Systems and methods for correlating alarms in a network

Abstract

Networking equipment often generates alarms that operators must sift through to troubleshoot the network. The heterogeneous nature of the equipment and their associated alarms renders this task difficult. Furthermore, a network fault may trigger collateral alarms in adjacent equipment, sometimes obscuring the root cause of the fault. The present disclosure includes a system for correlating multiple successive alarms to discriminate between alarms from a faulty network object and alarms from a properly functioning network object that is dependent on the faulty network object.

What is claimed is: 
     
         1 . A network fault analysis system, comprising:
 an alarm analyzer configured to:   receive a plurality of alarms from a plurality of network objects; and   classify, based at least in part on a network topology, each alarm of the plurality of received alarms as either originating from a faulty network object or originating from a properly functioning network object dependent on a faulty network object.   
     
     
         2 . The network fault system of  claim 1 , further comprising:
 a topology builder coupled to the alarm analyzer and configured to construct a network alarm topology.   
     
     
         3 . The network fault system of  claim 2 , wherein the alarm analyzer is further configured to propagate changes in an alarm state through a graph based at least in part on a the network alarm topology. 
     
     
         4 . The network fault system of  claim 1 , further comprising:
 an alarm collector coupled to the alarm analyzer and configured to collect the plurality of alarms from the plurality of network objects.   
     
     
         5 . The network fault system of  claim 1 , further comprising:
 a configuration application configured to determine dependencies between the plurality of network objects.   
     
     
         6 . The network fault system of  claim 4 , further comprising:
 a database comprising information relating to a connective layout of the plurality of network objects.   
     
     
         7 . The network fault system of  claim 5 , further comprising:
 a topology builder, coupled to the database and the configuration application, configured to construct a network alarm topology based at least in part on the dependences between the plurality of network objects and the connective layout of the plurality of network objects.   
     
     
         8 . The network fault system of  claim 1 , wherein the alarm analyzer is further configured to propagate changes in alarm state through a graph based at least in part on a temporal relationship between alarms. 
     
     
         9 . A computer-implemented method of determining a root source of failure in a network, comprising:
 receiving a network alarm topology;   receiving a first alarm from a first network object in the network; and   updating, based at least in part on the first alarm, an alarm state of a first node in the network alarm topology, the first node corresponding to the first network object.   
     
     
         10 . The computer-implemented method of  claim 9 , further comprising:
 receiving a second alarm from a second network object in the network;   updating, based at least in part on the second alarm, an alarm state of a second node in the network alarm topology, the second node corresponding to the second network object; and   updating, based at least in part on an operation performed on the updated alarm state of the first node and the updated alarm state of the second node, an alarm state of a third node in the network alarm topology.   
     
     
         11 . The computer-implemented method of  claim 10 , further comprising:
 updating, based at least in part on the alarm state of the third node, an alarm state of a fourth node in the network alarm topology.   
     
     
         12 . The computer-implemented method of  claim 10 ,
 wherein the updated alarm state of the second node is a fail state, and the updated alarm state of the third node represents that the second network object is not a source of failure.   
     
     
         13 . The computer-implemented method of  claim 10 ,
 wherein the operation is a function of a temporal relationship between the first alarm and the second alarm.   
     
     
         14 . A computer-implemented method of building a network alarm topology, comprising:
 constructing a plurality of alarm nodes corresponding to a plurality of alarm-generating network objects;   associating an alarm state of each of the alarm nodes with an alarm received from an alarm-generating network object associated with the alarm node;   constructing a plurality of aggregating nodes, each aggregating node performing an operation on the alarm states of two or more subordinate nodes to form an output; and   associating an alarm state of each aggregating node with the output of the corresponding operation.   
     
     
         15 . The computer-implemented method of  claim 14 , wherein the subordinate nodes corresponding to a first aggregating node of the plurality of aggregating nodes are alarm nodes. 
     
     
         16 . The computer-implemented method of  claim 14 , wherein the subordinate nodes corresponding to a first aggregating node of the plurality of aggregating nodes are other aggregating nodes of the plurality of aggregating nodes. 
     
     
         17 . The computer-implemented method of  claim 14 , wherein the plurality of aggregating nodes are constructed by configurable rules. 
     
     
         18 . The computer-implemented method of  claim 14 , wherein the operation is a function of a temporal relation between the alarm states of the two or more subordinate nodes. 
     
     
         19 . The computer-implemented method of  claim 14 , further comprising graphically displaying the topology, alarm history, and alarm states. 
     
     
         20 . The computer-implemented method of  claim 14 , wherein the alarm state is associated with the received alarm based at least in part on configurable associations between alarms and network objects.