A method, device and medium for fault locating of SDN network service

Abstract

The embodiment of the specification discloses a fault positioning method, device and medium for SDN network service, relates to the technical field of software-defined network, and comprises the following steps: obtaining service parameters of a network service to be positioned, including a service type, at least one network device and a network service architecture relationship, wherein the service type comprises a network interconnection service, a firewall service and a load balancing service; in a pre-constructed log analysis library, a plurality of storage logs are obtained, each storage log comprising a log source label, a log service label and a log level label; a plurality of matching logs are determined through the service type, the at least one network device and a plurality of log labels of each storage log; the plurality of matching logs are associated through the network service architecture relationship to generate a matching log architecture diagram; and the network service is positioned according to the matching log architecture diagram and the log level label of each matching log, wherein the log level label comprises an error level, an alarm level and a prompt level.

Description

Technical Field

[0001] This specification relates to the field of software-defined networking technology, and in particular to a fault location method, device and medium for SDN network services. Background Technology

[0002] With the development of technology, Software Defined Networking (SDN) has gradually emerged. SDN technology achieves the separation of the control plane and the data plane. However, as business demands increase and network architectures become more complex, the number of systems and devices that SDN controllers need to interface with and manage also gradually increases. When a business network becomes unavailable, the efficiency of troubleshooting becomes increasingly low when faced with numerous systems and devices.

[0003] The SDN controller listens to cloud platform network data via its northbound interface, stores the acquired data in its own database, and then distributes configurations to switches, load balancers, and firewalls via its southbound interface according to network service requirements. In real-world applications, the implementation of a network service involves multiple interactions between these systems and devices. A problem in any of these interactions can lead to network service failures, such as network outages. When a network service failure occurs, it's difficult to directly determine which interaction is causing the problem; engineers must analyze each step from the bottom up, considering the business process. This process requires logging into the backends of each system and device to search for corresponding log files, which is inefficient and hinders rapid problem detection. Furthermore, hardware devices like switches have limited storage space, resulting in limited locally stored logs. Old log content may have been updated, leading to missing logs and hindering accurate problem identification.

[0004] Therefore, in application scenarios where the SDN controller is connected to a large number of devices, the fault location of network services of the SDN controller is limited by the number of connected devices and the storage capacity of the connected devices themselves. This can easily lead to low log search efficiency or log overwriting, resulting in the inability to locate network service faults in a timely and accurate manner. Summary of the Invention

[0005] This specification provides one or more embodiments of a method, device, and medium for fault location of SDN network services, which is used to solve the following technical problem: In application scenarios where the SDN controller is connected to a large number of devices, when locating faults in SDN controller network services, the number of connected devices and the storage capacity of the connected devices themselves can lead to low log search efficiency or log overwriting, resulting in the inability to locate network service faults in a timely and accurate manner.

[0006] One or more embodiments of this specification employ the following technical solutions:

[0007] This specification provides one or more embodiments of a method for fault location of an SDN network service. The method includes: acquiring service parameters of the network service to be located, wherein the service parameters include service type, at least one network device corresponding to the network service, and the network service architecture relationship; the service type includes network interconnection service, firewall service, and load balancing service; acquiring multiple stored logs from a pre-built log analysis library, wherein the log analysis library stores log files pre-collected from multiple network devices, each stored log including multiple log tags, the log tags including log source tag, log service tag, and log level tag; determining multiple matching logs corresponding to the network service from the multiple stored logs using the service type in the service parameters of the network service, the at least one network device, and the multiple log tags of each stored log; associating the multiple matching logs using the network service architecture relationship in the service parameters of the network service to generate a matching log architecture diagram corresponding to the network service; and locating the network service fault based on the matching log architecture diagram and the log level tag of each matching log, wherein the log level tag includes error level, alarm level, and alert level.

[0008] Furthermore, before acquiring multiple stored logs from the pre-built log analysis library, the method further includes: acquiring pre-set log acquisition configuration parameters, wherein the configuration parameters include log acquisition path, connection method, and login information; acquiring multiple raw log files for each network device through the log configuration parameters, wherein the network device includes any one or more of a cloud platform, SDN controller, switch device, load balancer device, and firewall device; determining the log information of each raw log file; setting log tags for each raw log file based on the log information of each raw log file to generate corresponding stored logs; and storing the stored logs in the pre-built log analysis library.

[0009] Furthermore, by using the log configuration parameters, multiple raw log files of each network device are obtained, specifically including: performing an authentication operation for log acquisition using the login information in the log configuration parameters; after successful authentication, establishing a connection channel with each network device using the log acquisition path and connection method in the log configuration parameters; and setting up a timed log acquisition task to periodically acquire multiple raw log files of each network device through each connection channel.

[0010] Further, based on the log information of each original log file, a log tag is set for each original log file to generate a corresponding stored log. Specifically, this includes: obtaining the log source, log time, and log details corresponding to each original log file; setting a log source tag for each original log file based on the source device corresponding to each log source; converting the log time corresponding to each original log file according to a preset format rule to generate a log time tag, which is then used as the log name for each original log file; extracting the original log level from the log details of each original log file; performing log level matching on each original log level based on the log source tag of each original log file to determine the log level tag for each original log file; defining the service type of each original log file based on the log source tag to generate a log service tag; and setting the log level tag and the log service tag for each original log file to generate a stored log corresponding to each original log file.

[0011] Further, storing the stored logs in a pre-built log analysis library specifically includes: in the log analysis library, classifying multiple stored logs according to the log source tag of each stored log to generate a device storage node corresponding to each source device, wherein the log source tags corresponding to multiple stored logs in each device storage node are the same; setting the device identifier of the source device corresponding to the log source tag as the node name of the device storage node; in each device storage node, classifying multiple stored logs according to the log service tag of the stored log to generate a service storage sub-node corresponding to each service type, wherein the log service tags corresponding to multiple stored logs in each service storage sub-node are the same; setting the service type as the sub-node name of the service storage sub-node.

[0012] Furthermore, by using the service type in the service parameters of the network service, the at least one network device, and multiple log tags of each of the stored logs, multiple matching logs corresponding to the network service are determined from the multiple stored logs. Specifically, this includes: determining a designated device storage node corresponding to each network device in the log analysis library based on the device identifier of the at least one network device; determining a designated service storage sub-node corresponding to the service type in each designated device storage node based on the service type in the service parameters of the network service, and obtaining multiple designated stored logs in the designated service storage sub-node; and filtering out multiple matching logs whose log times meet preset requirements from the multiple designated stored logs using a pre-determined log timestamp for each of the designated stored logs.

[0013] Furthermore, by associating the multiple matching logs through the network service architecture relationship in the service parameters of the network service to generate a matching log architecture diagram corresponding to the network service, specifically including: obtaining the network service architecture relationship, wherein the network service architecture relationship includes at least one service process and at least one interactive network device corresponding to each service process; constructing a network service device architecture diagram among the multiple interactive network devices corresponding to the network service based on the network service architecture relationship, wherein the network service device architecture diagram includes the process sequence corresponding to the multiple interactive network devices; and associating each matching log with the interactive network device in the network service device architecture diagram through the log source tag of each matching log to generate a matching log architecture diagram corresponding to the network service.

[0014] Further, based on the matching log architecture diagram and the log level label of each matching log, fault location of the network service is performed, specifically including: obtaining at least one specified matching log with the log level label of the error level in the matching log architecture diagram based on the log level label of each matching log; determining the current architecture position of each specified matching log in the matching log architecture diagram through the at least one specified matching log; and locating the fault of the network service based on the current architecture position of each specified matching log.

[0015] This specification provides one or more embodiments of a fault location device for SDN network services, including:

[0016] At least one processor; and,

[0017] A memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to:

[0019] The process involves: acquiring service parameters of the network service to be located, wherein the service parameters include service type, at least one network device corresponding to the network service, and the network service architecture relationship; the service type includes network interconnection service, firewall service, and load balancing service; acquiring multiple stored logs from a pre-built log analysis library, wherein the log analysis library stores log files from multiple pre-collected network devices, and each stored log includes multiple log tags, including log source tag, log service tag, and log level tag; identifying multiple matching logs corresponding to the network service from the multiple stored logs based on the service type in the service parameters of the network service, the at least one network device, and the multiple log tags of each stored log; associating the multiple matching logs based on the network service architecture relationship in the service parameters of the network service to generate a matching log architecture diagram corresponding to the network service; and locating the network service fault based on the matching log architecture diagram and the log level tag of each matching log, wherein the log level tag includes error level, alarm level, and alert level.

[0020] This specification provides one or more embodiments of a non-volatile computer storage medium storing computer-executable instructions, wherein the computer-executable instructions are configured as follows:

[0021] The process involves: acquiring service parameters of the network service to be located, wherein the service parameters include service type, at least one network device corresponding to the network service, and the network service architecture relationship; the service type includes network interconnection service, firewall service, and load balancing service; acquiring multiple stored logs from a pre-built log analysis library, wherein the log analysis library stores log files from multiple pre-collected network devices, and each stored log includes multiple log tags, including log source tag, log service tag, and log level tag; identifying multiple matching logs corresponding to the network service from the multiple stored logs based on the service type in the service parameters of the network service, the at least one network device, and the multiple log tags of each stored log; associating the multiple matching logs based on the network service architecture relationship in the service parameters of the network service to generate a matching log architecture diagram corresponding to the network service; and locating the network service fault based on the matching log architecture diagram and the log level tag of each matching log, wherein the log level tag includes error level, alarm level, and alert level.

[0022] The above-mentioned at least one technical solution adopted in the embodiments of this specification can achieve the following beneficial effects: Through the above technical solution, multiple matching logs corresponding to network services are identified from multiple storage logs, and log files of all devices and systems in the network service process are summarized. Combined with multiple service types and network devices, the matching logs and network services are matched, providing a comprehensive log source for fault location and ensuring the comprehensiveness of the matching logs. Combined with the network service architecture relationship, a matching log architecture diagram corresponding to the network service is generated, which can intuitively display the log files generated by the network service in different business processes, mapping the sequence of business processes to the sequence of log files. Based on the matching log architecture diagram and the log level label of each matching log, fault location of the network service is performed, further improving the efficiency of fault location. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0024] Figure 1 A flowchart illustrating a fault location method for SDN network services provided in the embodiments of this specification.

[0025] Figure 2 This is a schematic diagram of the structure of a fault location device for SDN network services provided in the embodiments of this specification. Detailed Implementation

[0026] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0027] With the development of technology, Software Defined Networking (SDN) has gradually emerged. SDN technology achieves the separation of the control plane and the data plane. However, as business demands increase and network architectures become more complex, the number of systems and devices that SDN controllers need to interface with and manage also gradually increases. When a business network becomes unavailable, the efficiency of troubleshooting becomes increasingly low when faced with numerous systems and devices.

[0028] The SDN controller listens to cloud platform network data via its northbound interface, stores the acquired data in its own database, and then distributes configurations to switches, load balancers, and firewalls via its southbound interface according to network service requirements. In real-world applications, the implementation of a network service involves multiple interactions between these systems and devices. A problem in any of these interactions can lead to network service failures, such as network outages. When a network service failure occurs, it's difficult to directly determine which interaction is causing the problem; engineers must analyze each step from the bottom up, considering the business process. This process requires logging into the backends of each system and device to search for corresponding log files, which is inefficient and hinders rapid problem detection. Furthermore, hardware devices like switches have limited storage space, resulting in limited locally stored logs. Old log content may have been updated, leading to missing logs and hindering accurate problem identification.

[0029] Therefore, in application scenarios where the SDN controller is connected to a large number of devices, the fault location of network services of the SDN controller is limited by the number of connected devices and the storage capacity of the connected devices themselves. This can easily lead to low log search efficiency or log overwriting, resulting in the inability to locate network service faults in a timely and accurate manner.

[0030] This specification provides a fault location method for SDN network services. It should be noted that the execution subject in this specification embodiment can be a server or any device with data processing capabilities. Figure 1 This is a flowchart illustrating a fault location method for SDN network services provided in an embodiment of this specification, as shown below. Figure 1 As shown, the main steps include the following:

[0031] Step S101: Obtain the service parameters of the network service to be located.

[0032] In one embodiment of this specification, when a network service fails, it is necessary to locate the faulty network service, which can be referred to as the network service to be located. Obtaining the service parameters of this network service involves identifying the service type, at least one network device corresponding to the service, and the network service architecture relationship. Service types include network interconnection services, firewall services, and load balancing services. For example, network interconnection services include Layer 2 interconnection services within a region, subnetting services, and other network services such as network interconnection services between different regions. Each network service corresponds to at least one network device, which can be a cloud platform, SDN controller, switch device, load balancer device, firewall device, etc. The network service is broken down into multiple service processes, each with a sequential order, and each service process corresponds to at least one interacting network device. Based on the sequential order of each service process in the actual network service and the at least one interacting network device corresponding to each service process, a network service architecture relationship is constructed. This network service architecture relationship includes at least one service process and at least one interacting network device corresponding to each service process. The network service architecture relationship can be pre-built for each type of network service, and the network service architecture relationship of the corresponding network service can be directly invoked when a problem occurs; alternatively, the network service architecture relationship can be built in a targeted manner after a problem occurs.

[0033] Step S102: Obtain multiple stored logs from the pre-built log analysis library.

[0034] The log analysis library stores log files from multiple network devices that have been collected in advance. Each of these stored logs includes multiple log tags, including log source tags, log service tags, and log level tags.

[0035] Before acquiring multiple stored logs from a pre-built log analysis library, the method further includes: acquiring pre-set log acquisition configuration parameters, including log acquisition path, connection method, and login information; acquiring multiple raw log files for each network device using these configuration parameters, where the network device includes any one or more of a cloud platform, SDN controller, switch device, load balancer device, and firewall device; determining the log information for each raw log file; setting log tags for each raw log file based on its log information; and generating corresponding stored logs; and storing these stored logs in the pre-built log analysis library.

[0036] In one embodiment of this specification, a log analysis system is set up to collect and classify logs scattered across various systems and devices, generating a log analysis library. It should be noted that the log analysis system includes a configuration module, a log collection module, a log classification module, a log query module, and a log alarm module. The configuration module sets log acquisition configuration parameters, including the log acquisition path, connection method, and login information. The login information can be a username and password, or other methods, which are not specifically limited here. The log collection module, in conjunction with the log acquisition configuration parameters, collects logs, obtaining multiple raw log files from each network device. The log information of each raw log file is determined, and based on this information, log tags are set for each raw log file, generating corresponding stored logs. The log classification module classifies the multiple stored log files to store them in a pre-built log analysis library.

[0037] This log configuration parameter allows you to obtain multiple raw log files from each network device. Specifically, this involves: performing authentication for log acquisition using the login information in the log configuration parameter; establishing a connection channel with each network device using the log acquisition path and connection method specified in the log configuration parameter; and setting up a scheduled log acquisition task to periodically acquire multiple raw log files from each network device through each connection channel.

[0038] In one embodiment of this specification, since multiple systems and devices are involved in actual application scenarios, and the access permissions of different systems and devices differ, in order to control access permissions, authentication is performed on log acquisition using login information in the log configuration parameters to determine whether log acquisition permissions are available. Once authentication is successful, a connection channel is established with each network device using the log acquisition path and connection method specified in the log configuration parameters. A scheduled log acquisition task is set to periodically acquire multiple raw log files from each network device through each connection channel; for example, a scheduled task can be set to acquire raw log files from each system and device every 5 minutes.

[0039] In one embodiment of this specification, after obtaining the original log file, it is also necessary to format the original log file. Formatting can delete log files that cannot be opened, contain garbled characters, or are incompatible, thus preventing useless log files from occupying the inner layer.

[0040] Based on the log information of each original log file, log tags are set for each original log file to generate corresponding stored logs. Specifically, this includes: obtaining the log source, log time, and log details for each original log file; setting a log source tag for each original log file based on the source device corresponding to each log source; converting the log time for each original log file according to preset format rules to generate a log time tag, which is used as the log name for each original log file; extracting the original log level from the log details of each original log file; performing log level matching on each original log level based on the log source tag to determine the log level tag for each original log file; defining the service type for each original log file based on the log source tag to generate a log service tag; and setting the log level tag and log service tag for each original log file to generate the corresponding stored log.

[0041] In one embodiment of this specification, the log source, log time, and log details corresponding to each original log file are obtained. The log source refers to the source from which the log was acquired, i.e., the device to which the log belongs, also known as the source device. A source tag is set for each original log file using the source device corresponding to its log source to characterize the source or belonging device of each original log file. The log time corresponding to each original log file is converted according to a preset format rule to generate a log time tag, for example, converted to YYYYMMDDHHmmss format. This log time tag is used to name and store the original log file. The log details of the original log file include the original log level. Text feature extraction is performed on the log details to obtain the original log level. Combined with the log source tag of each original log file, log level matching is performed to convert the original log level into a standard log level. It should be noted that the original log levels in log files of different devices or systems are different. For example, a switch device has eight log levels. To perform unified analysis of logs from multiple devices and systems, it is necessary to unify the different level standards. The unified log levels include error level (ERROR), warning level (WARNING), and informational level (INFO). During log level matching, the source tags of the original log files determine all log levels corresponding to the source devices. The degree of influence of the current original log level of each original log file on the source device determines which unified log level to convert to. For example, if the original log level in the switch device's log file is the lowest level, it can be converted to the informational level, and a level tag is set. Based on the log source tags of each original log file, the source device of each original log file is determined. The service type of each original log file is defined according to the service type undertaken by the source device in the entire system's services, generating a log service tag. In other words, the log service type here corresponds to the log file generated during the network service the source device participates in. Service keyword tags can also be set for the original log files to represent the service keywords in the original log file, such as tenant name, VLAN ID, Vxlan ID, IP, VRF, etc. Finally, multiple tags are generated for each original log file, generating the corresponding stored log for each original log file.

[0042] The storage logs are stored in a pre-built log analysis library, specifically including: In the log analysis library, multiple storage logs are categorized according to their log source tags to generate device storage nodes corresponding to each source device, wherein multiple storage logs within each device storage node share the same log source tag; the device identifier of the source device corresponding to the log source tag is set as the node name of the device storage node; within each device storage node, multiple storage logs are categorized according to their log service tags to generate service storage sub-nodes corresponding to each service type, wherein multiple storage logs within each service storage sub-node share the same log service tag; and the service type is set as the sub-node name of the service storage sub-node.

[0043] In one embodiment of this specification, after acquiring multiple storage logs, to ensure convenience in subsequent querying, the storage logs can be categorized for storage. First, based on the log source tag of each storage log, multiple source devices corresponding to the multiple storage logs are determined. A corresponding device storage node is generated by combining the device identifier of each source device, and the device identifier of the source device is set as the node name of the device storage node. All storage logs corresponding to the corresponding source device are then stored. Next, within each device storage node, the multiple storage logs are categorized according to the log service tag of each storage log, generating a service storage sub-node corresponding to each service type. The service type is set as the sub-node name of the corresponding service storage sub-node, and multiple storage logs corresponding to the service type are stored in each service storage sub-node. It should be noted that storage targets can also be created, constructing storage directories according to device names, and creating subdirectories according to service types within the storage directory corresponding to each device to categorize and store multiple storage logs.

[0044] In one embodiment of this specification, the log query module is used to query stored logs in the log analysis library. For example, it can query log files of various devices and systems within the time period during which the faulty service was created; it can also query network-related logs of the faulty service for anomalies based on service type, such as the networks service in network interconnection services; it can query VLAN-related logs of the faulty service based on service keywords, such as VLAN ID; and it also supports multiple conditional queries, such as querying ERROR logs related to the faulty service by combining log level and service type. The log alarm module can customize alarm reporting parameters, such as defining the log level as "ERROR" and the log source as "switch". Based on the alarm reporting parameters, it matches the corresponding log file and pushes the matched log to the alarm module for early warning reporting.

[0045] In one embodiment of this specification, to avoid excessive log file usage leading to server resource exhaustion, automatic compression backup can be configured to compress log files, reduce memory usage, back up the logs, store them in an external database, and delete original log files that have been stored for a specified period, such as more than 6 months. In addition, to ensure the storage capacity of the external database, compressed backup logs that have exceeded a preset period can be automatically deleted, such as one year. It should be noted that the preset period and the specified period can be set according to requirements.

[0046] In one embodiment of this specification, multiple stored logs are obtained from a pre-built log analysis library.

[0047] Step S103: Using the service type in the service parameters of the network service, at least one network device, and multiple log tags of each stored log, determine multiple matching logs corresponding to the network service from multiple stored logs.

[0048] Using the service type in the service parameters of the network service, the at least one network device, and multiple log tags of each stored log, multiple matching logs corresponding to the network service are identified from the multiple stored logs. Specifically, this includes: determining a designated device storage node corresponding to each network device in the log analysis library based on the device identifier of the at least one network device; determining a designated service storage sub-node corresponding to the service type in each designated device storage node based on the service type in the service parameters of the network service, and obtaining multiple designated stored logs in the designated service storage sub-node; and filtering out multiple matching logs whose log times meet preset requirements from the multiple designated stored logs using the pre-determined log timestamps of each designated stored log.

[0049] In one embodiment of this specification, multiple matching logs corresponding to the network service are determined from multiple stored logs by using the service type in the service parameters of the network service, at least one network device, multiple log tags for each stored log, and multiple log tags corresponding to each stored log. First, based on the device identifier of each network device, a specified device storage node corresponding to the device identifier is selected from multiple device storage nodes in the log analysis database. Then, based on the service type in the service parameters of the network service, a specified service storage sub-node corresponding to the service type is determined from the specified device storage node to obtain multiple specified stored logs in the specified service storage sub-node. Since the log times of the specified stored logs differ, to ensure a high degree of matching with the network service and to more accurately find the stored log corresponding to the current network service, multiple matching logs whose log timestamps meet preset requirements are filtered out using the log timestamps of each specified stored log. Here, meeting the preset requirements means meeting the user's query requirements for the network service to be located, and this can be set according to user needs. For example, when a user is troubleshooting a network service, they need to locate the problem on a weekly basis. In other words, the query requires weekly log files. When performing the first troubleshooting, the time here refers to the log files within one week from the current time as the matching logs. Correspondingly, if a second troubleshooting is required, the log files from the previous week are used instead.

[0050] By identifying multiple matching logs corresponding to network services from various storage logs, and summarizing the log files of all devices and systems during the network service process, the matching logs and network services are matched, ensuring the matching logs match the network services. This provides a comprehensive log source for fault location and guarantees the comprehensiveness of the matching logs.

[0051] Step S104: Associate multiple matching logs through the network service architecture relationship in the service parameters of the network service to generate a matching log architecture diagram corresponding to the network service.

[0052] By associating the multiple matching logs with the network service architecture relationship in the service parameters of the network service, a matching log architecture diagram corresponding to the network service is generated. Specifically, this includes: obtaining the network service architecture relationship, wherein the network service architecture relationship includes at least one service process and at least one interactive network device corresponding to each service process; constructing a network service device architecture diagram among the multiple interactive network devices corresponding to the network service based on the network service architecture relationship, wherein the network service device architecture diagram includes the process sequence corresponding to the multiple interactive network devices; and associating each matching log with the interactive network device in the network service device architecture diagram through the log source tag of each matching log, thereby generating a matching log architecture diagram corresponding to the network service.

[0053] In one embodiment of this specification, the network service architecture relationship corresponding to a network service is obtained. Since each network service consists of multiple business processes, the network service architecture relationship is generated by the interaction order between these multiple business processes. Therefore, the network service architecture relationship includes at least one business process. Each business process in the network service is decomposed, and each business process is completed by at least one interactive network device. Therefore, the network service architecture relationship also includes at least one interactive network device corresponding to each business process. Based on the business processes in the network service architecture relationship, the relationship between each interactive device is determined, and a network service device architecture diagram is constructed. That is, the network service device architecture diagram includes multiple interactive network devices in the network service and the process order corresponding to these multiple interactive network devices. Each matching log is associated with an interactive network device in the network service device architecture diagram using its log source tag. Based on the network service device architecture diagram, a matching log architecture diagram corresponding to the network service is generated.

[0054] By combining the network service architecture relationships, a matching log architecture diagram corresponding to the network service is generated. This diagram can intuitively display the log files generated by the network service in different business processes, and map the sequence of business processes to the sequence of log files, which facilitates fault location through log files.

[0055] Step S105: Based on the matching log architecture diagram and the log level label of each matching log, fault location is performed on the network service.

[0056] The log level labels include error level, alarm level, and notification level.

[0057] Based on the matching log architecture diagram and the log level label of each matching log, fault location for the network service is performed, specifically including: obtaining at least one specified matching log with the log level label of the error level in the matching log architecture diagram based on the log level label of each matching log; determining the current architecture position of each specified matching log in the matching log architecture diagram based on the at least one specified matching log; and locating the fault for the network service based on the current architecture position of each specified matching log.

[0058] In one embodiment of this specification, based on the log level label of each matching log, at least one specified matching log with the log level label of error is obtained from the matching log architecture diagram; that is, the log file generated by the process that experienced the failure. By determining the position of at least one specified matching log in the matching log architecture diagram, the current architecture position of each specified matching log is determined. Based on the current architecture position of each specified matching log, network service fault location is performed. After determining the current architecture position, the service process and interacting network device corresponding to the specified matching log can be identified, thus achieving fault location of the network service.

[0059] Through the above technical solution, multiple matching logs corresponding to network services are identified from multiple storage logs. This summarizes log files from all devices and systems involved in the network service process. By combining multiple service types and network devices, the matching logs' compatibility with network services is ensured, providing a comprehensive log source for fault location and guaranteeing the completeness of the matching logs. Furthermore, by combining the network service architecture relationships, a matching log architecture diagram corresponding to the network service is generated. This diagram visually displays the log files generated by the network service in different business processes, mapping the sequence of business processes to the sequence of log files. Based on the matching log architecture diagram and the log level label of each matching log, fault location for network services is performed, further improving the efficiency of fault location.

[0060] This specification also provides an SDN network service fault location device, such as... Figure 2 As shown, the device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to:

[0061] The process involves: acquiring the service parameters of the network service to be located, including the service type, at least one network device corresponding to the network service, and the network service architecture relationship; the service type including network interconnection services, firewall services, and load balancing services; acquiring multiple stored logs from a pre-built log analysis library, which stores log files from multiple pre-collected network devices, each of which includes multiple log tags, including log source tags, log service tags, and log level tags; identifying multiple matching logs corresponding to the network service from the multiple stored logs based on the service type in the network service's service parameters, the at least one network device, and the multiple log tags of each stored log; associating these matching logs with the network service architecture relationship in the network service's service parameters to generate a matching log architecture diagram corresponding to the network service; and locating the network service fault based on the matching log architecture diagram and the log level tags of each matching log, where the log level tags include error level, alarm level, and alert level.

[0062] This specification also provides a non-volatile computer storage medium storing computer-executable instructions, wherein the computer-executable instructions are configured as follows:

[0063] The process involves: acquiring the service parameters of the network service to be located, including the service type, at least one network device corresponding to the network service, and the network service architecture relationship; the service type including network interconnection services, firewall services, and load balancing services; acquiring multiple stored logs from a pre-built log analysis library, which stores log files from multiple pre-collected network devices, each of which includes multiple log tags, including log source tags, log service tags, and log level tags; identifying multiple matching logs corresponding to the network service from the multiple stored logs based on the service type in the network service's service parameters, the at least one network device, and the multiple log tags of each stored log; associating these matching logs with the network service architecture relationship in the network service's service parameters to generate a matching log architecture diagram corresponding to the network service; and locating the network service fault based on the matching log architecture diagram and the log level tags of each matching log, where the log level tags include error level, alarm level, and alert level.

[0064] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, devices, and non-volatile computer storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0065] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0066] The devices, media, and methods provided in the embodiments of this specification are one-to-one correspondences. Therefore, the devices and media also have similar beneficial technical effects as their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be repeated here.

[0067] Those skilled in the art will understand that embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0068] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0069] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0070] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0071] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0072] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0073] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0074] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0075] The above description is merely one or more embodiments of this specification and is not intended to limit this specification. Various modifications and variations can be made to the one or more embodiments of this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of one or more embodiments of this specification should be included within the scope of the claims of this specification.

Claims

1. A fault location method for SDN network services, characterized in that, The method includes: Obtain the service parameters of the network service to be located, wherein the service parameters include the service type, at least one network device corresponding to the network service, and the network service architecture relationship, and the service type includes network interconnection service, firewall service, and load balancing service; In a pre-built log analysis library, multiple stored logs are obtained. The log analysis library stores log files from multiple pre-collected network devices. Each stored log includes multiple log tags, including log source tags, log service tags, and log level tags. By using the service type in the service parameters of the network service, the at least one network device, and multiple log tags of each of the stored logs, multiple matching logs corresponding to the network service are determined from the multiple stored logs; By associating the multiple matching logs through the network service architecture relationship in the service parameters of the network service, a matching log architecture diagram corresponding to the network service is generated; Based on the matching log architecture diagram and the log level label of each matching log, the network service is fault located, wherein the log level label includes error level, alarm level, and prompt level.

2. The fault location method for SDN network services according to claim 1, characterized in that, Before retrieving multiple stored logs from a pre-built log analysis library, the method further includes: Obtain pre-set log configuration parameters, wherein the log configuration parameters include log acquisition path, connection method and login information; The log configuration parameters are used to obtain multiple raw log files for each network device, wherein the network device includes any one or more of the following: cloud platform, SDN controller, switch device, load balancer device, and firewall device. Determine the log information of each of the original log files, set log tags for each of the original log files based on the log information of each of the original log files, and generate corresponding storage logs; The stored logs are stored in a pre-built log analysis library.

3. The fault location method for SDN network services according to claim 2, characterized in that, Using the log configuration parameters, multiple raw log files for each network device are obtained, specifically including: The login information in the log configuration parameters is used to perform the authentication operation for log acquisition. After successful authentication, a connection channel with each network device is established using the log acquisition path and connection method in the log configuration parameters. Set up a timed log acquisition task to periodically acquire multiple raw log files from each of the network devices through each of the connection channels.

4. The fault location method for SDN network services according to claim 2, characterized in that, Based on the log information of each of the original log files, log tags are set for each of the original log files, and corresponding storage logs are generated, specifically including: Obtain the log source, log time, and log details for each of the original log files; Set a log source tag for each original log file according to the source device corresponding to each log source; The log time corresponding to each of the original log files is converted according to a preset format rule to generate a log time tag, which is then used as the log name of each of the original log files. Based on the log details of each of the original log files, extract the original log level from each log detail; Based on the log source tag of each original log file, log level matching is performed on each original log level to determine the log level tag of each original log file. Based on the log source tag of each of the original log files, define the business type of each of the original log files to generate log business tags; Set the log level label and the log service label for each of the original log files to generate the storage log corresponding to each of the original log files.

5. The fault location method for SDN network services according to claim 4, characterized in that, Storing the stored logs in a pre-built log analysis library specifically includes: In the log analysis library, multiple stored logs are classified according to the log source tag of each stored log to generate a device storage node corresponding to each source device, wherein the log source tags of multiple stored logs in each device storage node are the same; Set the device identifier of the source device corresponding to the log source tag as the node name of the device storage node; In each of the device storage nodes, multiple storage logs are classified according to the log service tags of the storage logs to generate a service storage sub-node corresponding to each service type, wherein the log service tags corresponding to multiple storage logs in each of the service storage sub-nodes are the same; Set the service type as the name of the child node of the service storage child node.

6. The fault location method for SDN network services according to claim 5, characterized in that, By using the service type in the service parameters of the network service, the at least one network device, and multiple log tags for each of the stored logs, multiple matching logs corresponding to the network service are determined from the multiple stored logs, specifically including: Based on the device identifier of the at least one network device, determine the designated device storage node corresponding to each network device in the log analysis database; In each of the designated device storage nodes, a designated service storage sub-node corresponding to the service type is determined according to the service type in the service parameters of the network service, so as to obtain multiple designated storage logs in the designated service storage sub-node; By using a pre-determined log timestamp for each of the specified storage logs, multiple matching logs whose log times meet preset requirements are selected from the multiple specified storage logs.

7. The fault location method for SDN network services according to claim 1, characterized in that, By associating the multiple matching logs through the network service architecture relationships in the service parameters of the network service, a matching log architecture diagram corresponding to the network service is generated, specifically including: Obtain the network service architecture relationship, wherein the network service architecture relationship includes at least one service process and at least one interactive network device corresponding to each service process; Based on the network service architecture relationship, a network service device architecture diagram is constructed between multiple interactive network devices corresponding to the network service, wherein the network service device architecture diagram includes the process sequence corresponding to the multiple interactive network devices; By using the log source tag of each matching log, each matching log is associated with the interactive network device in the network service device architecture diagram to generate the matching log architecture diagram corresponding to the network service.

8. The fault location method for SDN network services according to claim 1, characterized in that, Based on the matching log architecture diagram and the log level label of each matching log, fault location is performed on the network service, specifically including: Based on the log level label of each of the matching logs, at least one specified matching log with the log level label being the error level is obtained in the matching log architecture diagram; Using the at least one specified matching log, determine the current architecture position of each specified matching log in the matching log architecture graph; Based on the current architecture location of each specified matching log, the network service is fault located.

9. A fault location device for SDN network services, characterized in that, The device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to: Obtain the service parameters of the network service to be located, wherein the service parameters include the service type, at least one network device corresponding to the network service, and the network service architecture relationship, and the service type includes network interconnection service, firewall service, and load balancing service; In a pre-built log analysis library, multiple stored logs are obtained. The log analysis library stores log files from multiple pre-collected network devices. Each stored log includes multiple log tags, including log source tags, log service tags, and log level tags. By using the service type in the service parameters of the network service, the at least one network device, and multiple log tags of each of the stored logs, multiple matching logs corresponding to the network service are determined from the multiple stored logs; By associating the multiple matching logs through the network service architecture relationship in the service parameters of the network service, a matching log architecture diagram corresponding to the network service is generated; Based on the matching log architecture diagram and the log level label of each matching log, the network service is fault located, wherein the log level label includes error level, alarm level, and prompt level.

10. A non-volatile computer storage medium storing computer-executable instructions, characterized in that, The computer-executable instructions are set as follows: Obtain the service parameters of the network service to be located, wherein the service parameters include the service type, at least one network device corresponding to the network service, and the network service architecture relationship, and the service type includes network interconnection service, firewall service, and load balancing service; In a pre-built log analysis library, multiple stored logs are obtained. The log analysis library stores log files from multiple pre-collected network devices. Each stored log includes multiple log tags, including log source tags, log service tags, and log level tags. By using the service type in the service parameters of the network service, the at least one network device, and multiple log tags of each of the stored logs, multiple matching logs corresponding to the network service are determined from the multiple stored logs; By associating the multiple matching logs through the network service architecture relationship in the service parameters of the network service, a matching log architecture diagram corresponding to the network service is generated; Based on the matching log architecture diagram and the log level label of each matching log, the network service is fault located, wherein the log level label includes error level, alarm level, and prompt level.

Images