A method for analyzing the causes of alarm filtering failures in a network management system

Abstract

This invention discloses a method for analyzing the causes of alarm filtering failures in a network management system, including: S1. Retrieving relevant alarms and rules through an interface query, selecting one alarm and one rule as input parameters and passing them to the controller; S2. A verification environment generator searches for the filtering conditions of a rule based on its rule ID and dynamically compiles and generates a corresponding verification simulation environment; S3. Passing the alarm into the verification simulation environment to match each filtering sub-condition and obtain the filtering result; S4. Passing the filtering result into a filtering result analyzer to obtain an analysis report; S5. Displaying the analysis report on the interface. This invention transforms the problem analysis process from manual to code-based, improving analysis efficiency, reducing the probability of errors, and increasing the accuracy of problem analysis. Through interface interaction and the provision of precise and detailed analysis reports, it not only provides a user-friendly and intuitive way to locate the causes of filtering failures for specific alarms and rules but also reduces learning costs and labor costs.

Description

Technical Field

[0001] This invention relates to the field of network management system technology, and specifically to a method for analyzing the causes of alarm filtering failures in a network management system. Background Technology

[0002] In the network management system, many backend processing modules are divided according to business needs. Some modules need to receive specific alarms for business analysis, resulting in the following: Figure 1 A similar processing architecture.

[0003] The subscription distribution module loads all the filtering conditions of the rules, receives all alarms and performs filtering processing, and then distributes them to different business modules.

[0004] However, when it is necessary to check why a certain alarm was not sent to the business module, the only way is to manually analyze why the alarm does not meet the filtering conditions of the rules. If the filtering conditions of the rules are set up to be complex, the verification will be time-consuming and laborious, and there will also be the problem of inaccurate analysis.

[0005] Generally, each business module will have its own rules, but what these rules have in common is that they all include filtering conditions.

[0006] The rule filtering conditions contain X (>=1) major conditions, and each major condition contains Y (>=1) minor conditions. The major conditions are related by OR, while the minor conditions under each major condition are related by AND. The minor conditions are set according to the alarm attributes, and the format is similar to:

[0007]

[0008] Currently, the main approach to analyzing alarm filtering failures in network management systems is through a combination of log printing and manual analysis, but this approach has the following drawbacks:

[0009] A. Manually analyzing and filtering logs is slow and unfriendly to users or maintenance personnel.

[0010] B. When the number of alarms is large, the more detailed the printed information, the greater the performance loss in processing, which affects the overall processing performance of the service. Summary of the Invention

[0011] The technical problem to be solved by the present invention is to provide a method for analyzing the reasons for alarm filtering failure in a network management system, which can locate the reasons for the failure of specified alarms and specified rule filtering in a user-friendly and intuitive way.

[0012] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows.

[0013] A method for analyzing the causes of alarm filtering failures in a network management system includes the following steps:

[0014] S1. The interface queries to obtain relevant alarms and rules, selects one alarm and one rule as input parameters and passes them to the controller;

[0015] S2. The verification environment generator finds the filtering conditions of the rule based on the rule ID and dynamically compiles and generates the corresponding verification simulation environment;

[0016] S3. The alarm is transmitted to the verification simulation environment to match each filter sub-condition and obtain the filtering result;

[0017] S4. Input the filtering results into the filtering result analyzer to obtain the analysis report;

[0018] S5. Display the analysis report on the interface.

[0019] Preferably, step S2 includes the following steps:

[0020] S21. Locate the rule content based on the rule ID and extract the filtering conditions;

[0021] S22. Sort the major conditions in the filtering conditions and label them M1, M2, ... Then sort the minor conditions under each major condition and label them M1-1, M1-2, ..., M2-1, ... Finally, dynamically generate the verification simulation environment based on the sorted filtering conditions.

[0022] Preferably, step S3 includes the following steps:

[0023] S31. Locate all attribute values ​​of the alarm based on its unique identifier and place them into the verification simulation environment;

[0024] S32. Start the verification simulation environment and output the filtering results for each sub-condition.

[0025] Preferably, step S4 includes the following steps:

[0026] S41. Initialize the analysis report model using filter criteria;

[0027] S42. Fill in the minor condition filtering results in the analysis report based on the filtering results and alarm attribute values;

[0028] S43. Based on the filtering results of the minor conditions under each major condition, infer the filtering results of the major conditions and complete the analysis report.

[0029] Preferably, step S43 includes the following steps:

[0030] S431. Based on the rule that the major conditions are OR-like and the minor conditions under each major condition are AND-like, and combined with the labels set for the conditions in step S22, the filtering condition relationship of the rule is represented.

[0031] S432. Combining the filtering results of the minor conditions in step S32, derive all the filtering results of the major conditions. The filtering result of the major condition is passed only if all the filtering results of the minor conditions under the major condition are passed.

[0032] S433. Complete the analysis report by filling in the rule information.

[0033] Due to the adoption of the above technical solutions, the technical progress achieved by this invention is as follows.

[0034] This invention transforms the problem analysis process from manual to code-based logic, improving analysis efficiency, reducing the probability of errors, and increasing the accuracy of problem analysis. Through interactive interfaces and the provision of precise and detailed analysis reports, it not only provides a user-friendly and intuitive way to locate the causes of failures in specific alarms and filtering by specific rules, but also reduces learning costs and labor costs. Attached Figure Description

[0035] Figure 1 A business processing architecture diagram for the existing network management system;

[0036] Figure 2 This is a flowchart of the present invention;

[0037] Figure 3 This is a flowchart of the verification environment generator of the present invention;

[0038] Figure 4 This is a sample diagram of the filtering conditions of the present invention;

[0039] Figure 5 This is a flowchart of the filtering result analyzer of the present invention;

[0040] Figure 6 This is a diagram illustrating the interface of the present invention. Detailed Implementation

[0041] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0042] A method for analyzing the causes of alarm filtering failures in a network management system, combined with Figure 2 As shown, it includes the following steps:

[0043] S1. The interface queries to obtain relevant alarms and rules. Select one alarm and one rule as input parameters and pass them to the controller.

[0044] S2. The verification environment generator looks up the rule's filtering conditions based on the rule ID and dynamically compiles and generates the corresponding verification simulation environment. For example... Figure 3 As shown, the specific steps include:

[0045] S21. First, find the rule content based on the rule ID and extract the filtering conditions.

[0046] S22. Sort the major conditions in the filtering conditions and label them M1, M2, ... Then sort the minor conditions under each major condition and label them M1-1, M1-2, ..., M2-1, ... (see Table 1). Finally, dynamically generate the verification simulation environment based on the sorted filtering conditions.

[0047] Example: such as Figure 4 As shown, there exists Figure 4 The filtering conditions shown in the DemoRule are sorted and marked as shown in Table 1:

[0048] Table 1

[0049] S3. The alarm is transmitted to the verification simulation environment to match each filter sub-condition and obtain the filtering result. Specifically, this includes the following steps:

[0050] S31. Locate all attribute values ​​of the alarm based on its unique identifier and place them into the verification simulation environment.

[0051] S32. Start the verification simulation environment and output the filtering results for each sub-condition. See Table 2 for an example.

[0052]

[0053] S4. Input the filtering results into the filtering result analyzer to obtain the analysis report. For example... Figure 5 As shown, the specific steps include:

[0054] S41. Initialize the analysis report model using filtering conditions.

[0055] The analysis report model is defined as follows:

[0056]

[0057]

[0058] Taking the filtering conditions in Table 1 as an example, the analysis details after initialization are shown in Table 3: Table 3

[0059] S42. Fill in the minor condition filtering results in the analysis report based on the filtering results and alarm attribute values.

[0060] Taking the data in Tables 2 and 3 as examples, the analysis details after filling in the small condition filtering results and the current values ​​of alarm attributes are shown in Table 4:

[0061]

[0062] Table 4

[0063] S43. Based on the filtering results of the minor conditions under each major condition, infer the filtering results of the major conditions and complete the analysis report.

[0064] Based on the rule that the major conditions are ORed, and the minor conditions under each major condition are ANDed, and combined with the labels set for the conditions in Table 1, the filtering condition relationships of DemoRule can be represented as Table 5:

[0065]

[0066]

[0067] Table 5

[0068] Then, combining the results of the smaller condition filtering in Table 2, such as M1-1 being passed and M1-2 being failed, the expression M1-1&&M1-2 results in a failed condition, and the larger condition is negated to 0 (not negated). Therefore, we can deduce that the larger condition filtering result for M1 is a failed condition. Similarly, the details of all the larger conditions can be derived as shown in Table 6.

[0069]

[0070] Table 6

[0071] If the major condition M2 passes the filter, then the result of the entire filter condition is "pass".

[0072] Finally, fill in the rule information to complete the analysis report.

[0073] S5. Display the analysis report in a user-friendly interface.

[0074] like Figure 6 As shown, refer to Figure 6 The annotations in the text can achieve the following steps to present the analysis report:

[0075] ① Click the "Open Query Conditions" button. After clicking, an alarm query box will pop up. Select the conditions and click "Query".

[0076] ② Select the rule type based on the business type.

[0077] ③ Select the dispatch rule to be verified under the business type in ②.

[0078] ④ Display of alarm query results.

[0079] ⑤ Select the data to be verified (only one record can be selected).

[0080] ⑥ View the values ​​of all attributes of the selected data (JSON format).

[0081] ⑦ Detailed analysis of major conditions.

[0082] ⑧ Filtering conditions and final filtering results are displayed.

[0083] ⑨Detailed analysis of minor conditions.

[0084] In use, this invention can not only automatically generate independent verification simulation environments based on historical data according to filtering rules, but also generate independent verification simulation environments based on the filtering conditions of specified rules. Through the filtering result analysis model, the filtering results of each sub-condition in the rule filtering conditions are marked (pass, fail, unverified) according to the alarm attribute values. The filtering results of the major conditions are analyzed based on the filtering results of each sub-condition, and the filtering results of the entire filtering conditions are analyzed based on the filtering results of the major conditions. The judgment process of each atomic condition and combined condition is recorded in detail, and the filtering results are formed into an analysis report. Through the interface interaction, the alarm filtering analysis and filtering analysis details are displayed in a user-friendly way, so as to intuitively display the entire source tracing result of the filtering in a way that is easy for users to understand.

Claims

1. A method for analyzing the causes of alarm filtering failures in a network management system, characterized in that: Includes the following steps: S1. The interface queries to obtain relevant alarms and rules, selects one alarm and one rule as input parameters and passes them to the controller; S2. The verification environment generator finds the filtering conditions of the rule based on the rule ID and dynamically compiles and generates the corresponding verification simulation environment; Step S2 includes the following steps: S21. Locate the rule content based on the rule ID and extract the filtering conditions; S22. Sort the major conditions in the filtering conditions and label them M1, M2..., then sort the minor conditions under each major condition again and label them M1-1, M1-2..., M2-1..., and finally dynamically generate a verification simulation environment based on the sorted filtering conditions; S3. The alarm is transmitted to the verification simulation environment to match each filter sub-condition and obtain the filtering result; Step S3 includes the following steps: S31. Locate all attribute values ​​of the alarm based on its unique identifier and place them into the verification simulation environment; S32. Start the verification simulation environment and output the filtering results for each sub-condition; S4. Input the filtering results into the filtering result analyzer to obtain the analysis report; S5. Display the analysis report on the interface.

2. The method for analyzing the causes of alarm filtering failure in a network management system according to claim 1, characterized in that: Step S4 includes the following steps: S41. Initialize the analysis report model using filter criteria; S42. Fill in the minor condition filtering results in the analysis report based on the filtering results and alarm attribute values; S43. Based on the filtering results of the minor conditions under each major condition, infer the filtering results of the major conditions and complete the analysis report.

3. The method for analyzing the causes of alarm filtering failure in a network management system according to claim 2, characterized in that: Step S43 includes the following steps: S431. Based on the rule that the major conditions are OR-like and the minor conditions under each major condition are AND-like, and combined with the labels set for the conditions in step S22, the filtering condition relationship of the rule is represented. S432. Combining the filtering results of the minor conditions in step S32, derive all the filtering results of the major conditions. The filtering result of the major condition is passed only if all the filtering results of the minor conditions under the major condition are passed. S433. Complete the analysis report by filling in the rule information.

Images