Method, system and equipment for monitoring optical line terminal equipment in real time and medium

Abstract

The invention provides a method and system for monitoring an optical line terminal device in real time, an electronic device and a storage medium, and aims to solve the problem that the optical line terminal device cannot be comprehensively monitored and analyzed in real time, the method comprises the following steps: collecting an optical line terminal device log, and generating a continuous log data stream; summarizing the log data flow, analyzing each log data, filtering out logs of which the equipment state is normal, and obtaining equipment error logs; and collecting all equipment error logs, and analyzing whether the error of the equipment is a large-area behavior or is abnormal generated by local individual optical line terminal equipment in real time according to the feature space of the equipment error logs at the moment. According to the invention, the workload of the system and the operation and maintenance personnel can be reduced, the resource consumption is reduced, the real-time performance of processing and statistics is ensured, and the abnormal condition and the abnormal range of the equipment are locked more accurately.

Description

Technical Field

[0001] The present disclosure relates to the field of information data technology, and in particular to a method for real-time monitoring of optical line terminal equipment, a system for real-time monitoring of optical line terminal equipment, an electronic device, and a computer-readable storage medium. Background Art

[0002] With the expansion of enterprise business and the increase in broadband users, the deployment and status management of large-scale optical modem equipment are becoming increasingly important. By timely monitoring the operation of optical modem equipment, enterprises can better manage and optimize resources, including abnormal and recovery responses of optical cross-connect box network equipment, and perception of overall operation, thereby reducing costs and improving efficiency. In addition, this technology also supports business maintenance, helping enterprises to accurately locate customers with optical path abnormalities, develop personalized service plans, and improve the user experience of existing users.

[0003] At present, the equipment stability monitoring of optical line terminals mainly relies on the acquisition of logs by the equipment and the maintenance by the optical line terminal operation and maintenance personnel. The previous monitoring method for optical line terminal equipment is to report the error log as long as an error is monitored. This method has the following disadvantages: 1. The previous experience method cannot define and distinguish the abnormal error types of optical line terminal equipment. For optical line terminal equipment, abnormalities are sporadic and self-recovering. It is impossible to rule out whether they are caused by network jitter or user active behavior. The occurrence of such problems often does not require attention, and previous experience cannot distinguish them; 2. The previous experience method is split, and only judges and handles errors for a single optical line terminal. In the face of massive optical line terminal equipment, it is impossible to perform comprehensive abnormal diagnosis, and it is impossible to analyze whether it is a large-scale behavior or a local individual device. Abnormal; 3. When the previous experience method conducts a comprehensive analysis of optical line terminal equipment, it is necessary to summarize and analyze it afterwards, which cannot meet the needs of real-time feedback on the current situation. Summary of the invention

[0004] In order to at least solve the problem that the existing technology cannot comprehensively monitor and analyze the optical line terminal in real time. The present invention provides a method for real-time monitoring of optical line terminal equipment, a system for real-time monitoring of optical line terminal equipment, an electronic device and a computer-readable storage medium, which can completely and quickly obtain the abnormal error information of a single device in the face of a large number of optical line terminal devices, and can also perform comprehensive abnormal diagnosis in the face of a large amount of data, analyze whether it is a large-scale behavior or an error generated by a local individual device, reduce the workload of the system and operation and maintenance personnel, and ensure the real-time processing and statistics.

[0005] In a first aspect, the present disclosure provides a method for real-time monitoring of an optical line terminal device, the method comprising:

[0006] Collect optical line terminal equipment logs and generate continuous log data streams;

[0007] Summarize the log data stream, parse each log data, filter out the logs with normal device status, and obtain the device error log;

[0008] Collect all device error logs and analyze in real time whether the device error is a large-scale behavior or an abnormality caused by a local individual optical line terminal device based on the feature space of the device error log at that time.

[0009] Furthermore, filtering out logs with normal device status and obtaining device error logs includes:

[0010] Set a waiting time. When the device generates an alarm log and exceeds the waiting time and there is no corresponding device's alarm release log, it is considered that the device is abnormal and the log is confirmed as a device error log.

[0011] When a device generates an alarm log and then generates an alarm release log within the waiting time, it is considered that the device has recovered abnormally and the alarm log will not be summarized downstream.

[0012] Furthermore, the feature space of the device error log at this time is used to analyze in real time whether the device error is a large-scale behavior or an abnormality caused by a local individual optical line terminal device, including:

[0013] For each device error log, collect various features of the log to form a feature vector of the log;

[0014] For the m captured device error logs, the overlap X between the logs is calculated based on the feature vectors of each log. Based on the overlap X, it is analyzed whether the device alarm is a large-scale behavior or an abnormality caused by a local individual optical line terminal device.

[0015] The various features of the log are collected to form a feature vector of the log, including:

[0016] For the acquired device error log A, collect the values ​​of its various features, that is, when log A has a certain feature i, enter A i =1, otherwise enter A i =0, get A1 to A n , the eigenvector of A is [A1, A2, …A n ], n∈[1,∞], n is the number of features of all logs;

[0017] The coincidence degree X between logs is calculated based on the eigenvectors of each log using the following formula:

[0018]

[0019] Furthermore, the method further comprises:

[0020] After parsing each log data, the following information is extracted from the log data:

[0021] Device manufacturer, device unique ID, normal / error identification, event type, event occurrence time, device name, and device corresponding IP.

[0022] Furthermore, filtering out the logs with normal device status and obtaining the device error logs includes:

[0023] The aggregated logs are divided into device error logs and device normal logs, and the error logs are mainly used for matching;

[0024] Pay attention to the error logs and keep them within the time after obtaining them.

[0025] For normal logs, the device unique identity ID is used as a match item to match the saved error logs. When the occurrence time of the event in the normal log is later than the occurrence time of the corresponding error event of the same device unique identity ID in the saved error log, the normal log is saved, otherwise the normal log is deleted, so that only the normal operation logs of the device related to the abnormal device are retained;

[0026] After the expert experience period, the generated device error log is judged again, and the device unique identity ID is used as the matching item to match the retained device normal operation log data related to the abnormal device; if there is a match, it proves that the corresponding device has experienced an abnormality, but has recovered at this time; if there is no corresponding data, it proves that the device has experienced an abnormality and has not yet recovered;

[0027] The error log of the device and the conclusion of whether it has been restored are retained as the device error log.

[0028] In a second aspect, the present disclosure provides a system for real-time monitoring of an optical line terminal device, the system comprising:

[0029] A collection module, which is configured to collect optical line terminal equipment logs and generate a continuous log data stream;

[0030] A filtering module is configured to aggregate log data streams, parse each log data, filter out logs with normal device status, and obtain device error logs;

[0031] The analysis module is configured to collect all device error logs and, based on the feature space of the device error logs at this time, analyze in real time whether the device error is a large-scale behavior or an abnormality caused by a local individual optical line terminal device.

[0032] Furthermore, the filtering module is specifically configured as follows:

[0033] Set a waiting time. When the device generates an alarm log and exceeds the waiting time and there is no corresponding device's alarm release log, it is considered that the device is abnormal and the log is confirmed as a device error log; and

[0034] When a device generates an alarm log and then generates an alarm release log within the waiting time, it is considered that the device has recovered abnormally and the alarm log will not be summarized downstream.

[0035] Furthermore, the analysis module is specifically configured as follows:

[0036] For each device error log, collect various features of the log to form a feature vector of the log; and,

[0037] For the m captured device error logs, the overlap X between the logs is calculated based on the feature vectors of each log. Based on the overlap X, it is analyzed whether the device alarm is a large-scale behavior or an abnormality caused by a local individual optical line terminal device.

[0038] The various features of the log are collected to form a feature vector of the log, including:

[0039] For the acquired device error log A, collect the values ​​of its various features, that is, when log A has a certain feature i, enter A i =1, otherwise enter A i =0, get A1 to A n , the eigenvector of A is [A1, A2, …A n ], n∈[1,∞], n is the number of features of all logs;

[0040] The coincidence degree X between logs is calculated based on the eigenvectors of each log using the following

[0041] formula:

[0042]

[0043] In a third aspect, the present disclosure provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes a method for real-time monitoring of an optical line terminal device as described in any one of the first aspects.

[0044] In a fourth aspect, the present disclosure provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for real-time monitoring of an optical line terminal device as described in any one of the first aspects above is implemented.

[0045] Beneficial effects:

[0046] The present disclosure provides a method for real-time monitoring of optical line terminal equipment, a system for real-time monitoring of optical line terminal equipment, an electronic device and a storage medium. Based on the traditional empirical method, the system relies on real-time processing of massive data and combines expert experience to distinguish the error types of the optical line terminal, and tracks and determines the self-recoverable errors so that when the errors are recovered, the abnormalities that occurred before in the device can be filtered out autonomously, reducing the workload of the system and operation and maintenance personnel. At the same time, based on the traditional experience, support for the processing of large-scale massive equipment is added, especially ensuring the real-time processing and statistics. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A flowchart of a method for real-time monitoring of an optical line terminal device provided in the first embodiment of the present disclosure;

[0048] Figure 2 A schematic diagram of a specific implementation process of real-time monitoring of an optical line terminal device provided by an embodiment of the present disclosure;

[0049] Figure 3 A schematic diagram of a method for real-time monitoring of an optical line terminal device provided in Embodiment 2 of the present disclosure;

[0050] Figure 4 An architecture diagram of a system for real-time monitoring of optical line terminal equipment provided in Embodiment 3 of the present disclosure;

[0051] Figure 5 This is an architecture diagram of an electronic device provided in Embodiment 4 of the present disclosure. DETAILED DESCRIPTION

[0052] In order to enable those skilled in the art to better understand the technical solution of the present disclosure, the present disclosure is further described in detail below in conjunction with the drawings and embodiments. It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention, rather than to limit the present invention.

[0053] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence; and, in the absence of conflict, the embodiments in the present disclosure and the features in the embodiments can be arbitrarily combined with each other.

[0054] The terms used in the embodiments of the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure. The singular forms of "a", "said" and "the" used in the embodiments of the present disclosure and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings.

[0055] In the subsequent description, the suffixes such as "module", "component" or "unit" used to represent elements are only used to facilitate the description of the present disclosure, and have no specific meanings. Therefore, "module", "component" or "unit" can be used in a mixed manner.

[0056] The technical solution of the present invention and how the technical solution of the present invention solves the above-mentioned problems existing in the prior art are described in detail below with specific embodiments. It is understandable that in the embodiments of the present application, the execution subject can perform some or all of the steps in the embodiments of the present application, and these steps or operations are only examples. The embodiments of the present application can also perform other operations or deformations of various operations. In addition, each step can be performed in a different order presented in the embodiments of the present application, and it is possible not to perform all the operations in the embodiments of the present application. And, the following several specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0057] Figure 1 A flowchart of a method for real-time monitoring of an optical line terminal device provided in the first embodiment of the present disclosure is shown as follows: Figure 1 As shown, the method includes:

[0058] Step S101: Collecting optical line terminal equipment logs to generate a continuous log data stream;

[0059] Step S102: Summarize the log data stream, parse each log data, filter out the logs with normal device status, and obtain the device error log;

[0060] Step S103: Collect all device error logs, and analyze in real time whether the device error is a large-scale behavior or an abnormality caused by a local individual optical line terminal device based on the feature space of the device error log at this time.

[0061] The disclosed embodiment uses an algorithm to automatically capture and analyze various types of information when the optical modem is offline and after it is offline. It retains and collects the conclusions on error logs and whether it has been restored, and extracts feature space for such data, and analyzes in real time whether the alarm of the device at this time is a large-scale behavior or an abnormality caused by a local individual optical line terminal device. Based on this, when the affected area is a small area, it sends a reminder of the optical modem offline and relevant channels for user feedback in real time to the user, optimizing the customer experience.

[0062] The specific implementation process is as follows Figure 2 As shown, through log collection and aggregation of massive equipment operation logs, a continuous log data stream is generated and uniformly transmitted to the next link, each log data is parsed, and the logs with normal equipment status are filtered out to obtain equipment error logs, that is, the logs are differentiated by status and divided into logs with normal equipment status and logs with abnormal equipment status. For the logs with abnormal equipment, it is judged whether the equipment has self-recovery and divided into equipment with recovery and equipment without recovery. For all unrecovered equipment error logs, feature space analysis is performed to determine whether the error logs of these devices have the same characteristics, and it is analyzed in real time whether the equipment error is a large-scale behavior or an abnormality caused by a local individual optical line terminal device, so as to report the abnormality.

[0063] The disclosed embodiment is based on the traditional empirical method, relying on a system for real-time processing of massive data, combined with expert experience to distinguish the error types of the optical line terminal, and track and determine the errors that can be self-recovered so that when the error is recovered, the abnormalities that occurred before the device can be automatically filtered out, reducing the workload of the system and operation and maintenance personnel. At the same time, based on the traditional experience, support for the processing of large-scale massive equipment is added, especially ensuring the real-time nature of processing and statistics.

[0064] Furthermore, filtering out logs with normal device status and obtaining device error logs includes:

[0065] Set a waiting time. When the device generates an alarm log and exceeds the waiting time and there is no corresponding device's alarm release log, it is considered that the device is abnormal and the log is confirmed as a device error log.

[0066] When a device generates an alarm log and then generates an alarm release log within the waiting time, it is considered that the device has recovered abnormally and the alarm log will not be summarized downstream.

[0067] In order to track and determine the self-recoverable errors in the massive device logs so that the abnormalities that occurred before can be filtered out autonomously when the error is recovered, the waiting time is set. The specific length of the waiting time can be set according to expert experience, such as being set to a period of time longer than the self-recovery time of general equipment. For a certain device, after the alarm log is generated, it is determined whether there is a device alarm release log within the waiting time. If there is, it is determined that the device has recovered abnormally, and the alarm log is not summarized downstream. If after the log is generated, it exceeds the waiting time and there is no corresponding device alarm release log, it is determined that the device is abnormal, confirmed as a device error log and summarized downstream. By filtering out the logs with normal device status and setting the waiting time to filter the alarm logs of the device that has recovered to normal, the alarm logs that need to be processed can be greatly reduced, resource consumption can be greatly reduced, and the abnormal conditions and abnormal ranges of the device can be locked more accurately.

[0068] Furthermore, the feature space of the device error log at this time is used to analyze in real time whether the device error is a large-scale behavior or an abnormality caused by a local individual optical line terminal device, including:

[0069] For each device error log, collect various features of the log to form a feature vector of the log;

[0070] For the m captured device error logs, the overlap X between the logs is calculated based on the feature vectors of each log. Based on the overlap X, it is analyzed whether the device alarm is a large-scale behavior or an abnormality caused by a local individual optical line terminal device.

[0071] The various features of the log are collected to form a feature vector of the log, including:

[0072] For the acquired device error log A, collect the values ​​of its various features, that is, when log A has a certain feature i, enter A i =1, otherwise enter A i =0, get A1 to A n , the eigenvector of A is [A1, A2, …A n ], n∈[1,∞], n is the number of features of all logs;

[0073] The coincidence degree X between logs is calculated based on the eigenvectors of each log using the following formula:

[0074]

[0075] In the above formula, the number from A, B, ... to M is m.

[0076] For each obtained device error log, its features are collected to form a feature vector of each log. For each device error log generated in the same time period or at a similar time, the overlap X between the logs is calculated to determine whether they are logs of the same type. If the log overlap is high, it means that the device alarm is a large-scale behavior. If the log overlaps with other logs, it means that the abnormality is generated by a local individual optical line terminal device. Or if the overlap between multiple logs is calculated to be low, it is determined that the abnormalities of each device are different. The overlap judgment between the logs can be set according to the actual situation, and the overlap boundary value can be set by pre-acquired experience.

[0077] Furthermore, the method further comprises:

[0078] After parsing each log data, the following information is extracted from the log data:

[0079] Device manufacturer, device unique ID, normal / error identification, event type, event occurrence time, device name, and device corresponding IP.

[0080] For the operation logs obtained, since they are collected from different manufacturers, it is necessary to unify the key indicators so that the next step of sorting and matching can be facilitated. Extract information such as the device manufacturer, device unique ID, normal / error identification, event type, event occurrence time, device name, device corresponding IP, etc. from the records. This facilitates log matching and subsequent parameter feature analysis.

[0081] Furthermore, filtering out the logs with normal device status and obtaining the device error logs includes:

[0082] The aggregated logs are divided into device error logs and device normal logs, and the error logs are mainly used for matching;

[0083] Pay attention to the error logs and keep them within the time after obtaining them.

[0084] For normal logs, the device unique identity ID is used as a match item to match the saved error logs. When the occurrence time of the event in the normal log is later than the occurrence time of the corresponding error event of the same device unique identity ID in the saved error log, the normal log is saved, otherwise the normal log is deleted, so that only the normal operation logs of the device related to the abnormal device are retained;

[0085] After the expert experience period, the generated device error log is judged again, and the device unique identity ID is used as the matching item to match the retained device normal operation log data related to the abnormal device; if there is a match, it proves that the corresponding device has experienced an abnormality, but has recovered at this time; if there is no corresponding data, it proves that the device has experienced an abnormality and has not yet recovered;

[0086] The error log of the device and the conclusion of whether it has been restored are retained as the device error log.

[0087] In addition to determining whether the device has recovered by obtaining the alarm release log, you can also determine whether the device has recovered by determining whether a normal log appears later.

[0088] The experience time can be set to be the same as the waiting time. If no alarm release log of the device appears within the waiting time, whether the device returns to normal can be determined by determining whether a normal log is generated after the waiting time.

[0089] Specifically, determine whether the device operation status in the log is an error log or a normal log;

[0090] If it is an error log, determine the device ID, form a device exception list, and continue to track subsequent logs;

[0091] If it is a normal log, determine whether the device ID is in the device abnormality list. If not, delete the record. If it is, it means that after the device generates an error log, a normal log appears, indicating that the device has been restored. Determine the device ID and form a device recovery list.

[0092] After the expert experience time, determine whether the device ID of the error log is in the device recovery list, that is, whether a normal device log is generated later. If so, it proves that the corresponding device has had an abnormality but has been recovered. If not, it indicates that the device has had an abnormality and has not been recovered.

[0093] Collect the error logs of the equipment. There are only two types of data judgments. At this time, keep the collected error logs and the conclusion of whether they have been restored. Extract the feature space for this type of data, and analyze in real time whether the alarm of the equipment at this time is a large-scale behavior or an abnormality caused by a local individual optical line terminal device.

[0094] After abnormal conditions occur in the optical line terminal equipment and the characteristic analysis is continued, the overall health status in the future can be predicted in real time based on the type of errors currently occurring and the number of erroneous devices.

[0095] The disclosed embodiment is applicable to massive optical line terminal equipment and corresponding data processing, and can completely and quickly obtain the abnormal error information of a single device in the case of massive optical line terminal equipment, and can also perform comprehensive abnormal diagnosis in the case of large amounts of data, and analyze whether the error is caused by large-scale behavior or local individual equipment. It greatly reduces resource consumption, and can more accurately lock the abnormal situation and abnormal range of the equipment; and has the characteristics of easy matching and high real-time performance.

[0096] The second embodiment of the present disclosure also provides a method for real-time monitoring of optical line terminal equipment, based on the following scenario: in the optical line terminal network, the same optical line terminal equipment is usually connected to multiple downstream optical network unit ONU (Optical Network Unit) fiber-optic access terminal equipment at the same time, and the equipment operation status of multiple downstream ONUs is collected at the same time to generate a continuous operation log stream. However, due to various factors, during the operation and maintenance of the equipment, the optical network unit ONU may go offline or fail. This may be caused by users actively disconnecting the equipment, or by normal aging and instability of the equipment itself. Therefore, some of the device error logs collected in the optical network unit ONU log can be self-recovered, so there is no need to pay too much attention to this part. You only need to focus on the optical network unit ONU equipment that has not recovered within the expert experience time.

[0097] like Figure 3 As shown, the method includes:

[0098] S1, first collect the operation records of the optical network unit from the optical line terminal, and the extracted operation records include the normal operation records of the equipment, the error records of the equipment operation, the equipment operation recovery records, etc. The records are uniformly collected and reported to the summary platform through the collection platform.

[0099] S2, collect the operation logs of the previous step. Since the logs are collected from different manufacturers, it is necessary to unify the key indicators for the next step of sorting. The information extracted from the records includes the device manufacturer, device unique ID, normal / error identification, event type, event occurrence time, device name, device corresponding IP, etc.

[0100] S3, based on the data collected in S2, is initially split into two types of data, namely device error logs and device normal logs, and the error logs are used as the main basis for matching.

[0101] S4, pay attention to the error log. Within the expert experience time, keep the error log, form a device anomaly list, and continue to track subsequent logs.

[0102] S5, for the normal log, determine whether the device ID is in the device abnormality list, use the device unique identity ID as the matching item, match the S4 data, and when the occurrence time of the event in the normal log is greater than the occurrence time of the corresponding error event of the same device unique identity ID in S4, save the normal log; otherwise, delete the normal log.

[0103] S6, in the above step S5, only the normal operation logs of the devices related to the abnormal devices are retained, and a device recovery list is formed.

[0104] S7, after the expert experience time, make another judgment on the generated device error log to determine whether the device ID is in the device recovery list, and match the S6 data with the device unique identity ID as the matching item. If there is a corresponding data in S6, it proves that the corresponding device has had an abnormality, but has been recovered at this time; if there is no corresponding data in S6, it proves that the device has had an abnormality and has not been recovered yet.

[0105] S8, the data in step S7 has only two types of judgments. At this time, the collected error logs and the conclusion of whether it has been restored are retained, and the feature space is extracted for this type of data. Real-time analysis is performed to determine whether the alarm of the device at this time is a large-scale behavior or an abnormality caused by a local individual optical line terminal device.

[0106] According to the above technical solution, in the above step S8, the method for recording the error log feature information is as follows: n is the number of features of all logs, n∈[1,∞], A i is the feature of log A. When abnormal log A is obtained, the feature collection method of A is as follows: collect A1 to A n When log A has certain characteristics, enter A i =1, otherwise, enter A i = 0, then the eigenvector of A is A = [A1, A2, ...A n ]; B i is the feature of log B. When abnormal log B is obtained, the feature collection method of B is as follows: collect B1 to B n When log B has a certain characteristic, enter B i =1, otherwise, enter B i = 0, then the eigenvector of B is B = [B1, B2, ...B n ]. At this time, it is analyzed whether the abnormality of the device is a large-scale behavior or an abnormality caused by a local individual optical line terminal device. For the m captured logs that have generated abnormalities, m∈[1,∞], the overlap degree X between the logs is calculated, and the calculation formula is:

[0107]

[0108] Based on the size of the overlap, it can be analyzed whether the alarm of the device at this time is a large-scale behavior or an abnormality caused by a local individual optical line terminal device.

[0109] The disclosed embodiments are applicable to massive optical line terminal devices and corresponding data processing, which can greatly reduce resource consumption and more accurately lock abnormal conditions and abnormal ranges of devices.

[0110] The third embodiment of the present disclosure also provides a system for real-time monitoring of an optical line terminal device, such as Figure 4 As shown, the system comprises:

[0111] A collection module 11, which is configured to collect optical line terminal equipment logs and generate a continuous log data stream;

[0112] A filtering module 12 is configured to aggregate log data streams, parse each log data, filter out logs with normal device status, and obtain device error logs;

[0113] The analysis module 13 is configured to collect all device error logs and analyze in real time whether the device error is a large-scale behavior or an abnormality caused by a local individual optical line terminal device based on the feature space of the device error log at this time.

[0114] Furthermore, the filtering module 12 is specifically configured as follows:

[0115] Set a waiting time. When the device generates an alarm log and exceeds the waiting time and there is no corresponding device's alarm release log, it is considered that the device is abnormal and the log is confirmed as a device error log; and

[0116] When a device generates an alarm log and then generates an alarm release log within the waiting time, it is considered that the device has recovered abnormally and the alarm log will not be summarized downstream.

[0117] Furthermore, the analysis module 13 is specifically configured as follows:

[0118] For each device error log, collect various features of the log to form a feature vector of the log; and,

[0119] For the m captured device error logs, the overlap X between the logs is calculated based on the feature vectors of each log. Based on the overlap X, it is analyzed whether the device alarm is a large-scale behavior or an abnormality caused by a local individual optical line terminal device.

[0120] The various features of the log are collected to form a feature vector of the log, including:

[0121] For the acquired device error log A, collect the values ​​of its various features, that is, when log A has a certain feature i, enter Ai=1, otherwise enter Ai=0, and obtain A1 to An. The feature vector of A is [A1, A2, ...An], and n is the number of features of all logs;

[0122] The coincidence degree X between logs is calculated based on the eigenvectors of each log using the following formula:

[0123]

[0124] Furthermore, the system also includes an extraction module 14;

[0125] The extraction module 14 is configured to extract the following information from the log data after the filtering module 12 parses each log data:

[0126] Device manufacturer, device unique ID, normal / error identification, event type, event occurrence time, device name, and device corresponding IP.

[0127] Furthermore, the filtering module 12 is specifically configured as follows:

[0128] The aggregated logs are divided into device error logs and device normal logs, and the error logs are mainly used for matching;

[0129] Pay attention to the error logs and keep them within the time after obtaining them.

[0130] For normal logs, the device unique identity ID is used as a match item to match the saved error logs. When the occurrence time of the event in the normal log is later than the occurrence time of the corresponding error event of the same device unique identity ID in the saved error log, the normal log is saved, otherwise the normal log is deleted, so that only the normal operation logs of the device related to the abnormal device are retained;

[0131] After the expert experience period, the generated device error log is judged again, and the device unique identity ID is used as the matching item to match the retained device normal operation log data related to the abnormal device; if there is a match, it proves that the corresponding device has experienced an abnormality, but has recovered at this time; if there is no corresponding data, it proves that the device has experienced an abnormality and has not yet recovered;

[0132] The error log of the device and the conclusion of whether it has been restored are retained as the device error log.

[0133] The system for real-time monitoring of optical line terminal equipment in the embodiment of the present disclosure is used to implement the method for real-time monitoring of optical line terminal equipment in method embodiment 1 and embodiment 2, so the description is relatively simple. For details, please refer to the relevant description in the previous method embodiment, which will not be repeated here.

[0134] In addition, if Figure 5 As shown, the third embodiment of the present disclosure further provides an electronic device, including a memory 100 and a processor 200, wherein the memory 100 stores a computer program, and when the processor 200 runs the computer program stored in the memory 100, the processor 200 executes the above-mentioned various possible methods.

[0135] The memory 100 is connected to the processor 200. The memory 100 may be a flash memory, a read-only memory or other memory, and the processor 200 may be a central processing unit or a single-chip microcomputer.

[0136] In addition, an embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored, and the computer program is executed by a processor to perform the above-mentioned various possible methods.

[0137] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), Digital Video Disc (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0138] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present disclosure, but the present disclosure is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and substance of the present disclosure, and these modifications and improvements are also considered to be within the scope of protection of the present disclosure.

Claims

1. A method for real-time monitoring of an optical line terminal device, characterized in that: The method comprises: Collect optical line terminal equipment logs and generate continuous log data streams; Summarize the log data stream, parse each log data, filter out the logs with normal device status, and obtain the device error log; Collect all device error logs and analyze in real time whether the device error is a large-scale behavior or an abnormality caused by a local individual optical line terminal device based on the feature space of the device error log at that time.

2. The method according to claim 1, characterized in that The filtering out of the logs with normal device status and obtaining the device error logs includes: Set a waiting time. When the device generates an alarm log and exceeds the waiting time and there is no corresponding device's alarm release log, it is considered that the device is abnormal and the log is confirmed as a device error log. When a device generates an alarm log and then generates an alarm release log within the waiting time, it is considered that the device has recovered abnormally and the alarm log will not be summarized downstream.

3. The method according to claim 1, characterized in that The feature space of the device error log at this time is used to analyze in real time whether the device error is a large-scale behavior or an abnormality caused by a local individual optical line terminal device, including: For each device error log, collect various features of the log to form a feature vector of the log; For the m captured device error logs, the overlap X between the logs is calculated based on the feature vectors of each log. Based on the overlap X, it is analyzed whether the device alarm is a large-scale behavior or an abnormality caused by a local individual optical line terminal device. The various features of the log are collected to form a feature vector of the log, including: For the acquired device error log A, collect the values ​​of its various features, that is, when log A has a certain feature i, enter A i =1, otherwise enter A i =0, get A1 to A n , the eigenvector of A is [A1, A2, …A n ], n∈[1,∞], n is the number of features of all logs; The coincidence degree X between logs is calculated based on the eigenvectors of each log using the following formula:

4. The method according to claim 1, characterized in that The method further comprises: After parsing each log data, the following information is extracted from the log data: Device manufacturer, device unique ID, normal / error identification, event type, event occurrence time, device name, and device corresponding IP.

5. The method according to claim 4, characterized in that The filtering out of the logs with normal device status and obtaining the device error logs includes: The aggregated logs are divided into device error logs and device normal logs, and the error logs are mainly used for matching; Pay attention to the error logs and keep them within the time after obtaining them. For normal logs, the device unique identity ID is used as a match item to match the saved error logs. When the occurrence time of the event in the normal log is later than the occurrence time of the corresponding error event of the same device unique identity ID in the saved error log, the normal log is saved, otherwise the normal log is deleted, so that only the normal operation logs of the device related to the abnormal device are retained; After the expert experience period, the generated device error log is judged again, and the device unique identity ID is used as the matching item to match the retained device normal operation log data related to the abnormal device; if there is a match, it proves that the corresponding device has had an abnormality, but has recovered at this time; if there is no corresponding data, it proves that the device has had an abnormality and has not yet recovered; The error log of the device and the conclusion of whether it has been restored are retained as the device error log.

6. A system for real-time monitoring of optical line terminal equipment, characterized in that: The system comprises: A collection module, which is configured to collect optical line terminal equipment logs and generate a continuous log data stream; A filtering module is configured to aggregate log data streams, parse each log data, filter out logs with normal device status, and obtain device error logs; The analysis module is configured to collect all device error logs and, based on the feature space of the device error logs at this time, analyze in real time whether the device error is a large-scale behavior or an abnormality caused by a local individual optical line terminal device.

7. The system according to claim 6, characterized in that The filtering module is specifically configured as follows: Set a waiting time. When the device generates an alarm log and exceeds the waiting time and there is no corresponding device's alarm release log, it is considered that the device is abnormal and the log is confirmed as a device error log; and When a device generates an alarm log and then generates an alarm release log within the waiting time, it is considered that the device has recovered abnormally and the alarm log will not be summarized downstream.

8. The system according to claim 6, characterized in that The analysis module is specifically configured as follows: For each device error log, collect various features of the log to form a feature vector of the log; and, For the m captured device error logs, the overlap X between the logs is calculated based on the feature vectors of each log. Based on the overlap X, it is analyzed whether the device alarm is a large-scale behavior or an abnormality caused by a local individual optical line terminal device. The various features of the log are collected to form a feature vector of the log, including: For the acquired device error log A, collect the values ​​of its various features, that is, when log A has a certain feature i, enter A i =1, otherwise enter A i =0, get A1 to A n , the eigenvector of A is [A1, A2, …A n ], n∈[1,∞], n is the number of features of all logs; The coincidence degree X between logs is calculated based on the eigenvectors of each log using the following formula:

9. An electronic device, characterized in that: The invention comprises a memory and a processor, wherein a computer program is stored in the memory, and when the processor runs the computer program stored in the memory, the processor executes the method for real-time monitoring of an optical line terminal device according to any one of claims 1 to 5.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for real-time monitoring of an optical line terminal device according to any one of claims 1 to 5 is implemented.

Images