Fault identification method and device

Abstract

The invention provides a fault identification method and device. The method comprises the following steps: acquiring N interfaces of user equipment; acquiring at least one flow monitoring value of each interface in the N interfaces within a first preset duration; for each interface in the N interfaces, if at least one flow monitoring value of the interface comprises a first flow monitoring value or a second flow monitoring value, determining that the interface has a fault, and recording a fault change table item corresponding to the interface; the first flow monitoring value is larger than a first preset maximum flow monitoring value corresponding to the interface, and the second flow monitoring value is smaller than a first preset minimum flow monitoring value corresponding to the interface. Therefore, by monitoring the N interfaces in the user equipment and periodically acquiring and storing the traffic, periodic fault judgment based on the traffic monitoring value is realized, the problems that fault recognition stays on a control surface and a large number of omission scenes exist can be solved, the monitoring pressure is relieved, and the fault recognition efficiency is improved. The problems that network faults are difficult to position and field data are difficult to retain are solved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communication technology, and in particular to a fault identification method and device. Background Art

[0002] At present, in data communication networks, the difficulty of equipment operation and maintenance has always been a major pain point due to the high complexity of networking solutions and the implementation of systems within devices. This also makes it difficult to locate network failures after they occur because there is no on-site information. The difficulty in automatically identifying service failures and automatically collecting on-site information is how to identify the failure and what information to collect after the failure.

[0003] In the prior art, network faults are usually recorded by single-protocol operation and maintenance within the device or by third-party controller operation and maintenance. In single-protocol operation and maintenance within the device, the router senses and records the control plane, but due to the huge number of routes and the excessive pressure on the equipment, only the current status information can be recorded. The route status at the time of the fault cannot be viewed, and the records triggered by the event are urgently needed, and not all records can be recorded. Therefore, how to achieve post-fault positioning and on-site information retention still needs further research. Summary of the invention

[0004] In order to solve the problem of post-fault location of network failures in the prior art, an embodiment of the present invention provides a fault identification method and device.

[0005] In the first aspect, an embodiment of the present invention provides a fault identification method, comprising: obtaining N interfaces of a user device, where N is a positive integer; obtaining at least one traffic monitoring value of each of the N interfaces within a first preset time length; for each of the N interfaces, if at least one traffic monitoring value of the interface includes a first traffic monitoring value or a second traffic monitoring value, it is determined that a fault has occurred in the interface, and a fault change table entry corresponding to the faulty interface is recorded; wherein the first traffic monitoring value is greater than a first preset maximum traffic monitoring value corresponding to the interface, and the second traffic monitoring value is less than a first preset minimum traffic monitoring value corresponding to the interface.

[0006] In the above scheme, the flow monitoring values ​​of N interfaces in the user equipment are monitored with a first preset time period as a period, so as to realize periodic fault judgment based on the flow monitoring value. Therefore, the above method realizes fault judgment based on the forwarding plane, ensures to judge whether a fault occurs from the perspective of the user equipment, and solves the problem that fault identification in the prior art stays on the control plane and there are a large number of missed scenarios. At the same time, according to the first preset maximum flow monitoring value and the first preset minimum flow monitoring value corresponding to each interface, it is determined whether the flow monitoring value of the interface is abnormal, so as to determine whether the interface has a fault, and the fault identification efficiency is high and the result is accurate. Moreover, when determining that an interface has a fault, the present application records the fault change table item, which can provide detailed data for subsequent fault analysis and improve the efficiency of fault handling.

[0007] In a possible implementation manner, obtaining N interfaces of the user equipment specifically includes: the N interfaces are N interfaces with the largest traffic among all interfaces of the user equipment.

[0008] Through this solution, N interfaces acquired by the user equipment are monitored, ensuring that a large number of services in the user equipment can be monitored by the method and the device, and at the same time, the monitoring pressure of the user equipment is reduced.

[0009] In one possible implementation, obtaining at least one traffic monitoring value for each of the N interfaces within a first preset time period includes: sampling the traffic monitoring value of each of the N interfaces once every M minutes within the first preset time period to obtain at least one traffic monitoring value for each of the N interfaces, where M is a positive integer.

[0010] Through this solution, with every M minutes as a sampling cycle, it is ensured that the method has good real-time performance in detecting abnormal flow monitoring values. It can also solve the problem of excessive equipment pressure caused by frequent sampling of flow monitoring values ​​in seconds in traditional methods.

[0011] In a possible implementation, the method further includes: for each of the N interfaces, obtaining multiple flow monitoring values ​​of the interface within a second preset time length; for each of the N interfaces, using the maximum flow monitoring value among the multiple flow monitoring values ​​of the interface as the first preset maximum flow monitoring value of the interface; for each of the N interfaces, using the minimum flow monitoring value among the multiple flow monitoring values ​​of the interface as the first preset minimum flow monitoring value of the interface.

[0012] In the above scheme, the second preset time period is used as a period to obtain the maximum and minimum values ​​of the traffic monitoring value of the interface within the second preset time period as a criterion for judging whether a fault occurs in the user device. On the one hand, this can ensure that the judgment standard of the user device when monitoring whether a fault occurs in the interface is more accurate. On the other hand, it can also ensure that the fault time period can be better located after a fault occurs.

[0013] In a possible implementation, the method further includes: for each of the N interfaces, when at least one flow monitoring value of the interface includes a first flow monitoring value or a second flow monitoring value, recording the time point of the first flow monitoring value or the second flow monitoring value.

[0014] Through the above method, when a user device fails, the time point when the abnormal traffic monitoring value occurs is recorded, the fault is accurately located and the on-site data is retained, which solves the problem of network failure being difficult to locate and on-site data being difficult or impossible to retain in the prior art.

[0015] In a possible implementation manner, the first preset duration is one week; M=10 minutes; and the second preset duration is four weeks.

[0016] Through the above method, sampling every 10 minutes within the first preset time can ensure that the collection of the flow monitoring value is not too frequent, which relieves the monitoring pressure of the user equipment and ensures that the real-time performance of the flow monitoring value is good. The second preset time is set to four weeks to ensure that the waiting time does not exceed one month when the user equipment is put into use, and it can take effect quickly. At the same time, it also ensures that the maximum or minimum flow monitoring values ​​determined by the four sets of data are relatively effective.

[0017] In the second aspect, an embodiment of the present invention provides a fault identification device, comprising: an acquisition unit, used to acquire N interfaces of a user device, N being a positive integer; acquiring at least one traffic monitoring value of each of the N interfaces within a first preset time length; a processing unit, used to determine that a fault has occurred in each of the N interfaces if at least one traffic monitoring value of the interface includes a first traffic monitoring value or a second traffic monitoring value, and record a fault change table entry corresponding to the failed interface; wherein the first traffic monitoring value is greater than a first preset maximum traffic monitoring value corresponding to the interface, and the second traffic monitoring value is less than a first preset minimum traffic monitoring value corresponding to the interface.

[0018] In a possible implementation manner, the N interfaces are N interfaces with the largest traffic among all interfaces of the user equipment.

[0019] In a possible implementation, the acquisition unit is specifically used to: sample the flow monitoring value of each of the N interfaces once every M minutes within a first preset time period to obtain at least one flow monitoring value for each of the N interfaces, where M is a positive integer.

[0020] In a possible implementation, the processing unit is specifically used to: for each of the N interfaces, obtain multiple flow monitoring values ​​of the interface within a second preset time length; for each of the N interfaces, use the maximum flow monitoring value among the multiple flow monitoring values ​​of the interface as the first preset maximum flow monitoring value of the interface; for each of the N interfaces, use the minimum flow monitoring value among the multiple flow monitoring values ​​of the interface as the first preset minimum flow monitoring value of the interface.

[0021] In a possible implementation, the acquisition unit is specifically used to: for each of the N interfaces, when at least one flow monitoring value of the interface includes a first flow monitoring value or a second flow monitoring value, record the time point of the first flow monitoring value or the second flow monitoring value.

[0022] In a possible implementation manner, the first preset duration is one week; M=10 minutes; and the second preset duration is four weeks.

[0023] In a third aspect, a device is provided, which includes a unit or module corresponding to the method described in any aspect of the first aspect. The unit or module can be implemented by hardware circuit, or by software, or by a combination of hardware circuit and software.

[0024] In an optional implementation, the device includes an acquisition unit and a processing unit, and the processing unit is used to execute a program or instruction to enable the device to execute the method described in any aspect of the first aspect.

[0025] In a fourth aspect, a device is provided, comprising a processor and an interface circuit, wherein the processor is used to communicate with other devices through the interface circuit and execute the method described in any one of the first aspects. The processor comprises one or more.

[0026] In a fifth aspect, a device is provided, comprising a processor coupled to a memory, the processor being configured to execute a program stored in the memory to execute the method described in any one of the first aspects. The memory may be located inside the device or outside the device. And the processor may be one or more.

[0027] In a sixth aspect, a device is provided, comprising a processor and a memory; the memory is used to store computer instructions, and when the device is running, the processor executes the computer instructions stored in the memory so that the device executes the method described in any aspect of the first aspect above.

[0028] In a seventh aspect, a chip system is provided, comprising: a processor or a circuit, configured to execute the method described in any one of the first aspects above.

[0029] In an eighth aspect, a computer-readable storage medium is provided, wherein instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is run on a communication device, the method described in any one of the above-mentioned first aspects is executed.

[0030] In a ninth aspect, a computer program product is provided, which includes a computer program or instructions. When the computer program or instructions are executed by a device, the method described in any one of the first aspects is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0032] Figure 1 A structural diagram of a user equipment provided by an embodiment of the present invention;

[0033] Figure 2 A schematic diagram of a flow chart of a fault identification method provided by an embodiment of the present invention;

[0034] Figure 3 A schematic diagram of a flow chart of a fault identification method provided by an embodiment of the present invention;

[0035] Figure 4 A schematic diagram of a fault identification device provided by an embodiment of the present invention;

[0036] Figure 5 A schematic diagram of a fault identification device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] Figure 1 A user equipment structure diagram of an embodiment of the present invention is shown in FIG. Figure 1 As shown, the structure includes a user device and several interfaces inside the user device. The user devices are connected through interfaces, and data between the user devices is transmitted through interfaces, that is, during the data transmission process, it will pass through the interfaces in these user devices. In the embodiment of the present invention, the traffic of the interface can be monitored to determine whether there is a fault.

[0039] In the present invention, the interface is a hardware network interface external to the user device; the user device is usually a device that the customer needs to automatically identify network faults and record fault sites. The user device includes but is not limited to routers, switches and other devices. The specific device type is determined in accordance with customer needs.

[0040] The preferred embodiments of the present invention are described below in conjunction with the drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention. In addition, the embodiments of the present invention and the features in the embodiments may be combined with each other if there is no conflict.

[0041] based on Figure 1 The user equipment structure diagram shown in FIG. Figure 2 A schematic diagram of a system architecture provided by an embodiment of the present invention is exemplarily shown. The method may be executed by a user device, and the user device may be a device such as a router or a switch.

[0042] like Figure 2 As shown, the process of the method may include:

[0043] Step 201, obtaining N interfaces of a user equipment;

[0044] Wherein, N is a positive integer, for example, N is an integer between 5 and 10.

[0045] In one implementation, the N interfaces are the N interfaces with the largest traffic among all interfaces of the user equipment. The traffic may include the outgoing traffic of the interface, the incoming traffic of the interface, or the sum of the outgoing traffic and the incoming traffic of the interface.

[0046] Exemplarily, the process of obtaining the N interfaces includes: using a command prompt to extract historical traffic data of all interfaces of the user device, comparing the extracted traffic data, and obtaining N interfaces with the largest traffic through comparison.

[0047] Exemplarily, the obtained N interfaces may also be updated regularly. For example, the N interfaces with the largest traffic in the X weeks are determined every X weeks.

[0048] In one implementation, the ratio between the value of N and the total number of interfaces of the user equipment is less than or equal to a preset ratio. For example, if the total number of interfaces of the user equipment is 100 and the preset ratio is 10%, then the value of N is less than or equal to 10.

[0049] By collecting traffic from the N interfaces with the largest traffic, it can be ensured that most of the services in the user device are monitored. At the same time, the ratio between the value of N and the value of the total number of interfaces of the user device is less than or equal to the preset ratio, which can reduce the monitoring pressure on the user device.

[0050] Step 202: Obtain at least one flow monitoring value of each of the N interfaces within a first preset time period.

[0051] For example, for the N interfaces, the traffic of each of the N interfaces is sampled once every M minutes within the first preset time, that is, a traffic monitoring value of each of the N interfaces is obtained every M minutes, and at least one traffic monitoring value of each of the N interfaces is obtained in the first preset time, where M is a positive integer. For example, M is 10.

[0052] Step 203: for each of the N interfaces, if at least one flow monitoring value of the interface includes the first flow monitoring value or the second flow monitoring value, it is determined that the interface has a fault, and a fault change table entry corresponding to the interface having the fault is recorded;

[0053] Among them, the first flow monitoring value is greater than the first preset maximum flow monitoring value corresponding to the interface, and the second flow monitoring value is less than the first preset minimum flow monitoring value corresponding to the interface.

[0054] In one implementation, the first preset maximum flow monitoring value and the first preset minimum flow monitoring value corresponding to each interface are preset.

[0055] In one implementation, the first preset maximum flow monitoring value and the first preset minimum flow monitoring value corresponding to each interface may be determined in the following manner:

[0056] Obtain multiple flow monitoring values ​​of each of the N interfaces within the second preset time length, and the maximum value of the multiple flow monitoring values ​​of each of the N interfaces within the second preset time length can be used as the first preset maximum flow monitoring value of the interface, and the minimum value of the multiple flow monitoring values ​​of each of the N interfaces within the second preset time length can be used as the first preset minimum flow monitoring value of the interface.

[0057] For example, the second preset time length is X weeks, where X is a positive integer, such as X = 4. The second preset time length may also be other values, which are not limited in the present application.

[0058] In one implementation, multiple flow monitoring values ​​of N interfaces are periodically updated with a second preset time period as a period.

[0059] For example, the multiple traffic monitoring value data stored in the user device are the traffic monitoring values ​​of N interfaces within the second preset time period, for example, the second preset time period is X weeks, and X is a positive integer. If multiple traffic monitoring values ​​of N interfaces within X weeks have been collected, then when the interface traffic monitoring values ​​of the X+1th week are collected, the traffic monitoring values ​​of the earliest week in the X weeks that have been collected are replaced with the traffic monitoring values ​​of the X+1th week. For example, if X=4, the traffic monitoring values ​​for 4 weeks are retained. After the end of the 5th week, the traffic monitoring values ​​of the N interfaces of the 1st week are deleted, and the newly acquired traffic monitoring values ​​of the N interfaces of the 5th week are stored as new traffic monitoring values. The second preset time period can also be other values, and the periodic update of the traffic monitoring value data changes with the change of the second preset time period, which is not limited in the present application.

[0060] In one implementation, during the second preset time period, in the process of obtaining the flow monitoring values ​​of the N interfaces, a flow monitoring value of each of the N interfaces is obtained every M minutes. For example, M=10.

[0061] In the above steps, the retained data of the second preset time length are all historical data of the last X weeks. Regardless of whether the newly acquired traffic monitoring values ​​of the N interfaces are determined to be faults by the method, all of them are retained as data in the second preset time length when the traffic monitoring values ​​of the N interfaces are periodically updated. On the one hand, this is because the action after the device recognizes the fault is only to record the snapshot of the change table items before and after the fault occurs, and will not perform any operation that damages the service of the user equipment. Therefore, a small number of abnormal judgment errors of traffic monitoring values, that is, omissions or false alarms of abnormal traffic monitoring value input and output faults, can be tolerated. On the other hand, since the second preset time length data as a comparison data group only maintains validity for X weeks, the abnormal data will not be maintained for too long and will not affect the overall fault detection and subsequent monitoring work.

[0062] In one implementation, in the process of obtaining the flow monitoring values ​​of N interfaces, the flow monitoring value of each of the N interfaces is obtained at a granularity of every M minutes. For each of the N interfaces, at least one flow monitoring value obtained by the interface within a first preset time period is compared with a first preset maximum flow monitoring value and a first preset minimum flow monitoring value, respectively, so as to determine whether the interface has a fault.

[0063] Exemplarily, in the process of obtaining the flow monitoring value of each of N interfaces at a granularity of every M minutes, one interface may have multiple failures within the first preset duration. For example, the first preset maximum flow monitoring value of interface A of the user equipment is 100GB, and the first preset minimum flow monitoring value is 20GB. With 100 minutes as the first preset duration and 10 minutes as the granularity, the flow monitoring value of each of N interfaces is obtained, and a total of 10 groups of flow monitoring values ​​of N interfaces are obtained. Then, the 10 obtained flow monitoring values ​​are compared with 100GB and 20GB. There may be a situation where 2 or more groups of flow monitoring values ​​are both greater than 100GB or less than 20GB at the same time. Then, these groups of flow monitoring values ​​are all judged to have failed.

[0064] If it is determined that the interface fails, the time point of the failure may also be recorded. The time point of the failure includes the time when a maximum flow monitoring value greater than the first preset maximum flow monitoring value is obtained, and the time when a minimum flow monitoring value less than the first preset minimum flow monitoring value is obtained.

[0065] In the present application, for an interface that fails among the N interfaces, a fault change table entry corresponding to the interface that fails is recorded. Specifically, the fault change table entry of the interface that fails within a third preset time after the time point when the fault occurs can be recorded, for example, the third preset time can be half an hour.

[0066] In one implementation, for an interface that fails among N interfaces, if the traffic monitoring value of each interface among the N interfaces is obtained at a granularity of every M minutes, then for the interface that fails among the N interfaces, the change table entries of the last three granularities of the failure are recorded, thereby ensuring that the recorded change table entry snapshot data includes the entire process before and after the failure occurs, ensuring the validity of the fault table entry snapshot. For example, when M = 10 minutes, if an interface among the N interfaces fails, then the fault change table entries of the interface within the last 30 minutes of the failure are recorded.

[0067] The changed entries include key protocol entries. These entries include but are not limited to at least one of the following: Border Gateway Protocol (BGP) entries, Intermediate System to Intermediate System (ISIS) entries, Open Shortest Path First Protocol (OSPF) entries, Label Distribution Protocol (LDP) entries, Resource Reservation Protocol-Traffic Engineering (RSVP-TE) entries, Label Switched Path (BGP-LSP) entries, Generic Route Encapsulation (GRE) entries, Internet Security (IP Security, IPSec) entries, Address Resolution Protocol (ARP) entries, Media Access Control Protocol (MAC) entries, Routing Information Base (RIB) entries, Forwarding Information Base (FIB) entries, Interface (Interface) entries, Segment Routing Protocol (Segment Routing Protocol) entries. Routing, SR) table items, Ethernet Virtual Private Network (EVPN) table items, Virtual Leased Line (VLL) table items, Virtual Private LAN Service (VPLS) table items, etc.

[0068] BGP may refer to the fourth version of the Border Gateway Protocol BGPv4, or the sixth version of the Border Gateway Protocol BGPv6;

[0069] ISIS can refer to the fourth version of the link state protocol, ISISv4, or the sixth version of the link state protocol, ISISv6;

[0070] OSPF may refer to the Open Shortest Path First protocol OSPF, or the third version of the Open Shortest Path First protocol OSPFv3.

[0071] At the same time, the segment routing protocol SR may include at least one of the following: the segment routing protocol SR-BE based on best-effort forwarding, the segment routing protocol SRv6-BE based on the IPv6 forwarding plane, the segment routing SR-TE based on traffic engineering, and the segment routing protocol SRv6 Policy based on the IPv6 forwarding plane.

[0072] Through this process, the flow monitoring values ​​of N interfaces in the user device are monitored with the first preset time period as a period, and periodic fault judgment based on the flow monitoring value is realized. Therefore, the above method realizes fault judgment based on the forwarding plane, ensures that whether a fault occurs from the perspective of the user device, and solves the problem that fault identification in the prior art stays on the control plane and there are a large number of missed scenarios. At the same time, according to the first preset maximum flow monitoring value and the first preset minimum flow monitoring value corresponding to each interface, it is determined whether the flow monitoring value of the interface is abnormal, so as to determine whether the interface has a fault, and the fault identification efficiency is high and the result is accurate. Moreover, when determining that the interface has a fault, the present application records the fault change table item, which can provide detailed data for subsequent fault analysis and improve the efficiency of fault handling.

[0073] When implementing it specifically, you can follow the following steps: Figure 3 The process shown in FIG. 1 is to periodically identify faults of user equipment, such as Figure 3 The process shown is based on Figure 2 The flowchart shown is a specific embodiment, where M=10 minutes, the first preset duration is one week, and the second preset duration is four weeks. It should be noted that the numerical value is only an example, and other data can also be used in the specific implementation process, which is not limited in the embodiment of the present invention. Figure 3 The specific implementation process shown includes the following steps:

[0074] In one possible implementation, Figure 3 As shown, the process includes the following steps:

[0075] Step 301: User equipment obtains N interfaces.

[0076] For example, the N interfaces are the N interfaces with the largest traffic among all interfaces of the user equipment.

[0077] In step 302, taking M=10 minutes as an example, the user equipment samples the flow monitoring values ​​of the flows of N interfaces with a sampling interval of every 10 minutes.

[0078] It should be noted that the above-mentioned sampling at a periodic interval of every 10 minutes is only an example, and other sampling intervals may also be used to sample the flow monitoring value, which is not limited in the embodiment of the present invention.

[0079] Step 303: Set the first preset time length to one week, and save the collected traffic monitoring values ​​of the N interfaces in a cycle of one week.

[0080] Taking setting the second preset time length to four weeks as an example, the user device retains the traffic monitoring values ​​of the last four weeks; it should be noted that the above one week and four weeks are only examples, and other time intervals can also be used as judgment criteria, which is not limited in the embodiments of the present invention.

[0081] Step 304 , whether the flow monitoring values ​​for four weeks have been collected; if the flow monitoring values ​​for four weeks have been collected, proceed to step 305 ; if the flow monitoring values ​​for four weeks have not been collected, proceed to step 303 .

[0082] Step 305, taking the maximum value of the flow monitoring value obtained by each of the N interfaces within four weeks as the first preset maximum flow monitoring value corresponding to the interface, and taking the minimum value of the flow monitoring value obtained by each of the N interfaces within four weeks as the first preset minimum flow monitoring value corresponding to the interface;

[0083] It should be noted that the above-mentioned collection of data for four weeks is only an example, and other time intervals may also be used as judgment criteria, which is not limited in the embodiment of the present invention.

[0084] Step 306, for each of the N interfaces, determine whether at least one flow monitoring value obtained by the interface within the first preset time period includes a first flow monitoring value greater than the first preset maximum flow monitoring value of the interface or a second flow monitoring value less than the first preset minimum flow monitoring value of the interface; if it includes the first flow monitoring value or the second flow monitoring value, determine that the interface has a fault and go to step 307; otherwise, go to step 303.

[0085] Step 307, taking a snapshot of the change entries of the interface failure in the last half hour;

[0086] The reason for selecting the change table items within half an hour is that this specific embodiment performs sampling at a sampling interval of every 10 minutes, and records the change table items within the last half hour after the fault occurs, which can cover the period before and after the fault occurs, and ensure that the fault manifestation is effective. It should be noted that the above-mentioned record of the change table items within the last half hour after the fault occurs is only an example, and other time lengths can also be used to record the fault change table items, which is not limited to the embodiments of the present invention.

[0087] Through the above method, with a sampling interval of 10 minutes, it can be ensured that the abnormal flow monitoring value is discovered in real time with good performance. At the same time, it can also solve the problem in the prior art that the flow monitoring value is obtained in seconds, and the data is obtained too frequently, resulting in excessive pressure on the equipment.

[0088] Furthermore, the first preset time is one week, which is consistent with the display mode of a large number of user devices. The traffic monitoring value can be displayed directly, and the process of analyzing the cycle through traffic is omitted. The second preset time is set to four weeks to ensure that when the user device is put into use, this method can take effect quickly, and the buffer time does not exceed one month. At the same time, four weeks as the second preset time ensures that the obtained traffic monitoring value data is relatively effective. If only two weeks of traffic monitoring values ​​are selected for judgment, the randomness of the data is too large. However, if five weeks or more of traffic monitoring values ​​are used, the second preset time is too long, which will increase the data storage pressure and computing pressure of the device.

[0089] In one practicable manner, based on the above Figure 3 The process shown in the figure can be divided into the following stages, including:

[0090] The interface information acquisition stage, the interface traffic monitoring value collection stage, the interface traffic monitoring value learning stage, the interface traffic monitoring value storage stage, the traffic monitoring value data anomaly comparison stage and the recent fault entry recording stage.

[0091] The interface information acquisition phase includes: Figure 3 In step 301, the user equipment uses a command line to obtain the interface with the largest flow monitoring value input and output, which is called the N interfaces with the largest flow monitoring value. The interface structure in the user equipment is as follows Figure 1 At the same time, the N interfaces with the largest flow monitoring values ​​are taken as collection objects, and the interface flow monitoring value collection phase is entered.

[0092] The interface traffic monitoring value collection phase includes: Figure 3 In step 302 and step 303, in this stage, the device collects the flow monitoring value data of N interfaces at a granularity of every M minutes, and stores the collected data in a period of each first preset time. It should be noted that the device retains data for at most every second preset time. In the user device, the user device that uses this method for the first time will be in the interface flow monitoring value learning stage before the use period reaches the second preset time, and the flow monitoring value data in the interface flow monitoring value learning stage will not be able to enter the flow monitoring value data abnormality comparison stage; after the user device's use period of this method reaches the second preset time, the newly obtained interface flow monitoring value data will no longer enter the interface flow monitoring value learning stage, but enter the interface flow monitoring value storage stage; the data in the interface flow monitoring value storage stage can enter the flow monitoring value data abnormality comparison stage.

[0093] The interface traffic monitoring value learning phase includes: Figure 3Step 304 in the interface traffic monitoring value learning phase, each time data within a first preset time period is obtained from the interface traffic monitoring value acquisition phase, a maximum value and a minimum value of the traffic monitoring value will be obtained.

[0094] The interface traffic monitoring value storage stage includes: Figure 3 Step 305 in the method is a stage after the user equipment completes the interface traffic monitoring value learning stage. The method suggests that the user equipment only retains the interface traffic monitoring value data for every second preset time period.

[0095] The abnormal comparison phase of flow monitoring value data includes Figure 3 Step 306 in this stage is performed in the interface traffic monitoring value storage stage. The user device compares the traffic monitoring value data that has just entered the interface traffic monitoring value storage stage with the traffic monitoring value data currently stored in the device, and determines whether a network failure occurs in the user device through the maximum and minimum values ​​of the traffic monitoring value.

[0096] The recent fault entry recording stage includes: Figure 3 In step 307, in this stage, a table entry is recorded for the time period determined to be a network failure in the abnormal traffic monitoring value data comparison stage.

[0097] It should be noted that the above steps are merely one type of practicable stage classification of the embodiment of the invention, and the present invention does not limit this.

[0098] Based on the same technical concept, Figure 4 A fault identification device provided by an embodiment of the present invention is exemplarily shown, and the device can execute the process of the fault identification method.

[0099] like Figure 4 As shown, the device comprises:

[0100] The acquisition unit 401 is used to acquire N interfaces of the user equipment, where N is a positive integer; and acquire at least one flow monitoring value of each of the N interfaces within a first preset time period;

[0101] The processing unit 402 is used to determine that a fault has occurred in each of the N interfaces if at least one flow monitoring value of the interface includes a first flow monitoring value or a second flow monitoring value, and record a fault change table entry corresponding to the failed interface; wherein the first flow monitoring value is greater than a first preset maximum flow monitoring value corresponding to the interface, and the second flow monitoring value is less than a first preset minimum flow monitoring value corresponding to the interface.

[0102] Based on the same technical concept, the embodiment of the present invention further provides a user equipment 500, referring to Figure 5As shown, the user equipment 500 is used to implement the fault identification method recorded in the above method embodiment. The user equipment 500 of this embodiment may include: a processor 501, an interface 502, a memory 503, and a computer program stored in the memory and executable on the processor, such as a fault identification program. Among them, the number of interfaces 502 is not limited, and there may be at least N interfaces, and the interface is used to communicate with other devices. When the processor executes the computer program, the steps in the above-mentioned various fault identification method embodiments are implemented. Alternatively, when the processor executes the computer program, the functions of each module / unit in the above-mentioned device embodiments are implemented.

[0103] The specific connection medium between the processor 501, the interface 502, and the memory 503 is not limited in the embodiment of the present invention. Figure 5 The processor 501, the interface 502, and the memory 503 are connected via a bus, and the connection between other components is only for illustrative purposes and is not intended to be limiting. The bus can be divided into an address bus, a data bus, a control bus, and the like.

[0104] The processor 501 is used to call the computer program stored in the memory 503 to execute the following Figure 2 The fault identification method shown in .

[0105] Interface 502 is used to communicate with other devices.

[0106] The memory 503 may be a volatile memory, such as a random-access memory (RAM); the memory 503 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), or the memory 503 may be any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 503 may be a combination of the above memories.

[0107] The embodiment of the present application further provides a computer-readable storage medium, wherein a computer program or instruction is stored in the computer-readable storage medium. When the computer program or instruction is executed by a user device, the following is implemented: Figure 2 The method of any one of the above.

[0108] In some possible implementations, various aspects of the table entry update method provided by the present invention may also be implemented in the form of a program product, which includes a program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the table entry update method according to various exemplary implementations of the present invention described above in this specification.

[0109] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0110] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0111] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0112] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0113] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0114] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of this application and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A fault identification method, characterized in that: include: Get N interfaces of the user equipment, where N is a positive integer; Obtain at least one flow monitoring value of each of the N interfaces within a first preset time period; For each of the N interfaces, if at least one flow monitoring value of the interface includes a first flow monitoring value or a second flow monitoring value, it is determined that the interface has failed, and the fault change table entry corresponding to the failed interface is recorded; wherein, the first flow monitoring value is greater than the first preset maximum flow monitoring value corresponding to the interface, and the second flow monitoring value is less than the first preset minimum flow monitoring value corresponding to the interface.

2. The method according to claim 1, characterized in that The N interfaces are the N interfaces with the largest traffic among all interfaces of the user equipment.

3. The method according to claim 1 or 2, characterized in that The obtaining of at least one flow monitoring value of each of the N interfaces within a first preset time period includes: For the N interfaces, the traffic of each of the N interfaces is sampled once every M minutes within a first preset time period to obtain at least one traffic monitoring value of each of the N interfaces, where M is a positive integer.

4. The method according to claim 3, characterized in that The method further comprises: For each of the N interfaces, obtaining a plurality of flow monitoring values ​​of the interface within a second preset time period; For each of the N interfaces, taking a maximum flow monitoring value among a plurality of flow monitoring values ​​of the interface as a first preset maximum flow monitoring value of the interface; For each of the N interfaces, a minimum flow monitoring value among multiple flow monitoring values ​​of the interface is used as a first preset minimum flow monitoring value of the interface.

5. The method according to claim 1 or 2, characterized in that: The method further comprises: For each of the N interfaces, when at least one flow monitoring value of the interface includes a first flow monitoring value or a second flow monitoring value, a time point of the first flow monitoring value or the second flow monitoring value is recorded.

6. The method according to claim 4, characterized in that Further including at least one of the following: The first preset duration is one week; M = 10 minutes; The second preset time period is four weeks.

7. A fault identification device, characterized in that: include: An acquiring unit, used to acquire N interfaces of a user device, where N is a positive integer; Obtain at least one flow monitoring value of each of the N interfaces within a first preset time period; A processing unit is used to determine that a fault has occurred in each of the N interfaces if at least one flow monitoring value of the interface includes a first flow monitoring value or a second flow monitoring value, and record a fault change table entry corresponding to the failed interface; wherein the first flow monitoring value is greater than a first preset maximum flow monitoring value corresponding to the interface, and the second flow monitoring value is less than a first preset minimum flow monitoring value corresponding to the interface.

8. The device according to claim 7, characterized in that The N interfaces are the N interfaces with the largest traffic among all interfaces of the user equipment.

9. A user equipment, characterized in that: including a processor and a memory; The memory is used to store computer instructions; The processor is connected to the memory, and is used to execute the computer instructions in the memory to implement the method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program or instruction, and when the computer program or instruction is executed by a user device, the method according to any one of claims 1 to 6 is implemented.

Images