US-20260128939-A1 - SYSTEMS AND METHODS FOR HANDLING ALARM FLAPPING CONDITIONS

Abstract

Aspects of the subject disclosure may include, for example, querying incoming alarms received at an element management system (EMS), based on a response to the query, determining patterns of the incoming alarms, determining that the patterns of the incoming alarms match with a flapping condition, upon the determination of the flapping condition, generating a synthetic alarm including information as to the incoming alarms and the flapping condition, and forwarding the synthetic alarm to an operations support system (OSS). Other embodiments are disclosed.

Inventors

• James Oliver
• Kent Tschopp
• Roger Armitage
• Keith Hearn
• IBRAHIM ABE ABUSEEINI
• Hasan JAFRI

Assignees

• AT&T INTELLECTUAL PROPERTY I, L.P.
• AT&T MOBILITY II LLC

Dates

Publication Date

20260507

Application Date

20241104

Claims (20)

1. 1 . A device, comprising: a processing system including a processor; and a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations, the operations comprising: detecting that alarms have been received at an element management system (EMS); determining that the alarms are associated with a flapping condition; suppressing the alarms associated with the flapping condition; generating a synthetic alarm including flapping condition information; and injecting the synthetic alarm to an operations support system (OSS).
2. 2 . The device of claim 1 , wherein the suppressing the alarms further comprise not forwarding the received alarms to the OSS.
3. 3 . The device of claim 1 , wherein the detecting further comprises: sending a periodic query to an alarm database in the EMS; and receiving a response to the periodic query including information about the received alarms.
4. 4 . The device of claim 1 , wherein the determining further comprises determining that the received alarms meet flapping condition criteria, wherein the flapping condition criteria include that: each alarm is raised and cleared in a first predetermined time period; and the raising and clearing of each alarm is repeated more than a second predetermined times within a third predetermined time period.
5. 5 . The device of claim 4 , wherein the flapping condition criteria further include that any of the alarms are raised from a same network element.
6. 6 . The device of claim 1 , wherein the generating the synthetic alarm further comprises generating the synthetic alarm including same information found in the received alarms and the flapping condition information, wherein the flapping condition information includes a flapping condition counter.
7. 7 . The device of claim 1 , wherein the operations further comprise: detecting that a previously tracked flapping condition is no longer occurring by sending a next query to the EMS; upon the detection of no previously tracked flapping condition, generating a synthetic clearing alarm with same key information of the received alarms; and forwarding the synthetic clearing alarm to the OSS.
8. 8 . The device of claim 7 , wherein the operations further comprise: maintaining a log that tracks an occurrence of the flapping condition; upon the detection of no previously tracked flapping condition, removing, from the log, the previously tracked flapping condition; detecting a subsequent flapping condition involving a same network element and same alarms of the previously tracked flapping condition; and adding, to the log, the subsequent flapping condition as a new occurrence of flapping condition.
9. 9 . A non-transitory machine-readable medium, comprising executable instructions that, when executed by a processing system including a processor, facilitate performance of operations, the operations comprising: storing a flapping condition configuration; periodically querying an alarm database included in an element management system (EMS); based on a response to the query, determining that original alarms are detected and the original alarms are associated with a flapping condition defined in the stored flapping condition configuration; generating a synthetic alarm including original alarms information and flapping condition information; and forwarding the synthetic alarm to an operations support system (OSS).
10. 10 . The non-transitory machine-readable medium of claim 9 , wherein the operations further comprise: raising a single synthetic alarm for each flapping condition such that the OSS will issue a ticket in response to the single synthetic alarm.
11. 11 . The non-transitory machine-readable medium of claim 9 , wherein the operations further comprise: tracking the synthetic alarm; determining that the synthetic alarm is cleared in a subsequent query and response; and forwarding a synthetic clearing alarm to the OSS.
12. 12 . The non-transitory machine-readable medium of claim 9 , wherein the operations further comprise: tracking the flapping condition associated with the original alarms; determining that the flapping condition is cleared in a subsequent period and a same flapping condition is returned in a later period than the subsequent period; generating a new synthetic alarm corresponding to the returned same flapping condition; and forwarding the new synthetic alarm to the OSS.
13. 13 . The non-transitory machine-readable medium of claim 9 , wherein the operations further comprise: tracking the synthetic alarm; determining that the flapping condition having triggered the synthetic alarm persists in a subsequent query and response; and generating no additional synthetic alarm in response to the persisting flapping condition.
14. 14 . The non-transitory machine-readable medium of claim 9 , wherein the operations further comprise: identifying a new flapping condition by comparing current and previous query output files; determining that a previous flapping condition still exists; upon determination that the previous flapping condition does not exist, generating a synthetic clearing alarm; upon determination that no flapping condition is detected, logging no detection of the flapping condition; and upon determination that the previous flapping condition is detected, generating a new synthetic alarm.
15. 15 . A method, comprising: querying, by a processing system including a processor, incoming alarms received at an element management system (EMS); based on a response to the query, determining, by the processing system, patterns of the incoming alarms; determining, by the processing system, that the patterns of the incoming alarms match with a flapping condition; upon the determination of the flapping condition, generating, by the processing system, a synthetic alarm including information as to the incoming alarms and the flapping condition; and forwarding, by the processing system, the synthetic alarm to an operations support system (OSS).
16. 16 . The method of claim 15 , wherein the determining of the flapping condition further comprises determining that the incoming alarms are repeatedly raised and cleared from a single network element within a predetermined time period.
17. 17 . The method of claim 15 , comprising: upon the determination of the flapping condition, raising, by the processing system, a single alarm as the synthetic alarm to the OSS, wherein the incoming alarms are suppressed and not forwarded to the OSS.
18. 18 . The method of claim 15 , comprising: determining, by the processing system, that the flapping condition persists in a subsequent query and a response thereto; and forwarding, by the processing system, no additional synthetic alarm as to the flapping condition to the OSS.
19. 19 . The method of claim 15 , comprising: logging, by the processing system, the determined flapping condition for tracking; determining, by the processing system, that the flapping condition is cleared in a subsequent query; upon determination of the clearing of the flapping condition, forwarding, by the processing system, a synthetic clearing alarm to the OSS; and removing the determined flapping condition from the tracking.
20. 20 . The method of claim 15 , comprising: detecting, by the processing system, a subsequent flapping condition involving a same network element and a same alarm; determining, by the processing system, the subsequent flapping condition as a new flapping condition; and generating, by the processing system, a new synthetic alarm in response to the new flapping condition.

Description

FIELD OF THE DISCLOSURE The subject disclosure relates to systems and methods for handling alarm flapping conditions. BACKGROUND In managing a telecommunications network, one of the tasks is resolving alarm conditions with network elements. Some alarm conditions are referred to as flapping conditions, which is where a network element sends an alarm for a failure condition and subsequently clears it within a short period of time repeatedly, as depicted in FIG. 1. A typical flapping condition can be responsible for thousands of alarms within minutes that are each cleared seconds after being sent, as shown in FIG. 1. A flapping condition can overwhelm alarm management systems (e.g., Element Management System (EMS) and Operations Support System (OSS)), putting them in an overload state, and possibly cause an outage at the EMS/OSS layer. Such conditions also may drown out other problems that may exist in the network. Therefore, it is important to detect a flapping condition and alert on it without needing to respond to every alarm. The EMS typically has capabilities to filter alarms that match a certain criteria, such as how long the alarm is active, etc. Use of this capability is helpful to prevent flooding northbound OSS (i.e., a higher layer than the EMS) with flapping alarms. Use of the filtering capability, however, may lead to failure to alert northbound OSS of a flapping condition that should be investigated and resolved. There is a need to ensure that an alert for a flapping condition is sent to an appropriate northbound OSS and that the flapping condition alarm will be automatically cleared without overloading the northbound OSS. BRIEF DESCRIPTION OF THE DRAWINGS Reference will now be made to the accompanying drawings, which are not necessarily drawn to scale, and wherein: FIG. 1 illustrates alarm raised and cleared in the prior art. FIG. 2A is a block diagram illustrating an exemplary, non-limiting embodiment of a communications network in accordance with various aspects described herein. FIG. 2B is a block diagram illustrating an example, non-limiting embodiment of a system functioning within the communication network of FIG. 1 in accordance with various aspects described herein. FIG. 2C illustrates alarm raised and cleared in the system of FIG. 2B. FIG. 2D depicts an illustrative embodiment of a method in accordance with various aspects described herein. FIG. 2E depicts an illustrative embodiment of another method in accordance with various aspects described herein. FIG. 2F depicts an illustrative embodiment of yet another method in accordance with various aspects described herein. FIG. 3 is a block diagram illustrating an example, non-limiting embodiment of a virtualized communication network in accordance with various aspects described herein. FIG. 4 is a block diagram of an example, non-limiting embodiment of a computing environment in accordance with various aspects described herein. FIG. 5 is a block diagram of an example, non-limiting embodiment of a mobile network platform in accordance with various aspects described herein. FIG. 6 is a block diagram of an example, non-limiting embodiment of a communication device in accordance with various aspects described herein. DETAILED DESCRIPTION The subject disclosure describes, among other things, illustrative embodiments for systems and methods for handling alarm flapping conditions. The systems and methods detect a flapping condition and generate an alert on the flapping condition without needing to process each alarm up at an operations support system (OSS) layer. The systems and methods filter and suppress a large number of alarms resulting from the flapping condition, thereby preventing overload of the OSS layer. At the same time, the systems and methods provide a synthetic alarm to the OSS layer, thereby notifying the OSS layer of the flapping condition. Other embodiments are described in the subject disclosure. One or more aspects of the subject disclosure are directed to a device including a processing system having a processor and a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations. The operations include detecting that alarms have been received at an element management system (EMS); determining that the alarms are associated with a flapping condition; suppressing the alarms associated with the flapping condition; generating a synthetic alarm including flapping condition information; and injecting the synthetic alarm to an operations support system (OSS). One or more aspects of the subject disclosure are directed to a non-transitory machine-readable medium, comprising executable instructions that, when executed by a processing system including a processor, facilitate performance of operations. The operations include storing a flapping condition configuration; periodically querying an alarm database included in an element management system (EMS); based on a response to