Method and device for processing alarm events

Abstract

The invention relates to the technical field of data analysis, in particular to a method and a device for processing alarm events. In order to determine an alarm event causing a root-cause failure timely and precisely among massive alarm events, the method is implemented in the steps of: combining alarm events generated in a current cycle and non-failed alarm events generated in a historical cycle; determining a subject-event topological relationship base on subjects corresponding to the alarm events respectively and a reference topological relationship between the preset subjects; dividing the subject-event topological relationship into a plurality of connected subgraphs; and screening the alarm event meeting a preset condition as the target alarm event from the acquired connected subgraphs. Therefore, the method and the device can fully consider the subjects having an association relationship and the alarm events generated by triggering of failures having an association relationshipcaused by asynchronization, can directly determine the root-cause failure of each alarm event caused by asynchronous triggering, shorten the troubleshooting time, and improve the efficiency of failureelimination.

Description

technical field [0001] The present application relates to the technical field of data analysis, and in particular to a method and device for processing alarm events. Background technique [0002] In order to better manage network business systems and network resources, monitoring points are usually deployed on corresponding devices. Once the monitored device fails, the corresponding monitoring point of the device will generate a corresponding alarm event to notify the management side. Corresponding processing is performed, wherein the monitoring point can be hardware or software, and the monitoring point can detect a hardware fault occurring in a corresponding device, and can also detect a software fault occurring in a corresponding device. [0003] However, with the expansion of the monitoring system and the increase of monitoring points, each monitoring point can generate multiple alarm events, and the management side may receive a large number of alarm events at the same ...

AI Technical Summary

Problems solved by technology

[0003] However, with the expansion of the monitoring system and the increase of monitoring points, each monitoring point can generate multiple alarm events, and the management side may receive a large number of alarm events at the same time

[0004] In view of the above situation, under related technologies, the preliminary processing of alarm events can only be completed by removing repeated alarm events. For example, suppose that an alarm event A is generated due to a failure of equipment 1, but due to failure to eliminate the failure in time, equipment 1 The alarm event A is repeatedly generated, then, under the related technology, only the repeated alarm event A can be deduplicated

[0005] When the management side receives a large number of alarm events, it is impossible to determine in a timely manner which alarm events are triggered by root-root faults among the massive alarm events only by deduplication processing, so the fault cannot be handled in time, which leads to longer time-consuming fault processing , the failure handling efficiency is reduced

Images