System fault positioning method and system and electronic equipment

Abstract

The invention provides a system fault positioning method and system and electronic equipment. The system fault positioning method comprises the following steps: acquiring preset original information of a target network system, wherein the preset original information at least comprises topological data, network element data, alarm data, equipment performance data and log data of the target network system; converting and sorting the alarm data according to the first mapping data table to form an alarm information set, and determining to-be-selected root cause alarm equipment corresponding to alarm information in the alarm information set according to the second mapping data table; determining an alarm root cause, a root cause alarm device and a solution measure according to the alarm data set, the to-be-selected root cause alarm device and preset original information; and forming a control signal for the root cause alarm equipment according to the solution measure, and sending the control signal to the root cause alarm equipment, or outputting the solution measure. According to the embodiment of the invention, the system fault can be automatically positioned and adjusted, and the operation and maintenance efficiency and the operation and maintenance reliability are improved.

Description

Background Art

[0002] Today, 5G and other network services have been widely used, making the current network operation and maintenance scenarios more complex and diverse. Operation and maintenance personnel often have to face a large amount of real-time and historical data. The existing network management system's technical means lack alarm root cause analysis application process, making it difficult to provide sufficient support for maintenance personnel. Many problems cannot be responded to and solved quickly, resulting in the spread and escalation of faults, which ultimately affects customer experience.

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0004] The purpose of the present disclosure is to provide a system fault locating method, system and electronic equipment for improving the operation and maintenance efficiency of complex optical network systems.

[0005] According to a first aspect of an embodiment of the present disclosure, a system fault locating method is provided, comprising: obtaining preset original information of a target network system, the preset original information comprising at least topology data, network element data, alarm data, equipment performance data, and log data of the target network system; converting and organizing the alarm data according to a first mapping data table to form an alarm information set, and determining a candidate root cause alarm device corresponding to the alarm information in the alarm information set according to a second mapping data table; determining an alarm root cause, a root cause alarm device, and a solution according to the alarm data set, the candidate root cause alarm device, and the preset original information; forming a control signal for the root cause alarm device according to the solution, and sending the control signal to the root cause alarm device, or outputting the solution.

[0006] According to a second aspect of an embodiment of the present disclosure, a system fault location system is provided, comprising: a network data collection module, an alarm data processing module, an association mining module, and a preset analysis model, wherein: the network data collection module is used to obtain preset original information of a target network system, and send the preset original information to the alarm data processing module and the preset analysis model, and the preset original information at least includes topology data, network element data, alarm data, equipment performance data, and log data of the target network system; the alarm data processing module is used to extract the alarm data from the preset original information, and send the alarm data to the association mining module; the association mining module The joint mining module is used to convert and organize the alarm data according to the first mapping data table to form an alarm information set, determine the candidate root cause alarm device corresponding to the alarm information in the alarm information set according to the second mapping data table, and send the organized alarm information set and the candidate root cause alarm device to the preset analysis model; the preset analysis model is used to determine the alarm root cause, the root cause alarm device and the solution according to the alarm data set, the candidate root cause alarm device and the preset original information, form a control signal for the root cause alarm device according to the solution, send the control signal to the root cause alarm device, or output the solution.

[0007] According to a third aspect of the present disclosure, there is provided an electronic device, comprising: a memory; and a processor coupled to the memory, wherein the processor is configured to execute any one of the methods described above based on instructions stored in the memory.

[0008] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a program is stored, and when the program is executed by a processor, the system fault locating method as described in any one of the above items is implemented.

[0009] According to a fifth aspect of the present disclosure, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0010] The disclosed embodiment automatically collects a variety of preset original information of the target model, converts and organizes the alarm data in the preset original information, and can effectively identify the alarm data of a large number of various devices in a complex system, thereby improving the efficiency of subsequent analysis; by using a trained preset analysis model to process the preset original information, the organized alarm information set and the root cause alarm device to be selected, it can effectively integrate a variety of information, accurately locate the cause of the alarm and the root cause alarm device, and automatically generate corresponding solutions. When the solution can be automatically executed by the root cause alarm device, a control signal is sent to the root cause alarm device to automatically eliminate the system alarm or reduce the system alarm; when the solution cannot be automatically executed by the root cause alarm device, the solution is automatically output for operation and maintenance personnel to handle, which can greatly improve the operation and maintenance efficiency and the accuracy of system fault location, so that the system can return to normal as soon as possible and reduce the operation and maintenance cost.

[0011] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0013] Figure 1 is a flow chart of a system fault locating method in an exemplary embodiment of the present disclosure.

[0014] Figure 2 It is a sub-flowchart of step S2 in the exemplary embodiment of the present disclosure.

[0015] Figure 3 is a schematic diagram of a system fault location system in an exemplary embodiment of the present disclosure.

[0016] Figure 4 is a schematic diagram of a system fault locating system 300 in an exemplary embodiment of the present disclosure.

[0017] Figure 5 is a schematic diagram of a system fault locating system 300 in an exemplary embodiment of the present disclosure.

[0018] Figure 6 is a block diagram of an electronic device in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0019] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0020] In addition, the accompanying drawings are only schematic diagrams of the present disclosure, and the same reference numerals in the drawings represent the same or similar parts, so their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities, which do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0021] The exemplary embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0022] Figure 1 is a flow chart of a system fault locating method in an exemplary embodiment of the present disclosure.

[0023] refer to Figure 1 , the system fault location method 100 may include:

[0024] Step S1, obtaining preset original information of the target network system, wherein the preset original information at least includes topology data, network element data, alarm data, equipment performance data, and log data of the target network system;

[0025] Step S2, converting and arranging the alarm data according to the first mapping data table to form an alarm information set, and determining the root cause alarm device to be selected corresponding to the alarm information in the alarm information set according to the second mapping data table;

[0026] Step S3, determining the alarm root cause, the root cause alarm device and the solution according to the alarm data set, the to-be-selected root cause alarm device and the preset original information;

[0027] Step S4: forming a control signal for the root cause alarm device according to the solution, and sending the control signal to the root cause alarm device, or outputting the solution.

[0028] The disclosed embodiment automatically collects a variety of preset original information of the target model, converts and organizes the alarm data in the preset original information, and can effectively identify the alarm data of a large number of various devices in a complex system, thereby improving the efficiency of subsequent analysis; by using a trained preset analysis model to process the preset original information, the organized alarm information set and the root cause alarm device to be selected, it can effectively integrate a variety of information, accurately locate the cause of the alarm and the root cause alarm device, and automatically generate corresponding solutions. When the solution can be automatically executed by the root cause alarm device, a control signal is sent to the root cause alarm device to automatically eliminate the system alarm or reduce the system alarm; when the solution cannot be automatically executed by the root cause alarm device, the solution is automatically output for operation and maintenance personnel to handle, which can greatly improve the operation and maintenance efficiency and the accuracy of system fault location, so that the system can return to normal as soon as possible and reduce the operation and maintenance cost.

[0029] The method of the embodiment of the present disclosure can be used to locate faults in a target network system, and the target network system may include multiple network devices, at least one of which may be an optical network device. An optical network device refers to a set of devices that realize functions such as generation, modulation, amplification, transmission, reception, and mutual conversion of optical signals and electrical signals based on the principle of optical communication technology, and may include optical transmission equipment, optical transport network equipment, optical access equipment, optical switching equipment, etc.

[0030] Next, each step of the system fault locating method 100 is described in detail.

[0031] In step S1, preset original information of a target network system is obtained, wherein the preset original information at least includes topology data, network element data, alarm data, equipment performance data, and log data of the target network system.

[0032] The target network system usually covers a variety of different types and levels of equipment, which continuously generate various types of data during continuous operation. In step S1, data can be collected from various data sources of the target network system. These data sources are widely distributed in different types of network devices, servers, and various software application systems. The above-mentioned various types of raw data collected at a sampling time point may at least include topology data, network element data, alarm data, equipment performance data, and log data.

[0033] Topology data includes the connection status of the network and devices. The granularity can be at the network element level, board level, port level or time slot level. It is used to describe the connection links, hierarchical architecture and data transmission paths between each device node, including the backbone links between core switches and edge routers, and the interconnection architecture of optical network equipment and server clusters.

[0034] The network element data records in detail the model, configuration parameters, region and other key configuration information of each network element, which is used for subsequent precise positioning of problematic devices.

[0035] Alarm data provides real-time feedback on various emergencies such as port failures, overtemperature, bandwidth congestion, etc. Its timeliness and accuracy are directly related to the effectiveness of troubleshooting. If the system is operating normally, there may be no alarm data at the sampling time point.

[0036] Equipment performance data continuously monitors core indicators such as optical power, CPU usage, memory usage, bit error rate, and throughput.

[0037] The log data fully records every key operation, every abnormal event and the corresponding timestamp of the equipment from startup, operation to maintenance, providing a basis for tracing the process of fault occurrence.

[0038] Table 1 shows exemplary data types included in alarm data and equipment performance data.

[0039] Table 1

[0040]

[0041] The above-mentioned preset original information is of different types and large in quantity. When the number of devices in the target network system is large, it can provide a complete description of the state of the target network system at the sampling time point of collecting these preset original information.

[0042] After obtaining the preset original information corresponding to a sampling time point, the preset original information can be purified based on the preset data cleaning rules to remove possible erroneous data, duplicate data, and incomplete data fragments in the original information to ensure the data quality of subsequent analysis. For example, for alarm data, remove false alarm information caused by short-term sensor failures; for log data, filter out redundant records generated by routine system maintenance operations. Through accurate data cleaning, the data entering the subsequent analysis process is authentic and reliable.

[0043] In step S2, the alarm data is converted and sorted according to the first mapping data table to form an alarm information set, and the candidate root cause alarm device corresponding to the alarm information in the alarm information set is determined according to the second mapping data table.

[0044] Due to the complexity of the preset original information, the data sources of the alarm data are widely distributed in different types of network devices, servers and various software application systems, and the data formats are complex and varied, including but not limited to text strings, binary codes, custom formats of specific manufacturers, etc. For example, a traditional network switch may output a port fault alarm in a simple text form, recorded as "Port03Down"; while the optical network equipment uses a structured XML format to feedback optical module abnormalities. And each manufacturer, product line, and product model has corresponding alarm processing suggestions. Therefore, before conducting a comprehensive analysis, each alarm data is first converted and sorted. At the same time, when it is found that the preset original information currently collected does not have alarm data, the execution of the current fault location method can be terminated and executed at the next sampling time point. In some embodiments, method 100 can also be started only when it is determined that alarm data appears.

[0045] Figure 2 It is a sub-flowchart of step S2 in the exemplary embodiment of the present disclosure.

[0046] refer to Figure 2 In an exemplary embodiment, step S2 may include:

[0047] Step S21, determining the alarm category and alarm device corresponding to each alarm data according to the first mapping data table, the first mapping data table including the mapping relationship between the device model, the alarm code, and the alarm category;

[0048] Step S22, determining a list of alarm devices corresponding to each alarm category and / or a list of alarm categories corresponding to each alarm device according to the alarm categories and alarm devices corresponding to the plurality of alarm data;

[0049] Step S23: forming an alarm information set according to the alarm device list corresponding to each alarm category and / or the alarm category list corresponding to each alarm device.

[0050] The first mapping data table is mainly used to translate alarm data. Since the alarm information generated by different manufacturers and different models of equipment has different formats and complex expressions, some use professional codes, and some are lengthy English descriptions, which greatly hinders unified analysis. The first mapping data table integrates the conversion rules summarized from industry general standards, mainstream manufacturers' equipment alarm specifications, and a large number of operation and maintenance practices based on industry standards, operation and maintenance experience, and past fault case accumulation. It can standardize the conversion of various alarm data and organize the ambiguous information into a clear structure and semantically clear alarm information set. For example, the different alarm expressions of link interruption of various devices are uniformly converted into the format of "link interruption [specific link identifier], fault level [high / medium / low]". For text alarms, text cleaning, word segmentation, part-of-speech tagging and other means in natural language processing technology are used to remove redundant information and extract key descriptive words. For example, "Port03Down" is converted into "Device port failure [port number: 03]" to make its semantics clearer and more intuitive. For structured data, by writing an adaptive parsing script, the data is reorganized according to the established field mapping relationship. For example, the optical module alarm in XML format is converted into "optical module alarm [module number: OpticalModule01, fault type: PowerAbnormal, time: 2024-12-3010:23:45]" to ensure that alarms from different sources can be unified into a standard structured expression.

[0051] After the format conversion is completed, enter the alarm information classification and aggregation step. Group the alarm information according to the type of alarm, scope of impact, severity and other dimensions. For example, all alarms related to network connection interruption are classified into one category, covering alarms of different devices but the same connection problems such as router port disconnection, link failure, network card failure, etc.; alarms such as high CPU usage and memory overflow caused by device resource overload are classified into the resource alarm group. In this process, each type of alarm can also be assigned a corresponding priority, which is usually determined by the impact of the fault on business continuity and the scope of the impact. For example, the core link interruption alarm that causes large-scale business paralysis is set to the highest priority, while the abnormal fan speed alarm of individual devices is set to a low priority.

[0052] Next comes the integration of associated alarm information. Considering that many faults do not occur in isolation, a root cause may trigger alarms in multiple devices or links. In some cases, factors such as the time sequence of alarm occurrence and the topological connection relationship of the equipment correspond to fixed associated alarms. For example, if an optical power reduction alarm of an optical network device appears in succession in a short period of time, followed by an increased bit error rate alarm on the downstream switch port connected to it, these two alarms are highly correlated and correspond to a fixed alarm situation: "Optical network link failure risk [source device: optical network device [number: XX], affected device: downstream switch [port number: YY], associated alarms: decreased optical power, increased bit error rate]".

[0053] This process can be achieved by querying the second mapping data table. The second mapping data table is mainly used to lock the candidate root cause alarm device corresponding to the alarm information according to the preset alarm and equipment failure association logic and the translated alarm data. The alarm and equipment failure association logic can be given by the equipment manufacturer or by the operation and maintenance personnel based on experience. It can give the corresponding candidate root cause alarm device based on the equipment connection topology and fault propagation model. For example, when a link alarm is found according to the translated alarm data, the optical network transceiver corresponding to the alarm type of the link, the connected switch port and other potential fault source devices can be quickly located to narrow the scope of investigation.

[0054] Finally, the alarm information that has undergone multiple steps of processing such as conversion, classification, and integration is gathered in an orderly manner to form a complete alarm information set and the candidate root cause alarm device corresponding to the alarm information set.

[0055] It should be noted that the root cause alarm device to be selected is not the final analysis result, but only the positioning result queried according to the fixed mapping relationship. The specific cause of the fault still needs further analysis.

[0056] By introducing mapping query, the alarm data can be simplified, and the root cause alarm devices to be selected can be given according to the fixed matching relationship, which can reduce the calculation amount of subsequent analysis and improve the efficiency of fault location.

[0057] In step S3, the alarm root cause, the root cause alarm device and the solution are determined according to the alarm data set, the to-be-selected root cause alarm device and the preset original information.

[0058] In an exemplary embodiment, the alarm data set, the root cause alarm device to be selected, and the preset original information can be input into the preset analysis model, and the preset analysis model outputs the alarm root cause, the root cause alarm device, and the solution corresponding to the alarm root cause and / or the solution corresponding to the root cause alarm device. In order to maintain the similarity between the training data and the input data actually processed by the model, the alarm information set corresponding to the preset original data and the root cause alarm device to be selected can also be input.

[0059] Preset analysis models include neural network models, generative large models, etc. The neural network model constructs a multi-layer neuron structure to process the input data layer by layer and finally outputs accurate prediction results. With its powerful self-learning and nonlinear mapping capabilities, it can deeply mine the hidden patterns and rules in massive and complex data.

[0060] The preset analysis model can update parameters through historical data training, and then automatically obtain analysis results based on input data. The training data (historical data) of the preset analysis model includes preset original information corresponding to multiple sampling time points, alarm root causes corresponding to the preset original information, root cause alarm devices, solutions and feedback information of the solutions. The feedback information includes manual debugging feedback information and / or feedback parameters automatically obtained from the root cause alarm device or the target network system.

[0061] The preset analysis model can use machine learning algorithms to conduct in-depth learning on preset original information, analysis results (alarm root cause / root cause alarm device / solution), and feedback information to dig out the alarm root cause hidden under the surface. For example, seemingly isolated alarms on multiple device ports may belong to a pattern, that is, the aging of the optical module of the upstream optical network device causes the optical power to decay, which in turn triggers a chain reaction. Therefore, the root cause alarm device corresponding to the alarm information of these device ports can be set to the optical network device, and the alarm root cause can be determined as the aging of the optical module of the optical network device.

[0062] The optical power of an optical network device connected to an optical link is continuously lower than the threshold. The affected service scope corresponding to the optical network device is located, and then the fault may be concentrated on the upstream and downstream devices related to the link and the services it carries. The root cause alarm devices of these upstream and downstream devices are set to the optical network device, and the root cause of the alarm is set to the optical power of the optical network device continuously being lower than the threshold.

[0063] In addition, the preset analysis model can also extract information fragments closely related to the time of fault occurrence, fault type, and faulty device identification from the complex alarm texts and log records through intelligent text analysis algorithms. For example, when a large-scale service interruption occurs in the system, the "optical module high temperature alarm" triggered by an optical network device at a specific time and a series of subsequent "link automatic switching" records associated with it are extracted from the massive logs. From this, the root cause of the fault is likely to be the transmission anomaly caused by the overheating of the optical module, and the root cause of the alarm is determined to be the optical network device, and the root cause of the alarm is determined to be the overheating of the optical module.

[0064] In some embodiments, the knowledge of the knowledge base can be pre-input into the preset analysis model during the training process. The knowledge base can store a large number of past fault cases, fault handling experience and corresponding solutions. Thus, the preset analysis model can compare the knowledge base entries one by one according to the characteristic information of the current fault, such as topological location, alarm combination, performance degradation trend, etc., match the closest historical case, and draw on its mature processing flow. For example, if this fault presents similar characteristics to the previous "optical network equipment board failure causing some services to be stuck", the root cause alarm device can be determined as the optical network device, and the root cause of the alarm can be determined as the board failure.

[0065] Thus, the root cause of the alarm and at least one root cause alarm device involved in the root cause of the alarm can be located; or at least one root cause alarm device and the root cause of the alarm corresponding to the root cause alarm device can be located. It should be noted that the device causing the alarm may not have an alarm itself, so the root cause alarm device does not necessarily have an alarm phenomenon, nor does it necessarily have an alarm root cause. However, the root cause of the alarm generally involves at least one root cause alarm device that causes the alarm data to be generated.

[0066] After determining the root cause alarm device, the preset analysis module can automatically determine the solution measures based on the built-in knowledge base and the fault resolution measures corresponding to the device model of the root cause alarm device, covering hardware detection, hardware replacement, software reset, software parameter adjustment instructions, emergency switching solutions, etc., to accelerate the fault repair process and improve the system availability recovery efficiency.

[0067] In an exemplary embodiment, in step S3, manually input information can also be received, and the manually input information is used to set the selected fault influencing factors, and the selected fault influencing factors include special events, special time, and special equipment; the alarm root cause, root cause alarm device and solution are determined according to the selected fault influencing factors, the alarm data set, the selected root cause alarm device and the preset original information.

[0068] For example, factors such as the Double 11 promotion and the Spring Festival travel rush may put great pressure on system operation and maintenance, leading to a series of obvious fault characteristics. Therefore, the disclosed embodiment is configured to input the candidate fault influencing factors into the preset analysis model, so that the preset analysis model can refer to these candidate fault influencing factors to give the final analysis conclusion. In order to maintain consistency between use and training, these candidate fault influencing factors can be used to participate in training during the training phase.

[0069] In step S4, a control signal for the root cause alarm device is formed according to the solution, and the control signal is sent to the root cause alarm device, or the solution is output.

[0070] When the solution meets the conditions for automatic execution, the control signal for the root cause alarm device can be quickly generated according to the instruction and delivered to the root cause alarm device in the form of an electrical signal or a network instruction. For example, for the device alarm caused by the software parameter error, the control signal carries the corrected parameter value, remotely triggers the device's software module to automatically update, and the repair action is completed instantly. The system alarm is eliminated or greatly reduced, and the service is restored smoothly. In some complex scenarios, such as the replacement of hardware modules of large optical network equipment, the solution cannot be automatically executed by the equipment. At this time, the detailed solution can be automatically output in the form of a report, including fault description, root cause analysis, required spare parts list, operation steps and precautions, etc., so that the operation and maintenance personnel can carry out on-site emergency repairs efficiently and accurately based on this report, ensure that the system returns to the right track as soon as possible, keep the operation and maintenance costs to a minimum, and improve the reliability and stability of the system in all aspects.

[0071] Corresponding to the above method embodiments, the present disclosure also provides a system fault locating system, which can be used to execute the above method embodiments.

[0072] Figure 3 is a schematic diagram of a system fault locating system in an exemplary embodiment of the present disclosure.

[0073] refer to Figure 3 The system fault location system 300 may include: a network data collection module 1, an alarm data processing module 2, an association mining module 3, and a preset analysis model 4, wherein:

[0074] The network data collection module 1 is used to obtain the preset original information of the target network system and send the preset original information to the alarm data processing module 2 and the preset analysis model 4. The preset original information at least includes the topology data, network element data, alarm data, equipment performance data and log data of the target network system;

[0075] The alarm data processing module 2 is used to extract the alarm data from the preset original information and send the alarm data to the association mining module 3;

[0076] The association mining module 3 is used to convert and organize the alarm data according to the first mapping data table to form an alarm information set, determine the root cause alarm device to be selected corresponding to the alarm information in the alarm information set according to the second mapping data table, and send the organized alarm information set and the root cause alarm device to be selected to the preset analysis model 4;

[0077] The preset analysis model 4 is used to determine the root cause of the alarm, the root cause alarm device and the solution according to the alarm data set, the root cause alarm device to be selected and the preset original information, and to form a control signal for the root cause alarm device according to the solution, and send the control signal to the root cause alarm device, or output the solution.

[0078] Among them, the alarm data processing module 2 is used to filter out alarm data from all the collected preset original information, and the association mining module is used to process the alarm data from the alarm data processing module 2 as in step S2 of method 100, and output an alarm information set and a root cause alarm device to be selected.

[0079] The output data of the association mining module 3 (including but not limited to the alarm information set and the root cause alarm device to be selected) is shown in Table 2.

[0080] Table 2:

[0081]

[0082]

[0083] In an exemplary embodiment, the network data collection module 1 and the association mining module 3 may integrate the input data of the preset analysis module 4 and form the following format:

[0084] Alarm data: XXXX.

[0085] Performance data: XXXX.

[0086] Topology information: XXXX.

[0087] Configuration information: XXXX.

[0088] Log information: XXXX.

[0089] RootAlarmConfidence: XXXX.

[0090] RootAlarmState:XXXX.

[0091] RootAlarmLevel:XXXX.

[0092] RootAlarmNamel:XXXX.

[0093] DerivedAlarms:XXXX.

[0094] Number of Alarms: XXXX.

[0095] NumberofAffectedConnections:XXXX.

[0096] The output data of the preset analysis model 4 (including but not limited to the root cause alarm device and the root cause of the alarm) can be shown in Table 3.

[0097] Table 3:

[0098]

[0099]

[0100] The solutions output by the preset analysis model 4 include but are not limited to those shown in Table 4.

[0101] Table 4:

[0102]

[0103] The specific execution steps of the above-mentioned network data collection module 1, alarm data processing module 2, association mining module 3, and preset analysis model 4 refer to the above-mentioned method embodiment, which will not be repeated here.

[0104] Figure 4 is a schematic diagram of a system fault locating system 300 in an exemplary embodiment of the present disclosure.

[0105] refer to Figure 4 In some embodiments, the system fault location system 300 further includes an information storage module 5, which is used to store the first mapping data table, the second mapping data table and the manually input information, and input the manually input information into the preset analysis model 4, and the manually input information is used to set the candidate fault influencing factors, and the candidate fault influencing factors include special events, special time, and special equipment. The information storage module 5 can be embodied in the form of a knowledge base, pre-storing more types of preset knowledge (determined association relationships), and the present disclosure does not impose any special restrictions on this.

[0106] Figure 5 is a schematic diagram of a system fault locating system 300 in an exemplary embodiment of the present disclosure.

[0107] refer to Figure 5 In some embodiments, the system fault location system 300 also includes a training data processing module 6, which is used to receive historical data and form training data of a target analysis model based on the historical data. The historical data includes at least preset original information corresponding to multiple sampling time points, alarm root causes corresponding to the preset original information, root cause alarm devices, solutions and feedback information of the solutions. The feedback information includes manual debugging feedback information and / or feedback parameters automatically obtained from the root cause alarm device or the target network system.

[0108] Combination Figure 5 A schematic diagram illustrating the interaction between the modules in the system 300.

[0109] In step S1: the network data collection module 1 obtains preset original information from the target network system through a data collection method.

[0110] In step S2: the network data collection module 1 synchronously transmits the topology information, network element information, alarm information, performance data and logs to the alarm data processing module 2 and the preset analysis model 4.

[0111] In step S3: the alarm data processing module 2 inputs the extracted alarm data into the association mining module 3.

[0112] In step S4: the association mining module 3 outputs an alarm information set and a root cause alarm device to be selected according to the alarm data.

[0113] In step S5: the preset analysis model 4 performs root cause analysis of the network fault according to the received information, and provides root cause analysis results, maintenance operations or repair suggestions.

[0114] Step S6: In the execution unit, if the network resources can meet the automatic operation and maintenance requirements, the control signal is automatically output to the target network system, and the setting is directly input to the root cause alarm device. If it cannot be met, the relevant analysis results and targeted operation and maintenance suggestions are output for operation and maintenance reference in the manual intervention stage.

[0115] Step S7: The target network system performs relevant operations to optimize and adjust the root cause alarm device.

[0116] Step S8: The training data processing module 6 collects the input data and output data of the preset analysis model 4, as well as the feedback information of the target network system on the solution measures, and merges and splices the three types of data to continuously accumulate the training data set of the large model to optimize the analysis capability of the preset analysis model 4.

[0117] The feedback information includes manual debugging feedback information and / or feedback parameters automatically obtained from the root cause alarm device or the target network system.

[0118] The method and system proposed in the embodiments of the present disclosure have many significant characteristics and advantages. First, in terms of the overall architecture, the application process of alarm root cause analysis in the optical network is clarified, and the input and output data parameters and formats required for the system process are sorted out and defined in detail. Its scope covers all aspects from system data acquisition and processing, training data acquisition and processing, alarm correlation analysis, root cause analysis to decision-making and resource application, providing a set of systematic solutions for optical network management in an all-round way. What is particularly critical is that the solution focuses on network resource management and optimization during the operation and maintenance of the optical network, generates accurate prediction results through data processing, and then makes scientific adjustment decisions, and optimizes resource application and adjustment cycles, thereby significantly improving the management efficiency of the optical network, and can be widely used in the root cause location of faults of different optical network bearer technologies. In addition, this method is not limited to a specific prediction algorithm, and can realize continuous optimization of the model based on the continuously accumulated data during the operation of the system, enhance the analysis ability of the model in practical applications, and reduce the need for external intervention.

[0119] From the perspective of practicality, the disclosed embodiments perform excellently. On the one hand, a complete set of models and processes for root cause location of optical network faults is proposed, which comprehensively covers key links such as data collection and processing, alarm correlation analysis, alarm root cause analysis, and model optimization. At the same time, the input and output of data and the format of model prompt words are clearly defined, which is highly consistent with the ease of use principle of network operation. On the other hand, a systematic management method for optical network operation and maintenance is proposed. This method has wide applicability and can seamlessly connect the root cause location of fault alarms and related decision-making processes of any optical transmission network. It is very easy to integrate with the existing network management controller system and show stronger adaptability and availability than general root cause location methods. In addition, it can not only generate accurate analysis results, but also refine the technical solutions for specific network adjustments into two types: automatic maintenance optimization and manual intervention, so that the prediction results are closely linked to actual operations, and various specific needs in network operations can be met.

[0120] By combining the collected actual decision data and network system parameters, we carefully create optimized training data for model reinforcement training, and continuously enhance the adaptability and prediction accuracy of the model. Moreover, the preset analysis model has strong flexibility. According to the differences in specific tasks, we only need to fine-tune the training data to adapt to different optical network system management system architectures and achieve the target function.

[0121] In summary, the embodiments of the present disclosure provide a comprehensive, efficient and practical solution for optical network alarm / fault root cause location and operation and maintenance management, and are expected to push the level of optical network resource management and control to a new level.

[0122] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0123] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0124] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0125] Refer to the following Figure 6 The electronic device 600 according to this embodiment of the present invention is described. Figure 6 The electronic device 600 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0126] like Figure 6 As shown, the electronic device 600 is in the form of a general computing device. The components of the electronic device 600 may include but are not limited to: at least one processing unit 610, at least one storage unit 620, and a bus 630 connecting different system components (including the storage unit 620 and the processing unit 610).

[0127] The storage unit stores program codes, which can be executed by the processing unit 610, so that the processing unit 610 performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit 610 can perform the method shown in the embodiment of the present disclosure.

[0128] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache memory unit 6202 , and may further include a read-only memory unit (ROM) 6203 .

[0129] The storage unit 620 may also include a program / utility 6204 having a set (at least one) of program modules 6205, such program modules 6205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0130] Bus 630 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0131] The electronic device 600 may also communicate with one or more external devices 700 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 600, and / or communicate with any device that enables the electronic device 600 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 650. Furthermore, the electronic device 600 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 660. As shown, the network adapter 660 communicates with other modules of the electronic device 600 via a bus 630. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0132] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0133] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of the present specification.

[0134] The program product for implementing the above method according to an embodiment of the present invention can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0135] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0136] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0137] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0138] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0139] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0140] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are to be considered exemplary only, and the true scope and concept of the present disclosure are indicated by the claims.

Claims

1. A system fault location method, characterized in that: include: Acquire preset original information of the target network system, wherein the preset original information includes at least topology data, network element data, alarm data, equipment performance data, and log data of the target network system; Converting and arranging the alarm data according to the first mapping data table to form an alarm information set, and determining the root cause alarm device to be selected corresponding to the alarm information in the alarm information set according to the second mapping data table; Determine the alarm root cause, the root cause alarm device and the solution according to the alarm data set, the root cause alarm device to be selected and the preset original information; A control signal for the root cause alarm device is formed according to the solution, and the control signal is sent to the root cause alarm device, or the solution is output.

2. The system fault location method according to claim 1, characterized in that: Converting and arranging the alarm data according to the first mapping data table to form an alarm information set includes: Determine the alarm category and alarm device corresponding to each piece of the alarm data according to the first mapping data table, wherein the first mapping data table includes a mapping relationship between device model, alarm code, and alarm category; Determine, according to the alarm categories and the alarm devices corresponding to the plurality of alarm data, a list of alarm devices corresponding to each alarm category and / or a list of alarm categories corresponding to each alarm device; The alarm information set is formed according to the alarm device list corresponding to each of the alarm categories and / or the alarm category list corresponding to each of the alarm devices.

3. The system fault location method according to claim 1, characterized in that: The step of determining the alarm root cause, the root cause alarm device, and the solution according to the alarm data set, the root cause alarm device to be selected, and the preset original information includes: The alarm data set, the root cause alarm device to be selected, and the preset original information are input into a preset analysis model, and the preset analysis model outputs the alarm root cause, the root cause alarm device, and the solution corresponding to the alarm root cause and / or the solution corresponding to the root cause alarm device.

4. The system fault location method according to claim 3, characterized in that: The training data of the preset analysis model includes preset original information corresponding to multiple sampling time points, the alarm root cause corresponding to the preset original information, the root cause alarm device, the solution and feedback information of the solution. The feedback information includes manual debugging feedback information and / or feedback parameters automatically obtained from the root cause alarm device or the target network system.

5. The system fault location method according to claim 1, characterized in that: The step of determining the alarm root cause, the root cause alarm device, and the solution according to the alarm data set, the root cause alarm device to be selected, and the preset original information includes: receiving manually input information, where the manually input information is used to set a candidate fault influencing factor, where the candidate fault influencing factor includes a special event, a special time, and a special device; The root cause of the alarm, the root cause alarm device and the solution are determined according to the candidate fault influencing factors, the alarm data set, the candidate root cause alarm device and the preset original information.

6. A system fault location system, characterized in that: It includes network data collection module, alarm data processing module, association mining module and preset analysis model, among which: The network data collection module is used to obtain preset original information of the target network system, and send the preset original information to the alarm data processing module and the preset analysis model, wherein the preset original information at least includes topology data, network element data, alarm data, equipment performance data, and log data of the target network system; The alarm data processing module is used to extract the alarm data from the preset original information and send the alarm data to the association mining module; The association mining module is used to convert and organize the alarm data according to the first mapping data table to form an alarm information set, determine the candidate root cause alarm device corresponding to the alarm information in the alarm information set according to the second mapping data table, and send the organized alarm information set and the candidate root cause alarm device to the preset analysis model; The preset analysis model is used to determine the root cause of the alarm, the root cause alarm device and the solution based on the alarm data set, the root cause alarm device to be selected and the preset original information, form a control signal for the root cause alarm device based on the solution, send the control signal to the root cause alarm device, or output the solution.

7. The system fault location system according to claim 6, characterized in that: It also includes an information storage module, which is used to store the first mapping data table, the second mapping data table and manually input information, and input the manually input information into the preset analysis model. The manually input information is used to set the selected fault influencing factors, and the selected fault influencing factors include special events, special time, and special equipment.

8. The system fault location method according to claim 1, characterized in that: It also includes a training data processing module, which is used to receive historical data and form training data for the target analysis model based on the historical data. The historical data at least includes preset original information corresponding to multiple sampling time points, alarm root causes corresponding to the preset original information, root cause alarm devices, solutions and feedback information of the solutions. The feedback information includes manual debugging feedback information and / or feedback parameters automatically obtained from the root cause alarm device or the target network system.

9. An electronic device, characterized in that: include: Memory; as well as A processor coupled to the memory, the processor being configured to execute the method according to any one of claims 1 to 5 based on instructions stored in the memory.

10. A computer-readable storage medium having a program stored thereon, wherein when the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images