A method, device and storage medium for predicting faults based on window frequent sequences

Abstract

The present invention relates to a method, device and storage medium for predicting faults based on window frequent sequences. The present invention presets a time window set for storing time windows, uses an abnormal event that causes any fault result in an alarm SEL log as a keyword, traverses the time window set to obtain a time window, takes the keyword as an anchor point, and intercepts an alarm SEL log block of the size of the time window forward; calculates a frequent item set for each alarm SEL log block intercepted according to each time window, takes a frequent item set with 2-3 elements and containing the keyword to form a target frequent item set, and records the target time window corresponding to the frequent item set; integrates the target time window, the corresponding frequent item and the anchor point into a window frequent sequence of the fault result; uses the window frequent sequence to calculate the weight sum of the fault result, takes the one with the largest weight sum among all the fault results that may be caused by the abnormal event in the alarm SEL log as the predicted fault result, and implements log-based fault analysis.

Description

Technical Field

[0001] The present invention relates to the field of log-based fault prediction, and in particular to a method, device and storage medium for predicting faults based on window frequent sequences. Background Art

[0002] In the field of server management technology, the system baseboard management controller (BMC), hot swap controller (HSC) and BOIS can generate event logs and record them in the system event log (SEL). Users or technicians can access the system event log through a log browser, which extracts information from the SEL. The SEL information can be used to monitor the server to detect warnings or potential major problems.

[0003] As server functions develop, the number of integrated modules in the server itself increases, and the interaction and influence between modules become complex, which may lead to the complexity of the root cause of the fault. Analyzing faults based on events in the SEL log generally requires professional maintenance personnel. Every time a network fault occurs, it is necessary to check the SEL logs of each layer and each component, which consumes a lot of manpower and material resources, and the results may not be good. There is also an analysis method that presets the correspondence between certain events and fault results, and matches the events in the SEL log with the correspondence to obtain the fault result. However, the correspondence formed by this analysis method is relatively fixed and cannot be expanded with the expansion of server modules. In addition, the events for analyzing fault results are often relatively small. If there are common events when two fault results occur, false alarms are very likely to occur, and the fault analysis effect is poor. Summary of the Invention

[0004] In order to solve the above technical problem or at least partially solve the above technical problem, the present invention provides a method, device and storage medium for predicting faults based on window frequent sequences.

[0005] In a first aspect, the present invention provides a method for predicting faults based on a windowed frequent sequence, comprising:

[0006] A time window set is preset to store time windows. The abnormal event that causes any fault result in the alarm SEL log is used as a keyword. The time window is traversed through the time window set to obtain the time window. The alarm SEL log block with the keyword as the anchor point is intercepted forward by the time window size. Frequent item sets are calculated for the alarm SEL log blocks intercepted according to each time window. The frequent items in the frequent item sets with 2-3 elements and containing the keyword are taken to form the target frequent item set. The target time window corresponding to the frequent item set is recorded. The target time window, the corresponding frequent items, and the anchor point are integrated into the window frequent sequence of the fault result.

[0007] The weighted sum of the fault results is calculated using the window frequent sequence, and the maximum weighted sum of all the fault results that may be caused by abnormal events in the alarm SEL log is taken as the predicted fault result, or a weighted sum threshold is preset, and the fault results that are higher than the weighted sum threshold are output from high to low according to the weighted sum.

[0008] Furthermore, the SEL logs of each module in the server are collected, and according to the event occurrence results in the SEL log content, it is determined whether the SEL log is an alarm log, and the non-alarm SEL logs are filtered out to obtain the alarm SEL log.

[0009] Furthermore, an analysis rule for analyzing a fault result based on an abnormal event is preset. The analysis rule includes abnormal events in the SEL log and the fault result obtained by analyzing the abnormal event. The format of the analysis rule is [event i ->error i ], where enent i Error is an abnormal event in the SEL log. i The fault result is determined by analyzing the rules to determine the fault result caused by the anchor point.

[0010] Furthermore, if a target frequent itemset is extracted from only the SEL log blocks divided by a time window, then this time window is the target time window of the target frequent itemset; if a target frequent itemset is extracted from the SEL log blocks divided by multiple time windows, then the smallest time window is taken as the target time window of the target frequent itemset.

[0011] Furthermore, the Apriori algorithm loads and analyzes abnormal events in the alarm SEL log block to generate item sets based on the abnormal events; obtains the number of elements in each item set, filters out item sets with 1 element and more than 3 elements, and calculates the support of the remaining item sets; presets a minimum support threshold and a minimum confidence threshold, selects item sets with support greater than the preset minimum support threshold, and then calculates the confidence of the selected item sets, and takes item sets with confidence greater than the minimum confidence threshold to form candidate frequent item sets; for a keyword, takes the frequent items containing the keyword in the candidate frequent item set to form the target frequent item set of the keyword, and records the target time window corresponding to the target frequent item set.

[0012] Furthermore, the target time window, the corresponding frequent items and the anchor point are integrated into the window frequent sequence of the fault result. The format of the window frequent sequence is E j =[k j , m1, m2...m i , M], where E j is the window frequent sequence of fault results, k j is the target time window, M is the anchor point, m1, m2...mi is the frequent item corresponding to the target time window and containing the anchor point M.

[0013] Furthermore, all possible fault results caused by abnormal events in the alarm SEL log include:

[0014] All abnormal events in a section of the alarm SEL log are traversed as keywords. For the traversed keywords, the keywords are used as anchor points, and the fault results corresponding to the anchor points are determined according to the analysis rules, thereby obtaining all possible fault results caused by all abnormal events in the section of the alarm SEL log.

[0015] Furthermore, calculating the weighted sum of the fault results using the windowed frequent sequence includes: setting the weight of the anchor point's contribution to the fault result to 1, setting the weight of the frequent item's contribution to the fault result to the inverse of the target time window, and calculating the weighted sum of the fault results.

[0016] In a second aspect, the present invention provides a device for predicting faults based on window frequent sequences, comprising: a processing unit, a bus unit, and a storage unit, wherein the bus unit connects the storage unit and the processing unit, and the storage unit stores a computer program. When the computer program is executed by the processing unit, the method for predicting faults based on window frequent sequences is implemented.

[0017] In a third aspect, the present invention provides a storage medium for implementing a method for predicting faults based on window-based frequent sequences, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the method for predicting faults based on window-based frequent sequences is implemented.

[0018] The above technical solution provided by the embodiment of the present invention has the following advantages compared with the prior art:

[0019] The present invention uses the abnormal event that causes any fault result in the alarm SEL log as a keyword, traverses the time window set to obtain the time window, and uses the keyword as an anchor point to intercept the alarm SEL log block of the size of the time window. This allows the frequent item set obtained based on the alarm SEL log block to take into account different time windows. Based on the existing correspondence between abnormal events and fault results, the present invention uses an analysis method based on the frequent item set idea to explore the correlation between the abnormal event represented by the keyword and other abnormal events. The fault analysis considers the correlation between the abnormal event represented by the keyword and other abnormal events, making the fault analysis more accurate. The target time window, the corresponding frequent item, and the anchor point are integrated into a window frequent sequence of the fault result; the window frequent sequence is used to calculate the weight sum of the fault result, and the maximum weight sum of all fault results that may be caused by the abnormal events in the alarm SEL log is taken as the predicted fault result, or a weight sum threshold is preset, and the fault results that are higher than the weight sum threshold are output from high to low according to the weight sum. The fault result analysis is more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0022] Figure 1 A flowchart of a method for predicting faults based on window frequent sequences provided by an embodiment of the present invention;

[0023] Figure 2 A flowchart of calculating a target frequent item set containing an anchor point for an alarm SEL log block intercepted according to each time window, and obtaining a window frequent sequence based on the target frequent item set, provided by an embodiment of the present invention;

[0024] Figure 3 The embodiment of the present invention provides a flowchart for calculating the weight sum of fault results using a window frequent sequence, and taking the maximum weight sum of all fault results that may be caused by abnormal events in the alarm SEL log as the predicted fault result;

[0025] Figure 4 A flowchart of an embodiment of the present invention for calculating the weighted sum of fault results using a windowed frequent sequence and predicting possible fault results based on the weighted sum analysis;

[0026] Figure 5 A schematic diagram of a device for predicting faults based on window frequent sequences is provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0028] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0029] Example 1

[0030] See Figure 1 As shown, the present invention provides a method for predicting faults based on window frequent sequences, comprising:

[0031] S100: Collect the alarm SEL logs for each module in the server. SEL logs are generated by the BMC and record changes in key parameters of each module in each server, as well as whether an event has occurred or been resolved. Specifically, the SEL logs for each module in the server are collected and categorized by module, such as CPU, memory, fan, network card, physical disk, and power supply. Based on the event occurrence results in the SEL log content, determine whether the SEL log is an alarm log. Non-alarm SEL logs are filtered out to obtain the alarm SEL logs for each module.

[0032] S200: Preset a plurality of time window sets for storing time windows. The time window sets record different time windows. A feasible time window set is [1, 3, 7, 15, 30], where the unit is day.

[0033] S300 , traverse the abnormal events that lead to any fault result in the alarm SEL log, use the traversed abnormal events as keywords, traverse the time window set to obtain a time window.

[0034] In the specific implementation process, an analysis rule based on abnormal event analysis of the fault result is preset. The analysis rule includes abnormal events in the SEL log and the fault result obtained by analyzing the abnormal events. The format of the analysis rule is [event i ->error i ], where enent i Error is an abnormal event in the SEL log. i The fault result is determined by analyzing the rules to determine the fault result corresponding to the abnormal event.

[0035] At step S400, using the keyword as an anchor point, the alarm SEL log is intercepted from the anchor point forward for a time span equal to the time window size to obtain an alarm SEL log block. When the time window set is [1, 3, 7, 15, 30], the alarm SEL log corresponding to the time window of 1 day, 3 days, 7 days, 15 days, and 30 days is intercepted.

[0036] S500, respectively calculate the target frequent item set containing the anchor point for the alarm SEL log block intercepted according to each time window, and obtain the window frequent sequence based on the target frequent item set. Figure 2 As shown, the target frequent item sets containing anchor points are calculated for the alarm SEL log blocks intercepted according to each time window, and the window frequent sequences are obtained based on the target frequent item sets, including:

[0037] S501: The Apriori algorithm loads and analyzes abnormal events in the alarm SEL log block to generate an item set based on the abnormal events.

[0038] S502 , obtaining the number of elements in each item set, filtering out item sets with 1 element and more than 3 elements, and calculating the support of the remaining item sets.

[0039] S503, preset a minimum support threshold and a minimum confidence threshold, select itemsets with support greater than the preset minimum support threshold, calculate the confidence of the selected itemsets, and take itemsets with confidence greater than the minimum confidence threshold to form candidate frequent itemsets.

[0040] S504: For a keyword, the frequent items in the candidate frequent itemsets that contain the keyword are selected to form a target frequent itemset for the keyword, and the target time window corresponding to the target frequent itemset is recorded. In the specific implementation, if a target frequent itemset is extracted from only a SEL log block divided by a time window, then this time window is the target time window for the target frequent itemset. If a target frequent itemset is extracted from SEL log blocks divided by multiple time windows, then the smallest time window is selected as the target time window for the target frequent itemset.

[0041] S505: Integrate the target time window, the corresponding frequent items and the anchor point into a window frequent sequence of the fault result. In the specific implementation process, the format of integrating the target time window, the corresponding frequent items and the anchor point into the window frequent sequence of the fault result is E j =[k j , m1, m2...m i , M], where E j is the window frequent sequence of fault results, k j is the target time window, M is the anchor point, m1, m2...m iis the frequent item corresponding to the target time window and containing the anchor point M.

[0042] S600, calculate the weight sum of the fault results using the window frequent sequence, and predict the possible fault results based on the weight sum analysis. Among them, a feasible method of predicting the possible fault results based on the weight sum analysis includes taking the maximum weight sum of all the fault results that may be caused by abnormal events in the alarm SEL log as the predicted fault result; or recording the weight sum of each fault result, comparing the weight sum with the preset weight sum threshold, outputting the fault result that is higher than the weight sum threshold, and arranging the output fault results from high to low according to the weight sum. In the specific implementation process, refer to Figure 3 As shown in Figure 1, the weighted sum of the fault results is calculated using the window frequent sequence. The possible fault results predicted based on the weighted sum analysis include:

[0043] S601: Traverse all abnormal events in an alarm SEL log as keywords.

[0044] S602 : For the traversed keywords, the keywords are used as anchor points, and the fault results corresponding to the anchor points are determined according to analysis rules, thereby obtaining all possible fault results caused by all abnormal events in the alarm SEL log.

[0045] S603, traverse all the fault results corresponding to the anchor point, and for each fault result obtained by traversal, calculate the weight sum of the fault results using the window frequent sequence. Specifically, a weight analysis rule is formed according to the format of the analysis rule, and the anchor point M and the frequent items containing the anchor point M in the window frequent sequence are used as events. i , in the analysis rule failure result error i The weights are configured beforehand to form weight analysis rules, such as: for the window frequent sequence E j =[k,m1,m2..m i ,M], the format of the weight analysis rule after processing is: [M→1*Error j ]、 The weights before the fault result are configured as follows: the weight of the anchor point in the window frequent sequence to the fault result is set to 1, and the weight of the frequent item to the fault result is set to the inverse of the target time window. In the specific implementation, different anchor points M may share a frequent item m. Based on the weight analysis rules, the frequent item m contributes to different fault results: and Therefore, the frequent sequences in the analysis window will get several weights and different failure results.

[0046] S604 , record and compare the weight sums of the various fault results, and take the one with the largest weight sum among all the fault results that may be caused by the abnormal events in the alarm SEL log as the prediction result.

[0047] Or see Figure 4 As shown, after executing S603, execute S605 to record the weight sum of each fault result, compare the weight sum with the preset weight sum threshold, output the fault result higher than the weight sum threshold, and arrange the output fault results from high to low according to the weight sum.

[0048] Example 2

[0049] See Figure 5 As shown, an embodiment of the present invention provides a device for predicting faults based on window frequent sequences, comprising: a processing unit, a bus unit, and a storage unit, wherein the bus unit connects the storage unit and the processing unit, and the storage unit stores a computer program. When the computer program is executed by the processing unit, the method for predicting faults based on window frequent sequences is implemented.

[0050] Example 3

[0051] An embodiment of the present invention provides a storage medium for implementing a method for predicting faults based on window-based frequent sequences. The storage medium stores a computer program, and when the computer program is executed by a processor, the method for predicting faults based on window-based frequent sequences is implemented.

[0052] The present invention uses the abnormal event that causes any fault result in the alarm SEL log as a keyword, traverses the time window set to obtain the time window, and uses the keyword as an anchor point to intercept the alarm SEL log block of the size of the time window. This allows the frequent item set obtained based on the alarm SEL log block to take into account different time windows. Based on the existing correspondence between abnormal events and fault results, the present invention uses an analysis method based on the frequent item set idea to explore the correlation between the abnormal event represented by the keyword and other abnormal events. The fault analysis considers the correlation between the abnormal event represented by the keyword and other abnormal events, making the fault analysis more accurate. The target time window, the corresponding frequent item, and the anchor point are integrated into a window frequent sequence of the fault result; the window frequent sequence is used to calculate the weight sum of the fault result, and the maximum weight sum of all fault results that may be caused by the abnormal events in the alarm SEL log is taken as the predicted fault result, or a weight sum threshold is preset, and the fault results that are higher than the weight sum threshold are output from high to low according to the weight sum. The fault result analysis is more accurate.

[0053] In the embodiments provided by the present invention, it should be understood that the disclosed structures and methods can be implemented in other ways. For example, the structural embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, structure or unit, which can be electrical, mechanical or other forms.

[0054] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0055] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0056] The foregoing description is intended only to provide specific embodiments of the present invention, which will enable those skilled in the art to understand and implement the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown herein, but is intended to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for predicting faults based on window frequent sequences, characterized in that: include: A time window set for storing time windows is preset, and the abnormal event that causes any fault result in the alarm SEL log is used as a keyword. The time window is traversed through the time window set to obtain the time window, and the alarm SEL log block of the time window size is intercepted forward with the keyword as the anchor point; the frequent item sets are calculated for the alarm SEL log blocks intercepted according to each time window respectively, and the frequent items in the frequent item set with 2-3 elements and containing the keyword are taken to form the target frequent item set, and the target time window corresponding to the frequent item set is recorded; the target time window, the corresponding frequent items and the anchor point are integrated into the window frequent sequence of the fault result, and the format of the window frequent sequence is E j =[k j , m1, m2...m i , M], where E j is the window frequent sequence of fault results, k j is the target time window, M is the anchor point, m1, m2...m i is the frequent item corresponding to the target time window and containing the anchor point M; The weight sum of fault results is calculated using a window frequent sequence, including: traversing all abnormal events in a section of an alarm SEL log as keywords; for the traversed keywords, taking the keywords as anchor points, determining the fault results corresponding to the anchor points according to the analysis rules, thereby obtaining all possible fault results caused by all abnormal events in the section of the alarm SEL log; traversing all the fault results corresponding to the anchor points, and for each traversed fault result, calculating the weight sum of the fault results using the window frequent sequence, wherein a weight analysis rule is formed according to the format of the analysis rule, and the anchor point M and the frequent items containing the anchor point M in the window frequent sequence are used as events. i , in the analysis rule failure result error i The pre-configured weights form weight analysis rules. For the window frequent sequence E j =[k j , m1, m2...m i ,M], the format of the weight analysis rule after processing is: [ ]、[ ]、[ ]、 [ ]; The configuration method for the weight before the fault result is as follows: the weight of the contribution of anchor point M to the fault result in the window frequent sequence is set to 1, and the weight of the contribution of frequent items to the fault result is set to the inverse of the target time window; when different anchor points M share a frequent item m, based on the weight analysis rule, the frequent item m contributes to different fault results. Analyzing the window frequent sequence will obtain several weights and different fault results; The fault result with the largest weight sum among all possible fault results caused by abnormal events in the alarm SEL log is taken as the predicted fault result, or a weight sum threshold is preset, and fault results with a weight sum higher than the weight sum threshold are output from high to low.

2. The method for predicting faults based on window frequent sequences according to claim 1, characterized in that: Collect the SEL logs of each module in the server, and determine whether the SEL log is an alarm log according to the event occurrence result in the SEL log content, and filter out the non-alarm SEL logs to obtain the alarm SEL log.

3. The method for predicting faults based on window frequent sequences according to claim 1, characterized in that: Preset analysis rules for analyzing fault results based on abnormal events, the analysis rules include abnormal events in the SEL log and the fault results obtained by analyzing the abnormal events. The format of the analysis rules is [event i ->error i ], where enent i Error is an abnormal event in the SEL log. i For the fault result, the fault result caused by the abnormal event is determined by analyzing the rules.

4. The method for predicting faults based on window frequent sequences according to claim 1, characterized in that: The target time window corresponding to the target frequent itemset is determined as follows: if a target frequent itemset is extracted from only the SEL log block divided by a time window, then this time window is the target time window of the target frequent itemset; if a target frequent itemset is extracted from the SEL log blocks divided by multiple time windows, then the smallest time window is taken as the target time window of the target frequent itemset.

5. The method for predicting faults based on window frequent sequences according to claim 1, characterized in that: The Apriori algorithm loads and analyzes abnormal events in the alarm SEL log block to generate itemsets based on the abnormal events. The number of elements in each itemset is obtained, itemsets with 1 element or more than 3 elements are removed, and the support of the remaining itemsets is calculated. The minimum support threshold and the minimum confidence threshold are preset, and the item sets with support greater than the preset minimum support threshold are selected. The confidence of the selected item sets is then calculated, and the item sets with confidence greater than the minimum confidence threshold are taken to form the candidate frequent item sets; for a keyword, the frequent items containing the keyword in the candidate frequent item sets are taken to form the target frequent item sets of the keyword, and the target time window corresponding to the target frequent item sets is recorded.

6. A device for predicting faults based on window frequent sequences, characterized in that: include: A processing unit, a bus unit, and a storage unit, wherein the bus unit connects the storage unit and the processing unit, and the storage unit stores a computer program. When the computer program is executed by the processing unit, the method for predicting faults based on window frequent sequences according to any one of claims 1 to 5 is implemented.

7. A storage medium for implementing a method for predicting faults based on window-based frequent sequences, wherein the storage medium stores a computer program, characterized in that: When the computer program is executed by a processor, the method for predicting faults based on window frequent sequences according to any one of claims 1 to 5 is implemented.

Images