Method for achieving network equipment monitoring and alarming on basis of Syslog knowledge base

Abstract

The invention discloses a method for achieving network equipment monitoring and alarming on the basis of a Syslog knowledge base. The method comprises the following steps that 1, alarm keywords of various manufacturers are recorded through the Syslog knowledge base; 2, each keyword is subjected to level classification and event classification; and 3, after receiving a log, a log server conducts keyword matching of the alarm knowledge base on the log and then conducts alarm forwarding according to a matching result. According to the method, the alarm keywords of the various manufacturers are recorded through Syslog knowledge base, each keyword is subjected to level classification and event classification, keyword matching is conducted when the log is received, and precise log event alarmingis achieved; and massive log alarms are subjected to alarm compression through the knowledge base, that is to say, for the same type of alarms, only the number is accumulated, new alarms are not triggered, and therefore the efficient and convenient monitoring requirement of network equipment under massive logs is met.

Description

technical field [0001] The invention relates to a network equipment monitoring and alarming method, in particular to a method for realizing network equipment monitoring and alarming based on a Syslog knowledge base. Background technique [0002] The syslog (Syslog) protocol is a standard for forwarding syslog information in an IP network. The log server receives the Syslog message, judges its content, and implements an event alarm. [0003] Syslog message format: A system message starts with a percent sign, and its structure is as follows. [0004] %FACILITY-SUBFACILITY-SEVERITY-MNEMONIC: Message-text [0005] Facility (feature): A code composed of 2 or more capital letters, used to indicate the model of hardware device, protocol or system software. [0006] Severity (severity): a numerical code ranging from 0 to 7, indicating the severity of the event. [0007] Mnemonic: A code that uniquely identifies an error message. [0008] Message-text (message text): A text strin...

AI Technical Summary

Problems solved by technology

[0012] 1. Since the manufacturer does not have a unified standard for the definition of logs, the alarm level classification and event classification cannot be effectively realized

In particular, for the implementation of alarm recovery

[0013] 2. Log events are a time-ordered list, and the log content itself has no contextual relevance. Therefore, when processing massive log events, the number of alarms generated will be very large

Images