Method for locating and analyzing fault of intelligent self-adapting network based on log

Abstract

An adaptive network fault location and analysis method based on logs is principally composed of a log preprocessing method based on priority, a log event cluster analysis method based on time-series and a multidimensional log statistical analysis method. Magnanimity of log information is classified to store according to priority, and then key event types namely 'policy' are filtered out according to log event cluster analysis method based on time-series, subsequently the key log information is displayed on the interface by using multidimensional log statistical analysis method, and an alarm judging mechanism is triggered to alarm in real time. The method has favorable expandability and accuracy, and is easy to butt-joint with related application interfaces of operators.

Description

technical field [0001] The present invention has designed the analysis model and the method of the network failure localization based on Syslog (system log), mainly researches how to analyze the log data of Internet network equipment (exchange, router, CMTS), timely and accurately locate the network quality deterioration point, It involves technical fields such as Syslog protocol analysis, network management and data mining. Background technique [0002] At present, from the outside, the network environment has undergone tremendous changes, and has experienced a development process from single to complex structures and single to diverse applications, which requires network administrators to re-understand system management in terms of network protocol hierarchy , realize centralized management through appropriate policies, and realize real-time monitoring of events and rapid response network management. However, the objects of network management are mainly composed of hardwa...

AI Technical Summary

Problems solved by technology

[0005] 1. There is no special processing for the received Syslog information according to the characteristics of the network equipment: Currently, the Syslog information can only be distinguished according to the IP address and time, and the Syslog information cannot be distinguished and stored according to the priority

Therefore, a large amount of general information floods high-priority information, which prevents maintenance personnel from discovering serious events of network equipment in time and prolongs the response time of emergencies

[0006] 2. Most of the current log review methods are carried out on a regular basis. The disadvantage of this is that the information in the log cannot be analyzed in a timely manner. Especially in the diagnosis of network faults, the regular review method is particularly insufficient

[0007] It can be seen from the above that it is difficult to meet the needs of network management by using the traditional Syslog information analysis method

Images