Alarm Correlation Analysis Method Based on Knowledge Base

Abstract

The invention provides a warning association analysis method based on a knowledge base. The method includes the steps that 1, warning information existing in a warning bus is acquired; 2, warning absorption association analysis is conducted on the warning information, and a root warning is obtained; 3, warning deduction association analysis is conducted on the warning information, and a new warning is deducted to serve as a root warning; 4, the result obtained after association analysis is identified in the warning bus in a association identifier setting mode; 5, after the root warning is determined, automatic confirmation is conducted on sub-warnings, and all the relevant sub-warnings are closed synchronously as along as the root warning is closed. According to the warning association analysis method, real-time rule match is conducted on multiple warnings in the warning bus according to the association rules of warning absorption and warning deduction stored in the knowledge base, the absorption relation and the deduction relation are built in sequence to form a tree-shaped structure, so that the root warning is analyzed in real time, the derivative warnings are absorbed, or a new warning is obtained according to the existing warning deduction.

Description

technical field [0001] The invention relates to the field of IT equipment monitoring, in particular to an alarm correlation analysis method based on a knowledge base. Background technique [0002] As the information system plays an increasingly important role in various industries, the requirements for the monitoring system are also getting higher and higher. At present, the mainstream technical positioning of the IT monitoring system construction goal is to realize system-level monitoring. At this stage, the IT monitoring system no longer focuses on the realization of a "large and comprehensive" single commercial product, but each organization combines its own application system characteristics and management requirements, and integrates the heterogeneous data sources of multiple data sources through information system integration. The monitoring and alarm information is managed and correlated in a unified manner, so as to complete the system-oriented monitoring. [0003]...

AI Technical Summary

Problems solved by technology

When the operation and maintenance personnel deal with the alarm, it is possible to delay the processing time of the fault because they do not find the most important alarm information from a large number of alarms

In addition, when some faults occur, the root alarms of individual monitoring sources may be blocked, or some logical root alarms cannot be directly obtained from the monitoring system, which will affect the efficiency of fault handling

Images