Alarm root cause location method and device, storage medium and electronic device

Abstract

The present disclosure provides a method and device for locating the root cause of an alarm, a storage medium, and an electronic device, and relates to the field of computer technology. The method includes querying the bearer service information, routing elements, and alarm information of a subnet connection according to a pre-constructed service alarm table; dividing the route into different spans according to the protection segment of the routing element; analyzing the bearer service information and alarm information of the subnet connection corresponding to different spans respectively, and determining the alarm information of multiple different spans; merging the alarm information of multiple different spans to determine the root cause of the alarm. The present application determines the root cause of the alarm by analyzing and merging the alarm information through a pre-constructed service alarm table combined with dividing the route into spans, and can quickly query and locate the alarm, making the determination of the root cause of the alarm more efficient and accurate, and solving the problem of low timeliness in locating the root cause of Ethernet service alarms.

Description

Background Art

[0002] With the rapid development of information technology, applications such as data center interconnection, cloud computing, and video streaming have become widely popular around the world. This trend has promoted Ethernet services to become one of the main types of services carried by optical transport networks, greatly promoting high-speed data transmission and sharing. The rise of multi-service optical transport network technology has not only improved the flexibility and efficiency of optical transport networks in carrying Ethernet services, but also further increased the proportion of Ethernet services in optical transport networks. In this context, an optical channel often needs to carry hundreds or even thousands of customer services, especially at the bottom layer of the transmission network, where the number of customer services carried is even larger.

[0003] In related technologies, Ethernet service connectivity and service quality indicator detection rely on OAM configuration defined by IEEE 802.1ag or Y.1731 standards. However, the OAM configuration process is cumbersome and complex, resulting in the inability of most Ethernet services to effectively report alarms. The limitations of the OAM configuration method make the network lack the ability to perceive changes in customer service status in real time. Usually, fault diagnosis can only be performed after receiving customer complaints, and it is impossible to provide early warning, analysis and disposal in the first time when the fault occurs, which seriously affects the customer experience.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The present disclosure provides a method and device for locating an alarm root cause, a storage medium and an electronic device, which at least to a certain extent overcome the problem of low timeliness of locating the root cause of Ethernet service alarms in related technologies.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a method for locating the root cause of an alarm is provided, characterized in that it includes: querying the bearer service information, routing elements and alarm information of the subnet connection according to a pre-constructed service alarm table; dividing the route into different spans according to the protection segment of the routing element; respectively analyzing the bearer service information and the alarm information of the subnet connection corresponding to the different spans to determine the alarm information of multiple different spans; merging the alarm information of the multiple different spans to determine the root cause of the alarm.

[0008] In some embodiments, before querying the bearer service information, routing elements and alarm information of the subnet connection according to the pre-constructed service alarm table, the method also includes: establishing a mapping relationship between the bearer service information of the subnet connection and the routing elements, and determining a mapping table; obtaining target alarm information, filtering the target alarm information according to the mapping table, and determining the filtered alarm information; writing the filtered alarm information into the mapping table, and generating the pre-constructed service alarm table.

[0009] In some embodiments, the obtaining of target alarm information, filtering the target alarm information according to the mapping table, and determining the filtered alarm information includes: obtaining target alarm information, and determining whether the target alarm information is related to the mapping table; if not, filtering the target alarm information; if relevant, determining the target alarm information as the filtered alarm information.

[0010] In some embodiments, the span includes an unprotected routing span and a protected routing span, and the bearer service information and the alarm information of the subnet connection corresponding to the different spans are analyzed separately to determine the alarm information of multiple different spans, including: when the span is an unprotected routing span, querying the alarm information of the routing element corresponding to the unprotected span from the pre-constructed service alarm table; when the unprotected span has alarm information causing routing interruption, determining that the alarm information of the unprotected span is a span interruption; when the span is a protected routing span, querying the working routing alarm information and the protection routing alarm information of the routing element in the protection routing span from the pre-constructed service alarm table; if the path where the service flow is located is interrupted, determining that the working routing alarm information is a span interruption; if the path where the service flow is located is not interrupted, determining that the protection routing alarm information is a span degradation.

[0011] In some embodiments, the merging of the alarms of the multiple different spans and determining the root cause of the alarm includes: merging the alarm information of the multiple different spans according to the business flow direction and the preset alarm transmission rules, and determining the merged alarm information; and determining the root cause alarm according to the merged alarm information.

[0012] In some embodiments, the method also includes: when the root cause of the alarm changes, the root cause of the alarm is updated; when the business status changes, if the business in the business status is a customer business, the business status and root cause alarm are updated; if the business in the business status is a non-customer business, the business status change is pushed to the service layer for processing.

[0013] According to another aspect of the present disclosure, there is also provided an alarm root cause locating device, including: a service alarm table query module, used to query the bearer service information, routing elements and alarm information of the subnet connection according to a pre-constructed service alarm table; a span division module, used to divide the route into different spans according to the protection segments of the routing elements; an alarm information determination module, used to respectively analyze the bearer service information and the alarm information of the subnet connection corresponding to the different spans, and determine the alarm information of multiple different spans; an alarm root cause determination module, used to merge the alarm information of the multiple different spans, and determine the alarm root cause.

[0014] According to another aspect of the present disclosure, an electronic device is also provided, which includes: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned alarm root cause locating methods by executing the executable instructions.

[0015] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the alarm root cause locating method described in any one of the above is implemented.

[0016] According to another aspect of the present disclosure, a computer program product is provided, including: a computer program or instructions, wherein when the computer program or instructions are executed by a processor, any one of the above alarm root cause locating methods is implemented.

[0017] The method for locating the root cause of an alarm provided in the embodiments of the present disclosure queries the bearer service information, routing elements, and alarm information of the subnet connection according to a pre-constructed service alarm table; divides the route into different spans according to the protection segment of the routing element; analyzes the bearer service information and alarm information of the subnet connection corresponding to the different spans respectively, and determines the alarm information of multiple different spans; and merges the alarm information of multiple different spans to determine the root cause of the alarm. The present application determines the root cause of the alarm by analyzing and merging the alarm information through a pre-constructed service alarm table combined with dividing the route into spans. It can quickly query and locate the alarm, making the determination of the root cause of the alarm more efficient and accurate, and solving the problem of low timeliness in locating the root cause of Ethernet service alarms.

[0018] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0020] Figure 1 A schematic diagram showing the structure of an alarm root cause location system in an embodiment of the present disclosure;

[0021] Figure 2 A flow chart of a method for locating the root cause of an alarm in an embodiment of the present disclosure is shown;

[0022] Figure 3 A flowchart showing a specific example of a method for locating the root cause of an alarm in an embodiment of the present disclosure is shown;

[0023] Figure 4 A flowchart of starting service status detection of a method for locating an alarm root cause in an embodiment of the present disclosure is shown;

[0024] Figure 5 A flowchart showing the termination service status detection of a method for locating an alarm root cause in an embodiment of the present disclosure is shown;

[0025] Figure 6 A flowchart showing another specific example of a method for locating the root cause of an alarm in an embodiment of the present disclosure is shown;

[0026] Figure 7 A flowchart showing another specific example of a method for locating the root cause of an alarm in an embodiment of the present disclosure;

[0027] Figure 8 A flowchart showing another specific example of a method for locating an alarm root cause in an embodiment of the present disclosure is shown;

[0028] Fig. 9 A schematic diagram showing a three-layer service bearing relationship of a method for locating an alarm root cause in an embodiment of the present disclosure is shown;

[0029] Fig.10 A schematic diagram showing another specific example of a method for locating an alarm root cause in an embodiment of the present disclosure is shown;

[0030] Fig.11 A schematic diagram of an alarm root cause location device according to an embodiment of the present disclosure is shown;

[0031] Fig.12 A structural block diagram of a computer device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0032] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0033] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0034] For ease of understanding, before introducing the embodiments of the present disclosure, several terms involved in the embodiments of the present disclosure are first explained as follows:

[0035] SNC: Sub-network Connection, sub-network connection;

[0036] OTN: Optical Transport Network;

[0037] M-OTN: Multi-Service Optical Transport Network;

[0038] OCH: Optical Channel, optical channel;

[0039] OAM: Operation, Administration, and Maintenance;

[0040] EoO: Ethernet over OTN, encapsulates Ethernet signals into optical data unit k pipes and carries them through the OTN network, thus realizing the transmission of Ethernet services on the existing OTN network;

[0041] CTP: Circuit Transport Path, which involves end-to-end connections established through physical circuits;

[0042] PTP: Point-to-Point, which means data is transmitted directly between two specific nodes without passing through any intermediate nodes;

[0043] FTP: Fiber Transport Path, fiber transmission path.

[0044] The specific implementation of the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings.

[0045] Figure 1 FIG. 2 shows an exemplary application system architecture diagram to which the alarm root cause location method in the embodiment of the present disclosure can be applied. Figure 1 As shown, the system architecture may include an application layer 101 , a client layer 102 , and an optical transport network 103 .

[0046] The application layer 101 includes customer service visualization, fault handling ticket system and fault diagnosis.

[0047] The client layer 102 includes client service status update management, client service status update queue, service layer status update processing waiting queue, service anomaly root cause location, service status analysis, protection segment status analysis, routing status analysis, alarm preprocessing (alarm object-SNC mapping relationship), object dependency, subnet connection and subnet connection routing, and management system. The management system includes configuration (information) collection, alarm collection, and configuration distribution. Among them, the alarm preprocessing module is used to monitor alarm notifications, filter pending alarms, generate a "service-alarm change list" relationship, and push notifications of pending subnet connection status analysis. Specifically, the alarm preprocessing module is used to: monitor alarm notifications, generate a "business-alarm change list" relationship after filtering through the "routing element-business" mapping relationship; since alarms can usually be reported in a short time, it is advisable to set a waiting time, and perform unified analysis after the alarm reporting is completed; the waiting time should be flexibly configured; during the waiting time, continuously monitor the alarm generation and disappearance notifications, update the "business-alarm change list", and delete the relationship when the elements in the alarm list are empty; after the waiting time, push the "business-alarm change list" to the status analysis module.

[0048] Among them, configuration collection is used to collect equipment and service configuration information of the optical transport network, generate network elements, boards, ports, subnet connections and subnet connection routes, and maintain the configuration association between objects; alarm information collection is used to collect optical transport network alarms, complete the standardization of alarm names and alarm attachment points of each manufacturer, and store alarms in the alarm queue (database), and send alarm generation / disappearance notifications in a timely manner.

[0049] The optical transport network 103 transmits the collected information to the alarm collection and configuration collection, and receives the configuration information issued.

[0050] Under the above system architecture, an embodiment of the present disclosure provides a method for locating the root cause of an alarm, which can be executed by any electronic device with computing and processing capabilities.

[0051] In some embodiments, the alarm root cause location method provided in the embodiments of the present disclosure may be executed by a terminal device of the above-mentioned system architecture; in other embodiments, the alarm root cause location method provided in the embodiments of the present disclosure may be executed by a server in the above-mentioned system architecture; in other embodiments, the alarm root cause location method provided in the embodiments of the present disclosure may be implemented by a terminal device and a server in the above-mentioned system architecture through interaction.

[0052] Figure 2 A flow chart of a method for locating the root cause of an alarm in an embodiment of the present disclosure is shown as follows: Figure 2 As shown, the alarm root cause location method provided in the embodiment of the present disclosure includes the following steps:

[0053] S202: query the bearer service information, routing elements and alarm information of the subnet connection according to the pre-built service alarm table.

[0054] It should be noted that the above-mentioned service alarm table can be a data table or a database for storing and managing information in the network. For example, the pre-built service alarm table includes the bearer service information, routing elements and alarm information of the subnet connection. The bearer service information of the above-mentioned subnet connection can be various service data transmitted between subnets. The above-mentioned routing elements can be various elements used to determine the transmission path of data packets in the network. Routing elements are an important part of the routing table. They jointly determine the transmission path of data packets in the network. For example, the above-mentioned routing elements can include the destination network address, network mask, next hop address, and physical port for transmission. The above-mentioned alarm information can be a warning message sent to the operation and maintenance personnel when an abnormality or failure occurs in the network equipment or system. For example, the above-mentioned alarm information can include an alarm location list, hierarchy, status, alarm source, root cause alarm, and description.

[0055] S204: Divide the route into different span segments according to the protection segments of the route elements.

[0056] It should be noted that the above protection segment can be a specific route set up to ensure the reliability and continuity of data transmission. When this route fails, the network can automatically or manually switch to the backup route to ensure normal data transmission. The above span includes an unprotected route span and a protected route span.

[0057] S206, respectively analyzing the bearer service information and alarm information of the subnet connections corresponding to different spans, and determining the alarm information of multiple different spans.

[0058] In an example of the present disclosure, the above-mentioned analysis of the bearer service information and alarm information of the subnet connection corresponding to different spans respectively determines the alarm information of multiple different spans, including: when the span is an unprotected routing span, querying the alarm information of the routing element corresponding to the unprotected span from a pre-built service alarm table, and when the unprotected span has alarm information causing routing interruption, determining the alarm information of the unprotected span as a span interruption; when the span is a protected routing span, querying the working routing alarm information and protection routing alarm information of the routing element in the protection routing span from a pre-built service alarm table, if the path where the service flow is located is interrupted, determining the working routing alarm information as a span interruption, and if the path where the service flow is located is not interrupted, determining the protection routing alarm information as a span degradation.

[0059] For example, if the span is an unprotected routing span, query the alarms of the routing elements of the span from the service alarm table: the operation and maintenance personnel first need to access the alarm list in the network management system to find the alarm information of all routing elements related to the specific span. Determine whether there is an alarm that causes routing interruption in the span: by analyzing the alarm information, determine whether there are any alarms that may cause routing interruption (such as link disconnection, equipment failure, etc.). If not, the span is normal: if no alarms that cause routing interruption are found, it can be considered that the span is currently in a normal state. Otherwise, the span is interrupted: if an alarm that causes routing interruption is found, the span is marked as interrupted. In the span, reversely analyze the root cause alarm that causes the span interruption along the service flow, and record the span status and possible root cause alarms: starting from the end of the service flow, reversely trace the alarm information in the span to determine the root cause of the span interruption. Record the status of the span and possible root cause alarms for subsequent analysis and resolution.

[0060] For example, if the span is a span with protection routing, query the alarms of the working routing elements and protection routing elements in the span from the service alarm table (alarm information of routing elements on the working path and protection path). Analyze the status and root cause alarms of the working and protection routes respectively: Use the same analysis method as the unprotected scenario to evaluate the status of the working path and protection path respectively, and determine the root cause alarms that may cause the interruption. If both the working routing element and the protection routing element are normal (no alarm information is issued), the span can be marked as normal. Otherwise, if there is a problem in either the working path or the protection path, further analysis is required: Query the status of the protection group: Check the status of the protection group to determine whether protection switching or protection failure has occurred. If the path where the service flow is located is interrupted, the span is interrupted. If the path where the service flow is located (whether the working path or the protection path) is interrupted, the span is marked as interrupted and the root cause alarm that caused the interruption is recorded. If the service flow can continue to be transmitted through the backup path, but the performance may be affected (such as increased delay, reduced bandwidth, etc.), the span is marked as degraded and the root cause alarm that caused the degradation is recorded.

[0061] S208, merging alarm information of multiple different spans to determine the root cause of the alarm.

[0062] In one example of the present disclosure, the above-mentioned merging of alarms of multiple different spans and determining the root cause of the alarm includes: merging the alarm information of multiple different spans according to the business flow direction and the preset alarm transmission rules, and determining the merged alarm information; and determining the root cause alarm according to the merged alarm information.

[0063] For example, first, collect cross-segment root cause alarms (alarms may come from different network devices, links or systems, and may involve multiple cross-segments). Then, determine the direction of the service flow, which can be determined by a network topology diagram, a routing table or a traffic analysis tool. The direction of the service flow can determine which cross-segment alarm is the root cause of the service interruption. The preset alarm transmission rule can be the way and law of alarm propagation in the network. For example, the alarm transmission rule can be based on factors such as network architecture, protocol, and device characteristics. After collecting all cross-segment root cause alarms and understanding the service flow direction and alarm transmission rules, merge these alarms. The merging process can include the following steps: deduplication: delete duplicate alarms to ensure that each alarm is considered only once; association: associate related alarms to form an alarm chain or alarm tree; priority sorting: prioritize alarms according to factors such as the severity of the alarm and the scope of impact.

[0064] The present application determines the root cause of the alarm by combining a pre-constructed service alarm table with the division of the route into cross-segments, analyzing and merging the alarm information, and can quickly query and locate the alarm, making the determination of the root cause of the alarm more efficient and accurate, thereby solving the problem of low timeliness in locating the root cause of Ethernet service alarms.

[0065] In one embodiment of the present disclosure, Figure 3 As shown, the alarm root cause location method provided in the embodiment of the present disclosure further includes the following steps before querying the bearer service information, routing elements and alarm information of the subnet connection according to the pre-built service alarm table:

[0066] S302, establishing a mapping relationship between the bearer service information of the subnet connection and the routing element, and determining a mapping table;

[0067] S304, obtaining target alarm information, filtering the target alarm information according to the mapping table, and determining the filtered alarm information;

[0068] S306, writing the filtered alarm information into a mapping table to generate a pre-built business alarm table.

[0069] For example, start customer service status monitoring and establish a mapping table: establish a "routing element-service" mapping relationship (equivalent to the above mapping table) based on the service information carried by the subnet-connected SNC and its related routing elements. If the mapping relationship of a certain SNC already exists, there is no need to add the mapping relationship of the SNC and its service layer SNC again. Terminate customer service status monitoring and remove the mapping table: when a certain service no longer needs to be monitored, remove the relevant relationship of the service from the "routing element-service" mapping relationship (equivalent to the above mapping table). If all customer-layer services carried by a service layer SNC no longer need to be monitored, the relevant relationship of the service layer SNC is removed synchronously.

[0070] The present application can quickly exclude alarm information that is not relevant to the current business by filtering the target alarm information according to the mapping table, thereby improving the accuracy and readability of the alarm information.

[0071] In a specific example, Figure 4 As shown, a service status detection process of starting a method for locating an alarm root cause in an embodiment of the present disclosure includes the following steps:

[0072] S401, start customer service status monitoring;

[0073] S402, querying the service and service routing;

[0074] S403, extracting routing elements (CTP / PTP / FTP, etc.), establishing a mapping relationship with the service, and registering it to the alarm preprocessing module;

[0075] S404, determine whether it is carried in the service layer, if so, execute S405, if not, execute S407;

[0076] S405, adding the client layer service to the status transfer list of the service layer service;

[0077] S406, determine whether the service layer status has been monitored, if so, execute S407, if not, execute S402;

[0078] S407, end the monitoring process.

[0079] Among them, the alarm preprocessing module is used to monitor alarm notifications, filter pending alarms, generate a "business-alarm change list" relationship, and push SNC status pending analysis notifications. Specifically, the alarm preprocessing module is used to: monitor alarm notifications, generate a "business-alarm change list" relationship after filtering through the "routing element-business" mapping relationship; since alarms can usually be reported in a short time, it is advisable to set a waiting time, and analyze them uniformly after the alarms are reported; the waiting time should be flexibly configured; during the waiting time, continuously monitor the alarm generation and disappearance notifications, update the "business-alarm change list", and delete the relationship when the elements in the alarm list are empty; after the waiting time, push the "business-alarm change list" to the status analysis module.

[0080] In a specific example, Figure 5 As shown, the termination service status detection process of an alarm root cause location method in an embodiment of the present disclosure includes the following steps:

[0081] S501, terminate the customer service status monitoring;

[0082] S502, removing the mapping relationship related to the service from the alarm pre-processing module;

[0083] S503, querying the service bearer relationship;

[0084] S504, determine whether the service bearer relationship is carried on the service layer, if so, execute S505, if not, execute S507;

[0085] S505, removing the client layer service from the status transfer list of the service layer service;

[0086] S506, determine whether the status transfer list is empty, if so, execute S502, if not, execute S507;

[0087] S507, end the monitoring process.

[0088] In one embodiment of the present disclosure, Figure 6As shown, the alarm root cause locating method provided in the embodiment of the present disclosure obtains target alarm information, filters the target alarm information according to the mapping table, and determines that the filtered alarm information includes the following steps:

[0089] S602, obtaining target warning information, and determining whether the target warning information is related to the mapping table;

[0090] S604, if not relevant, filter the target warning information;

[0091] S606: If relevant, determine the target alarm information as the filtered alarm information.

[0092] In a specific example, target alarm information is obtained by monitoring, for example, alarm notifications (target alarm information) from network devices (such as routers, switches, servers, etc.) are continuously monitored through monitoring tools. The alarm notifications include detailed information of the alarm, such as alarm type, level, timestamp, device or interface that triggers the alarm, etc. For example, optical transmission network alarms are collected to complete the standardization of the names of alarms from various manufacturers and the standardization of alarm attachment points. Then, filtering is performed through a mapping table to identify the alarm information related to the business being monitored in the target alarm information, and exclude alarm information that is not related to the business. Filtering can be performed by judging whether the device name of the network element in the target alarm information is consistent with the device name of the network element in the mapping table, or by judging whether the ID of the network element in the target alarm information is consistent with the ID of the network element in the mapping table.

[0093] In one embodiment of the present disclosure, Figure 7 As shown, the alarm root cause location method provided in the embodiment of the present disclosure also includes the following steps:

[0094] S702, when the alarm root cause changes, the alarm root cause is updated;

[0095] S704, when the business status changes, if the business in the business status is a customer business, the business status and root cause alarm are updated; if the business in the business status is a non-customer business, the business status change is pushed to the service layer for processing.

[0096] It should be noted that the above update refers to modifying the changed information in the business alarm table accordingly.

[0097] For example, after determining the root cause alarm, continue to analyze the business status and root cause alarm. If the business status and root cause alarm of the current layer have not changed, the analysis can end at the current layer. If the root cause alarm changes, it is necessary to update the root cause alarm information of this business. After the update, because the root cause of the business problem has been determined, the analysis of the business status can also end at the current layer. If the business status has changed (for example, business interruption, performance degradation, etc.), it is necessary to further determine whether the business is a customer business. If it is a customer business, update the status and root cause alarm information of the business. If the business is not a customer business, push the business status change to the service layer status change processing queue, trigger the customer layer business to continue analysis, and after the service layer business status change is pushed to the processing queue, further analysis of the customer layer business is performed.

[0098] Figure 8 A flowchart of another specific example of a method for locating the root cause of an alarm in an embodiment of the present disclosure is shown. Figure 8 As shown, the alarm root cause location provided in the embodiment of the present disclosure includes the following steps:

[0099] S801, start to create a business-alarm change list;

[0100] S802, query SNC, SNC_ROUTE, and divide the analysis boundary according to the protection segment of the service route;

[0101] S803, determine whether there is an alarm change in the span, if so, execute S804, if not, execute S819;

[0102] S804, determine whether the span is protected, if so, execute S805, if not, execute S814;

[0103] S805, analysis work, protection routing status and root cause alarm (same as unprotected span);

[0104] S806, determine whether the working and protection are normal, if so, execute S813, if not, execute S807;

[0105] S807, query the protection group status;

[0106] S808, determine whether the path where the flow is located is interrupted, if so, execute S809, if not, execute S811;

[0107] S809, cross-segment interruption;

[0108] S810: the root cause alarm of the route where the flow is located is used as the root cause of the cross-segment interruption;

[0109] S811, cross-segment downgrade;

[0110] S812, the root cause alarm of the flow backup route is used as the root cause of the cross-segment degradation;

[0111] S813, normal span;

[0112] S814, updating the cross-segment routing element alarm list;

[0113] S815, determine whether there is an interruption alarm, if yes, execute S816, if not, execute S818;

[0114] S816, cross-segment interruption;

[0115] S817, analyze the root cause of the interruption and issue an alarm;

[0116] S818, normal span;

[0117] S819, integrates multiple spans to determine service status and root cause alarms;

[0118] S820, determine whether the service status has changed, if so, execute S821, if not, execute S822;

[0119] S821, determine whether the customer's business has changed, if so, execute S825, if not, execute S824;

[0120] S822, determine whether the root cause alarm has changed, if so, execute S823, if not, end the process;

[0121] S823, update the root cause alarm and end the process;

[0122] S824, business status transmission, generating a customer layer alarm according to the inter-layer alarm derivation relationship, and returning to S802;

[0123] S825: The customer service status and root cause alarm are updated, and the process ends.

[0124] The process of analyzing the work, protecting the routing status and the root cause alarm in S805 may be the same as the process from S814 to S818.

[0125] Fig. 9 A schematic diagram showing a three-layer service bearing relationship of a method for locating the root cause of an alarm in an embodiment of the present disclosure is shown. Fig. 9 As shown, the three-layer service bearing relationship includes the following steps:

[0126] First, monitor the status of customer service SNC-1: recursively query the bearer relationship of SNC-1, find all service layers that directly and indirectly bear SNC-1, and monitor their service layers together. That is, the final monitored SNCs include SNC-1, SNC-4, SNC-6, and SNC-7; for each monitored SNC, query its SNC-ROUTE (routing element), and register the "routing element-SNC" relationship to the alarm preprocessing module;

[0127] Then, monitor the status of customer service SNC-3: recursively query the bearer relationship of SNC-3 and monitor its service layer together. However, since SNC-7 has been registered, it does not need to be processed repeatedly. The newly added monitored SNCs include SNC-3 and SNC-5. For each monitored SNC, query its SNC-ROUTE and register the "routing element-SNC" relationship to the alarm preprocessing module.

[0128] Finally, terminate the status monitoring of SNC-1: recursively query the bearer relationship of SNC-1 and terminate its service layer. However, since SNC-7 needs to serve the monitoring of other customer layer services, it cannot be terminated. The SNCs whose monitoring is terminated this time include SNC-1, SNC-4, and SNC-6. For each SNC monitored, it is necessary to remove its registered "routing element-SNC" relationship from the alarm preprocessing module to ensure that after the monitoring is terminated, the normal operation of the operation and maintenance system will not be interfered with due to invalid alarm information.

[0129] Fig.10 A schematic diagram showing another specific example of a method for locating the root cause of an alarm in an embodiment of the present disclosure is shown. Fig.10 The EoO service shown is not configured with OAM, and service status monitoring is enabled, so all service layer services that carry it also have service status monitoring enabled. After the OCH channel between f3 and f4 is interrupted, the device reports alarms at all layers. After delayed processing by the alarm preprocessing module, the following alarms and service parallel analysis are available, as shown in Table 1:

[0130] Table 1

[0131]

[0132] Since the business status has changed and the above layers are not customer services, it is necessary to simulate the generation of customer layer alarms, as shown in Table 2 below:

[0133] Table 2

[0134]

[0135] In a specific example, the ETH service is analyzed as a customer service termination. Through the relationship between the root cause alarm layer transmission, the root cause of the fault can be found layer by layer. For example, the transmission path of the alarm information is: c4, ODU-SNC interruption, d4, OTU-SNC interruption, e4, OCH-SNC interruption, f4. Through this path, the status of each service layer is checked one by one until the root cause of the fault is found. When the root cause of the fault is found, the service status and root cause of the ETH service are fed back to the upper layer application. It should be noted that since the analysis process depends on data-driven, in actual operation, the analysis process described in the above embodiment does not need to be strictly carried out in sequence. As long as the final analysis result is ensured to remain unchanged, the order of the analysis process can be flexibly adjusted according to specific circumstances and needs. In some cases, the device layer may not be able to report the alarm information in time. In order to make up for this defect, the alarm change of the customer layer is generated by simulating the change of the service layer service status, which can make up for the defect of the device layer not reporting the alarm, and also realize the vertical analysis of the alarm derivative relationship to form a transmission chain of the root cause between layers. Fig.10 Medium color marks indicate the presence of an alarm. The brighter the color, the more critical the alarm location.

[0136] It should be noted that the acquisition, storage, use, and processing of data in the technical solution disclosed in this disclosure are in compliance with the relevant provisions of national laws and regulations, and various types of data such as personal identity data, operation data, behavioral data, etc. related to individuals, customers, and groups obtained in the embodiments of this disclosure have all been authorized.

[0137] Based on the same inventive concept, the present disclosure also provides an alarm root cause location device, as described in the following embodiments. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0138] Fig.11 A schematic diagram of an alarm root cause location device according to an embodiment of the present disclosure is shown. Fig.11 As shown, the device includes: a service alarm table query module 1101, a cross-segment division module 1102, an alarm information determination module 1103, and an alarm root cause determination module 1104.

[0139] The service alarm table query module 1101 is used to query the bearer service information, routing elements and alarm information of the subnet connection according to the pre-built service alarm table.

[0140] The span division module 1102 is used to divide the route into different spans according to the protection segments of the route elements.

[0141] The alarm information determination module 1103 is used to analyze the bearer service information and alarm information of the subnet connection corresponding to different spans respectively, and determine the alarm information of multiple different spans.

[0142] The alarm root cause determination module 1104 is used to merge alarm information of multiple different spans and determine the alarm root cause.

[0143] In one example of the present disclosure, the above-mentioned alarm root cause locating device also includes a business alarm table construction module, which is used to establish a mapping relationship between the bearer business information of the subnet connection and the routing element to determine the mapping table; obtain target alarm information, filter the target alarm information according to the mapping table, and determine the filtered alarm information; write the filtered alarm information into the mapping table to generate a pre-constructed business alarm table.

[0144] In an example of the present disclosure, the above-mentioned business alarm table construction module is also used to obtain target alarm information and determine whether the target alarm information is related to the mapping table; if not, filter the target alarm information; if relevant, determine the target alarm information as the filtered alarm information.

[0145] In one example of the present disclosure, the alarm information determination module is also used to, when the span is an unprotected routing span, query the alarm information of the routing element corresponding to the unprotected span from a pre-built service alarm table; when the unprotected span has alarm information causing routing interruption, determine the alarm information of the unprotected span as a span interruption; when the span is a protected routing span, query the working routing alarm information and protection routing alarm information of the routing element in the protection routing span from a pre-built service alarm table; if the path where the service flow is located is interrupted, determine the working routing alarm information as a span interruption; if the path where the service flow is located is not interrupted, determine the protection routing alarm information as a span degradation.

[0146] In one example of the present disclosure, the alarm information determination module is also used to merge alarm information of multiple different spans according to the business flow direction and preset alarm transmission rules, and determine the merged alarm information; and determine the root cause alarm according to the merged alarm information.

[0147] In one example of the present disclosure, the above-mentioned alarm root cause locating device also includes an information update module, which is used to update the alarm root cause when the alarm root cause changes; when the business status changes, if the business status is a customer business, the business status and root cause alarm are updated; if the business status is a non-customer business, the business status change is pushed to the service layer for processing.

[0148] It should be noted that the examples and application scenarios implemented by the modules in the above-mentioned device embodiment are the same as those of the corresponding steps in the method embodiment, but are not limited to the contents disclosed in the above-mentioned method embodiment. It should be noted that the above-mentioned modules as part of the device can be executed in a computer system such as a set of computer executable instructions.

[0149] Those skilled in the art will appreciate that various aspects of the present disclosure may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation that combines hardware and software aspects, which may be collectively referred to herein as a "circuit," "module," or "system."

[0150] Based on the same inventive concept, an electronic device is also provided in an embodiment of the present disclosure, the electronic device comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any of the above alarm root cause location methods by executing the executable instructions. Since the principle of solving the problem in the electronic device embodiment is similar to that in the above method embodiment, the implementation of the electronic device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0151] Refer to the following Fig.12 1200 according to this embodiment of the present disclosure is described. Fig.12 The electronic device 1200 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0152] like Fig.12 As shown, the electronic device 1200 is in the form of a general computing device. The components of the electronic device 1200 may include but are not limited to: at least one processing unit 1210, at least one storage unit 1220, and a bus 1230 connecting different system components (including the storage unit 1220 and the processing unit 1210).

[0153] The storage unit stores program codes, which can be executed by the processing unit 1210, so that the processing unit 1210 executes the steps described in the above “exemplary method” section of this specification according to various exemplary embodiments of the present disclosure.

[0154] For example, the processing unit 1210 can execute the following steps of the above-mentioned method embodiment: query the bearer service information, routing elements and alarm information of the subnet connection according to the pre-constructed service alarm table; divide the route into different spans according to the protection segment of the routing element; analyze the bearer service information and alarm information of the subnet connection corresponding to different spans respectively, and determine the alarm information of multiple different spans; merge the alarm information of multiple different spans to determine the root cause of the alarm.

[0155] For example, the processing unit 1210 can execute the following steps of the above-mentioned method embodiment: establish a mapping relationship between the bearer service information of the subnet connection and the routing element, and determine the mapping table; obtain target alarm information, filter the target alarm information according to the mapping table, and determine the filtered alarm information; write the filtered alarm information into the mapping table to generate a pre-built service alarm table.

[0156] For example, the processing unit 1210 can execute the following steps of the above method embodiment: obtain target alarm information, determine whether the target alarm information is related to the mapping table; if not, filter the target alarm information; if relevant, determine the target alarm information as the filtered alarm information.

[0157] For example, the processing unit 1210 can execute the following steps of the above method embodiment: when the span is an unprotected routing span, query the alarm information of the routing element corresponding to the unprotected span from a pre-constructed service alarm table; when the unprotected span has alarm information that causes routing interruption, determine that the alarm information of the unprotected span is a span interruption; when the span is a protected routing span, query the working routing alarm information and protection routing alarm information of the routing element in the protection routing span from a pre-constructed service alarm table; if the path where the service flow is located is interrupted, determine that the working routing alarm information is a span interruption; if the path where the service flow is located is not interrupted, determine that the protection routing alarm information is a span degradation.

[0158] For example, the processing unit 1210 may execute the following steps of the above method embodiment: merging alarm information of multiple different spans according to the business flow direction and preset alarm transmission rules, and determining the merged alarm information; and determining the root cause alarm according to the merged alarm information.

[0159] For example, the processing unit 1210 can execute the following steps of the above method embodiment: when the root cause of the alarm changes, the root cause of the alarm is updated; when the business status changes, if the business in the business status is a customer business, the business status and the root cause alarm are updated; if the business in the business status is a non-customer business, the business status change is pushed to the service layer for processing.

[0160] The storage unit 1220 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 12201 and / or a cache storage unit 12202 , and may further include a read-only storage unit (ROM) 12203 .

[0161] The storage unit 1220 may also include a program / utility 12204 having a set (at least one) of program modules 12205, such program modules 12205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0162] Bus 1230 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0163] The electronic device 1200 may also communicate with one or more external devices 1240 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1200, and / or may communicate with any device that enables the electronic device 1200 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1250. In addition, the electronic device 1200 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 1260. As shown, the network adapter 1260 communicates with other modules of the electronic device 1200 via a bus 1230. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1200, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0164] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0165] Based on the same inventive concept, the embodiment of the present disclosure also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, any of the above alarm root cause location methods is implemented. Since the principle of solving the problem in the computer-readable storage medium embodiment is similar to that in the above method embodiment, the implementation of the computer-readable storage medium embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0166] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0167] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0168] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0169] In specific implementation, the program code for performing the operation of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0170] Based on the same inventive concept, a computer program product is also provided in an embodiment of the present disclosure, including a computer program product, including: a computer program or an instruction, which implements the alarm root cause location method of any one of the above method embodiments when the computer program or the instruction is executed by the processor. Since the principle of solving the problem in the computer program product embodiment is similar to that in the above method embodiment, the implementation of the computer program product embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0171] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0172] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0173] Through the description of the above implementation modes, it is easy for those skilled in the art to understand that the example implementation modes described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation mode of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation mode of the present disclosure.

[0174] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A method for locating the root cause of an alarm, characterized in that: include: According to the pre-built service alarm table, query the bearer service information, routing elements and alarm information of the subnet connection; Dividing the route into different spans according to the protection segments of the routing elements; Respectively analyzing the bearer service information and the alarm information of the subnet connection corresponding to the different spans, and determining the alarm information of a plurality of different spans; Merging the alarm information of the multiple different spans to determine the root cause of the alarm; The span includes an unprotected routing span and a protected routing span. The bearer service information and the alarm information of the subnet connection corresponding to the different spans are analyzed respectively to determine the alarm information of multiple different spans. The method comprises: when the span is an unprotected routing span, querying the alarm information of the routing element corresponding to the unprotected routing span from the pre-constructed service alarm table; when the unprotected routing span has alarm information causing routing interruption, determining that the alarm information of the unprotected routing span is a span interruption; when the span is a protected routing span, querying the working routing alarm information and the protection routing alarm information of the routing element in the protection routing span from the pre-constructed service alarm table; if the path where the service flow is located is interrupted, determining that the working routing alarm information is a span interruption; if the path where the service flow is located is not interrupted, determining that the protection routing alarm information is a span degradation.

2. The alarm root cause location method according to claim 1, characterized in that: Before querying the bearer service information, routing elements and alarm information of the subnet connection according to the pre-built service alarm table, the method further includes: Establishing a mapping relationship between the bearer service information of the subnet connection and the routing element, and determining a mapping table; Acquire target warning information, filter the target warning information according to the mapping table, and determine the filtered warning information; The filtered alarm information is written into a mapping table to generate the pre-built service alarm table.

3. The alarm root cause location method according to claim 2, characterized in that: The acquiring target alarm information, filtering the target alarm information according to the mapping table, and determining the filtered alarm information includes: Obtaining target warning information, and determining whether the target warning information is related to the mapping table; If not relevant, filtering the target warning information; If relevant, the target warning information is determined as the filtered warning information.

4. The alarm root cause location method according to claim 1, characterized in that: The merging of the multiple alarms of different spans and determining the root cause of the alarms comprises: According to the business flow direction and the preset alarm transmission rule, the alarm information of the plurality of different spans is merged, and the merged alarm information is determined; The root cause alarm is determined according to the merged alarm information.

5. The alarm root cause location method according to claim 1, characterized in that: The method further comprises: When the alarm root cause changes, the alarm root cause is updated; When the business status changes, if the business in the business status is a customer business, the business status and root cause alarm are updated; if the business in the business status is a non-customer business, the business status change is pushed to the service layer for processing.

6. An alarm root cause location device, characterized in that: include: A service alarm table query module is used to query the bearer service information, routing elements and alarm information of the subnet connection according to the pre-built service alarm table; A span division module, used for dividing the route into different spans according to the protection segments of the routing elements; An alarm information determination module, used to respectively analyze the bearer service information and the alarm information of the subnet connection corresponding to the different spans, and determine the alarm information of multiple different spans; An alarm root cause determination module, used to merge the alarm information of the plurality of different spans and determine the alarm root cause; Among them, the span includes an unprotected routing span and a protected routing span, and the alarm information determination module is also used to, when the span is an unprotected routing span, query the alarm information of the routing element corresponding to the unprotected routing span from the pre-constructed service alarm table; when the unprotected routing span has alarm information causing routing interruption, determine the alarm information of the unprotected routing span as a span interruption; when the span is a protected routing span, query the working routing alarm information and protection routing alarm information of the routing element in the protection routing span from the pre-constructed service alarm table; if the path where the service flow is located is interrupted, determine the working routing alarm information as a span interruption; if the path where the service flow is located is not interrupted, determine the protection routing alarm information as a span degradation.

7. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the alarm root cause location method according to any one of claims 1 to 5 by executing the executable instructions.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the alarm root cause locating method according to any one of claims 1 to 5 is implemented.

9. A computer program product comprising: A computer program or instruction, characterized in that when the computer program or instruction is executed by a processor, it implements the alarm root cause locating method described in any one of claims 1 to 5.

Images