JP4836053B2 - Failure determination method and program - Google Patents

Description

  The present invention relates to a failure determination method.

  Various communication devices are placed in the communication network. A failure of a communication device is notified by various methods depending on the type of communication network or device. For example, an IP device connected to a LAN transmits a failure to a failure monitoring device on the network by the SNMP protocol. Further, many communication devices installed in the conventional PDH network detect a failure by a sensor device. In addition, alarms issued by failure monitoring devices include alarms due to primary cause failures caused by equipment failures, as well as impact failures caused by secondary effects caused by the equipment failure. There is an alarm. The alarm due to the influence failure includes, for example, one issued from the lower device due to the failure of the upper device in the communication hierarchy, and one issued from the upper device due to the failure of the lower device.

  An alarm generated in the communication network is delivered to the failure determination device. The failure determination device analyzes the alarm that arrives, determines the alarm due to the main cause failure, and determines the failure. FIG. 1 is a flowchart for explaining processing in the failure determination apparatus. In the failure determination device, reception processing (S10), extraction processing (S11), and determination processing (S12) are executed.

  In the conventional failure determination apparatus, in the extraction process (S11), alarms are extracted in the order of arrival, and the determination process (S12) is performed. However, because there is a difference in the alarm determination method in the failure monitoring device that is the source of the alarm and the transmission path through which the alarm passes, the order in which the alarm is generated and the order in which the alarm arrives at the failure determination device are: Does not necessarily match. That is, the conventional failure determination device cannot guarantee the order of alarm generation. For this reason, there has been a problem that the alarm due to the influence failure is erroneously determined to be the alarm due to the main cause failure.

  FIG. 2 is a flowchart for explaining extraction processing in a conventional failure determination apparatus. As shown in FIG. 2, in the conventional extraction process, when an alarm arrives, it waits for a predetermined aggregation time in order to wait for all related alarms to be prepared (S21). Thereafter, all alarms that have arrived are extracted (S22). When the alarm is extracted, a determination process is performed on the extracted alarm (S12).

  The operation of the conventional failure determination device will be described in detail with reference to FIG. 3 and FIG. As shown in FIG. 3, it is assumed that there is a monitoring target network 10 having [communication device A] 11, [communication device B] 12, and [communication device C] 13. [Communication device B] 12 is an upper device, and [Communication device C] 13 is a lower device. Here, as illustrated, it is assumed that a failure occurs in [communication device A] 11 at 10:00:00 and a failure occurs in [communication device B] 12 at 10:00:10. These failures are completely unrelated accidents. Further, it is assumed that [communication device C] 13 is affected by a failure of [communication device B] 12, which is a higher-level device, at 10:00:10.

  FIG. 4 is a diagram for explaining the operation of the conventional failure determination apparatus under the situation shown in FIG. In FIG. 4, the first alarm arrived at the failure determination device is an alarm due to the failure of [communication device A] 11, and the reception time is set to 10: 00: 1. Further, the next alarm arrived is an alarm due to an influence failure of [communication device C] 13, and the reception time is set to 10:00:11. The alarm that arrived last is an alarm due to the failure of [communication device B] 12, and the reception time is set to 10:00:25. In the conventional failure determination apparatus shown in FIG. 4, it is assumed that 20 seconds is set as an aggregation time parameter.

  In the conventional failure determination apparatus, when the first alarm arrives, the extraction process is driven. The conventional failure determination apparatus waits for the aggregation time starting from the time when the first alarm arrives (S21). In the example of FIG. 4, the first alarm arrives at 10: 00: 1 and the aggregation time is 20 seconds, so it will wait until 10:00:21. Then, when it is 10:00:21, all arriving alarms are extracted (S22). In the case of FIG. 4, an alarm due to a failure of [communication device A] 11 and an alarm due to an influence failure of [communication device C] 13 are extracted. When determination processing is performed for these alarms (S12), it is determined that a failure has occurred in [communication device A] 11 and a failure has occurred in [communication device C] 13. That is, the alarm due to the influence failure is determined to be an alarm due to the main cause failure. Subsequently, since an alarm due to the failure of [communication device B] 12 has arrived at 10: 0: 25, extraction is also performed at 10: 0: 45 after 20 seconds (S22). When determination processing is performed for this alarm (S12), it is determined that a failure has occurred in [communication device B] 12. Eventually, all of [communication device A] 11, [communication device B] 12, and [communication device C] 13 make an erroneous determination that a failure has occurred.

  By the way, as publicly known documents related to equipment failures in a communication network, Japanese Patent Application Laid-Open No. 2004-080297 (see Patent Document 1), Japanese Patent Application Laid-Open No. 2005-190270 (see Patent Document 2), Japanese Patent Application Laid-Open No. 05-022291. (See Patent Document 3), Japanese Patent Laid-Open No. 06-311207 (see Patent Document 4). In the invention of “Failure Measure System” described in Patent Document 1, the estimation means estimates a cause of a failure that has occurred in any of a plurality of communication devices constituting a communication network. The measure execution means takes measures against the failure based on the estimation content of the estimation means.

  In the invention of the “causal relationship estimation program” described in Patent Document 2, the computer is caused to execute the following steps. The storing step stores a plurality of causal relationship estimated value calculation rules in advance. Receiving from the first device comprises: an ID of a first error message; a first time when the first error message is generated; an ID of a first process that generated the first error message; The first communication partner of the first inter-process communication or the first shared partner of the first shared file to which the first process was connected, the first inter-process communication or the first generation time of the first shared file And a first extinction time from the first device. Receiving from the second device comprises: an ID of a second error message; a second time at which the second error message is generated; an ID of a second process that has generated the second error message; The second communication partner of the second inter-process communication or the second shared partner of the second shared file, the second inter-process communication or the second generation time of the second shared file to which the two processes were connected. And a second extinction time is received from the second device. The step of selecting determines whether the first process ID and the second process ID are the same. The first communication partner is the second process or the second communication partner is the first process ID. Based on whether it is a process, it is determined whether there is at least a temporary interprocess communication between the first process and the second process. Determining whether a shared file exists at least temporarily between the first process and the second process based on whether a second sharing partner is the first process; Based on the second time, and at least one of the first generation time, the first annihilation time, the second generation time, and the second annihilation time, the first time and the first time Between 2 times Determining at least one of the first inter-process communication or the first shared file or the second inter-process communication or the second shared file. A causal relationship estimation value calculation rule to be applied is selected based on the result. The calculating step calculates a causal relationship estimated value based on a causal relationship estimated value calculation rule to be applied.

  In the invention of the “failure message management method” described in Patent Document 3, a network management system that is connected to a plurality of network configuration devices constituting a communication network through a communication line and monitors and controls these network configuration devices is the network configuration. Receive and manage fault messages in real time when a fault occurs in the device. The network management system includes a failure determination memory that stores a failure occurrence time for each component device of the network configuration device and for each failure type. When a failure occurrence message is received from the network component device, a failure occurrence time is registered at a corresponding position in the determination memory. After this registration, a predetermined failure occurrence message is output when a predetermined time is exceeded before receiving the failure recovery message. On the other hand, when a failure recovery message is received within a predetermined time, the failure occurrence time already registered at the corresponding position is deleted and the already received failure occurrence message is discarded.

  In the invention of the “system failure determination method” described in Patent Document 4, the determined system detects a failure of the subsystem itself and outputs an alarm report message, and other than the subsystem. A plurality of subsystems having a second failure detection function for detecting an abnormality in the processing results of the subsystems and outputting an alarm report message are connected to form a group. The alarm report message output by the first failure detection function is stored in each storage area independently with the time of occurrence of the alarm report message in correspondence with each subsystem. The alarm report message output by the second failure detection function is stored in each storage area independently and in correspondence with each subsystem together with the time of occurrence of the alarm report message. When the alarm report message by the first failure detection function is stored in the storage area, or the alarm report message stored in the storage area within a time that is a predetermined time after the current time by the second failure detection function It is determined that the subsystem corresponding to the case corresponding to at least one of the cases where the number is equal to or greater than the preset number has failed.

JP 2004-080297 A JP 2005-190270 A Japanese Patent Laid-Open No. 05-022291 Japanese Patent Laid-Open No. 06-311207

  An object of the present invention is to determine a failure more accurately by paying attention to an alarm occurrence time.

  In the failure determination method according to the present invention, in the receiving step, an alarm transmitted from the communication network is received. In the extracting step, referring to the time stamp time of the alarm, the alarm to be determined is extracted based on the time stamp time. In the determining step, it is determined whether the extracted alarm is due to a main cause failure or an influence failure.

  In the failure determination method according to the present invention, the step of extracting the alarm to be determined includes a step of storing the assumed value tb, a step of storing the maximum value tt, and a step of reserving the next determination. In the step of storing the assumed value tb, when a plurality of alarms can be generated due to one failure, the assumed value tb of the time width in which the time stamp times in the plurality of alarms are stored is stored. In the step of storing the maximum value tt, the maximum value tt of the time required for reception is stored depending on the alarm arrival route. In the step of reserving the next determination, the extraction time is determined based on the assumed value tb and the maximum value tt, and the next determination is reserved. Further, in the failure determination method according to the present invention, in the reservation step, when an alarm is received, the time obtained by adding the assumed value tb and the maximum value tt to the time stamp time of the alarm Determine the extraction time. In the failure determination method according to the present invention, in the reservation step, the maximum value tt is added to the time stamp time of the alarm received this time when the next determination has already been reserved by another alarm reception. When the time points in the past from the extraction time related to the reserved determination, there is a step of skipping the reservation by the alarm received this time.

  In the failure determination method according to the present invention, the step of extracting the alarm to be determined includes only an alarm having a time stamp time from the extraction time to the time obtained by subtracting the maximum value tt when the extraction time is reached. Are extracted as judgment targets.

  According to the present invention, since the failure determination is performed by paying attention to the alarm occurrence time, the failure can be determined more accurately.

  The alarm is time stamped when created. If alarm extraction processing is performed with reference to this time stamp time (S11), failure determination focusing on the alarm occurrence time can be performed. Hereinafter, an embodiment of the failure determination method based on the time stamp time will be described in detail.

  FIG. 5 is a diagram for explaining the time width tb and the latest arrival time tt. First, the time width tb will be described. When a device breaks down, alarms that are issued due to the effect are thought to spread in a short time due to real-time exchanges between devices. Therefore, the time stamp time of the alarm due to the main cause failure and the time stamp time of the alarm due to the influence failure are considered to indicate close times. The given time stamp does not guarantee the actual ripple order, and the time stamp time of the alarm due to the influence failure may indicate an earlier time than the time stamp time of the alarm due to the main cause failure. Then, when a failure occurs, the time stamp time of the alarm due to the main cause failure and the time stamp time of the alarm due to the influence failure are distributed with a random value within a certain time width. Conceivable. Let the assumed value of this time width be tb. In the case of FIG. 5, the time stamp indicating the earliest time is the time stamp at time ts1, and the time stamp indicating the latest time is the time stamp at time ts2. If the time stamp time of the alarm that first arrives at the failure determination device is time ts2, the determination to be made from now only needs to be performed for alarms having time stamp times up to the time stamp time ts2 of the alarm. . However, if the time stamp time of the first arriving alarm is the time ts1, the determination to be made is added to the time stamp time ts1 of the alarm by the estimated time width (also simply referred to as the time width) tb. It is necessary to add up to alarms with timestamps up to the time. That is, whether the time stamp time of an alarm that first arrives at the failure determination device is the time ts1, the time ts2, or the time between them is not clear even if only one alarm is seen. It can be said that it is sufficient to add up to an alarm having a time stamp time up to a time obtained by adding the time width tb to the time stamp time of the alarm. In the present embodiment, alarm extraction processing is performed based on this time width tb.

  Next, the latest arrival time tt will be described. The time when the alarm arrives at the failure determination device depends on the notification route to the failure determination device. Since an alarm can be routed through various notification routes, the arrival time differs for each notification route. When a certain failure occurs, the earliest alarm is considered to be able to reach the failure determination device instantly, that is, at the same time as the time stamp time, depending on the processing timing. In the example of FIG. 5, an alarm having a time stamp time of time ts1 can reach the failure determination device at time tt11, and an alarm having a time stamp time of time ts2 reaches the failure determination device at time tt21. Is possible. On the other hand, it is considered that the latest alarm can reach the failure determination device from the time stamp time until a predetermined time elapses, depending on the processing timing. In the example of FIG. 5, an alarm having a time stamp time of time ts1 can reach the failure determination device by time tt12, and an alarm having a time stamp time of time ts2 fails by time tt22. It is considered that the determination device can be reached. In the present embodiment, this predetermined time is set as the latest arrival time tt, and alarm extraction processing is performed based on the latest arrival time tt.

  If the time width tb and the latest arrival time tt are given, when a certain failure occurs, the time for which a series of alarms are collected in the failure determination device can be obtained. That is, the earliest alarm has a time stamp ts1, reaches the failure determination device at time tt11, and the latest alarm has the time stamp ts2, and reaches the failure determination device at time tt22. Assuming that the longest aggregation time of the alarm is a time obtained by combining the time width tb and the latest arrival time tt. From this, when a certain alarm arrives at the failure determination device, for example, if it waits for [tb + tt] time starting from the time stamp time of the alarm, the failure determination device will have all the information related to the failure. It is thought that the alarm is gathered. Further, it can be said that the time stamp time of the collected alarms falls within the time width tb.

  In this embodiment, the extraction process driven by the arrival of a certain first alarm waits for [tb + tt] time after the time stamp time in the first alarm. Then, after [tb + tt] time elapses, alarms to be determined are extracted from all alarms that have arrived at the failure determination apparatus up to that point. Further, when extracting an alarm to be determined, a time that goes back to the latest arrival time tt from the time after [tb + tt] time is used as a reference. An alarm having a time stamp time later than the reference time is not extracted and is excluded from the determination processing targets. On the other hand, an alarm having a time stamp time before the reference time is extracted and set as a determination process target.

  6 and 7 are flowcharts illustrating the extraction process (S11) executed by the failure determination apparatus according to the present embodiment. The flowchart of FIG. 6 shows a process for determining when to perform extraction, and the flowchart of FIG. 7 shows a process for determining which alarm should be extracted. First, the flowchart of FIG. 6 will be described. The extraction process (S11) is driven when the first alarm arrives (S30). The time stamp time is referred to from the first alarm that arrives (S31). Further, the above-described time width tb and the latest arrival time tt are read (S32). The failure determination device calculates the extraction time based on the time stamp time, the time width tb, and the latest arrival time tt. The calculated extraction time is set (S33). The time that is the starting point for calculating the extraction time is the time stamp time. This time stamp time is preferably the time stamp time in the first alarm for simple processing. The extraction time is assumed to be the time after elapse of the sum of the time width tb and the latest arrival time tt from the starting time stamp time. Here, the extraction time is set to a time obtained by adding the time width tb and the latest arrival time tt to the starting time stamp time.

  Next, the flowchart of FIG. 7 will be described. As shown in FIG. 7, the extraction of the alarm applied to the determination process (S12) is not performed until the extraction time (S40). When the extraction time set in FIG. 6 is reached, it is considered that a series of alarms generated by one failure has all arrived at the failure determination device. Therefore, the arrival alarm is read at this timing (S41). Next, the time stamp time is referred to for the read alarm (S42). Subsequently, it is determined whether or not to extract based on the time stamp time. In FIG. 7, it is determined whether or not the time stamp is within a reference time set based on the time width tb (S43). That is, alarms whose time stamp time falls within the time width tb are extracted, and alarms exceeding the time width tb are extracted separately. Here, the time from the extraction time (time stamp time + time width tb + latest arrival time tt) to the time that is back by the latest arrival time tt is set as the reference time. If the time stamp is within the reference time, the alarm is extracted (S44). If the time stamp is not within the reference time, the alarm is not extracted and the next determination is reserved (S45). An alarm whose time stamp is not within the reference time is extracted in the next extraction process (S11), and is determined in the next determination process (S12).

  With reference to FIG. 8, the operation of the failure determination apparatus in the present embodiment under the situation shown in FIG. 3 will be described. In FIG. 8, in the failure determination apparatus according to the present embodiment, 5 seconds is set as the time width tb, and 20 seconds is set as the latest arrival time tt. The set time width tb of 5 seconds and the latest arrival time tt of 20 seconds are stored in the system. In the figure, the failure determination device is programmed to set the extraction time to a time obtained by adding the time width tb and the latest arrival time tt to the time stamp time in the first alarm. In addition, the reference time is programmed to be set to the time from the extraction time to the time that goes back to the latest arrival time tt. When the determination is reserved (S45), the next extraction is performed at the time when 5 seconds of the time width tb and 20 seconds of the latest arrival time tt have elapsed from the current extraction time, that is, 25 seconds. Suppose it is programmed to do later. As shown in FIG. 8, the first alarm that reaches the failure determination device is an alarm due to a failure of [communication device A] 11, and the reception time is set to 10: 00: 1. Further, the next alarm arrived is an alarm due to an influence failure of [communication device C] 13, and the reception time is set to 10:00:11. The alarm that arrived last is an alarm due to the failure of [communication device B] 12, and the reception time is set to 10:00:25.

  In the failure determination apparatus according to the present embodiment, when an alarm due to failure of [communication device A] 11 arrives at 10:01:00, the extraction process is driven (S30). The failure determination device refers to the time stamp of the alarm due to the failure of the [communication device A] 11 (S31), and acquires 10:00:00 as the time stamp time. Subsequently, 5 seconds of time width tb and 20 seconds of latest arrival time tt are read (S32). Then, as programmed, the extraction time is set to 10: 00: 0 + 5 seconds + 20 seconds = 10: 0: 25 (S33).

  When the extraction time is 10:00:25 (S40), the alarm due to the failure of the [communication device A] 11 and the alarm due to the influence failure of the [communication device C] 13 are read (S41). Referring to the time stamp of the alarm due to the main cause failure of [communication device A] 11 (S42), the time stamp time is 10:00:00. This time stamp time is included in the reference time before 10 hours 0 minutes 5 seconds from 10 hours 0 minutes 25 seconds of the extraction time, that is, 20 hours later than the latest arrival time tt (S43). Therefore, the alarm due to the main cause failure of [communication device A] 11 is extracted (S44). The extracted alarm is deleted from the extraction target queue. On the other hand, referring to the time stamp of the alarm due to the influence failure of [communication device C] 13 (S42), the time stamp time is 10:00:10. This time stamp time is not included in the reference time before 10: 00: 5 (S43). Therefore, a determination reservation is made without extracting an alarm due to an influence failure of [communication device C] 13 (S45). Eventually, in the first determination process (S12), only the alarm due to the main cause failure of [communication device A] 11 is determined, and the failure determination device reports the failure of [communication device A] 11.

  The next extraction is performed at 10:00:50 after 25 seconds. At 10:00:50, the alarm due to the influence failure of [communication device C] 13 that has not been extracted and arrived and the alarm due to the main cause failure of [communication device B] 12 are read ( S41). Referring to the time stamp of the alarm due to the influence failure of [communication device C] 13 (S42), the time stamp time is 10:00:10. This time stamp time is included in the reference time before 10 hours 0 minutes 30 seconds, that is, from 10 hours 0 minutes 50 seconds of the extraction time to 20 seconds of the latest arrival time tt (S43). Therefore, an alarm due to an influence failure of [communication device C] 13 is extracted (S44). On the other hand, referring to the time stamp of the alarm due to the main cause failure of [communication device B] 12 (S42), the time stamp time is 10:00:10. This time stamp time is included in the reference time before 10:00:30 (S43). Therefore, the alarm due to the main cause failure of [communication device B] 12 is extracted (S44). Eventually, in the second determination process (S12), an alarm due to an influence failure of [communication device C] 13 and an alarm due to a main cause failure of [communication device B] 12 are determined, and two alarms are analyzed. Thus, the failure determination device reports only the failure of [communication device B] 12 and does not report the failure of [communication device C] 13.

FIG. 1 is a flowchart for explaining processing in the failure determination apparatus. FIG. 2 is a flowchart for explaining extraction processing in a conventional failure determination apparatus. FIG. 3 is a diagram for explaining a specific example of a failure situation that may occur in the communication network. FIG. 4 is a diagram for explaining the operation of the conventional failure determination apparatus. FIG. 5 is a diagram for explaining the time width tb and the latest arrival time tt. FIG. 6 is a first flowchart for explaining the extraction process executed by the failure determination apparatus according to the present embodiment. FIG. 7 is a second flowchart for explaining the extraction process executed by the failure determination apparatus according to the present embodiment. FIG. 8 is a diagram for explaining the operation of the failure determination apparatus according to the present embodiment.

Explanation of symbols

10 Monitoring target networks 11 to 13 Communication equipment

Claims (5)

Receiving an alarm transmitted from a communication network;
Referring to the time stamp time of the alarm and extracting the alarm to be determined based on the time stamp time;
Extracted alarm, have a determining whether by or impact failure due primarily cause failures,
The step of extracting the alarm to be determined is
When a plurality of alarms can occur due to a single failure, the time
Storing an assumed value tb of a time width in which the pump times are dispersed;
A step of storing a maximum value tt of a time required for reception depending on an arrival route of the alarm;
An extraction time is determined based on the assumed value tb and the maximum value tt, and the next determination is predicted.
About to step and
A failure determination method comprising: The reservation step includes:
When receiving the alarm, the time stamp time of the alarm, the assumed value tb, the time obtained by adding the said maximum value tt, failure determination method according to claim 1, wherein determining that the extraction time. The reservation step includes:
When the next determination has already been reserved by another alarm reception, the time obtained by adding the maximum value tt to the time stamp time of the alarm received this time indicates the past than the extraction time related to the reservation determination. The failure determination method according to claim 2 , further comprising a step of skipping reservation by the alarm received this time. The step of extracting the alarm to be determined is
The failure determination method according to any one of claims 1 to 3 , wherein when an extraction time comes, only an alarm having a time stamp time from the extraction time to a time obtained by subtracting the maximum value tt is extracted as a determination target. .   The program for making a failure determination apparatus perform the failure determination method of any one of Claims 1 thru | or 4.

Images