comparison on the attribute information and at least one piece of identification information of at least one alarm object. Wherein the at least one alarm object corresponds to the at least one stored alarm, i.e. the at least one alarm object is from the at least one stored alarm. If the similarity between the attribute information and the identification information of any one of the at least one alarm object is greater than a preset threshold, determining the alarm corresponding to any one of the alarm objects as a suspected alarm having an association relationship with the alarm.

The preset threshold may be 90% or 95%, and the like, which is not specifically limited in the embodiment of the present disclosure. Then, displaying the type information of the suspected alarm and the identification information of the suspected alarm through an alarm display module, and displaying an association relationship confirmation prompt message aiming at the suspected alarm; and if the operation of confirming the association relationship of the operation maintenance personnel for the suspected alarm is subsequently received, storing the association relationship between the alarm and the suspected alarm through an alarm storage module.

Referring to fig. 6, the method for implementing alarm association as described above is illustrated as a specific example.

As shown in fig. 6, the alarm receiving module receives a signaling link failure alarm sent by the VNF, and forwards the signaling link failure alarm to the association analysis module.

The association analysis module extracts that the alarm object indicated by the alarm is a "signaling link", that is, the type of the alarm object is a signaling link, the identification information of the alarm object is "link name L NK 01", and constructs L ST L NK command to query the VNF for the attribute information of the link with link name L NK01 in the signaling link, referring to fig. 6, the attribute information of the link name L NK01 includes a series of attribute names and attribute values.

The correlation analysis module finds a module fault alarm in the alarm storage module, the identification information of the alarm object indicated by the alarm is "module number is 8", which is equal to one of the attributes of the inquired link name L NK01 "module number is 8", and the alarm level of the module fault alarm is the alarm level of the signaling link fault, so that the signaling link fault alarm is taken as a sub-alarm of the module fault alarm.

The suspected alarm determination process based on the artificial intelligence fuzzy recognition technology is as follows:

for example, for the above-mentioned alarm object "link name L NK 01", an attribute in the attribute information is "home IP address 172.25.10.130", and there is a stored alarm in the alarm library, the stored alarm is an IP collision alarm, and the identification information of the alarm object is "IP address 172.25.10.130", after comparison, it is found that the "home IP address 172.25.10.130" of the IP collision alarm is similar to the "IP address 172.25.10.130" of the signaling link failure alarm, so the IP collision alarm is taken as a suspected alarm of the signaling link failure alarm.

According to the method provided by the embodiment of the disclosure, after the association analysis module receives an alarm, a data query request for the alarm is sent to the VNF, so that all attribute information of an alarm object indicated by the alarm is obtained from the VNF, and then the association analysis module performs polling search in at least one stored alarm in the alarm library according to all the obtained attribute information, so that the stored alarm in association relation with the alarm storage is obtained. Even if facing the communication system with a large number of alarm types and complex relation, the association between the alarms can be completed more simply.

Furthermore, through the text analysis capability based on the artificial intelligence fuzzy recognition technology, suspected alarms which are suspected to have a suspected association relation with newly received alarms can be mined from stored alarms in an alarm library, and the further association relation establishment is carried out through manual confirmation on the suspected alarms, so that the establishment mode of the association relation is expanded, and the method is more intelligent.

Fig. 7 is a schematic structural diagram of an apparatus for implementing alarm association according to an embodiment of the present disclosure. Referring to fig. 7, the apparatus includes:

an alarm receiving module 701, configured to obtain a data query script of an alarm after receiving the alarm; calling the data query script, and sending a data query request aiming at the alarm to a VNF, wherein the data query request at least comprises first identification information of a first alarm object indicated by the alarm; receiving first attribute information, which is returned by the VNF and is aimed at the first alarm object, wherein the first attribute information is acquired by the VNF according to the first identification information after the VNF receives the data query request;

and the association analysis module 702 is configured to perform polling search in at least one stored alarm according to the first attribute information of the first alarm object, so as to obtain a target stored alarm having an association relationship with the alarm.

In another embodiment, the association analysis module 702 is configured to, for each of the at least one stored alarm, determine the alarm as a sub-alarm of the stored alarm if the second identification information of the second alarm object indicated by the stored alarm matches one of the first attribute information and the alarm level of the stored alarm is greater than the alarm level of the alarm.

In another embodiment, the association analysis module 702 is configured to, for each of the at least one stored alarm, determine that the alarm is a root alarm of the stored alarms if one of the second attribute information of the second alarm object indicated by the stored alarm matches the first identification information of the first alarm object and an alarm level of the alarm is greater than an alarm level of the stored alarm.

In another embodiment, the association analysis module 702 is further configured to, for each piece of attribute information in the first attribute information, perform fuzzy comparison on the attribute information and at least one piece of identification information of at least one alarm object, where the at least one alarm object corresponds to the at least one stored alarm; if the similarity between the attribute information and the identification information of any one of the at least one alarm object is greater than a preset threshold, determining the alarm corresponding to any one of the alarm objects as a suspected alarm having an association relationship with the alarm.

In another embodiment, referring to fig. 8, the apparatus further comprises:

an alarm display module 703, configured to display the type information of the suspected alarm and the identification information of the suspected alarm, and display an association confirmation prompt message for the suspected alarm;

an alarm storage module 704, configured to store the association between the alarm and the suspected alarm after receiving an association confirmation operation for the suspected alarm.

In another embodiment, the alarm storage module 704 is configured to store the type information of the alarm, the first identification information, the first attribute information, and the association relationship between the alarm and the at least one target stored alarm after obtaining the at least one target stored alarm having an association relationship with the alarm;

an alarm display module 703, configured to display the type information of the alarm, the first identification information, and the association relationship between the alarm and the at least one target stored alarm.

It should be noted that: in the apparatus for implementing alarm association provided in the foregoing embodiment, when implementing alarm association, only the division of each functional module is illustrated, and in practical application, the function distribution may be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules, so as to complete all or part of the functions described above. In addition, the apparatus for implementing alarm association and the method embodiment for implementing alarm association provided by the above embodiments belong to the same concept, and specific implementation processes thereof are detailed in the method embodiment and are not described herein again.

Fig. 9 is a schematic structural diagram of an apparatus 900 for implementing alarm association according to an embodiment of the present disclosure. Referring to fig. 9, the apparatus 900 includes a processor, a communication interface, a memory, and a communication bus, and may further include an input/output interface, wherein the processor, the memory, the input/output interface, and the communication interface complete communication with each other through the communication bus. The memory stores at least one instruction, at least one program, code set, or instruction set, and the processor is configured to execute the at least one instruction, at least one program, code set, or instruction set stored in the memory, so as to implement the method for implementing alarm association according to the foregoing embodiments.

In an exemplary embodiment, a computer readable storage medium, such as a memory, storing a computer program is provided, where at least one of the above-mentioned instructions, at least one program, a set of codes, or a set of instructions, when executed by a processor, implement the method for implementing alarm association as described in the above-mentioned embodiments. For example, the computer-readable storage medium may be a Read-Only Memory (ROM), a Random Access Memory (RAM), a Compact Disc Read-Only Memory (CD-ROM), a magnetic tape, a floppy disk, an optical data storage device, and the like.

It will be understood by those skilled in the art that all or part of the steps for implementing the above embodiments may be implemented by hardware, or may be implemented by a program instructing relevant hardware, where the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a magnetic disk or an optical disk, etc.

The above description is intended to be exemplary only and not to limit the present disclosure, and any modification, equivalent replacement, or improvement made without departing from the spirit and scope of the present disclosure is to be considered as the same as the present disclosure.

Claims

1. A method for implementing alarm association, the method comprising:

after receiving an alarm, acquiring a data query script of the alarm, wherein the alarm carries an alarm level of the alarm;

calling the data query script, and sending a data query request aiming at the alarm to a Virtual Network Function (VNF), wherein the data query request at least comprises first identification information of a first alarm object indicated by the alarm;

receiving first attribute information, which is returned by the VNF and is aimed at the first alarm object, wherein the first attribute information is obtained by the VNF according to the first identification information after the VNF receives the data query request, the first attribute information comprises a plurality of attributes, and each attribute is composed of an attribute name and an attribute value;

2. The method of claim 1, further comprising:

3. The method of claim 1, further comprising:

4. The method of claim 3, further comprising:

5. The method according to any one of claims 1 to 2, further comprising:

6. An apparatus for implementing alarm association, the apparatus comprising:

the alarm receiving module is used for acquiring a data query script of an alarm after receiving the alarm, wherein the alarm carries the alarm level of the alarm; calling the data query script, and sending a data query request aiming at the alarm to a Virtual Network Function (VNF), wherein the data query request at least comprises first identification information of a first alarm object indicated by the alarm; receiving first attribute information, which is returned by the VNF and is aimed at the first alarm object, wherein the first attribute information is acquired by the VNF according to the first identification information after the VNF receives the data query request;

and the association analysis module is used for determining the alarm as a sub-alarm of the stored alarm if the second identification information of the second alarm object indicated by the stored alarm is matched with one attribute information in the first attribute information and the alarm level of the stored alarm is greater than the alarm level of the alarm for each stored alarm in at least one stored alarm.

7. The apparatus of claim 6, wherein the association analysis module is configured to determine, for each of the at least one stored alarm, the alarm as a root alarm of the stored alarm if one of the second attribute information of the second alarm object indicated by the stored alarm matches the first identification information of the first alarm object and an alarm level of the alarm is greater than an alarm level of the stored alarm.

8. The apparatus according to claim 6, wherein the association analysis module is further configured to, for each piece of attribute information in the first attribute information, perform fuzzy comparison between the attribute information and at least one identification information of at least one alarm object, where the at least one alarm object corresponds to the at least one stored alarm; if the similarity between the attribute information and the identification information of any one of the at least one alarm object is greater than a preset threshold, determining the alarm corresponding to any one of the alarm objects as a suspected alarm having an association relationship with the alarm.

9. The apparatus of claim 8, further comprising:

the alarm display module is used for displaying the type information of the suspected alarm and the identification information of the suspected alarm and displaying an association relationship confirmation prompt message aiming at the suspected alarm;

and the alarm storage module is used for storing the association relationship between the alarm and the suspected alarm after receiving the association relationship confirmation operation aiming at the suspected alarm.

10. The apparatus of any one of claims 6 to 7, further comprising:

the alarm storage module is used for storing the type information of the alarm, the first identification information, the first attribute information and the association relationship between the alarm and at least one target stored alarm after obtaining at least one target stored alarm having the association relationship with the alarm;

and the alarm display module is used for displaying the type information of the alarm, the first identification information and the association relationship between the alarm and the at least one target stored alarm.

11. A computer-readable storage medium, having stored therein at least one instruction, at least one program, a set of codes, or a set of instructions, which is loaded and executed by a processor to implement the method of implementing an alarm association according to any one of claims 1 to 5.