Method and device for generating warning data of network management system

Abstract

The invention provides a method and device for generating warning data of a network management system. The method comprises the following steps: acquiring log data which is reported by a network element in the network management system and used for recording events of the network element; matching the log data with preset filtering rules one by one; if the log data is matched with one filtering rule, filtering out the log data, else, continuing the matching of the next filtering rule until finishing matching all the filtering rules; and if all the filtering rules are not matched with the log data, converting the log data according to the preset conversion rule from log data to warning data so as to generate the warning data of the network management system. The invention implements separation of the operational procedure and service data processing as well as loose coupling of data acquisition and data analysis, has high capacity for processing mass data, and is convenient for development, maintenance and failure positioning.

Description

technical field [0001] The invention relates to the technical field of combining network management and security management, in particular to a method and device for generating alarm data of a Network Management System (NMS, Network Management System) through analysis and processing of log data. Background technique [0002] The network management system includes multiple network elements. Specifically, the network element may be various devices such as a router, a server, a firewall, a database, or a switch. Network elements use log data to record various events that occur on them, and log data plays a very important role in network security, network stability, and network fault analysis. [0003] For example, the Syslog protocol is an industry standard simple protocol supported by many equipment manufacturers and multiple platform operating systems (refer to RFC 3164). Syslog uses the User Datagram Protocol (UDP) as its underlying transport layer mechanism (RFC 3195 uses...

AI Technical Summary

Problems solved by technology

[0008] At present, most network management systems have limited support for network element log data (such as Syslog messages). For example, although some network management systems claim to support it, they are actually a tool plug-in independent of the entire system. There is no reflection in the alarm management, and problems cannot be found in time; other systems provide very complex configuration functions that are difficult to understand and grasp, which increases the difficulty of system application

These practices do not bring convenience to the management of the entire network and the analysis of network faults, but instead increase the burden on network management personnel and increase the cost of network operation and maintenance management

Images