Root cause positioning method, communication device and computer readable storage medium

Abstract

The application discloses a root cause positioning method, a communication device and a computer readable storage medium, and is applied to network management. The network management is connected with multiple interworking network elements. The root cause positioning method comprises the following steps: acquiring alarm logs from the multiple interworking network elements. The alarm logs comprise first alarm logs and second alarm logs. The first alarm logs are alarm logs of interworking network elements disconnected with peer network elements. The first alarm logs comprise fault information of the peer network elements disconnected with the interworking network elements. The second alarm logs are alarm logs of interworking network elements connected normally with peer network elements. A fault prediction sample is constructed according to the first alarm logs and the second alarm logs. A preset fault positioning model is used to predict the fault prediction sample, so that a fault positioning prediction result is obtained.

Description

Technical Field

[0001] This application relates to, but is not limited to, the field of communication technology, and in particular to a root cause localization method, communication device, and computer-readable storage medium. Background Technology

[0002] Currently, complex network systems typically contain tens of thousands of module nodes, each generating a large amount of logs during system operation. When a system failure occurs, the failure propagates along the network, creating a storm of alarms and generating a massive amount of alarm log information. However, the true root cause is often lost in this sea of ​​alarms, especially when the root cause node becomes disconnected, making it impossible to access its alarm logs. This hinders the identification of the root cause node and makes it difficult to accurately troubleshoot the problem. Consequently, the time spent by maintenance personnel in troubleshooting increases significantly, leading to slow recovery of network system services after outages and impacting user experience. Summary of the Invention

[0003] This application provides a root cause localization method, communication device, and computer-readable storage medium, which can quickly locate the root cause node when the root cause node is disconnected, thereby improving the efficiency of fault diagnosis.

[0004] In a first aspect, embodiments of this application provide a root cause localization method applied to a network management system, wherein the network management system is connected to multiple interconnected network elements;

[0005] The root cause localization method includes:

[0006] Obtain alarm logs from multiple interconnected network elements. The alarm logs include a first alarm log and a second alarm log. The first alarm log is the alarm log of the interconnected network element that is disconnected from the peer network element. The first alarm log includes fault information of the peer network element that is disconnected from the interconnected network element. The second alarm log is the alarm log of the interconnected network element that is normally connected to the peer network element.

[0007] Construct a fault prediction sample based on the first alarm log and the second alarm log;

[0008] The fault prediction sample is predicted using a preset fault location model to obtain the fault location prediction result.

[0009] Secondly, embodiments of this application provide a root cause localization method applied to interconnected network elements, wherein the interconnected network elements are connected to the network management system, and the root cause method includes:

[0010] When the interconnecting network element experiences a disconnection fault with the peer network element, the interconnecting network element generates fault information according to a preset interaction protocol;

[0011] A first alarm log is generated based on the fault information;

[0012] The first alarm log is reported to the network management system so that the network management system can construct a fault prediction sample based on the first alarm log and the second alarm log, and use a preset fault location model to predict the fault prediction sample to obtain a fault location prediction result. The second alarm log is generated by the interconnecting network element that is normally connected to the peer network element.

[0013] Thirdly, embodiments of this application provide a communication device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the root cause localization method as described in the first aspect or the root cause localization method as described in the second aspect.

[0014] Fourthly, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions for performing the root cause localization method as described in the first aspect or the root cause localization method as described in the second aspect.

[0015] This application embodiment includes: acquiring alarm logs from multiple interconnected network elements, the alarm logs including a first alarm log and a second alarm log, the first alarm log being the alarm log of an interconnected network element disconnected from the peer network element, the first alarm log including fault information of the peer network element disconnected from the peer network element, and the second alarm log being the alarm log of an interconnected network element normally connected to the peer network element; constructing fault prediction samples based on the first alarm log and the second alarm log; and using a preset fault location model to predict the fault prediction samples to obtain fault location prediction results.

[0016] According to the solution provided in this application embodiment, since the network element that is disconnected cannot upload its own alarm log to the network management system due to a fault, the interconnected network element that is disconnected from the peer network element will upload a first alarm log carrying the fault information of the peer network element to the network management system, while the interconnected network element that is normally connected to the peer network element will upload its own generated second alarm log to the network management system. The network management system receives the alarm logs of each interconnected network element and can obtain the fault information of the disconnected network element from the alarm logs uploaded by the associated network elements of the disconnected network element. The network management system constructs fault prediction samples using the first and second alarm logs. It then uses a pre-defined fault location model to predict faults for all network elements. Compared to the approach where network elements that are out of service cannot upload their own alarm logs and only rely on the alarm logs uploaded by interconnected network elements for root cause prediction, this method utilizes the fault information of network elements associated with the out-of-service element to upload alarm logs containing fault information to the network management system. This increases the number of samples used to construct prediction samples, and by combining the prediction samples from all interconnected and out-of-service network elements, the accuracy of root cause prediction is improved, and the efficiency of fault diagnosis is increased. Attached Figure Description

[0017] Figure 1 This is a flowchart of the steps of a root cause localization method for network management provided in one embodiment of this application;

[0018] Figure 2 This is a flowchart of the steps involved in generating a fault location model according to another embodiment of this application;

[0019] Figure 3 This is a flowchart illustrating the steps involved in constructing a fault prediction sample according to another embodiment of this application;

[0020] Figure 4 This is a flowchart of the steps for filtering alarm logs provided in another embodiment of this application;

[0021] Figure 5 This is a flowchart of the steps for constructing a fault prediction sample using logs to be analyzed, provided in another embodiment of this application;

[0022] Figure 6 This is a flowchart of the log data ownership allocation steps provided in another embodiment of this application;

[0023] Figure 7 This is a schematic diagram of a log data transfer process provided in another embodiment of this application;

[0024] Figure 8 This is a flowchart of log data preprocessing steps provided in another embodiment of this application;

[0025] Figure 9This is a flowchart of the steps of a root cause localization method applied to interconnected network elements provided in another embodiment of this application;

[0026] Figure 10 This is a schematic diagram of the structure of a communication device provided in another embodiment of this application. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0028] It is understandable that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, or the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0029] This application provides a root cause localization method, communication device, and computer-readable storage medium. The method involves interconnected network elements associated with a network element experiencing a network outage reporting a first alarm log containing fault information of the out-of-network element to the network management system. Meanwhile, interconnected network elements with normal connections to the peer network element only report their own second alarm logs to the network management system. This allows the network management system to generate fault prediction samples using both the first and second alarm logs. This approach enhances the use of fault information from the out-of-network element to construct these samples, avoiding the inability to predict faults based on alarm logs related to the out-of-network element due to its failure to upload its own. By integrating information from both interconnected and out-of-network elements, the method improves the accuracy of root cause prediction and increases the efficiency of fault diagnosis.

[0030] The embodiments of this application will be further described below with reference to the accompanying drawings.

[0031] like Figure 1 As shown, Figure 1 This application provides a root cause localization method according to one embodiment. This method can be applied to a network management system connected to multiple interconnected network elements. The root cause localization method includes, but is not limited to, the following steps:

[0032] Step S100: Obtain alarm logs from multiple interconnected network elements. The alarm logs include a first alarm log and a second alarm log. The first alarm log is the alarm log of the interconnected network element that is disconnected from the peer network element. The first alarm log includes the fault information of the peer network element that is disconnected from the peer network element. The second alarm log is the alarm log of the interconnected network element that is normally connected to the peer network element.

[0033] Step S200: Construct a fault prediction sample based on the first alarm log and the second alarm log;

[0034] Step S300: Use the preset fault location model to predict the fault prediction sample to obtain the fault location prediction result.

[0035] In complex network systems, there are tens of thousands of network elements, and data flows between these elements. When a network failure occurs, the fault propagates along the network, and each node generates a large number of alarm logs and reports them to the network management system. When some nodes lose connection to the network management system, they cannot report their alarm logs, resulting in a decrease in the number of root cause prediction samples and a decline in prediction accuracy. Therefore, when an interconnected network element connected to the network management system cannot connect to its peer network element, it reports a first alarm log containing fault information of the disconnected peer. Interconnected network elements with normal connections to their peers only report their second alarm logs. The fault information in the first alarm log can be obtained from the fault codes and the address of the peer network element during the interaction between the interconnected network element and the disconnected peer. Therefore, the network management system receives both the first and second alarm logs and uses them to construct fault prediction samples. Since the first alarm log contains fault information related to the network element that is out of service, fault prediction samples related to the out-of-service network element can be constructed using this information. These generated fault prediction samples are then imported into a pre-defined fault location model for prediction, yielding the fault location prediction result. This fault location model is a graph convolutional neural network model built based on a pre-defined network topology. Therefore, compared to the scheme that relies solely on alarm logs from interconnected network elements for prediction when network elements are out of service and unable to report logs, utilizing alarm logs associated with the out-of-service network element carrying fault information, and combining the fault information from the out-of-service network element with the alarm logs from interconnected network elements for prediction, increases the number of prediction samples and improves prediction accuracy.

[0036] It should be noted that the generated fault location prediction results can include only one root cause network element, or the prediction influence of each fault prediction sample can be sorted to output multiple root cause network elements with greater influence. Furthermore, the generated fault location prediction results include the fault type corresponding to each root cause network element and the corresponding solution. The fault type can be obtained based on a pre-set interaction protocol and the alarm logs or fault information corresponding to the root cause network element. Multiple solutions can also be pre-set in the network management system, each solution corresponding to a specific fault type. Therefore, a solution matching the fault type is searched from the pre-set multiple solutions based on the fault type. When the root cause network element is predicted, the corresponding fault type and the matching solution are also determined. Therefore, this application, by providing detailed information in the root cause location prediction results, enables maintenance personnel to quickly identify the root cause network element and its fault type using the generated fault location prediction results, and to quickly restore the network system operation using the solutions in the prediction results. This improves the efficiency of system fault diagnosis, shortens the system fault recovery cycle, and enhances the user experience.

[0037] It should be noted that each interconnected network element can upload its own alarm logs to the resource record database through the log reporting interface. The network administrator can obtain the original alarm logs from the resource record database through the secure file transfer protocol and perform root cause analysis and problem localization on the alarm logs.

[0038] It should be noted that since the fault prediction samples are alarm logs and fault information in text form, rather than specific metrics such as traffic volume, success rate, latency, and system throughput, the method of obtaining fault prediction samples is simple. For alarm logs, data cleaning rules, text similarity dictionaries, and data sorting rules can be configured to obtain the required data format for constructing fault prediction samples. Therefore, compared with the scheme of constructing prediction samples using only specific metrics for root cause localization prediction, this application improves the accuracy of prediction results and has higher universality and applicability by modifying the reported data of abnormal scenarios.

[0039] Additionally, refer to Figure 2 In one embodiment, Figure 2 The generation process of the fault location model shown also includes, but is not limited to, the following steps:

[0040] Step S400: Obtain the preset prediction model;

[0041] Step S500: Construct topology data and tag files based on preset network topology relationships;

[0042] Step S600: Generate fault training samples based on the label file;

[0043] Step S700: The prediction model is trained using topological data, label files, and fault training samples to obtain the fault location model.

[0044] Each network system has a corresponding network topology relationship. The network topology relationship includes the basic information of each network element, such as host name, device name, network element code, network management address, and the relationship between each network element. Therefore, the topology data of each network element is constructed using the pre-set network topology relationship. The topology data is used for communication with other network elements and includes the project name, network element name, network element server address, subordinate relationship with other network elements, and data flow.

[0045] A fault scenario can be identified using pre-defined network topology relationships, and a corresponding tag file can be generated. The tag file includes preset root cause nodes and fault types. For example, using network topology relationships, the fault scenario can be determined as follows: at 17:29 on January 1, 2002, a virtual machine network delay fault occurred in the message processing network element numbered 127. Therefore, this fault scenario can be used as a tag file, and the tag file serves as the tag for fault training samples. The tag file contains corresponding sample directories for each network element. This fault scenario is simulated using a Robot Framework (RF), with each network element generating corresponding alarm logs. The alarm logs generated by each network element include corresponding network element identification tags. Therefore, each alarm log can be categorized into its respective sample directory based on the network element identification tags; that is, alarm logs generated for the same fault scenario form a set of fault training samples. Thus, by identifying the corresponding tag files using pre-defined network topology relationships, RF simulation generates fault scenarios corresponding to each tag file, and each network element generates corresponding alarm logs, resulting in multiple sets of fault training samples.

[0046] By extracting network element feature values ​​from topology data, label files, and fault training samples, a feature matrix can be obtained. An adjacency matrix is ​​then constructed based on the relationships between the network elements. The feature matrix and adjacency matrix are input into a pre-configured graph convolutional neural network for training, thereby obtaining a fault localization model. Therefore, the first and second alarm logs can be imported into the fault localization model for super-precision analysis. Figure 2 Classification and prediction of fault location results.

[0047] Additionally, refer to Figure 3 In one embodiment, Figure 1 Step 200 in the illustrated embodiment also includes, but is not limited to, the following steps:

[0048] Step S210: Filter the first alarm log to obtain the first log to be analyzed, and filter the second alarm log to obtain the second log to be analyzed.

[0049] Step S220: Generate a fault prediction sample based on the first log to be analyzed and the second log to be analyzed.

[0050] Because the alarm logs uploaded by network elements contain complex and disordered data, using fault prediction samples generated from this data can affect the accuracy of root cause localization predictions. Therefore, it is necessary to filter the first and second alarm logs to remove complex and disordered log data, resulting in the first and second logs to be analyzed. This improves the accuracy of the model's input data. During the filtering process, the first alarm log can either remove irrelevant fault information or retain fault information. Therefore, using the first and second logs to be analyzed to construct fault prediction samples can reduce the interference of complex and disordered data and improve the accuracy of root cause localization predictions.

[0051] Additionally, refer to Figure 4 In one embodiment, Figure 3 Step 210 in the illustrated embodiment also includes, but is not limited to, the following steps:

[0052] Step S211: Based on the preset scenario thesaurus, perform similarity matching on the first alarm log and the second alarm log to obtain similar keywords;

[0053] Step S212: Filter the first alarm log based on similar keywords to obtain the first log to be analyzed, and filter the second alarm log based on similar keywords to obtain the second log to be analyzed.

[0054] Due to the large number of network elements in the network system, it is difficult to import all the generated alarm logs into the root cause localization model for prediction. Furthermore, some alarm logs are unrelated to the root cause fault. Predicting all alarm logs would be time-consuming, and using unrelated logs for prediction would not accurately identify the root cause network element. Therefore, to quickly locate alarm logs related to the root cause fault, text similarity matching is performed on the first and second alarm logs. Various fault types are determined according to a preset interaction protocol, and corresponding scenario lexicons are constructed using fault keywords generated by each fault type. If an alarm log does not contain keywords from the preset scenario lexicon, it can be considered that the root cause network element cannot be identified through this alarm log, and therefore, this alarm log can be removed. A word vector model is used to extract word vectors from the first and second alarm logs, extracting a set of word vectors corresponding to the preset lexicon. The central keyword is determined based on the cosine distance between the word vectors in the set, and the fault scenario can be determined using the central keyword. Based on the cosine distance between the central keyword and each word vector, they are sorted from largest to smallest. The top 5 word vectors and the central keyword are selected as approximate keywords. The first and second alarm logs are searched for matches containing approximate keywords. If an alarm log contains approximate keywords, its content is considered highly correlated with the root cause network element of the current fault. Using this alarm log to generate fault prediction samples and perform root cause localization prediction can improve the accuracy of root cause localization. If an alarm log does not contain approximate keywords, its content is considered less correlated with the root cause network element of the current fault. To reduce the number of low-correlation prediction samples that could lower the accuracy of root cause localization, only alarm logs containing approximate keywords are retained, while the rest are filtered out. Therefore, the first and second alarm logs are filtered based on approximate keywords to obtain the first and second logs with a high correlation to the root cause fault. The first log contains fault information of the disconnected peer network element.

[0055] Additionally, refer to Figure 5 In one embodiment, Figure 3 Step 220 in the illustrated embodiment also includes, but is not limited to, the following steps:

[0056] Step S221: Assign the first log to be analyzed and the second log to be analyzed to the network element directory corresponding to the corresponding interconnected network element according to the network element identification tag, and assign the fault information to the network element directory corresponding to the corresponding disconnected network element according to the fault identification tag. The disconnected network element is the peer network element that is disconnected from the interconnected network element.

[0057] Step S222: Construct fault prediction samples based on log data in each network element directory.

[0058] Both the first and second logs to be analyzed contain network element identification tags, and the fault information in the first log contains fault identification tags. By reading the first and second logs line by line, the network element identification tags and fault identification tags can be obtained. Based on these tags, the network element to which each log and fault information belongs can be determined. The first and second logs are then standardized according to a preset sample content format to facilitate importing into the root cause localization model for prediction. The standardized first and second logs are then assigned to the corresponding network element directories according to their respective network element identification tags. The network element directory structure for storing fault prediction samples is the same as that for storing fault training samples.

[0059] Generally, when an interconnecting network element experiences a fault during interaction with a peer network element, such as a network outage, the interconnecting network element can determine the fault information of the peer network element based on the interaction protocol and error codes. This fault information can then be appended to its own alarm log as a special field. After being reported, all alarm logs are mixed. To extract the fault information from the first alarm log (i.e., the first log to be analyzed) for sample construction, pre-defined fields can be used to query and extract information from each log during content normalization. This allows for simultaneous content normalization and fault information extraction, improving efficiency. The fault information also includes the address of the peer network element, i.e., the fault identification tag of the network element that experienced a network outage. The fault information is extracted from the first alarm log as an independent network element log and assigned to the corresponding network element's directory according to the fault identification tag. After extracting the fault information from the first log to be analyzed, the first log to be analyzed can have its appended fault information removed and be assigned to the appropriate network element directory. Therefore, fault prediction samples can be constructed using log data in the network element catalog corresponding to each network element. This involves constructing samples using not only alarm logs from interconnected network elements but also fault information from disconnected network elements. Compared to the solution of using only alarm logs uploaded by interconnected network elements for root cause localization and prediction when network elements are disconnected and unable to upload their own logs, this method adds fault prediction samples from disconnected network elements. By combining fault prediction samples from multiple network elements, the accuracy of root cause localization and prediction can be improved.

[0060] It should be noted that fault identification tags can be extracted from fault information using preset address fields. If the fault identification tag cannot be determined from the preset address field, it can be determined from the service orchestration file based on the network element service name field.

[0061] Additionally, refer to Figure 6 In one embodiment, Figure 5 Step 221 in the illustrated embodiment also includes, but is not limited to, the following steps:

[0062] Step S223: Allocate the first log to be analyzed and the second log to be analyzed to the buffer corresponding to the corresponding interconnected network element according to the network element identification tag, and allocate the fault information to the buffer corresponding to the corresponding disconnected network element according to the fault identification tag.

[0063] Step S224: When the buffer capacity is insufficient, or when the first log to be analyzed, the second log to be analyzed, and the fault information are all allocated to the corresponding buffers, the log data of each buffer is transferred to the network element directory corresponding to each buffer.

[0064] Combination Figure 7 , Figure 7 The flowchart illustrates the log data transfer process. During the allocation of the first log to be analyzed, the second log to be analyzed, and fault information to the network element directory, to improve data transfer efficiency and avoid increasing the processing pressure on the network management system by writing each log data piece by piece to the network element directory, each network element has a corresponding buffer. After the first and second logs to be analyzed are organized and fault information is extracted, they are cached in the corresponding network element's buffer according to the network element identification tag. Simultaneously, fault information is cached in the corresponding network element's buffer according to the fault identification tag. When the buffer capacity is insufficient, the log data in that buffer is written to a temporary file, and a temporary network element tag is attached to the temporary file. Furthermore, after all log data—the first log to be analyzed, the second log to be analyzed, and the fault information—has been cached, the log data from each buffer is written to a temporary file, and a temporary network element tag is attached to each temporary file according to its corresponding network element. After all log data from all buffers has been written to temporary files, each temporary file is transferred to the corresponding network element's network element directory according to its temporary network element tag. Therefore, log data is pre-classified according to the network element it belongs to by utilizing the buffer corresponding to each network element, and log data in the buffer corresponding to the same network element are moved into the network element directory at the same time to improve data read and write efficiency.

[0065] Additionally, refer to Figure 8 In one embodiment, Figure 3 The steps preceding step 210 in the illustrated embodiment include, but are not limited to, the following steps:

[0066] Step S213: Perform data cleaning on the first alarm log and the second alarm log, so that the first alarm log after data cleaning is filtered to obtain the first log to be analyzed, and the second alarm log after data cleaning is filtered to obtain the second log to be analyzed.

[0067] The first and second alarm logs contain a large amount of messy data, such as incorrect log levels, duplicate uploaded alarm logs, empty logs, or incorrect file formats. This erroneous and messy data in the alarm logs affects the accuracy of the data, leading to a decrease in the accuracy of the constructed fault prediction samples and interfering with the output of the root cause localization model. Therefore, it is necessary to clean the first and second alarm logs to improve the accuracy of the input data for the root cause localization model. Furthermore, cleaning the first and second alarm logs facilitates subsequent filtering processes, reducing the interference of erroneous and messy data.

[0068] like Figure 9 As shown, Figure 9 This application provides a root cause localization method according to one embodiment. This method can be applied to interconnected network elements connected to the network management system. The root cause localization method includes, but is not limited to, the following steps:

[0069] Step S800: When a disconnection fault occurs between the interconnecting network element and the peer network element, the interconnecting network element generates fault information according to a preset interaction protocol.

[0070] Step S900: Generate the first alarm log based on the fault information;

[0071] Step S1000: The first alarm log is reported to the network management system so that the network management system can construct a fault prediction sample based on the first alarm log and the second alarm log, and use a preset fault location model to predict the fault prediction sample to obtain the fault location prediction result. The second alarm log is generated by the interconnected network element that is normally connected to the peer network element.

[0072] During network system operation, various network elements interact with peer network elements. When an interconnecting network element maintaining a connection with the network management system experiences a disconnection during interaction with a peer network element—for example, if the peer network element experiences a network outage—the disconnected peer network element cannot report its own alarm logs. The interconnecting network element can determine the fault information of the peer network element based on a pre-defined interaction protocol and the fault codes generated by the interaction error. Specifically, the interconnecting network element can also determine the address information of the peer network element, i.e., a fault identification tag, based on a pre-defined network topology, and add the fault identification tag to the fault information. After generating the fault information, the interconnecting network element constructs the fault information in the supplementary information of its own alarm information, thereby generating a first alarm log. This first alarm log carries the fault information of the disconnected peer network element. The interconnecting network element reports the first alarm log to the network management system through the log reporting interface, allowing the network management system to obtain the fault information of the disconnected peer network element from the first alarm log reported by the interconnecting network element. Furthermore, in the event of a network system failure, interconnected network elements that are normally connected to their peers will report their generated alarm logs, i.e., the second alarm logs, to the network management system. Therefore, after receiving the second alarm logs and the first alarm logs carrying fault information about the disconnected network elements, the network management system can construct fault prediction samples using both logs. These samples include prediction samples related to each interconnected network element and prediction samples for each disconnected network element. The generated fault prediction samples are then imported into a preset root cause localization model to obtain the fault location prediction result. By having interconnected network elements that have experienced disconnection faults construct fault information from their own alarm logs and upload them, compared to the scheme where prediction is only based on alarm logs reported by interconnected network elements when disconnected network elements cannot report their own logs, this approach utilizes the fault information of disconnected network elements for prediction, integrating log data from various network elements in the network system for root cause localization prediction, thus improving the accuracy of root cause localization.

[0073] Additionally, refer to Figure 10 , Figure 10 An embodiment of the present application provides a 1000. Figure 10 A schematic diagram of the structure of a communication device 1000 provided in an embodiment of this application is shown. The communication device 1000 includes: a memory 1010, a processor 1020, and a computer program stored in the memory 1010 and executable on the processor 1020.

[0074] The processor 1020 and the memory 1010 can be connected via a bus or other means.

[0075] The non-transient software program and instructions required to implement the software upgrade method of the above embodiments are stored in the memory 1010. When executed by the processor 1020, the root cause localization method in the above embodiments is executed, for example, the method described above is executed. Figure 1 Method steps S100 to S300 in the above method steps Figure 2 Method steps S400 to S700 in the middle Figure 3 Method steps S210 to S220 in the middle Figure 4 Method steps S211 to S212 in the middle Figure 5 Method steps S221 to S222 in the middle Figure 6 Method steps S223 to S224 in the middle. Figure 7 The root cause localization method in step S213 of the method or such Figure 8 The root cause localization method in steps S800 to S1000 of the method.

[0076] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0077] Furthermore, one embodiment of this application also provides a computer-readable storage medium storing computer-executable instructions that are executed by a processor or controller, for example, by a processor in the above embodiments, causing the processor to perform the root cause localization method described above, for example, performing the above-described... Figure 1 Method steps S100 to S300 in the above method steps Figure 2 Method steps S400 to S700 in the middle Figure 3 Method steps S210 to S220 in the middle Figure 4 Method steps S211 to S212 in the middle Figure 5 Method steps S221 to S222 in the middle Figure 6 Method steps S223 to S224 in the middle. Figure 8 The root cause localization method in step S213 of the method or such Figure 9The root cause localization method comprises steps S800 to S1000. Those skilled in the art will understand that all or some of the steps and systems disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible by a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

Claims

1. A root cause localization method, applied to a network management system, wherein the network management system is connected to multiple interconnected network elements; The root cause localization method includes: Obtain alarm logs from multiple interconnected network elements. The alarm logs include a first alarm log and a second alarm log. The first alarm log is the alarm log of the interconnected network element that is disconnected from the peer network element. The first alarm log includes fault information of the peer network element that is disconnected from the interconnected network element. The second alarm log is the alarm log of the interconnected network element that is normally connected to the peer network element. Construct a fault prediction sample based on the first alarm log and the second alarm log; The fault prediction sample is predicted using a preset fault location model to obtain the fault location prediction result.

2. The root cause localization method according to claim 1, characterized in that, The fault location model is generated by the following steps: Obtain the preset prediction model; Topology data and tag files are constructed based on preset network topology relationships; Fault training samples are generated based on the label file; The prediction model is trained using the topology data, the label file, and the fault training samples to obtain the fault location model.

3. The root cause localization method according to claim 1, characterized in that, The step of constructing a fault prediction sample based on the first alarm log and the second alarm log includes: The first alarm log is filtered to obtain the first log to be analyzed, and the second alarm log is filtered to obtain the second log to be analyzed. A fault prediction sample is generated based on the first log to be analyzed and the second log to be analyzed.

4. The root cause localization method according to claim 3, characterized in that, The step of filtering the first alarm log to obtain the first log to be analyzed, and filtering the second alarm log to obtain the second log to be analyzed, includes: Based on a preset scenario thesaurus, similarity matching is performed on the first alarm log and the second alarm log to obtain similar keywords; The first alarm log is filtered based on the approximate keywords to obtain the first log to be analyzed, and the second alarm log is filtered based on the approximate keywords to obtain the second log to be analyzed.

5. The root cause localization method according to claim 3, characterized in that, Both the first alarm log and the second alarm log include network element identification tags, and the fault information includes fault identification tags; The step of generating a fault prediction sample based on the first log to be analyzed and the second log to be analyzed includes: The first log to be analyzed and the second log to be analyzed are assigned to the network element directory corresponding to the interconnected network element according to the network element identification tag, and the fault information is assigned to the network element directory corresponding to the disconnected network element according to the fault identification tag, wherein the disconnected network element is the peer network element that is disconnected from the interconnected network element; Fault prediction samples are constructed based on the log data in each of the network element directories.

6. The root cause localization method according to claim 5, characterized in that, The step of allocating the first log to be analyzed and the second log to be analyzed to the network element directory corresponding to the corresponding interconnected network element according to the network element identification tag, and allocating the fault information to the network element directory corresponding to the corresponding disconnected network element according to the fault identification tag, includes: The first log to be analyzed and the second log to be analyzed are assigned to the buffer corresponding to the interconnected network element according to the network element identification tag, and the fault information is assigned to the buffer corresponding to the disconnected network element according to the fault identification tag. When the capacity of the buffer is insufficient, or when the first log to be analyzed, the second log to be analyzed, and the fault information are all allocated to the corresponding buffer, the log data of each buffer is transferred to the network element directory corresponding to each buffer.

7. The root cause localization method according to claim 3, characterized in that, Before filtering the first alarm log to obtain the first log to be analyzed, and filtering the second alarm log to obtain the second log to be analyzed, the process includes: The first alarm log and the second alarm log are cleaned so that the first alarm log after data cleaning is filtered to obtain the first log to be analyzed, and the second alarm log after data cleaning is filtered to obtain the second log to be analyzed.

8. A root cause localization method applied to an interconnected network element, wherein the interconnected network element is connected to a network management system, the root cause localization method comprising: When the interconnecting network element experiences a disconnection fault with the peer network element, the interconnecting network element generates fault information according to a preset interaction protocol; A first alarm log is generated based on the fault information; The first alarm log is reported to the network management system so that the network management system can construct a fault prediction sample based on the first alarm log and the second alarm log, and use a preset fault location model to predict the fault prediction sample to obtain a fault location prediction result. The second alarm log is generated by the interconnecting network element that is normally connected to the peer network element.

9. A communication device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the computer program, it implements the root cause localization method as described in any one of claims 1 to 7 or the root cause localization method as described in claim 8.

10. A computer-readable storage medium storing computer-executable instructions for performing the root cause localization method as claimed in any one of claims 1 to 7 or the root cause localization method as claimed in claim 8.

Images