Alarm information update device, alarm information update method, and program

Abstract

An alarm information updating device according to one embodiment of the present invention comprises an acquisition unit, an extraction unit, and an update unit. The acquisition unit acquires alarm information including message information indicating content of an alarm in a network and node information indicating a source that has produced the alarm. The extraction unit extracts information indicating a first node from the message information on a rule basis. If the first node is a node connected to a second node belonging to the source, the update unit updates node information at the second node.

Description

Technical Field

[0001] Embodiments relate to an alarm information update device, an alarm information update method, and a program.

Background Art

[0002] Fault detection techniques for detecting the cause and location of faults occurring on a network are known. In fault detection techniques, messages such as alarms generated when a fault occurs are used for fault detection.

[0003] For example, a technique has been proposed to automatically generate, as a rule for fault detection, a combination of types of alarms that occur based on a rule considering the adjacency relationship of communication devices on a network.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] However, in a fault detection rule considering the adjacency relationship on a network, when there are a large number of connections between communication devices, the adjacency relationships and alarms to be considered increase explosively. For this reason, there is a concern that a huge amount of calculation is required for analyzing the rules in a fault detection rule considering the adjacency relationship on a network.

[0006] The present invention has been made paying attention to the above circumstances, and an object thereof is to provide a means for detecting a fault while suppressing an increase in the amount of calculation.

Means for Solving the Problems

[0007] An alarm information update device according to one embodiment comprises an acquisition unit, an extraction unit, and an update unit. The acquisition unit acquires alarm information including message information indicating the content of an alarm in the network and node information indicating the source of the alarm. The extraction unit extracts information indicating a first node from the message information in a rule-based manner. The update unit updates the node information at the second node if the first node is a node connected to a second node belonging to the source. [Effects of the Invention]

[0008] According to this embodiment, it is possible to provide a means for detecting failures while suppressing an increase in computational complexity. [Brief explanation of the drawing]

[0009] [Figure 1] Figure 1 is a block diagram showing an example of a fault detection system and network according to the first embodiment. [Figure 2] Figure 2 is a block diagram showing an example of the hardware configuration of communication equipment constituting the network according to the first embodiment. [Figure 3] Figure 3 shows an example of network topology information according to the first embodiment. [Figure 4] Figure 4 shows an example of network alarm information detected by the fault detection system according to the first embodiment. [Figure 5] Figure 5 is a block diagram showing an example of the hardware configuration of the alarm information update device according to the first embodiment. [Figure 6] Figure 6 is a block diagram showing an example of the functional configuration of an alarm information update device according to the first embodiment. [Figure 7] Figure 7 shows an example of alarm format information stored in the alarm information update device according to the first embodiment. [Figure 8] Figure 8 is a flowchart showing an example of the overall processing in the alarm information update device according to the first embodiment. [Figure 9]FIG. 9 is a flowchart showing an example of update processing in the alarm information update device according to the first embodiment. [Figure 10] FIG. 10 is a flowchart showing an example of update processing in the alarm information update device according to the second embodiment. [Figure 11] FIG. 11 is a diagram showing an example of topology information of the network according to the third embodiment. [Figure 12] FIG. 12 is a diagram showing an example of alarm format information stored in the alarm information update device according to the third embodiment. [Figure 13] FIG. 13 is a flowchart showing an example of update processing in the alarm information update device according to the third embodiment. [Figure 14] FIG. 14 is a diagram showing an example of alarm format information stored in the alarm information update device according to the fourth embodiment. [Figure 15] FIG. 15 is a flowchart showing an example of update processing in the alarm information update device according to the fourth embodiment.

BEST MODE FOR CARRYING OUT THE INVENTION

[0010] Hereinafter, embodiments will be described with reference to the drawings. In the following description, components having the same function and configuration are denoted by common reference numerals.

[0011] 1. First Embodiment 1.1 Configuration 1.1.1 Failure Detection System FIG. 1 is a block diagram showing an example of a failure detection system and a network according to the first embodiment.

[0012] The failure detection system 1 is, for example, a system that monitors the network NW. The failure detection system 1 has a function of detecting alarms occurring in the network NW. The network NW is composed of a plurality of communication devices SW1, SW2, SW3, SW4, SW5,... having an arbitrary connection relationship with each other. The failure detection system 1 stores topology information 2 and alarm information 3. The failure detection system 1 includes a failure detection device 4 and an alarm information update device 5.

[0013] The topology information 2 is information that defines the connection relationship of the network NW.

[0014] The alarm information 3 is information including alerts generated in the network NW and the like.

[0015] The failure detection device 4 is, for example, a computer such as a server. The failure detection device 4 is configured to detect the location (source) and cause of a failure that has occurred in the network NW based on the topology information 2 and the alarm information 3.

[0016] The alarm information update device 5 is, for example, a computer such as a server. The alarm information update device 5 is configured to update the content of the alarm information 3 based on the topology information 2. Specifically, the alarm information update device 5 has a function of detailing the information regarding the source of the alarm in the alarm information 3.

[0017] With the above configuration, the alarm information update device 5 can suppress an increase in the load of failure detection by the failure detection device 4.

[0018] 1.1.2 Communication Devices FIG. 2 is a block diagram showing an example of the hardware configuration of a communication device that constitutes the network according to the first embodiment. In FIG. 2, as an example, the hardware configuration of the communication device SW1 is shown.

[0019] Communication device SW1 is a physical node in the network NW. Communication device SW1 includes module M1 and card C1. Module M1 and card C1 are physical nodes with a finer granularity than communication device SW1. Card C1 includes multiple ports P1, P2, P3, and P4. Each of the multiple ports P1, P2, P3, and P4 is a physical node with a finer granularity than card C1.

[0020] 1.1.3 Topology Information Figure 3 shows an example of network topology information according to the first embodiment. In Figure 3, topology information relating to communication devices SW1 and SW2 is shown in the network NW shown in Figure 1.

[0021] As shown in Figure 3, topology information 2 stores information about the nodes located on the network NW and the connection relationships between those nodes.

[0022] According to topology information 2, communication device SW1 includes nodes SW1, SW1_M1, SW1_C1, SW1_C1_P1, SW1_C1_P2, SW1_C1_P3, and SW1_C1_P4. Each node is associated with a granularity. Specifically, node SW1 has a granularity of "chassis" and corresponds to the chassis to which the IP address "10.24.1.20" is assigned. Node SW1_M1 has a granularity of "card" and corresponds to module M1. Node SW1_C1 has the same granularity as node SW1_M1, "card", and corresponds to card C1. Nodes SW1_C1_P1, SW1_C1_P2, SW1_C1_P3, and SW1_C1_P4 have the same granularity as each other, "port", and correspond to ports P1, P2, P3, and P4 within card C1, respectively. Here, nodes with a granularity of "card" have a higher granularity than nodes with a granularity of "chassis". Nodes with a granularity of "port" also have a higher granularity than nodes with a granularity of "card".

[0023] Similarly, according to topology information 2, communication device SW2 includes nodes SW2, SW2_C1, SW2_C1_P1, SW2_C1_P2, SW2_C1_P3, and SW2_C1_P4. Node SW2 has a granularity of "chassis" and corresponds to the chassis to which the IP address "10.24.1.30" is assigned. Node SW2_C1 has a granularity of "card" and corresponds to card C1. Nodes SW2_C1_P1, SW2_C1_P2, SW2_C1_P3, and SW2_C1_P4 have equivalent granularity "port" and correspond to ports P1, P2, P3, and P4 within card C1, respectively.

[0024] Furthermore, topology information 2 indicates that node SW1_C1_P1 and node SW2_C1_P4 are connected.

[0025] 1.1.4 Alarm Information Figure 4 shows an example of network alarm information detected by the fault detection system according to the first embodiment.

[0026] As shown in Figure 4, alarm information 3 stores information about multiple alarms. Each alarm is defined by information including its number, time, source, and message.

[0027] The number is an identification number that uniquely identifies the alarm.

[0028] The time indicates the date and time the alarm occurred.

[0029] The source indicates the origin of the alarm. The source stores any node within the communication device where the alarm occurred. In the example in Figure 4, it is shown that the source node for alarms numbered 1 and 2 is communication device SW1. In this case, by referring to alarm information 3, it can be confirmed that an alarm occurred in communication device SW1, but it is not possible to confirm which specific node within communication device SW1 caused the alarm.

[0030] The message provides an overview of the alarm. In the example in Figure 4, alarm number 1 indicates that the error counter threshold in "module1" has been exceeded. Alarm number 2 indicates that the ping command to "10.24.1.30" has failed.

[0031] 1.1.5 Alarm Information Update Device Figure 5 is a block diagram showing an example of the hardware configuration of the alarm information update device according to the first embodiment.

[0032] As shown in Figure 5, the alarm information update device 5 includes a control circuit 11, a communication module 12, a user interface 13, storage 14, a drive 15, and a storage medium 16.

[0033] The control circuit 11 is a circuit that controls all components of the alarm information update device 5 as a whole. The control circuit 11 includes a CPU (Central Processing Unit), RAM (Random Access Memory), and ROM (Read Only Memory), etc. The ROM of the control circuit 11 stores programs used for various processes in the alarm information update device 5. The CPU of the control circuit 11 controls the entire alarm information update device 5 according to the programs stored in the ROM of the control circuit 11. The RAM of the control circuit 11 is used as a workspace for the CPU of the control circuit 11.

[0034] The communication module 12 is a circuit used for data communication within the fault detection system 1.

[0035] The user interface 13 is an interface that manages communication between the user and the control circuit 11. The user interface 13 includes input devices and output devices. Input devices include, for example, a keyboard, a touch panel, and operation buttons. Output devices include, for example, an LCD (Liquid Crystal Display) or an EL (Electroluminescence) display. The user interface 13 converts user input into electrical signals and then transmits them to the control circuit 11. The user interface 13 outputs the execution results based on user input to the user.

[0036] The storage 14 includes, for example, an HDD (Hard Disk Drive) or an SSD (Solid State Drive). The storage 14 stores information used in various processes in the alarm information update device 5.

[0037] Drive 15 is a device for reading software stored on the storage medium 16. Drive 15 includes, for example, a CD (Compact Disk) drive and a DVD (Digital Versatile Disk) drive.

[0038] The storage medium 16 is a medium for storing software by electrical, magnetic, optical, mechanical, or chemical means. The storage medium 16 may also store programs for executing various processes in the alarm information update device 5.

[0039] Figure 6 is a block diagram showing an example of the functional configuration of an alarm information update device according to the first embodiment. The CPU of the control circuit 11 loads the program stored in the ROM or storage medium 16 of the control circuit 11 into the RAM of the control circuit 11. The CPU of the control circuit 11 then interprets and executes the program loaded into the RAM of the control circuit 11. As a result, the alarm information update device 5 functions as a computer comprising an alarm information acquisition unit 21, a topology information acquisition unit 22, a storage unit 23, an extraction unit 24, and an update unit 25.

[0040] The alarm information acquisition unit 21 acquires the portion of the alarm information 3 that pertains to the alarm that occurred (hereinafter simply referred to as alarm information 3) in response to the occurrence of an alarm. The alarm information acquisition unit 21 transmits the acquired alarm information 3 to the extraction unit 24.

[0041] The topology information acquisition unit 22 acquires topology information 2. The topology information acquisition unit 22 transmits the acquired topology information 2 to the extraction unit 24.

[0042] The memory unit 23 is a memory area within the storage unit 14. The memory unit 23 stores alarm format information 23a. Alarm format information 23a is information for classifying the messages of alarm information 3 according to the format of the message. Alarm format information 23a is registered, for example, by the user.

[0043] Figure 7 shows an example of alarm format information stored in the alarm information update device according to the first embodiment.

[0044] As shown in Figure 7, the alarm format information 23a contains information about multiple formats. Each format is defined by information including a number and a pattern.

[0045] The number is an identification number that uniquely identifies the format.

[0046] The pattern shows the format details. In the example in Figure 7, the format corresponding to number 1 is “<module [0-9]> This indicates that "Error counter exceeds threshold". Here, "[0-9]" is a regular expression representing any number from 0 to 9. "<>" is a symbol that treats anything that matches within the <> as a variable. Furthermore, the format corresponding to number 2 is shown to be "Ping failed for <\d{1,3}\. \d{1,3}\. \d{1,3}\. \d{1,3}\>". Here, "\d{1,3}\. \d{1,3}\. \d{1,3}\" is a regular expression representing an IP (Internet Protocol) address.

[0047] Returning to Figure 6, let's explain the functional configuration of the alarm information update device 5.

[0048] The extraction unit 24 extracts a string indicating a node from the message of alarm information 3 using a rule-based system that matches the pattern in alarm format information 23a. Based on the nodes extracted from the message of alarm information 3, the extraction unit 24 extracts a node indicating the source of the alarm. The granularity of the nodes indicating the source of the alarm extracted by the extraction unit 24 is higher than the granularity of the nodes stored in the source of alarm information 3. The extraction unit 24 transmits the information indicating the extracted nodes to the update unit 25.

[0049] The update unit 25 updates the nodes stored in the source of the alarm information 3 with higher-granularity nodes extracted by the extraction unit 24.

[0050] With the above configuration, the alarm information update device 5 can update the source node in the alarm information 3 to a more detailed node before the alarm information 3 is referenced by the fault detection device 4.

[0051] 1.2 Operation Next, the operation of the alarm information update device according to the first embodiment will be described.

[0052] 1.2.1 Overall Processing Figure 8 is a flowchart showing an example of the overall processing in the alarm information update device according to the first embodiment. It is assumed that prior to the alarm information update processing, the user has registered the alarm format information 23a in the storage unit 23 in advance.

[0053] When an alarm occurs (start), the alarm information acquisition unit 21 acquires the portion related to the alarm that occurred from the alarm information 3 (S11).

[0054] The extraction unit 24 determines whether the source node is listed in the alarm information 3 obtained in the processing of S11 (S12).

[0055] If the source node is not listed in Alarm Information 3 (S12; no), the entire process terminates (terminate).

[0056] If the source node is listed in alarm information 3 (S12; yes), the extraction unit 24 determines whether there is a pattern in alarm format information 23a that matches the message in alarm information 3 (S13).

[0057] If there is no pattern in alarm format information 23a that matches the message in alarm information 3 (S13; no), the entire process is terminated (terminated).

[0058] If there is a pattern in the alarm format information 23a that matches the message of the alarm information 3 (S13; yes), the extraction unit 24 extracts the string corresponding to the node (referred to as the extracted node) from the message of the alarm information 3 obtained in the processing of S11 (S14).

[0059] The extraction unit 24 determines whether the node extracted in the S14 process is the source of the alarm or a node of a communication device that is opposite to the source of the alarm (S15).

[0060] If the node extracted in the S14 process is not the source of the alarm, or a node of a communication device that is opposite the source of the alarm (S15; no), the entire process ends (end).

[0061] If the node extracted in the S14 process is the source of the alarm, or a node of a communication device facing the source of the alarm (S15; yes), the extraction unit 24 and the update unit 25 execute the update process (S16). Details of the update process will be described later.

[0062] After the S16 update process, the entire process will be completed (end).

[0063] 1.2.2 Update Process Next, the update process in the alarm information update device according to the first embodiment will be described.

[0064] Figure 9 is a flowchart showing an example of the update process in the alarm information update device according to the first embodiment. The processes S21 to S24 shown in Figure 9 are details of the process S16 in Figure 8.

[0065] When the update process starts (start), the extraction unit 24 determines whether the node extracted in the process of S14 belongs to the communication device that generated the alarm or to the communication device that is opposite to the source of the alarm (S21).

[0066] If the node extracted in the S14 process belongs to the communication device opposite the source of the alarm (S21; opposite), the extraction unit 24 refers to the topology information 2 and determines whether the node connected to the node extracted from the communication device opposite the source of the alarm is located in the communication device that generated the alarm (S22).

[0067] If the node that connects to the node extracted from the communication device opposite the source of the alarm is located in the communication device that generated the alarm (S22; yes), the extraction unit 24 extracts the node that connects to the node extracted from the communication device opposite the source of the alarm from the communication device that generated the alarm (S23).

[0068] If the node extracted in the S14 process belongs to the communication device that generated the alarm (S21; source), or after the S23 process, the update unit 25 updates the alarm information 3 with the node extracted from the communication device that generated the alarm (S24).

[0069] If the node extracted from the communication device opposite the source of the alarm is not present in the communication device that generated the alarm (S22; no), or if the update process ends after the S24 process (end).

[0070] 1.3 Specific Examples The following are two specific examples of update processes.

[0071] 1.3.1 Example 1 The first example corresponds to the occurrence of alarm number 1 in alarm information 3 shown in Figure 4. In this case, the source of the alarm is node SW1. The message of the alarm is "module 1 Error counter exceeds threshold".

[0072] In the first example, during processing S14, the extraction unit 24 extracts "module1" as a string corresponding to a node from the message corresponding to number 1 of the alarm information 3. "module1" corresponds to node SW1_M1 of the communication device SW1.

[0073] In the S21 process, the extraction unit 24 determines that the node SW1_M1 extracted in the S14 process belongs to the communication device SW1, which is the source of the alarm. Therefore, in the S24 process, the update unit 25 updates the node SW1 stored in the source of the alarm information 3 with the extracted node SW1_M1.

[0074] In this way, if the message in Alarm Information 3 includes the node from which the alarm originated, the information regarding the source of the alarm in Alarm Information 3 can be made more detailed.

[0075] 1.3.2 Example 2 The second example corresponds to the occurrence of alarm number 2 in alarm information 3 shown in Figure 4. In this case, the source of the alarm is node SW1. The message of the alarm is "Ping failed for 10.24.1.30".

[0076] In the second example, during processing S14, the extraction unit 24 extracts "10.24.1.30" as the string corresponding to the node from the message corresponding to number 2 of the alarm information 3. "10.24.1.30" corresponds to node SW2 of the communication device SW2.

[0077] In the S21 process, the extraction unit 24 determines that node SW2 extracted in the S14 process belongs to communication device SW2 opposite to communication device SW1, which is the source of the alarm. According to topology information 2, communication device SW2 is connected to node SW1_C1_P1 of communication device SW1 via node SW2_C1_P4. Therefore, in the S23 process, the extraction unit 24 extracts node SW1_C1_P1 from communication device SW1, which is the source of the alarm. Then, in the S24 process, the update unit 25 updates node SW1 stored in the source of alarm information 3 with the extracted node SW1_C1_P1.

[0078] In this way, when the message in Alarm Information 3 includes the node opposite to the source of the alarm, the information regarding the source of the alarm in Alarm Information 3 can be made more detailed.

[0079] 1.3 Effects of the First Embodiment According to the first embodiment, the alarm information acquisition unit 21 acquires alarm information 3, which includes a message indicating the content of the alarm in the network NW and the node from which the alarm originated. The extraction unit 24 extracts a string indicating a node from the message in the alarm information 3 using a rule-based approach based on alarm format information 23a. The update unit 25 updates the source of the alarm information 3 with the node belonging to the communication device that originated the alarm, to which the node extracted by the extraction unit 24 is connected, if the node is connected to the node belonging to the communication device that originated the alarm. This allows the node indicated as the source of the alarm information 3 to be refined to a higher-granularity node when the message in the alarm information 3 includes a node belonging to the opposing communication device. As a result, the fault detection device 4 can grasp the source of the alarm at a higher granularity via the alarm information 3, and the load on the fault detection process can be reduced. Therefore, the fault detection system 1 can detect faults while suppressing an increase in computational load.

[0080] Furthermore, if the node extracted by the extraction unit 24 is a node belonging to the communication device that generated the alarm, the extraction unit 24 updates the source of the alarm information 3 with the extracted node. This allows the node indicated as the source of the alarm information 3 to be refined to a higher-granularity node when the message of the alarm information 3 contains a node belonging to the communication device that generated the alarm.

[0081] 2. Second Embodiment Next, an alarm information update device according to the second embodiment will be described. The second embodiment differs from the first embodiment in that nodes that update alarm information 3 are further selectively extracted based on the distance to the opposing communication device. The following will mainly describe the configuration and operation that differ from the first embodiment. Configurations and operations equivalent to the first embodiment will be omitted from the description as appropriate.

[0082] 2.1 Update Process Figure 10 is a flowchart showing an example of the update process in the alarm information update device according to the second embodiment. Figure 10 corresponds to Figure 9 in the first embodiment.

[0083] When the update process starts (start), the extraction unit 24 determines whether the node extracted in the process of S14 belongs to the communication device that generated the alarm or to the communication device that is opposite to the source of the alarm (S31).

[0084] If the node extracted in the S14 process belongs to the communication device opposite the source of the alarm (S31; opposite), the extraction unit 24 refers to the topology information 2 and determines whether the node connected to the node extracted from the communication device opposite the source of the alarm is located in the communication device that generated the alarm (S32).

[0085] If the node that connects to the node extracted from the communication device opposite the source of the alarm is located in the communication device that generated the alarm (S32; yes), the extraction unit 24 extracts the node that connects to the node extracted from the communication device opposite the source of the alarm from the communication device that generated the alarm (S33).

[0086] If the node extracted in the S14 process belongs to the communication device that generated the alarm (S31; source), or after the S33 process, the extraction unit 24 determines whether multiple nodes were extracted from the communication device that generated the alarm (S34).

[0087] If multiple nodes are extracted from the communication device that generated the alarm (S34; yes), the extraction unit 24 extracts the node that is closest to the communication device that is opposite to the source of the alarm from among the multiple nodes extracted from the source of the alarm (S35).

[0088] If only one node is extracted from the communication device that generated the alarm (S34; no), or after processing in S35, the update unit 25 updates the alarm information 3 with the single node extracted from the communication device that generated the alarm (S36).

[0089] If the node extracted from the communication device opposite the source of the alarm is not present in the communication device that generated the alarm (S32; no), or after processing S36, the update process ends (end).

[0090] 2.2 Effects according to the second embodiment According to the second embodiment, when the extraction unit 24 extracts multiple nodes (for example, nodes SW1_C1_P1 and SW1_C1) from the message of alarm information 3, it further extracts the node closest to the communication device that generated the alarm (for example, node SW1_C1_P1) from among the multiple nodes. This allows the source of the alarm to be updated with a single high-granularity node, even when multiple nodes are relevant based solely on the connection relationships between nodes. This further reduces the load on the fault detection process.

[0091] 3. Third Embodiment Next, an alarm information update device according to the third embodiment will be described. The third embodiment differs from the first embodiment in that nodes for updating alarm information 3 are selectively extracted based on attributes specified for each pattern in the alarm format information 23a. The following will mainly describe the configuration and operation that differ from the first embodiment. Configurations and operations equivalent to the first embodiment will be omitted from the description as appropriate.

[0092] 3.1 Topology Information Figure 11 shows an example of network topology information according to the third embodiment. Figure 11 corresponds to Figure 3 in the first embodiment.

[0093] As shown in Figure 11, according to topology information 2 in the third embodiment, node SW1_C1_P1 and node SW2_C1_P4 are connected with the attribute "service", and node SW1_C1_P2 and node SW2_C1_P3 are connected with the attribute "maintenance". Here, the attribute corresponds to the purpose for which the connection is used.

[0094] 3.2 Alarm format information Figure 12 shows an example of alarm format information stored in the alarm information update device according to the third embodiment. Figure 12 corresponds to Figure 7 in the first embodiment.

[0095] As shown in Figure 12, each format of alarm format information 23a is defined by information that includes an attribute in addition to a number and a pattern.

[0096] The numbers and patterns are the same as in Figure 7, so we will omit the explanation.

[0097] The attributes are equivalent to those defined in topology information 2 and correspond to the purpose for which the connections between nodes are used. The attributes included in alarm format information 23a are used to extract the nodes that will update alarm information 3 in the corresponding format. That is, in the update process, the update unit 25 selectively updates alarm information 3 with nodes that have the attributes specified in alarm format information 23a.

[0098] 3.3 Update Process Figure 13 is a flowchart showing an example of the update process in the alarm information update device according to the third embodiment. Figure 13 corresponds to Figure 9 in the first embodiment.

[0099] When the update process starts (start), the extraction unit 24 determines whether the node extracted in the process of S14 belongs to the communication device that generated the alarm or to the communication device that is opposite to the source of the alarm (S41).

[0100] If the node extracted in the S14 process belongs to the communication device opposite the source of the alarm (S41; opposite), the extraction unit 24 refers to the topology information 2 and determines whether the node connected to the node extracted from the communication device opposite the source of the alarm is located in the communication device that generated the alarm (S42).

[0101] If the node that connects to the node extracted from the communication device opposite the source of the alarm is located in the communication device that generated the alarm (S42; yes), the extraction unit 24 extracts the node that connects to the node extracted from the communication device opposite the source of the alarm from the communication device that generated the alarm (S43).

[0102] If the node extracted in the S14 process belongs to the communication device that generated the alarm (S41; source), or after the S43 process, the extraction unit 24 determines whether multiple nodes were extracted from the communication device that generated the alarm (S44).

[0103] If multiple nodes are extracted from the communication device that generated the alarm (S44; yes), and if the nodes extracted in the S14 process belong to the communication device opposite to the alarm source (S41; opposite), the extraction unit 24 extracts from the multiple nodes extracted from the alarm source the nodes that match the attributes specified in the alarm format information 23a (S45).

[0104] If only one node is extracted from the communication device that generated the alarm (S44; no), or after processing in S45, the update unit 25 updates the alarm information 3 with the single node extracted from the communication device that generated the alarm (S46).

[0105] If the node extracted from the communication device opposite the source of the alarm does not have a corresponding node in the communication device that generated the alarm (S42; no), or if the update process ends after processing S46 (end).

[0106] 3.4 Effects of the Third Embodiment According to the third embodiment, when the extraction unit 24 extracts multiple nodes (for example, nodes SW1_C1_P1 and SW1_C1_P2) from the message of the alarm information 3, it further extracts a node (node ​​SW1_C1_P1) that matches a specified attribute (for example, "service"). This allows the source of the alarm to be updated with a single high-granularity node, even when multiple nodes are relevant based solely on the connection relationships between nodes. Furthermore, the attributes used for extraction are defined by rules for each format in the alarm format information 23a. Therefore, the attributes related to the alarm can be appropriately set according to the alarm pattern.

[0107] 4. Fourth Embodiment Next, an alarm information update device according to the fourth embodiment will be described. The fourth embodiment differs from the first embodiment in that it selects a node to update the alarm information 3 based on the granularity specified for each pattern in the alarm format information 23a. The following will mainly describe the configuration and operation that differ from the first embodiment. Configurations and operations equivalent to the first embodiment will be omitted from the description as appropriate.

[0108] 4.1 Alarm Format Information Figure 14 shows an example of alarm format information stored in the alarm information update device according to the fourth embodiment. Figure 14 corresponds to Figure 7 in the first embodiment.

[0109] As shown in Figure 14, each format of alarm format information 23a is defined by information that includes granularity in addition to the number and pattern.

[0110] The numbers and patterns are the same as in Figure 7, so we will omit the explanation.

[0111] The granularity is equivalent to the granularity defined in topology information 2 and is an indicator of the level of detail of a node. The granularity included in alarm format information 23a is used to select the node to update alarm information 3 in the corresponding format. That is, in the update process, the update unit 25 selectively updates alarm information 3 with nodes having the granularity specified in alarm format information 23a.

[0112] 4.2 Update Process Figure 15 is a flowchart showing an example of the update process in the alarm information update device according to the fourth embodiment. Figure 15 corresponds to Figure 9 in the first embodiment.

[0113] When the update process starts (start), the extraction unit 24 determines whether the node extracted in the process of S14 belongs to the communication device that generated the alarm or to the communication device that is opposite to the source of the alarm (S51).

[0114] If the node extracted in the S14 process belongs to the communication device opposite the source of the alarm (S51; opposite), the extraction unit 24 refers to the topology information 2 and determines whether the node connected to the node extracted from the communication device opposite the source of the alarm is located in the communication device that generated the alarm (S52).

[0115] If the node that connects to the node extracted from the communication device opposite the source of the alarm is located in the communication device that generated the alarm (S52; yes), the extraction unit 24 extracts the node that connects to the node extracted from the communication device opposite the source of the alarm from the communication device that generated the alarm (S53).

[0116] If the node extracted in the S14 process belongs to the communication device that generated the alarm (S51; source), or after the S53 process, the update unit 25 adjusts the granularity of the node extracted from the communication device that generated the alarm to the granularity specified in the alarm format information 23a (S54).

[0117] The update unit 25 updates the alarm information 3 at the node of the communication device that generated the alarm, whose granularity was adjusted in the processing of S54 (S55).

[0118] If the node extracted from the communication device opposite the source of the alarm is not present in the communication device that generated the alarm (S52; no), or after processing S55, the update process ends (end).

[0119] 4.3 Effects of the Fourth Embodiment According to the fourth embodiment, the update unit 25 adjusts the granularity of the nodes belonging to the source of the alarm extracted by the extraction unit 24 to the granularity specified by the alarm format information 23a. The update unit 25 updates the source of the alarm information 3 with the nodes whose granularity has been adjusted. This allows the fault detection device 4 to update the granularity stored in the source of the alarm information 3 in a rule-based manner to the granularity required for fault detection processing. As a result, the load on the fault detection processing can be reduced.

[0120] 5. Variations, etc. Furthermore, various modifications can be applied to the first, second, third, and fourth embodiments described above.

[0121] In the first, second, third, and fourth embodiments described above, the case in which the program that performs the overall processing, including the update process, is executed in the alarm information update device 5 has been described, but it is not limited to this. For example, the program that performs the overall processing, including the update process, may be executed on computing resources on the cloud.

[0122] It should be noted that the present invention is not limited to the embodiments described above, and can be modified in various ways during implementation without departing from its essence. Furthermore, each embodiment may be combined as appropriate, and in that case, the combined effects can be obtained. Moreover, the above embodiments include various inventions, and various inventions can be extracted by selecting combinations from the multiple constituent elements disclosed. For example, if the problem can be solved and effects obtained even if some constituent elements are deleted from all the constituent elements shown in the embodiment, then the configuration with these deleted constituent elements can be extracted as an invention. [Explanation of symbols]

[0123] 1…Fault detection system 2…Topology information 3… Alarm information 4…Fault detection device 5… Alarm information update device 11…Control circuits 12…Communication module 13…User Interface 14…Storage 15…Drive 16...Storage medium 21… Alarm information acquisition unit 22...Topology Information Acquisition Unit 23...Storage section 23a… Alarm format information 24…Extraction part 25…Update section

Claims

1. An acquisition unit that acquires alarm information including message information indicating the content of the alarm in the network and node information indicating the source of the alarm, An extraction unit that extracts information indicating the first node in a rule-based manner from the aforementioned message information, If the first node is a node connected to a second node belonging to the source, the second node includes an update unit that updates the node information, An alarm information update device equipped with this device.

2. The update unit updates the node information at the first node if the first node is a node belonging to the source. The alarm information update device according to claim 1.

3. If the message information includes multiple nodes, the extraction unit extracts the node closest to the source from the multiple nodes as the first node. The alarm information update device according to claim 1.

4. If the message information includes multiple nodes, the extraction unit extracts a node that matches a predetermined attribute from the multiple nodes as the first node. The alarm information update device according to claim 1.

5. The aforementioned update unit is The granularity of the second node is adjusted to the specified granularity, The node information is updated with the second node adjusted to the specified granularity. The aforementioned granularity is an indicator of the level of detail of the node. The alarm information update device according to claim 1.

6. The granularity of the second node is higher than the granularity of the nodes stored in the node information. The aforementioned granularity is an indicator of the level of detail of the node. The alarm information update device according to claim 1.

7. An alarm information update method performed by an alarm information update device, To obtain alarm information including message information indicating the content of the alarm in the network, and node information indicating the source of the alarm, From the aforementioned message information, extract information indicating the first node using a rule-based approach, If the first node is a node connected to a second node belonging to the source, the node information is updated at the second node, A method for updating alarm information, which includes the following features.

8. A program for causing a computer to function as one of the components of the alarm information update device described in any one of claims 1 to 6.

Images