Alarm indicator construction method and related device

Abstract

The present invention discloses a method and related device for constructing alarm indicators. The method can obtain the SNMP performance indicators of a target device based on the SNMP protocol; obtain the original syslog log text of the target device based on the syslog protocol; and obtain the original trap message text of the target device based on the trap protocol. At least an alarm indicator set is constructed based on the SNMP performance indicators, the original syslog log text, and the original trap message text. The alarm indicator set includes a first indicator set corresponding to the SNMP performance indicators, a second indicator set corresponding to the original syslog log text, and a third indicator set corresponding to the original trap message text. It can be seen that the present invention can establish a unified alarm indicator set, thereby allowing alarm indicators to be expanded as needed, with high scalability, thereby improving the alarm monitoring capability of the target device and reducing labor costs.

Description

Technical Field

[0001] The present invention relates to the field of alarms, and in particular to an alarm indicator construction method and related devices. Background Art

[0002] With the development of 5G, software-defined access networks, and core network technologies, large enterprises have more and more network devices, and their types are becoming more and more complex. Monitoring of the network infrastructure environment is becoming increasingly important, especially the need to monitor network devices.

[0003] Traditionally, NetCool products have been used to monitor network equipment performance and faults. However, as IT scale has expanded, NetCool has encountered numerous issues in daily use, including product functionality, technical support, and business operations. These include a lack of scalability, declining management efficiency, and significant labor costs. Summary of the Invention

[0004] In view of the above problems, the present invention provides a method for constructing an alarm indicator and related devices that overcome the above problems or at least partially solve the above problems.

[0005] In a first aspect, a method for constructing an alarm indicator includes:

[0006] Based on the SNMP protocol, obtain the SNMP performance indicators of the target device;

[0007] Based on the syslog protocol, obtain the original syslog log of the target device;

[0008] Based on the trap protocol, obtain the original trap message of the target device;

[0009] At least an alarm indicator set is constructed based on the snmp performance indicator, the syslog log original text and the trap message original text, wherein the alarm indicator set includes a first indicator set corresponding to the snmp performance indicator, a second indicator set corresponding to the syslog log original text and a third indicator set corresponding to the trap message original text.

[0010] In conjunction with the first aspect, in some optional implementations, obtaining the original syslog log of the target device based on the syslog protocol includes:

[0011] Obtain the original text of the syslog log sent by the target device based on the syslog protocol.

[0012] In combination with the previous embodiment, in some optional embodiments, obtaining the original text of the trap message of the target device based on the trap protocol includes:

[0013] Obtain the original text of the trap message sent by the target device based on the trap protocol.

[0014] In combination with the previous embodiment, in some optional embodiments, constructing at least an alarm indicator set based on the snmp performance indicator, the syslog log original text, and the trap message original text includes:

[0015] Establishing the first indicator set according to the object identifier OID in the SNMP performance indicator, wherein the first indicator set records the corresponding relationship between the target object identifier OID and the SNMP performance indicator;

[0016] Based on a preset log processing rule, the syslog log original text is processed and the second indicator set is constructed according to the processing result;

[0017] Based on the preset message parsing rules, the original text of the trap message is parsed and the third indicator set is constructed according to the parsing result.

[0018] In combination with the previous embodiment, in some optional embodiments, processing the syslog log original text based on a preset log processing rule and constructing the second indicator set according to the processing result includes:

[0019] According to the keywords in the log processing rules, the syslog log original text is matched to obtain the corresponding keywords;

[0020] A corresponding alarm indicator is established according to the keyword, thereby establishing the second indicator set, wherein the second indicator set records the corresponding relationship between the alarm indicator and the keyword.

[0021] Optionally, in certain optional implementations, parsing the original text of the trap message based on a preset message parsing rule and constructing the third indicator set according to the parsing result includes:

[0022] According to the message parsing rules, the original text of the trap message is parsed to obtain the corresponding object identifier OID;

[0023] Query the MIB library according to the object identifier oid to obtain the corresponding identifier interpretation;

[0024] According to the identifier interpretation, a corresponding alarm indicator is established, thereby establishing the third indicator set, wherein the third indicator set records the corresponding relationship between the object identifier oid and the alarm indicator.

[0025] In a second aspect, an alarm indicator construction device includes: a performance acquisition unit, a log acquisition unit, a message acquisition unit, and an indicator set construction unit;

[0026] The performance obtaining unit is used to obtain the SNMP performance index of the target device based on the SNMP protocol;

[0027] The log obtaining unit is used to obtain the original syslog log of the target device based on the syslog protocol;

[0028] The message obtaining unit is used to obtain the original text of the trap message of the target device based on the trap protocol;

[0029] The indicator set construction unit is used to construct at least an alarm indicator set based on the snmp performance indicator, the syslog log original text and the trap message original text, wherein the alarm indicator set includes a first indicator set corresponding to the snmp performance indicator, a second indicator set corresponding to the syslog log original text and a third indicator set corresponding to the trap message original text.

[0030] In conjunction with the second aspect, in certain optional implementations, the log obtaining unit includes: a log obtaining subunit;

[0031] The log obtaining subunit is used to obtain the original syslog log sent by the target device based on the syslog protocol.

[0032] In a third aspect, a computer-readable storage medium stores a program, which, when executed by a processor, implements any of the above-mentioned alarm indicator construction methods.

[0033] In a fourth aspect, an electronic device comprises at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other through the bus; and the processor is used to call program instructions in the memory to execute any of the above-mentioned alarm indicator construction methods.

[0034] By means of the above technical solution, the present invention provides a method and related apparatus for constructing alarm indicators. The method can obtain the SNMP performance indicators of a target device based on the SNMP protocol; obtain the target device's syslog log text based on the syslog protocol; and obtain the target device's trap message text based on the trap protocol. Based on the SNMP performance indicators, the syslog log text, and the trap message text, at least an alarm indicator set is constructed, wherein the alarm indicator set includes a first indicator set corresponding to the SNMP performance indicators, a second indicator set corresponding to the syslog log text, and a third indicator set corresponding to the trap message text. As can be seen from this, the present invention can establish a unified alarm indicator set, thereby allowing alarm indicators to be expanded as needed, resulting in high scalability, thereby improving the alarm monitoring capability of the target device and reducing labor costs.

[0035] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present invention. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0037] Figure 1 A flowchart of a method for constructing an alarm indicator provided by the present invention is shown;

[0038] Figure 2 A schematic diagram of an indicator system provided by the present invention is shown;

[0039] Figure 3 A schematic structural diagram of an alarm indicator construction device provided by the present invention is shown;

[0040] Figure 4 A schematic structural diagram of an electronic device provided by the present invention is shown. DETAILED DESCRIPTION

[0041] Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0042] like Figure 1 As shown, the present invention provides a method for constructing an alarm indicator, including: S100, S200, S300 and S400;

[0043] S100, based on the SNMP protocol, obtain the SNMP performance indicators of the target device;

[0044] Optionally, the snmp protocol mentioned in the present invention refers to the Simple Network Management Protocol (SNMP). The target device can be a network device, that is, the present invention can collect the snmp performance indicators of the network device.

[0045] Optionally, the present invention does not impose any specific restrictions on the method of obtaining SNMP performance indicators. For example, the execution subject of the present invention can send an snmp_get command to the network device to obtain the actual indicator value of the specified OID (OID is the object identifier in the MIB information management library), that is, obtain the parameter items of the specified SNMP performance indicator through the OID, wherein the parameter items include the indicator category, device type, indicator value and indicator threshold of the corresponding SNMP performance indicator.

[0046] Optionally, the present invention may continue to use the existing indicator set of the SNMP performance indicators without extraction, and subsequently a unified indicator set may be constructed based on the existing indicator set of the SNMP performance indicators.

[0047] S200, based on the syslog protocol, obtaining the original syslog log of the target device;

[0048] Optionally, the syslog protocol is a well-known concept in the art and will not be described in detail in this invention. For details, please refer to relevant descriptions in this art. The present invention does not specifically limit the method for obtaining the original syslog log. For example, the execution subject of the present invention can configure the address of the execution subject of the present invention on the target device, and when a fault occurs on the target device, the syslog log will be automatically sent to the execution subject of the present invention, wherein the syslog log records the original syslog log.

[0049] Optionally, after obtaining the syslog log original text, the present invention can process the syslog log original text according to a preset syslog keyword alarm rule, and then generate corresponding alarm information, so as to subsequently establish a corresponding indicator set based on the alarm information.

[0050] For example, the original text of the syslog log is "%%10IFNET / 3 / PHY_UPDOWN:-DevIP11.50.238.208; Physical state on the interface Ten-GigabitEthernet4 / 2 / 1changed to up". The execution subject of the present invention can extract the indicator "port status IFStatus indicator" from it according to the syslog keyword alarm rule provided by the manufacturer.

[0051] Optional, combined Figure 1 In the illustrated embodiment, in some optional embodiments, the S200 includes: obtaining the original syslog log sent by the target device based on the syslog protocol.

[0052] Optionally, as mentioned above, the target device may send the syslog log to the execution subject of the present invention through the syslog protocol based on a pre-configured address, and the present invention does not impose any limitation on this.

[0053] S300, based on the trap protocol, obtaining the original trap message of the target device;

[0054] Optionally, the trap protocol is a well-known concept in this field, and the present invention will not go into detail about it. Please refer to the relevant descriptions in this field for details. It should be noted that the execution subject of the present invention can obtain the configuration such as the mapping relationship between the trap oid sent by the user and the indicator. When the trap oid field of the trap message completely matches the preset trap oid, the present invention can mark the indicator field corresponding to the trap message as the trap indicator corresponding to the trap oid. That is, the present invention can use the trap oid to extract the trap indicator from the existing trap message original text according to the extraction rules provided by the manufacturer. For example, the trap indicator that can be extracted from the trap alarm with the trap oid value of "1.3.6.1.4.1.37945.1.1.0.487169" is the "CPU status CPUStatus indicator".

[0055] Optionally, there is no necessary order in which S100 , S200 and S300 are executed. They may be executed in any feasible serial order or in parallel order according to actual needs.

[0056] Optionally, the present invention does not impose any specific restrictions on the method for obtaining the original text of the trap message of the target device. For example, in combination with the previous embodiment, in some optional embodiments, the S300 includes: obtaining the original text of the trap message sent by the target device based on the trap protocol.

[0057] S400. Construct at least an alarm indicator set based on the snmp performance indicator, the syslog log original text and the trap message original text, wherein the alarm indicator set includes a first indicator set corresponding to the snmp performance indicator, a second indicator set corresponding to the syslog log original text and a third indicator set corresponding to the trap message original text.

[0058] Optionally, based on the indicators extracted from the three protocols above, the present invention can establish a unified indicator system such as Figure 2 As shown. It should be noted that: Complete Figure 2 After the indicators shown are extracted, a threshold value can be set for each indicator, wherein the snmp performance indicator threshold value follows the existing threshold value and does not need to be adjusted; the threshold value of the indicator derived from the original text of the syslog log and the original text of the trap message is set as the keyword threshold value. Setting the keyword threshold value can be done by the user on the monitoring page, by selecting the indicator to set the keyword threshold value of the indicator. The keyword threshold value can be set by an empirical value or by the initialization threshold value provided by each equipment manufacturer. After the user sets the keyword threshold value, it can be sent to the execution subject of the present invention through the page, so that the execution subject of the present invention can use the keyword threshold value of the corresponding indicator when processing the alarm.

[0059] That is, in combination with the previous embodiment, in some optional embodiments, the S400 includes: step 1.1, step 1.2 and step 1.3;

[0060] Step 1.1: establishing the first indicator set according to the object identifier OID in the SNMP performance indicator, wherein the first indicator set records the corresponding relationship between the target object identifier OID and the SNMP performance indicator;

[0061] Optionally, as mentioned above, the present invention can continue to use the existing indicators of the SNMP protocol, that is, select indicators corresponding to the object identifier OID from the existing indicators of the SNMP protocol to construct the first indicator set, and the present invention does not impose any limitation on this.

[0062] Step 1.2: Based on a preset log processing rule, the original syslog log is processed and the second indicator set is constructed according to the processing result;

[0063] In combination with the previous embodiment, in some optional embodiments, the step 1.2 includes: step 2.1 and step 2.2;

[0064] Step 2.1, according to the keywords in the log processing rules, the syslog log original text is matched to obtain the corresponding keywords;

[0065] Step 2.2: Establish corresponding alarm indicators according to the keywords, thereby establishing the second indicator set, wherein the second indicator set records the corresponding relationship between the alarm indicators and the keywords.

[0066] Step 1.3: Based on the preset message parsing rules, parse the original text of the trap message and construct the third indicator set according to the parsing result.

[0067] Optionally, in some optional embodiments, the step 1.3 includes: step 3.1, step 3.2 and step 3.3;

[0068] Step 3.1, according to the message parsing rules, parse the original text of the trap message to obtain the corresponding object identifier OID;

[0069] Step 3.2, query the MIB library according to the object identifier oid and obtain the corresponding identifier interpretation;

[0070] Step 3.3: Establish corresponding alarm indicators based on the identifier interpretation, thereby establishing the third indicator set, wherein the third indicator set records the corresponding relationship between the object identifier oid and the alarm indicator.

[0071] In summary, the present invention supports the construction of a system for monitoring alarm indicators of multiple protocols, can extract standardized alarm indicators and thresholds, and form a standardized alarm indicator package, including snmp performance indicators, trap protocol and syslog protocol detailed indicators, standardize the alarm indicator system of multiple protocols, and facilitate flexible expansion of alarm rules.

[0072] like Figure 3 As shown, the present invention provides an alarm indicator construction device, comprising: a performance obtaining unit 100, a log obtaining unit 200, a message obtaining unit 300 and an indicator set construction unit 400;

[0073] The performance obtaining unit 100 is used to obtain the SNMP performance index of the target device based on the SNMP protocol;

[0074] The log obtaining unit 200 is used to obtain the original syslog log of the target device based on the syslog protocol;

[0075] The message obtaining unit 300 is used to obtain the original text of the trap message of the target device based on the trap protocol;

[0076] The indicator set construction unit 400 is used to construct at least an alarm indicator set based on the snmp performance indicator, the syslog log original text and the trap message original text, wherein the alarm indicator set includes a first indicator set corresponding to the snmp performance indicator, a second indicator set corresponding to the syslog log original text and a third indicator set corresponding to the trap message original text.

[0077] Combine Figure 3 In the illustrated embodiment, in certain optional embodiments, the log obtaining unit 200 includes: a log obtaining subunit;

[0078] The log obtaining subunit is used to obtain the original syslog log sent by the target device based on the syslog protocol.

[0079] In combination with the previous embodiment, in some optional embodiments, the basic message obtaining unit 300 includes: a message obtaining subunit;

[0080] The message obtaining subunit is used to obtain the original text of the trap message sent by the target device based on the trap protocol.

[0081] In combination with the previous embodiment, in some optional embodiments, the indicator set construction unit 400 includes: a performance indicator processing subunit, a log processing subunit and a message processing subunit;

[0082] The performance indicator processing subunit is used to establish the first indicator set according to the object identifier OID in the SNMP performance indicator, wherein the first indicator set records the corresponding relationship between the target object identifier OID and the SNMP performance indicator;

[0083] The log processing subunit is used to process the syslog log original text based on a preset log processing rule and construct the second indicator set according to the processing result;

[0084] The message processing subunit is used to parse the original text of the trap message based on a preset message parsing rule and construct the third indicator set according to the parsing result.

[0085] In combination with the previous embodiment, in some optional embodiments, the log processing subunit includes: a keyword matching subunit and a first establishing subunit;

[0086] The keyword matching subunit is used to perform regular matching on the original syslog log according to the keywords in the log processing rules to obtain corresponding keywords;

[0087] The first establishing subunit is configured to establish corresponding alarm indicators according to the keywords, thereby establishing the second indicator set, wherein the second indicator set records the corresponding relationship between the alarm indicators and the keywords.

[0088] Optionally, in certain optional embodiments, the message processing subunit includes: a message parsing subunit, an interpretation query subunit, and a second establishment subunit;

[0089] The message parsing subunit is used to parse the original text of the trap message according to the message parsing rule to obtain the corresponding object identifier OID;

[0090] The interpretation query subunit is used to query the MIB library according to the object identifier OID to obtain the corresponding identifier interpretation;

[0091] The second establishing subunit is used to establish corresponding alarm indicators according to the identifier interpretation, thereby establishing the third indicator set, wherein the third indicator set records the corresponding relationship between the object identifier oid and the alarm indicator.

[0092] The present invention provides a computer-readable storage medium having a program stored thereon, wherein the program, when executed by a processor, implements any of the above-mentioned alarm indicator construction methods.

[0093] like Figure 4 As shown, the present invention provides an electronic device 70, which includes at least one processor 701, and at least one memory 702 and a bus 703 connected to the processor 701; wherein the processor 701 and the memory 702 communicate with each other through the bus 703; the processor 701 is used to call the program instructions in the memory 702 to execute any of the above-mentioned alarm indicator construction methods.

[0094] In the present invention, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0095] Each embodiment in this specification is described in a related manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiment is generally similar to the method embodiment, so the description is relatively simple. For related parts, refer to the description of the method embodiment.

[0096] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein, but is intended to be embodied in the widest possible manner consistent with the principles and novel features disclosed herein.

[0097] The above description is only a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention are included in the scope of protection of the present invention.

Claims

1. A method for constructing an alarm indicator, characterized in that: include: Based on the SNMP protocol, obtain the SNMP performance indicators of the target device; Based on the syslog protocol, obtain the original syslog log of the target device; Based on the trap protocol, obtain the original trap message of the target device; Constructing at least an alarm indicator set based on the SNMP performance indicator, the syslog log original text, and the trap message original text, wherein the alarm indicator set includes a first indicator set corresponding to the SNMP performance indicator, a second indicator set corresponding to the syslog log original text, and a third indicator set corresponding to the trap message original text; The step of constructing at least an alarm indicator set according to the snmp performance indicator, the syslog log original text, and the trap message original text includes: Establishing the first indicator set according to the object identifier OID in the SNMP performance indicator, wherein the first indicator set records the corresponding relationship between the object identifier OID and the SNMP performance indicator; Based on a preset log processing rule, the syslog log original text is processed and the second indicator set is constructed according to the processing result; Based on the preset message parsing rules, the original text of the trap message is parsed and the third indicator set is constructed according to the parsing result.

2. The method according to claim 1, characterized in that The obtaining of the original syslog log of the target device based on the syslog protocol includes: Obtain the original text of the syslog log sent by the target device based on the syslog protocol.

3. The method according to claim 2, characterized in that The obtaining of the original text of the trap message of the target device based on the trap protocol includes: Obtain the original text of the trap message sent by the target device based on the trap protocol.

4. The method according to claim 1, wherein The processing of the syslog log original text based on the preset log processing rules and constructing the second indicator set according to the processing results includes: According to the keywords in the log processing rules, the syslog log original text is matched to obtain the corresponding keywords; A corresponding alarm indicator is established according to the keyword, thereby establishing the second indicator set, wherein the second indicator set records the corresponding relationship between the alarm indicator and the keyword.

5. The method according to claim 1, wherein The step of parsing the original text of the trap message based on a preset message parsing rule and constructing the third indicator set according to the parsing result includes: According to the message parsing rules, the original text of the trap message is parsed to obtain the corresponding object identifier OID; Query the MIB library according to the object identifier oid to obtain the corresponding identifier interpretation; According to the identifier interpretation, a corresponding alarm indicator is established, thereby establishing the third indicator set, wherein the third indicator set records the corresponding relationship between the object identifier oid and the alarm indicator.

6. A device for constructing an alarm indicator, characterized in that: include: Performance acquisition unit, log acquisition unit, message acquisition unit and indicator set construction unit; The performance obtaining unit is used to obtain the SNMP performance index of the target device based on the SNMP protocol; The log obtaining unit is used to obtain the original syslog log of the target device based on the syslog protocol; The message obtaining unit is used to obtain the original text of the trap message of the target device based on the trap protocol; The indicator set construction unit is used to construct at least an alarm indicator set according to the SNMP performance indicator, the syslog log original text and the trap message original text, wherein the alarm indicator set includes a first indicator set corresponding to the SNMP performance indicator, a second indicator set corresponding to the syslog log original text and a third indicator set corresponding to the trap message original text; The indicator set construction unit includes: a performance indicator processing subunit, a log processing subunit and a message processing subunit; The performance indicator processing subunit is used to establish the first indicator set according to the object identifier OID in the SNMP performance indicator, wherein the first indicator set records the corresponding relationship between the object identifier OID and the SNMP performance indicator; The log processing subunit is used to process the original syslog log based on a preset log processing rule and construct the second indicator set according to the processing result; The message processing subunit is used to parse the original text of the trap message based on a preset message parsing rule and construct the third indicator set according to the parsing result.

7. The device according to claim 6, characterized in that The log obtaining unit includes: a log obtaining subunit; The log obtaining subunit is used to obtain the original syslog log sent by the target device based on the syslog protocol.

8. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, the alarm indicator construction method according to any one of claims 1 to 5 is implemented.

9. An electronic device, characterized in that: The electronic device includes at least one processor, and at least one memory and bus connected to the processor; wherein the processor and the memory communicate with each other through the bus; the processor is used to call the program instructions in the memory to execute the alarm indicator construction method as described in any one of claims 1 to 5.

Images