• 专利附录
  • 专利说明
  • 权利要求
  • 类似技术
  • 同族专利
  • 引用文献
  • 法律状态
  • 优先权
    • 专利摘要:
    A computer implemented method of network monitoring and control. The method comprises identifying (400) an alert related to a monitored device of a group of monitored devices; confirming (403) that automatic actions are applicable for the monitored device; and performing (405) at least one predefined automatic action for the monitored device, the action being selected based on the identified alert.
    公开号:FI20185597A1
    申请号:FI20185597
    申请日:2018-06-29
    公开日:2019-12-30
    发明作者:Henri Karikallio
    申请人:Elisa Oyj；
    IPC主号:
    专利说明:

    AUTOMATED NETWORK MONITORING AND CONTROL
    20185597 prh 29 -06- 2018
    TECHNICAL FIELD [0001] The present application generally relates to automated network monitoring and control.
    BACKGROUND [0002] This section illustrates useful background information without admission of any technique described herein representative of the state of the art.
    [0003] A network operation center (NOC) is generally a location from which NOC personnel exercises monitoring and control over a network. NOC personnel are responsible for monitoring one or many networks for certain conditions that may require special attention to avoid degraded service. NOC personnel follow screens showing events received from network devices, ongoing incidents and general network performance. NOC personnel decide upon required actions based on information they see on the screens.
    [0004] Automation of NOC functionality of telecommunication networks has been developed in order to improve efficiency of network monitoring and control and to reduce the amount of manual work and human errors. But automation of network monitoring and control is not a straightforward task to implement.
    SUMMARY [0005] Various aspects of examples of the invention are set out in the claims.
    [0006] According to a first example aspect of the present invention, there is provided a computer implemented method of network monitoring and control. The method comprises identifying an alert related to a monitored device of a group of monitored devices;
    confirming that automatic actions are applicable for the monitored device; and performing at least one predefined automatic action for the monitored device, the action being selected based on the identified alert.
    [0007] In an embodiment, the method further comprises checking, after a predefined period of time, whether the identified alert has reappeared and
    20185597 prh 29 -06- 2018 responsively taking a further action.
    [0008] In an embodiment, the identified alert indicates degraded performance in the group of monitored devices, faulty or degraded operation in the group of monitored devices and/or a change in external conditions.
    [0009] In an embodiment, identifying the alert comprises obtaining performance data related to monitored devices, and identifying the alert based on the performance data and performance rules.
    [0010] In an embodiment, the method further comprises identifying the alert based on one or more thresholds being exceeded in the performance data.
    [0011] In an embodiment, the method further comprises identifying that a ticket associated with the monitored device exists and enriching the ticket based on the identified alert.
    [0012] In an embodiment, the method further comprises identifying that the monitored device is in a quarantine list and responsively terminating processing of the identified alert.
    [0013] In an embodiment, the method further comprises identifying that the monitored device is under maintenance or that a rollout is being performed in the monitored device and responsively terminating processing of the identified alert.
    [0014] In an embodiment, the method further comprises identifying that a monitored device specific threshold or a system specific threshold has been exceeded and responsively terminating processing of the identified alert.
    [0015] In an embodiment, the method further comprises identifying that the identified alert has reappeared and responsively generating a ticket for manual handling.
    [0016] In an embodiment, the automatic action is an action affecting operation of the monitored device.
    [0017] In an embodiment, the automatic action comprises one or more of the following: resetting the monitored device, changing value of at least one parameter in the network device, closing a port in the monitored device, opening a port in the monitored device, and automatically generating a ticket for manual action.
    [0018] According to a second example aspect of the present invention, there is provided an apparatus comprising a processor and a memory including computer program code; the memory and the computer program code configured to, with the processor, cause the apparatus to perform the method of the first aspect or any
    20185597 prh 29 -06- 2018 related embodiment.
    [0019] According to a third example aspect of the present invention, there is provided a computer program comprising computer executable program code which when executed by a processor causes an apparatus to perform the method of the first aspect or any related embodiment.
    [0020] The computer program of the third aspect may be a computer program product stored on a non-transitory memory medium.
    [0021] Different non-binding example aspects and embodiments of the present invention have been illustrated in the foregoing. The embodiments in the foregoing are used merely to explain selected aspects or steps that may be utilized in implementations of the present invention. Some embodiments may be presented only with reference to certain example aspects of the invention. It should be appreciated that corresponding embodiments may apply to other example aspects as well.
    BRIEF DESCRIPTION OF THE DRAWINGS [0022] For a more complete understanding of example embodiments of the present invention, reference is now made to the following descriptions taken in connection with the accompanying drawings in which:
    [0023] Fig. 1 shows an example scenario according to an embodiment;
    [0024] Fig. 2 shows a system according to an embodiment;
    [0025] Fig. 3 shows logical components of an example system suited for implementing certain embodiments;
    [0026] Figs. 4A-4E show flow diagrams illustrating example methods according to certain embodiments; and [0027] Fig. 5 shows an apparatus according to an embodiment.
    DETAILED DESCRIPTON OF THE DRAWINGS [0028] Example embodiments of the present invention and its potential advantages are understood by referring to Figs. 1 through 5 of the drawings. In this document, like reference signs denote like parts or steps.
    [0029] In an embodiment of the invention there is provided an automated network monitoring and control system. The developed automated solution can be employed in NOC functionality of a telecommunication network. Additionally or
    20185597 prh 29 -06- 2018 alternatively, the developed automated solution can be employed in monitoring and control of devices of a power grid or of devices of a cable or television network or some other group of monitored devices. In general, the developed automated solution can be employed for monitoring and control of any electronic devices that are communicatively connected to a network monitoring and control system implementing the automated solution. Various embodiments of the invention discussed in the following relate to monitoring of a telecommunication network, but it is to be understood that disclosed embodiments may be applied to other monitored devices, too. A monitored device in the sense of present disclosure can be any electronic device that is being monitored and/or controlled. It is to be noted that the group of monitored devices may be part of a larger system comprising also devices that are not being monitored. For example a telecommunication network may comprise a plurality of devices that are not being monitored or controlled through the present automated solution.
    [0030] As operational load and network complexity increase due to increasing number of base stations and other network devices as well as increasing amount of manual work required for maintaining quality of network, there is increasing need for automation of network monitoring and control of telecommunication networks. At the same time the need for automated monitoring increases in other application areas, too.
    [0031] Fig. 1 shows an example scenario according to an embodiment. The scenario shows a group of monitored devices 101 and an automated monitoring and control system 111. Alerts related to the monitored devices 101 are conveyed to the automated monitoring and control system 111 in phase 11. The cause for generation of an alert may be for example a fault in a monitored device such as one or more of the following: abnormal behaviour of a monitored device, hardware failure in a monitored device, exceeding a predefined threshold, synchronization problem, failure in operation of a functionality, excess load, insufficient storage capacity, insufficient processing resources, degraded performance etc. Performance of the monitored device or the whole system comprising the monitored device may be based on suitable performance indicators. The performance indicators may comprise for example counter values and/or Key Performance Indicator, KPI, values derived on the basis of one or more other performance indicators. In an example implementation, the performance indicators are observed over a predefined time
    20185597 prh 29 -06- 2018 and, if needed, an alert is generated on the basis of the observations. Additionally or alternatively, in a telecommunication network the cause for generation of an alert may be for example one or more of the following: abnormal behaviour of a base station, transmission problem in a network link, existence of an SNMP (Simple Network Management Protocol) trap, degraded throughput etc. Additionally or alternatively, the source of the alert may be an external system, such as a weather database or a traffic data source or a call data record (CDR) database.
    [0032] The automated monitoring and control system 111 analyses the alerts in 12 to automatically decide on actions to be taken. The automatically decided actions are performed on one or more monitored devices in phase 13. It is to be noted that the action is decided and performed autonomously without human interaction. Furthermore, it is to be noted that the device originating the alert may be different from the device in which the automated action is applied. Additionally or alternatively, the automatically decided action may be generation of a ticket for manual action. In this case human actions may be used for solving the issue. The shown process is continuously repeated. Additionally, if the fault causing the alert(s) is not fixed by the automatic action and/or the alert reappears, a ticket for manual action may be generated.
    [0033] Fig. 2 shows a system according to an embodiment. The system comprises a telecommunication network 110, user devices 109, cloud and service platforms 107 and Internet 108. The telecommunication network 110 serves user devices 109 connected to the telecommunication network 110. The telecommunication network 110 provides communication services to the user devices such as for example access to cloud and service platforms 107 and Internet 108 and other systems. The telecommunication network 110 may be divided into a radio access network 102 comprising base stations that provide radio interface for connecting to the telecommunication network 110, a backhaul portion 103 that connects the radio interface of the radio access network 110 to other parts of the network, IP/MPLS (Internet Protocol I Multiprotocol Label Switching) portion 104 that provides data-carrying services for both circuit switched and packet switched communications, a circuit switched core network 105 for circuit switched communications and a packet switched core network 106 for packet switched communications.
    [0034] Further the system of Fig. 2 comprises an OSS (Operations Support
    20185597 prh 29 -06- 2018
    System) 110 and an automated monitoring and control system 111. The OSS continuously collects alerts from one or more monitored devices of the telecommunication network 110. For example hardware failure in a base station of the radio access network 102 causes generation of an alert that is then conveyed to the OSS. The alerts received in the OSS are conveyed to the automated monitoring and control system 111. The automated monitoring and control system 111 analyses the alerts to automatically decide on actions that may be required. The action may be an automatic action 112 performed on one or more monitored devices of the telecommunication network, such as resetting a monitored device, changing value of at least one parameter in a monitored device, closing a port in a monitored device, or opening a port in a monitored device. Alternatively or additionally the action may be generation of an alert ticket for manual action.
    [0035] Fig. 3 shows logical components of an example system suited for implementing certain embodiments. The system is divided into a hardware supervision block 310, a performance supervision block 320, a predictive supervision block 330 and a manual actions block 340. The hardware supervision block 310 concerns collecting and analyzing 311, 312 alerts received from physical monitored devices, and automatically deciding and performing actions based on the analysis 112 and possibly generating tickets for manual actions 113. The performance supervision block 320 concerns collecting and analyzing performance data related to monitored devices 321, 322, and automatically deciding and performing actions based on the analysis 112 and possibly generating tickets for manual actions 113. The predictive supervision block 330 concerns collecting 331 data from the monitored devices, the data comprising for example alerts and/or performance data, and predicting forthcoming alerts or incidents based on collected data 332. The predicted alerts or incidents are then used for deciding and performing actions 112 and possibly for generating tickets for manual actions 113. The manual actions block 340 concerns manually performed work, such as 342: handling of tickets relating to customer complaints and 341: handling of tickets generated by the automatic process of one of the blocks 310-330. It is to be noted that data for the hardware supervision, performance supervision and predictive supervision blocks 310, 320, 330 may be collected from other external sources, too. Certain embodiments of present invention relate mainly but not exclusively to the hardware supervision block 310 and the performance supervision block 320.
    20185597 prh 29 -06- 2018 [0036] Figs. 4A-4E show flow diagrams illustrating example methods according to certain embodiments. The methods may be implemented in the automated monitoring and control system 111 of Figs. 1 and 2. The methods are implemented in a computer and do not require human interaction. It is to be noted that the methods may however provide output that may be further processed by humans. The methods of Figs. 4A-4E may be combined with each other and the order of phases conducted in each method may be changed expect where otherwise explicitly defined. Furthermore it is to be noted that performing all phases of the flow charts is not mandatory.
    [0037] Fig. 4A shows a flow diagram illustrating a method according to an embodiment of the invention. The method comprises following phases:
    [0038] Phase 400: An alert related to a monitored device is identified. The alerts may be alerts concerning faults in operation of monitored devices. The faults may concern hardware problems, unavailable services or degraded performance as discussed in connection with Fig 1. Additionally or alternatively the source of alerts may be an external source, such as weather database or traffic surveillance database. In an embodiment, phase 400 comprises filtering the alerts that are being processed to reduce the number of alerts in further processing and/or classifying the alerts to different categories.
    [0039] Phase 403: It is checked whether an automatic action can be applied to the monitored device. In general this refers to checking whether performing an automatic action would interfere with some other ongoing action or whether there is some other matter that indicates the automatic action should be avoided. More detailed embodiments relating to performing this phase are discussed in connection with Figs. 4C-4E. If it is concluded that automatic actions are not applicable, processing of the identified alert is terminated in phase 404. A report of the identified alert may be generated, though. Additionally or alternatively, a ticket for manual operations may be generated so that human intervention is possible if needed. If it is concluded that automatic actions are applicable, the process proceeds to phase 405. By checking applicability of automatic actions, one achieves that risk of automatically performing unnecessary or even harmful actions can be reduced. This is beneficial in connection with any alert, but especially alerts concerning degraded performance might cause unnecessary actions to be taken if such checking phase was not performed.
    20185597 prh 29 -06- 2018 [0040] Phase 405: An action is performed for the monitored device based on the identified alert. The action may be chosen for example based on predefined rules or predefined logic charts. It is to be noted that more than one alert related to the monitored device may have been identified and the action may be chosen on the basis of more than one identified alert. That is, there may be a certain alert pattern that leads to a certain action, while one single alert may lead to another action. It is to be noted that in this context an action may comprise a single action or more than one actions.
    [0041] Phase 406: The process waits for a predefined period of time. This may be for example 5 min, 10 min, 20 min, 30 min or an hour.
    [0042] Phase 407: It is checked whether the fault causing the alert identified in phase 402 was fixed. In an example embodiment this is implemented by checking if the identified alert reappears. If the fault was fixed, the process stops in phase 409 and a report is generated to log the action that was taken by the automatic process. If the fault was not fixed, a ticket for manual action is generated in phase 408. Alternatively or additionally, the process may return to phase 405 to repeat the action for the monitored device. Yet another alternative (not shown in Fig 4A) is to perform for the monitored device another action different from the action performed in phase 405.
    [0043] By checking whether the alert reappears and generating a ticket for manual action if necessary, one achieves that the automatic system does not continue to perform the automatic action forever, if the action is not fixing the problem.
    [0044] In an embodiment the alert that is identified in phase 400 is a cell faulty alert in a telecommunication network and the action that is performed in phase 405 is resetting the monitored device (the monitored device may be for example a base station). For example existence of one or more of the following alerts may be considered a cell faulty alert: monitored device disconnected, base station down, cell out of service, cell unavailable, and transmission interruption.
    [0045] Other embodiments comprise the following different embodiments:
    - The alert that is identified in phase 400 is an indication of no data transmission in a cell and the action that is performed in phase 405 is reactivating data transmission in the cell by resetting the monitored device.
    - The alert that is identified in phase 400 is an indication of no data
    20185597 prh 29 -06- 2018 transmission in a cell and the action that is performed in phase 405 is reactivating data transmission in the cell by deactivating and activating a GPRS (General Packet Radio Service) parameter.
    - The alert that is identified in phase 402 is an indication of a fault in VSWR (Voltage Standing Wave Ratio) antenna monitoring or a VSWR alarm and the action that is performed in phase 405 is generation of a ticket for manual action.
    - The alert that is identified in phase 402 is an indication of a power unit output voltage fault and the action that is performed in phase 405 is generation of a ticket for manual action.
    - The alert that is identified in phase 402 is an indication of a fault in the chain between a power unit and MHA (MastHead Amplifier) and the action that is performed in phase 405 is generation of a ticket for manual action.
    - The alert that is identified in phase 402 is an indication of a LAN (Local Area Network) error or a communication error and the action that is performed in phase 405 is resetting the network device.
    - The alert that is identified in phase 402 is an indication of a control plane problem and the action that is performed in phase 405 is deactivating and activating LTE (Long Term Evolution) S1 link.
    - The alert that is identified in phase 400 is an indication of exceeded threshold in Twamp (Two-Way Active Measurement Protocol) measurement and the action that is performed in phase 405 is resetting the network device.
    - The alert that is identified in phase 400 is an indication of over 20 Bad Uplink events in a day or an indication of over 20 abnormal distribution events and the action that is performed in phase 405 is locking and opening a cell. It is to be noted that instead of 20, the threshold may be some other number such as for example 10, 30 or 50.
    [0046] Fig. 4B shows a flow diagram illustrating a method according to an embodiment of the invention. The method is one example implementation of phase 400 of Fig. 4A. The method comprises following phases:
    [0047] Phase 441: Performance data concerning a predefined period of time is obtained. The predefined time may be for example 10 min, 15 min, 30 min, 1 h, 3h, 5h or a day. The performance data may comprise counter values, transmission or
    20185597 prh 29 -06- 2018 throughput rates or other performance indicators. As an example, a counter may count for example number of dropped connections. Additionally or alternatively the performance data may comprise a performance value derived on the basis of more than one counter values.
    [0048] Phase 442: The performance data is compared to performance rules or decision logic.
    [0049] Phase 443: One or more alerts are identified on the basis of the comparison phase 443.
    [0050] Fig. 4C shows a flow diagram illustrating a method according to an embodiment of the invention. The method comprises following phases:
    [0051] Phase 400: An alert related to a monitored device is identified similarly to Fig 4A.
    [0052] In phases 412, 414, 417 and 418 it is checked whether an automatic action can be applied to the monitored device.
    [0053] Phase 412: It is checked whether a ticket associated with the monitored device already exists. That is, it is checked if a problem associated with the monitored device has already been identified. If it is found out that a ticket already exists, the ticket is enriched with information about the identified alert in phase 413. Otherwise the process proceeds to phase 414.
    [0054] Phase 414: It is checked whether the monitored device is in a quarantine list. If it is found out that the monitored device is in a quarantine list, processing of the identified alert is terminated in phase 416. A report of the identified alert may be generated. Otherwise the process proceeds to phase 417. In an embodiment, a monitored device is inserted into a quarantine list whenever certain automatic action (e.g. reset) is being performed in the monitored device and the monitored device is kept on the list for a period of time that may be for example 1, 3 or 5 days or 1, 2, 4 or 7 weeks. During this time further automatic actions are prevented in the monitored device. In this way the checking phase 414 provides that the automatic action is not continuously repeated for the monitored device. The quarantine list may indicate which alert caused the quarantine and this may be taken into account when checking whether the monitored device is in the quarantine list.
    [0055] Phase 417: It is checked whether a rollout process is being performed in the monitored device. If it is found out that there is a rollout in progress, processing of the identified alert is terminated in phase 416. A report of the identified
    20185597 prh 29 -06- 2018 alert may be generated. Otherwise the process proceeds to phase 418.
    [0056] Phase 418: It is checked whether the monitored device is in maintenance. If it is found out that there is a maintenance work in progress, processing of the identified alert is terminated in phase 416. A report of the identified alert may be generated. Otherwise the process proceeds to phase 405.
    [0057] Phases 417 and 418 provide that automatic actions do not interfere with any ongoing actions being performed in the network device.
    [0058] Phase 405: An action is performed for the monitored device based on the identified alert. The action may be chosen for example based on predefined rules or predefined logic charts. It is to be noted that more than one alert related to the monitored device may have been identified and the action may be chosen on the basis of more than one identified alert. That is, there may be a certain alert pattern that leads to a certain action, while one single alert may lead to another action. It is to be noted that in this context an action may comprise a single action or more than one actions.
    [0059] In an embodiment, the process proceeds from phase 405 to phases 406-409 as disclosed in Fig. 4A.
    [0060] Fig. 4D shows a flow diagram illustrating a method according to an embodiment of the invention. The method comprises following phases:
    [0061] Phase 420: It is detected that a monitored device is in a quarantine list for example as a result of the checking in phase 414 of Fig. 4C.
    [0062] Phase 423: It is checked how many times the quarantine list has been violated and whether a threshold is being exceeded. Violation of the quarantine list refers to that the process tries to perform an automatic action for a monitored device that is listed on the quarantine list. The number of such violations is logged. The threshold may be for example 5, 10, 20 or 30 violations per monitored device. The threshold may be alert specific. That is, a different counter may be maintained for different alerts. Counter of the violations is reset when the network device is removed from the quarantine list.
    [0063] If the threshold has been exceeded, a ticket for manual action is generated in phase 408. In this way human interaction is provided for solving the reason for repeated requests for automatic actions. If the threshold has not been exceeded, processing of the alert identified for the monitored device is terminated in phase 424 and the quarantine list violation counter is incremented.
    20185597 prh 29 -06- 2018 [0064] Fig. 4E shows a flow diagram illustrating a method according to an embodiment of the invention. The method comprises following phases:
    [0065] Phase 400: An alert related to a monitored device is identified similarly to Fig 4A.
    [0066] In phases 432 and 434 it is checked whether an automatic action can be applied to the monitored device.
    [0067] Phase 432: It is checked whether a monitored device specific threshold has been exceeded. If it is found out that the threshold has been exceeded, processing of the identified alert is terminated in phase 433. A report of the identified alert may be generated. Otherwise the process proceeds to phase 434. The threshold may be for example at least 5% or 10% degradation in performance compared to previous performance values. The checking phase 434 provides that the automatic actions can be controlled on a monitored device level and for example performing ineffective actions can be reduced. Performance may be degraded from optimal, but if there has not been a significant change compared to previous values, corrective actions may not be required or may not be effective.
    [0068] Phase 434: It is checked whether a network specific or a system specific threshold has been exceeded. If it is found out that the threshold has been exceeded, processing of the identified alert is terminated in phase 433. A report of the identified alert may be generated. Otherwise the process proceeds to phase 405. The threshold may be for example maximum 50, 100 or 150 actions per day. The checking phase 434 provides that the automatic actions can be controlled on a network or system level and for example resetting all monitored devices of a system at the same time can be prevented.
    [0069] Phase 405: An action is performed for the monitored device based on the identified alert. The action may be chosen for example based on predefined rules or predefined logic charts. It is to be noted that more than one alert related to the network device may have been identified and the action may be chosen on the basis of more than one identified alert. That is, there may be a certain alert pattern that leads to a certain action, while one single alert may lead to another action. It is to be noted that in this context an action may comprise a single action or more than one actions. Network device specific or network specific counter may be increment after the automatic action has been performed.
    [0070] In an embodiment, the process proceeds from phase 405 to phases
    20185597 prh 29 -06- 2018
    406-409 as disclosed in Fig. 4A.
    [0071] Fig. 5 shows an apparatus 50 according to an embodiment. The apparatus 50 is for example a general-purpose computer or server or some other electronic data processing apparatus. The apparatus 50 can be used for implementing embodiments of the invention. That is, with suitable configuration the apparatus 50 is suited for operating for example as the network monitoring and control system 111 of foregoing disclosure.
    [0072] The general structure of the apparatus 50 comprises a processor 51, and a memory 52 coupled to the processor 51. The apparatus 50 further comprises software 53 and database 54 stored in the memory 52 and operable to be loaded into and executed in the processor 51. The software 53 may comprise one or more software modules and can be in the form of a computer program product. The database 54 may be usable for storing e.g. rules and patterns for use in data analysis. Further, the apparatus 50 comprises a communication interface 55 coupled to the processor 51.
    [0073] The processor 51 may comprise, e.g., a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a graphics processing unit, or the like. Fig. 5 shows one processor 51, but the apparatus 50 may comprise a plurality of processors.
    [0074] The memory 52 may be for example a non-volatile or a volatile memory, such as a read-only memory (ROM), a programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), a random-access memory (RAM), a flash memory, a data disk, an optical storage, a magnetic storage, a smart card, or the like. The apparatus 50 may comprise a plurality of memories. The memory 52 may be constructed as a part of the apparatus 50 or it may be inserted into a slot, port, or the like of the apparatus 50 by a user.
    [0075] The communication interface 55 may comprise communication modules that implement data transmission to and from the apparatus 50. The communication modules may comprise, e.g., a wireless or a wired interface module. The wireless interface may comprise such as a WLAN, Bluetooth, infrared (IR), radio frequency identification (RF ID), GSM/GPRS, CDMA, WCDMA, or LTE (Long Term Evolution) radio module. The wired interface may comprise such as Ethernet or universal serial bus (USB), for example. Further the apparatus 50 may comprise a user interface (not shown) for providing interaction with a user of the apparatus. The
    20185597 prh 29 -06- 2018 user interface may comprise a display and a keyboard, for example. The user interaction may be implemented through the communication interface 55, too.
    [0076] The database 54 may be certain memory area in the memory 52 or alternatively the database 54 may be a separate component or the database 54 may be located in a physically separate database server that is accessed for example through the communication unit 55. The database unit 54 may be a relational (SQL) or a non-relational (NoSQL) database.
    [0077] A skilled person appreciates that in addition to the elements shown in Fig. 5, the apparatus 50 may comprise other elements, such as microphones, displays, as well as additional circuitry such as memory chips, application-specific integrated circuits (ASIC), other processing circuitry for specific purposes and the like. Further, it is noted that only one apparatus is shown in Fig. 5, but the embodiments of the invention may equally be implemented in a cluster of shown apparatuses.
    [0078] Without in any way limiting the scope, interpretation, or application of the claims appearing below, a technical effect of one or more of the example embodiments disclosed herein is ability to automate network monitoring and control in telecommunication networks.
    [0079] Another technical effect of one or more of the example embodiments disclosed herein is that increasing number of issues in monitored devices can be solved before they are visible to end users thereby improving user experience. Another technical effect of one or more of the example embodiments disclosed herein is that complex systems with increasing traffic amount can be handled without necessarily needing additional personnel for network monitoring tasks.
    [0080] Another technical effect of one or more of the example embodiments disclosed herein is that risk of human errors may be reduced. For example in a NOC functionality it is likely that due to huge amount of alerts to be monitored, some alerts may go unnoticed by the monitoring personnel. Whereas, in the automated solution, all alerts are equally processed.
    [0081] If desired, the different functions discussed herein may be performed in a different order and/or concurrently with each other. Furthermore, if desired, one or more of the before-described functions may be optional or may be combined.
    [0082] Although various aspects of the invention are set out in the independent claims, other aspects of the invention comprise other combinations of features from the described embodiments and/or the dependent claims with the features of the independent claims, and not solely the combinations explicitly set out in the claims.
    [0083] It is also noted herein that while the foregoing describes example embodiments of the invention, these descriptions should not be viewed in a limiting sense. Rather, there are several variations and modifications, which may be made without departing from the scope of the present invention as defined in the appended claims.
    权利要求:
    Claims (15)
    [1] 20185597 prh 29 -06- 2018
    1. A computer implemented method of network monitoring and control, the method comprising identifying (400) an alert related to a monitored device of a group of monitored devices (101);
    confirming (403) that automatic actions are applicable for the monitored device; and performing (405) at least one predefined automatic action for the monitored device, the action being selected based on the identified alert.
    [2] 2. The method of claim 1, further comprising checking (406), after a predefined period of time, whether the identified alert has reappeared and responsively taking a further action.
    [3] 3. The method of claim 1 or 2, wherein the identified alert indicates degraded performance or faulty or degraded operation in the group of monitored devices (101).
    [4] 4. The method of any preceding claim, wherein the identified alert indicates a change in external conditions.
    [5] 5. The method of any preceding claim, wherein identifying the alert comprises obtaining (441) performance data related to monitored devices, and identifying (442, 443) the alert based on the performance data and performance rules.
    [6] 6. The method of claim 5, further comprising identifying the alert based on one or more thresholds being exceeded in the performance data.
    [7] 7. The method of any preceding claim, further comprising identifying (412) that a ticket associated with the monitored device exists and enriching the ticket based on the identified alert.
    20185597 prh 29 -06- 2018
    [8] 8. The method of any preceding claim, further comprising identifying (414) that the monitored device is in a quarantine list and responsively terminating processing of the identified alert.
    [9] 9. The method of any preceding claim, further comprising identifying (417, 418) that the monitored device is under maintenance or that a rollout is being performed in the monitored device and responsively terminating processing of the identified alert.
    [10] 10. The method of any preceding claim, further comprising identifying (432, 434) that a monitored device specific threshold or a system specific threshold has been exceeded and responsively terminating processing of the identified alert.
    [11] 11. The method of any one of claims 2-10, further comprising identifying that the identified alert has reappeared and responsively generating (408) a ticket for manual handling.
    [12] 12. The method of any preceding claim, wherein the automatic action is an action affecting operation of the monitored device.
    [13] 13. The method of any preceding claim, wherein the automatic action comprises one or more of the following: resetting the monitored device, changing value of at least one parameter in the network device, closing a port in the monitored device, opening a port in the monitored device, and automatically generating a ticket for manual action.
    [14] 14. An apparatus (50, 111) comprising a processor (51), and a memory (52) including computer program code; the memory and the computer program code configured to, with the processor, cause the apparatus to perform the method of any one of claims 1-13.
    [15] 15. A computer program comprising computer executable program code (53) which when executed by a processor causes an apparatus to perform the method of any one of claims 1 -13.
    类似技术:
    公开号 | 公开日 | 专利标题
    US9680722B2|2017-06-13|Method for determining a severity of a network incident
    CN104126285A|2014-10-29|Method and apparatus for rapid disaster recovery preparation in a cloud network
    CN101502144A|2009-08-05|Element management system in wireless communication network
    CN105744553B|2021-05-04|Network association analysis method and device
    US20140227992A1|2014-08-14|Method of and An Operating Support System for Providing Performance Management in a Mobile Telecommunications System
    US11252066B2|2022-02-15|Automated network monitoring and control
    CN108768710B|2021-12-24|Dynamic weight evaluation method, model and device for optical transmission network health
    CN105052076B|2020-08-25|Network element management system and network element management method based on cloud computing
    US20210226853A1|2021-07-22|Automated network monitoring and control
    US20210226840A1|2021-07-22|Automated network monitoring and control
    KR20190047809A|2019-05-09|Ict equipment management system and method there of
    US10338544B2|2019-07-02|Communication configuration analysis in process control systems
    US11196841B1|2021-12-07|Smart remote agent on an access CPE with an agile OpenWrt software architecture
    WO2021233224A1|2021-11-25|Fault processing method, apparatus, and system
    CN110365551B|2021-05-07|Network information acquisition method, device, equipment and medium
    WO2021208979A1|2021-10-21|Network fault handling method and apparatus
    CN110505715B|2021-08-06|Base station device
    US10778519B2|2020-09-15|Intelligent upgrades for network devices
    US10841821B2|2020-11-17|Node profiling based on combination of performance management | counters using machine learning techniques
    US20210357281A1|2021-11-18|Using User Equipment Data Clusters and Spatial Temporal Graphs of Abnormalities for Root Cause Analysis
    EP3836599A1|2021-06-16|Method for detecting permanent failures in mobile telecommunication networks
    Firdaus et al.2019|Sleeping Cell Analysis in LTE Network with Self-Healing Approach
    CN114221874A|2022-03-22|Traffic analysis and scheduling method and device, computer equipment and readable storage medium
    CN113537687A|2021-10-22|Internet of things equipment framework management method, system and equipment
    CN113760634A|2021-12-07|Data processing method and device
    同族专利:
    公开号 | 公开日
    US20210176151A1|2021-06-10|
    EP3815304A1|2021-05-05|
    US11252066B2|2022-02-15|
    AU2019293863A1|2020-12-10|
    FI128647B|2020-09-30|
    CA3101259A1|2020-01-02|
    WO2020002771A1|2020-01-02|
    引用文献:
    公开号 | 申请日 | 公开日 | 申请人 | 专利标题
    US6665262B1|1999-02-16|2003-12-16|Telefonaktiebolaget Lm Ericsson |Distributed fault management architecture|
    US6446123B1|1999-03-31|2002-09-03|Nortel Networks Limited|Tool for monitoring health of networks|
    US20020194319A1|2001-06-13|2002-12-19|Ritche Scott D.|Automated operations and service monitoring system for distributed computer networks|
    US7120633B1|2002-07-31|2006-10-10|Cingular Wireless Ii, Llc|Method and system for automated handling of alarms from a fault management system for a telecommunications network|
    US20040215765A1|2003-04-25|2004-10-28|Asher Michael L.|Method for integrated infrastructure and facility management|
    US8812649B2|2005-04-14|2014-08-19|Verizon Patent And Licensing Inc.|Method and system for processing fault alarms and trouble tickets in a managed network services system|
    US8676945B2|2005-04-14|2014-03-18|Verizon Business Global Llc|Method and system for processing fault alarms and maintenance events in a managed network services system|
    CN101801015B|2009-02-06|2014-03-12|中兴通讯股份有限公司|Method and device for processing out of service faults of cell|
    US8095075B2|2009-03-10|2012-01-10|Telefonaktiebolaget Lm Ericsson |System and method of detecting a sleeping cell and remedying detected conditions in a telecommunication network|
    US8823536B2|2010-04-21|2014-09-02|Microsoft Corporation|Automated recovery and escalation in complex distributed applications|
    EP2617158A1|2010-09-17|2013-07-24|Deutsche Telekom AG|Method for improved handling of incidents in a network monitoring system|
    US9009307B2|2013-01-08|2015-04-14|Bank Of America Corporation|Automated alert management|
    FI125573B|2013-08-27|2015-11-30|Elisa Oyj|Adaptive management of services that take into account the disruptive effect|
    SG10201407299RA|2013-11-08|2015-06-29|Accenture Global Services Ltd|Network node failure predictive system|
    US20160035246A1|2014-07-31|2016-02-04|Peter M. Curtis|Facility operations management using augmented reality|
    EP3041283B1|2014-12-30|2019-05-29|Comptel Corporation|Prediction of failures in cellular radio access networks and scheduling of preemptive maintenance|
    US9571334B2|2015-01-26|2017-02-14|CENX, Inc.|Systems and methods for correlating alarms in a network|
    US9585034B1|2015-06-25|2017-02-28|Sprint Communications Company L.P.|Automated response system deactivation during large scale issues and managing wireless network operations|
    US10397043B2|2015-07-15|2019-08-27|TUPL, Inc.|Wireless carrier network performance analysis and troubleshooting|
    US10193742B2|2015-10-29|2019-01-29|Kodacloud Inc.|Selecting a corrective action for a network connection problem based on historical data|
    US10708795B2|2016-06-07|2020-07-07|TUPL, Inc.|Artificial intelligence-based network advisor|
    US20180091369A1|2016-09-28|2018-03-29|Intel Corporation|Techniques to detect anomalies in software defined networking environments|
    US10733072B2|2017-11-03|2020-08-04|Nutanix, Inc.|Computing system monitoring|
    US20190392328A1|2018-06-25|2019-12-26|International Business Machines Corporation|Cognitive computing systems and services utilizing internet of things environment|
    FI128647B|2018-06-29|2020-09-30|Elisa Oyj|Automated network monitoring and control|FI128647B|2018-06-29|2020-09-30|Elisa Oyj|Automated network monitoring and control|
    法律状态:
    2020-09-30| FG| Patent granted|Ref document number: 128647 Country of ref document: FI Kind code of ref document: B |
    优先权:
    申请号 | 申请日 | 专利标题
    FI20185597A|FI128647B|2018-06-29|2018-06-29|Automated network monitoring and control|FI20185597A| FI128647B|2018-06-29|2018-06-29|Automated network monitoring and control|
    US15/734,423| US11252066B2|2018-06-29|2019-06-26|Automated network monitoring and control|
    AU2019293863A| AU2019293863A1|2018-06-29|2019-06-26|Automated network monitoring and control|
    CA3101259A| CA3101259A1|2018-06-29|2019-06-26|Automated network monitoring and control|
    PCT/FI2019/050498| WO2020002771A1|2018-06-29|2019-06-26|Automated network monitoring and control|
    EP19740038.5A| EP3815304A1|2018-06-29|2019-06-26|Automated network monitoring and control|
    [返回顶部]