Processing method for alarm correlation of monitoring system based on business rules

Abstract

The invention discloses a processing method for alarm correlation of a monitoring system based on business rules. The processing method comprises following steps of: a), coding all capital equipment in a unified mode according to business rules; b), acquiring original alarm information, where each piece of business rules comprises a capital code through which a business system ID is founded out and finding out all related capital equipment corresponding to the business system by means of the business system ID; c), reading occurrence time of original alarm information and calculating the related warning time range; and d), matching all related original alarm information in a related manner in order to find out original alarm information and result alarm information if original alarm information of related capital equipment within the related alarm time range is present and carrying out early warning operation if otherwise. The processing method for alarm correlation of the monitoring system based on business rules has following beneficial effects: with business requirements of a client as objects of management, root causes of failure based on business rules can be precisely positioned and non-perceptible failure of the client can be pre-processed in order to avoid occurrences of perception failures.

Description

technical field [0001] The invention relates to a monitoring system fault alarm processing method, in particular to a monitoring system alarm correlation processing method based on business rules. Background technique [0002] The construction of the IT monitoring and alarm system integrates the monitoring of various information equipment and multi-level services. With the development of business, the alarm information entering the monitoring system is becoming larger and more complex. When an information device or communication network fails, how to locate the cause of the failure accurately and quickly is the most important thing in troubleshooting. [0003] At present, most monitoring systems only monitor information devices, links, and application software on each node independently in real time, which leads to a huge amount of alarm information and intricate relationships. A service fault may trigger fault alarms on multiple nodes, and even faults that have not yet ma...

AI Technical Summary

Problems solved by technology

[0005] Disadvantage 1: Traditional monitoring systems usually take network elements as the management object, and customers usually care more about service availability

The normal operation of network elements does not guarantee the normal operation of services, and this service fault monitoring mode lacks the fundamental nature of customer-oriented

[0006] Disadvantage 2: The traditional monitoring system only monitors the alarm information of each network element separately, and does not perform correlation analysis on multiple related alarms caused by the same fault

[0007] Disadvantage 3: Some monitoring systems in the industry have adopted alarm association processing. The core component association rule engine is tightly coupled with the association logic. When new alarm information appears or business logic changes, data mining must be performed on the entire alarm datab

Images