JP6463703B2 - Network monitoring apparatus and network monitoring method - Google Patents

Description

  The present invention relates to a network monitoring apparatus and a network monitoring method.

  An IP (Internet Protocol) network is composed of various devices (NE: Network Element) such as routers, switches, and servers. In recent years when the Internet has become widespread, the number and types of NEs have increased with the expansion of networks and services.

  In providing a service, it is very important that the NE is operating normally. Therefore, the communication carrier always monitors the state of the NE using an operation system (OpS: Operation System).

  For example, in OSI (Open Systems Interconnection) management defined by ISO (International Organization for Standardization), there are five system management function areas (Fault Management, Accounting Management) as functions that OpS should have. , Configuration Management, Security Management, and Performance Management). As fault management in these five functional areas, OpS should have a function (monitoring function) for displaying an alarm notified from a communication device to an operator.

  In addition, e-TOM (enhanced Telecom Operations Map), which is a business process framework defined by TMF (TeleManagement Forum), defines three basic operations (Fulfillment, Assurance, Billing) as business that a communication carrier should have. (Refer nonpatent literature 1). When executing an Assurance operation, the operator uses the OpS monitoring function. The OpS monitoring function often displays an alarm notified from the communication device using a trap notification of SNMP (Simple Network Management Protocol) (see Non-Patent Document 2), which is a standardized protocol. Based on information such as the date of occurrence and importance included in the Trap notification, the operator determines the priority of the confirmation as well as grasping the alarm contents.

“BUSINESS PROCESS FRAMEWORK (eTOM)”, [online], TMF, [Search February 26, 2016], Internet, <URL: https://www.tmforum.org/business-process-framework/> “A SIMPLE NETWORK MANAGEMENT PROTOCOL (SNMP)”, [online], May 1990, IETF, [February 26, 2016 search], Internet, <URL: https://www.ietf.org/rfc/rfc1157. txt>

  Here, when monitoring a large-scale NW such as a communication carrier, the operator handles a large amount of alarms because a large number of NEs are monitored as a management target. The operator determines the priority of confirmation based on information such as the date and time of occurrence and the importance level. However, when a large number of alarms occur, the work efficiency greatly depends on the experience and skills of the operator, and the operator has priority. There is a problem that there is an increased possibility of mistaken alarms to be confirmed.

  The present invention has been made in view of the above-described problem, and is capable of preferentially checking important alarms from a plurality of alarms without depending on the experience and skill of the operator. It is an object to provide a monitoring method.

  In order to solve the above problem, the network monitoring device according to the present invention is a network monitoring device that monitors a network using an alarm notified from a communication device, and needs to be confirmed by an operator that requires confirmation of the alarm. A storage unit that stores policy information in which a degree is defined as a conditional probability that is a combination of a confirmation target alarm that is a confirmation target alarm and a correlation alarm that is correlated with the confirmation target alarm; When a new first alarm is notified from the communication device, the confirmation target alarm of the policy information is searched using the first alarm as a key, and the first alarm is obtained from a combination of alarms that can be taken in the future. A confirmation necessity calculation unit for calculating the confirmation necessity degree, and the confirmation necessity calculation unit is correlated with the first alarm when the first alarm is notified. In addition, referring to the policy information using the second alarm as a key for the confirmation necessity of the second alarm whose confirmation necessity has already been calculated by being notified before the first alarm. It is characterized by recalculating with.

  In order to solve the above problems, a network monitoring method according to the present invention is a network monitoring method of a network monitoring device that monitors a network using an alarm notified from a communication device, and the network monitoring device is operated by an operator. The degree of confirmation that requires confirmation of the alarm is defined by a conditional probability that is conditional on a combination of a confirmation target alarm that is a confirmation target alarm and a correlation alarm that is correlated with the confirmation target alarm. When a new first alarm is notified from the communication device, the policy information is stored, and when the first alarm is used as a key to search for the confirmation target alarm of the policy information, Calculating the degree of necessity of confirmation of the first alarm from combinations of alarms that can be taken in the future, and when the first alarm is notified, the first alarm The policy information with the second alarm as a key is used as the confirmation necessity of the second alarm that has been correlated and is notified before the first alarm, and has already calculated the confirmation necessity. And performing a recalculation step by referring to.

  By doing in this way, the network monitoring apparatus and the network monitoring method according to the present invention use the predefined policy information every time an alarm is generated, and the degree of confirmation of the notified alarm and the notified alarm Calculate the degree of alarm confirmation that is correlated with For this reason, the operator can preferentially confirm important ones from a plurality of alarms by outputting the calculated degree of confirmation to the operator.

  The policy information includes, for example, the correlation alarm that is correlated with the ratio of the state in which only the confirmation target alarm is generated with respect to the entire event that the confirmation target alarm has occurred, and the confirmation target alarm is generated. Are defined at the same time, and a ratio indicating whether or not the operator needs to confirm the confirmation target alarm is further defined with respect to the defined ratio of each state.

  By doing in this way, it is possible to set the necessity of confirmation in detail by dividing the case for each state. Therefore, the operator can preferentially check the more important ones from the plurality of alarms.

  In the network monitoring device according to the present invention, a combination of the confirmation target alarm and the correlation alarm correlated with the confirmation target alarm in a ratio indicating the necessity of confirmation is a group. In addition, it may be determined according to the relationship with alarms belonging to other groups.

  In this way, the network monitoring apparatus according to the present invention increases the necessity of confirmation for more important alarms, for example, even between alarms that are not directly correlated. Can do.

  According to the present invention, important alarms can be preferentially confirmed from a plurality of alarms without depending on the experience and skills of the operator.

It is a figure for demonstrating the policy which concerns on this embodiment. It is a figure for demonstrating the policy which concerns on this embodiment. It is a figure for demonstrating the policy which concerns on this embodiment. It is a figure for demonstrating the policy which concerns on this embodiment. It is a schematic block diagram of the network monitoring system using the network monitoring apparatus which concerns on this embodiment. It is a functional block diagram of the network monitoring apparatus which concerns on this embodiment. It is an example of the data structure of a state definition table. It is an example of the data structure of the ratio table according to combination. It is an illustration of the flowchart which shows the calculation operation | movement of the alarm confirmation necessity degree in the network monitoring apparatus which concerns on this embodiment. It is an example of the policy regarding the alarm A. It is an example of the policy regarding the warning B. It is an example of the policy regarding the warning C. It is an example of the policy regarding the alarm D. FIG. It is an example of the policy regarding the alarm E. FIG. It is an example of the sequence which shows operation | movement of the network monitoring apparatus which concerns on this embodiment. It is a figure which shows the expected value (confirmation necessity level) which an operator needs to confirm the warning C when the warning C generate | occur | produces. It is a figure which shows the expected value (confirmation necessity level) which an operator needs to confirm the warning C when the warning B generate | occur | produces after the warning C. FIG. It is a figure which shows the expected value (confirmation necessity level) which an operator needs to confirm the alarm B when the alarm B generate | occur | produces after the alarm C. FIG. It is a figure which shows the expected value (confirmation necessity level) which an operator needs to confirm the alarm C when the alarm A generate | occur | produces following the alarms C and B. FIG. It is a figure which shows the expected value (confirmation necessity level) which an operator needs to confirm the alarm B when the alarm A generate | occur | produces following the alarms C and B. FIG. It is a figure which shows the expected value (confirmation necessity level) which an operator needs to confirm the alarm A when the alarm A generate | occur | produces following the alarms C and B. FIG. It is an example of the display screen to an operator, (a)-(d) shows the state of each process.

[Summary of Invention]
The present inventor has found that when a large number of alarms occur, a skilled operator determines the priority of confirmation by paying attention to the correlation between alarms in addition to information such as the date and time of occurrence and importance. It was. The correlation between alarms is, for example, detecting an alarm indicating an optical loss of a standby system signal simultaneously with an alarm indicating an optical loss (LOS: Loss of Signal) of an operation system signal of a certain optical path. For example, when a certain optical interface card itself fails, an alarm indicating an optical loss of communication on the optical interface is detected simultaneously with an alarm indicating a card failure. In these cases, it is assumed that the skilled operator pays attention to the light loss alarm of the operational system signal in the former case, and first performs the recovery recovery of the operational system. In the latter case, it is assumed that the optical interface card itself is confirmed first, not the cable or the optical element, focusing on the alarm indicating the card failure rather than the optical loss alarm of communication. In the present invention, the display is made so that the operator can explicitly recognize the correlation between the alarms.

  Specifically, the ratio that requires alarm confirmation by the operator is conditional on a combination of a confirmation target alarm that is a confirmation target alarm and a correlation alarm that is correlated with the confirmation target alarm. Set in advance as a policy defined by probability. Then, every time a new alarm is generated as time passes, the ratio at which the operator needs to confirm the alarm at each time point is calculated using this policy. Hereinafter, the ratio at which the operator needs to confirm the alarm is referred to as “confirmation necessity” or “expected value”.

For example, the entire event P (A) that the alarm A has occurred is set to “1”, and what kind of state can exist as a result when the alarm A occurs is defined. As a result, the meaning includes other alarms that are generated almost simultaneously with the generation of the alarm A and other alarms that are generated after a long time has elapsed since the generation of the alarm A. Here, “a state where only alarm A occurs”, “a state where only alarm A and alarm B occur”, “a state where only alarm A, alarm B and alarm C occur”, “alarm A, alarm B and alarm” Assume that there can be four states, “a state in which only D occurs”.
The rate at which only alarm A occurs is represented by P (JA). Similarly, the ratio of other states is represented by P (JAB), P (JABC), and P (JABD), respectively, and `` P (A) = P (JA) + P (JAB) + P (JABC) + P ( JABD) ”. When the ratio of the state defined here is represented by a square area, it is as shown in FIG. Note that the ratio of these states may be determined based on, for example, the experience of a skilled operator, and is determined in advance at the time of policy setting.

  Next, in a state where only alarm A occurs, if P (JAO) is the rate at which the operator needs to check alarm A, and P (JAX) is the rate at which it is not, then “P (JA) = P (JAO ) + P (JAX) ”. It should be noted that the ratio indicating whether or not these confirmations are necessary may be determined based on, for example, the experience of a skilled operator, and is determined in advance at the time of policy setting. Set P (JAX) to “0” if confirmation is necessary. Similarly, if P (JABO), P (JABX), P (JABCO), P (JABCX), P (JABDO), P (JABDX), then `` P (JAB) = P (JABO) + P (JABX) '' , “P (JABC) = P (JABCO) + P (JABCX)”, “P (JABD) = P (JABDO) + P (JABDX)”. When the ratio indicating the necessity of confirmation defined here is represented by a square area, it is as shown in FIG. Thereby, the policy according to the present invention is completed.

Here, when there is no other alarm when alarm A actually occurs, it is unclear at that time which state will be in the future. Therefore, the expected value that the operator needs to confirm alarm A can be said to be “(P (JAO) + P (JABO) + P (JABCO) + P (JABDO)) / P (A)”. In the example of FIG. 3, the portion surrounded by a thick solid line is “17/36 = 47%”.
Next, it is assumed that a warning D occurs after the warning A. In this case, since the status of P (JA), P (JAB), and P (JABC) cannot be taken in the future, the expected value that the operator needs to confirm alarm A is "P (JABDO) / P (JABD ) ". In the example of FIG. 3, the portion surrounded by a broken line is “(1/36) / (1/6) = 17%”.
In this way, every time a new alarm occurs, the operator knows the proportion of the alarm that needs to be confirmed, so even an operator with little practical experience mistakes the alarm that should be confirmed with priority. The possibility is reduced.

The ratio indicating the necessity of confirmation (for example, P (JAO)) is the correlation alarm (here, alarm A) that is correlated with the alarm to be confirmed (here, alarm A) and the alarm to be confirmed. When the combination with (B, C, D) is one group, it may be determined according to the relationship with the alarm belonging to the other group.
For example, it is assumed that there are two optical interface cards, a first optical interface card and a second optical interface card, and there is no correlation between these optical interface cards. When the operator wants to place more importance on the failure of the second optical interface card than the first optical interface card, for example, the policy of the first optical interface card is defined as shown in FIG. The interface card policy is defined as shown in FIG. In FIG. 4, since it is defined as “P (JAO) = 13/36”, the ratio that requires confirmation of the second optical interface card when both cards receive an alarm indicating card failure. Is higher than the ratio requiring confirmation of the first optical interface card. For this reason, even between alarms that are not directly correlated, for example, it is possible to increase the necessity of confirmation for more important alarms.

Hereinafter, embodiments for carrying out the present invention will be described in detail with reference to the drawings as appropriate.
Each figure is only schematically shown so that the invention can be fully understood. Therefore, the present invention is not limited to the illustrated example. In addition, in each figure, about the same component or the same component, the same code | symbol is attached | subjected and those overlapping description is abbreviate | omitted.

<< Configuration of network monitoring device according to this embodiment >>
With reference to FIG. 5, the network monitoring apparatus 3 according to the present embodiment will be described. FIG. 5 is a schematic configuration diagram of a network monitoring system 1 using the network monitoring device 3 according to the present embodiment. The network monitoring system 1 monitors the network NW, and includes # 1, #n (n is an arbitrary natural number) NE2, 2,... (Indicated by # 1NE to #nNE in the figure) constituting the network NW. The network monitoring device (NMS: Network Management System) 3 for monitoring the network NW and the operator terminal 4 are configured.

  The NE 2 is an example of a communication device, and may be various devices such as a router, a switch, and a server, for example. The NE2 has an SNMP agent function. For example, when a value exceeding a preset threshold value or a specific signal is detected, an alarm is notified by transmitting a Trap notification to the network monitoring device 3. To do. The Trap notification includes, for example, information related to an alarm such as an alarm name, an occurrence date and time, and an importance level.

  The network monitoring device 3 monitors the network NW. The network monitoring device 3 has an SNMP manager function, receives a Trap notification from each NE 2, and causes the operator terminal 4 to display information related to an alarm stored in the received Trap notification. As a result, the operator can confirm an abnormality of the network NW such as “disconnection of active system signal” and “disconnection of standby system signal”. In addition, the network monitoring device 3 displays a ratio (necessity of confirmation) that the operator needs to confirm each alarm together with the occurrence date and the importance. Details of the functions of the network monitoring device 3 will be described later.

  The operator terminal 4 is a terminal operated by an operator, and includes an input unit and a display unit (not shown). Information related to the alarm is displayed on the display unit of the operator terminal 4 by the network monitoring device 3, and the operator refers to the displayed information and responds to the alarm.

  A detailed configuration of the network monitoring device 3 will be described with reference to FIG. FIG. 6 is a functional configuration diagram of the network monitoring device 3 according to the present embodiment. The network monitoring device 3 includes a storage unit 10, a processing unit 20, and a communication unit 30.

  The storage unit 10 includes a storage medium such as a random access memory (RAM), a read only memory (ROM), a hard disk drive (HDD), and a flash memory. When the network monitoring device 3 is realized by program execution processing, the storage unit 10 stores a network monitoring program for realizing the function of the network monitoring device 3. The processing unit 20 is realized by a program execution process by a CPU (Central Processing Unit) included in the network monitoring device 3, a dedicated circuit, or the like. The communication unit 30 is, for example, a communication module.

  The network monitoring device 3 according to the present embodiment can be realized by a program for executing the processing as described above, and the program is stored in a computer-readable recording medium (CD-ROM or the like) and provided. Is possible. It is also possible to provide the program through a network such as the Internet.

The storage unit 10 includes an NE information DB 11, a policy DB 12, and an alarm information DB 13.
The NE information DB 11 stores minimum information (for example, an IP address and a device name) necessary for establishing a connection to the NE 2. The NE information DB 11 is created in advance before monitoring the network NW, and is updated when the configuration of the network NW is changed.

  The policy DB 12 stores information about policies. The policy DB 12 is created in advance before monitoring the network NW. The configuration of the policy DB 12 is not particularly limited, and can be various configurations. Here, the policy DB 12 will be described as being composed of the state definition table 12a and the combination-specific ratio table 12b. However, for example, the policy DB 12 may be composed of one table, or may be normalized and further subdivided. May be.

A data configuration example of the state definition table 12a is shown in FIG. The state definition table 12a includes state information, group information, and correlation information between alarms.
The state information is information indicating the state of the network NW. The state here assumes a situation in which an alarm is notified from the NE 2 when an abnormality occurs in the NE 2 constituting the network NW, and the operator has to take some action for the notified alarm. For example, “Status ABC” assumes that three alarms A, B, and C are notified and the operator confirms Alarm A, and “Status BAC” indicates that three alarms A, B, and C are It is assumed that the operator is notified and the operator confirms the alarm B.

  The group information is information indicating a group indicating a set of states. “Group 1-A” is a collection of combinations of alarm A and a correlation alarm that is correlated with alarm A, with alarm A notified from NE 2 of # 1 as a confirmation target alarm. “Group 1-B” is a combination of alarm B and a correlation alarm correlated with alarm B, with alarm B notified from NE2 of # 1 as a confirmation target alarm. . “Group 1-A” and “Group 1-B” are other groups.

  The correlation information between alarms is composed of a combination of information for identifying an alarm (for example, an alarm name) and information for identifying a part from which the alarm is issued (for example, a part name). The part is preferably a set of the device (NE2) and the interface number, etc., but here, in order to simplify the description, it is a unit. The name of the confirmation target alarm is stored in the first alarm name, and the name of the correlation alarm correlated with the confirmation target alarm is stored in the second alarm name and the third alarm name. For example, in the “status ABC”, the alarm A notified from the NE2 of # 1 is a confirmation target alarm, and the alarms B and C notified from the NE2 of # 1 are correlation alarms for the alarm A. In the “state BAC”, the alarm B notified from the NE2 of # 1 is a confirmation target alarm, and the alarms A and C notified from the NE2 of # 1 are correlation alarms for the alarm B.

A data configuration example of the combination ratio table 12b is shown in FIG. The combination-specific ratio table 12b includes state information, an in-group ratio, a confirmation necessity degree, and a confirmation unnecessary degree.
The state information is the same as that described in the state definition table 12a, and is information indicating the state of the network NW.
The in-group ratio is information indicating the ratio of each state in the group. For example, “state A”, “state AB”, and “state ABC” indicate that the ratio is “1/3” in “group 1-A”. That is, as a result, the ratios to “state A”, “state AB”, and “state ABC” are all “1/3” and the same.

The degree of necessity of confirmation is information indicating a ratio at which the operator needs to confirm the confirmation target alarm. For example, in each of the states “state A”, “state AB”, and “state ABC” (the ratio of the states is “1/3”), the alarm A that is the confirmation target alarm is set at a ratio of “9/30”. Indicates that confirmation is required.
The confirmation unnecessary degree is information indicating a ratio that the operator does not need to confirm the confirmation target alarm. For example, in each of the states “state A”, “state AB”, and “state ABC” (the ratio of the states is “1/3”), the alarm A that is the confirmation target alarm is set at the ratio of “1/30”. Indicates that there is no need to check.

  The alarm information DB 13 (see FIG. 6) stores alarm information notified by the NE 2 (for example, importance, occurrence date / time, alarm name, alarm issue source part, etc.). The alarm information DB 13 is updated when an alarm is notified from NE2.

Next, the configuration of the processing unit 20 will be described with reference to FIG. The processing unit 20 includes a policy definition unit 21, an SNMP manager unit 22, a confirmation necessity calculation unit 23, and an HMI (Human-Machine Interface) unit 24. Here, only the outline of the processing will be described, and the details will be described in the operation.
The policy definition unit 21 supports the creation of the policy DB 12 by the operator. The SNMP manager unit 22 receives the Trap notification from each NE 2 and stores information related to the alarm stored in the received Trap notification in the alarm information DB 13. The confirmation necessity calculator 23 calculates the confirmation necessity. The HMI unit 24 provides a user interface to the operator terminal 4 and transmits information related to the calculated alarm to the operator terminal 4. In addition, the operator receives input of information related to an alarm via the operator terminal 4.

Specific processing of the confirmation necessity calculation unit 23 is shown in FIG. The process shown in FIG. 9 is started when a new alarm is notified from NE2. First, the confirmation necessity calculation unit 23 calculates an expected value (confirmation necessity) that the operator needs to confirm for the newly notified alarm (step U1). Specifically, the confirmation necessity degree calculation unit 23 refers to the first alarm name in the state definition table 12a using the newly notified alarm identification information (for example, alarm name) as a key, and determines the notified alarm. Get the corresponding state from the state information. For example, when the alarm B is newly notified, the state B, the state BA, the state BAC, and the state BC are acquired.
Then, the confirmation necessity degree calculation unit 23 refers to the state information of the combination-specific ratio table 12b using the acquired state as a key, and divides the corresponding confirmation necessity degree by the in-group ratio, thereby obtaining an expected value (confirmation necessity degree). ). For example, when state B, state BA, state BAC, and state BC are acquired, “((9/60) + (1/60) + (1/60) + (9/20) / (1/6) + (1/6) + (1/6) + (1/2)) = (38/60) / (6/6) = 63% ”is calculated as the alarm B confirmation necessity level.

  Subsequently, the confirmation necessity calculation unit 23 determines whether or not there is an alarm correlated with the newly notified alarm among the alarms whose expected value (confirmation necessity) has already been calculated (step U2). . Specifically, the first alarm name in the state definition table 12a is referred to using the identification information (for example, alarm name) of the alarm whose expected value (confirmation necessity) has already been calculated as a key, and the newly notified alarm With reference to the identification information (for example, alarm name), the second alarm name and the third alarm name in the state definition table 12a are referred to and it is determined whether or not there is a state satisfying these conditions. If a correlated alarm exists (“Yes” in step U2), the process proceeds to step U3. On the other hand, if a correlated alarm does not exist (“No” in step U2), the process ends. For example, assuming that the alarm A is newly notified in the state where the alarm B that has already been calculated with the expected value of “63%” exists, the state BA and the state BAC satisfy the condition.

  When there is a correlated alarm (“Yes” in step U2), the confirmation necessity calculator 23 recalculates the expected value (confirmation necessity) that the operator needs to confirm for the correlated alarm (step U3). ). Specifically, the confirmation necessity calculation unit 23 refers to the state information of the combination-specific ratio table 12b using the state determined to satisfy the condition as a key, and divides the corresponding confirmation necessity by the in-group ratio. Then recalculate the expected value (necessity of confirmation). For example, when it is determined that the state BA and the state BAC satisfy the condition, “((1/60) + (1/60) / (1/6) + (1/6)) = (2/60) / (2/6) = 10% "is recalculated as the necessity of confirmation of alarm B after alarm A notification.

<< Operation of network monitoring apparatus according to this embodiment >>
Below, operation | movement of the network monitoring apparatus which concerns on this embodiment is demonstrated. First, with reference to FIG. 10 to FIG. 14, a premise policy will be described, and thereafter, with reference to FIG. 15 to FIG. 22, an indication of the necessity of confirmation to the operator using the described policy is displayed. The operation will be described.

<Description of policy>
The policy is determined, for example, by an experienced operator who is experienced and registered in advance in the policy DB 12 by the policy definition unit 21 (see FIG. 6). Here, as an example, it is assumed that the following five alarms may be generated for a certain part (for the sake of simplicity, the unit of apparatus).
-Alarm A: An alarm that needs to be confirmed almost certainly in order to cope with a failure. For example, LOS (major signal loss) with a Majority of Major.
Alarm B: An alarm that does not need to be confirmed if alarm A has occurred. For example, LOS with importance Minor (spare system signal loss). In the redundant configuration, alarm C is almost always accompanied.
Alarm C: An alarm that is merely information and does not need to be confirmed if a related alarm has occurred. For example, SW-WORK (path switching) whose importance is Info. Related alarms are alarm A, alarm B, and alarm D.
Alarm D: Alarm A, Alarm B, and Alarm E are generated independently. Confirmation priority is higher than alarm A. For example, EQP (equipment failure) with an importance of Major.
Alarm E: The alarm A, the alarm B, the alarm C, and the alarm D are generated independently. The priority of confirmation is lower than alarm D, and the priority of confirmation is higher than alarm A. For example, EQP (equipment failure) with an importance of Major.

(Policy when the alarm to be confirmed is alarm A)
Possible states when the alarm A occurs are “state A”, “state AB”, and “state ABC”.
-State A: As a result, only alarm A occurs.
State AB: State where only alarm A and alarm B occur as a result.
-State ABC: As a result, only alarm A, alarm B, and alarm C are generated.

  Further, the breakdown of the ratio P (JA) of “state A”, the ratio P (JAB) of “state AB”, and the ratio P (JABC) of “state ABC” is defined as shown in FIG. Here, alarm A is defined as “alarm that needs to be confirmed almost certainly in order to deal with a failure”, and alarm A should be confirmed almost certainly in any of state A, state AB, and state ABC. Therefore, no weight is given to a specific state, and “P (JA) = P (JAB) = P (JABC) = 1/3” is set. Also, in any state, the level of confirmation that the operator needs to confirm alarm A is “P (JAO) / P (JA) = P (JABO) / P (JAB) = P (JABCO) / P (JABC) = “90%” as shown in (9/30) / (1/3) ”.

(Policy when the alarm to be confirmed is alarm B)
Possible states when the alarm B is generated are four states of “state B”, “state BA”, “state BAC”, and “state BC”.
-State B: As a result, only alarm B occurs.
State BA: State where only alarm B and alarm A occur as a result.
State BAC: A state in which only alarm B, alarm A, and alarm C occur as a result.
-State BC: As a result, only alarm B and alarm C occur.

  FIG. 11 shows a breakdown of the ratio P (JB) of “state B”, the ratio P (JBA) of “state BA”, the ratio P (JBAC) of “state BAC”, and the ratio P (JBC) of “state BC”. Define as follows. Here, the alarm B is defined as “almost always accompanied by the alarm C in the case of a redundant configuration”, and since the state BC is often obtained, “P (JBC) = 1/2” is set. Also, alarm B is defined as “alarm that does not need to be confirmed if alarm A has occurred”, and the degree of confirmation that the operator needs to confirm alarm B when there is no alarm A is “P ( (JBO) / P (JB) = (9/60) / (1/6), P (JBCO) / P (JBC) = (9/20) / (1/2)) ” " On the other hand, when there is an alarm A, the level of confirmation that the operator needs to confirm alarm B is “P (JBAO) / P (JBA) = (1/60) / (1/6), P (JBACO) As shown by “/ P (JBAC) = (1/60) / (1/6)”, “10%” is set.

(Policy when the alarm to be confirmed is alarm C)
The possible states when the alarm C is generated are six states of “state C”, “state CB”, “state CAB”, “state CD”, “state CBD”, and “state CABD”.
-State C: As a result, only alarm C occurs.
-State CB: As a result, only alarm C and alarm B are generated.
State CAB: A state in which only alarm C, alarm A, and alarm B are generated as a result.
State CD: A state in which only alarm C and alarm D are generated as a result.
-State CBD: As a result, only alarm C, alarm B, and alarm D are generated.
State CABD: A state in which only alarm C, alarm A, alarm B, and alarm D are generated as a result.

  Further, the ratio P (JC) of the “state C”, which is the six states, the ratio P (JCB) of the “state CB”, the ratio P (JCAB) of the “state CAB”, and the ratio P (JCD) of the “state CD” , The breakdown of the ratio P (JCBD) of the “state CBD” and the ratio P (JCABD) of the “state CABD” is defined as shown in FIG. Here, the alarm C is defined as “alarm that is just information and does not need to be confirmed if a related alarm has occurred”. When the alarm C has occurred first, the alarm C should be confirmed. The ratio of P (JC) is increased. In addition, when there is any one of alarm A, alarm B and alarm D, the confirmation necessity degree that the operator needs to confirm alarm C is expressed as “P (JCBO) / P (JCB) = P (JCABO) / P (JCAB ) = P (JCDO) / P (JCD) = P (JCBDO) / P (JCBD) = P (JCABDO) / P (JCABD) = (1/120) / (1/12) ” Discount ".

(Policy when the alarm to be confirmed is alarm D)
Possible states when the alarm D is generated are two states of “state D” and “state DC”.
State D: A state in which only alarm D occurs as a result.
State DC: A state in which only alarm D and alarm C occur as a result.
Further, the breakdown of the ratio P (JD) of “state D” and the ratio P (JDC) of “state DC” is defined as shown in FIG. Here, the alarm D is defined as “the alarm A, the alarm B, and the alarm E are generated independently. The confirmation priority is higher than the alarm A”. Since we want to make it higher than the priority of confirmation of alarm A, the ratio in “P (JD), P (JDC) = 1/2” is set to “P (JDO), P (JDCO) = 99/200”.

(Policy when the alarm to be confirmed is alarm E)
A possible state when the alarm E is generated is defined as one state of “state E”.
-State E: As a result, only the alarm E occurs.
Further, the breakdown of the ratio P (JE) of “state E” is defined as shown in FIG. Here, the alarm E is generated independently of the alarm A, alarm B, alarm C, and alarm D. The confirmation priority is lower than the alarm D, and the confirmation priority is higher than the alarm A. Since alarm E has no correlation with any other alarms, we want to make alarm E confirmation priority lower than alarm D confirmation priority and higher than alarm A confirmation priority. The ratio in “P (JE) = 1” is “P (JEO) = 95/100”.

<Operation of displaying the necessity of confirmation to the operator>
With reference to FIG. 15, the operation of displaying the degree of necessity for confirmation to the operator will be described. First, it is assumed that alarm C is generated at NE2 of # 1. Then, the NE 2 of # 1 transmits a trap notification indicating the alarm C to the network monitoring device 3 (step S11). The confirmation necessity calculation unit 23 of the network monitoring device 3 that has received the trap notification calculates the confirmation necessity of the alarm C (step S12). Specifically, since it is unknown which state will be in the future at this time, the confirmation necessity degree calculation unit 23 encloses an expected value that the operator needs to confirm the alarm C with a thick line in FIG. Calculated as `` (P (JCO) + P (JCBO) + P (JCABO) + P (JCDO) + P (JCBDO) + P (JCABDO)) / P (C) = 74/120 = 62% '' .

  Subsequently, the HMI unit 24 of the network monitoring device 3 transmits information on the calculated degree of necessity for checking the alarm C to the operator terminal 4 (step S13). Then, the operator terminal 4 displays a screen (see FIG. 22A) including information on the degree of necessity for confirming the alarm C (step S14). The operator can confirm and respond to the alarm C by paying attention to the alarm C on this screen, but here, it is assumed that the operator has not immediately confirmed and responded to the alarm C (step T1). .

  Next, it is assumed that alarm B is generated at NE2 of # 1. Then, the NE 2 of # 1 transmits a trap notification indicating the alarm B to the network monitoring device 3 (step S21). The confirmation necessity calculation unit 23 of the network monitoring device 3 that has received the trap notification calculates the confirmation necessity of the alarm C and the alarm B (step S22).

  In the calculation of the necessity level of the alarm C, the condition C (P (JC)) and the state CD (P (JCD)) cannot be obtained because the alarm B is generated. The expected value that the operator needs to confirm C is indicated by the area “(P (JCBO) + P (JCABO) + P (JCBDO) + P (JCABDO)) / (P (JCB)) surrounded by a thick line in FIG. + P (JCAB) + P (JCBD) + P (JCABD)) = (4/120) / (4/12) = 1/10 = 10% ”. That is, when the alarm B occurs, the expected value that the operator needs to confirm the alarm C changes from “62%” to “10%”.

  In addition, since the alarm C has already occurred in the calculation of the necessity level of the alarm B, the state B (P (JB)) and the state BA (P (JBA)) cannot be taken. 23, an expected value that the operator needs to confirm alarm B is displayed in the area “(P (JBACO) + P (JBCO)) / (P (JBAC) + P (JBC)) surrounded by a thick line in FIG. = (28/60) / (4/6) = 28/40 = 70% ".

  Subsequently, the HMI unit 24 of the network monitoring device 3 transmits information on the calculated necessity of confirmation of the alarms B and C to the operator terminal 4 (step S23). Then, the operator terminal 4 displays a screen (see FIG. 22B) including information on the necessity of confirmation of the alarms B and C after the alarm B is generated (step S24). Here, the confirmation necessity of the alarm B is higher than the confirmation necessity of the alarm C. Therefore, the operator can check and respond to the alarm B by paying attention to the alarm B on this screen, but here, the operator has not confirmed and responded to the alarm B immediately ( Step T2).

  Next, it is assumed that alarm A occurs at NE2 of # 1. Then, the NE 2 of # 1 transmits a trap notification indicating the alarm A to the network monitoring device 3 (step S31). The confirmation necessity calculator 23 of the network monitoring device 3 that has received the trap notification calculates the confirmation necessity of the alarms C, B, and A (step S32).

  In the calculation of the necessity of confirmation of alarm C, the occurrence of alarm A causes state CB (P (JCB)) and state CDB (in addition to state C (P (JC)) and state CD (P (JCD)). P (JCBD)) cannot be taken, so the confirmation necessity calculation unit 23 sets the expected value that the operator needs to confirm the alarm C to the area “(P (JCABO) + P (JCABDO)) / (P (JCAB) + P (JCABD)) = (2/120) / (2/12) = 1/10 = 10% ”. That is, even if the alarm A occurs, the expected value that the operator needs to confirm the alarm C remains “10%”.

  In addition, in the calculation of the necessity of confirmation of alarm B, state BC (P (JBC)) is taken in addition to state B (P (JB)) and state BA (P (JBA)) because alarm A occurs. Since it is not obtained, the confirmation necessity degree calculation unit 23 calculates the expected value that the operator needs to confirm the alarm B to the area “P (JBACO) / P (JBAC) = (1/60) surrounded by a thick line in FIG. ) / (1/6) = 1/10 = 10% ". In other words, when alarm A occurs, the expected value that the operator needs to confirm alarm B changes from “70%” to “10%”.

  In the calculation of the necessity of confirmation of alarm A, since alarms B and C have already occurred, state A (P (JA)) and state AB (P (JAB)) cannot be taken. The calculation unit 23 calculates the expected value that the operator needs to confirm the alarm A to the area “P (JABCO) / P (JABC) = (9/30) / (1/3)” surrounded by the thick line in FIG. = 9/10 = 90% ".

  Subsequently, the HMI unit 24 of the network monitoring device 3 transmits information on the calculated necessity of confirmation of the alarms A, B, and C to the operator terminal 4 (step S33). Then, the operator terminal 4 displays a screen (see FIG. 22C) including information on the necessity of confirmation of the alarms A, B, and C after the alarm A is generated (step S34). Here, the necessity for confirmation of alarm A is higher than the necessity for confirmation of alarms B and C. Therefore, the operator can check and respond to the alarm A by paying attention to the alarm A on this screen, but here, it is assumed that the alarm A is not immediately confirmed and responded ( Step T3).

  Next, it is assumed that alarms D and E occur at NE2 # 1. Then, the NE 2 of # 1 transmits a trap notification indicating the alarms D and E to the network monitoring device 3 (step S41). The confirmation necessity calculation unit 23 of the network monitoring device 3 that has received the trap notification calculates the confirmation necessity of the alarms C, B, A and D, E in the same manner (step S42). Since alarms A and B are not correlated with alarms D and E, even if alarms D and E occur, calculation of the necessity of confirmation is not performed, and calculation of the necessity of confirmation is performed only for alarms C, D, and E. I do. As a result, the expected values that the operator needs to check for alarms C, B, A remain “10%”, “10%”, and “90%”. Further, the expected values that the operator needs to confirm the alarms D and E are “99%” and “95%”, respectively.

  Subsequently, the HMI unit 24 of the network monitoring device 3 transmits information on the calculated necessity of confirmation of alarms A, B, C, D, and E to the operator terminal 4 (step S43). Then, the operator terminal 4 displays a screen (see FIG. 22D) including information on the necessity of confirmation of the alarms A, B, C, D and E after the alarms D and E are generated (step S44). . Here, the confirmation necessity of the alarm D is higher than the confirmation necessity of the alarms A, B, C, E. Therefore, the operator pays attention to the alarm D on this screen and confirms and responds to the alarm D (step T4).

  Next, the operator confirms and responds to alarm E, which requires a higher degree of confirmation than the degree of confirmation of alarms A, B, and C (step T5). The alarm A, which has a higher degree of necessity for confirmation, is confirmed and dealt with (step T6). Since alarms B and C are correlated with alarm A, confirmation and execution of alarms B and C can be omitted by confirming and responding to alarm A.

  As described above, the network monitoring device 3 according to the embodiment uses the policy DB 12 registered in advance every time an alarm is generated, and is correlated with the degree of necessity for confirming the notified alarm and the notified alarm. Calculate the level of alarm confirmation required. For this reason, the operator can preferentially confirm important ones from a plurality of alarms by outputting the calculated degree of confirmation to the operator.

  In addition, the network monitoring device 3 according to the embodiment, for example, between alarms that are not directly correlated (for example, between alarms A and D or between alarms A and E), for example, more important alarms (for example, , Alarms D and E) can be made more necessary for confirmation.

[Modification]
As mentioned above, although embodiment of this invention was described, this invention is not limited to this, It can implement in the range which does not change the meaning of a claim. The modification of embodiment is shown below.

  In the present embodiment, SNMP is assumed, but the present invention is not limited to this. For example, the network monitoring device 3 can receive an alarm from the NE 2 using a protocol other than SNMP.

  Further, in the present embodiment, it is assumed that an alarm is notified from the NE 2 when an abnormality occurs in the NE 2 configuring the network NW, and the number of alarms increases. However, the present invention can also be applied to the case where the number of alarms is reduced by eliminating the abnormality. For example, when the alarms A, B, and C are notified and the alarm C is resolved from the state in which the confirmation necessity for each alarm is calculated, the confirmation necessity of the alarms A and B correlated with the alarm C is set. You may make it recalculate.

1 Network monitoring system 2 NE (communication equipment)
3 Network monitoring device 4 Operator terminal 10 Storage unit 11 NE information DB
12 Policy DB (policy information)
12a State definition table 12b Ratio table according to combination 13 Alarm information DB
DESCRIPTION OF SYMBOLS 20 Processing part 21 Policy definition part 22 SNMP manager part 23 Confirmation necessity calculation part 24 HMI part 30 Communication part

Claims (4)

A network monitoring device that monitors a network using an alarm notified from a communication device,
The degree of necessity of confirmation requiring confirmation of the alarm by the operator is a conditional probability based on a combination of a confirmation target alarm that is a confirmation target alarm and a correlation alarm that is correlated with the confirmation target alarm. A storage unit for storing the defined policy information;
When a new first alarm is notified from the communication device, the confirmation target alarm of the policy information is searched using the first alarm as a key, and the first alarm is obtained from a combination of alarms that can be taken in the future. A confirmation necessity calculator for calculating the confirmation necessity of
When the first alarm is notified, the confirmation necessity degree calculation unit is correlated with the first alarm and is notified before the first alarm, so that the confirmation necessity degree has already been obtained. Recalculating the degree of necessity of confirmation of the calculated second alarm by referring to the policy information using the second alarm as a key;
A network monitoring device. The policy information includes a ratio of a state in which only the confirmation target alarm is generated with respect to an entire event that the confirmation target alarm is generated and a correlation alarm that is correlated when the confirmation target alarm is generated at the same time. The ratio of the state that occurs is defined, and the ratio that indicates the necessity of confirmation of the confirmation target alarm by the operator is further defined for the defined ratio of each state.
The network monitoring apparatus according to claim 1. The ratio indicating the necessity of confirmation is the relationship with the alarm belonging to another group when the combination of the confirmation target alarm and the correlation alarm correlated with the confirmation target alarm is made into one group. Is determined according to the
The network monitoring apparatus according to claim 2. A network monitoring method of a network monitoring device for monitoring a network using an alarm notified from a communication device,
The network monitoring device
The degree of necessity of confirmation requiring confirmation of the alarm by the operator is a conditional probability based on a combination of a confirmation target alarm that is a confirmation target alarm and a correlation alarm that is correlated with the confirmation target alarm. A storage unit for storing the defined policy information;
When a new first alarm is notified from the communication device, the confirmation target alarm of the policy information is searched using the first alarm as a key, and the first alarm is obtained from a combination of alarms that can be taken in the future. Calculating the confirmation level of
When the first alarm is notified, the second alarm that has a correlation with the first alarm and that has already been calculated prior to the first alarm is already calculated. Recalculating the degree of confirmation necessity by referring to the policy information with the second alarm as a key,
A network monitoring method characterized by the above.

Images