Summary of the invention
In view of above-mentioned existing in prior technology problem, the purpose of this invention is to provide a kind of method and device of fault location, can improve the efficient and the accuracy of fault location, reduce the workload of alert analysis.
The objective of the invention is to be achieved through the following technical solutions:
The invention provides a kind of method of fault location, comprise the steps:
A, according to alert analysis factor configuration alarm correlation data;
B, warning information is carried out correlation analysis, determine source alarm based on the alarm correlation data of configuration;
The source alarm that C, basis are determined is carried out fault location and is handled.
Alert analysis factor described in the steps A comprises:
Alarm type and/or alarm source and/or alarm time window.
Alarm correlation data described in the steps A comprise: alarm type correlation and/or alarm source correlation and/or alarm time window.
Described step B specifically comprises:
B1, choose a fixed warning information of alarm type as current alarm;
B2, judge whether to exist and the relevant alarm of described current alarm type according to the alarm correlation data of configuration, if do not exist and the relevant alarm of described current alarm type, alarm in the source that then described current alarm is defined as.
Described step B2 also comprises:
B21, if exist and the relevant alarm of described current alarm type, judge between described current alarm and the alarm of described type correlation whether have the alarm source correlation according to the alarm correlation data of configuration, if do not have the alarm source correlation between described current alarm and the alarm of described type correlation, then described current alarm be defined as the source alarm.
Described step B21 also comprises:
B211, if there are the alarm source correlation in described current alarm and described type correlation between alarming, whether the time difference of judging described current alarm and the alarm of described type correlation according to the alarm correlation data of configuration surpasses the time span that the alarm time window limits, if the time difference of described current alarm and the alarm of described type correlation surpasses the time span that the alarm time window limits, then described current alarm is defined as the source alarm.
Described step B211 also comprises:
If the time difference of described current alarm and the alarm of described type correlation surpasses the time span that the alarm time window limits, then described type is correlated with alarm as current alarm, and carries out described step B2.
The present invention also provides a kind of device of fault location, comprising:
Alarm correlation data memory module, source alarm determination module and fault location module;
Described alarm correlation data memory module is used to store the alarm correlation data according to the configuration of alert analysis factor;
Described source alarm determination module is used for according to the alarm correlation data of configuration warning information being carried out correlation analysis, determines the source alarm;
Described fault location module is used for carrying out fault location according to the source alarm that described source alarm determination module is determined and handles.
Described source alarm determination module comprises:
The type correlation is judged submodule, is used for judging whether to exist the alarm relevant with the current alarm type according to the alarm correlation data of configuration, if there be not the alarm relevant with the current alarm type, then current alarm is defined as the source alarm.
Described source alarm determination module also comprises:
The source correlation is judged submodule, being used for judging the judged result of submodule when described type correlation is when having the alarm relevant with the current alarm type, judge between current alarm and the alarm of type correlation whether have the alarm source correlation according to the alarm correlation data of configuration, if do not have the alarm source correlation between current alarm and the alarm of type correlation, then current alarm be defined as the source alarm.
Described source alarm determination module also comprises:
The alarm time difference is judged submodule, being used for judging the judged result of submodule when described source correlation is when having the alarm source correlation between current alarm and the alarm of type correlation, whether the time difference of judging current alarm and the alarm of type correlation according to the alarm correlation data of configuration surpasses the time span that the alarm time window limits, if the time difference of current alarm and the alarm of type correlation surpasses the time span that the alarm time window limits, then current alarm is defined as the source alarm.
As seen from the above technical solution provided by the invention, adopt method of the present invention and device to have following advantage:
1, can from a large amount of alarm datas, find the source alarm rapidly, determine alarm source, so alert analysis speed be fast, thereby improve the efficient of fault location;
2, the alert analysis process is finished by software, and the possibility that omission, mistake occur is less, so the alert analysis data are reliable, thereby has improved the accuracy of fault location, and greatly reduces the work of maintenance personnel amount;
3, be beneficial to rapidly, fix a breakdown exactly;
4, implementation method of the present invention is simple, can realize by software fully, can compatible well existing equipment, and hardware implementation cost is very low.
Embodiment
Core concept of the present invention is: at first, and according to alert analysis factor configuration alarm correlation data; Then, warning information is carried out correlation analysis, determine the source alarm based on the alarm correlation data of configuration; And carry out fault location according to the source alarm of determining and handle.
Alert analysis factor among the present invention includes but not limited to alarm type, alarm source and alarm time window, can expand as required, increases the analytical procedure of other factors in the alert analysis process.
Be that example illustrates technical scheme of the present invention with these three alert analysis factors of alarm type, alarm source and alarm time window below.
In order to implement technical scheme of the present invention, the alarm correlation data in advance need be disposed in the warning system.
The alarm correlation data of static configuration in warning system comprise: alarm type correlation, alarm source correlation and alarm time window.
In order to understand technical scheme of the present invention better, again some main terms relevant with the present invention are described below:
Alarm type: according to alarm characteristic or the classification that alarm is carried out of the common ground that takes out of phenomenon in a certain respect.
Such as, single board default alarm, frame fault warning, or the like.
Alarm source: the root or the source that refer to alarm generation.
Such as, the alarm that the veneer in the frame breaks down and causes, so, the single board default in the frame is exactly an alarm source.
The source alarm: refer to the original alarm incident, the source alarm might trigger other a series of alarm events, also may not trigger other alarm events.
The alarm of deriving: by other alarm events of original alarm Event triggered.
Caused the frame fault warning such as the alarm of, single board default, so, the single board default alarm is exactly the source alarm, the frame fault warning alarm of deriving exactly.
Alarm correlation: refer to have certain contact between the alarm or involve, and can cause causality between alarm.
If have correlation between two alarms, so, there is one to be the source alarm in these two alarms, another is the alarm of deriving.
Alarm type correlation: refer between the dissimilar alarms to have certain contact or to involve, and can cause causality between alarm.
Such as, the single board default alarm may cause the frame fault warning, therefore, has the correlation of alarm type between single board default alarm and the frame fault warning.
Alarm source correlation: refer between the different alarm sources to have certain contact or to involve, and can cause causality between alarm, include but not limited to the same relation of alarm source, the inclusion relation of alarm source, the adduction relationship of alarm source.
Such as, single board default alarm and frame fault warning have taken place simultaneously, the correlation that whether has alarm source so between single board default alarm and the frame fault warning, there is the alarm type correlation except judging between these two alarms, to judge also whether the veneer that alarm takes place belongs to the frame that alarm takes place, if then have the correlation of alarm source between single board default alarm and the frame fault warning, and belong to the alarm source correlation of inclusion relation; Otherwise, do not have the correlation of alarm source between single board default alarm and the frame fault warning.
Alarm time window: weigh the long measure of alarm time difference, can set up on their own according to actual needs.
The method of utilizing pre-configured alarm correlation data to carry out alarm correlation analysis is:
At first select an alarm to analyze, judge whether to exist the alarm relevant with the current alarm type as current alarm;
If there is the alarm of alarm type correlation in current alarm, need then further to judge whether these two alarms exist the alarm source correlation;
If there is the alarm source correlation in these two alarms, whether the alarm time difference that then needs further to judge these two alarms drops in the alarm time window;
If the alarm time difference of these two alarms has dropped in the alarm time window, think that then these two alarms are the correlation alarm, i.e. type correlation alarm is the source alarm of current alarm, current alarm is the alarm of deriving of type correlation alarm.
For the present invention there being further understanding, method of the present invention is described in detail below in conjunction with accompanying drawing.
The specific implementation of the method for the invention may further comprise the steps as shown in Figure 1:
Step 11: in the fixed warning information of numerous alarm types, choose an important warning information and carry out alarm correlation analysis as current alarm.
Step 12: judge whether to exist the alarm relevant with the current alarm type according to the alarm correlation data that are pre-configured in the warning system.
If (this alarm is called: the type correlation alarm of current alarm), then execution instep 13 the alarm relevant with the type of current alarm in existing warning information;
Otherwise, think not have any correlation, execution instep 16 between current alarm and other alarms.
Such as, the current alarm type is the frame fault warning, has the single board default warning information in existing warning information, because the single board default alarm belongs to the alarm of type correlation with the frame fault warning, therefore, there is the alarm of type correlation in current alarm.
Step 13: judge between current alarm and the alarm of its type correlation whether have the alarm source correlation according to pre-configured alarm correlation data.
If have the alarm source correlation between current alarm and the alarm of its type correlation, then execution instep 14; Otherwise, think not have correlation, execution instep 16 between current alarm and other alarms.
Still be the frame fault warning with the current alarm, the alarm of type correlation illustrates how to judge between current alarm and the alarm of its type correlation whether have the source correlation for the single board default alarm is example.
Judge whether the veneer that alarm takes place belongs to the frame that alarm takes place, if then have the alarm source correlation between single board default alarm and the frame fault warning; Otherwise, do not have the alarm source correlation between single board default alarm and the frame fault warning.
Step 14: whether the alarm time difference of judging current alarm and the alarm of its type correlation according to pre-configured alarm correlation data drops in the alarm time window.
If the alarm time difference of current alarm and the alarm of its type correlation drops in the alarm time window, be that the alarm time difference does not surpass the time span that the alarm time window limits, then think and have correlation between the alarm of current alarm and its type correlation, these two alarms belong to relevant alarm, the type correlation alarm that is current alarm is the source alarm of current alarm, otherwise, current alarm is the alarm of deriving of its type correlation alarm, therefore, current alarm is not the original reason of initiating failure, with its eliminating, and execution instep 15;
If the alarm time difference of current alarm and the alarm of its type correlation does not drop in the alarm time window, promptly the alarm time difference has surpassed the time span that the alarm time window limits, and then thinks not have correlation, execution instep 16 between current alarm and other alarms.
Still be the frame fault warning with the current alarm, its type correlation alarm illustrates how to judge between current alarm and the alarm of its type correlation whether have correlation for the single board default alarm is example.
Because not only one of the veneer quantity in the frame, though so have the alarm source correlation between these two alarms, but still can not determine that this frame fault warning is caused by this single board default alarm, therefore, also need to judge the time difference of these two alarms, if the alarm time difference drops in the predefined alarm time window, think that then these two alarms are the correlation alarm, this frame fault warning is caused by this single board default alarm, therefore, the frame fault warning is the alarm of deriving of single board default alarm, not the true cause of initiating failure,, need then to continue its source alarm with its eliminating, be that alarm correlation analysis is carried out in the single board default alarm, find out its source alarm again.
Step 15: the type correlation of current alarm is alarmed as current alarm, and returnstep 12, and continue alarm correlation analysis is carried out in this alarm (being the alarm of type correlation), find out the source alarm of this alarm, up to finding out final source alarm, i.e. the source alarm of all alarms.
Step 16: determine that current alarm is the source alarm, and execution instep 17.
After the source alarm is determined, also just found the original reason of initiating failure, the alert analysis process finishes.
Certainly, in actual applications, the original reason of initiating failure may be not only one, at this moment, need repeat the process of alert analysis, all finds up to all the original reasons with initiating failure.
Step 17: carry out fault location according to the current alarm that is defined as the source alarm.
After the fault location, just can fix a breakdown, thereby make equipment recover normal operation, business is restored.
The present invention also provides a kind of device of fault location, comprising: alarm correlation data memory module, source alarm determination module and fault location module, as shown in Figure 2.Each functions of modules is as follows:
The function of alarm correlation data memory module is:
Storage is according to the alarm correlation data of alert analysis factor configuration.
Described fault location module is used for carrying out fault location according to the source alarm that described source alarm determination module is determined and handles.
The function of source alarm determination module is:
Alarm correlation data according to configuration are carried out correlation analysis to warning information, determine the source alarm.
The function of fault location module is:
Carry out the fault location processing according to the source alarm that source alarm determination module is determined.
Wherein, the function of source alarm determination module is finished by type correlation judgement submodule, source correlation judgement submodule and alarm time difference judgement submodule;
The type correlation judges that the function of submodule is:
Judge whether to exist the alarm relevant according to pre-configured alarm correlation data,, then current alarm is defined as the source alarm if there be not the alarm relevant with the current alarm type with the current alarm type.
The source correlation judges that the function of submodule is:
Judging the judged result of submodule when the type correlation is when having the alarm relevant with the current alarm type, judge between current alarm and the alarm of type correlation whether have the alarm source correlation according to pre-configured alarm correlation data, if do not have the alarm source correlation between current alarm and the alarm of type correlation, then current alarm be defined as the source alarm.
The alarm time difference judges that the function of submodule is:
Judging the judged result of submodule when the source correlation is when having the alarm source correlation between current alarm and the alarm of type correlation, judge according to pre-configured alarm correlation data whether the time difference of current alarm and type correlation alarm drop in the alarm time window, if the time difference of current alarm and the alarm of type correlation does not drop in the alarm time window, then current alarm is defined as the source alarm.
In sum, adopt method and system of the present invention, can from a large amount of alarm datas, find the source alarm rapidly, determine alarm source, so alert analysis speed is fast, thereby improve the efficient of fault location; The alert analysis process is finished by software, and the possibility that omission, mistake occur is less, so the alert analysis data are reliable, thereby has improved the accuracy of fault location, and greatly reduces the work of maintenance personnel amount.
The above; only for the preferable embodiment of the present invention, but protection scope of the present invention is not limited thereto, and anyly is familiar with those skilled in the art in the technical scope that the present invention discloses; the variation that can expect easily or replacement all should be encompassed within protection scope of the present invention.Therefore, protection scope of the present invention should be as the criterion with the protection range of claim.