Network fault analysis method and system

Abstract

The invention discloses a network fault analysis method and system, and relates to the field of network monitoring. The network fault analysis method comprises the following steps: collecting network data by adopting a distributed link; determining whether a network has a network fault based on the network data; under the condition that the network has the network fault, determining a fault type based on the network data; and layer-by-layer troubleshooting is carried out on the network based on the fault type, data indexes of the faulted network are obtained, and the data indexes comprise at least one of a throughput index, a delay index, a performance index and an abnormal index.

Description

Technical Field

[0001] The present application relates to the field of network monitoring, and in particular to a network fault analysis method and system. Background Art

[0002] With the popularization of the Internet and the rapid development of information technology, the network has become an indispensable infrastructure in modern society. However, network failures occur from time to time, which not only affect the normal operation of the network, but also may cause serious economic losses and social impacts. Network fault analysis refers to the process of diagnosing, locating, analyzing and solving problems or abnormal conditions in the network. Its purpose is to determine the cause of the fault, the scope of impact and the solution to restore the normal operation of the network and prevent similar problems from happening again.

[0003] In the related art, some network fault analysis tools are used, but the number of locations and types of network faults is large, and the network fault analysis tools cannot fully match the network faults, resulting in low accuracy of the analysis results after current analysis of network faults. Summary of the invention

[0004] The embodiments of the present application provide a network fault analysis method and system to solve the problem of low accuracy of network fault analysis results in related technologies.

[0005] In a first aspect, an embodiment of the present application provides a network fault analysis method, including: Use distributed links to collect network data; Determining whether there is a network fault in the network based on the network data; In the case where a network fault exists in the network, determining a fault type based on the network data; Based on the fault type, the network is checked layer by layer to obtain data indicators of the network where the fault occurs, wherein the data indicators include at least one of the following: throughput indicator, delay indicator, performance indicator, and abnormality indicator.

[0006] In a second aspect, an embodiment of the present application provides a network fault analysis system, including: A collection module, used to collect network data using distributed links; A first determination module, configured to determine whether there is a network fault in the network based on the network data; A second determination module, configured to determine a fault type based on the network data when a network fault exists in the network; The analysis module is used to check the network layer by layer based on the fault type to obtain data indicators of the faulty network, wherein the data indicators include at least one of the following: throughput indicator, delay indicator, performance indicator, and abnormal indicator.

[0007] In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method described in the first aspect.

[0008] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0009] In an embodiment of the present application, a distributed link is first used to collect network data, and then it is determined based on the network data whether there is a network fault in the network. In the case that there is a network fault in the network, the fault type is determined based on the network data. Finally, the network is checked layer by layer based on the fault type to obtain data indicators of the network where the fault occurs. The data indicators include at least one of the following: throughput indicators, delay indicators, performance indicators, and abnormal indicators. This embodiment introduces a distributed link tracking system to collect network data, supports modes of multiple programming languages, and enables different microservices to use a unified tracking solution for request tracking, greatly simplifying the call chain analysis across services, checking the network layer by layer based on the fault type, and gradually narrowing the scope of the fault in a predetermined order, thereby improving the efficiency and accuracy of fault troubleshooting. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 is a flow chart of a network fault analysis method provided by an embodiment of the present application; Figure 2 is a schematic diagram of a network fault analysis system provided in an embodiment of the present application; Figure 3 It is a structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0011] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0012] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here. In addition, the "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally represents that the objects associated with each other are in an "or" relationship.

[0013] The following is combined with Figures 1 to 3 , a network fault analysis method and system provided by an embodiment of the present application are described in detail through specific embodiments and application scenarios.

[0014] like Figure 1 As shown, it is a flow chart of a network fault analysis method provided by an embodiment of the present application. Figure 1 As shown, the network fault analysis method may include: contents shown in S101 to S104.

[0015] In S101, distributed links are used to collect network data.

[0016] Among them, distributed link tracking technology is used to collect network data, and a distributed link tracking system is introduced to support modes of multiple programming languages, so that different microservices can use a unified tracking solution for request tracking, which greatly simplifies the call chain analysis across services.

[0017] It is worth noting that, in this embodiment, an observability traffic collection platform can be pre-set, and the platform can support any microservice framework and any development programming language.

[0018] Specifically, the platform can be set with ports / protocols corresponding to different microservice frameworks, and can support any microservice framework. The platform can use container technologies such as Docker to provide isolated operating environments for different programming languages. Each container can contain the runtime environment, dependency libraries, etc. of a specific programming language, thereby ensuring that services in different programming languages ​​can run stably on the platform. Through container technologies such as Docker, the platform can support the isolated operation of any microservice framework and programming language. This design ensures the independence and portability between different services, allowing the platform to be easily integrated into a variety of technology stacks. The introduction of a distributed link tracking system supports multiple programming language modes, allowing different microservices to use a unified tracking solution for request tracking, greatly simplifying the call chain analysis across services.

[0019] This observability traffic collection platform can support tracing the distributed call chain of any application request through different microservices and different virtual network paths.

[0020] Specifically, distributed link tracking technology can be used. The traffic collector can support the analysis of application protocols such as HTTP 1 / 2 / S, DNS, gRPC, MySQL, Dubbo, Redis, Kafka, SOFARPC, MQTT, PostgreSQL, and ProtobufRPC protocols, performance indicator data collection, and application call log collection; the collector should support eBPF data collection capabilities without intrusion into application processes and application codes, without restarting application processes, and without inserting stubs in the code, and realize data collection of application process system calls through eBPF technology. Functional screenshots can also be provided.

[0021] In this embodiment, distributed link tracing is used to perform tracking at key locations of each microservice, such as entry points, exit points, database access, etc., to record the start and end time of the request, operation name, label and other information, generate a unique tracking identifier (Trace ID) for each request, and pass it in the entire call chain. The Trace ID is used to associate request fragments in different microservices to form a complete call chain. At the same time, each operation within a microservice can generate a unique span identifier (Span ID) to identify a specific operation within the microservice, ensuring that the request can correctly pass context information (such as Trace ID, Span ID, etc.) when crossing different microservices and different virtual networks. The data collected by the tracking needs to be transmitted to the collector (Collector) of the distributed link tracing system. The collector stores the collected data in the backend storage system, such as a distributed database, index system, etc. The distributed link tracing system can be set to support multiple programming languages ​​​​so that a unified tracing solution can be used in different microservices.

[0022] In S102, it is determined whether there is a network failure in the network based on the network data.

[0023] A network analysis server can be built on the above platform. The network analysis server can determine whether there is a network failure and the specific type of failure through methods such as network traffic collection, physical inspection, log analysis, protocol analysis, software product analysis, and user feedback. For example, whether the internal network or the external network is inaccessible, whether a specific website is inaccessible or all websites are inaccessible, the specific details shall be subject to actual application and are not limited in this embodiment.

[0024] In S103, when a network fault occurs in the network, the fault type is determined based on the network data.

[0025] This embodiment can be self-developed for the open source version of the network monitoring tool, and is mainly used in daily work scenarios such as the collection and monitoring of network transmission information during business operation, assisting in quickly identifying specific fault types and locating faults, thereby achieving efficient operation and maintenance and ensuring business continuity.

[0026] In S104, the network is checked layer by layer based on the fault type to obtain data indicators of the faulty network, where the data indicators include at least one of the following: throughput indicator, delay indicator, performance indicator, and abnormality indicator.

[0027] In an embodiment of the present application, a distributed link is first used to collect network data, and then it is determined based on the network data whether there is a network fault in the network. In the case that there is a network fault in the network, the fault type is determined based on the network data. Finally, the network is checked layer by layer based on the fault type to obtain data indicators of the network where the fault occurs. The data indicators include at least one of the following: throughput indicators, delay indicators, performance indicators, and abnormal indicators. This embodiment introduces a distributed link tracking system to collect network data, supports modes of multiple programming languages, and enables different microservices to use a unified tracking solution for request tracking, greatly simplifying the call chain analysis across services, checking the network layer by layer based on the fault type, and gradually narrowing the scope of the fault in a predetermined order, thereby improving the efficiency and accuracy of fault troubleshooting.

[0028] In a possible implementation of the present application, using distributed links to collect network data can include: accessing different network platforms through distributed links; calling application processes through eBPF (extended Berkeley Packet Filter) and collecting network data in real time, and the network data includes at least one of the following: network traffic data, network log data, and user feedback data.

[0029] In this embodiment, the eBPF data collection capability can be used for data collection, without restarting the application process or inserting stubs in the code, and the data collection of the application process system call can be realized through the eBPF technology. The eBPF technology is used to realize non-intrusive application process system call data collection, without restarting the application or modifying the code, which greatly reduces the complexity of monitoring and the impact on the production environment. The collector stores the collected data in a distributed database or index system, supports efficient query and retrieval, and provides a solid data foundation for troubleshooting and performance analysis.

[0030] In a possible implementation of the present application, determining whether there is a network fault based on network data may include: determining whether there is a network fault based on the network data through log analysis, protocol analysis, and software product analysis; determining that there is a network fault when the network traffic in the network data is less than the preset traffic, or there is an abnormality in the network log data, or a network abnormality reported by the user is received.

[0031] In this embodiment, it is possible to determine whether there is a network fault and the specific type of the fault through network traffic collection, physical inspection, log analysis, protocol analysis, software product analysis, and user feedback. For example, if the network traffic in the network data is less than the preset traffic, or there is an abnormality in the network log data, or a network abnormality is received from the user, it is determined that there is a network fault. The network fault can also be determined by other methods, which are subject to actual application and are not limited in this embodiment.

[0032] In one possible implementation of the present application, after determining the fault type based on network data, the method may further include: checking the network area and / or network location related to the fault type, the network area and / or network location including network cables, optical fibers, and power cables; based on the network area and / or network location, using a diagnostic tool to determine the device status of the network device.

[0033] That is, after determining the fault type based on network data, the network area / location related to the cause of the fault and the specific type of the fault can be checked, such as network cables, optical fibers, power cables, etc., and the device status of network devices such as routers, switches, and firewalls can be determined using diagnostic tools or other methods. Then, based on the specific type of network fault and the cause of the fault, the troubleshooting method can be determined, which can specifically include which layers to check and in what order.

[0034] In a possible implementation of the present application, the network is checked layer by layer based on the fault type to obtain data indicators of the network where the fault occurs, which may include: determining the fault troubleshooting layer based on the fault type and the device status of the network device, the fault troubleshooting layer including at least one of the following: physical layer, data link layer, network layer, transport layer, application layer; based on the troubleshooting of the fault troubleshooting layer, obtaining data indicators of the network where the fault occurs, the data indicators including at least one of the following: network layer throughput indicator, transport layer throughput indicator, transport layer latency indicator, transport layer performance indicator, transport layer abnormality indicator.

[0035] In this embodiment, the troubleshooting method is determined based on the specific type and cause of the network fault. The layers that need to be checked may include the physical layer, data link layer, network layer, transport layer, application layer, etc., and then the network fault analysis results are obtained, which may specifically include data indicators such as network layer throughput indicators, transport layer throughput indicators, transport layer delay indicators, transport layer performance indicators, and transport layer abnormality indicators. Combining multiple methods such as network traffic collection, physical inspection, log analysis, protocol analysis, and user feedback, it is possible to comprehensively evaluate the status of the network and application, accurately identify the type and cause of the fault, support hierarchical troubleshooting from the physical layer to the application layer, and gradually narrow the scope of the fault in a predetermined order, thereby improving the efficiency and accuracy of troubleshooting. Based on the collected data and fault analysis results, the performance of the network and application can be optimized and the configuration can be adjusted to improve the overall operating efficiency.

[0036] like Figure 2 As shown, it is a schematic diagram of a network fault analysis system provided by an embodiment of the present application. Figure 2 As shown, the network fault analysis system may include: a collection module 201 , a first determination module 202 , a second determination module 203 and an analysis module 204 .

[0037] Among them, the collection module 201 is used to collect network data using distributed links; the first determination module 202 is used to determine whether there is a network fault in the network based on the network data; the second determination module 203 is used to determine the fault type based on the network data when there is a network fault in the network; the analysis module 204 is used to check the network layer by layer based on the fault type to obtain data indicators of the network where the fault occurs, and the data indicators include at least one of the following: throughput indicator, delay indicator, performance indicator, and abnormality indicator.

[0038] In the embodiment of the present application, first, the collection module 201 uses a distributed link to collect network data, then the first determination module 202 determines whether there is a network fault in the network based on the network data, and the second determination module 203 determines the fault type based on the network data when there is a network fault in the network, and finally the analysis module 204 checks the network layer by layer based on the fault type to obtain data indicators of the network where the fault occurs, and the data indicators include at least one of the following: throughput indicators, delay indicators, performance indicators, and abnormal indicators. This embodiment introduces a distributed link tracking system to collect network data, supports multiple programming language modes, and enables different microservices to use a unified tracking solution for request tracking, greatly simplifies the call chain analysis across services, checks the network layer by layer based on the fault type, and gradually narrows the fault scope in a predetermined order, thereby improving the efficiency and accuracy of fault troubleshooting.

[0039] In a possible implementation of the present application, the collection module 201 is used to: access different network platforms through distributed links; call application processes through eBPF, and collect network data in real time, where the network data includes at least one of the following: network traffic data, network log data, and user feedback data.

[0040] In a possible implementation of the present application, the first determination module 202 is used to: determine whether there is a network fault based on network data through log analysis, protocol analysis, and software product analysis; determine whether there is a network fault when the network traffic in the network data is less than the preset traffic, or there is an abnormality in the network log data, or a network abnormality is received from the user's feedback.

[0041] In a possible implementation manner of the present application, the network fault analysis system may further include: a checking module and a third determining module.

[0042] Among them, the inspection module is used to check the network area and / or network location related to the fault type, and the network area and / or network location include network cables, optical fibers, and power cables; the third determination module is used to determine the device status of the network device based on the network area and / or network location using a diagnostic tool.

[0043] In a possible implementation of the present application, in a possible implementation of the present application, the analysis module 204 is used to: determine the troubleshooting layer based on the fault type and the device status of the network device, the troubleshooting layer including at least one of the following: physical layer, data link layer, network layer, transport layer, application layer; based on the troubleshooting of the troubleshooting layer, obtain data indicators of the network where the fault occurs, the data indicators including at least one of the following: network layer throughput indicator, transport layer throughput indicator, transport layer delay indicator, transport layer performance indicator, transport layer abnormality indicator.

[0044] The functions of the network fault analysis system described in this application have been Figure 1 The method embodiment shown is described in detail, so for any details not provided in the description of this embodiment, please refer to the relevant descriptions in the aforementioned embodiments, which will not be repeated here.

[0045] like Figure 3 As shown, an embodiment of the present application also provides an electronic device 300, including a processor 301, a memory 302, and a program or instruction stored in the memory 302 and executable on the processor 301. When the program or instruction is executed by the processor 301, each process of the above-mentioned network fault analysis method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0046] The embodiment of the present application also provides a storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, each process of the network fault analysis method embodiment provided in any of the above embodiments is implemented. And the same technical effect can be achieved, and to avoid repetition, it will not be repeated here.

[0047] The processor is the processor in the electronic device described in the above embodiment. The storage medium includes computer storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, etc.

[0048] The embodiment of the present application further provides a computer program / program product, which is stored in a storage medium. The computer program / program product is executed by at least one processor to implement the various processes of the above-mentioned network fault analysis method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0049] It should be noted that, in this article, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the method and system in the embodiment of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0050] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0051] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A network fault analysis method, characterized in that: include: Use distributed links to collect network data; Determining whether there is a network fault in the network based on the network data; In the case where a network fault exists in the network, determining a fault type based on the network data; Based on the fault type, the network is checked layer by layer to obtain data indicators of the network where the fault occurs, wherein the data indicators include at least one of the following: throughput indicator, delay indicator, performance indicator, and abnormality indicator.

2. The method according to claim 1, characterized in that: The method of collecting network data using distributed links includes: Access different network platforms through distributed links; The application process is called through eBPF, and network data is collected in real time, where the network data includes at least one of the following: network traffic data, network log data, and user feedback data.

3. The method according to claim 2, characterized in that The determining whether there is a network fault based on the network data includes: Based on the network data, determine whether there is a network fault through log analysis, protocol analysis, and software product analysis; When the network flow in the network data is less than the preset flow, or the network log data has an abnormality, or a network abnormality is reported by a user, it is determined that a network failure exists in the network.

4. The method according to claim 1, characterized in that: After determining the fault type based on the network data, the method further includes: Check the network area and / or network location related to the fault type, wherein the network area and / or network location includes network cables, optical fibers, and power cables; Use diagnostic tools to determine the device status of network devices based on network region and / or network location.

5. The method according to claim 4, characterized in that The network is checked layer by layer based on the fault type to obtain data indicators of the network where the fault occurs, including: Based on the fault type and the device status of the network device, determining a fault troubleshooting layer, the fault troubleshooting layer comprising at least one of the following: a physical layer, a data link layer, a network layer, a transport layer, and an application layer; Based on the troubleshooting of the troubleshooting layer, data indicators of the faulty network are obtained, and the data indicators include at least one of the following: network layer throughput indicator, transport layer throughput indicator, transport layer delay indicator, transport layer performance indicator, and transport layer anomaly indicator.

6. A network fault analysis system, characterized in that: include: A collection module, used to collect network data using distributed links; A first determination module, configured to determine whether there is a network fault in the network based on the network data; A second determination module, configured to determine a fault type based on the network data when a network fault exists in the network; The analysis module is used to check the network layer by layer based on the fault type to obtain data indicators of the faulty network, wherein the data indicators include at least one of the following: throughput indicator, delay indicator, performance indicator, and abnormal indicator.

7. The system according to claim 6, characterized in that The acquisition module is used for: Access different network platforms through distributed links; The application process is called through eBPF, and network data is collected in real time, where the network data includes at least one of the following: network traffic data, network log data, and user feedback data.

8. The system according to claim 7, characterized in that The first determining module is used to: Based on the network data, determine whether there is a network fault through log analysis, protocol analysis, and software product analysis; When the network flow in the network data is less than the preset flow, or the network log data has an abnormality, or a network abnormality is reported by a user, it is determined that a network failure exists in the network.

9. The system according to claim 6, characterized in that The system further comprises: An inspection module, used to inspect a network area and / or a network location related to the fault type, wherein the network area and / or the network location include a network cable, an optical fiber, and a power cable; The third determination module is used to determine the device status of the network device using a diagnostic tool based on the network area and / or the network location.

10. An electronic device, characterized in that: The method comprises a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method according to any one of claims 1 to 5.

Images