A real-time topology establishment method for large-scale network alarms

Abstract

The invention discloses a large-scale network alarm real-time topology establishment method, comprising: S1, acquiring real-time alarm data and classifying the real-time alarm data according to alarm equipment, and generating multiple alarm groups; S2, sorting each alarm according to the order of alarm time Sorting the alarm data in the group; S3, traversing each alarm group respectively, establishing or updating the local alarm topology diagram corresponding to the alarm group; S4, judging whether there is unprocessed real-time alarm data, if so, return to step S1, otherwise Continue to execute step S5; S5, publish the global alarm topology relationship diagram according to the local alarm topology relationship diagrams corresponding to the multiple alarm groups. The process of this method is automated and does not require too much processing parameter configuration, which can simplify the complexity of analyzing alarm correlations in the operation and maintenance process, and at the same time display the topological relationship between alarms in an intuitive way, which can be widely used in the field of operation and maintenance.

Description

technical field [0001] The invention relates to the technical field of communication, in particular to a method for establishing a real-time topology of a large-scale network alarm. Background technique [0002] For the convenience of the following description, the following noun explanations are first given: [0003] Large-scale network alarms: For data centers, network alarms whose storage, calculation and analysis of network alarm data exceeds the processing capacity of one server are defined as large-scale network alarms; [0004] Real-time processing: the processing interval of the alarm log processing method is less than 10 minutes; [0005] Alarm correlation analysis: analyze and mine the sequence of occurrence time between alarms in the alarm log, the probability relationship of simultaneous occurrence, or the analysis of other logical relationships, which is defined as alarm correlation analysis; [0006] Topology establishment: Establish the topological relations...

AI Technical Summary

Problems solved by technology

There are mainly the following shortcomings in the prior art: 1. Time dimension information is not used: in the existing alarm analysis technology, the alarm records are divided based on the sliding window method

Firstly, alarms occurring in a time window are considered to occur at the same time, but the specific sequence of occurrences in this window is not used; secondly, on the boundaries of two consecutive time windows, two alarms whose occurrence time is less than the length of a window are considered to be Artificially divided into two sets, losing information that may be associated

2. Lack of effective processing of alarm noise: the existing alarm correlation analysis technology simply divides alarms according to the time of alarm occurrence and the length of the user-defined alarm time window. This division method lacks effective processing of noise

3. It only provides the correlation analysis between alarms, but cannot provide the analysis of the relationship between alarms and the alarm chain, that is, it is impossible to find out the alarm topology diagram based on a certain alarm.

Existing alarm correlation analysis uses the common Apriori correlation analysis algorithm or FP-Growth algorithm to mine the relationship between alarm records. This method does not distinguish the sequence of alarms and does not provide a global alarm topology. The operation and maintenance personnel cannot quickly find information such as the correlation of a specific alarm or a specific fault based on the analysis results, for example, how many times the specific alarm occurred after the specific alarm occurred, or after the specific alarm occurred, Which alarms, how many times each alarm occurred, and which alarm occurred the most times

Images