Fault locating method and device of data center bottom-layer network, server and medium

Abstract

The application discloses a fault positioning method and device of a data center bottom-layer network, a server and a medium. The application relates to the technical field of cloud computing. The method comprises the following steps: acquiring a current detection flow set and a current path set corresponding to a target data center collected by each target proxy service based on a preset network search list; determining a detection threshold based on the integrity index of a target detection flow in the current detection flow set, generating an abnormal alarm data set based on the target detection flow data analysis, determining an abnormal network path corresponding to each abnormal alarm data in the abnormal alarm data set based on the current path set, and obtaining a common network node set by processing each abnormal network path; and counting the occurrence frequency of each common network node in the common network node set and determining a target fault node based on the statistical result. The technical scheme of the application solves the problem of poor real-time performance of network fault positioning in the prior art and can quickly perform fault positioning on the data center bottom-layer network.

Description

TECHNICAL FIELD

[0001] The embodiment of the present application relates to the technical field of cloud computing, and particularly relates to a fault positioning method and device of an underlay network of a data center, a server and a medium. BACKGROUND

[0002] As a core infrastructure of modern information technology, the network performance of a data center directly affects the quality of various applications and services. Therefore, it is very important to locate the fault nodes of an underlay network in the data center.

[0003] However, with the continuous expansion and increasing complexity of the data center, the underlay network of the data center contains a large number of network device nodes and connection lines, and the modern data center network usually adopts a multi-path transmission technology, so that the traditional network fault positioning method often fails to meet the real-time requirements. Therefore, how to quickly locate the fault of the underlay network of the data center is a problem to be solved at present. SUMMARY

[0004] The embodiment of the present application provides a fault positioning method and device of an underlay network of a data center, a server and a medium, to solve the problem of poor real-time performance of the underlay network fault positioning in the prior art.

[0005] In a first aspect, the embodiment of the present application provides a fault positioning method of an underlay network of a data center, comprising:

[0006] Obtaining a current detection flow set and a current path set corresponding to a target data center collected by each target proxy service based on a preset network search list; wherein the target proxy service is deployed in each target server of the target data center; the preset network search list comprises internal hierarchical network topology relationships of access switches corresponding to each target server, external hierarchical network topology relationships of the access switches, external hierarchical network topology relationships of aggregation switches and external hierarchical network topology relationships of core switches;

[0007] Determining a detection threshold corresponding to each target detection flow based on the integrity index of the target detection flow in the current detection flow set, and performing data analysis on the target detection flow based on the detection threshold to generate an abnormal alarm data set corresponding to the current detection flow set;

[0008] Determining an abnormal network path corresponding to each abnormal alarm data in the abnormal alarm data set based on the current path set, and obtaining a common network node set by processing each abnormal network path;

[0009] Count the occurrence frequency of each public network node in the public network node set, and determine the target fault node corresponding to the target data center based on the statistical result.

[0010] In a second aspect, the embodiments of the present application further provide a fault locating device of a data center bottom-layer network, which comprises:

[0011] The data collection module is configured to acquire a current probe flow set and a current path set corresponding to the target data center, which are collected by each target proxy service based on a preset network search list; the target proxy service is deployed in each target server of the target data center; the preset network search list comprises internal hierarchical network topology relationships of access switches corresponding to each target server, external hierarchical network topology relationships of the access switches, external hierarchical network topology relationships of aggregation switches, and external hierarchical network topology relationships of core switches.

[0012] The data analysis module is configured to determine a probe threshold corresponding to each target probe flow based on an integrity index of the target probe flow in the current probe flow set, and perform data analysis on the target probe flow based on the probe threshold, to generate an abnormal alarm data set corresponding to the current probe flow set.

[0013] The fault analysis module is configured to determine an abnormal network path corresponding to each abnormal alarm data in the abnormal alarm data set based on the current path set, and aggregate and process each abnormal network path to obtain a public network node set.

[0014] The fault locating module is configured to count the occurrence frequency of each public network node in the public network node set, and determine the target fault node corresponding to the target data center based on the statistical result.

[0015] In a third aspect, the embodiments of the present application further provide a server, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor; when the processor executes the program, the method for locating faults of a data center bottom-layer network is implemented, as described in any of the embodiments of the present application.

[0016] In a fourth aspect, the embodiments of the present application further provide a computer readable storage medium, which stores a computer program; when the processor executes the program, the method for locating faults of a data center bottom-layer network is implemented, as described in any of the embodiments of the present application.

[0017] In a fifth aspect, the embodiments of the present application further provide a computer program product, which comprises a computer program; when the processor executes the computer program, the method for locating faults of a data center bottom-layer network is implemented, as described in any of the embodiments of the present application.

[0018] In the embodiment of the present application, the target data center corresponding current probe flow set and current path set are collected by each target agent service based on the preset network search list, then the detection threshold corresponding to each target probe flow is determined based on the integrity index of each target probe flow in the current probe flow set, and the target probe flow is analyzed based on the detection threshold to generate the abnormal alarm data set corresponding to the current probe flow set, further, the abnormal network path corresponding to each abnormal alarm data in the abnormal alarm data set is determined based on the current path set, and the common network node set is obtained by processing each abnormal network path, finally, the occurrence frequency of each common network node in the common network node set is counted, and the target fault node corresponding to the target data center is determined based on the statistical result. Since the probe flow between servers is collected based on the preset hierarchical detection method, the number of probe flows between servers is greatly reduced, and the abnormal alarm data and routing path corresponding to the probe flow are combined to locate the network fault node, without the need for traffic collection or port mirroring operation on the network equipment. Therefore, the problem of poor real-time performance of bottom layer network fault positioning can be solved, and the fault node of the bottom layer network can be quickly positioned. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor.

[0020] Figure 1 A network architecture diagram of a large-scale system for measuring and analyzing the network delay of a data center provided by the prior art;

[0021] Figure 2 A flowchart of a fault positioning method of a data center bottom layer network provided by the embodiment of the present application;

[0022] Figure 3 A network architecture diagram of a bottom layer network provided by the embodiment of the present application;

[0023] Figure 4 A flowchart of another fault positioning method of a data center bottom layer network provided by the embodiment of the present application;

[0024] Figure 5 A schematic diagram of an internal hierarchical network topology relationship of an access switch provided by the embodiment of the present application;

[0025] Figure 6 A schematic diagram of an external hierarchical network topology relationship of an access switch provided by the embodiment of the present application;

[0026] Figure 7 A schematic diagram of a converged switch external hierarchical network topology relationship provided for an embodiment of the present application;

[0027] Figure 8 A schematic diagram of a core switch external hierarchical network topology relationship provided for an embodiment of the present application;

[0028] Figure 9 A flow chart of still another data center bottom-layer network fault locating method provided for an embodiment of the present application;

[0029] Figure 10 A structural schematic diagram of a data center bottom-layer network fault locating device provided for an embodiment of the present application;

[0030] Figure 11 A structural schematic diagram of a server for implementing a data center bottom-layer network fault locating method provided for an embodiment of the present application. DETAILED DESCRIPTION

[0031] The present application will be further described below in conjunction with the accompanying drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application. In addition, it should be noted that, for the convenience of description, only the parts related to the present application are shown in the drawings, but not all the structures.

[0032] It should be noted that: similar reference numerals and letters represent similar items in the following drawings, therefore, once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings. Meanwhile, in the description of the present application, the terms "first", "second", etc. are only used to distinguish the description, but cannot be understood as indicating or implying relative importance. The acquisition, storage, use, processing, etc. of data in the technical solution of the present application all comply with the relevant provisions of the national laws and regulations. It should be noted that, in the embodiments of the present application, some industry existing solutions, components, models, etc. may be mentioned, which should be considered as exemplary, and the purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the related content of the solution.

[0033] A data center network is usually divided into two levels of underlay network and overlay network. Among them, the underlay network is a physical network responsible for transmitting data packets and is the basis of the overlay network. Therefore, how to quickly locate the fault of the underlay network is very important. However, due to the complexity and high requirements of the underlay network, the following challenges are usually encountered when locating the fault of the underlay network: 1) Large scale of nodes: The underlay network is composed of switches and routers and other devices, driven by Ethernet protocol, routing protocol and Virtual Local Area Network (VLAN) protocol, etc., containing a large number of network device nodes and connection lines. It is difficult to monitor all nodes in real time. 2) Complexity of multi-path transmission: The underlay network uses multi-path transmission technology, which increases the complexity of network path and the difficulty of fault location. 3) High real-time requirement: Many applications have very high requirements for network quality, and need to quickly identify network problems and quickly locate faults.

[0034] The prior art usually uses a large-scale system (pingmesh) of data center network latency measurement and analysis to determine the network performance in the underlay network for detection. Figure 1 A network architecture diagram of a large-scale system of data center network latency measurement and analysis provided by the prior art is shown. Specifically, the pingmesh architecture includes a pingmesh controller, a pingmesh agent service and a data storage and analysis (DSA) platform. The pingmesh generator in the pingmesh controller generates a packet internet grope list (pinglist) file according to the network topology graph, wherein the pinglist file contains a list of target server nodes to be probed for each server. And send the pinglist file to each server. The pingmesh agent in each server determines the server to be probed according to the pinglist file, uses Transmission Control Protocol / Hypertext Transfer Protocol (TCP / HTTP) to ping the server to be probed, and saves the results in the form of a log in the memory. When the saved results in the memory exceed a certain threshold or reach a timeout time, upload the saved results to the DSA platform for analysis and processing.

[0035] However, if the pingmesh system is used to detect network performance, each server in the same data center needs to ping all the remaining servers. For example, if the data center contains N servers, each server needs to ping the remaining (N-1) servers, that is, N 2 complexity. If there are 10,000 servers in the data center, there are 10,000*9999 ping tasks, and if a server has multiple Internet Protocol (IP) requests, the result is doubled. If a ping action is performed every 30 seconds, and the payload size required for a ping action is 64 bytes, the data storage amount for 1 day is: 10,000*9999*64*24*3600 / 30=16.76TB. High computing and storage costs are required, and the detection rate of network performance is greatly affected. In addition, although the pingmesh system can detect the network performance of the underlying network, it is difficult to specifically locate the fault root cause. Therefore, in order to quickly locate the fault node of the underlying network of the data center and improve the efficiency of fault location, an embodiment of the present application provides a fault location method for the underlying network of the data center.

[0036] Figure 2 A flowchart of a fault location method for the underlying network of the data center is provided in an embodiment of the present application. The embodiment can be applicable to the case of quickly locating the fault node of the underlying network in the data center, and the method can be executed by a fault location device for the underlying network of the data center. The device can be realized in the form of hardware and / or software, and the device can be configured in a server. As shown in Figure 2 , the method comprises:

[0037] S101, obtaining a current probe flow set and a current path set corresponding to a target data center collected by each target proxy service based on a preset network search list; wherein the target proxy service is deployed in each target server of the target data center; the preset network search list includes internal hierarchical network topology relationships of access switches corresponding to each target server, external hierarchical network topology relationships of access switches, external hierarchical network topology relationships of aggregation switches, and external hierarchical network topology relationships of core switches.

[0038] The target data center can refer to a data center that needs to be analyzed. For example, it can be a data center that needs to be fault located, or a data center that needs to be quality evaluated. Each physical device in the data center constitutes an underlying network, and the underlying network in each data center is usually a standard three-layer network architecture. Figure 3A network architecture diagram of a bottom-layer network is provided for an embodiment of the present application. Specifically, in the same geographical area, a plurality of independent data centers isolated from each other form an availability zone (AZ). For each data center in each AZ, a server is mounted under an access switch (leaf), the access switch is mounted under a spine switch, and the spine switch is mounted under a core switch (core). Among them, the server, the access switch and the spine switch are in the computing area, and the core switch is in the core switching area. Each AZ transmits data through the core switch.

[0039] The target server can refer to a source server selected for data detection in a preset network search list. The preset network search list can refer to a data detection topology list corresponding to the target data center constructed in advance. Generally, the preset network search list contains a source server for data detection, i.e., a target server, and a detected server corresponding to the source server. For example, the preset network search list can contain the internal hierarchical network topology relationship of the access switch corresponding to each target server, the external hierarchical network topology relationship of the access switch, the external hierarchical network topology relationship of the spine switch, and the external hierarchical network topology relationship of the core switch.

[0040] The internal hierarchical network topology relationship of the access switch can refer to the network topology relationship between the target server and the corresponding detected server under the same access switch. The external hierarchical network topology relationship of the access switch can refer to the network topology relationship between the target server and the detected server under different access switches. The external hierarchical network topology relationship of the spine switch can refer to the network topology relationship between the target server and the detected server under different spine switches. The external hierarchical network topology relationship of the core switch can refer to the network topology relationship between the target server and the detected server under different core switches.

[0041] The target agent service can refer to an agent service program deployed on the target server for initiating data detection. For example, the target agent service can generate a probe flow result for packet internet grope (ping), and can also generate a path collection result for path collection. The current probe flow set can refer to a set composed of each probe flow result corresponding to the target data center at the same time. The current path set can refer to a set composed of each path collection result corresponding to the target data center at the same time.

[0042] In an optional implementation, before obtaining the current probe stream set and the current path set corresponding to the target data center based on the preset network search list, the method further comprises: generating a basic proxy service based on a grouping network search underlying principle, and deploying the basic proxy service to all servers in the target data center. The grouping network search underlying principle can refer to the underlying principle of a ping command. The basic proxy service can refer to a proxy service reconstructed based on the underlying principle of the grouping network search. Thus, by rewriting the basic proxy service based on the underlying principle of the ping command and deploying the basic proxy service to all servers in the target data center, the target server can send a probe request to other nodes without invoking the ping command of the operating system, thereby improving the efficiency of data detection.

[0043] S102, determining a probe threshold corresponding to each target probe stream based on the integrity index of the target probe stream in the current probe stream set, and performing data analysis on the target probe stream based on the probe threshold to generate an abnormal alarm data set corresponding to the current probe stream set.

[0044] The target probe stream can refer to a probe stream result selected for data analysis in the current probe stream set. For example, the target probe stream can include a source IP address, a destination IP address, a packet loss rate, and a delay time.

[0045] The probe threshold can refer to a numerical value used to evaluate the target probe stream. The abnormal alarm data can refer to alarm information corresponding to the target probe stream that does not meet the probe threshold. For example, the abnormal alarm data can include the target probe stream that does not meet the probe threshold, the corresponding probe threshold, and the numerical value exceeding the probe threshold. The abnormal alarm data set can refer to a set of each abnormal alarm data corresponding to the current probe stream set.

[0046] S103, determining an abnormal network path corresponding to each abnormal alarm data in the abnormal alarm data set based on the current path set, and processing each abnormal network path to obtain a common network node set.

[0047] The abnormal network path can refer to a transmission path of the abnormal alarm data. For example, it can be the transmission path of the target probe stream corresponding to the abnormal alarm data.

[0048] The common network node can refer to a same network node through which at least two abnormal network paths pass. The common network node set can refer to a set composed of respective common network nodes corresponding to the target data center.

[0049] In S104, the occurrence frequency of each common network node in the common network node set is counted, and a target fault node corresponding to the target data center is determined based on the counting result.

[0050] The occurrence frequency can refer to the number of occurrences of the same common node in each abnormal network path. For example, the occurrence frequency of each common network node can be determined by the number of times the same common node is passed through by each abnormal network path. The target fault node can refer to a network node with a fault problem in the target data center.

[0051] In the embodiment of the application, the target proxy service based on the preset network search list collects the current probe flow set and the current path set corresponding to the target data center, and then determines the probe threshold corresponding to the target probe flow based on the integrity index of each target probe flow in the current probe flow set, and performs data analysis on the target probe flow based on the probe threshold, to generate an abnormal alarm data set corresponding to the current probe flow set. Further, the abnormal network path corresponding to each abnormal alarm data in the abnormal alarm data set is determined based on the current path set, and the common network node set is obtained by processing each abnormal network path. Finally, the occurrence frequency of each common network node in the common network node set is counted, and the target fault node corresponding to the target data center is determined based on the counting result. Since the probe flow between servers is collected based on the preset hierarchical detection method, the number of probe flows between servers is greatly reduced, and the abnormal alarm data corresponding to the probe flow and the routing path are combined to locate the network fault node, without the need for traffic collection or port mirroring on the network device. Therefore, the real-time problem of bottom-layer network fault location can be solved, and the fault node of the bottom-layer network can be quickly located.

[0052] Figure 4 The flowchart of another method for locating a fault of a bottom-layer network of a data center is provided in the embodiment of the application. The embodiment is based on the above-mentioned embodiment, and specifically describes the operation before the current probe flow set and the current path set corresponding to the target data center collected by the target proxy service based on the preset network search list are obtained. As shown in FIG. 4, the method comprises the following steps. Figure 4

[0053] ​S201, acquire the basic network topology data corresponding to the underlying network of the target data center; wherein the basic network topology data comprises the core switch information corresponding to the target data center, the aggregation switch information corresponding to each core switch, the access switch information corresponding to each aggregation switch, and the server information corresponding to each access switch.

[0054] The basic network topology data can refer to the original network topology data corresponding to the underlying network of the target data center. Generally, the basic network topology data comprises the core switch information corresponding to the target data center, the aggregation switch information corresponding to each core switch, the access switch information corresponding to each aggregation switch, and the server information corresponding to each access switch.

[0055] The core switch information corresponding to the target data center can comprise the number of core switches corresponding to the target data center and the number of each core switch. The aggregation switch information corresponding to each core switch can comprise the number of aggregation switches under each core switch and the number of each aggregation switch. The access switch information corresponding to each aggregation switch can comprise the number of access switches under each aggregation switch and the number of each access switch. The server information corresponding to each access switch can comprise the number of servers under each access switch and the number of each server.

[0056] Thus, through the basic network topology data corresponding to the underlying network of the target data center, the number of devices at each level and the connection between each device can be determined, providing an effective basis for the subsequent construction of the preset network search list.

[0057] S202, based on the preset access switch internal level detection rule and the server information corresponding to each access switch, construct the full-amount access switch internal level network topology relationship corresponding to the target data center.

[0058] The preset access switch internal level detection rule can refer to a preset detection link determination rule for the internal level of the access switch. Through the preset access switch internal level detection rule, the detection link topology relationship between each server under the same access switch can be determined.

[0059] The access switch internal level network topology relationship can refer to the detection link topology relationship of the internal level of the access switch constructed according to the preset access switch internal level detection rule. Generally, the access switch internal level network topology relationship can comprise the source server number and the corresponding detected server number under the same access switch. The full-amount access switch internal level network topology relationship can refer to the full-amount access switch internal level network topology relationship in the target data center.

[0060] In an optional embodiment, the preset access switch internal level detection rule and the server information corresponding to each access switch are used to construct a full-amount access switch internal level network topology relationship corresponding to the target data center, including:

[0061] In step a1, a first current server under a target access switch and a first set number of first servers to be detected corresponding to the first current server are obtained based on the server information corresponding to each access switch.

[0062] The target access switch can refer to an access switch mounted by a server selected for network topology relationship determination. The first current server can refer to a source server initiating a detection request under the target access switch. For example, the first current server can be each server under the target access switch. The first server to be detected can refer to a detected server corresponding to the first current server.

[0063] The first set number can refer to a value limiting the number of devices in the access switch internal level. For example, the number of detection links issued by each server under the access switch internal level can be multiplied. Specifically, the access switch is usually connected to at most 45 servers, that is, there are 45 links from the servers to the access switch, and one detection link initiated by each server can theoretically cover all 45 links. Therefore, in the embodiment of the application, each server can initiate a set number of detection links, such as 3 times detection links, that is, 3 links. In this way, the coverage rate of all detection links can be improved.

[0064] In step a2, the first current server is taken as a first source object, and the first server to be detected is taken as a first detection object, a detection link between the first source object and the first detection object is constructed, and an internal level network topology relationship corresponding to the target access switch is generated.

[0065] The source object can refer to a server initiating a detection request. The detection object can refer to a server to be detected. Generally, one source object and one detection object form a detection link. The first source object can refer to a source object under the access switch internal level. The first detection object can refer to a detection object under the access switch internal level. The internal level network topology relationship corresponding to the target access switch can refer to a network topology relationship formed between each first source object and the corresponding first detection object under the target access switch.

[0066] Figure 5An internal hierarchical network topology relationship access switch diagram provided by the embodiment of the present application. Specifically, for each server under the same target access switch, the IP is sorted, the server numbered i under the target access switch is taken as the first current server, and the server numbered (i+N) is taken as the first to-be-tested server. Wherein, N represents the first set number, and the example is N=1, 2, 3. For example, if the server numbered 1 is the first current server, the first to-be-tested server is the server numbered 2, the server numbered 3 and the server numbered 4 respectively. Similarly, if the server numbered 2 is the first current server, the first to-be-tested server is the server numbered 3, the server numbered 4 and the server numbered 5 respectively. Further, the first current server is taken as the first source object, the first to-be-tested server is taken as the first probe object, the probe link between the first source object and the first probe object is constructed, and finally, the probe links between all the first source objects and the first probe objects under the target access switch are summarized to generate the internal hierarchical network topology relationship corresponding to the target access switch.

[0067] Step a3, the internal hierarchical network topology relationship corresponding to the target access switch is summarized to generate the full access switch internal hierarchical network topology relationship corresponding to the target data center.

[0068] Specifically, after generating the internal hierarchical network topology relationship corresponding to each target access switch, the internal hierarchical network topology relationship corresponding to all target access switches under the target data center is summarized, thereby generating the full access switch internal hierarchical network topology relationship corresponding to the target data center, which provides an effective basis for subsequent fault location.

[0069] S203, based on the preset access switch external hierarchical detection rule, the access switch information corresponding to each aggregation switch and the server information corresponding to each access switch, the full access switch external hierarchical network topology relationship corresponding to the target data center is constructed.

[0070] Wherein, the preset access switch external hierarchical detection rule can refer to the preset detection link determination rule of the access switch external hierarchical. Through the preset access switch external hierarchical detection rule, the detection link topology relationship between each access switch under the same aggregation switch can be determined.

[0071] The access switch external level network topology relationship can refer to a detection link topology relationship of the access switch external level constructed according to a preset access switch external level detection rule. Generally, the access switch external level network topology relationship can include a source server number and a corresponding detected server number under the same aggregation switch but different access switches. The full-amount access switch external level network topology relationship can refer to all access switch external level network topology relationships in the target data center.

[0072] In an optional embodiment, the full-amount access switch external level network topology relationship corresponding to the target data center is constructed based on the preset access switch external level detection rule, the access switch information corresponding to each aggregation switch, and the server information corresponding to each access switch, and includes:

[0073] Step b1, based on the access switch information corresponding to each aggregation switch, a first current access switch under a target aggregation switch and a second set number of first to-be-tested access switches corresponding to the first current access switch are obtained.

[0074] The target aggregation switch can refer to an aggregation switch mounted by the access switch currently selected for network topology relationship determination. The first current access switch can refer to a source access switch initiating a detection request under the target aggregation switch. The first to-be-tested access switch can refer to a detected access switch corresponding to the first current access switch.

[0075] The second set number can refer to a value limiting the number of devices in the access switch external level. For example, the number of detection links sent by each access switch in the access switch external level can be multiplied. Specifically, each access switch is usually connected to at most 4 aggregation switches, i.e., there are 4 links from each access switch to the aggregation switch. Therefore, in the embodiment of the application, a set number of detection links can be sent by each access switch, such as 3 times of detection links, i.e., 12 detection links. In this way, the coverage rate of all detection links can be improved.

[0076] Step b2, based on the server information corresponding to each access switch, a second set number of second current servers under the first current access switch are obtained, and based on the second current servers and a preset sorting remainder rule, a second to-be-tested server under the first to-be-tested access switch is obtained.

[0077] The second current server can refer to a source server initiating a detection request under the first current access switch. The second to-be-tested server can refer to a detected server corresponding to the second current server.

[0078] The preset sorting remainder rule can refer to a pre-set link pairing rule between the physical machines. For example, if the source physical machine number of the initiation of the detection request is X, and the device layer under the receiving detection request contains Y physical machines, the preset sorting remainder rule can be that the number of the detected physical machine is the remainder of X divided by Y, i.e., (X%Y). Specifically, taking the first current access switch as the access switch 1, the second current server number as P, the first to-be-tested access switch as the access switch 2, and the access switch 2 containing Q servers as an example, according to the preset sorting remainder rule, the second to-be-tested server number under the first to-be-tested access switch can be determined as (P%Q).

[0079] In step b3, the second current server is taken as a second source object, the second to-be-tested server is taken as a second detection object, a detection link between the second source object and the second detection object is constructed, and an external hierarchical network topology relationship corresponding to the first current access switch is generated.

[0080] The second source object can refer to a source object under the external hierarchy of the access switch. The second detection object can refer to a detection object under the external hierarchy of the access switch. The external hierarchical network topology relationship corresponding to the first current access switch can refer to a network topology relationship formed between each second source object and the corresponding second detection object under the first current access switch.

[0081] Figure 6A schematic diagram of an access switch external hierarchical network topology relationship provided for an embodiment of the present application. Specifically, first, for each access switch under the same target aggregation switch and each server under each access switch, sort by IP, take the source access switch currently selected to initiate the detection request under the target aggregation switch as the first current access switch, and take the remaining second set number of access switches as the first to-be-tested access switches. For example, if the first current access switch is access switch 1 under the target aggregation switch, and the second set number is 12, then the first to-be-tested access switches are access switch 2, access switch 3, …, access switch 12, and access switch 13 under the target aggregation switch, a total of 12 access switches. Further, to ensure that the servers under each access switch are sufficiently dispersed, select a second set number of servers under each first current access switch as second current servers, and determine the second to-be-tested servers under the first to-be-tested access switches according to a preset sorting modulo rule. For example, taking the first current access switch as access switch 1 under the target aggregation switch, the first to-be-tested access switch as access switch 2 under the target aggregation switch, and access switch 2 containing q servers as an example. Select 12 servers under access switch 1 as second current servers, and the second to-be-tested server corresponding to the second current server numbered p is numbered (p%q). For example, if access switch 2 contains 13 servers, and the second current server is the server numbered 1 under access switch 1, then the second to-be-tested server is the server numbered 1 under access switch 2. Similarly, if the second current server is the server numbered 2 under access switch 1, then the second to-be-tested server is the server numbered 2 under access switch 2. By analogy, the 12 second current servers under access switch 1 are all paired with corresponding second to-be-tested servers. Finally, take the second current servers as second source objects, and take the second to-be-tested servers as second detection objects, construct detection links between the second source objects and the second detection objects, and aggregate the detection links between all second source objects and second detection objects under the first current access switch to generate the external hierarchical network topology relationship corresponding to the first current access switch.

[0082] Step b4, aggregate the external hierarchical network topology relationships corresponding to all first current access switches under all target aggregation switches to generate the external hierarchical network topology relationship of all access switches corresponding to the target data center.

[0083] Specifically, after generating the external hierarchical network topology relationship corresponding to each first current access switch, the external hierarchical network topology relationship corresponding to all first current access switches under the same target aggregation switch is summarized, and the external hierarchical network topology relationship corresponding to the first current access switches under all target aggregation switches in the target data center is summarized, thereby generating the full-amount access switch external hierarchical network topology relationship corresponding to the target data center, providing an effective basis for subsequent fault location.

[0084] In S204, based on the preset aggregation switch external hierarchical detection rule, the aggregation switch information corresponding to each core switch, the access switch information corresponding to each aggregation switch, and the server information corresponding to each access switch, a full-amount aggregation switch external hierarchical network topology relationship corresponding to the target data center is constructed.

[0085] The preset aggregation switch external hierarchical detection rule can refer to a preset determination rule of the detection link of the aggregation switch external hierarchy. Through the preset aggregation switch external hierarchical detection rule, the detection link topology relationship between each server under the same core switch can be determined.

[0086] The aggregation switch external hierarchical network topology relationship can refer to the detection link topology relationship of the aggregation switch external hierarchy constructed according to the preset aggregation switch external hierarchical detection rule. Generally, the aggregation switch external hierarchical network topology relationship can include the source server number and the corresponding detected server number under the same core switch but different aggregation switches. The full-amount aggregation switch external hierarchical network topology relationship can refer to all aggregation switch external hierarchical network topology relationships in the target data center.

[0087] In an optional implementation, the construction of the full-amount aggregation switch external hierarchical network topology relationship corresponding to the target data center based on the preset aggregation switch external hierarchical detection rule, the aggregation switch information corresponding to each core switch, the access switch information corresponding to each aggregation switch, and the server information corresponding to each access switch includes:

[0088] In Scl, based on the aggregation switch information corresponding to each core switch, a first current aggregation switch under a target core switch and a third set number of first to-be-tested aggregation switches corresponding to the first current aggregation switch are obtained.

[0089] The target core switch can refer to a core switch mounted by a currently selected aggregation switch for determining a network topology relationship. The first current aggregation switch can refer to a source aggregation switch issuing a probe request under the target core switch. The first to-be-tested aggregation switch can refer to a detected aggregation switch corresponding to the first current aggregation switch. Generally, the first to-be-tested aggregation switch is an aggregation switch adjacent to the first current aggregation switch.

[0090] The third set number can refer to a value for limiting the number of devices in the external level of the aggregation switch. For example, the number of probe links sent by each aggregation switch in the external level of the aggregation switch can be multiplied. Specifically, each aggregation switch is usually connected to at most four core switches, that is, there are four links from each aggregation switch to the core switch. Therefore, in the embodiment of the application, each aggregation switch can send a set number of probe links, for example, five times of probe links, that is, 20 probe links. In this way, the coverage rate of all probe links can be improved.

[0091] In step c2, based on the access switch information corresponding to each aggregation switch, a third set number of second current access switches under the first current aggregation switch are obtained, and based on the second current access switches and a preset sorting remainder rule, a second to-be-tested access switch under the first to-be-tested aggregation switch is obtained.

[0092] The second current access switch can refer to a source access switch issuing a probe request under the first current aggregation switch. Generally, to ensure that the access switches under each aggregation switch are sufficiently dispersed, a third set number of second current access switches are selected under each first current aggregation switch. The second to-be-tested access switch can refer to a detected access switch corresponding to the second current access switch.

[0093] In step c3, a first server under the second current access switch is taken as a third source object, a first server under the second to-be-tested access switch is taken as a third probe object, a probe link between the third source object and the third probe object is constructed, and an external level network topology relationship corresponding to the first current aggregation switch is generated.

[0094] The first server can refer to a server with an IP ranking first under the access switch. For example, the server can be a server numbered 1. The third source object can refer to a source object in the external level corresponding to the aggregation switch. The third probe object can refer to a probe object in the external level corresponding to the aggregation switch. The external level network topology relationship corresponding to the first current aggregation switch can refer to a network topology relationship formed between each third source object and the corresponding third probe object under the first current aggregation switch.

[0095] Figure 7A schematic diagram of an external hierarchical network topology relationship of a convergence switch is provided for an embodiment of the present application. Specifically, for the convergence switches under the same target core switch, the access switches under all the convergence switches, and the servers under each access switch, the IP is sorted, the source convergence switch of the target core switch that initiates the detection request is taken as a first current convergence switch, each first current convergence switch selects a third set number of first to-be-tested convergence switches adjacent to it. For example, if the first current convergence switch is the convergence switch 1 under the target core switch, and the third set number is 20, then the first to-be-tested convergence switches are the convergence switch 2, the convergence switch 3, …, the convergence switch 20 and the convergence switch 21 under the target core switch, a total of 20 convergence switches. Further, to ensure that the access switches under each convergence switch are sufficiently dispersed, a third set number of second current access switches are selected under each first current convergence switch, and the second to-be-tested access switches under the first to-be-tested convergence switches are determined according to a preset sorting remainder rule. For example, taking the first current convergence switch as the convergence switch 1 under the target core switch, and the first to-be-tested convergence switch as the convergence switch 2 under the target core switch, and taking the s access switches in the convergence switch 2 as an example. Then, the second to-be-tested access switch corresponding to the second current access switch numbered r under the convergence switch 1 is numbered (r % s) in the convergence switch 2. For example, if the convergence switch 1 contains 20 access switches, the convergence switch 2 contains 20 access switches, and the second current access switch is the access switch numbered 1 under the convergence switch 1, then the second to-be-tested access switch is the access switch numbered 1 under the convergence switch 2, i.e., the access switch numbered 21 in all the access switches. Similarly, if the second current access switch is the access switch numbered 2 under the convergence switch 1, then the second to-be-tested access switch is the access switch numbered 2 under the convergence switch 2, i.e., the access switch numbered 22 in all the access switches. By analogy, the 20 second current access switches under the convergence switch 1 complete pairing with the corresponding second to-be-tested access switches. Further, the first server under the second current access switch is taken as a third source object, the first server under the second to-be-tested access switch is taken as a third detection object, a detection link between the third source object and the third detection object is constructed, and the detection links between all the third source objects and the third detection objects under the first current convergence switch are summarized to generate an external hierarchical network topology relationship corresponding to the first current convergence switch.

[0096] It is worth noting that if the number of aggregation switches adjacent to the first current aggregation switch in sequence after the target core switch is less than the third set number, the aggregation switches adjacent in sequence before the target core switch can be supplemented. For example, there are 31 aggregation switches under the target core switch, the first current aggregation switch is numbered as aggregation switch 10, and the third set number is 20. The aggregation switches behind the aggregation switch 10 can be obtained first. Here, the number of aggregation switches adjacent in sequence after the aggregation switch 10 is 11, which is less than the third set number 20. Therefore, 9 aggregation switches before the aggregation switch 10 are obtained as the first to-be-tested aggregation switches.

[0097] Step c4, aggregating the external hierarchical network topology relationship corresponding to all the first current aggregation switches under all the target core switches to generate the external hierarchical network topology relationship of all the aggregation switches corresponding to the target data center.

[0098] Specifically, after generating the external hierarchical network topology relationship corresponding to each first current aggregation switch, the external hierarchical network topology relationship corresponding to all the first current aggregation switches under the same target core switch is aggregated, and the external hierarchical network topology relationship corresponding to the first current aggregation switches under all the target core switches in the target data center is aggregated. Thus, the external hierarchical network topology relationship of all the aggregation switches corresponding to the target data center is generated, which provides an effective basis for subsequent fault location.

[0099] S205, based on the preset core switch external hierarchical detection rule, the core switch information corresponding to the target data center, the aggregation switch information corresponding to each core switch, the access switch information corresponding to each aggregation switch, and the server information corresponding to each access switch, constructing the external hierarchical network topology relationship of all the core switches corresponding to the target data center.

[0100] The preset core switch external hierarchical detection rule can refer to a preset core switch external hierarchical detection link determination rule. Through the preset core switch external hierarchical detection rule, the detection link topology relationship between the servers under different core switches can be determined.

[0101] The core switch external hierarchical network topology relationship can refer to the detection link topology relationship of the core switch external hierarchy according to the preset core switch external hierarchical detection rule. Generally, the core switch external hierarchical network topology relationship can include the source server number and the corresponding detected server number under different core switches. The external hierarchical network topology relationship of all the core switches can refer to the external hierarchical network topology relationship of all the core switches in the target data center.

[0102] In an optional implementation, the constructing of the full-amount core switch external hierarchical network topology relationship corresponding to the target data center based on the preset core switch external hierarchical detection rule, the core switch information corresponding to the target data center, the aggregation switch information corresponding to each core switch, the access switch information corresponding to each aggregation switch, and the server information corresponding to each access switch comprises:

[0103] Step d1, acquiring a current core switch under the target data center and a to-be-tested core switch corresponding to the current core switch based on the core switch information corresponding to the target data center.

[0104] The current core switch can refer to a source core switch currently selected for the determination of the network topology relationship. The to-be-tested core switch can refer to a detected core switch corresponding to the current core switch. For example, the to-be-tested core switch can be the remaining core switches in the target data center except the current core switch.

[0105] Step d2, determining a second current aggregation switch of the same number under the current core switch and a second to-be-tested aggregation switch of the same number under the to-be-tested core switch based on the aggregation switch information corresponding to each core switch.

[0106] The second current aggregation switch can refer to an aggregation switch initiating a detection request under the current core switch. The second to-be-tested aggregation switch can refer to a detected aggregation switch corresponding to the second current aggregation switch.

[0107] Specifically, if the current core switch is core switch 1 and the to-be-tested core switch is core switch 2, the second current aggregation switch is aggregation switch 1 in the sorting of all aggregation switches, and the second to-be-tested aggregation switch is aggregation switch 2 in the sorting of all aggregation switches.

[0108] Step d3, acquiring a fourth set number of third current access switches under the second current aggregation switch based on the access switch information corresponding to each aggregation switch, and acquiring a third to-be-tested access switch under the second to-be-tested aggregation switch based on the third current access switch and a preset sorting remainder rule.

[0109] The fourth set number can refer to a number limiting the number of devices in the layer outside the core switch. For example, the number of probe links sent by each core switch in the layer outside the core switch can be multiplied. Specifically, if each core switch is connected to two customer edge (CE) devices, i.e., the link between each core switch and the customer edge device is two, in the embodiment of the application, each core switch can send a set number of probe links, such as 5 times probe links, i.e., 10 probe links. In this way, the coverage of all probe links can be improved.

[0110] The third current access switch can refer to a source access switch sending a probe request under the second current aggregation switch. Generally, to ensure that the access switches under each aggregation switch are sufficiently dispersed, the fourth set number of third current access switches are selected under each second current aggregation switch. The third to-be-tested access switch can refer to a probed access switch corresponding to the third current access switch.

[0111] In step d4, a first server under the third current access switch is taken as a fourth source object, a first server under the third to-be-tested access switch is taken as a fourth probe object, a probe link between the fourth source object and the fourth probe object is constructed, and an external layer network topology relationship corresponding to the current core switch is generated.

[0112] The fourth source object can refer to a source object in the layer outside the core switch. The fourth probe object can refer to a probe object in the layer outside the core switch. The external layer network topology relationship corresponding to the current core switch can refer to a network topology relationship formed between each fourth source object and a corresponding fourth probe object under the current core switch.

[0113] Figure 8A schematic diagram of an external hierarchical network topology relationship of a core switch is provided for an embodiment of the present application. Specifically, for a target core switch under a target data center, a cluster switch under the target core switch, an access switch under all cluster switches, and a server under each access switch, the IP is sorted, the source core switch under the target data center that initiates a detection request is taken as a current core switch, the remaining core switches are taken as to-be-detected core switches, the cluster switch of the same number under the current core switch is taken as a second current cluster switch, and the cluster switch of the same number under the to-be-detected core switch is taken as a second to-be-detected cluster switch. For example, if the current core switch is core switch 1 and the to-be-detected core switch is core switch 2, the second current cluster switch is cluster switch 1 in the sorting of all cluster switches, and the second to-be-detected cluster switch is cluster switch 2 in the sorting of all cluster switches. Further, to ensure that the access switches under each cluster switch are sufficiently dispersed, a fourth set number of third current access switches are selected under each second current cluster switch, and the third to-be-detected access switches under the second to-be-detected cluster switch are determined according to a preset sorting remainder rule. For example, taking the second current cluster switch as the cluster switch 1 under the current core switch and the second to-be-detected cluster switch as the cluster switch 2 under the to-be-detected core switch, and taking the cluster switch 2 as an example that contains v access switches. The third to-be-detected access switch corresponding to the third current access switch numbered u under the cluster switch 1 has a number of (u%v) in the cluster switch 2. For example, if the cluster switch 1 contains 10 access switches, the cluster switch 2 contains 10 access switches, the fourth set number is 10, and the third current access switch is the access switch numbered 1 under the cluster switch 1, then the third to-be-detected access switch is the access switch numbered 1 under the cluster switch 2, that is, the access switch numbered 11 in all access switches. Similarly, if the third current access switch is the access switch numbered 2 under the cluster switch 1, then the third to-be-detected access switch is the access switch numbered 2 under the cluster switch 2, that is, the access switch numbered 12 in all access switches. By analogy, the 10 third current access switches under the cluster switch 1 are paired with the corresponding third to-be-detected access switches. Further, the first server under the third current access switch is taken as a fourth source object, the first server under the third to-be-detected access switch is taken as a fourth detection object, a detection link between the fourth source object and the fourth detection object is constructed, and the detection links between all fourth source objects and fourth detection objects under the current core switch are summarized to generate an external hierarchical network topology relationship corresponding to the current core switch.

[0114] Step d5, aggregate the external hierarchical network topology relationship corresponding to the full amount of current core switches under the target data center to generate the full amount of core switch external hierarchical network topology relationship corresponding to the target data center.

[0115] Specifically, after generating the external hierarchical network topology relationship corresponding to each current core switch, the external hierarchical network topology relationship corresponding to the full amount of current core switches under the same target data center is aggregated, thereby generating the full amount of core switch external hierarchical network topology relationship corresponding to the target data center, providing an effective basis for subsequent fault location.

[0116] S206, de-duplicate the full amount of access switch internal hierarchical network topology relationship, full amount of access switch external hierarchical network topology relationship, full amount of aggregation switch external hierarchical network topology relationship, and full amount of core switch external hierarchical network topology relationship to obtain a preset network search list corresponding to the target data center.

[0117] Wherein, the de-duplication processing can refer to the processing operation of screening out repeated detection links. For example, the repeated detection links in the full amount of access switch internal hierarchical network topology relationship, the full amount of access switch external hierarchical network topology relationship, the full amount of aggregation switch external hierarchical network topology relationship, and the full amount of core switch external hierarchical network topology relationship are screened out, only one detection link is retained in each group of repeated detection links, and the remaining detection links are deleted to generate a preset network search list corresponding to the target data center. Thus, the number of detection links between the source object and the detection object within one detection period can be ensured to be one, avoiding the repetition of data transmission and improving the efficiency of fault location.

[0118] Specifically, if the number of core switches in the target data center CS = 8, the number of aggregation switches SPS = 74, the number of access switches LS = 1843, the average number of servers under each access switch S = 45, the number of user network edge devices connected by each core switch CE = 4, the first set number is 3, the second set number is 12, the third set number is 20, and the fourth set number is 20. Then, in the preset network search list, the full amount of access switch internal hierarchical network topology relationship contains 3*S*LS = 248805 detection links. The full amount of access switch external hierarchical network topology relationship contains 12*12*LS = 265392 detection links. The full amount of aggregation switch external hierarchical network topology relationship contains 20*20*SPS = 29600 detection links. The full amount of core switch external hierarchical network topology relationship contains CE*5*CS*(CS-1) = 20*CS*(CS-1) = 1120 detection links. That is, there are a total of 54W detection links in the target data center, which greatly reduces the number of detection links compared to the prior art.

[0119] S207, determining, by the target agent service, a target detection object corresponding to the target server based on the preset network search list, performing grouped network search on the target detection object according to a first set time length to generate a current detection flow, and performing path collection on the target detection object according to a second set time length to generate a current path.

[0120] The target detection object can refer to a detected server corresponding to the target server. The grouped network search can refer to a ping detection operation performed according to a ping command. The first set time length can refer to a time period for periodically limiting the grouped network search operation. For example, the first set time length can be 5s or 10s, etc. The current detection flow can refer to a ping detection result between the target server and the target detection object in the current detection period. For example, the current detection flow can include source IP, destination IP, packet loss rate, and delay time, etc.

[0121] The path collection can refer to a network path acquisition operation performed according to a path tracking command. The second set time length can refer to a time period for periodically limiting the path collection operation. For example, the second set time length can be 1h. The current path can refer to a data transmission link between the target server and the target detection object in the actual data transmission process.

[0122] S208, aggregating current detection flows corresponding to all target agent services at the same time as a current detection flow set corresponding to the target data center, and aggregating current paths corresponding to all target agent services at the same time as a current path set corresponding to the target data center.

[0123] Specifically, after the target agent service performs grouped network search on the target detection object according to the first set time length to generate the current detection flow, the current detection flows corresponding to all target agent services at the same time are aggregated to generate a current detection flow set corresponding to the target data center. After the path collection on the target detection object according to the second set time length to generate the current path, the current paths corresponding to all target agent services at the same time are aggregated to generate a current path set corresponding to the target data center. Thus, effective data basis is provided for subsequent fault location.

[0124] S209, based on the target data center corresponding to the historical detection flow set integrity check each target detection flow in the current detection flow set, and obtain the integrity index corresponding to each target detection flow.

[0125] The historical detection flow set can refer to a set composed of each detection flow collected in a historical time period. For example, it can be a set composed of each detection flow collected in the previous week or the previous month.

[0126] The integrity check can refer to a data integrity check operation on the target probe stream. For example, the integrity check can include format check and data volume check. Specifically, the format check can be a standardization check on the data format of the target probe stream. The data volume check can be to determine whether there is probe stream data of the same probe link as the target probe stream in the historical probe stream set.

[0127] In S210, a probe threshold corresponding to the target probe stream is determined based on a preset alarm strategy and the integrity index.

[0128] The preset alarm strategy can refer to a preset data evaluation strategy. For example, the preset alarm strategy can be a dynamic prediction strategy or a static prediction strategy.

[0129] In an optional embodiment, the determination of the probe threshold corresponding to the target probe stream based on the preset alarm strategy and the integrity index includes:

[0130] In e1, if the preset alarm strategy is a dynamic prediction strategy and the integrity index corresponding to the target probe stream is an integrity result, a dynamic threshold is generated based on the historical probe stream corresponding to the target probe stream in the historical probe stream set, and the dynamic threshold is taken as the probe threshold corresponding to the target probe stream.

[0131] The dynamic prediction strategy can refer to a strategy for dynamically evaluating data. The dynamic threshold can refer to a threshold that changes with time points.

[0132] Specifically, the data fluctuation of the same probe pair, i.e., the target server and the corresponding probed server, can be different at different time points. Therefore, in the case where the preset alarm strategy is a dynamic prediction strategy and the integrity index corresponding to the target probe stream is an integrity result, the probe threshold of the target probe stream can be determined by using the historical probe stream generated by the probe pair corresponding to the target probe stream in a historical time period. For example, if the delay of the probe pair corresponding to the target probe stream at zero o'clock in the historical probe stream in a month is 5 ms, and the delay at nine o'clock in the morning is 15 ms, the probe threshold of the target probe stream at zero o'clock can be set to 15 ms, and the probe threshold at nine o'clock in the morning can be set to 30 ms. In this way, the probe threshold corresponding to the target probe stream can be more refined, and the accuracy of fault positioning is improved.

[0133] In e2, if the preset alarm strategy is a static prediction strategy, a static threshold corresponding to the target probe stream is determined based on a preset threshold setting rule, and the static threshold is taken as the probe threshold corresponding to the target probe stream.

[0134] The solid-state prediction strategy can refer to a strategy of fixed evaluation of data. The preset threshold setting rule can refer to a pre-set solid-state threshold determination standard. Generally, different detection data correspond to different solid-state threshold determination standards. For example, if the detection data is packet loss, the preset threshold setting rule can be that the solid-state threshold is lower than 50%. If the detection data is delay time, the preset threshold setting rule can be that the delay time is lower than 100 ms. The solid-state threshold can refer to a threshold that does not change with the change of time point.

[0135] Specifically, if the preset alarm strategy is a solid-state prediction strategy, the solid-state threshold corresponding to each detection data in the target detection flow can be determined based on the preset threshold setting rule, and the solid-state threshold corresponding to each detection data is taken as the detection threshold corresponding to the target detection flow. Thus, the corresponding detection threshold of the target detection flow is determined, which provides an effective basis for subsequent fault location.

[0136] S211, data analysis of the target detection flow based on the detection threshold, generating an abnormal alarm data set corresponding to the current detection flow set.

[0137] Specifically, after determining the detection threshold corresponding to the target detection flow, each detection data in the target detection flow can be compared with the threshold using each detection threshold. When the delay time or packet loss in the target detection flow exceeds the corresponding detection threshold, the abnormal alarm data corresponding to the target detection flow is generated. Further, the abnormal alarm data corresponding to all target detection flows in the current detection flow set is combined to generate an abnormal alarm data set corresponding to the current detection flow set.

[0138] In an optional embodiment, after the data analysis of the target detection flow based on the detection threshold, generating an abnormal alarm data set corresponding to the current detection flow set, the method further comprises:

[0139] Step f1, if the abnormal alarm data set is empty, obtaining a quality evaluation requirement corresponding to the target data center; wherein the quality evaluation requirement includes identification information of the target data center and identification information of a detection data center corresponding to the target data center.

[0140] The quality evaluation requirement can refer to a data transmission quality detection requirement initiated by a user. For example, it can be a requirement for evaluating data delay. Generally, the quality evaluation requirement can include identification information of the target data center and identification information of a detection data center corresponding to the target data center. The identification information can refer to the unique identification data of each data center. For example, it can be the IP address of each data center. The detection data center can refer to a detected data center corresponding to the target data center.

[0141] Step f2, based on the identification information of the target data center and the identification information of the detection data center, obtaining a candidate detection flow set between the target data center and the detection data center in the current detection flow set.

[0142] The candidate detection flow can refer to a detection flow in the current detection flow set, the detection path of which contains the target data center and the detection data center. The candidate detection flow set can refer to a set composed of each candidate detection flow.

[0143] Step f3, performing quality evaluation on the candidate detection flows in the candidate detection flow set based on a preset evaluation standard, and generating a quality evaluation result corresponding to the target data center.

[0144] The preset evaluation standard can refer to a pre-set quality evaluation standard. For example, the preset evaluation standard can include delay time evaluation and packet loss evaluation. The quality evaluation can refer to a numerical comparison operation of each candidate detection flow according to the preset evaluation standard. The quality evaluation result can refer to a conclusive result generated after quality evaluation according to the preset evaluation standard. For example, it can be the maximum value or the average value between each detection flow data.

[0145] Specifically, after performing data analysis on the target detection flow based on the detection threshold, generating an abnormal alarm data set corresponding to the current detection flow set, if the abnormal alarm data set is empty, it indicates that there is no fault node in the target data center. At this time, if there is a demand to query the data delay between the target data center and the corresponding detection data center, the candidate detection flow set between the target data center and the detection data center can be obtained in the current detection flow set according to the identification information of the target data center and the identification information of the target data center corresponding to the detection data center, and the quality evaluation of the candidate detection flow in the candidate detection flow set is performed based on the preset evaluation standard, and the quality evaluation result corresponding to the target data center is generated. For example, there are three candidate detection flows in the candidate detection flow set, wherein the delay time of the candidate detection flow 1 is 5ms, the delay time of the candidate detection flow 2 is 5ms, and the delay time of the candidate detection flow 3 is 15ms, and the preset evaluation standard is that the difference between each delay time is less than 5ms. Through the quality evaluation of each candidate detection flow based on the preset evaluation standard, it can be determined that there is a candidate detection flow that does not meet the preset evaluation standard. At this time, the maximum value between each delay time can be taken as the quality evaluation result corresponding to the target data center. Thus, the data transmission quality of the target data center can be evaluated in the case that there is no fault node in the target data center.

[0146] S212, determining the abnormal network path corresponding to each abnormal alarm data in the abnormal alarm data set based on the current path set, and processing each abnormal network path to obtain a common network node set.

[0147] Specifically, after generating the abnormal alarm data set corresponding to the current probe flow set, the abnormal network path corresponding to each abnormal alarm data can be determined in the current path set, and each network node in each abnormal network path is compared and summarized to obtain the common network node corresponding to each abnormal network path, which constitutes a common network node set, providing an effective basis for subsequent determination of fault nodes.

[0148] S213, the occurrence frequency of each common network node in the common network node set is counted, and the target fault node corresponding to the target data center is determined based on the statistical result.

[0149] In an optional embodiment, the target fault node corresponding to the target data center is determined based on the statistical result, comprising:

[0150] Step g1, if the highest frequency common network node in the statistical result is unique, the highest frequency common network node is taken as the target fault node corresponding to the target data center.

[0151] Among them, the highest frequency common network node can refer to the common network node with the maximum frequency. For example, if the common network node set contains common network node 1, common network node 2 and common network node 3, the frequency of common network node 1 is 3, the frequency of common network node 2 is 5, and the frequency of common network node 3 is 7. Then the common network node 3 is the highest frequency common network node.

[0152] Specifically, after counting the occurrence frequency of each common network node in the common network node set, if there is only one highest frequency common network node, the highest frequency common network node can be taken as the target fault node corresponding to the target data center.

[0153] Step g2, if the highest frequency common network node in the statistical result is not unique, each highest frequency common network node is taken as a candidate fault node, and a target fault node in the candidate fault node is determined based on a preset routing tracking instruction as the target fault node corresponding to the target data center.

[0154] Among them, the candidate fault node can refer to the common network node that needs to be judged twice. The preset routing tracking instruction can refer to the pre-set real-time routing path collection instruction. For example, the preset routing tracking instruction can be the traceroute instruction.

[0155] Specifically, after counting the occurrence frequencies of the public network nodes in the set of public network nodes, if there are multiple public network nodes with the highest occurrence frequency, the preset route tracking instruction can be used to collect real-time paths of the probe links where the multiple public network nodes with the highest occurrence frequency are located, and the target fault node corresponding to the target data center can be determined according to the real-time path collection result.

[0156] In an optional implementation, after the occurrence frequencies of the public network nodes in the set of public network nodes are counted and the target fault node corresponding to the target data center is determined based on the counting result, the method further includes: performing fault disposal on the target fault node to isolate the target fault node. The fault disposal can refer to an operation of isolating and disposing the target fault node. For example, a port of the target fault node can be closed. In this way, the target fault node can be stopped from transmitting data, and the influence of the target fault node on the data transmission process can be reduced.

[0157] In the embodiment of the present application, by presetting the internal hierarchical detection rules of the access switches and the server information corresponding to each access switch, the full-amount internal hierarchical network topology relationship of the access switches corresponding to the target data center is constructed. By presetting the external hierarchical detection rules of the access switches, the access switch information corresponding to each aggregation switch and the server information corresponding to each access switch, the full-amount external hierarchical network topology relationship of the access switches corresponding to the target data center is constructed. By presetting the external hierarchical detection rules of the aggregation switches, the aggregation switch information corresponding to each core switch, the access switch information corresponding to each aggregation switch and the server information corresponding to each access switch, the full-amount external hierarchical network topology relationship of the aggregation switches corresponding to the target data center is constructed. By presetting the external hierarchical detection rules of the core switches, the core switch information corresponding to the target data center, the aggregation switch information corresponding to each core switch, the access switch information corresponding to each aggregation switch and the server information corresponding to each access switch, the full-amount external hierarchical network topology relationship of the core switches corresponding to the target data center is constructed. Then, the full-amount internal hierarchical network topology relationship of the access switches, the full-amount external hierarchical network topology relationship of the access switches, the full-amount external hierarchical network topology relationship of the aggregation switches and the full-amount external hierarchical network topology relationship of the core switches are processed to obtain a preset network search list corresponding to the target data center. The target proxy service determines the target detection object corresponding to the target server based on the preset network search list, performs grouped network search on the target detection object for a first set time to generate a current detection flow, and collects the path of the target detection object for a second set time to generate a current path. The current detection flows corresponding to the full-amount target proxy services at the same time are summarized as a current detection flow set corresponding to the target data center, and the current paths corresponding to the full-amount target proxy services at the same time are summarized as a current path set corresponding to the target data center. Further, based on the integrity check of each target detection flow in the current detection flow set corresponding to the target data center, the integrity index corresponding to each target detection flow is obtained. Based on the preset alarm strategy and the integrity index, the detection threshold corresponding to the target detection flow is determined, and the data analysis of the target detection flow is performed based on the detection threshold to generate an abnormal alarm data set corresponding to the current detection flow set. Finally, based on the current path set, the abnormal network path corresponding to each abnormal alarm data in the abnormal alarm data set is determined, the common network node set is obtained by processing each abnormal network path, and the occurrence frequency of each common network node in the common network node set is counted. Based on the statistical result, the target fault node corresponding to the target data center is determined. Since the detection flow between the servers is collected based on the preset hierarchical detection method, the number of detection flows between the servers is greatly reduced, and the network fault node is located by combining the abnormal alarm data and the routing path corresponding to the detection flow, without the need for traffic collection or port mirroring on the network equipment.Therefore, it can solve the problem of poor real-time performance in locating faults in the underlying network and can quickly locate faulty nodes in the underlying network.

[0158] Figure 9 This is a flowchart illustrating another method for fault location in a data center's underlying network, provided by an embodiment of the present invention. Specifically, firstly, a preset network search list corresponding to the target data center is constructed based on the basic network topology data corresponding to the target data center's underlying network. A basic proxy service is generated based on the underlying principle of grouped network search, and this basic proxy service is deployed to all servers within the target data center. Next, the target proxy service within each target server determines the target probe object corresponding to the target server based on the preset network search list. Grouped network search is performed on the target probe object for a first set of time to generate the current probe flow, and path collection is performed on the target probe object for a second set of time to generate the current path. The current probe flows corresponding to all target proxy services at the same time are aggregated as the current probe flow set corresponding to the target data center, and the current paths corresponding to all target proxy services at the same time are aggregated as the current path set corresponding to the target data center. Further, the integrity of each target probe flow in the current probe flow set is verified based on the historical probe flow set corresponding to the target data center to obtain the integrity index corresponding to each target probe flow. A detection threshold corresponding to the target probe flow is determined based on a preset alarm strategy and the integrity index. Finally, data analysis is performed on the target probe flows based on the detection threshold to generate an abnormal alarm data set corresponding to the current probe flow set. If the abnormal alarm data set is empty, a quality assessment of the target data center can be performed based on its quality assessment requirements, generating a corresponding quality assessment result. If the abnormal alarm data set is not empty, the baseline paths in the current path set can be completed using a preset network search list. Based on the current path set, the abnormal network paths corresponding to each abnormal alarm data point in the abnormal alarm data set are determined, and these abnormal network paths are aggregated to obtain a common network node set. Finally, the frequency of occurrence of each common network node in the common network node set is statistically analyzed. Based on the statistical results, the target fault node corresponding to the target data center is determined, and fault handling is performed on the target fault node to isolate it. This completes the fault location of the underlying network of the target data center.

[0159] Figure 10 This is a schematic diagram of a fault location device for a data center underlying network provided in an embodiment of the present invention. Figure 10 As shown, the device includes: a data acquisition module 301, a data analysis module 302, a fault analysis module 303, and a fault location module 304;

[0160] The data collection module 301 is configured to acquire a current probe flow set and a current path set corresponding to a target data center collected by each target proxy service based on a preset network search list; the target proxy service is deployed in each target server of the target data center; the preset network search list includes internal hierarchical network topology relationships of access switches corresponding to each target server, external hierarchical network topology relationships of the access switches, external hierarchical network topology relationships of aggregation switches, and external hierarchical network topology relationships of core switches.

[0161] The data analysis module 302 is configured to determine a probe threshold corresponding to each target probe flow in the current probe flow set based on an integrity index of the target probe flow, and perform data analysis on the target probe flow based on the probe threshold, to generate an abnormal alarm data set corresponding to the current probe flow set.

[0162] The fault analysis module 303 is configured to determine an abnormal network path corresponding to each abnormal alarm data in the abnormal alarm data set based on the current path set, and aggregate and process each abnormal network path to obtain a common network node set.

[0163] The fault positioning module 304 is configured to count the occurrence frequency of each common network node in the common network node set, and determine a target fault node corresponding to the target data center based on the counting result.

[0164] In the embodiment of the application, the current probe flow set and the current path set corresponding to the target data center are collected by each target proxy service based on the preset network search list, then the probe threshold corresponding to each target probe flow in the current probe flow set is determined based on the integrity index of the target probe flow, and the target probe flow is analyzed based on the probe threshold to generate the abnormal alarm data set corresponding to the current probe flow set, further, the abnormal network path corresponding to each abnormal alarm data in the abnormal alarm data set is determined based on the current path set, and each abnormal network path is aggregated and processed to obtain the common network node set, finally, the occurrence frequency of each common network node in the common network node set is counted, and the target fault node corresponding to the target data center is determined based on the counting result. Since the probe flow between servers is collected based on the preset hierarchical detection method, the number of probe flows between servers is greatly reduced, and the abnormal alarm data and the routing path corresponding to the probe flow are combined to locate the network fault node, without the need for traffic collection or port mirroring on the network equipment. Therefore, the real-time problem of bottom-layer network fault positioning can be solved, and the fault node of the bottom-layer network can be quickly positioned.

[0165] Optionally, the fault locating device of the data center bottom-layer network further comprises a search list generation module, which comprises a topology data acquisition unit, a first hierarchical relationship construction unit, a second hierarchical relationship construction unit, a third hierarchical relationship construction unit, a fourth hierarchical relationship construction unit, and a data deduplication unit.

[0166] The topology data acquisition unit is configured to acquire basic network topology data corresponding to the target data center bottom-layer network before acquiring the current probe flow set and the current path set corresponding to the target data center collected by each target proxy service based on a preset network search list; the basic network topology data comprises core switch information corresponding to the target data center, aggregation switch information corresponding to each core switch, access switch information corresponding to each aggregation switch, and server information corresponding to each access switch.

[0167] The first hierarchical relationship construction unit is configured to construct full-amount access switch internal hierarchical network topology relationships corresponding to the target data center based on a preset access switch internal hierarchical detection rule and the server information corresponding to each access switch.

[0168] The second hierarchical relationship construction unit is configured to construct full-amount access switch external hierarchical network topology relationships corresponding to the target data center based on a preset access switch external hierarchical detection rule, the access switch information corresponding to each aggregation switch, and the server information corresponding to each access switch.

[0169] The third hierarchical relationship construction unit is configured to construct full-amount aggregation switch external hierarchical network topology relationships corresponding to the target data center based on a preset aggregation switch external hierarchical detection rule, the aggregation switch information corresponding to each core switch, the access switch information corresponding to each aggregation switch, and the server information corresponding to each access switch.

[0170] The fourth hierarchical relationship construction unit is configured to construct full-amount core switch external hierarchical network topology relationships corresponding to the target data center based on a preset core switch external hierarchical detection rule, the core switch information corresponding to the target data center, the aggregation switch information corresponding to each core switch, the access switch information corresponding to each aggregation switch, and the server information corresponding to each access switch.

[0171] The data deduplication unit is configured to perform deduplication processing on the full-amount access switch internal hierarchical network topology relationships, the full-amount access switch external hierarchical network topology relationships, the full-amount aggregation switch external hierarchical network topology relationships, and the full-amount core switch external hierarchical network topology relationships to obtain a preset network search list corresponding to the target data center.

[0172] Optionally, the first hierarchical relationship construction unit can be specifically configured to:

[0173] based on the server information corresponding to each access switch, a first current server under the target access switch and a first set number of first to-be-tested servers corresponding to the first current server are acquired;

[0174] the first current server is taken as a first source object, the first to-be-tested server is taken as a first detection object, a detection link between the first source object and the first detection object is constructed, and an internal hierarchical network topology relationship corresponding to the target access switch is generated;

[0175] internal hierarchical network topology relationships corresponding to all target access switches are summarized, and a full-amount access switch internal hierarchical network topology relationship corresponding to the target data center is generated.

[0176] Optionally, the second hierarchical relationship construction unit can be specifically used for:

[0177] based on the access switch information corresponding to each aggregation switch, a first current access switch under the target aggregation switch and a second set number of first to-be-tested access switches corresponding to the first current access switch are acquired;

[0178] based on the server information corresponding to each access switch, a second set number of second current servers under the first current access switch are acquired, and based on the second current servers and a preset sorting remainder rule, second to-be-tested servers under the first to-be-tested access switch are acquired;

[0179] the second current servers are taken as second source objects, the second to-be-tested servers are taken as second detection objects, a detection link between the second source objects and the second detection objects is constructed, and an external hierarchical network topology relationship corresponding to the first current access switch is generated;

[0180] external hierarchical network topology relationships corresponding to all first current access switches under all target aggregation switches are summarized, and a full-amount access switch external hierarchical network topology relationship corresponding to the target data center is generated.

[0181] Optionally, the third hierarchical relationship construction unit can be specifically used for:

[0182] based on the aggregation switch information corresponding to each core switch, a first current aggregation switch under the target core switch and a third set number of first to-be-tested aggregation switches corresponding to the first current aggregation switch are acquired;

[0183] based on the access switch information corresponding to each aggregation switch, a third set number of second current access switches under the first current aggregation switch are acquired, and based on the second current access switches and a preset sorting remainder rule, second to-be-tested access switches under the first to-be-tested aggregation switch are acquired;

[0184] taking the first server under the second current access switch as a third source object, taking the first server under the second to-be-tested access switch as a third probe object, constructing a probe link between the third source object and the third probe object, and generating an external hierarchical network topology relationship corresponding to the first current aggregation switch;

[0185]

[0186] Optionally, the fourth hierarchical relationship construction unit can be specifically used for:

[0187] based on the core switch information corresponding to the target data center, obtaining a current core switch under the target data center and a to-be-tested core switch corresponding to the current core switch;

[0188] based on the aggregation switch information corresponding to each core switch, determining a second current aggregation switch of the same number under the current core switch and a second to-be-tested aggregation switch of the same number under the to-be-tested core switch;

[0189] based on the access switch information corresponding to each aggregation switch, obtaining a fourth set number of third current access switches under the second current aggregation switch, and based on the third current access switch and a preset sorting remainder rule, obtaining a third to-be-tested access switch under the second to-be-tested aggregation switch;

[0190] taking the first server under the third current access switch as a fourth source object, taking the first server under the third to-be-tested access switch as a fourth probe object, constructing a probe link between the fourth source object and the fourth probe object, and generating an external hierarchical network topology relationship corresponding to the current core switch;

[0191]

[0192] Optionally, the fault location device of the data center bottom-layer network can further include a proxy service deployment module configured to, before obtaining the current probe flow set and the current path set corresponding to the target data center collected by each target proxy service based on a preset network search list, generate a basic proxy service based on a grouping network search bottom-layer principle, and deploy the basic proxy service to all servers in the target data center.

[0193] Optionally, the data collection module 301 can be specifically used for:

[0194] ​​The target probe object corresponding to the target server is determined based on a preset network search list through the target agent service, and a current probe flow is generated by grouping network search of the target probe object according to a first set time length, and a current path is generated by path collection of the target probe object according to a second set time length;

[0195] The current probe flows corresponding to all target agent services at the same time are summarized as a current probe flow set corresponding to the target data center, and the current paths corresponding to all target agent services at the same time are summarized as a current path set corresponding to the target data center.

[0196] Optionally, the data analysis module 302 can specifically include an index determination unit and a data analysis unit.

[0197] The index determination unit is configured to verify each target probe flow in the current probe flow set based on the historical probe flow set corresponding to the target data center, and obtain an integrity index corresponding to each target probe flow.

[0198] The data analysis unit is configured to determine a probe threshold value corresponding to the target probe flow based on a preset alarm strategy and the integrity index.

[0199] Optionally, the data analysis unit can be specifically configured to:

[0200] If the preset alarm strategy is a dynamic prediction strategy and the integrity index corresponding to the target probe flow is an integrity result, a dynamic threshold value is generated based on a historical probe flow corresponding to the target probe flow in the historical probe flow set, and the dynamic threshold value is taken as the probe threshold value corresponding to the target probe flow.

[0201] If the preset alarm strategy is a solid-state prediction strategy, a solid-state threshold value corresponding to the target probe flow is determined based on a preset threshold value setting rule, and the solid-state threshold value is taken as the probe threshold value corresponding to the target probe flow.

[0202] Optionally, the fault location module 304 can be specifically configured to:

[0203] If the highest frequency public network node in the statistical result is unique, the highest frequency public network node is taken as the target fault node corresponding to the target data center.

[0204] If the highest frequency public network node in the statistical result is not unique, each highest frequency public network node is taken as a candidate fault node, and a target fault node in the candidate fault node is determined based on a preset routing tracking instruction, and is taken as the target fault node corresponding to the target data center.

[0205] Optionally, the fault locating apparatus of the data center underlying network further comprises a fault isolation module, configured to: count the occurrence frequencies of each public network node in the set of public network nodes, and determine a target fault node corresponding to the target data center based on the counting result; and perform fault disposal on the target fault node to isolate the target fault node after the target fault node is determined.

[0206] Optionally, the fault locating apparatus of the data center underlying network further comprises a quality evaluation module, configured to: after the data analysis on the target probe stream based on the probe threshold is performed to generate a set of abnormal alarm data corresponding to the set of current probe streams, if the set of abnormal alarm data is empty, acquire a quality evaluation requirement corresponding to the target data center; wherein the quality evaluation requirement comprises identification information of the target data center and identification information of a probe data center corresponding to the target data center; based on the identification information of the target data center and the identification information of the probe data center, acquire a set of candidate probe streams between the target data center and the probe data center from the set of current probe streams; and perform quality evaluation on the candidate probe streams in the set of candidate probe streams based on a preset evaluation standard to generate a quality evaluation result corresponding to the target data center.

[0207] The fault locating apparatus of the data center underlying network provided by the embodiments of the present application can execute the fault locating method of the data center underlying network provided by any of the embodiments of the present application, and has the corresponding function modules and beneficial effects of the execution method.

[0208] Figure 11 A structural diagram of a server for implementing the fault locating method of the data center underlying network according to the embodiments of the present application is shown in FIG. 4. Figure 11 As shown in FIG. 4, the server comprises a processor 410, a memory 420, an input device 430 and an output device 440; the number of processors 410 in the server can be one or more, Figure 11 and one processor 410 is taken as an example in this embodiment; the processor 410, the memory 420, the input device 430 and the output device 440 in the server can be connected through a bus or other means, Figure 11 and the connection through the bus is taken as an example in this embodiment.

[0209] The memory 420, as a computer readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the fault locating method of the data center underlying network in the embodiments of the present application (for example, the data collection module 301, the data analysis module 302, the fault analysis module 303 and the fault locating module 304 in the fault locating device of the data center underlying network). The processor 410 executes various functions of the server and data processing by running the software programs, instructions and modules stored in the memory 420, that is, implements the above-mentioned fault locating method of the data center underlying network.

[0210] The method comprises:

[0211] Obtaining a current probe flow set and a current path set corresponding to the target data center based on the target data collected by each target proxy service based on a preset network search list; wherein the target proxy service is deployed in each target server of the target data center; the preset network search list includes the internal hierarchical network topology relationship of the access switch corresponding to each target server, the external hierarchical network topology relationship of the access switch, the external hierarchical network topology relationship of the aggregation switch and the external hierarchical network topology relationship of the core switch;

[0212] Determining a probe threshold value corresponding to each target probe flow based on the integrity index of the target probe flow in the current probe flow set, and performing data analysis on the target probe flow based on the probe threshold value to generate an abnormal alarm data set corresponding to the current probe flow set;

[0213] Determining an abnormal network path corresponding to each abnormal alarm data in the abnormal alarm data set based on the current path set, and processing each abnormal network path to obtain a common network node set;

[0214] Counting the occurrence frequency of each common network node in the common network node set, and determining a target fault node corresponding to the target data center based on the statistical result.

[0215] The memory 420 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system and at least one application required by a function; the data storage area can store data created according to the use of the terminal, etc. In addition, the memory 420 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some examples, the memory 420 can further include a memory remotely arranged with respect to the processor 410, which can be connected to the server through a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network and a combination thereof.

[0216] The input device 430 can be used to receive inputted digital or character information, and to generate key signal inputs related to user settings and function controls of the server. The output device 440 can include a display device such as a display screen.

[0217] The embodiment of the present application also provides a computer readable storage medium, which stores a computer program, and the program is used for executing a fault locating method of a data center bottom network when executed by a computer processor, and the method comprises the following steps:

[0218] Obtaining a current probe flow set and a current path set corresponding to a target data center, which are collected by each target proxy service based on a preset network search list; the target proxy service is deployed in each target server of the target data center; the preset network search list comprises internal hierarchical network topology relationships of access switches corresponding to each target server, external hierarchical network topology relationships of the access switches, external hierarchical network topology relationships of aggregation switches, and external hierarchical network topology relationships of core switches;

[0219] Determining a probe threshold corresponding to each target probe flow in the current probe flow set based on an integrity index of the target probe flow, and performing data analysis on the target probe flow based on the probe threshold to generate an abnormal alarm data set corresponding to the current probe flow set;

[0220] Determining an abnormal network path corresponding to each abnormal alarm data in the abnormal alarm data set based on the current path set, and processing each abnormal network path to obtain a common network node set;

[0221] Counting the occurrence frequency of each common network node in the common network node set, and determining a target fault node corresponding to the target data center based on the statistical result.

[0222] Of course, the program of the computer readable storage medium provided by the embodiment of the present application is not limited to the method operations as described above, and can also perform related operations in the fault locating method of the data center bottom network provided by any embodiment of the present application.

[0223] Those skilled in the art can clearly understand the present application by the above description of the embodiments, and the present application can be realized by software and necessary general hardware, and of course, can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product can be stored in a computer readable storage medium, such as a floppy disk, a read-only memory (ROM), a random access memory (RAM), a FLASH, a hard disk, or an optical disk, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the method described in each embodiment of the present application.

[0224] It is worth noting that in the above embodiments of the fault locating device of the data center bottom layer network, each unit and module included is only divided according to functional logic, but is not limited to the above division, as long as the corresponding function can be realized; in addition, the specific names of each functional unit are only for easy mutual distinction, and do not limit the protection scope of the present application.

[0225] The embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the fault locating method of the data center bottom layer network provided by any embodiment of the present application.

[0226] The computer program product can be written in one or more programming languages or combinations thereof to implement the computer program code for performing the operations of the present application, and the programming languages include object-oriented programming languages such as Java, Smalltalk, C++, and conventional procedural programming languages such as "C" language or similar programming languages. The program code can be completely executed on a user computer, partially executed on a user computer, executed as a separate software package, partially executed on a user computer and partially executed on a remote computer, or completely executed on a remote computer or server. In the case involving a remote computer, the remote computer can be connected to the user computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, connected through the Internet by using an Internet service provider).

[0227] Note that the above merely describes preferred embodiments of the present application and the principles of the technology applied. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and that various obvious changes, modifications and substitutions can be made thereto without departing from the scope of the present application. Therefore, although the present application has been described in detail through the above embodiments, the present application is not limited to the above embodiments, and can include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the claims.

Claims

1. A method for fault location in a data center's underlying network, characterized in that, include: The system acquires the current probe flow set and current path set corresponding to the target data center, collected by each target proxy service based on a preset network search list. The target proxy services are deployed on each target server within the target data center. The preset network search list includes the internal hierarchical network topology of the access switch, the external hierarchical network topology of the access switch, the external hierarchical network topology of the aggregation switch, and the external hierarchical network topology of the core switch corresponding to each target server. The internal hierarchical network topology of the access switch refers to the network topology between the target server and the corresponding probed server under the same access switch. The external hierarchical network topology of the access switch refers to the network topology between the target server and probed servers under different access switches. The external hierarchical network topology of the aggregation switch refers to the network topology between the target server and probed servers under different aggregation switches. The external hierarchical network topology of the core switch refers to the network topology between the target server and probed servers under different core switches. Based on the integrity index of each target detection stream in the current detection stream set, the detection threshold corresponding to the target detection stream is determined, and the target detection stream is analyzed based on the detection threshold to generate an abnormal alarm data set corresponding to the current detection stream set. Based on the current path set, determine the abnormal network path corresponding to each abnormal alarm data in the abnormal alarm data set, and summarize and process each abnormal network path to obtain a common network node set. The frequency of occurrence of each public network node in the set of public network nodes is statistically analyzed, and the target fault node corresponding to the target data center is determined based on the statistical results. The step of obtaining the current probe flow set and current path set corresponding to the target data center obtained by each target proxy service based on a preset network search list includes: determining the target probe object corresponding to the target server through the target proxy service based on the preset network search list, and performing grouped network search on the target probe object according to a first preset time period to generate the current probe flow, and performing path collection on the target probe object according to a second preset time period to generate the current path; summarizing the current probe flows corresponding to all target proxy services at the same time as the current probe flow set corresponding to the target data center, and summarizing the current paths corresponding to all target proxy services at the same time as the current path set corresponding to the target data center.

2. The method according to claim 1, characterized in that, Before obtaining the current probe flow set and current path set corresponding to the target data center collected by each target proxy service based on a preset network search list, the method further includes: Obtain the basic network topology data corresponding to the underlying network of the target data center; wherein, the basic network topology data includes the core switch information corresponding to the target data center, the aggregation switch information corresponding to each core switch, the access switch information corresponding to each aggregation switch, and the server information corresponding to each access switch. Based on the preset access switch internal hierarchy detection rules and the server information corresponding to each access switch, construct the internal hierarchy network topology of all access switches corresponding to the target data center. Based on the preset access switch external layer detection rules, the access switch information corresponding to each aggregation switch and the server information corresponding to each access switch, construct the full access switch external layer network topology relationship of the target data center. Based on the preset external layer detection rules of the aggregation switches, the aggregation switch information corresponding to each core switch, the access switch information corresponding to each aggregation switch, and the server information corresponding to each access switch, the external layer network topology relationship of all aggregation switches corresponding to the target data center is constructed. Based on the preset core switch external layer detection rules, the core switch information corresponding to the target data center, the aggregation switch information corresponding to each core switch, the access switch information corresponding to each aggregation switch, and the server information corresponding to each access switch, construct the full core switch external layer network topology relationship corresponding to the target data center. The deduplication process is performed on the internal hierarchical network topology relationships of all access switches, the external hierarchical network topology relationships of all access switches, the external hierarchical network topology relationships of all aggregation switches, and the external hierarchical network topology relationships of all core switches to obtain a preset network search list corresponding to the target data center.

3. The method according to claim 2, characterized in that, The process of constructing the internal hierarchical network topology of all access switches corresponding to the target data center based on preset access switch internal hierarchy detection rules and server information corresponding to each access switch includes: Based on the server information corresponding to each access switch, obtain the first current server under the target access switch and the first set number of first servers to be tested corresponding to the first current server; Using the first current server as the first source object and the first server under test as the first probe object, a probe link is constructed between the first source object and the first probe object to generate the internal hierarchical network topology relationship corresponding to the target access switch. Summarize the internal hierarchical network topology relationships of all target access switches, and generate the internal hierarchical network topology relationships of all access switches corresponding to the target data center.

4. The method according to claim 2, characterized in that, The process of constructing the external layer network topology of all access switches corresponding to the target data center based on preset access switch external layer detection rules, access switch information corresponding to each aggregation switch, and server information corresponding to each access switch includes: Based on the access switch information corresponding to each aggregation switch, obtain the first current access switch under the target aggregation switch and the second set number of first access switches to be tested corresponding to the first current access switch. Based on the server information corresponding to each access switch, a second set number of second current servers under the first current access switch are obtained, and based on the second current servers and the preset sorting modulo rule, the second servers under the first access switch to be tested are obtained. Using the second current server as the second source object and the second server under test as the second probe object, a probe link is constructed between the second source object and the second probe object, and the external hierarchical network topology relationship corresponding to the first current access switch is generated. Summarize the external layer network topology relationships of all current access switches under all target aggregation switches, and generate the external layer network topology relationships of all access switches corresponding to the target data center.

5. The method according to claim 2, characterized in that, The process of constructing the external layer network topology of all aggregation switches corresponding to the target data center based on preset external layer detection rules for aggregation switches, aggregation switch information corresponding to each core switch, access switch information corresponding to each aggregation switch, and server information corresponding to each access switch includes: Based on the aggregation switch information corresponding to each core switch, obtain the first current aggregation switch under the target core switch and the third set number of first aggregation switches to be tested corresponding to the first current aggregation switch. Based on the access switch information corresponding to each aggregation switch, obtain the third set number of second current access switches under the first current aggregation switch, and based on the second current access switches and the preset sorting modulo rule, obtain the second access switches under the first aggregation switch to be tested. Using the first server under the second current access switch as the third source object and the first server under the second access switch under test as the third probe object, a probe link is constructed between the third source object and the third probe object to generate the external hierarchical network topology relationship corresponding to the first current aggregation switch. Summarize the external layer network topology relationships of all target core switches and the first current aggregation switch, and generate the external layer network topology relationships of all aggregation switches for the target data center.

6. The method according to claim 2, characterized in that, The process involves constructing the external layer network topology of all core switches corresponding to the target data center based on preset core switch external layer detection rules, core switch information corresponding to the target data center, aggregation switch information corresponding to each core switch, access switch information corresponding to each aggregation switch, and server information corresponding to each access switch. Based on the core switch information corresponding to the target data center, obtain the current core switch under the target data center and the core switch to be tested corresponding to the current core switch. Based on the aggregation switch information corresponding to each core switch, determine the second current aggregation switch with the same number under the current core switch, and the second aggregation switch under the core switch to be tested with the same number. Based on the access switch information corresponding to each aggregation switch, obtain the fourth set number of third current access switches under the second current aggregation switch, and based on the third current access switches and the preset sorting modulo rule, obtain the third access switches under the second aggregation switch to be tested. The first server under the third current access switch is used as the fourth source object, and the first server under the third access switch to be tested is used as the fourth probe object. A probe link is constructed between the fourth source object and the fourth probe object to generate the external hierarchical network topology relationship corresponding to the current core switch. Summarize the external layer network topology relationships of all current core switches under the target data center, and generate the external layer network topology relationships of all core switches under the target data center.

7. The method according to claim 1, characterized in that, Before obtaining the current probe flow set and current path set corresponding to the target data center collected by each target proxy service based on a preset network search list, the process also includes: A basic proxy service is generated based on the underlying principle of packet network search, and the basic proxy service is deployed to all servers in the target data center.

8. The method according to claim 1, characterized in that, The step of determining the detection threshold corresponding to the target detection stream based on the integrity index of each target detection stream in the current detection stream set includes: Based on the integrity verification of the historical probe flow set corresponding to the target data center, the integrity index of each target probe flow in the current probe flow set is obtained; The detection threshold corresponding to the target detection stream is determined based on the preset alarm strategy and the integrity index.

9. The method according to claim 8, characterized in that, The step of determining the detection threshold corresponding to the target detection stream based on the preset alarm strategy and the integrity index includes: If the preset alarm strategy is a dynamic prediction strategy and the integrity index corresponding to the target detection stream is an integrity result, then a dynamic threshold is generated based on the historical detection streams corresponding to the target detection stream in the historical detection stream set, and the dynamic threshold is used as the detection threshold corresponding to the target detection stream. If the preset alarm strategy is a solid prediction strategy, then the solid threshold corresponding to the target detection flow is determined based on the preset threshold setting rules, and the solid threshold is used as the detection threshold corresponding to the target detection flow.

10. The method according to claim 1, characterized in that, The step of determining the target fault node corresponding to the target data center based on statistical results includes: If the public network node with the highest frequency of occurrence in the statistical results is unique, then the public network node with the highest frequency of occurrence will be taken as the target fault node corresponding to the target data center. If the most frequently occurring public network node in the statistical results is not unique, then each most frequently occurring public network node is selected as a candidate fault node, and the target fault node among the candidate fault nodes is determined based on the preset route tracing instruction, and is used as the target fault node corresponding to the target data center.

11. The method according to claim 1, characterized in that, After statistically analyzing the frequency of occurrence of each public network node in the set of public network nodes and determining the target fault node corresponding to the target data center based on the statistical results, the method further includes: The target fault node is handled to isolate it.

12. The method according to claim 1, characterized in that, After performing data analysis on the target detection stream based on the detection threshold to generate an abnormal alarm data set corresponding to the current detection stream set, the method further includes: If the abnormal alarm data set is empty, obtain the quality assessment requirements corresponding to the target data center; wherein, the quality assessment requirements include the identification information of the target data center and the identification information of the detection data center corresponding to the target data center; Based on the identification information of the target data center and the identification information of the probe data center, obtain a set of candidate probe flows between the target data center and the probe data center from the current probe flow set; The quality of the candidate probe streams in the candidate probe stream set is evaluated based on preset evaluation criteria, and the quality evaluation results corresponding to the target data center are generated.

13. A fault location device for a data center underlying network, characterized in that, include: The data acquisition module is used to acquire the current probe flow set and current path set corresponding to the target data center, collected by each target proxy service based on a preset network search list. The target proxy services are deployed on each target server within the target data center. The preset network search list includes the internal hierarchical network topology of the access switch, the external hierarchical network topology of the access switch, the external hierarchical network topology of the aggregation switch, and the external hierarchical network topology of the core switch corresponding to each target server. The internal hierarchical network topology of the access switch refers to the network topology between the target server and the corresponding probed server under the same access switch; the external hierarchical network topology of the access switch refers to the network topology between the target server and probed servers under different access switches; the external hierarchical network topology of the aggregation switch refers to the network topology between the target server and probed servers under different aggregation switches; and the external hierarchical network topology of the core switch refers to the network topology between the target server and probed servers under different core switches. The data analysis module is used to determine the detection threshold corresponding to the target detection stream based on the integrity index of each target detection stream in the current detection stream set, and to perform data analysis on the target detection stream based on the detection threshold to generate an abnormal alarm data set corresponding to the current detection stream set. The fault analysis module is used to determine the abnormal network path corresponding to each abnormal alarm data in the abnormal alarm data set based on the current path set, and to summarize and process each abnormal network path to obtain a common network node set. The fault location module is used to count the frequency of occurrence of each public network node in the public network node set, and determine the target fault node corresponding to the target data center based on the statistical results. Specifically, the data acquisition module is used to: determine the target probe object corresponding to the target server based on a preset network search list through the target proxy service, and perform grouped network search on the target probe object to generate the current probe stream according to a first preset time period, and perform path acquisition on the target probe object to generate the current path according to a second preset time period; summarize the current probe streams corresponding to all target proxy services at the same time as the current probe stream set corresponding to the target data center, and summarize the current paths corresponding to all target proxy services at the same time as the current path set corresponding to the target data center.

14. A server, characterized in that, The system includes a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the computer program, it implements a fault location method for the underlying network of a data center as described in any one of claims 1-12.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements the fault location method for the underlying network of the data center as described in any one of claims 1-12.

16. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the fault location method for the underlying network of the data center as described in any one of claims 1-12.

Images