Alarm monitoring network alarm flow interruption and storm monitoring method and system

Abstract

A method for monitoring network alarm outages and storms includes: an alarm monitoring definition module receiving alarm data and sending monitoring definition change messages; an alarm data receiving module of an alarm monitoring traffic counting module receiving monitoring definition change messages and alarm data in real time, reading and updating the alarm monitoring filter set, iterating through the alarm monitoring filter set, comparing alarm data one by one to see if it meets the preset conditions of a certain alarm monitoring filter and calculating the number of alarm monitoring filters that meet the conditions, generating and updating the data of the corresponding alarm monitoring filter; and an alarm monitoring judgment module receiving alarm data, judging and generating outage and storm alarms. This invention overcomes the lack of real-time performance in existing technologies, thus detecting problems and effectively reducing system load. Furthermore, it eliminates the need for additional hardware and software overhead and avoids persisting specific alarm data to a database or storing it in a memory cache like Redis, further saving costs.

Description

Technical Field

[0001] This invention relates to network alarm monitoring technology, and more particularly to a monitoring system for alarm disconnection and alarm storm. Background Technology

[0002] After receiving network alarm data, alarm monitoring systems typically perform business logic processing (such as alarm data parsing) on ​​the alarm data and distribute it to multiple internal or external modules for specific processing. Determining whether certain specific alarms have experienced alarm outages or alarm storms is a fundamental question.

[0003] The conventional approach of existing alarm monitoring systems is to persist alarm data to a database (DB) or store it in a memory cache (Redis), and then continuously query for alarms that meet specific conditions through polling. Based on the number of alarms, the system determines whether there is an alarm outage (e.g., the number of alarms within a specific time period is less than a minimum threshold) or an alarm storm (e.g., the number of alarms within a specific time period is greater than a maximum threshold). However, existing technologies often suffer from drawbacks such as high cost of persistent storage, insufficient real-time detection of outages or alarm storms, and high computational cost of polling.

[0004] Therefore, there is an urgent need for a monitoring method and system for alarm interruption and alarm storm to address the shortcomings of existing technologies. Summary of the Invention

[0005] The purpose of this invention is to provide a method and system for monitoring network alarm outages and storms, which can significantly improve the efficiency and real-time performance of monitoring alarm outages or alarm storms.

[0006] To achieve the above objectives, this invention provides a method for monitoring network alarm outages and storms, comprising: an alarm monitoring definition module receiving alarm data and sending monitoring definition change messages; an alarm data receiving module of an alarm monitoring traffic counting module receiving monitoring definition change messages and alarm data in real time; and an alarm monitoring traffic counting module reading and updating the alarm monitoring filter set within the monitoring definition change message; the alarm monitoring traffic counting module iterating through the alarm monitoring filter set, comparing alarm data one by one to see if it meets the preset conditions of a certain alarm monitoring filter and calculating the number of alarm monitoring filters that meet the conditions; and a notification module of the alarm monitoring traffic counting module periodically pulling from its internal counting queue and updating the number of alarm monitoring filters in the counting queue. If an alarm meets the preset conditions of the corresponding alarm monitoring filter, the count of the alarm monitoring filter is incremented by 1, and the data of the corresponding alarm monitoring filter in the counting queue is generated and updated. The data of the alarm monitoring filter includes: alarm monitoring filter ID, start time, end time, count value, and instance name. An alarm monitoring judgment module receiving alarm data and judging and generating outage and storm alarms.

[0007] As a preferred approach, an alarm monitoring filter is created before the alarm monitoring definition module receives alarm data. This includes creating filtering conditions related to alarm disconnection and alarm storms through the alarm monitoring definition UI module within the alarm monitoring definition module.

[0008] As a preferred approach, before creating alarm monitoring filters in the alarm monitoring definition module, the basic environment should be set up and corresponding topics for sending and receiving data messages and control messages should be created. These data and control messages include messages for sending and receiving alarm monitoring definitions and traffic count messages for sending and receiving alarm monitoring filters.

[0009] As a preferred method, the alarm monitoring definition module receiving alarm data and sending monitoring definition change messages includes: after receiving the alarm data, the alarm monitoring definition module loads the alarm monitoring definition UI, and the alarm monitoring definition module sends the monitoring definition change message to the corresponding message module through its internal alarm monitoring change notification module. After processing the alarm monitoring change notification, the alarm monitoring definition module calls the alarm monitoring traffic counting module through the ctrl.q function, thereby generating corresponding alarm monitoring filters. Multiple alarm monitoring filters constitute an alarm monitoring filter set.

[0010] As a preferred method, generating and updating the data for the corresponding alarm monitoring filters in the counting queue includes: updating the result queue of the counts of internal alarm monitoring filters statistically collected by the alarm monitoring traffic counting module, wherein the result queue includes a set of alarm monitoring filters that are updated in real time. The alarm monitoring traffic counting module sends alarm monitoring messages related to the updated set of alarm monitoring filters to Kafka.

[0011] As a preferred method, reading and updating the alarm monitoring filter set within the monitoring definition change message includes: the alarm monitoring traffic counting module loads the alarm monitoring filter set in real time through the alarm monitoring loading module, and the alarm monitoring traffic counting module modifies the alarm monitoring filter data in the alarm monitoring filter set in real time through the alarm monitoring change processing module. Specifically, modifying the alarm monitoring filter data in the alarm monitoring filter set in real time through the alarm monitoring change processing module includes: the alarm monitoring traffic counting module listening for monitoring definition change messages from the corresponding message module through its internal alarm monitoring change processing module; and the alarm monitoring traffic counting module reading alarm monitoring filter definitions from the persistent database and modifying the internal alarm monitoring filter set. Modifying the internal alarm monitoring filter set includes: adding new alarm monitoring filters to the set if they are enabled, and deleting specified alarm monitoring filters from the set if they are disabled.

[0012] As a preferred method, the alarm monitoring and judgment module receives alarm data and determines and generates flow interruption and storm alarms by: calling alarmCount.q to read the number of corresponding alarm monitoring filters in the alarm monitoring filter set in the alarm monitoring message; and processing the alarm monitoring message according to the flow interruption monitoring strategy and the storm monitoring strategy to determine and generate flow interruption and storm alarms.

[0013] As a preferred approach, the alarm disconnection strategy includes: if the number of alarms received by the alarm monitoring filter within a preset time threshold is less than a preset minimum threshold, then alarm disconnection is triggered. The alarm storm strategy includes: if the number of alarms received by the alarm monitoring filter within a preset time threshold is greater than a preset maximum threshold, then alarm storm is triggered.

[0014] As a preferred method, after determining and generating a power outage and storm alarm, the alarm monitoring module sends the corresponding alarm issue and alarm clearing result to the user client via SMS notification module, thereby notifying the user to handle the alarm.

[0015] In this application specification, Kafka is a well-known term in the art, referring to an open-source stream processing platform developed by the Apache Software Foundation and written in Scala and Java. Kafka is a high-throughput distributed publish-subscribe messaging system capable of processing all action stream data from consumers on a website.

[0016] Each message published to the Kafka cluster has a category called a topic. Physically, messages from different topics are stored separately. Logically, although messages from a single topic are stored on one or more brokers, users only need to specify the topic of the message to produce or consume data without needing to know where the data is stored.

[0017] This invention provides an alarm monitoring network alarm outage and storm monitoring system, comprising an alarm monitoring definition module, an alarm monitoring traffic counting module, and an alarm monitoring judgment module. The alarm monitoring definition module receives alarm data and sends monitoring definition change messages. The alarm data receiving module of the alarm monitoring traffic counting module receives monitoring definition change messages and alarm data in real time. Furthermore, the alarm monitoring traffic counting module reads and updates the alarm monitoring filter set within the monitoring definition change message. The alarm monitoring traffic counting module iterates through the alarm monitoring filter set, comparing each alarm data point to see if it meets the preset conditions of a certain alarm monitoring filter and calculating the number of satisfied alarm monitoring filters. The notification module of the alarm monitoring traffic counting module periodically pulls its internal counting queue and updates the count of alarm monitoring filters in the counting queue. If an alarm meets the preset conditions of the corresponding alarm monitoring filter, the count of the alarm monitoring filter is incremented by 1, and the data of the corresponding alarm monitoring filter in the counting queue is generated and updated. The data of the alarm monitoring filter includes: alarm monitoring filter ID, start time, end time, count value, and instance name. The alarm monitoring and judgment module receives alarm data, judges and generates flow interruption and storm alarms.

[0018] Compared with existing technologies, this invention can significantly improve the efficiency and real-time performance of monitoring alarm outages and alarm storms. This invention has the following advantages: Firstly, it overcomes the insufficient real-time performance of existing technologies, enabling immediate problem detection. Secondly, it reduces system load without requiring additional hardware or software overhead. Furthermore, this invention does not require persisting alarm data to a database or storing it in a memory cache such as Redis, further saving costs. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating the alarm monitoring network alarm disconnection and storm monitoring method of the present invention.

[0020] Figure 2 This is a schematic diagram of the alarm monitoring network alarm disconnection and storm monitoring system of the present invention. Detailed Implementation

[0021] In the following description, embodiments of the alarm monitoring network alarm disconnection and storm monitoring method and apparatus of the present invention will be described with reference to the accompanying drawings.

[0022] The embodiments described herein are specific implementations of the present invention, used to illustrate the concept of the invention, and are illustrative and exemplary, and should not be construed as limiting the embodiments or scope of the present invention. In addition to the embodiments described herein, those skilled in the art can employ other obvious technical solutions based on the content disclosed in the claims and specification of this application. These technical solutions include those that make any obvious substitutions and modifications to the embodiments described herein.

[0023] The accompanying drawings in this specification are schematic diagrams used to help illustrate the concept of the invention and to schematically show the interrelationships of the various parts.

[0024] First, the meanings of the terms involved in this invention are explained as follows:

[0025] Network alarm data: Alarm data is generated by network devices or related IT systems in the communication network. This alarm data will be collected and processed by the alarm monitoring system in a pre-defined format.

[0026] Alarm monitoring system: An IT system responsible for collecting network alarm data, processing alarm data business logic, and displaying alarm data.

[0027] Alarm disconnection: If the alarm monitoring system does not receive alarms that meet certain specified conditions within a specified time period, it indicates that there is a disconnection in this type of alarm. For example, if no alarms from a certain province's wireless network are received for 10 minutes.

[0028] Alarm storm: If the number of alarms that meet certain specified conditions received by the alarm monitoring system within a specified time period exceeds a threshold, it indicates that there is an alarm storm. For example, the number of wireless network alarms received in a certain province exceeds 100,000 within 10 minutes.

[0029] The conventional approach of existing alarm monitoring systems is to persist alarm data to a database or save it to a memory cache such as Redis. Then, they continuously query the number of alarm data that meet specific conditions through polling. Based on the number, they determine whether there is an alarm outage (e.g., the number of alarms in a specific time period is less than the minimum threshold) or an alarm storm (e.g., the number of alarms in a specific time period is higher than the maximum threshold).

[0030]

[0031] The two key aspects of existing technologies are persistent storage and polling queries based on persistent storage. The main drawbacks of existing technologies are the high cost of persistent storage, insufficient real-time detection of outages or alarm storms, and the high computational complexity of the polling method. Existing technologies have the following shortcomings:

[0032] 1. Querying the number of alarm data that meet specific conditions by polling has insufficient real-time performance and cannot effectively detect problems in the first instance.

[0033] 2. Querying the number of alarm data that meet specific conditions by polling will place a significant additional burden on the system and require additional software and hardware overhead.

[0034] 3. To monitor alarm outages or alarm storms, alarm data needs to be persisted to a database or stored in a memory cache, which incurs additional overhead.

[0035] To address the characteristics and shortcomings of existing technologies, this invention primarily focuses on improving the process by moving the delayed polling query to the access stage (comparing data as it's accessed), counting the comparison results in real time, and determining whether a flow interruption or alarm storm has occurred based on the count. This invention proposes a method and system that uses specific conditions for monitoring alarm flow interruptions or alarm storms as alarm monitoring filters. These filters are then placed at the access or distribution stage of the alarm monitoring system. This stage compares the alarm monitoring filter conditions, counts the data that meets them, and sends the count messages to the message queue of an open-source stream processing platform (Kafka). Finally, the alarm monitoring and judgment module uses a strategy to determine whether an alarm flow interruption or alarm storm has occurred. This significantly improves the efficiency of monitoring alarm flow interruptions or alarm storms, while also greatly enhancing real-time performance.

[0036] like Figure 1The diagram illustrates the flowchart of the alarm monitoring network alarm interruption and storm monitoring method of the present invention. In this invention, `ctrl.q` and `alarmCount.q` are specific function names. `ctrl.q` is used to send and receive alarm monitoring definition messages (adding alarm monitoring filters, disabling alarm monitoring filters), and `alarmCount.q` is used to send and receive alarm monitoring filter traffic count messages. `DB` is a type of database. `Redis` is a type of memory cache. The alarm monitoring filter ID is a unique code for the alarm monitoring filter, used to generate and retrieve the corresponding filter. The alarm monitoring definition UI is the human-computer interaction graphical interface for alarm monitoring definitions. Kafka is a well-known term in the field; it is an open-source stream processing platform developed by the Apache Software Foundation, written in Scala and Java. Kafka is a high-throughput distributed publish-subscribe messaging system that can handle all action stream data from consumers on a website. Each message published to a Kafka cluster has a category (topic), which is called a topic. Physically, messages from different topics are stored separately. Logically, although messages from a single topic are stored on one or more brokers, users only need to specify the topic of the message to produce or consume data without having to worry about where the data is stored.

[0037] This invention provides a method for monitoring network alarm outages and storms, including:

[0038] The alarm monitoring definition module receives alarm data and sends monitoring definition change messages.

[0039] The alarm data receiving module of the alarm monitoring traffic counting module receives monitoring definition change messages and alarm data in real time. Furthermore, the alarm monitoring traffic counting module reads and updates the alarm monitoring filter set within the monitoring definition change message.

[0040] The alarm monitoring traffic counting module iterates through the alarm monitoring filter set, comparing each alarm data point to see if it meets the preset conditions of a particular alarm monitoring filter and calculating the number of filters that meet the conditions. The notification module of the alarm monitoring traffic counting module periodically pulls from its internal counting queue and updates the count of alarm monitoring filters in the queue. If an alarm meets the preset conditions of the corresponding alarm monitoring filter, the count of the alarm monitoring filter is incremented by 1, and the data for the corresponding alarm monitoring filter in the counting queue is generated and updated. The data for the alarm monitoring filter includes: alarm monitoring filter ID, start time, end time, count value, and instance name.

[0041] Alarm monitoring filters are pre-defined filters that meet one or more specific conditions related to determining power outage and storm alarms, based on actual needs. These specific conditions are the preset data filtering criteria for monitoring. For example, monitoring filtering criteria can be set according to actual needs, such as: alarm data from Shandong Province and specializing in wireless networks.

[0042] By creating filters based on the conditions, data is compared during data access. After each alarm data entry is compared, a filter ID is added to one of the data's attributes. This way, subsequent processes only need to compare the filter ID, eliminating the need to compare multiple conditions. For example, alarm data from Shandong province with a wireless network specialty, as mentioned earlier, can be saved as a filter with the filter ID 790001. During data access, if an alarm meets this filter condition, it will be marked with the filter ID (790001). Subsequent processes only need to compare 790001 to determine whether the condition of "Shandong province with a wireless network specialty" is met.

[0043] The alarm monitoring and judgment module receives alarm data, judges its validity, and generates interruption and storm alarms. More specifically, the alarm monitoring definition module defines the filtering conditions to be monitored (e.g., alarms for provinces and specializing in Wi-Fi) and saves them as alarm monitoring filters. The alarm monitoring traffic counting module compares alarm data to whether it meets a specific alarm monitoring filter; if it does, it increments the count for that filter by 1 and periodically sends the traffic count to a Kafka topic used for counting. The alarm monitoring judgment module receives the alarm monitoring filter traffic count messages and performs the judgment for alarm interruption and alarm storm.

[0044] In a further preferred embodiment, an alarm monitoring filter is created before the alarm monitoring definition module receives alarm data, including: creating filtering conditions related to monitoring alarm disconnection and alarm storm through the alarm monitoring definition UI module inside the alarm monitoring definition module.

[0045] In a further preferred embodiment, before the alarm monitoring definition module creates the alarm monitoring filter, the basic environment is set up and corresponding topics for sending and receiving data messages and control messages are created. These sending and receiving data messages and control messages include messages for sending and receiving alarm monitoring definitions and traffic count messages for sending and receiving alarm monitoring filters.

[0046] In a further preferred embodiment, the alarm monitoring definition module receiving alarm data and sending monitoring definition change messages includes: after receiving the alarm data, the alarm monitoring definition module loads the alarm monitoring definition UI, and the alarm monitoring definition module sends a monitoring definition change message to the corresponding message module through its internal alarm monitoring change notification module. After processing the alarm monitoring change notification, the alarm monitoring definition module calls the alarm monitoring traffic counting module through the ctrl.q function, thereby generating corresponding alarm monitoring filters. Multiple alarm monitoring filters constitute an alarm monitoring filter set.

[0047] In a further preferred embodiment, generating and updating the data for the corresponding alarm monitoring filters in the counting queue includes: updating the result queue of the counts of the internal alarm monitoring filters statistically collected by the alarm monitoring traffic counting module, wherein the result queue includes a real-time updated set of alarm monitoring filters. The alarm monitoring traffic counting module sends alarm monitoring messages related to the updated set of alarm monitoring filters to Kafka.

[0048] In a further preferred embodiment, reading and updating the alarm monitoring filter set within the monitoring definition change message includes: the alarm monitoring traffic counting module loads the alarm monitoring filter set in real time through the alarm monitoring loading module, and the alarm monitoring traffic counting module modifies the data of the alarm monitoring filters in the alarm monitoring filter set in real time through the alarm monitoring change processing module. Specifically, modifying the data of the alarm monitoring filters in the alarm monitoring filter set in real time through the alarm monitoring change processing module includes: the alarm monitoring traffic counting module listening for monitoring definition change messages from the corresponding message module through its internal alarm monitoring change processing module; and the alarm monitoring traffic counting module reading alarm monitoring filter definitions from the persistent database and modifying the internal alarm monitoring filter set. Modifying the internal alarm monitoring filter set includes: adding a new alarm monitoring filter to the set if the alarm monitoring filter is enabled, and deleting the specified alarm monitoring filter from the set if the alarm monitoring filter is disabled.

[0049] In a further preferred embodiment, the alarm monitoring and judgment module receiving alarm data and determining and generating disconnection and storm alarms includes: the alarm monitoring and judgment module calling alarmCount.q to read the number of corresponding alarm monitoring filters in the alarm monitoring filter set in the alarm monitoring message. The alarm monitoring and judgment module processes the alarm monitoring message according to the disconnection monitoring strategy and the storm monitoring strategy, and then determines and generates disconnection and storm alarms.

[0050] In a further preferred embodiment, the alarm disconnection strategy includes: if the number of alarms received by the alarm monitoring filter within a preset time threshold is less than a preset minimum threshold, then an alarm disconnection is triggered. The alarm storm flow strategy includes: if the number of alarms received by the alarm monitoring filter within a preset time threshold is greater than a preset maximum threshold, then an alarm storm is triggered.

[0051] In a further preferred embodiment, after determining and generating a power outage and storm alarm, the alarm monitoring module sends the corresponding alarm issue and alarm clearing result to the user client via an SMS notification module, thereby notifying the user to handle the alarm.

[0052] Figure 2 The framework structure of the present invention is shown, as follows: Figure 1 and Figure 2 As shown below, the detailed steps are a specific example of the alarm monitoring network alarm disconnection and storm monitoring methods.

[0053] (1) Set up the basic environment and create the corresponding topics for sending and receiving data messages and control messages.

[0054] Specifically, after setting up the basic environment (x86 server or Kubernetes container), installing the basic software package (Kafka), and creating the corresponding topic for sending and receiving data messages and control messages, ctrl.q is used to send and receive messages defined by alarm monitoring (adding alarm monitoring filters, disabling alarm monitoring filters), and alarmCount.q is used to send and receive traffic count messages for alarm monitoring filters.

[0055] (2) The alarm monitoring definition module receives alarm data. Through the alarm monitoring definition UI module inside the alarm monitoring definition module, filter conditions related to alarm interruption and alarm storm can be created.

[0056] Specifically, the alarm monitoring definition UI module within the alarm monitoring definition module allows users to create filter conditions for monitoring, such as alarms related to the province (e.g., xx province + specialty: wireless network). These conditions are then saved as alarm monitoring filters. Subsequent checks using these filters determine if alarm outages or alarm storms occur. Each alarm monitoring filter has a unique ID, and created filters are persisted to a database. A typical example of an alarm monitoring filter is shown below:

[0057]

[0058] (3) The alarm monitoring definition module sends a monitoring definition change message and processes the alarm monitoring change notification.

[0059] Specifically, after receiving alarm data, the alarm monitoring definition module loads the alarm monitoring definition UI and sends a monitoring definition change message to the corresponding message module through its internal alarm monitoring change notification module. After processing the alarm monitoring change notification, the alarm monitoring definition module calls the alarm monitoring traffic counting module through the ctrl.q function, thereby generating corresponding alarm monitoring filters. Multiple alarm monitoring filters constitute an alarm monitoring filter set.

[0060] Furthermore, the alarm monitoring change notification process is handled by the alarm monitoring definition module, which calls the alarm monitoring traffic counting module via the ctrl.q function. This includes the alarm monitoring definition UI module, which, after defining the alarm monitoring filter, sends a monitoring definition change message to Kafka's ctrl.q function through its internal alarm monitoring change notification module. A typical example of a change message enabling an alarm monitoring filter is as follows:

[0061] {msg_type:'monitorFilterChange',msg_source:'Monitor Definition UI',

[0062] msg_data:'filterId=-189760991,changeType=1'}

[0063] (4) The alarm monitoring traffic counting module reads and updates the alarm monitoring filter set inside the monitoring definition change message, including: the alarm monitoring traffic counting module loads the alarm monitoring filter set in real time through the alarm monitoring loading module, and the alarm monitoring traffic counting module modifies the alarm monitoring filter data in the alarm monitoring filter set in real time through the alarm monitoring change processing module.

[0064] Specifically, the alarm monitoring traffic counting module listens for monitoring definition change messages from ctrl.q through its internal alarm monitoring change processing module, reads alarm monitoring filter definitions from the persistent database, and modifies the internal alarm monitoring filter set. If an alarm monitoring filter is enabled, a new alarm monitoring filter is added to the set; if an alarm monitoring filter is disabled, the specified alarm monitoring filter is deleted from the set.

[0065] (5) The alarm monitoring traffic counting module iterates through the alarm monitoring filter set, comparing each alarm data point to see if it meets the preset conditions of a certain alarm monitoring filter and calculating the number of alarm monitoring filters that meet the conditions. The notification module of the alarm monitoring traffic counting module periodically pulls the internal counting queue and updates the number of alarm monitoring filters in the counting queue. If an alarm meets the preset conditions of the corresponding alarm monitoring filter, the count of the alarm monitoring filter is incremented by 1, and the data of the corresponding alarm monitoring filter in the counting queue is generated and updated. Updating the counting queue data can specifically involve periodically sending the filter traffic count to the Kafka topic used for counting. The data of the alarm monitoring filter includes: alarm monitoring filter ID, start time, end time, count value, and instance name. The alarm monitoring judgment module receives the alarm data, judges it, and generates flow interruption and storm alarms.

[0066] Specifically, the alarm monitoring traffic counting module continuously receives alarm data through its internal alarm data receiving module. It then reads the internal alarm monitoring filter set, compares each filter one by one, and if a filter's condition is met, its count is incremented by 1, and the internal counting queue is updated. An example of the counting data protocol is as follows:

[0067] {msg_type:'monitorCount',msg_source:'Monitoring Count',

[0068] msg_data:'filterId=-189760991,start_time=1665652680000,end_time=1665652

[0069] 740000,count=10001,instance=01'}

[0070] Where filterId is the alarm monitoring filter ID, start_time is the start time of this count, end_time is the end time of this count, count is the cumulative count for this time period, and instance is the instance number of the alarm monitoring traffic counting module. Note: The count is generally accumulated in units of one time slice, such as one minute. Because the alarm monitoring traffic counting module may be running on multiple cluster instances, an additional field of the instance name of the alarm monitoring traffic counting module is added to facilitate the subsequent alarm monitoring judgment module to sum the counts of the same alarm monitoring filter ID across multiple instances to form the total.

[0071] (6) The alarm monitoring traffic counting module sends updated alarm monitoring messages related to the alarm monitoring filter set to Kafka. The alarm monitoring judgment module calls alarmCount.q to read the number of corresponding alarm monitoring filters in the alarm monitoring filter set in the alarm monitoring message.

[0072] Specifically, the notification module of the alarm monitoring traffic counting module periodically pulls the internal counting queue and sends the corresponding data to Kafka's alarmCount.q.

[0073] (7) The alarm monitoring and judgment module processes alarm monitoring messages according to the outage monitoring strategy and storm monitoring strategy, and then determines and generates outage and storm alarms.

[0074] Specifically, the alarm monitoring and judgment module reads the alarmCount.q count message data from Kafka. Reading the count message data can be done by loading the count message data into the alarm monitoring and judgment module in the form of filtered traffic count messages, and then determining alarm disconnection or alarm storm based on the alarm disconnection monitoring strategy and alarm storm monitoring strategy.

[0075] The alarm monitoring and judgment module reads the counting messages, groups them according to the alarm monitoring filter ID, and accumulates the counts for the same alarm monitoring filter ID and the same time slice. For example, the following two counting messages are received:

[0076] {msg_type:'monitorCount',msg_source:'Monitoring Count',

[0077] msg_data:'filterId=-189760991,start_time=1665652680000,end_time=1665652

[0078] 740000,count=9000,instance=01'}

[0079] {msg_type:'monitorCount',msg_source:'Monitoring Count',

[0080] msg_data:'filterId=-189760991,start_time=1665652680000,end_time=1665652

[0081] 740000,count=8000,instance=02'}

[0082] The two count messages are then merged and parsed to show that the cumulative count of the alarm monitoring filter with an alarm monitoring filter ID equal to -189760991 at time slices 2022-10-13 17:18:00 and 2022-10-13 17:19:00 is 9000 + 8000 = 17000.

[0083] If the alarm disconnection policy is set as follows: alarm disconnection occurs when the alarm monitoring filter ID = -189760991 receives fewer than 1000 alarms within one minute, then alarm disconnection will not be triggered. If the alarm storm flow policy is set as follows: alarm storm occurs when the alarm monitoring filter ID = -189760991 receives more than 10000 alarms within one minute, then alarm storm will be triggered.

[0084] (8) The alarm monitoring module sends the corresponding alarm issues and alarm clearing results to the user client via SMS notification module, thereby notifying the user to handle the alarm.

[0085] Specifically, if the alarm monitoring and judgment module experiences an alarm interruption or alarm storm, it can notify the operation and maintenance personnel through the SMS notification module for handling.

[0086] On one hand, this invention uses an alarm monitoring filter to pre-determine the access or distribution stage of the alarm monitoring system, and monitors alarm disconnection or alarm storm phenomena under specific conditions through real-time counting and monitoring judgment based on real-time counting. This mechanism can significantly improve the processing efficiency and real-time performance of alarm disconnection or alarm storm monitoring. This corresponds to steps 2, 3, 4, 5, 6, and 7 above.

[0087] On the other hand, this invention features a loosely coupled design and interaction protocol among alarm monitoring definition, alarm monitoring traffic counting, and alarm monitoring judgment, as well as a judgment process for alarm interruption and alarm storm based on alarm monitoring filter counting. These correspond to steps 2, 3, 4, 5, 6, 7, and 8 above.

[0088] Compared with existing technologies, this invention can significantly improve the efficiency and real-time performance of monitoring alarm outages and alarm storms.

[0089] This invention has the following advantages: Firstly, it overcomes the lack of real-time performance in existing technologies, enabling immediate problem detection. Secondly, it reduces system load without requiring additional hardware or software overhead. Furthermore, it eliminates the need to persist alarm data to a database or store it in a memory cache like Redis, further saving costs.

[0090] The significant effects of the technical solution provided by this invention are as follows:

[0091] 1. Effectively improves monitoring efficiency by moving the monitoring comparison to the access or distribution stage of the alarm monitoring system, and only retains the count results after comparison, avoiding the situation of continuous querying and comparison by polling.

[0092] 2. It effectively improves the real-time performance of monitoring because both the modules and the module as a whole are processed through streaming, allowing monitoring results to be fed back the fastest. The polling method is relatively slower due to the frequency and efficiency of queries.

[0093] 3. The alarm monitoring traffic counting module is placed at the front end of the alarm monitoring access or distribution link. The modification workload is small and the load added to these links is small, but it can provide additional instance-level load monitoring for these links.

[0094] 4. In the case of pure streaming processing, the alarm data itself does not need to be stored in an additional database or memory cache to support the monitoring and querying of the polling method.

[0095] 5. This solution separates counting and monitoring judgment, and the system has excellent scalability.

[0096] Compared with existing technologies, this invention can significantly improve the efficiency and real-time performance of monitoring alarm outages and alarm storms:

[0097] 1. This invention effectively improves monitoring efficiency, significantly reduces computational load, and allows a single count to be used for multiple monitoring (e.g., monitoring under the same conditions at different time granularities). Polling methods struggle to reuse results because it is difficult to achieve minute-level data sharding, requiring a large amount of data to be re-queried each time a poll is conducted.

[0098] 2. This invention effectively improves the real-time monitoring, stream processing, and stream counting methods, and monitoring results can be obtained in the shortest time, basically meeting the requirements for minute-level monitoring.

[0099] 3. The alarm monitoring traffic counting of this invention can be naturally attached to the access or distribution links in the alarm monitoring system. The amount of modification work is small and the load added to these links is small, but it can provide these links with additional instance-level load monitoring.

[0100] 4. The architecture of this invention is loosely coupled, and the monitoring count and alarm monitoring judgment can evolve independently.

[0101] like Figure 2 As shown, the present invention provides an alarm monitoring network alarm disconnection and storm monitoring system, including an alarm monitoring definition module, an alarm monitoring traffic counting module, and an alarm monitoring judgment module.

[0102] The alarm monitoring definition module receives alarm data and sends monitoring definition change messages.

[0103] The alarm data receiving module of the alarm monitoring traffic counting module receives monitoring definition change messages and alarm data in real time. Furthermore, the alarm monitoring traffic counting module reads and updates the alarm monitoring filter set within the monitoring definition change message.

[0104] The alarm monitoring traffic counting module iterates through the alarm monitoring filter set, comparing each alarm data point to see if it meets the preset conditions of a particular alarm monitoring filter and calculating the number of filters that meet the conditions. The notification module of the alarm monitoring traffic counting module periodically pulls from its internal counting queue and updates the count of alarm monitoring filters in the queue. If an alarm meets the preset conditions of the corresponding alarm monitoring filter, the count of the alarm monitoring filter is incremented by 1, and the data for the corresponding alarm monitoring filter in the counting queue is generated and updated. The data for the alarm monitoring filter includes: alarm monitoring filter ID, start time, end time, count value, and instance name.

[0105] The alarm monitoring and judgment module receives alarm data, judges and generates flow interruption and storm alarms.

[0106] More specifically, in alarm monitoring systems, it is necessary to determine whether alarms that meet certain specified conditions have experienced alarm disconnection or alarm storm phenomena. This invention designs a pre-counting mechanism based on alarm monitoring filters and a post-judgment processing mechanism based on pre-counting to improve the judgment efficiency of these two situations.

[0107] This system consists of three modules: an alarm monitoring definition module, an alarm monitoring traffic counting module, and an alarm monitoring judgment module. The alarm monitoring definition module defines the filtering conditions to be monitored (e.g., alarms for provinces and specializing in Wi-Fi) and saves them as alarm monitoring filters. The alarm monitoring traffic counting module compares alarm data to specific alarm monitoring filters; if they meet the criteria, it increments the count for that filter and periodically sends the traffic count to a Kafka topic. The alarm monitoring judgment module receives the alarm monitoring filter traffic count messages and performs judgments on alarm disconnection and alarm storms.

[0108] like Figure 1 and Figure 2 As shown below, the detailed steps are a specific example of the alarm monitoring network alarm outage and storm monitoring system process.

[0109] (1) Set up the basic environment and create the corresponding topics for sending and receiving data messages and control messages.

[0110] Specifically, after setting up the basic environment (x86 server or Kubernetes container), installing the basic software package (Kafka), and creating the corresponding topic for sending and receiving data messages and control messages, ctrl.q is used to send and receive messages defined by alarm monitoring (adding alarm monitoring filters, disabling alarm monitoring filters), and alarmCount.q is used to send and receive traffic count messages for alarm monitoring filters.

[0111] (2) The alarm monitoring definition module receives alarm data. Through the alarm monitoring definition UI module inside the alarm monitoring definition module, filter conditions related to alarm interruption and alarm storm can be created.

[0112] Specifically, the alarm monitoring definition UI module within the alarm monitoring definition module allows users to create filter conditions for monitoring, such as "province: [province name] + specialty: wireless network alarms," ​​and then save these conditions as alarm monitoring filters. These filters are then used to determine if there are alarm outages or alarm storms. Each alarm monitoring filter has a unique ID, and created filters are persisted to database storage.

[0113] (3) The alarm monitoring definition module sends a monitoring definition change message and processes the alarm monitoring change notification.

[0114] Specifically, after receiving alarm data, the alarm monitoring definition module loads the alarm monitoring definition UI and sends a monitoring definition change message to the corresponding message module through its internal alarm monitoring change notification module. After processing the alarm monitoring change notification, the alarm monitoring definition module calls the alarm monitoring traffic counting module through the ctrl.q function, thereby generating corresponding alarm monitoring filters. Multiple alarm monitoring filters constitute an alarm monitoring filter set.

[0115] Furthermore, the alarm monitoring change notification process is handled. The alarm monitoring definition module calls the alarm monitoring traffic counting module through the ctrl.q function. This includes the alarm monitoring definition UI module of the alarm monitoring definition module sending the monitoring definition change message to Kafka's ctrl.q through its internal alarm monitoring change notification module after completing the alarm monitoring filter definition.

[0116] (4) The alarm monitoring traffic counting module reads and updates the alarm monitoring filter set inside the monitoring definition change message, including: the alarm monitoring traffic counting module loads the alarm monitoring filter set in real time through the alarm monitoring loading module, and the alarm monitoring traffic counting module modifies the alarm monitoring filter data in the alarm monitoring filter set in real time through the alarm monitoring change processing module.

[0117] Specifically, the alarm monitoring traffic counting module listens for monitoring definition change messages from ctrl.q through its internal alarm monitoring change processing module, reads alarm monitoring filter definitions from the persistent database, and modifies the internal alarm monitoring filter set. If an alarm monitoring filter is enabled, a new alarm monitoring filter is added to the set; if an alarm monitoring filter is disabled, the specified alarm monitoring filter is deleted from the set.

[0118] (5) The alarm monitoring traffic counting module iterates through the alarm monitoring filter set, comparing each alarm data to see if it meets the preset conditions of a certain alarm monitoring filter and calculating the number of alarm monitoring filters that meet the conditions. The notification module of the alarm monitoring traffic counting module periodically pulls the internal counting queue and updates the number of alarm monitoring filters in the counting queue. If an alarm meets the preset conditions of the corresponding alarm monitoring filter, the count of the alarm monitoring filter is incremented by 1, and the data of the corresponding alarm monitoring filter in the counting queue is generated and updated. The data of the alarm monitoring filter includes: alarm monitoring filter ID, start time, end time, count value, and instance name. The alarm monitoring judgment module receives alarm data, judges and generates flow interruption and storm alarms.

[0119] Specifically, the alarm monitoring traffic counting module continuously receives alarm data through its internal alarm data receiving module. It then reads the internal alarm monitoring filter set, compares each alarm monitoring filter one by one, and increments the count of a certain alarm monitoring filter if it meets the requirements, and updates the internal counting queue.

[0120] (6) The alarm monitoring traffic counting module sends updated alarm monitoring messages related to the alarm monitoring filter set to Kafka. The alarm monitoring judgment module calls alarmCount.q to read the number of corresponding alarm monitoring filters in the alarm monitoring filter set in the alarm monitoring message.

[0121] Specifically, the notification module of the alarm monitoring traffic counting module periodically pulls the internal counting queue and sends the corresponding data to Kafka's alarmCount.q.

[0122] (7) The alarm monitoring and judgment module processes alarm monitoring messages according to the outage monitoring strategy and storm monitoring strategy, and then determines and generates outage and storm alarms.

[0123] Specifically, the alarm monitoring and judgment module reads the alarmCount.q count message data from Kafka, and then determines the alarm disconnection and alarm storm based on the alarm disconnection monitoring strategy and the alarm storm monitoring strategy.

[0124] The alarm monitoring and judgment module reads the counting messages, groups them according to the alarm monitoring filter ID, and accumulates the counts for the same alarm monitoring filter ID and the same time slice.

[0125] (8) The alarm monitoring module sends the corresponding alarm issues and alarm clearing results to the user client via SMS notification module, thereby notifying the user to handle the alarm.

[0126] Specifically, if the alarm monitoring and judgment module experiences an alarm interruption or alarm storm, it can notify the operation and maintenance personnel through the SMS notification module for handling.

[0127] The basic principle of this invention is to make specific conditions for monitoring alarm disconnection or alarm storm into an alarm monitoring filter, and to place the alarm monitoring filter at the access or distribution stage of the alarm monitoring system. This stage compares the alarm monitoring filter conditions and counts the data that meet the alarm monitoring filter conditions, and then sends the count message to the Kafka message queue. Finally, the alarm monitoring judgment module judges the count according to the strategy to determine whether an alarm disconnection or alarm storm has occurred.

[0128] Firstly, the system creates corresponding topic storage units for sending and receiving data messages and control messages. Alarm monitoring filters are used to send and receive alarm monitoring defined messages, and the clock counting module is used to send and receive alarm monitoring filter traffic counting messages. The alarm monitoring filters include adding alarm monitoring filters and disabling alarm monitoring filters.

[0129] Secondly, the system uses the alarm monitoring definition UI module within the alarm monitoring definition module;

[0130] Third, after completing the definition of the alarm monitoring filter, the alarm monitoring definition UI module of the alarm monitoring definition module sends a monitoring definition change message to the alarm monitoring filter in the self-loaded message queue through the internal alarm monitoring change notification module.

[0131] Fourth, the alarm monitoring traffic counting module listens for alarm monitoring filter definition change messages through its internal alarm monitoring change processing module, reads the alarm monitoring filter definitions from the persistent database, and modifies the internal alarm monitoring filter set. If an alarm monitoring filter is enabled, a new alarm monitoring filter is added to the set; if an alarm monitoring filter is disabled, the specified alarm monitoring filter is deleted from the set.

[0132] Fifth, the alarm monitoring traffic counting module continuously receives alarm data through its internal alarm data receiving module. It then reads the internal alarm monitoring filter set, compares each alarm monitoring filter one by one, and if a certain alarm monitoring filter is satisfied, it increments the count of that alarm monitoring filter by 1 and updates the internal counting queue.

[0133] Sixth, the alarm monitoring traffic counting module's notification module periodically pulls the internal counting queue and sends it to the clock counting module of the self-loaded message queue.

[0134] Seventh, the alarm monitoring and judgment module reads the clock counting message data from the load message queue, and then determines the alarm interruption and alarm storm based on the alarm interruption monitoring strategy and the alarm storm monitoring strategy.

[0135] Eighth, if the alarm monitoring and judgment module experiences an alarm interruption or alarm storm, it can notify the operation and maintenance personnel through the SMS notification module for handling.

[0136] Taking a provincial Unicom alarm monitoring system as an example, which collects 4 million alarm data entries from all disciplines per day, the processing steps of this invention are as follows:

[0137] 1. Without changing the existing basic hardware and software configuration, upgrade the alarm distribution module of the alarm monitoring system (the alarm monitoring traffic counting module is integrated into the alarm distribution module).

[0138] 2. Deploy the alarm monitoring definition module and establish alarm monitoring filters according to business needs. The total number of alarm monitoring filters is approximately 200.

[0139] 3. Deploy the alarm monitoring and judgment module, configure the minimum threshold value for alarm disconnection for each alarm monitoring filter, and configure the maximum threshold value for alarm storm for each alarm monitoring filter.

[0140] 4. After enabling alarm monitoring, it can support alarm interruption and alarm storm monitoring at the minute level, without adding any new hardware resources.

[0141] As can be seen from the above, the method and system for implementing alarm disconnection and alarm storm phenomena in the alarm monitoring system of the present invention greatly improves the monitoring efficiency of alarm data.

[0142] Compared with existing technologies, this invention can significantly improve the efficiency and real-time performance of monitoring alarm outages and alarm storms.

[0143] This invention has the following advantages: Firstly, it overcomes the lack of real-time performance in existing technologies, enabling immediate problem detection. Secondly, it reduces system load without requiring additional hardware or software overhead. Furthermore, it eliminates the need to persist alarm data to a database or store it in a memory cache like Redis, further saving costs.

[0144] The significant effects of the technical solution provided by this invention are as follows:

[0145] 1. Effectively improves monitoring efficiency by moving the monitoring comparison to the access or distribution stage of the alarm monitoring system, and only retains the count results after comparison, avoiding the situation of continuous querying and comparison by polling.

[0146] 2. It effectively improves the real-time performance of monitoring because both the modules and the module as a whole are processed through streaming, allowing monitoring results to be fed back the fastest. The polling method is relatively slower due to the frequency and efficiency of queries.

[0147] 3. The alarm monitoring traffic counting module is placed at the front end of the alarm monitoring access or distribution link. The modification workload is small and the load added to these links is small, but it can provide additional instance-level load monitoring for these links.

[0148] 4. In the case of pure streaming processing, the alarm data itself does not need to be stored in an additional database or memory cache to support the monitoring and querying of the polling method.

[0149] 5. This solution separates counting and monitoring judgment, and the system has excellent scalability.

[0150] Compared with existing technologies, this invention can significantly improve the efficiency and real-time performance of monitoring alarm outages and alarm storms:

[0151] 1. This invention effectively improves monitoring efficiency, significantly reduces computational load, and allows a single count to be used for multiple monitoring (e.g., monitoring under the same conditions at different time granularities). Polling methods struggle to reuse results because it is difficult to achieve minute-level data sharding, requiring a large amount of data to be re-queried each time a poll is conducted.

[0152] 2. This invention effectively improves the real-time monitoring, stream processing, and stream counting methods, and monitoring results can be obtained in the shortest time, basically meeting the requirements for minute-level monitoring.

[0153] 3. The alarm monitoring traffic counting of this invention can be naturally attached to the access or distribution links in the alarm monitoring system. The amount of modification work is small and the load added to these links is small, but it can provide these links with additional instance-level load monitoring.

[0154] 4. The architecture of this invention is loosely coupled, and the monitoring count and alarm monitoring judgment can evolve independently.

[0155] The embodiments of the alarm monitoring network alarm disconnection and storm monitoring method and system of the present invention have been described above, with the purpose of explaining the spirit of the present invention. Please note that those skilled in the art can modify and combine the features of the above embodiments without departing from the spirit of the present invention; therefore, the present invention is not limited to the above embodiments. Specific features of the alarm monitoring network alarm disconnection and storm monitoring system of the present invention, such as shape, size, and location, can be specifically designed based on the functions of the features disclosed above, and these designs are all achievable by those skilled in the art. Furthermore, the technical features disclosed above are not limited to the disclosed combinations with other features; those skilled in the art can also make other combinations between the technical features according to the purpose of the invention, to achieve the purpose of the present invention.

Claims

1. A method for monitoring alarm outages and storms in an alarm monitoring network, characterized in that, include: The alarm monitoring definition module receives alarm data and sends monitoring definition change messages; The alarm data receiving module of the alarm monitoring traffic counting module receives monitoring definition change messages and alarm data in real time; and the alarm monitoring traffic counting module reads and updates the alarm monitoring filter set inside the monitoring definition change message. The alarm monitoring traffic counting module iterates through the alarm monitoring filter set, comparing alarm data one by one to see if it meets the preset conditions of a certain alarm monitoring filter and calculating the number of alarm monitoring filters that meet the conditions. The notification module of the alarm monitoring traffic counting module periodically pulls the internal counting queue and updates the number of alarm monitoring filters in the counting queue. If an alarm meets the preset conditions of the corresponding alarm monitoring filter, the count of the alarm monitoring filter is incremented by 1, and the data of the corresponding alarm monitoring filter in the counting queue is generated and updated. The data of the alarm monitoring filter includes: alarm monitoring filter ID, start time, end time, count value, and instance name; and The alarm monitoring and judgment module receives alarm data, determines and generates outage and storm alarms, including: The alarm monitoring and judgment module calls alarmCount.q to read the number of corresponding alarm monitoring filters in the alarm monitoring filter set within the alarm monitoring message; and The alarm monitoring and judgment module processes alarm monitoring messages according to the outage monitoring strategy and the storm monitoring strategy, and then determines and generates outage and storm alarms.

2. The alarm monitoring network alarm disconnection and storm monitoring method according to claim 1, characterized in that, Before the alarm monitoring definition module receives alarm data, an alarm monitoring filter is created, including: The alarm monitoring definition UI module within the alarm monitoring definition module allows for the creation of filtering conditions related to alarm disconnection and alarm storms.

3. The alarm monitoring network alarm disconnection and storm monitoring method according to claim 2, characterized in that, Before creating alarm monitoring filters in the alarm monitoring definition module, the basic environment must be set up and corresponding topics for sending and receiving data messages and control messages must be created; among them, Sending and receiving data messages and control messages includes sending and receiving alarm monitoring defined messages and sending and receiving alarm monitoring filter traffic count messages.

4. The alarm monitoring network alarm disconnection and storm monitoring method according to claim 1, characterized in that, The alarm monitoring definition module receives alarm data and sends monitoring definition change messages, including: After receiving alarm data, the alarm monitoring definition module loads the alarm monitoring definition UI, and the alarm monitoring definition module sends a monitoring definition change message to the corresponding message module through the internal alarm monitoring change notification module. After processing the alarm monitoring change notification, the alarm monitoring definition module calls the alarm monitoring traffic counting module through the ctrl.q function, thereby generating the corresponding alarm monitoring filter. Multiple alarm monitoring filters constitute an alarm monitoring filter set.

5. The alarm monitoring network alarm disconnection and storm monitoring method according to claim 1, characterized in that, The data generated and updated for the corresponding alarm monitoring filters in the counting queue includes: Update the result queue of the internal alarm monitoring filter count statistics of the alarm monitoring traffic counting module, where the result queue includes the alarm monitoring filter set updated in real time; The alarm monitoring traffic counting module sends updated alarm monitoring filter set-related alarm monitoring messages to Kafka.

6. The alarm monitoring network alarm disconnection and storm monitoring method according to claim 1, characterized in that, Reading and updating the alarm monitoring filter set within the monitoring definition change message includes: the alarm monitoring traffic counting module loads the alarm monitoring filter set in real time through the alarm monitoring loading module, and the alarm monitoring traffic counting module modifies the data of the alarm monitoring filters in the alarm monitoring filter set in real time through the alarm monitoring change processing module; wherein, The alarm monitoring filter data that is modified in real time through the alarm monitoring change processing module includes: the alarm monitoring traffic counting module listening for monitoring definition change messages from the corresponding message module through its internal alarm monitoring change processing module; and the alarm monitoring traffic counting module reading alarm monitoring filter definitions from the persistent database and modifying its internal alarm monitoring filter set. Modifying the internal alarm monitoring filter set includes: adding a new alarm monitoring filter to the set if the alarm monitoring filter is enabled, and deleting the specified alarm monitoring filter from the set if the alarm monitoring filter is disabled.

7. The alarm monitoring network alarm disconnection and storm monitoring method according to claim 1, characterized in that, The flow interruption monitoring strategy includes: if the number of alarms received by the alarm monitoring filter within a preset time threshold is less than a preset minimum threshold, then it is determined that an alarm flow interruption is triggered; The storm monitoring strategy includes: if the number of alarms received by the alarm monitoring filter within a preset time threshold is greater than a preset maximum threshold, then an alarm storm is determined to be triggered.

8. The alarm monitoring network alarm disconnection and storm monitoring method according to claim 1, characterized in that, After identifying and generating flow interruption and storm alarms, the alarm monitoring module sends the corresponding alarm issue and alarm clearing results to the user client via SMS notification, thereby notifying the user to handle the alarm.

9. A network alarm monitoring system for alarm outages and storm monitoring, characterized in that, It includes an alarm monitoring definition module, an alarm monitoring traffic counting module, and an alarm monitoring judgment module; among which, The alarm monitoring definition module receives alarm data and sends monitoring definition change messages; The alarm data receiving module of the alarm monitoring traffic counting module receives monitoring definition change messages and alarm data in real time; and the alarm monitoring traffic counting module reads and updates the alarm monitoring filter set inside the monitoring definition change message. The alarm monitoring traffic counting module iterates through the alarm monitoring filter set, comparing alarm data one by one to see if it meets the preset conditions of a certain alarm monitoring filter and calculating the number of alarm monitoring filters that meet the conditions. The notification module of the alarm monitoring traffic counting module periodically pulls the internal counting queue and updates the number of alarm monitoring filters in the counting queue. If an alarm meets the preset conditions of the corresponding alarm monitoring filter, the count of the alarm monitoring filter is incremented by 1, and the data of the corresponding alarm monitoring filter in the counting queue is generated and updated. The data of the alarm monitoring filter includes: alarm monitoring filter ID, start time, end time, count value, and instance name; and The alarm monitoring and judgment module receives alarm data, determines and generates flow interruption and storm alarms, including: The alarm monitoring and judgment module calls alarmCount.q to read the number of corresponding alarm monitoring filters in the alarm monitoring filter set within the alarm monitoring message; and The alarm monitoring and judgment module processes alarm monitoring messages according to the outage monitoring strategy and the storm monitoring strategy, and then determines and generates outage and storm alarms.

Images