A monitoring system alarm correlation processing method based on business rules

Abstract

The invention discloses a monitoring system alarm association processing method based on business rules, which includes the following steps: a) uniformly code all asset equipment according to business rules; b) acquire original alarm information, each original alarm information includes asset code , and find the business system ID through the asset code, and then find all relevant asset equipment corresponding to the business system through the business system ID; c) read the occurrence time of the original alarm message, and calculate the relevant alarm time range; d ) If the original alarm information of the relevant asset equipment already exists within the relevant alarm time range, all relevant original alarm information is associated and matched to find out the source alarm message and the result alarm message; otherwise, early warning processing is performed. The invention can take the customer's business requirements as the management object, accurately locate the source of the fault according to the business rules, and can pre-process the customer's non-perceived fault to avoid the occurrence of the perceptual fault.

Description

technical field [0001] The invention relates to a monitoring system fault alarm processing method, in particular to a monitoring system alarm correlation processing method based on business rules. Background technique [0002] The construction of the IT monitoring and alarm system integrates the monitoring of various information equipment and multi-level services. With the development of business, the alarm information entering the monitoring system is becoming larger and more complex. When an information device or communication network fails, how to locate the cause of the failure accurately and quickly is the most important thing in troubleshooting. [0003] At present, most monitoring systems only monitor information devices, links, and application software on each node independently in real time, which leads to a huge amount of alarm information and intricate relationships. A service fault may trigger fault alarms on multiple nodes, and even faults that have not yet ma...

AI Technical Summary

Problems solved by technology

[0005] Disadvantage 1: Traditional monitoring systems usually take network elements as the management object, and customers usually care more about service availability

The normal operation of network elements does not guarantee the normal operation of services, and this service fault monitoring mode lacks the fundamental nature of customer-oriented

[0006] Disadvantage 2: The traditional monitoring system only monitors the alarm information of each network element separately, and does not perform correlation analysis on multiple related alarms caused by the same fault

[0007] Disadvantage 3: Some monitoring systems in the industry have adopted alarm association processing. The core component association rule engine is tightly coupled with the association logic. When new alarm information appears or business logic changes, data mining must be performed on the entire alarm database. to generate a new correlation rule matching the new alarm information

This architecture in which business logic is closely related to the association rule engine not only greatly wastes system resources, ignores the role of historical alarm data, but also is not conducive to business analysts' involvement in the formulation and management of rules

[0008] Disadvantage 4: The existing monitoring system, no matter whether the association rule engine has been used or not, lacks the calculation model of alarm damage cost and response cost to calculate the cost-sensitive weight value of the result alarm

[0009] It can be seen from the above that the above design flaws prevent the alarm information from accurately locating the root cause of the fault, flexibly adjusting the association rules, and responding to key faults in a timely manner, resulting in poor customer experience.

Images