Method and device for processing network equipment alarm message storm

Abstract

The invention relates to a method and a device for processing network equipment alarm message storm. The method comprises the following steps: (1) setting a monitored network element, and establishing a network element model; (2) creating a network element alarm rule engine, and generating network element alarm data adapting to a rule in real time based on source alarm information; (3) collecting statistics on network element alarm number in real time based on the network element alarm data in the current sliding time window, and dynamically generating a confidence interval and a threshold by using a probability statistic method, wherein the sliding time window comprises time units of multiple sequences; (4) judging the type of an alarm message behind the current sliding time window according to the alarm number and the threshold, wherein if the alarm number is higher than the upper limit threshold, the alarm message is a storm message and storm early warning is performed; if the alarm number is lower than the lower limit threshold, the alarm message is a storm release message and storm early warning is releases; otherwise, the alarm message is a normal alarm message; and (5) sliding a time unit backward based on the current sliding time window, entering next sliding time window, and turning to step (3) above.

Description

technical field [0001] The invention belongs to the technical field of network communication, and in particular relates to a method and device for processing a network equipment alarm message storm based on probability statistics. Background technique [0002] With the rapid commercialization of mobile communication networks, 2G, 3G, and LTE networks are gradually integrated, and the network structure is becoming increasingly complex, and the traffic carried by the network is increasing year by year. When a key device fails, a large number of messages will be reported to the network equipment fault management system. At this time, the fault monitoring may not be timely or even impossible to monitor, and then the fault processing may not be timely. If the number of messages exceeds the processing capacity of the system , it will cause huge pressure to the system, or even paralyze it. Timely and effective monitoring of network faults and processing them in the first place has...

AI Technical Summary

Problems solved by technology

[0004] (1) A large number of meaningless alarm messages appear on the monitoring platform, which affects the monitoring personnel to discover and deal with normal network element alarms, including major network element alarms

[0005] (2) The analysis of a large number of storm alarms consumes a lot of CPU time, and memory overflow may occur during analysis, resulting in delays in alarm monitoring

[0006] (3) Due to the lack of a certain prediction and message merging mechanism for the alarm storm, the entire fault management system is in a passive high-load state when encountering a message storm

However, this scheme needs to pre-set the threshold based on experience, but the threshold of the message storm is generally difficult to pre-determine

If the threshold is too small, normal messages will be discarded, and normal alarms cannot be monitored; if the threshold is too large, when an alarm storm actually occurs, the alarm message storm cannot be filtered out

[0011] However, the above solutions still cannot perfectly solve the problems and impacts faced by the warning storm

Images