Early warning method, device, medium and product for NFV network performance degradation

Abstract

The application discloses a kind of early warning method, device, medium and product of NFV network performance degradation, by the performance data and log data of the network element to be monitored in NFV network are collected, obtain the log amount statistical data of sub-log template;According to the all log template list in incremental log template monitoring configuration table and slice log quantity monitoring configuration table, the log amount statistical data is extracted, and log statistical data is obtained;According to the first matching rule of preset and incremental log template monitoring configuration table, determine the first matching template set;According to the template matching of first matching template set to log statistical data, and according to the index of the template matched in incremental log template monitoring configuration table, generate degradation early warning information.This application scheme can early warn before index degradation, improve early warning accuracy.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication technology, in particular to a method and device for early warning of performance degradation of an NFV network, a medium and a product. BACKGROUND

[0002] In a mobile communication network, the NFV (Network Functions Virtualization) technology abstracts physical servers, storages and network devices into virtual resources at the hardware layer, utilizes virtual machine managers and other components to coordinate the creation, scheduling and destruction of virtual machines at the virtualization layer, and provides virtual AMF, MME, PCF, PCRF, UDM, AUSF, HSS, UPF, GW-U, SMF, GW-C, NEF, NRF, NSSF and other network functions at the virtual network function layer.

[0003] While the NFV technology provides higher flexibility and scalability for the network, the performance monitoring of network resources at each layer also faces great challenges with the increase in the types and number of virtualized network elements. The performance monitoring in the NFV network includes not only the PM indicators such as CPU utilization, memory utilization and disk utilization in the traditional IT system performance monitoring scenarios, but also various performance indicators related to the business functions of various virtualized network elements, such as throughput, delay, packet loss rate and success rate of each signaling process.

[0004] The prior art can only produce monitoring and early warning after performance degradation occurs or at least when there are slight performance degradation symptoms before serious performance degradation occurs based on preset early warning thresholds, and cannot provide early warning for sudden serious network performance problems. SUMMARY

[0005] Compared with the prior art, the present application provides a method and device for early warning of performance degradation of an NFV network, which can provide early warning before the indicators degrade and improve the accuracy of early warning.

[0006] The present application provides a method for early warning of performance degradation of an NFV network, which comprises:

[0007] Collecting performance data and log data of a network element to be monitored in the NFV network to obtain log volume statistical data of a log template;

[0008] Log volume statistics are extracted from the list of all log templates in the incremental log template monitoring configuration table and the slice log quantity monitoring configuration table to obtain log statistics. The incremental log template monitoring configuration table is obtained by statistically analyzing historical log data using preset degradation threshold rules, and the slice log quantity monitoring configuration table is obtained by statistically analyzing historical log data using preset monitoring rules.

[0009] Based on the incremental log template monitoring configuration table and the preset first matching rule, determine the first matching template set;

[0010] The log statistics data are matched with the first set of matching templates, and degradation warning information is generated based on the indicators in the incremental log template monitoring configuration table according to the matched templates.

[0011] Preferably, the method further includes:

[0012] Based on the slice log quantity monitoring configuration table and the preset second matching rule, determine the second matching template set;

[0013] The log statistics data are matched using the second matching template set, and degradation warning information is generated based on the indicators in the slice log quantity monitoring configuration table according to the matched template.

[0014] Preferably, performance data and log data of the network elements to be monitored in the NFV network are collected to obtain log volume statistics for each log template, including:

[0015] Based on the pre-configured list of performance indicators to be analyzed, PM data is collected and stored at different continuous periods.

[0016] Based on the network element type and network element name information in the list of performance indicators to be analyzed, all log data of each network element are continuously accessed.

[0017] Based on the preset log template extraction algorithm, the template is extracted from each group of log text in all log data to obtain the log template, and a list of log templates is obtained.

[0018] Based on the log gateway template list, and according to the preset log monitoring time window granularity, log volume is grouped and statistically analyzed within each unit time window slice. The statistical results are stored in the data warehouse to obtain log volume statistics for each log template.

[0019] Preferably, the step of extracting templates from each group of log text in all log data according to a preset log template extraction algorithm to obtain a log template list includes:

[0020] The collected log data is grouped according to different network element types and log types. For the full log data in each group, the log template extraction algorithm is introduced to extract the template from the log text of each group to obtain the log template, and thus obtain the log template list.

[0021] The log template includes network element type, network element name, log type, log template ID, and log text template expression.

[0022] Preferably, the statistical process of the incremental log template monitoring configuration table includes:

[0023] The degradation threshold rule is used to detect whether each time slice in the historical log data, divided according to a preset monitoring time granularity, has deteriorated, and the abnormal range of each degradation index is recorded; the historical log data is historical data continuously collected according to a preset degradation identification duration;

[0024] Extract log statistics data for the preset duration preceding each abnormal interval of an indicator;

[0025] Each extracted log statistical data point is grouped by indicator name and written as incremental data into the PM indicator degradation event sample library;

[0026] List all log templates that appear within the time period of the degradation identification duration, and calculate the minimum and maximum values ​​of the monitored log volume for each log template within the preset log monitoring time window granularity to obtain the incremental PM baseline sample interval log template statistics table indexed by template ID within this time period;

[0027] The incremental PM baseline sample interval log template statistics table obtained within each log monitoring time window is accumulated to obtain the cumulative PM baseline sample interval log template statistics table, and all index template IDs in the updated cumulative PM baseline sample interval log template statistics table are set as the PM baseline sample interval template set.

[0028] Set the log volume monitoring rules according to the preset log volume monitoring rule annotation information;

[0029] For each abnormal interval of the deteriorating indicator, extract the set of templates that appear in the interval within the log monitoring time window granularity.

[0030] Calculate the subset of the template set for each interval and the template set extracted from the interval at the granularity of the previous log monitoring time window;

[0031] The complement of the calculated complement set and the complement set of the PM baseline sample interval template set;

[0032] The template list and slice log volume information in the obtained set are used as the first output result data, and the time period information of the log monitoring time window granularity range in which each template in the template list of the set first appears within the abnormal range of the above indicators is used as the second output result data.

[0033] When there is more than one log template in the first output result data, the rule category is set to incremental log template monitoring rule;

[0034] Count the number of times each template appears in multiple events, and sort the average slice log volume of each template in the list in ascending order according to the number of occurrences in descending order;

[0035] Delete the templates in the list whose valid status is set to no in the log volume monitoring rules, and select the templates in the log volume monitoring rules that automatically configure the upper limit of the number of incremental templates for monitoring single indicators according to the order of the list to obtain the incremental log template monitoring configuration table.

[0036] Furthermore, after obtaining the incremental log template monitoring configuration table, the method further includes:

[0037] Update the occurrence count and average slice log volume of templates marked as valid (yes or no) in the incremental log template monitoring configuration table;

[0038] Recalculate the incremental log template monitoring configuration table and set the statistics of the incremental log template monitoring configuration table to an inactive state.

[0039] Preferably, the statistical process of the slice log quantity monitoring configuration table includes:

[0040] When the number of templates in the first output result data is empty, the configuration table for monitoring the number of slice logs is empty.

[0041] When there is more than one log template in the first output result data, record the list of abnormal templates for each event in the second output result data;

[0042] Count the number of times each template appears in multiple events, and sort the average slice log volume of each template in the list in ascending order according to the number of occurrences in descending order;

[0043] Delete the templates in the list whose valid status is set to no in the log volume monitoring rules, and select the templates in the log volume monitoring rules that automatically configure the upper limit of the single indicator monitoring increment templates according to the order of the list to obtain the slice log volume monitoring configuration table.

[0044] Furthermore, after obtaining the slice log quantity monitoring configuration table, the method further includes:

[0045] Update the cumulative number of anomalies and the average percentage of anomalies in the slice log volume for templates marked with a valid status of "yes" or "no" in the slice log volume monitoring configuration table. For items marked with a valid status of "not marked", automatically update the upper and lower limits of the warning threshold parameters.

[0046] Set the rule for combining incremental templates in the log volume monitoring rules to "yes" and continue to recalculate the configuration table for monitoring the number of sliced ​​logs.

[0047] Preferably, the first matching template set is determined according to the matching rules configured in the incremental log template monitoring configuration table, specifically including:

[0048] In all rules of the PM indicator early warning category set for incremental log template monitoring rules, select the rules configured as enabled for monitoring and early warning.

[0049] Take the union of the slice log templates with the maximum number of single-index automatic configuration monitoring incremental templates in the sorting rules of the incremental log template monitoring configuration table for each rule, and use it as the first matching template set.

[0050] Preferably, the second matching template set is determined according to the matching rules configured in the slice log quantity monitoring configuration table, specifically including:

[0051] In all rules of the PM indicator warning category set as the log volume monitoring rule, select the rule configured as the enabled monitoring and warning rule;

[0052] Take the union of the maximum number of slice log templates for the single-index automatic configuration monitoring incremental template in the sorting rules of the slice log quantity monitoring configuration table for each rule, and use it as the second matching template set.

[0053] Preferably, the method further includes:

[0054] The collected PM indicators are monitored using a preset early warning period for PM indicators as the warning time limit.

[0055] When a deterioration warning message is generated within the warning time limit, the number of successful warnings is recorded cumulatively.

[0056] If no degradation warning information is generated within the warning time limit, the number of warning errors is recorded cumulatively.

[0057] The warning information will be set to inactive when the warning period ends.

[0058] Preferably, the step of performing template matching on the log statistics data according to the second matching template set, and generating degradation warning information based on the indicators in the slice log quantity monitoring configuration table according to the matched template, includes:

[0059] The log statistics data are used to identify log volume anomalies based on the second matching template set;

[0060] When an anomaly is identified, list all PM metrics in the entire configuration table that are no / yes for the template with the anomaly and whose condition is OR, and generate performance degradation warning information.

[0061] For PM indicators where the configuration item is "yes" and the condition is "AND", the first M slice log templates in the sorting rules of the incremental log template monitoring configuration table are selected according to the rules of the indicator. The templates are matched with the log statistics data, and deterioration warning information is generated based on the indicators in the incremental log template monitoring configuration table according to the matched templates.

[0062] For PM metrics where the configuration item for whether to use the incremental template rule is yes and the condition is OR, the top M slice log templates in the sorting rules of the incremental log template monitoring configuration table are selected, and template matching is performed with the log statistics data. Based on the matched templates, degradation warning information is generated according to the metrics in the incremental log template monitoring configuration table.

[0063] This invention also provides an early warning device for NFV network performance degradation, the device comprising:

[0064] The data acquisition module is used to collect performance data and log data of the network elements to be monitored in the NFV network, and obtain log volume statistics of the log template.

[0065] The extraction module is used to extract the log volume statistics based on the list of all log templates in the incremental log template monitoring configuration table and the slice log quantity monitoring configuration table to obtain log statistics. The incremental log template monitoring configuration table is obtained by statistically analyzing historical log data using preset degradation threshold rules, and the slice log quantity monitoring configuration table is obtained by statistically analyzing historical log data using preset monitoring rules.

[0066] The set module is used to determine the first matching template set based on the incremental log template monitoring configuration table and the preset first matching rule;

[0067] The matching module is used to perform template matching on the log statistics data according to the first matching template set, and generate degradation warning information based on the indicators in the incremental log template monitoring configuration table according to the matched template.

[0068] This invention also provides an early warning device for NFV network performance degradation, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements an early warning method for NFV network performance degradation as described in any of the above embodiments.

[0069] This invention also provides a computer-readable storage medium, which includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform an early warning method for NFV network performance degradation as described in any of the above embodiments.

[0070] This invention also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the method described in any of the above embodiments.

[0071] Compared with existing technologies, this invention provides a method, device, medium, and product for early warning of NFV network performance degradation. It collects performance data and log data from network elements to be monitored in the NFV network to obtain log volume statistics for different log templates. Log volume statistics are extracted from the log volume statistics based on a list of all log templates in an incremental log template monitoring configuration table and a slice log quantity monitoring configuration table to obtain log statistics. The incremental log template monitoring configuration table is obtained by statistically analyzing historical log data using preset degradation threshold rules, and the slice log quantity monitoring configuration table is obtained by statistically analyzing historical log data using preset monitoring rules. A first matching template set is determined based on the incremental log template monitoring configuration table and a preset first matching rule. Template matching is performed on the log statistics based on the first matching template set, and degradation early warning information is generated based on the indicators in the incremental log template monitoring configuration table of the matched templates. This solution can provide early warning before indicator degradation, improving the accuracy of early warnings. Attached Figure Description

[0072] Figure 1 This is a flowchart illustrating an early warning method for NFV network performance degradation provided in an embodiment of the present invention.

[0073] Figure 2 This is a schematic diagram of time slice data identified by the incremental log template provided in this embodiment of the invention;

[0074] Figure 3 This is a schematic diagram of the baseline sample interval provided in an embodiment of the present invention;

[0075] Figure 4 This is a schematic diagram of time slicing for anomaly detection of slice log volume provided in an embodiment of the present invention;

[0076] Figure 5 This is a schematic diagram of the structure of an early warning device for NFV network performance degradation provided in an embodiment of the present invention;

[0077] Figure 6 This is another structural schematic diagram of an early warning device for NFV network performance degradation provided in an embodiment of the present invention. Detailed Implementation

[0078] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0079] See Figure 1 This is a flowchart illustrating an early warning method for NFV network performance degradation provided in an embodiment of the present invention, the method comprising steps S1 to S4;

[0080] S1, collect performance data and log data of the network elements to be monitored in the NFV network, and obtain log volume statistics of the log template;

[0081] S2, extract the log volume statistics based on the list of all log templates in the incremental log template monitoring configuration table and the slice log quantity monitoring configuration table to obtain log statistics; wherein, the incremental log template monitoring configuration table is obtained by statistically analyzing historical log data using preset degradation threshold rules, and the slice log quantity monitoring configuration table is obtained by statistically analyzing historical log data using preset monitoring rules;

[0082] S3, determine the first matching template set according to the incremental log template monitoring configuration table and the preset first matching rule;

[0083] S4, perform template matching on the log statistics data according to the first matching template set, and generate deterioration warning information based on the indicators in the incremental log template monitoring configuration table according to the matched template.

[0084] In this specific implementation, the performance data and log data of the network elements to be monitored in the NFV network are continuously collected and stored. After preprocessing the original log data, the log volume statistics of the log template are obtained.

[0085] An incremental log template monitoring configuration table is obtained by statistically analyzing historical log data based on preset degradation threshold rules;

[0086] Within each T2 time slice of each type of network element, log volume statistics are extracted from the list of all log templates in the incremental log template monitoring configuration table and the slice log quantity monitoring configuration table to obtain log statistics data.

[0087] Based on the matching rules configured in the incremental log template monitoring configuration table, a first matching template set is determined. The first matching template set is used to identify abnormal data.

[0088] Based on the first set of matching templates, template matching is performed on the extracted log statistics. Once any template in the set is matched, all PM metrics belonging to that template in the full configuration table are listed, and deterioration warning information for each PM performance metric is generated.

[0089] This application proposes a method for providing early warnings of PM (Progressive PM) metric degradation by comparing the newly added log text expressions (i.e., incremental log template lists) with the previous time slice after monitoring. Since only specific log text expressions need to be identified, this method facilitates parallel and efficient processing and monitoring of log data, effectively adding log information as a monitoring parameter for PM metric early warning while still controlling the computational cost of data processing.

[0090] In another embodiment of the present invention, when issuing an early warning, a second matching template set is determined by matching according to the slice log quantity monitoring configuration table and the preset second matching rule, and the matching template set is used for abnormal template identification.

[0091] The log statistics data are matched using the second matching template set, and degradation warning information is generated based on the indicators in the slice log quantity monitoring configuration table according to the matched template.

[0092] This solution directly processes all log data into serialized data based on log templates for analysis and early warning. By configuring "incremental log template monitoring" and "slice log quantity monitoring" rules, this solution detects log anomalies and issues early warnings based on these rules, resulting in lower computing power overhead when dealing with massive logs from various network elements connected in NFV networks.

[0093] In another embodiment provided by the present invention, step S1 specifically includes the following steps:

[0094] PM data collection and storage involves continuously collecting and storing PM data at time granularities of 15 minutes / hour / day, based on the [network element level, network element type, network element name, indicator name, and collection time granularity] information configured in the preset list of performance indicators to be analyzed.

[0095] Log data collection, storage, and preprocessing are performed. First, log data is collected and stored, which means continuously accessing all log data of each network element based on the network element type and network element name information in the list of performance indicators to be analyzed.

[0096] Next, log template extraction is performed. Based on the preset log template extraction algorithm, templates are extracted from each group of log text in all log data to obtain log templates and a list of log templates is obtained.

[0097] Based on the obtained log gateway template list, and according to the preset log monitoring time window granularity T2, such as 5 minutes, within each unit time window slice, log volume grouping statistics are implemented down to the network element + template dimension, and the statistical results are stored in the data warehouse. The data model includes at least the following information: [network element type, network element name, log type, log template ID, log volume, monitoring time window granularity].

[0098] By continuously collecting and storing performance data and log data of network elements to be monitored in the NFV network, and preprocessing the raw log data, log volume statistics of sub-log templates are obtained, which facilitates early warning identification.

[0099] In another embodiment provided by the present invention, the process of generating a log gate template list specifically includes:

[0100] The collected log data is grouped according to different network element types and log types. In the initial state, historical log data for a time period of "preset template extraction duration 1" is continuously collected. The logs collected within the time period are grouped according to different [network element type, log type]. For the full log data in each group, a log template extraction algorithm (such as Drain3) is introduced to extract the template from the log text of each group to obtain the log template. The content includes [network element type, network element name, log type, log template ID, log text template expression], resulting in an initialized log template list.

[0101] Among them, "log type" is a classification of log attributes: such as operation log, security log, operation log, alarm log, event log, etc.

[0102] The specific "log body template expression" is a log text matching expression that includes keywords and various variables such as time, numbers, and string wildcards.

[0103] For example: [<:TIME:>][<:NUM:>][WARN][<:NUM:>][iod_monitor.c<:NUM:>checkDetectReqAndTimer]IOD<:*:>has been blocked for about<:PERIOD:>detectpriority<:NUM:>current running req(pid:<:NUM:>name:RunTask<:*:>.

[0104] Then, after continuously collecting historical log data for a period of "preset template extraction duration 2" and filtering out logs that do not match the existing log templates, incremental templates are extracted using the same method as in the initial state and added to the log gate template list to supplement the log gate template list.

[0105] In another embodiment provided by the present invention, the statistical process of the incremental log template monitoring configuration table includes the following steps:

[0106] First, automatically process the relevant data on historical PM index deterioration events;

[0107] This includes historical PM indicator degradation identification. Specifically, after continuously collecting historical PM data for a preset degradation identification period according to the list of performance indicators to be analyzed, it determines whether indicator degradation exists within each time slice of that period based on the PM indicator quality poorness threshold in the basic configuration information and the "monitoring time granularity" of each indicator. It then records the abnormal intervals for each PM indicator. See also... Figure 2 This is a schematic diagram of time slice data for incremental log template discrimination provided in this embodiment of the invention. Each PM indicator abnormal interval is... Figure 2 The T1 interval in the middle.

[0108] Next, log statistics are extracted. For each abnormal interval of a recorded PM indicator, log statistics within interval T1 and the preceding N*T1+T2 are extracted, where N is the "preset early warning period" for each indicator. Figure 2 In the given N=2, T2 is the "preset log monitoring time window granularity", and T1=k*T2, where k is an integer and k>=1.

[0109] Then, the PM indicator degradation event sample library is updated. The log statistics data related to each batch of PM indicator degradation events extracted above and the PM indicators in the corresponding intervals are grouped by indicator name and written as incremental data into the "PM indicator degradation event sample library" established with [network element level, network element type, network element name, indicator name] as the index.

[0110] Then, update the PM baseline sample interval data, which involves listing all log template sets that have appeared in all baseline sample intervals within the preset degradation identification time period. See [link / reference]. Figure 3 This is a schematic diagram of the baseline sample interval provided in this embodiment of the invention. The minimum and maximum values ​​of the monitoring log volume for each log template within all T2 slices of the interval are statistically analyzed. An incremental PM baseline sample interval log template statistical table indexed by template ID is obtained for this time period. This statistical table is compared with the cumulative PM baseline sample interval log template statistical table to obtain an updated cumulative PM baseline sample interval log template statistical table, which includes the incremental template ID and updates the minimum and maximum value records for each template.

[0111] Then, the PM baseline sample interval template set is automatically set, that is, all index template IDs in the cumulative PM baseline sample interval log template statistics table after each iteration are set as the PM baseline sample interval template set.

[0112] Based on the configuration information in the log volume monitoring rule labeling information table regarding whether each template has a warning upper limit and a warning lower limit configured, the log volume monitoring rules are set. The configuration parameters include "Yes," "No," and "Not Labeled." The initialization status of all labeling information can be set to "Not Labeled."

[0113] Table 1 Examples of Log Volume Monitoring Rules

[0114] Template ID Upper limit of early warning threshold Lower limit of early warning threshold 001 xxx xx 002 xxx Null 003 Null xx

[0115] Table 2 Example of Log Volume Monitoring Rule Labeling Information

[0116] Template ID Whether to configure the upper limit of early warning Whether to configure the lower limit of early warning 001 Yes Yes 002 Yes No 003 No Unlabeled

[0117] The expert experience configuration adjustment unit can be used for modification. For configuration parameters that are "yes" or "unmarked", the threshold value will be assigned the corresponding maximum and minimum values ​​from the cumulative PM baseline sample interval log template statistics table. For configuration parameters that are "no", the threshold value will be set to Null.

[0118] Then, the incremental log template monitoring rules are automatically configured, and all sample data under each index category in the "PM index deterioration event sample library" are processed automatically in sequence.

[0119] like Figure 2 As shown, from each PM indicator abnormal event, the N*T1 interval, i.e. Figure 2Extract the template set appearing in each T2 interval from the template log statistics within the dashed background interval. Calculate the complement of this interval and the template set of the previous T2 interval. Further calculate the complement of this complement and the template set of the PM baseline sample interval. Use the template list and slice log volume information in the obtained set as the first output result data R1, and use the T2 interval time period information of the first appearance of each template in the set template list within the above N*T1 interval as the second output result data R2. For example... Figure 2 In the given example, templates with IDs 006 and 002 should be recorded in R1, but template 004 does not need to be recorded; in R2, the information of the first T2 time period should be recorded for template 006.

[0120] If there is more than one log template in the result data R1, the rule category should be set to incremental log template monitoring rule.

[0121] Based on the template list recorded in each event in the first output result data R1, the number of times each template appears in multiple events is counted, and the templates are sorted in descending order of the number of occurrences and ascending order of the average slice log volume of each template in the list. Templates whose valid status is set to no by the expert experience configuration adjustment unit in this PM indicator rule are excluded. The maximum number of incremental monitoring templates is automatically configured according to the preset single indicator, i.e., M. The top M items are written into the incremental log template monitoring configuration table to obtain the incremental log template monitoring configuration table.

[0122] By performing a differential comparison between samples corresponding to the PM index deterioration range and samples from the PM index normal range, early warning rules can be automatically mined. This solves the problem of manually extracting rules from the massive logs of various network elements in the NFV system.

[0123] In another embodiment of the present invention, after obtaining the incremental log template monitoring configuration table, the method further includes:

[0124] Update the configuration table to include the occurrence count and average slice log volume information for templates whose validity status is marked as either yes or no.

[0125] After completing the writing process of the "Incremental Log Template Monitoring Configuration Table", the incremental log template monitoring configuration table is still written according to the normal process, but the configuration table is set to an inactive state.

[0126] In another embodiment provided by this invention, some steps of the statistical process of the slice log quantity monitoring configuration table overlap with the statistical process of the incremental log template monitoring configuration table, with the specific difference being:

[0127] After taking the template list and slice log volume information in the obtained set as the first output result data, and taking the time period information of the log monitoring time window granularity interval where each template in the template list of the set first appears in the above indicator abnormal interval as the second output result data;

[0128] See Figure 4 This is a schematic diagram of time slicing for anomaly detection of slice log volume provided in an embodiment of the present invention.

[0129] From the template log statistics of each T2 interval within the N*T1 interval (dashed background interval) of each PM indicator anomaly event, extract the sub-template log volume statistics within that interval, and determine whether the log volume of each template is abnormal based on the "log volume monitoring rules" for each template. Use the template list and its log volume information in the anomaly set as output result data R1, and use the T2 interval time period information of the first occurrence of abnormal log volume for each template in the template list within the above N*T1 interval as output result data R2. For example... Figure 4 In the given example, R1 should record the templates marked A and B in the graph, but not the templates marked D and E; in R2, for the template of item 6 (corresponding to the black bar), the T2 time period information marked A should be recorded.

[0130] If the template list in all result data R1 is empty, jump to the automatic configuration step of the slice log quantity monitoring rule, and the statistical slice log quantity monitoring configuration table is empty.

[0131] When there is more than one log template in the first output result data, record the list of abnormal templates for each event in the second output result data;

[0132] The number of times each template appears in multiple events is counted, and then the templates are sorted in descending order of the number of times they appear and in descending order of the absolute value of the average percentage of abnormal slice log volume for each template in the list. Templates whose "mark as valid status" is set to no in this PM indicator rule by the expert experience configuration adjustment unit are excluded. Then, the Top M items are selected according to the preset single indicator automatic configuration monitoring log volume abnormal template number upper limit and written into the slice log volume monitoring configuration table to obtain the slice log volume monitoring configuration table.

[0133] It should be noted that the interactive basic input configuration, incremental log template monitoring rule annotation, and slice log volume monitoring rule annotation functions are provided via web services, specifically including:

[0134] The basic input configuration provides an interface for configuring various preset parameters for the data collection and preprocessing unit and the automatic configuration unit for early warning rules. In addition, it offers query and configuration modification functions for the "List of Performance Indicators to be Analyzed," as well as query and configuration modification functions for parameters such as the "PM indicator quality poor threshold" and "PM indicator early warning cycle" for each indicator.

[0135] The monitoring rule annotation process provides an interactive configuration page. For each PM indicator to be analyzed, users can view its latest status and alert rules. The alert rules are configured based on the previous expert experience and the update results of each alert rule auto-configuration unit. The rules are divided into two categories: "Incremental Log Template Monitoring" and "Slice Log Volume Monitoring." These can be configured to a fixed category based on expert experience. Items not configured are automatically determined by the alert rule auto-configuration unit.

[0136] The incremental log template monitoring rule annotation page includes a historical degradation event timeline for the PM metric and a rule-related information query and settings area.

[0137] The timeline area allows you to query the abnormal intervals of each PM indicator in history. Based on the results data in 2.2 and 2.3, R2 marks the location of the "incremental log template" monitoring anomaly in the N T2 intervals before each T1 interval. By default, the timeline can locate the most recent PM degradation interval.

[0138] The query settings area displays information on the number of historical successful alerts and the number of alert errors, as well as the current rules' "Incremental Log Template Monitoring Configuration Table" and "Slice Log Quantity Monitoring Configuration Table" information, whether the monitoring rules are automatically updated, whether the monitoring and alert rules are enabled, whether the slice log quantity rules are combined, the PM indicator quality threshold, the PM indicator early warning cycle, and other configuration and parameter configurations and parameters, and provides corresponding modification or input options.

[0139] The "Incremental Log Template Monitoring Configuration Table" presents all log templates in the current configuration table, sorted sequentially by their valid status (in the order of Yes, Unmarked, No), the number of times the template appears in descending order, and the average number of log slices for each template in the list in ascending order. The "Valid Status" and "Remarks" information for each template row in the table can be modified based on expert experience. The presentation and configuration method of the "Log Slice Quantity Monitoring Configuration Table" is the same as described in section b) below.

[0140] By default, only the "Incremental Log Template Monitoring Configuration Table" is active. When the "Whether to Combine Slice Log Quantity Rules" option is marked as yes, the "Slice Log Quantity Monitoring Configuration Table" can also be active, and the conditions for generating warning information can be configured as the "AND" logic of the two.

[0141] In the configuration list, the templates listed earlier in the order are considered key log templates for alerting PM degradation. Optionally, the priority of each log template can be configured in the list, and priority information can be included in the sorting to ensure that high-priority templates are always applied first for monitoring and alerting.

[0142] Segment log volume monitoring rule annotation. The components and interaction logic of the configuration page for segment log volume monitoring rules are largely the same as those for incremental log template monitoring rules.

[0143] The "Segment Log Quantity Monitoring Configuration Table" presents all log templates in the current configuration table, sorted in descending order by their marked validity status (in the order of Yes, Unmarked, No), template occurrence frequency, and the absolute value of the average segment log quantity anomaly percentage for each template in the list. Based on expert experience, information such as the "Upper Warning Threshold," "Lower Warning Threshold," "Marked Validity Status," and "Remarks" for each template row in the table can be modified. The referenced "Log Quantity Monitoring Rules" and "Log Quantity Monitoring Rule Marking Information" tables are updated synchronously based on the modifications.

[0144] For warning thresholds, three states are distinguished by different background colors: fixed value set by experts, threshold value canceled, and threshold value not set by experts. In the template where "marked as valid" is "unmarked" and the template where "marked as valid" is "yes", the upper and lower warning threshold parameters are automatically updated by the "warning rule automatic configuration unit".

[0145] By default, only the "Slice Log Quantity Monitoring Configuration Table" is active. When the "Whether to Combine Incremental Template Rules" option is marked as yes, the "Incremental Log Template Monitoring Configuration Table" can also be active, and the conditions for generating warning information can be configured as "AND" or "OR" logic of the two.

[0146] This approach combines an efficient presentation method for rules obtained through automated mining with a flexible and simplified expert experience annotation interaction method. By organically integrating the expert experience configuration adjustment unit with the configuration table and interactive configuration interface of the corresponding rules in the automatic configuration unit for early warning rules, it solves the problems of difficulty in interpreting and determining the effectiveness of automatically mined rules. This results in high interpretability of early warning rules.

[0147] In another embodiment of the present invention, after obtaining the slice log quantity monitoring configuration table, the method further includes:

[0148] Update the configuration table with information such as the cumulative number of anomalies and the average percentage of anomalies in the slice log volume for templates with "marked valid status" set to "yes" or "no". Automatically update the upper and lower warning threshold parameters for items with "marked valid status" set to "not marked".

[0149] After completing the writing process of the "Slice Log Quantity Monitoring Configuration Table", for the PM indicator in the slice log quantity monitoring rules where the "Whether to combine incremental template rules" option is set to "Yes", the "Whether to combine incremental template rules" option in the log quantity monitoring rules is set to "Yes", and the slice log quantity monitoring configuration table is re-statisticalized. There is no need for the complement of this set and the "PM baseline sample interval template set" in the process.

[0150] In another embodiment of the present invention, the following steps are specifically performed when determining the first matching template set:

[0151] Among all rules in the PM indicator early warning category that are for incremental log template monitoring, select the rules whose "Monitoring and early warning rule is enabled" setting is enabled;

[0152] The first set of matching templates is the union of the top M log templates in the sorting rule of the incremental log template monitoring configuration table for each rule.

[0153] Where M represents the maximum number of incremental templates for automatic configuration monitoring of a single indicator.

[0154] Based on the first set of matching templates, template matching is performed on the extracted log statistics. Once any template in the set is matched, all PM metrics belonging to that template in the full configuration table are listed, and deterioration warning information for each PM performance metric is generated.

[0155] In yet another embodiment of the present invention, determining the second matching template set specifically includes the following steps:

[0156] Among all rules in the PM indicator warning category "slice log volume monitoring", select the rule whose "monitoring warning rule is enabled" setting is enabled.

[0157] For each rule obtained, the union of the top M rule sets in the "Segment Log Quantity Monitoring Configuration Table" is selected as the second matching template set.

[0158] Where M represents the maximum number of incremental templates for automatic configuration monitoring of a single indicator.

[0159] In another embodiment provided by the present invention, the method further includes:

[0160] For each PM indicator, after a deterioration warning is generated, the warning is in an active state. A web monitoring interface is provided to view all current active warning information. For each active state, the warning information is monitored based on the configured "PM indicator early warning period" value N, with a warning time limit of (N+1)*T1. If a PM deterioration event occurs within the warning time limit, the number of successful warnings is recorded. At the end of the warning time limit, the warning information is set to an inactive state. If no PM deterioration event occurs within the warning time limit, the number of incorrect warnings is recorded.

[0161] If the system has sufficient computing resources, rules configured as "Whether monitoring and early warning rules are enabled" can also be simulated and cumulatively recorded according to this step to provide more reference information for the rule configuration and adjustment process.

[0162] In another embodiment of the present invention, template matching is performed on the log statistics data according to the second matching template set, and degradation warning information is generated based on the indicators in the slice log quantity monitoring configuration table according to the matched template, including:

[0163] Based on the second matching template set, log volume anomalies are identified in the extracted log statistics. Once an anomaly is identified, all PM metrics for which the "Whether to use a joint incremental template rule" configuration item in the full configuration table is either no or yes with an OR condition are listed, and performance degradation warning information is generated.

[0164] For PM metrics where the configuration item is yes and the condition is AND, the top M log templates in the sorting rule of the "Incremental Log Template Monitoring Configuration Table" for that rule are matched with the log statistics data. Once any template in the set is matched, a performance degradation warning message is generated.

[0165] For all PM metrics where the "Whether to Combine Incremental Template Rules" configuration item is "Yes" and the condition is "OR", but no warning data is generated, the top M log templates in the sorting rules of the "Incremental Log Template Monitoring Configuration Table" of this rule are matched with the log statistics data. Once any template in the set is matched, a performance degradation warning message is generated.

[0166] For each PM indicator, after the deterioration warning information is generated, the method for recording the warning activity status and the cumulative number of successful warnings and the number of false warnings is the same as in the above embodiment.

[0167] If the system has sufficient computing resources, rules configured as "Whether monitoring and early warning rules are enabled" can also be simulated and cumulatively recorded according to this step to provide more reference information for the rule configuration and adjustment process.

[0168] This application proposes a method to provide early warnings of PM (Progressive Performance Index) degradation by monitoring for anomalies in the number of specific logs within each time slice. Since it only requires statistical analysis and threshold determination of the number of logs matching a specific log text expression (i.e., log template), it effectively adds log information as a monitoring parameter for PM indicator early warning while still controlling the computational cost of data processing.

[0169] See Figure 5 This is a schematic diagram of an early warning device for NFV network performance degradation provided in an embodiment of the present invention. The device includes:

[0170] The data acquisition module is used to collect performance data and log data of the network elements to be monitored in the NFV network, and obtain log volume statistics of the log template.

[0171] The extraction module is used to extract the log volume statistics based on the list of all log templates in the incremental log template monitoring configuration table and the slice log quantity monitoring configuration table to obtain log statistics. The incremental log template monitoring configuration table is obtained by statistically analyzing historical log data using preset degradation threshold rules, and the slice log quantity monitoring configuration table is obtained by statistically analyzing historical log data using preset monitoring rules.

[0172] The set module is used to determine the first matching template set based on the incremental log template monitoring configuration table and the preset first matching rule;

[0173] The matching module is used to perform template matching on the log statistics data according to the first matching template set, and generate degradation warning information based on the indicators in the incremental log template monitoring configuration table according to the matched template.

[0174] It should be noted that the NFV network performance degradation early warning device provided in this embodiment can execute all the steps and functions of the NFV network performance degradation early warning method provided in any of the above embodiments, and the specific functions of the device will not be described in detail here.

[0175] See Figure 6 This is another structural schematic diagram of an NFV network performance degradation early warning device provided in an embodiment of the present invention. The NFV network performance degradation early warning device includes: a processor, a memory, and a computer program stored in the memory and executable on the processor, such as an NFV network performance degradation early warning program. When the processor executes the computer program, it implements the steps in the various embodiments of the NFV network performance degradation early warning method described above, for example... Figure 1The steps S1 to S4 are shown. Alternatively, when the processor executes the computer program, it implements the functions of each module in the above-described device embodiments.

[0176] For example, the computer program can be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the NFV network performance degradation early warning device. For example, the computer program can be divided into several modules, the specific functions of which have been described in detail in the NFV network performance degradation early warning method provided in any of the above embodiments; therefore, the specific functions of the device will not be repeated here.

[0177] The aforementioned NFV network performance degradation early warning device can be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. This device may include, but is not limited to, a processor and memory. Those skilled in the art will understand that the illustrated diagram is merely an example of an NFV network performance degradation early warning device and does not constitute a limitation on such a device. It may include more or fewer components than illustrated, or combine certain components, or use different components. For example, the NFV network performance degradation early warning device may also include input / output devices, network access devices, buses, etc.

[0178] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. This processor is the control center of the NFV network performance degradation early warning device, connecting all parts of the device via various interfaces and lines.

[0179] The memory can be used to store the computer program and / or modules. The processor implements various functions of the NFV network performance degradation early warning device by running or executing the computer program and / or modules stored in the memory and calling the data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital card (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0180] The module integrated into the NFV network performance degradation early warning device, if implemented as a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.

[0181] This invention also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the method described in any of the above embodiments.

[0182] It should be noted that the computer program product provided in this embodiment can execute all the steps and functions of the early warning method for NFV network performance degradation provided in any of the above embodiments, and the specific functions of the device will not be described in detail here.

[0183] It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications are also considered to be within the scope of protection of this invention.

Claims

1. A method for early warning of performance degradation in NFV networks, characterized in that, The method includes: The performance data and log data of the network elements to be monitored in the NFV network are collected to obtain log volume statistics for each log template. Log volume statistics are extracted from the list of all log templates in the incremental log template monitoring configuration table and the slice log quantity monitoring configuration table to obtain log statistics. The incremental log template monitoring configuration table is obtained by statistically analyzing historical log data using preset degradation threshold rules, and the slice log quantity monitoring configuration table is obtained by statistically analyzing historical log data using preset monitoring rules. Based on the incremental log template monitoring configuration table and the preset first matching rule, determine the first matching template set; The log statistics data are matched with the first set of matching templates, and degradation warning information is generated based on the indicators in the incremental log template monitoring configuration table according to the matched templates.

2. The early warning method for NFV network performance degradation according to claim 1, characterized in that, The method further includes: Based on the slice log quantity monitoring configuration table and the preset second matching rule, determine the second matching template set; The log statistics data are matched using the second matching template set, and degradation warning information is generated based on the indicators in the slice log quantity monitoring configuration table according to the matched template.

3. The early warning method for NFV network performance degradation according to claim 1, characterized in that, The performance data and log data of the network elements to be monitored in the NFV network are collected to obtain log volume statistics for each log template, including: Based on the pre-configured list of performance indicators to be analyzed, PM data is collected and stored at different continuous periods. Based on the network element type and network element name information in the list of performance indicators to be analyzed, all log data of each network element are continuously accessed. Based on the preset log template extraction algorithm, the template is extracted from each group of log text in all log data to obtain the log template, and a list of log templates is obtained. Based on the log gateway template list, and according to the preset log monitoring time window granularity, log volume is grouped and statistically analyzed within each unit time window slice. The statistical results are stored in the data warehouse to obtain log volume statistics for each log template.

4. The early warning method for NFV network performance degradation according to claim 3, characterized in that, The process involves extracting templates from each group of log text in all log data using a preset log template extraction algorithm, resulting in a log template list, including: The collected log data is grouped according to different network element types and log types. For the full log data in each group, the log template extraction algorithm is introduced to extract the template from the log text of each group to obtain the log template, and thus obtain the log template list. The log template includes network element type, network element name, log type, log template ID, and log text template expression.

5. The early warning method for NFV network performance degradation according to claim 1, characterized in that, The statistical process of the incremental log template monitoring configuration table includes: The degradation threshold rule is used to detect whether each time slice in the historical log data, divided according to a preset monitoring time granularity, has deteriorated, and the abnormal range of each degradation index is recorded; the historical log data is historical data continuously collected according to a preset degradation identification duration; Extract log statistics data for the preset duration preceding each abnormal interval of an indicator; Each extracted log statistical data point is grouped by indicator name and written as incremental data into the PM indicator degradation event sample library; List all log templates that appear within the time period of the degradation identification duration, and calculate the minimum and maximum values ​​of the monitored log volume for each log template within the preset log monitoring time window granularity to obtain the incremental PM baseline sample interval log template statistics table indexed by template ID within this time period; The incremental PM baseline sample interval log template statistics table obtained within each log monitoring time window is accumulated to obtain the cumulative PM baseline sample interval log template statistics table, and all index template IDs in the updated cumulative PM baseline sample interval log template statistics table are set as the PM baseline sample interval template set. Set the log volume monitoring rules according to the preset log volume monitoring rule annotation information; For each abnormal interval of the deteriorating indicator, extract the set of templates that appear in the interval within the log monitoring time window granularity. Calculate the complement of the template set for each interval and the template set extracted from the interval at the granularity of the previous log monitoring time window; The complement of the calculated complement set and the complement set of the PM baseline sample interval template set; The template list and slice log volume information in the obtained set are used as the first output result data, and the time period information of the log monitoring time window granularity range in which each template in the template list of the set first appears within the abnormal range of the above indicators is used as the second output result data. When there is more than one log template in the first output result data, the rule category is set to incremental log template monitoring rule; Count the number of times each template appears in multiple events, and sort the average slice log volume of each template in the list in ascending order according to the number of occurrences in descending order; Delete the templates in the list whose valid status is set to no in the log volume monitoring rules, and select the templates in the log volume monitoring rules that automatically configure the upper limit of the number of incremental templates for monitoring single indicators according to the order of the list to obtain the incremental log template monitoring configuration table.

6. The early warning method for NFV network performance degradation according to claim 5, characterized in that, After obtaining the incremental log template monitoring configuration table, the method further includes: Update the occurrence count and average slice log volume of templates marked as valid (yes or no) in the incremental log template monitoring configuration table; Recalculate the incremental log template monitoring configuration table and set the statistics of the incremental log template monitoring configuration table to an inactive state.

7. The early warning method for NFV network performance degradation according to claim 5, characterized in that, The statistical process for the slice log quantity monitoring configuration table includes: When the number of templates in the first output result data is empty, the configuration table for monitoring the number of slice logs is empty. When there is more than one log template in the first output result data, record the list of abnormal templates for each event in the second output result data; Count the number of times each template appears in multiple events, and sort the average slice log volume of each template in the list in ascending order according to the number of occurrences in descending order; Delete the templates in the list whose valid status is set to no in the log volume monitoring rules, and select the templates in the log volume monitoring rules that automatically configure the upper limit of the single indicator monitoring increment templates according to the order of the list to obtain the slice log volume monitoring configuration table.

8. The early warning method for NFV network performance degradation according to claim 7, characterized in that, After obtaining the slice log quantity monitoring configuration table, the method further includes: Update the cumulative number of anomalies and the average percentage of anomalies in the slice log volume for templates marked with a valid status of "yes" or "no" in the slice log volume monitoring configuration table. For items marked with a valid status of "not marked", automatically update the upper and lower limits of the warning threshold parameters. Set the rule for combining incremental templates in the log volume monitoring rules to "yes" and continue to recalculate the configuration table for monitoring the number of sliced ​​logs.

9. The early warning method for NFV network performance degradation according to claim 1, characterized in that, Based on the matching rules configured in the incremental log template monitoring configuration table, a first set of matching templates is determined, specifically including: In all rules of the PM indicator early warning category set for incremental log template monitoring rules, select the rules configured as enabled for monitoring and early warning. Take the union of the slice log templates with the maximum number of single-index automatic configuration monitoring incremental templates in the sorting rules of the incremental log template monitoring configuration table for each rule, and use it as the first matching template set.

10. The early warning method for NFV network performance degradation according to claim 2, characterized in that, Based on the matching rules configured in the slice log quantity monitoring configuration table, a second set of matching templates is determined, specifically including: In all rules of the PM indicator warning category set as the log volume monitoring rule, select the rule configured as the enabled monitoring and warning rule; Take the union of the maximum number of slice log templates for the single-index automatic configuration monitoring incremental template in the sorting rules of the slice log quantity monitoring configuration table for each rule, and use it as the second matching template set.

11. The early warning method for NFV network performance degradation according to claim 1, characterized in that, The method further includes: The collected PM indicators are monitored using a preset early warning period for PM indicators as the warning time limit. When a deterioration warning message is generated within the warning time limit, the number of successful warnings is recorded cumulatively. If no degradation warning information is generated within the warning time limit, the number of warning errors is recorded cumulatively. The warning information will be set to inactive when the warning period ends.

12. The early warning method for NFV network performance degradation according to claim 2, characterized in that, The step of performing template matching on the log statistics data according to the second matching template set, and generating degradation warning information based on the indicators in the slice log quantity monitoring configuration table according to the matched template, includes: The log statistics data are used to identify log volume anomalies based on the second matching template set; When an anomaly is identified, list all PM metrics in the entire configuration table that are no / yes for the template with the anomaly and whose condition is OR, and generate performance degradation warning information. For PM indicators where the configuration item is "yes" and the condition is "AND", the first M slice log templates in the sorting rules of the incremental log template monitoring configuration table are selected according to the rules of the indicator. The templates are matched with the log statistics data, and deterioration warning information is generated based on the indicators in the incremental log template monitoring configuration table according to the matched templates. For PM metrics where the configuration item for whether to use the incremental template rule is yes and the condition is OR, the top M slice log templates in the sorting rules of the incremental log template monitoring configuration table are selected, and template matching is performed with the log statistics data. Based on the matched templates, degradation warning information is generated according to the metrics in the incremental log template monitoring configuration table.

13. An early warning device for NFV network performance degradation, characterized in that, The device includes: The data acquisition module is used to collect performance data and log data of the network elements to be monitored in the NFV network, and obtain log volume statistics of the log template. The extraction module is used to extract the log volume statistics based on the list of all log templates in the incremental log template monitoring configuration table and the slice log quantity monitoring configuration table to obtain log statistics. The incremental log template monitoring configuration table is obtained by statistically analyzing historical log data using preset degradation threshold rules, and the slice log quantity monitoring configuration table is obtained by statistically analyzing historical log data using preset monitoring rules. The set module is used to determine the first matching template set based on the incremental log template monitoring configuration table and the preset first matching rule; The matching module is used to perform template matching on the log statistics data according to the first matching template set, and generate degradation warning information based on the indicators in the incremental log template monitoring configuration table according to the matched template.

14. An early warning device for NFV network performance degradation, characterized in that, The system includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the early warning method for NFV network performance degradation as described in any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the early warning method for NFV network performance degradation as described in any one of claims 1 to 12.

16. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method described in any one of claims 1 to 12.

Images