WO2016119436A1

WO2016119436A1 - Alarm processing method and device, and controller

Info

Publication number: WO2016119436A1
Application number: PCT/CN2015/086803
Authority: WO
Inventors: 陈俏钢; 薄开涛
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-01-27
Filing date: 2015-08-12
Publication date: 2016-08-04
Also published as: CN105991332A

Abstract

Disclosed are an alarm processing method and device, and a controller. The method comprises: receiving an alarm from a network device; analyzing the alarm to obtain an analysis result; and processing the alarm according to the analysis result. By means of the present invention, the problem in the related art is solved that alarms are not processed timely and performance an upper layer network device is low when the number of the alarms is great, and accordingly the effect of efficiently and timely processing the alarms is achieved.

Description

Alarm processing method, device and controller

Technical field

The present invention relates to the field of communications, and in particular to an alarm processing method, apparatus, and controller.

Background technique

In a communication network, a network consists of a number of communication device nodes, which are called network elements. The network elements are connected by communication lines, including fiber optic cables and the like. The network elements are distributed in various regions, some in the communication building laboratory in the city, and some network elements are in remote areas. However, the equipment of these network elements needs to be configured, maintained and monitored. It is impossible to assign personnel to each place. This requires a central network management system, which is placed in the central computer room to configure and maintain various nodes on the network through remote communication. monitor.

Managing the network through the controller can be achieved by an emerging network management control system. In this control system, the control functions of the service resources in the traditional network management are separated, and only the service resources are concerned. Controllers can be hierarchically organized in a tree to correlate large-scale networks. The controller that directly manages the NEs can be called a domain controller (D-Controller, or DC). The controller of the upper layer (Super Controller, or S-Controller, or SC) does not directly manage NEs. Instead, the domain controller is managed, and then the virtual network management provided by the domain controller is used to manage the actual network. FIG. 1 is a schematic diagram of networking in which a controller management network is used in the related art. As shown in FIG. 1 , in an application scenario, a controller forms a tree management system, and an upper layer is an SC, an underlying DC partition management domain, and a management communication network. And network elements. The controller is managed by the interface in the south direction and the network device, and the northbound interface allows the application layer to access the network APP (Application) for network management, and also through the side interface and the same network management plane (including: the network element management system ( Element Management System (referred to as EMS), Network Management System (NMS), or Operation Support System (OSS) communicates management information. The network APP is the actual business application of the network, and uses the resources provided by the controller to issue requests for service establishment, deletion, and modification. The controller establishes, deletes, and modifies the service according to the request of the network APP, and monitors the alarm and performance of the service. 2 is a schematic diagram of a relationship between a controller and other network entities in a Software Defined Network (SDN) network in the related art. As shown in FIG. 2, the DC directly manages the communication network, and the SC manages the DC. It can also communicate with traditional network management systems to provide resources and services to the APP.

During the actual operation of the network, faults may be encountered, or interference may be received and communication quality may be degraded. Once this is sent, the network device reports an alert. Since the direct communication of the network device is closely related, if a device or a part of the resource reports a fault on the fault, the network will generate an alarm in a large area. Produce a lot of reports Police. For network administrators, it is difficult to find so many alarms for the real cause of the failure. The occurrence of a fault in the network triggers an alarm that directly reflects the fault. At the same time, a series of alarms are triggered because the fault affects other devices or services. For example, alarm A triggers alarm B, alarm A is the root alarm, and alarm B is the derivative alarm.

In the traditional network, the alarms are generated by the device. After receiving the alarm, the network controller directly forwards the alarm to the upper-layer network device that processes the alarm. Therefore, in the related technology, not only the alarm processing is not timely, but also the number of alarms. In many cases, the performance of the upper layer network device is low.

Summary of the invention

The embodiment of the present invention provides an alarm processing method, device, and controller, so as to solve at least the problem that the performance of the upper layer network device is low, not only in the case that the alarm processing is not timely, but also in the case that the number of alarms is large.

According to an aspect of the embodiments of the present invention, an alarm processing method is provided, including: receiving an alarm from a network device; analyzing the alarm to obtain an analysis result; and processing the alarm according to the analysis result.

Preferably, the analyzing the alarm to obtain the analysis result comprises: analyzing, according to the alarm cause of generating the alarm, whether the alarm has an impact on the service managed by the controller; The relationship between the resource of the alarm and the resource occupied by the service managed by the controller is analyzed to determine whether the alarm has an impact on the service managed by the controller.

Preferably, analyzing, according to the relationship between the resource that generates the alarm and the resource occupied by the service managed by the controller, analyzing whether the alarm affects the service managed by the controller The result includes one of the following: in a case where the root resource generating the alarm is not occupied by the service managed by the controller, and the sub-resource corresponding to the root resource is not occupied by the service managed by the controller Determining that the alarm does not affect the service managed by the controller; the root resource that generates the alarm is not occupied by the service managed by the controller, but the sub-resource corresponding to the root resource is In the case that the service managed by the controller is occupied, the alarm is determined to have an impact on the service managed by the controller; and the root resource generating the alarm is not occupied by the service managed by the controller. The sub-resource corresponding to the root resource is not occupied by the service managed by the controller, but the root resource and/or the sub-resource corresponding to the root resource and the service managed by the controller If the mapping relationship exists, determining that the alarm has an impact on the service managed by the controller; and determining that the root resource that generates the alarm is occupied by a service managed by the controller The business production impact on the controller management.

Preferably, processing the alarm according to the analysis result includes one of: following the alarm The reason is that if the alarm does not affect the service managed by the controller, the alarm is suppressed; and the resource occupied by the resource generated by the controller and the controller is used according to the resource that generates the alarm. If the relationship determines that the alarm does not affect the service managed by the controller, the alarm is suppressed; where the root resource generating the alarm is not managed by the controller If the sub-resource corresponding to the root resource is occupied by the service managed by the controller, the alarm is derived as a sub-resource-derived alarm; the root resource that generates the alarm is not used by the controller. The sub-resource corresponding to the root resource is not occupied by the service managed by the controller, but the root resource and/or the sub-resource corresponding to the root resource are managed by the controller. If the service has a mapping relationship, the alarm is derived as a relationship-derived alarm according to the mapping relationship; the root resource that generates the alarm is occupied by the service managed by the controller. If the alarm is used, the alarm is directly reported to the upper-layer network device.

Preferably, in the case of deriving the alarm, the method further includes: recording an association between the alarm and the derived derivative alarm, where the derivative alarm includes: a sub-resource-derived alarm and/or relationship Deriving the alarm; reporting the derived alarm and the association relationship to the upper layer network device, and/or providing the association relationship for the network element device in the controller management system to query.

Preferably, after the alarm is processed according to the analysis result, the method further includes: generating, according to a state change of the network element device caused by the alarm, or a state change of an object representing the resource of the alarm The status notification of the network element device or the object representing the resource; the status notification of the generated network element device or the object representing the resource is reported to the upper layer network device.

According to another aspect of the present invention, an alarm processing apparatus is provided, including: a receiving module configured to receive an alarm from a network device; and an analysis module configured to analyze the alarm to obtain an analysis result; The module is configured to process the alarm according to the analysis result.

Preferably, the analysis module includes: a first analysis unit, configured to analyze, according to the cause of the alarm that generates the alarm, whether the alarm has an impact on the service managed by the controller; and the second analysis unit And analyzing, according to the relationship between the resource that generates the alarm and the resource occupied by the service managed by the controller, analyzing, by the analysis, whether the alarm affects the service managed by the controller result.

Preferably, the second analyzing unit comprises one of: a first determining subunit, configured to be occupied by a service in which a root resource generating the alarm is not managed by the controller, and also having no corresponding root resource In the case that the sub-resource is occupied by the service managed by the controller, it is determined that the alarm does not affect the service managed by the controller; and the second determining sub-unit is set to generate the root of the alarm. The resource is not occupied by the service managed by the controller, but if the sub-resource corresponding to the root resource is occupied by the service managed by the controller, determining the service that the alarm manages to the controller The third determining subunit is configured to be occupied by a service in which the root resource generating the alarm is not managed by the controller, and the sub resource corresponding to the root resource is not used by the controller managed by the controller. Occupied, but the root resource and/or the corresponding resource of the root resource If the source has a mapping relationship with the service managed by the controller, determining that the alarm has an impact on the service managed by the controller; and determining, by the fourth determining subunit, that the root resource that generates the alarm is In the case that the service managed by the controller is occupied, the impact of the alarm on the service production managed by the controller is determined.

Preferably, the processing module includes one of the following: a first suppression unit, configured to: if the alarm is not affected by the service managed by the controller according to the alarm cause, The alarm is suppressed; the second suppression unit is configured to determine, according to the relationship between the resource that generates the alarm and the resource occupied by the controller, that the alarm does not manage the service managed by the controller In the case of an impact, the alarm is suppressed; the first derivative unit is configured to be occupied by a service in which the root resource generating the alarm is not managed by the controller, but the sub-resource corresponding to the root resource is In the case that the service managed by the controller is occupied, the alarm is derived as a sub-resource-derived alarm; and the second derivation unit is configured to be occupied by a service in which the root resource generating the alarm is not managed by the controller. The sub-resource corresponding to the root resource is not occupied by the service managed by the controller, but the root resource and/or the sub-resource corresponding to the root resource and the controller In the case that the managed service has a mapping relationship, the alarm is derived as a relationship-derived alarm according to the mapping relationship; the first reporting unit is configured to be a service that is managed by the controller in the root resource that generates the alarm. The alarm is reported to the upper-layer network device.

Preferably, the processing module further includes: a recording unit, configured to record an association relationship between the alarm and the derived derivative alarm in the case of deriving the alarm, wherein the derivative alarm includes: a sub-resource-derived alarm and/or a relationship-derived alarm; the second reporting unit is configured to report the derived alarm and the association relationship to an upper-layer network device, and/or a providing unit, configured to provide the association relationship The network element device query in the controller management system.

Preferably, the device further includes: a generating module, configured to generate the network element device or the representative according to a state change of the network element device caused by the alarm, or a state change of an object representing the resource of the alarm The status notification of the object of the resource; the reporting module is configured to report the status notification of the generated network element device or the object representing the resource to the upper layer network device.

According to still another aspect of the embodiments of the present invention, there is provided a controller comprising the alarm processing apparatus of any of the above.

Preferably, the controller comprises at least one of: a domain controller DC, a super controller SC, wherein the SC is an upper layer controller of the DC.

According to the embodiment of the present invention, the alarm is received from the network device, and the alarm is analyzed to obtain an analysis result; the alarm is processed according to the analysis result, and the related technology is not only timely Moreover, in the case of a large number of alarms, the performance of the upper layer network device is low, and the effect of efficiently and timely processing the alarm is achieved.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a schematic diagram of networking in which a controller management network is used in the related art;

2 is a schematic diagram of a relationship between a controller and other network entities in an SDN network in the related art;

FIG. 3 is a flowchart of an alarm processing method according to an embodiment of the present invention; FIG.

4 is a structural block diagram of an alarm processing apparatus according to an embodiment of the present invention;

FIG. 5 is a block diagram showing a preferred structure of an analysis module 44 in an alarm processing apparatus according to an embodiment of the present invention; FIG.

6 is a block diagram showing a preferred structure of a second analyzing unit 54 in the analyzing module 44 in the alarm processing apparatus according to an embodiment of the present invention;

7 is a block diagram 1 of a preferred structure of a processing module 46 in an alarm processing apparatus according to an embodiment of the present invention;

8 is a block diagram 2 of a preferred structure of a processing module 46 in an alarm processing apparatus according to an embodiment of the present invention;

9 is a block diagram showing a preferred structure of an alarm processing apparatus according to an embodiment of the present invention;

FIG. 10 is a structural block diagram of a controller according to an embodiment of the present invention; FIG.

11 is a schematic structural diagram of a controller alarm analysis module according to an embodiment of the present invention;

FIG. 12 is a schematic diagram of alarm reporting processing according to an embodiment of the present invention; FIG.

FIG. 13 is a schematic diagram of alarm reporting processing according to a preferred embodiment 2 of the present invention.

detailed description

The invention will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

An alarm processing method is provided in this embodiment. FIG. 3 is a flowchart of an alarm processing method according to an embodiment of the present invention. As shown in FIG. 3, the flow includes the following steps:

Step S302, receiving an alarm from the network device, it should be noted that the network device may be the network element device itself that generates the alarm, or may be a controller device;

Step S304, analyzing the alarm to obtain an analysis result;

Step S306, processing the alarm according to the analysis result.

Through the above steps, the controller analyzes and processes the received alarms, which solves the problem that the alarm processing is not timely in the related art, and the performance of the upper layer network device is low in the case of a large number of alarms. The effect of efficient and timely processing of alarms.

Preferably, when the analysis is performed on the alarm, the analysis result is different, and the analysis result may be different. For example, the alarm may be generated according to the alarm cause of the alarm, and the analysis may be performed to analyze whether the alarm affects the service managed by the controller. As a result, the analysis result of whether the alarm affects the service managed by the controller may be analyzed according to the relationship between the resource that generates the alarm and the resource occupied by the controller.

When analyzing the result of analyzing whether the alarm affects the service managed by the controller according to the relationship between the resource generated by the alarm and the resource occupied by the controller, the following may be included: the root of the alarm is generated. If the resource is not occupied by the service managed by the controller, and the sub-resource corresponding to the root resource is occupied by the service managed by the controller, the alarm is determined to have no impact on the service managed by the controller; If the service is not occupied by the controller, but the sub-resource corresponding to the root resource is occupied by the service managed by the controller, it is determined that the alarm affects the service managed by the controller; the root resource that generates the alarm is not controlled by the controller. When the managed service is occupied, the sub-resource corresponding to the root resource is not occupied by the service managed by the controller. However, if the root resource and/or the sub-resource corresponding to the root resource are mapped to the service managed by the controller, the alarm is determined. Impact on the services managed by the controller; the situation in which the root resource generating the alarm is occupied by the controller Next, determine the impact of the alarm on the business production managed by the controller.

When the alarm is processed according to the analysis result, the alarm is processed differently according to the analysis result. The following example shows that the alarm can be suppressed in the following cases: for example, the alarm is analyzed according to the cause of the alarm. If the controller does not affect the service managed by the controller, the alarm is suppressed. For example, the relationship between the resource generated by the alarm and the resource occupied by the controller is determined. In the case of an impact, the alarm is suppressed; the alarm may be derivatized in the following cases: for example, the root resource that generates the alarm is not occupied by the service managed by the controller, but the sub-resource corresponding to the root resource is When the controller manages the service, the alarm is derived as a sub-resource-derived alarm; for example, the root resource that generates the alarm is not occupied by the service managed by the controller, and the sub-resource corresponding to the root resource is not used by the controller. Managed business, but sub-resources corresponding to root resources and/or root resources and controller-managed industries If a mapping relationship exists, the alarm is derived as a relationship-derived alarm according to the mapping relationship. In addition, when the root resource generating the alarm is occupied by the service managed by the controller, the alarm is directly reported to the upper-layer network device. It should be noted that the upper layer network device herein is a relative concept. For example, when the controller DC receives the alarm, the upper layer network device is the upper layer network device SC of the controller DC, and for example, when the upper layer network is used. When the device SC receives the alarm, the upper layer network device is the upper layer network device NMS of the SC.

It should be noted that, in the case of deriving the alarm, it is also possible to: record the alarm and the derived Derived alarm relationship, where the derivative alarm includes: a sub-resource-derived alarm and/or a relationship-derived alarm; the derived alarm and the association relationship are reported to the upper-layer network device, and/or the association relationship is provided for the controller management system. NE device query.

In addition, after the alarm is processed according to the analysis result, the following processing may be further included: generating a network element device or an object representing a resource according to a state change of the network element device caused by the alarm, or a state change of an object representing the resource of the alarm The status notification of the generated network element device or the object representing the resource is reported to the upper layer network device.

In the embodiment, an alarm processing device is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and has not been described again. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

4 is a block diagram showing the structure of an alarm processing apparatus according to an embodiment of the present invention. As shown in FIG. 4, the apparatus includes a receiving module 42, an analyzing module 44, and a processing module 46, which will be described below.

The receiving module 42 is configured to receive an alarm of the network element device in the controller management system; the analyzing module 44 is connected to the receiving module 42 and configured to analyze the alarm to obtain an analysis result; the processing module 46 is connected to the analysis module. 44. Set to process the alarm according to the analysis result.

FIG. 5 is a block diagram showing a preferred structure of an analysis module 44 in an alarm processing apparatus according to an embodiment of the present invention. As shown in FIG. 5, the analysis module 44 includes one of the following: a first analysis unit 52, a second analysis unit 54, and the like. The analysis module 44 will be described.

The first analyzing unit 52 is configured to analyze whether the alarm has an impact on the service managed by the controller according to the alarm cause of generating the alarm; and the second analyzing unit 54 is configured to be managed according to the resource and the controller that generate the alarm. The relationship between the resources occupied by the service analyzes the analysis result of whether the alarm affects the service managed by the controller.

FIG. 6 is a block diagram showing a preferred structure of the second analyzing unit 54 in the analyzing module 44 in the alarm processing apparatus according to the embodiment of the present invention. As shown in FIG. 6, the second analyzing unit 54 includes one of the following: the first determining sub-unit 62. The second determining subunit 64, the third determining subunit 66, and the fourth determining subunit 68, the second analyzing unit 54 will be described below.

The first determining sub-unit 62 is configured to determine the alarm pair control in the case that the root resource generating the alarm is not occupied by the service managed by the controller, and the sub-resource corresponding to the root resource is not occupied by the service managed by the controller. The service managed by the device does not have an impact; the second determining sub-unit 64 is configured to be occupied by the service that the root resource that generates the alarm is not occupied by the controller, but the sub-resource corresponding to the root resource is occupied by the service managed by the controller. Determining that the alarm has an impact on the service managed by the controller; the third determining subunit 66 is set to be the root of the alarm generated. The resource is not occupied by the service managed by the controller, and the sub-resource corresponding to the root resource is not occupied by the service managed by the controller, but the sub-resource corresponding to the root resource and/or the root resource is mapped to the service managed by the controller. In the case that the alarm is determined to affect the service managed by the controller, the fourth determining sub-unit 68 is configured to determine the service production managed by the controller for the alarm when the root resource generating the alarm is occupied by the service managed by the controller. influences.

FIG. 7 is a block diagram of a preferred structure of a processing module 46 in an alarm processing apparatus according to an embodiment of the present invention. As shown in FIG. 7, the processing module 46 includes one of the following: a first suppression unit 70, a second suppression unit 72, and a first A derivation unit 74, a second derivation unit 76, and a first reporting unit 78, the processing module 46 will be described below.

The first suppression unit 70 is configured to suppress the alarm if the alarm does not affect the service managed by the controller according to the cause of the alarm; the second suppression unit 72 is configured to be based on the resource generated by the alarm. The relationship between the resources occupied by the controller-managed service determines that the alarm does not affect the service managed by the controller, and the alarm is suppressed; the first derivative unit 74 is configured to not control the root resource that generates the alarm. If the service managed by the device is occupied by the service, but the sub-resource corresponding to the root resource is occupied by the service managed by the controller, the alarm is derived as a sub-resource-derived alarm; and the second derivation unit 76 is set to not generate the root resource of the alarm. The service is managed by the controller, and the sub-resource corresponding to the root resource is not occupied by the service managed by the controller. However, if the root resource and/or the sub-resource corresponding to the root resource are mapped to the service managed by the controller, According to the mapping relationship, the alarm is derived as a relationship-derived alarm; the first reporting unit 78 is set to be controlled at the root resource that generates the alarm. The case manager of business occupied, alarm reporting directly to the upper-layer network device.

FIG. 8 is a block diagram of a preferred structure of the processing module 46 in the alarm processing apparatus according to the embodiment of the present invention. As shown in FIG. 8, the processing module 46 includes the first derivative module 74 and/or the first derivative module 76, Also included is a recording unit 82, a second reporting unit 84, and/or a providing unit 86, which is described below.

The recording unit 82 is configured to: record, in the case of deriving the alarm, the association between the alarm and the derived derivative alarm, where the derivative alarm includes: a sub-resource-derived alarm and/or a relationship-derived alarm; the second report The unit 84 is configured to report the derived alarm and the association relationship to the upper layer network device, and/or the providing unit 86 is configured to provide an association relationship for the network element device query in the controller management system.

FIG. 9 is a block diagram of a preferred structure of an alarm processing apparatus according to an embodiment of the present invention. As shown in FIG. 9, the apparatus includes: a generating module 92 and a reporting module 94, in addition to all the modules shown in FIG. The device is described.

The generating module 92 is connected to the processing module 46, and configured to generate a status notification of the network element device or the object representing the resource according to the state change of the network element device caused by the alarm or the state change of the object representing the resource of the alarm; The module 94 is connected to the generating module 92, and is configured to report the status notification of the generated network element device or the object representing the resource to the upper layer network device.

FIG. 10 is a block diagram showing the structure of a controller according to an embodiment of the present invention. As shown in FIG. 10, the controller 100 includes the alarm processing device 102 of any of the above.

Preferably, the controller may include at least one of the following: a domain controller DC, a super controller SC, wherein the SC is an upper layer controller of the DC. It should be pointed out that there can be multiple SCs. From the perspective of DC, SC is the upper controller. If there is SC on the SC, the above is the upper controller. This is the relative relationship.

In the network controlled by the SDN controller, due to the control characteristics of the SDN controller, it only cares about the resources related to the service, and due to the division of the rights, the original alarm may be generated by resources unrelated to the service, or by the controller. The management of the business, but the impact on the controller management business, resulting in business failure, or quality degradation. Since the main core of the controller is to perform service management, the network management system or the control plane does not generate alarms for the device resources and the service. In this embodiment, in the embodiment, the alarm is also presented as a service alarm. The controller derives the affected service alarms. In addition, in addition to the alarm derivation, the controller also needs to analyze the alarm affecting the service, and the alarm continues to be reported.

The scheme is briefly described below.

An alarm analysis module is added to the network controller. FIG. 11 is a schematic structural diagram of a controller alarm analysis module according to an embodiment of the present invention. As shown in FIG. 11, the alarm analysis module performs the following steps:

Step 1: After the device detects the fault, it generates an alarm and reports it to the controller and the NMS.

Step 2: After the controller receives the device alarm, it analyzes and processes it, including flexible combination of one or more of the following sub-steps:

Step 2.1: According to the cause of the alarm, the alarm causes no impact on the service. If one of the alarm causes is received, the alarm may not be processed or suppressed. Such alarm causes include, but are not limited to, temperature alarms, voltage alarms, smoke alarms, and the like, which are not listed one by one. Alarms that the controller needs to process, including but not limited to: LOS (Loss of Signal), DEG (Degraded Signal), LOC (Loss of Connectivity/Loss of Connection), AIS (Alarm Indication Signal).

Step 2.2: Analyze the alarm and find that the resource that generates the alarm is not the resource occupied by the service, nor does it affect the resources occupied by the service. Such alarms may not be processed or suppressed. Such resources include, but are not limited to, power modules, fan modules, backplane buses, and the like. The controller needs to process the generated alarm resources, including but not limited to: physical port, connection terminal point, path termination point, logical terminal point, flow point, and stream point pool.

Step 2.3: Analyze the alarm and find that the resource that generates the alarm is not the resource directly occupied by the service. However, if the sub-resource is occupied by the service, the alarm can be deduced into an alarm of the sub-resource occupied by the service, and then the controller sends the generated alarm. Reported to the upper controller and the network management plane. The original alarm can continue to be reported according to the implementation needs or Not reported.

Step 2.4: Analyze the alarm and find that the resource that generates the alarm is the resource occupied by the service. The alarm that is reported is the alarm of the service. The alarm is sent to the upper-layer controller and the network management plane.

Step 2.5: Analyze the alarm and find that the resource that generates the alarm has no direct correspondence with the resource object of the service, but has an indirect mapping relationship (for example, virtualization), and the controller derives according to the indirect mapping relationship. The alarm of the service resource, and then the controller reports the derivative alarm to the upper layer control and the network management plane. The original alarm can be reported or not reported according to the implementation requirements.

Step 2.6: Analyze the alarm and find that the alarm is a network element alarm, but the controller is not interested in the alarm, but is interested in the change of the network element status caused by the alarm. The controller suppresses or discards the alarm, generates a status notification, and modifies the alarm. The status of the local NE is reported to the upper-layer controller and the NMS plane.

Step 2.7: The new alarm generated by the controller, the corresponding relationship between the original alarm and the derived alarm is recorded, and provided when the alarm is reported, or a query is provided, so that the network management plane performs root cause analysis to find the root cause of the fault, and repair and Troubleshoot.

Step 3: After the EMS receives the original alarm from the device and receives the derived alarm from the controller, the EMS can perform local storage, display, confirmation, and annotation management. The EMS reports both alarms to the NMS/OSS.

Step 4: After receiving the derivative alarm reported by the lower-layer controller, the upper-layer controller performs the local analysis processing by using the analysis and processing method of step 2. The result is reported to the APP and the OSS/NMS.

Step 5: After receiving the service alarm, the APP is used for interface display and service quality assessment.

Step 6: The OSS/NMS receives the original alarms reported by the EMS, and the derived alarms, and the derived alarms reported from the upper-layer controllers for comprehensive analysis, including analysis of alarm correlations, root cause analysis, etc., for network operation, maintenance, and elimination. Provide basis for failure, billing, etc.

The method for processing device resource alarms by the controller includes analyzing, processing, deriving, and continuing to report to other systems after receiving the alarm. It provides an efficient and feasible alarm processing method for the controller to handle alarms.

The following describes an alarm analysis processing method by taking an alarm generated in a service across multiple controllers as an example.

Preferred embodiment 1

12 is a schematic diagram of an alarm reporting process according to a preferred embodiment of the present invention. As shown in FIG. 12, domain controllers DC1 and DC2, a zone management communication network, and a super controller SC are used as upper controllers to manage DC1 and DC2. . Two management domains are connected to NE1, and NE2 to NE6 form a communication network. The connection between NE1 and NE6 indicates the service that the APP cares about. The service A endpoint is at NE1, the Z endpoint is at NE6, and the NE2 is passed through. NE3, NE4, and NE5 are directly managed by DC1 and DC2, respectively, and the dotted line in the figure indicates the management relationship. DC1, DC2, and SC respectively have a paired network management system. It is assumed that an alarm Alarm1 is generated in the network element 1, and other network elements also generate alarms.

Step 1: NE1 detects the fault, the smoke detector feels that the smoke is excessive, the smoke detection module generates the alarm alarm1, and reports it to DC1 and EMS1.

Step 2: After DC1 receives Alarm1, the analysis module analyzes the cause of the alarm and finds that the alarm cause of alarm1 is a smoke alarm, which is an alarm cause unrelated to the service, so DC1 ignores the alarm.

Step 3: If the fault is detected by the NE2, the fan module finds that the fan speed is abnormal. The alarm alarm2 is generated and reported to DC1 and EMS1.

Step 4: After DC1 receives alarm2, the analysis module analyzes the alarm source and finds that the resource generated by alarm2 is a fan module, which has nothing to do with the service, so DC1 ignores the alarm.

Step 5: The OTN optical port of the NE1 is faulty, and the OTN has a signal degradation alarm. The alarm alarm3 is generated and reported to DC1 and EMS1.

Step 6: DC1 receives the alarm3 and analyzes it. The analysis module analyzes the OTN port. Although the resource is not directly used by the service, the sub-channel ODU1-1 under the OTN is used in the service 1, and the DC1 derives the ODU1-1 resource. Degradation alarm alarm4, and record the corresponding relationship of alarm3-alarm4, then DC1 reports alarm4 to SC and EMS1, and the association of alarm3-alarm4 is attached.

Step 7: The EMS receives a total of alarm1, alarm2, alarm3, and alarm4. While performing traditional EMS alarm management, these alarms are reported to NMS/OSS1.

Step 8: The SC receives the alarm alarm4, and the analysis module finds that the resource ODU1 and the service 1 in the SC are virtualized and mapped to the service 2, and the ODU1 is virtualized into the LTP1. The derived module SC derives the alarm5 of the LTP1 resource from alarm4, and records the correspondence of alarm4-alarm5. The SC reports alarm5 to the app and NMS/OSS1 with the association of alarm4-alarm5.

Step 9: NMS/OSS1 receives alarms alarm1, alarm2, alarm3, alarm4, alarm5. Since the derived correspondence of alarm3-alarm4-alarm5 is already available, NMS/OSS1 can easily analyze that alarm3 is the root cause alarm. It is necessary to notify the maintenance personnel to repair the device and eliminate the fault.

Step 10: After receiving the alarm5, the APP knows that its service 2 has generated alarm 5, and service 2 has received an impact. App users communicate and coordinate with the network operator.

Similar alarms generated by NE3 and NE4 have been processed in DC2, EMS2, and NMS/OSS2.

Preferred embodiment two

FIG. 13 is a schematic diagram of an alarm reporting process according to a preferred embodiment of the present invention. As shown in FIG. 13, one network element NE1 in the network is managed by the implemented domain controller DC1, and is managed by the EMS1 network management system, and NE1 is generated. An alarm a, the result processing flow is as follows

Step 1: NE1 detects the fault and reports alarm a.

Step 2: DC1 analyzes the alarm a, analyzes the alarm cause and the alarm source, and finds that the sub-resource of the alarm a is used by the service, discards the alarm a according to the analysis result, derives the alarm b, and then reports the alarm b to the upper layer. Controller SC1, and network management system EMS1.

Step 3: After EMS1 receives alarm a and alarm b, alarms a and b are reported to the upper-layer network management system OSS1.

Step 4: After receiving the alarm b reported by the DC1, the SC1 analyzes the alarm reason and the alarm source, and finds that the resource of the alarm b is virtualized and becomes the logical object obj1. They belong to the virtualized mapping relationship, and the SC1 discards. Alarm b, derived from alarm c. SC1 reports the alarm c to the app and OSS1 at the same time.

Step 5: The app receives the alarm notification and knows that the abstract object obj1 in its own service has an alarm c. For the purpose of troubleshooting, the app issues a request for querying all alarms and associations to OSS1.

Step 6: OSS1 queries the alarm association relationship from SC1 to obtain the association relationship between alarm b and alarm c.

Step 7: OSS1 queries the alarm association relationship from EMS1.

Step 8: EMS1 finds the association between alarm a and alarm b from DC1. Report to OSS1.

Step 9: OSS1 summarizes the associations of alarms a, b, and c, and reports them to the APP.

Step 10: The app gets all the alarms a, b, c from the query response and knows that a is the root cause alarm. It is used to notify the operation and maintenance personnel to repair the equipment.

Obviously, those skilled in the art should understand that the above modules or steps of the embodiments of the present invention can be implemented by a general computing device, which can be concentrated on a single computing device or distributed in multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from The steps shown or described are performed sequentially, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated into a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above are only the preferred embodiments of the present invention, and are not intended to limit the present invention, and various modifications and changes can be made to the present invention. Anything made within the spirit and principles of the present invention Modifications, equivalent substitutions, improvements, etc., are intended to be included within the scope of the present invention.

Industrial applicability

As described above, the above-mentioned embodiments and the preferred embodiments solve the problem that the alarm processing is not timely in the related art, and the performance of the upper layer network device is low in the case of a large number of alarms, thereby achieving efficient and timely processing. The effect of the alarm.

Claims

An alarm processing method includes:

Receiving an alarm from a network device;

The alarm is analyzed to obtain an analysis result;

The alarm is processed according to the analysis result.
The method according to claim 1, wherein analyzing the alarm to obtain the analysis result comprises:

Determining, according to the cause of the alarm that generates the alarm, whether the alarm has an impact on the service managed by the controller;

And analyzing, according to the relationship between the resource that generates the alarm and the resource occupied by the service managed by the controller, whether the alarm has an impact on the service managed by the controller.
The method according to claim 2, wherein, according to the relationship between the resource generating the alarm and the resource occupied by the service managed by the controller, analyzing whether the alarm is managed by the controller The analysis results of the impact of the business include one of the following:

Determining the alarm pair if the root resource that generates the alarm is not occupied by the service managed by the controller, and the sub-resource corresponding to the root resource is not occupied by the service managed by the controller. The service managed by the controller has no impact;

And determining, in the case that the root resource that generates the alarm is not occupied by the service managed by the controller, but the sub-resource corresponding to the root resource is occupied by the service managed by the controller, determining the alarm to the The business managed by the controller has an impact;

The root resource that generates the alarm is not occupied by the service managed by the controller, and the sub-resource corresponding to the root resource is not occupied by the service managed by the controller, but the root resource and/or the If the mapping between the sub-resources corresponding to the root resource and the service managed by the controller is performed, determining that the alarm has an impact on the service managed by the controller;

And determining, in the case that the root resource that generates the alarm is occupied by the service managed by the controller, determining the impact of the alarm on the service production managed by the controller.
The method according to claim 3, wherein processing the alarm according to the analysis result comprises one of the following:

The alarm is suppressed if the alarm does not affect the service managed by the controller according to the cause of the alarm;

And determining, in the case that the alarm does not affect the service managed by the controller, according to a relationship between a resource that generates the alarm and a resource that is used by the controller, inhibition;

If the root resource that generates the alarm is not occupied by the service managed by the controller, but the sub-resource corresponding to the root resource is occupied by the service managed by the controller, the alarm is derived as a sub- Resource derived alarm;

The root resource that generates the alarm is not occupied by the service managed by the controller, and the sub-resource corresponding to the root resource is not occupied by the service managed by the controller, but the root resource and/or the In the case that the sub-resource corresponding to the root resource has a mapping relationship with the service managed by the controller, the alarm is derived as a relationship-derived alarm according to the mapping relationship;

The alarm is directly reported to the upper-layer network device in the case that the root resource that generates the alarm is occupied by the service managed by the controller.
The method according to claim 4, wherein, in the case of deriving the alarm, the method further comprises:

Recording an association between the alarm and the derived derivative alarm, where the derived alarm includes: a sub-resource derived alarm and/or a relationship derivative alarm;

And reporting the associated alarm to the upper-layer network device, and/or providing the association relationship for the network element device in the controller management system to query.
The method according to any one of claims 1 to 5, further comprising: after processing the alarm according to the analysis result, further comprising:

Generating a status notification of the network element device or the object representing the resource according to a state change of the network element device caused by the alarm, or a state change of an object representing the resource of the alarm;

The status notification of the generated network element device or the object representing the resource is reported to the upper layer network device.
An alarm processing device includes:

a receiving module, configured to receive an alarm from a network device;

An analysis module configured to analyze the alarm to obtain an analysis result;

The processing module is configured to process the alarm according to the analysis result.
The apparatus of claim 7 wherein said analyzing module comprises:

The first analyzing unit is configured to analyze, according to the cause of the alarm that generates the alarm, whether the alarm has an impact on the service managed by the controller;

The second analyzing unit is configured to analyze, according to the relationship between the resource that generates the alarm and the resource occupied by the service managed by the controller, whether the alarm has an impact on the service managed by the controller The results of the analysis.
The apparatus of claim 8 wherein said second analysis unit comprises one of:

a first determining subunit, configured to be occupied by a service in which the root resource generating the alarm is not managed by the controller, and where the sub resource corresponding to the root resource is occupied by a service managed by the controller In case, determining that the alarm does not affect the service managed by the controller;

a second determining subunit, configured to be used when the root resource that generates the alarm is not occupied by the service managed by the controller, but the sub-resource corresponding to the root resource is occupied by the service managed by the controller Determining that the alarm has an impact on the service managed by the controller;

a third determining subunit, configured to be occupied by a service that is not managed by the controller, where the root resource that generates the alarm is not occupied by the controller, but the sub-resource corresponding to the root resource is not occupied by the service managed by the controller, but If the root resource and/or the sub-resource corresponding to the root resource are in a mapping relationship with the service managed by the controller, determining that the alarm has an impact on the service managed by the controller;

The fourth determining subunit is configured to determine, in the case that the root resource generating the alarm is occupied by the service managed by the controller, the impact of the alarm on the service production managed by the controller.
The apparatus of claim 9 wherein said processing module comprises one of:

The first suppression unit is configured to suppress the alarm if the alarm does not affect the service managed by the controller according to the alarm cause;

a second suppression unit, configured to determine, in a relationship between the resource generated by the alarm and a resource occupied by the service managed by the controller, that the alarm does not affect the service managed by the controller And suppressing the alarm;

a first derivation unit, configured to: when a root resource that generates the alarm is not occupied by a service managed by the controller, but a sub-resource corresponding to the root resource is occupied by a service managed by the controller, Deriving the alarm as a sub-resource derived alarm;

The second derivation unit is configured to be occupied by a service that is not managed by the controller, and the sub-resource corresponding to the root resource is not occupied by the service managed by the controller, but Mapping a root resource and/or a sub-resource corresponding to the root resource to a service managed by the controller In the case, the alarm is derived as a relationship-derived alarm according to the mapping relationship;

The first reporting unit is configured to directly report the alarm to the upper-layer network device if the root resource that generates the alarm is occupied by the service managed by the controller.
The apparatus of claim 10, further comprising:

a recording unit, configured to record an association between the alarm and the derived derivative alarm, where the derivative alarm includes: a sub-resource-derived alarm and/or a relationship derivative Alarm

a second reporting unit, configured to report the derived alarm and the association relationship to an upper layer network device, and/or a providing unit, configured to provide the association relationship for querying by a network element device in the controller management system .
The apparatus according to any one of claims 7 to 11, further comprising:

Generating a module, configured to generate a state notification of the network element device or the object representing the resource according to a state change of the network element device caused by the alarm, or a state change of an object representing the resource of the alarm;

The reporting module is configured to report the status notification of the generated network element device or the object representing the resource to the upper layer network device.
A controller comprising the alarm processing device of any of the above.
The controller of claim 13, wherein the controller comprises at least one of: a domain controller DC, a super controller SC, wherein the SC is an upper layer controller of the DC.