An intelligent tracing method and device for information network management failure

Abstract

The application relates to an intelligent tracing method and device for information network management faults, which comprises the following steps: firstly, tracing based on historical alarm data: according to an intelligent analysis algorithm FP-Growth, intelligently analyzing the correlation between each device appearing a certain index alarm and other devices appearing index alarms; secondly, tracing based on network upstream and downstream structures: constructing a fault tracing topological structure diagram based on network upstream and downstream structure information collection device routing information; if real-time alarm information is connectivity alarm or ping alarm, determining whether the network communication device of the upper layer is the alarm source through a two-dimensional table of the topological structure, and if not, determining the alarm source through the correlation table. The application also relates to an intelligent tracing device for information network management faults. Advantages of the application: the application can correctly analyze the correlation and subordination between network alarms, locate the real root alarm, greatly reduce the number of alarms, and improve the efficiency and quality of network operation and maintenance.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information network management fault analysis, in particular to a method for intelligent diagnosis and automatic accurate positioning of information network management faults. BACKGROUND

[0002] The integrated network management system developed based on the traditional architecture design has a bottleneck in data collection, query and processing performance, and has problems such as complex application deployment, upgrade and expansion, poor adaptability to changes in monitored objects, etc.

[0003] Secondly, with the rapid development of power business, the normal and stable operation of the power core business system is the key to the normal operation of the company's business. This puts forward higher requirements for the network operation environment and the overall monitoring of the business system. The current information network management fault diagnosis mainly reflects the following aspects:

[0004] In the case of a large number of alarms, it is impossible to realize intelligent diagnosis and automatic accurate positioning of the fault of the network communication device and the interface connection relationship, so as to correctly analyze the correlation and subordinate relationship between network alarms and locate the real "root alarm".

[0005] The existing network management fault tracing intelligent method mainly includes the following two technical routes:

[0006] 1. Through the scene reproduction system and snapshot network element system built to analyze and locate the fault in the network management system. This method cannot correctly analyze the correlation and subordinate relationship between network alarms and locate the real "root alarm";

[0007] 2. Analysis of network management alarm related projects to locate the node causing the fault. This method cannot realize intelligent diagnosis and automatic accurate positioning of the fault of the network communication device and the interface connection relationship in the case of a large number of alarms. SUMMARY

[0008] In order to solve the above problems, the purpose of the present application is to provide an intelligent tracing method for information network management faults, which can analyze the correlation and subordinate relationship between network alarms, intelligently diagnose and accurately locate the alarm device, greatly reduce the number of alarms, and improve the efficiency and quality of network operation.

[0009] To achieve the above purpose, the present application adopts the following technical scheme:

[0010] An intelligent tracing method for information network management faults, comprising the following steps:

[0011] Based on the analysis of historical alarm data, the correlation relationship table of index alarm is constructed, which records the correlation relationship between the index alarm of any device and the index alarm of other devices;

[0012] Based on the routing information, the topology structure two-dimensional table is constructed, which records the network communication devices linked by each host in the network and the link relationship between the network communication devices;

[0013] According to the real-time alarm information, the fault is judged:

[0014] If it is a connectivity alarm or a ping alarm, the upper network communication device is determined through the topology structure two-dimensional table, if the upper network communication device alarms, the alarm source is located, if the upper network communication device does not alarm, the alarm source is determined through the correlation relationship table;

[0015] If it is not a connectivity alarm or a ping alarm, the alarm source is determined through the correlation relationship table;

[0016] The process of determining the alarm source by the correlation relationship is: querying the devices and the index alarms of the devices associated with the index alarm of the device in the correlation relationship table, so as to determine the alarm source.

[0017] More preferably, the construction step of the correlation relationship table is: based on the SNMP protocol to collect historical alarm data, when the FP-Growth algorithm is used to analyze and process the historical alarm data, a frequent pattern tree is constructed, wherein TID is the index alarm of a device, support = a certain type of index alarm / total alarm number, an output correlation relationship table is constructed, which records the correlation relationship between the index alarm of any device and the index alarm of other devices; The devices include network communication devices, hosts and databases, middleware and storage devices on the host, wherein when the database, middleware and storage devices alarm, the host serves as the host of the database, middleware and storage devices.

[0018] More preferably, the correlation relationship table contains multiple groups of association records, wherein any group of association records contains the ID and index alarm of the two associated devices, the number of times of the association, the confidence and the support.

[0019] More preferably, the constructing step of the topology two-dimensional table is that the collection service collects the routing information table of the network communication device through the SNMP protocol, the routing information table stores the IP information of the request sender host and the IP information of the target host to be accessed, the obtained host IP is associated and matched with the device IP in the device account table, the network communication device linked by each host and the link relationship between the network communication devices are determined, at the same time, the unique primary key ID of the device is determined in the device account table through the IP information of the device, and then the processed information is stored in the topology two-dimensional table.

[0020] More preferably, the alarm source is determined through the association relationship, and the current alarm device primary key, device type, index alarm name, device primary key, device type, index alarm name, support degree and confidence degree causing the index alarm of the current device are outputted, so as to determine the alarm source.

[0021] In order to solve the above problems, the purpose of the present application is to further provide an intelligent tracing device for information network management fault.

[0022] An intelligent tracing device for information network management fault, comprising a data analysis module: based on the analysis of historical alarm data, an association relationship table of index alarms is constructed, which records the association relationship between the index alarms of other devices when any index alarm of the device occurs; a routing analysis module: based on the routing information, a topology two-dimensional table is constructed, which records the network communication devices linked by each host in the network and the link relationship between the network communication devices; a fault analysis module: based on real-time alarm information, fault analysis is performed: if it is a connectivity alarm or a ping alarm, the upper network communication device is determined through the topology two-dimensional table, if the upper network communication device alarms, the alarm source is located, if the upper network communication device does not alarm, the alarm source is determined through the association relationship table; if it is not a connectivity alarm or a ping alarm, the alarm source is determined through the association relationship table; the process of determining the alarm source through the association relationship is: the devices associated with the index alarms of the device in the association relationship table and the index alarms of the devices are queried, so as to determine the alarm source.

[0023] More preferably, the data analysis module performs the following steps: collecting historical alarm data based on the SNMP protocol, constructing a frequent pattern tree when analyzing and processing the historical alarm data using the FP-Growth algorithm, wherein TID is an index alarm of a certain device, the support degree = the index alarm of a certain type / the total number of alarms, and an association table is output, which records the association between the index alarms of other devices when any index alarm of a device occurs; the devices include network communication devices, hosts, and databases, middleware, and storage devices on the hosts, wherein when the databases, middleware, and storage devices generate alarms, the host serves as the host of the databases, middleware, and storage devices.

[0024] More preferably, the association table contains multiple groups of association records, wherein any group of association records contains the IDs and index alarms of the two associated devices, the number of times of the association, the confidence degree, and the support degree.

[0025] More preferably, the route analysis module performs the following steps: collecting the route information table of the network communication device through the SNMP protocol, the route information table stores the IP information of the request sender host and the IP information of the target host to be accessed, and the obtained host IP is associated and matched with the device IP in the device account table to determine the network communication devices linked by each host and the linkage relationship between the network communication devices, and at the same time, the unique primary key ID of the device is determined in the device account table through the IP information of the device, and then the processed information is stored in the topology two-dimensional table.

[0026] More preferably, the alarm source is determined through the association relationship, and the current alarm device primary key, device type, index alarm name, device primary key, device type, index alarm name, support degree, and confidence degree that cause the index alarm of the current device are output, so as to determine the alarm source.

[0027] The present application has the following advantages:

[0028] The intelligent tracing method and device for information network management faults focus on the SNMP and TCP / IP protocols of the business system, combine the network topology alarm fault normalization integration technology, use the big data FP-Growth intelligent analysis algorithm, use the SNMP running state information of the network communication device, combine the content of the route information table in the network communication device, realize the intelligent fault diagnosis and automatic accurate positioning of the superior-inferior relationship and connection relationship of the network communication device, and thus can correctly analyze the association and subordinate relationship between network alarms, locate the real device index root alarm, greatly reduce the number of alarms, and improve the efficiency and quality of network operation. BRIEF DESCRIPTION OF DRAWINGS

[0029] Figure 1Flow chart of the intelligent tracing method for information network management fault of the present application;

[0030] Figure 2 Analysis schematic diagram of the present application using FP-Growth algorithm;

[0031] Figure 3 Network structure schematic diagram of the present application;

[0032] Figure 4 Flow chart of the construction of the two-dimensional graph of the topology structure of the present application;

[0033] Figure 5 Flow chart of the processing of the positioning root cause alarm of the present application. Embodiment

[0034] The present application is further described in detail below in combination with the accompanying drawings and specific embodiments. Embodiment

[0035] Please refer to Figure 1 An intelligent tracing method for information network management fault, comprising the following steps:

[0036] Step 1, based on the analysis of historical alarm data, constructing the correlation table of index alarm:

[0037] Based on the SNMP protocol, collecting historical alarm data, and using the FP-Growth algorithm to analyze the relationship between each device index alarm, outputting the correlation table. The table records the correlation between the index alarms of any device and the index alarms of other devices. The devices described in this embodiment include network communication devices, hosts, and databases, middleware, and storage devices on the host, wherein, when the database, middleware, and storage devices alarm, the host is the host of the database, middleware, and storage devices. The network communication device is mainly a router or a switch. The device supporting the SNMP protocol (SNMP protocol: Simple Network Management Protocol) can provide device running state information for collection services, such as host memory usage, cpu usage, process information, storage usage, connectivity, and ping packet loss rate, as well as network communication device port status, cpu usage, import and export traffic, connectivity, and ping packet loss rate, etc., so when the device fails, the device alarm data can be obtained, such as connectivity alarm.

[0038] As Figure 2As shown, when the FP-Growth algorithm is used to analyze and process the historical alarm data, a frequent pattern tree is constructed, where TID refers to the alarm information of an index of a device, and the support degree = the alarm information of a certain type / the total number of alarms. Within the range that the server and the algorithm can bear, the larger the data volume is, the better the correlation between the alarms of the indexes of the devices can be found. Therefore, the FP-Growth algorithm can analyze the correlation between the alarms of the indexes of the devices and the alarms of the indexes of other devices after the alarms of the indexes of the devices occur. For example, as shown in Figure 3 In the network topology, the host 1 has a network port connection failure, and correspondingly, the associated device router 1 can have a port failure.

[0039] After the FP-Growth algorithm is used to analyze the historical alarm data, the output correlation table records the correlation between the alarms of two devices in the network, including the IDs and indexes of the two associated devices, the number of times of the correlation, the confidence degree, and the support degree. The confidence degree refers to if a sample contains the alarms of A and B, then cofidence(AB) = P(B|A) = the number of tuples containing A and B / the number of tuples containing A = support(A∪B) / support(A). As shown in Table 1 (Table 1 only shows some associated devices), where ID represents the serial number, ResoureIP_id represents the device id, IndexName represents the index name, cnt represents the number of occurrences, confidence represents the confidence degree, and Support represents the support degree.

[0040] Table 1:

[0041] In the fault tracing correlation analysis algorithm, the configuration content involves [CA_RULE], [database], and [hbase] of the configuration file RULE.ini. [CA_RULE] is mainly used to adjust the support degree, the confidence degree, and the number of historical alarm table data obtained during the correlation mining. [database] is mainly used to configure the address and port of the oracle database when reading the topology two-dimensional table, the account table, the resource type table, the correlation table, and the topology analysis result data, and writing the data into the oracle data table. [hbase] is mainly used to configure the address and port information of the Hbase database storing the historical alarm table. [mongodb] is mainly used to configure the address and port information of the MongoDB database storing the real-time alarm table.

[0042] Step 2, a topology two-dimensional table is constructed based on the routing information, which records the network communication devices linked by each host in the network and the link relationship between the network communication devices.

[0043] Please refer to Figure 4 The construction step of the topology two-dimensional table is: the collection service collects the routing information table of the network communication device through the SNMP protocol, the routing information table stores the IP information of the request sender host, i.e. the host IP information linked to the network communication device, and the IP information of the target host to be accessed, the obtained host IP is associated and matched with the device IP in the device account table, the link relationship between each host and the network communication device and the link relationship between the network communication devices are determined, at the same time, the unique primary key ID of the device is determined in the device account table through the IP information of the device, and then the processed information is stored in the topology two-dimensional table. The device account table mainly stores the primary key ID, IP and other information of the device, the corresponding unique primary key ID can be obtained through the IP information, and then the primary key ID is stored in the topology two-dimensional table. Therefore, when an alarm occurs, the relationship between the upper and lower layers of the network is obtained by querying the topology two-dimensional table through the link oracle database, and the network upper and lower layer structure is traced. In practical application, since the routing information table of the switch and the router is a real-time table, when a device does not perform network activity at this time, it will not be reflected on the routing information table, therefore, after completing the construction of the topology two-dimensional table, it is regarded as a historical topology two-dimensional table, then the routing information is still collected in real time, a real-time topology two-dimensional table is constructed, and the two tables are combined to constantly improve, so as to generate a topology two-dimensional table which completely records the network structure data.

[0044] Step 3, please refer to Figure 5 Fault judgment is performed according to real-time alarm information:

[0045] Step 31, it is judged whether the alarm index of the device is connectivity alarm or ping alarm, if not, step 32 is executed, if yes, the network topology two-dimensional table and the device account table are queried to determine the upper layer network communication device corresponding to the alarm device, it is queried whether the upper layer network communication device has port alarm, connectivity or ping alarm, if yes, the upper layer network communication device is determined as the alarm source, if not, step 32 is executed.

[0046] Step 32, query the association table record, determine the index alarm of the associated other device according to the index alarm of the current alarm device, output the current alarm object primary key, object type, alarm index, object primary key, object type, index name, support degree and confidence degree of the object causing the current object index alarm, so as to determine the alarm source. The number of alarm sources determined by the association table record is determined by the number of network access ports of the device and the number of switches and routers connected by the device. Embodiments

[0047] Based on the same inventive concept, the present embodiment provides a device for executing the method of embodiment one.

[0048] Please refer to Figures 1 to 5 , an intelligent traceability device for information network management failure, comprising

[0049] Data analysis module: based on the analysis of historical alarm data, an association table of index alarms is constructed, which records the association between the index alarms of any device and other devices. Specifically, the data analysis module performs the following steps: based on the SNMP protocol, historical alarm data is collected, and when the FP-Growth algorithm is used to analyze and process the historical alarm data, a frequent pattern tree is constructed, wherein TID is the index alarm of a certain device, support degree = index alarm of a certain type / total alarm number, and an association table is output, which records the association between the index alarms of any device and other devices; the device includes network communication devices, hosts and databases, middleware and storage devices on the host, wherein when the database, middleware and storage devices alarm, the host acts as the host of the database, middleware and storage devices. The association table contains multiple association records, wherein any association record contains the IDs and index alarms of the two associated devices, the number of times of the association, the confidence degree and the support degree.

[0050] Route analysis module: based on the routing information, a topology two-dimensional table is constructed, which records the network communication devices linked by each host in the network and the link relationship between the network communication devices. Specifically, the route analysis module performs the following steps: the service collects the routing information table of the network communication device through the SNMP protocol, the routing information table stores the IP information of the request sender host and the IP information of the target host to be accessed, the obtained host IP is associated and matched with the device IP in the device account table, the link relationship between each host and the network communication device and the link relationship between the network communication devices are determined, at the same time, the unique primary key ID of the device is determined in the device account table through the IP information of the device, and then the processed information is stored in the topology two-dimensional table.

[0051] The fault analysis module: based on real-time alarm information to analyze the fault: if the connectivity alarm or ping alarm, then through the topological structure two-dimensional table to determine the upper network communication device, if the upper network communication device alarm, then locate the alarm source, if the upper network communication device does not alarm, then through the association relationship table to determine the alarm source; if not connectivity alarm or ping alarm, then through the association relationship table to determine the alarm source; the process of the association relationship to determine the alarm source is: query the association relationship table associated with the device index alarm and the device index alarm, output the current alarm device primary key, device type, index alarm name, cause the current device index alarm device primary key, device type, index alarm name, support and confidence, so as to determine the alarm source.

[0052] The embodiments not described in detail in the present embodiment can refer to example one.

[0053] The above is only a specific embodiment of the present application, and does not limit the patent scope of the present application, any equivalent structural transformation using the content of the present application specification and drawings, or directly or indirectly applied to other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. An intelligent source tracing method for information network management faults, characterized in that: Includes the following steps: Based on the analysis of historical alarm data, a correlation table for indicator alarms is constructed, which records the correlation between indicator alarms occurring on other devices when any type of indicator alarm occurs on a device. The steps for constructing the correlation table are as follows: historical alarm data is collected based on the SNMP protocol, and the FP-Growth algorithm is used to analyze and process the historical alarm data to construct a frequent pattern tree. Here, TID represents the indicator alarm of a certain device, and support = indicator alarm of a certain type / total number of alarms. The correlation table is output, which records the correlation between indicator alarms occurring on other devices when any type of indicator alarm occurs on a device. The devices include network communication devices, hosts, and databases, middleware, and storage devices on the host. When the database, middleware, and storage devices generate alarms, the host acts as the host machine for the database, middleware, and storage devices. A two-dimensional topology table is constructed based on routing information, which records the network communication devices linked to by each host in the network and the link relationships between these devices. The construction steps of the two-dimensional topology table are as follows: The data collection service collects the routing information table of network communication devices through the SNMP protocol. This routing information table stores the IP information of the requesting host and the IP information of the target host to be accessed. The obtained host IP is matched with the device IP in the device ledger table to determine the network communication devices linked to by each host and the link relationships between these devices. At the same time, the unique primary key ID of the device is determined in the device ledger table using the device IP information. Finally, the processed information is stored in the two-dimensional topology table. Fault diagnosis based on real-time alarm information: If it is a connectivity alarm or a ping alarm, the upper-layer network communication device is determined through the two-dimensional table of the topology structure. If the upper-layer network communication device alarms, the alarm source is located. If the upper-layer network communication device does not alarm, the alarm source is determined through the association table. If it is not a connectivity alarm or a ping alarm, the alarm source is determined through the aforementioned association table; The process of determining the alarm source by the association relationship is as follows: query the devices and their indicator alarms that are associated with the device in the association relationship table, thereby determining the alarm source.

2. The intelligent source tracing method for information network management faults according to claim 1, characterized in that: The association table contains multiple sets of association records, where any set of association records includes the IDs and indicator alarms of the two related devices, the number of times the association occurs, the confidence level, and the support level.

3. The intelligent source tracing method for information network management faults according to claim 1, characterized in that: The alarm source is determined by the aforementioned relationship, and the primary key of the current alarm device, device type, indicator alarm name, primary key of the device that caused the current device indicator alarm, device type, indicator alarm name, support, and confidence are output to determine the alarm source.

4. An intelligent fault tracing device for information network management, characterized in that: include The data analysis module analyzes historical alarm data to construct an association table for indicator alarms. This table records the association between an indicator alarm occurring on one device and indicator alarms occurring on other devices. The data analysis module performs the following steps: collecting historical alarm data using the SNMP protocol; analyzing and processing the historical alarm data using the FP-Growth algorithm; constructing a frequent pattern tree, where TID represents the indicator alarm of a certain device; support = indicator alarm of a certain type / total number of alarms; and outputting an association table that records the association between an indicator alarm occurring on one device and indicator alarms occurring on other devices. The devices include network communication equipment, a host, and databases, middleware, and storage devices on the host. When an alarm occurs on the database, middleware, or storage device, the host acts as the host machine for the database, middleware, or storage device. The routing analysis module constructs a two-dimensional topology table based on routing information. This table records the network communication devices linked to by each host in the network and the link relationships between these devices. The routing analysis module performs the following steps: The collection service collects routing information tables of network communication devices via the SNMP protocol. These tables store the IP information of the requesting host and the IP information of the target host to be accessed. The obtained host IPs are matched with the device IPs in the device ledger table to determine the network communication devices linked to each host and the link relationships between these devices. Simultaneously, the unique primary key ID of the device is determined in the device ledger table using the device's IP information. Finally, the processed information is stored in the two-dimensional topology table. Fault Analysis Module: Performs fault analysis based on real-time alarm information. If it is a connectivity alarm or a ping alarm, the upper-layer network communication device is determined through the two-dimensional topology table. If the upper-layer network communication device alarms, the alarm source is located. If the upper-layer network communication device does not alarm, the alarm source is determined through the association table. If it is not a connectivity alarm or a ping alarm, the alarm source is determined through the association table. The process of determining the alarm source through the association table is as follows: query the devices and their corresponding indicator alarms in the association table to determine the alarm source.

5. The intelligent fault tracing device for information network management according to claim 4, characterized in that: The association table contains multiple sets of association records, where any set of association records includes the IDs and indicator alarms of the two related devices, the number of times the association occurs, the confidence level, and the support level.

6. The intelligent tracing device for information network management faults according to claim 4, characterized in that: The alarm source is determined by the aforementioned relationship, and the primary key of the current alarm device, device type, indicator alarm name, primary key of the device that caused the current device indicator alarm, device type, indicator alarm name, support, and confidence are output to determine the alarm source.

Images