Abnormal root cause method and device of business index, electronic equipment and storage medium

Abstract

The invention provides an abnormal root cause method and device for business indexes, electronic equipment and a storage medium, which are used for improving the accuracy and comprehensiveness of fault root causes. The method comprises the following steps: determining an associated abnormal resource corresponding to an abnormal business index contained in business data, and obtaining an associated business index corresponding to the associated abnormal resource; obtaining a resource abnormality level of the associated abnormal resource, and calculating a predicted abnormality level of the associated business index according to the resource abnormality level of the associated abnormal resource; and under the condition that the actual abnormal level of the associated business index is matched with the predicted abnormal level, determining the associated abnormal resource as an abnormal root cause resource, and determining an abnormal root cause of the abnormal business index according to the abnormal root cause resource.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing, and in particular to a method, device, electronic device and storage medium for detecting abnormal root causes of business indicators. Background Art

[0002] The causes of failures in current networks are relatively complex. For example, multiple network elements in the network may fail, and each network element may involve a large number of business indicators. Therefore, how to locate the cause of the failure based on abnormal business indicators has become a technical problem that needs to be solved urgently.

[0003] In the related art, the business data in the business system can be collected in real time and analyzed to determine the abnormal business indicators contained in the business data, and the operation records associated with the abnormal business indicators can be analyzed in combination with the log records of the business system.

[0004] However, in the above method, analysis can only be performed based on data in a single system, namely the business system, and the basis for analysis is mainly the log records in the business system. This method can only locate fault problems caused by abnormal business operations, and cannot accurately locate fault problems caused by other reasons. Therefore, it has low accuracy and narrow applicability. Summary of the invention

[0005] The present invention provides a method, device, electronic device and storage medium for detecting abnormal root causes of business indicators, so as to improve the accuracy and comprehensiveness of fault root causes.

[0006] In a first aspect, an embodiment of the present disclosure provides a method for detecting abnormal root causes of business indicators, including:

[0007] Determine an associated abnormal resource corresponding to the abnormal business indicator included in the business data, and obtain an associated business indicator corresponding to the associated abnormal resource;

[0008] Acquire the resource anomaly level of the associated abnormal resource, and calculate the predicted anomaly level of the associated business indicator according to the resource anomaly level of the associated abnormal resource;

[0009] In a case where the actual abnormality level of the associated business indicator matches the predicted abnormality level, the associated abnormal resource is determined to be an abnormal root cause resource, and the abnormal root cause of the abnormal business indicator is determined according to the abnormal root cause resource.

[0010] In a second aspect, an embodiment of the present disclosure provides an abnormal root cause device for a business indicator, including:

[0011] An indicator acquisition module, adapted to determine an associated abnormal resource corresponding to an abnormal business indicator included in the business data, and acquire an associated business indicator corresponding to the associated abnormal resource;

[0012] a level calculation module, adapted to obtain the resource abnormality level of the associated abnormal resource, and calculate the predicted abnormality level of the associated business indicator according to the resource abnormality level of the associated abnormal resource;

[0013] The root cause module is adapted to determine that the associated abnormal resource is an abnormal root cause resource when the actual abnormal level of the associated business indicator matches the predicted abnormal level, and determine the abnormal root cause of the abnormal business indicator according to the abnormal root cause resource.

[0014] In a third aspect, an embodiment of the present disclosure provides an electronic device, which includes a memory and a processor; the memory stores a computer program that can be executed by the processor, and when the computer program is executed by the processor, the abnormal root cause method of the business indicator provided in any of the above aspects is implemented.

[0015] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the abnormal root cause method of the business indicator provided in any of the above aspects.

[0016] According to a method for determining the abnormal root cause of a business indicator provided by an embodiment of the present disclosure, it is possible to determine the associated abnormal resources corresponding to the abnormal business indicators contained in the business data, and obtain the associated business indicators corresponding to the associated abnormal resources; the predicted abnormal level of the associated business indicator is calculated by the resource abnormal level of the associated abnormal resource, and accordingly, it is determined whether the actual abnormal level of the associated business indicator matches the predicted abnormal level. If the match is successful, the associated abnormal resource is determined to be the abnormal root cause resource, thereby determining the abnormal root cause of the abnormal business indicator according to the abnormal root cause resource. It can be seen that this method associates business data with resource data for analysis, thereby broadening the scope of abnormal root causes through cross-database analysis, not limited to fault problems caused by abnormal business operations, but also able to accurately locate fault problems caused by resource abnormalities and other reasons. In addition, in the case of determining that the associated abnormal resources may have faults, further verification is performed with the help of the abnormal situation of the associated business indicator, so as to improve the accuracy of the abnormal root cause according to the verification result, and avoid the root cause error problem caused by accidental association. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In the accompanying drawings of the embodiments of the present disclosure:

[0018] Figure 1 A flowchart of a method for determining the abnormal root cause of a business indicator provided by an embodiment of the present disclosure;

[0019] Figure 2 A schematic diagram of the architecture of a root cause analysis system in an example is shown;

[0020] Figure 3 A flowchart for implementing an abnormal root cause method in an example is shown;

[0021] Figure 4 A schematic diagram of the structure of the root cause analysis system in the above example is shown;

[0022] Figure 5 A block diagram of a device for detecting abnormal root causes of business indicators provided by an embodiment of the present disclosure;

[0023] Figure 6 A block diagram of a composition of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the technical solution of the present disclosure, a method, device, electronic device and storage medium for abnormal root cause of a business indicator provided by an embodiment of the present disclosure are described in detail below in conjunction with the accompanying drawings.

[0025] The present disclosure will be described more fully below with reference to the accompanying drawings, but the embodiments shown may be embodied in different forms, and the present disclosure should not be construed as being limited to the embodiments set forth below. On the contrary, the purpose of providing these embodiments is to make the present disclosure thorough and complete, and will enable those skilled in the art to fully understand the scope of the present disclosure.

[0026] The accompanying drawings of the embodiments of the present disclosure are used to provide a further understanding of the embodiments of the present disclosure, and constitute a part of the specification, and are used together with the detailed embodiments to explain the present disclosure, and do not constitute a limitation of the present disclosure. By describing the detailed embodiments with reference to the accompanying drawings, the above and other features and advantages will become more apparent to those skilled in the art.

[0027] The present disclosure may be described with reference to plan views and / or cross-sectional views by means of ideal schematic views of the present disclosure. Therefore, the exemplary illustrations may be modified according to manufacturing techniques and / or tolerances.

[0028] In the absence of conflict, the various embodiments of the present disclosure and the various features therein may be combined with each other.

[0029] The terms used in the present disclosure are only used to describe specific embodiments and are not intended to limit the present disclosure. The term "and / or" as used in the present disclosure includes any and all combinations of one or more related enumerated items. The singular forms "one" and "the" as used in the present disclosure are also intended to include plural forms, unless the context clearly indicates otherwise. The terms "including", "made of..." as used in the present disclosure specify the presence of the features, wholes, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof.

[0030] Unless otherwise defined, all terms (including technical and scientific terms) used in this disclosure have the same meaning as commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and this disclosure, and will not be interpreted as having an idealized or overly formal meaning unless explicitly defined in this disclosure.

[0031] The present disclosure is not limited to the embodiments shown in the drawings, but includes modifications of the configurations formed based on the manufacturing process. Therefore, the regions illustrated in the drawings have schematic properties, and the shapes of the regions shown in the drawings illustrate the specific shapes of the regions of the elements, but are not intended to be limiting.

[0032] First, Figure 1 A flowchart of a method for determining the root cause of abnormality of a business indicator provided by an embodiment of the present disclosure. Figure 1 The present disclosure provides a method for determining the abnormal root cause of a business indicator, including the following steps:

[0033] Step S110: determining the associated abnormal resources corresponding to the abnormal business indicators included in the business data, and acquiring the associated business indicators corresponding to the associated abnormal resources.

[0034] Among them, business data can be obtained based on system operation data in the business system. For example, business data may include business performance data, business log data, etc. Among them, business performance data is used to characterize indicator data associated with various business indicators, and business log data is used to store operation records associated with business operations. Among them, abnormal business indicators may include: business indicators whose difference between the actual value of the indicator and the standard value of the indicator is greater than a preset abnormal threshold; or, abnormal business indicators may also include: business indicators with abnormal operation results. In short, the present disclosure does not limit the specific connotation and abnormal type of abnormal business indicators.

[0035] When the abnormal business indicators are determined, the associated abnormal resources corresponding to the abnormal business indicators contained in the business data are further determined. The associated abnormal resources can be determined by performing correlation analysis on the business data and resource data. The resource data records information such as various resources and their operating status. Resources may include: various hardware devices related to various functions such as computing, storage, and network operation. For example, resources may be in the form of magnetic arrays, hard disks, servers, etc. By performing correlation analysis on the business data and resource data, the associated abnormal resources corresponding to the abnormal business indicators can be determined. The associated abnormal resources refer to: resources that may have a correlation relationship with the abnormal business indicators and have abnormalities.

[0036] When the associated abnormal resource is determined, the associated business indicator corresponding to the associated abnormal resource is further obtained. The associated business indicator refers to a business indicator that has an associated relationship with the associated abnormal resource, for example, a business indicator that needs to be implemented with the help of the associated abnormal resource. In an optional implementation, the associated network element service corresponding to the associated abnormal resource (for example, a network element service using the associated abnormal resource) can be determined first, and the business indicator corresponding to the associated network element service is used as the associated business indicator. The associated business indicator is other indicators different from the abnormal business indicator, and the number of the associated business indicators can be one or more.

[0037] Step S120: Obtain the resource abnormality level of the associated abnormal resource, and calculate the predicted abnormality level of the associated business indicator according to the resource abnormality level of the associated abnormal resource.

[0038] The resource anomaly level of the associated abnormal resource is used to characterize the degree of anomaly of the associated abnormal resource, and can be characterized in various forms such as an abnormal value, percentage, etc. Since the associated business indicator is an indicator that has an associated relationship with the associated abnormal resource, the predicted anomaly level of the associated business indicator can be calculated according to the resource anomaly level of the associated abnormal resource and the association between the associated business indicator and the associated abnormal resource.

[0039] It can be seen that the predicted abnormality level of the associated business indicator is the abnormality degree of the associated business indicator predicted based on the resource abnormality level of the associated abnormal resource and the correlation between the associated business indicator and the associated abnormal resource. For example, if the resource abnormality level of the associated abnormal resource is higher, and / or the correlation between the associated business indicator and the associated abnormal resource is greater, the predicted abnormality level of the associated business indicator is higher. For example, if the associated abnormal resource has a serious abnormality, when the correlation between the associated business indicator and the associated abnormal resource is large, the associated business indicator should also have a serious abnormality.

[0040] Step S130: when the actual abnormality level of the associated business indicator matches the predicted abnormality level, determining the associated abnormal resource as an abnormal root cause resource, and determining the abnormal root cause of the abnormal business indicator according to the abnormal root cause resource.

[0041] Among them, the actual abnormality level of the associated business indicator is determined according to the actual abnormal situation of the associated business indicator, for example, it can be determined according to the difference between the actual value of the indicator and the standard value of the indicator. The actual abnormality level is used to characterize the actual abnormality degree of the associated business indicator, and the predicted abnormality level is used to characterize the predicted abnormality degree. Through the judgment operation of whether the actual abnormality level matches the predicted abnormality level, it can be verified whether the abnormal situation of the abnormal business indicator is caused by the abnormality of the associated abnormal resource. Under normal circumstances, if the abnormal situation of the abnormal business indicator is caused by the abnormal situation of the associated abnormal resource, it will inevitably cause the associated business indicator that has a dependency relationship with the associated abnormal resource to also be abnormal at the same time. Therefore, verification with the help of associated business indicators can avoid misjudgment and improve the accuracy of root cause analysis.

[0042] Among them, when determining the abnormal root cause of the abnormal business indicator based on the abnormal root cause resource, the root cause that caused the abnormal root cause resource to be abnormal can be determined based on the log information of the abnormal root cause resource, so that the root cause of the abnormal root cause resource will be used as the abnormal root cause of the abnormal business indicator. Therefore, this method can directly find the root cause of the resource abnormality problem corresponding to the abnormal business indicator: for example, the abnormal business indicator is caused by the decline of storage I / O, and it can be known from the resource log that the decline of magnetic array storage I / O is caused by the abnormality of the magnetic array battery. Accordingly, the present application can directly locate the root cause to the final magnetic array battery, rather than the intermediate storage I / O (From iCenter), so that the root cause is more accurate.

[0043] It can be seen that this method associates business data with resource data for analysis, thereby broadening the scope of abnormal root causes through cross-database analysis, not limited to faults caused by abnormal business operations, but also able to accurately locate faults caused by resource abnormalities and other reasons. In addition, when the associated abnormal resources that may have faults are determined, further verification is performed with the help of abnormal conditions of associated business indicators, so as to improve the accuracy of the abnormal root cause based on the verification results and avoid root cause errors caused by accidental associations.

[0044] The present application does not limit the specific implementation details of the above embodiments, and those skilled in the art may also make various changes and modifications to the above embodiments:

[0045] In an optional implementation, when calculating the predicted abnormal level of the associated business indicator according to the resource abnormal level of the associated abnormal resource, it is implemented in the following manner: determining the correlation coefficient between the associated business indicator and the associated abnormal resource; calculating the predicted abnormal level of the associated business indicator according to the resource abnormal level and the correlation coefficient. Among them, the correlation coefficient between the associated business indicator and the associated abnormal resource is used to characterize the correlation between the associated business indicator and the associated abnormal resource. For example, the correlation coefficient between the associated business indicator and the associated abnormal resource is used to characterize the degree of dependence of the associated business indicator on the associated abnormal resource, and / or the degree of influence of the associated abnormal resource on the associated business indicator. If the degree of dependence of the associated business indicator on the associated abnormal resource is higher, and / or the degree of influence of the associated abnormal resource on the associated business indicator is greater, it means that the correlation between the associated business indicator and the associated abnormal resource is greater, that is, the correlation coefficient between the associated business indicator and the associated abnormal resource is greater. It can be seen that the predicted abnormal level of the associated business indicator can be calculated by the resource abnormal level and the correlation coefficient. For example, when the resource abnormal level is the same, the larger the correlation coefficient, the higher the predicted abnormal level of the associated business indicator.

[0046] In an optional implementation, determining the correlation coefficient between the associated business indicator and the associated abnormal resource includes: determining the associated network element service corresponding to the associated business indicator, determining the resource dependence index of the associated network element service for the associated abnormal resource; and determining the correlation coefficient between the associated business indicator and the associated abnormal resource according to the resource dependence index. Among them, the associated network element service corresponding to the associated business indicator may be the network element service that generates the associated business indicator. The resource dependence index is determined according to the number of resources of the same type corresponding to the associated abnormal resource used by the associated network element service. If the number of resources of the same type is greater, the resource dependence index of the associated network element service for the associated abnormal resource is smaller. Among them, the same type of resources corresponding to the associated abnormal resource refers to: resources of the same resource type as the associated abnormal resource. For example, if the associated abnormal resource is a magnetic array, the number of resources of the same type corresponding to the associated abnormal resource is the number of magnetic arrays. For example, if the number of magnetic arrays used by the associated network element service is greater, the resource dependence index for a specific associated abnormal resource is lower (i.e., the impact caused by a problem in one of the multiple magnetic arrays is smaller); if the number of magnetic arrays used by the associated network element service is smaller, the resource dependence index for a specific associated abnormal resource is greater (i.e., the impact caused by a problem in one of the multiple magnetic arrays is greater). It can be seen that the correlation coefficient between the associated business indicator and the associated abnormal resource can be determined by the associated network element service corresponding to the associated business indicator and the resource dependence index of the associated network element service for the associated abnormal resource. Generally, the correlation coefficient is proportional to the resource dependence index. The larger the resource dependence index, the greater the correlation coefficient; the smaller the resource dependence index, the smaller the correlation coefficient.

[0047] In an optional implementation, determining the correlation coefficient between the associated business indicator and the associated abnormal resource includes: determining the influence of the associated abnormal resource on the associated business indicator according to the resource type of the associated abnormal resource and the indicator type of the associated business indicator; and determining the correlation coefficient between the associated business indicator and the associated abnormal resource according to the influence. Among them, the influence can be determined according to the correlation between the resource abnormality level in the historical resource data and the indicator abnormality level in the historical business data. By analyzing the historical data, it can be known that there is a specific correlation between the resource type and the indicator type. For example, the influence of resource type A on indicator A' is greater, but the influence on indicator B' is smaller; the influence of resource type B on indicator A' is smaller, but the influence on indicator B' is larger. In short, through various methods such as machine learning, the influence between resource type and indicator type can be determined, and then the correlation coefficient between the associated business indicator and the associated abnormal resource can be determined according to the influence. For example, if the influence of the associated abnormal resource on the associated business indicator is greater, the correlation coefficient between the associated business indicator and the associated abnormal resource is greater; if the influence of the associated abnormal resource on the associated business indicator is smaller, the correlation coefficient between the associated business indicator and the associated abnormal resource is smaller.

[0048] In another optional implementation, the associated abnormal resources corresponding to the abnormal business indicators included in the business data are determined in the following manner: resource data corresponding to the resource system is obtained; the business data and the resource data are associated and calculated by a preset association algorithm, and the associated abnormal resources corresponding to the abnormal business indicators are determined according to the association calculation results. This method can respectively obtain the resource data corresponding to the resource system and the business data corresponding to the business system, and then perform an association calculation on the business data and the resource data through an association algorithm, so as to determine the associated abnormal resources corresponding to the abnormal business indicators included in the business data according to the association relationship between the business data and the resource data.

[0049] In yet another optional implementation, the associated business indicator corresponding to the associated abnormal resource is obtained in the following manner:

[0050] Determine the associated network element service corresponding to the associated abnormal resource according to the preset resource configuration information. The resource configuration information is used to describe the configuration related to the resource data. Accordingly, the associated network element service corresponding to the associated abnormal resource can be determined according to the resource configuration information. The associated network element service corresponding to the associated abnormal resource refers to: a network element service that uses the associated abnormal resource.

[0051] Determine the service indicator corresponding to the associated network element service according to the preset service configuration information. The service configuration information is used to describe the configuration related to the service data. Accordingly, the service indicator corresponding to the associated network element service can be determined according to the service configuration information. The service indicator corresponding to the associated network element service refers to: the service indicator generated by the associated network element service, or the service indicator related to the running state of the associated network element service.

[0052] The associated service indicator is determined according to the service indicator corresponding to the associated network element service. For example, the service indicator corresponding to the associated network element service may be directly determined as the associated service indicator.

[0053] It can be seen that the associated business indicator is determined by means of the associated network element service corresponding to the associated abnormal resource. Therefore, the associated business indicator must be a business indicator that has an associated relationship with the associated abnormal resource. That is, the associated business indicator is generated by means of the associated abnormal resource, and specifically, it can be generated by the associated network element service by means of the associated abnormal resource.

[0054] In another optional implementation, the actual abnormality level of the associated business indicator is determined by: obtaining the actual value of the indicator of the associated business indicator and the standard value of the indicator of the associated business indicator; determining the actual abnormality level of the associated business indicator according to the comparison result between the actual value of the indicator and the standard value of the indicator. Among them, the standard value of the indicator of the associated business indicator is the value corresponding to the state of the associated business indicator in normal business operation, which can be specifically determined by monitoring the historical business status. The actual value of the indicator is the current actual value of the associated business indicator, and accordingly, the comparison result between the actual value of the indicator and the standard value of the indicator is used to characterize the degree to which the indicator value of the associated business indicator deviates from the normal level. The greater the difference between the actual value of the indicator and the standard value of the indicator, the higher the actual abnormality level of the associated business indicator.

[0055] In another optional implementation, when determining the abnormal root cause of the abnormal business indicator according to the abnormal root cause resource, it is implemented in the following manner: obtaining the associated log information corresponding to the abnormal root cause resource, and determining the abnormal root cause of the abnormal business indicator according to the associated log information. Among them, the associated log information stores various operations related to the resource, so the abnormal root cause of the abnormal business indicator can be determined according to the associated log information, and the abnormal root cause can specifically be various operations related to the resource.

[0056] In yet another optional implementation, the resource anomaly level of the associated abnormal resource may be obtained in the following manner:

[0057] First, the indicator abnormality level of the abnormal business indicator is obtained, and the correlation coefficient between the abnormal business indicator and the associated abnormal resource is determined. Among them, the indicator abnormality level of the abnormal business indicator can be determined according to the comparison result between the actual value of the indicator and the standard value of the indicator of the abnormal business indicator: if the difference between the actual value of the indicator of the abnormal business indicator and the standard value of the indicator is greater, the indicator abnormality level of the abnormal business indicator is greater. The method for determining the correlation coefficient between the abnormal business indicator and the associated abnormal resource can refer to the method for determining the correlation coefficient between the associated business indicator and the associated abnormal resource, which will not be repeated here.

[0058] Then, according to the index abnormality level and the correlation coefficient between the abnormal business index and the associated abnormal resource, the resource abnormality level of the associated abnormal resource is determined. For example, the product or ratio between the index abnormality level and the correlation coefficient between the abnormal business index and the associated abnormal resource can characterize the resource abnormality level of the associated abnormal resource. In short, since there is a correlation between the index and the resource, the index is affected by the resource, and therefore, the resource abnormality level of the associated abnormal resource can be indirectly determined by calculating the index abnormality level of the abnormal business index. Of course, those skilled in the art can also use other methods to implement, for example, the resource abnormality level of the associated abnormal resource can also be directly obtained based on the resource acquisition data, and this application does not limit this.

[0059] For ease of understanding, the following example is used to introduce an implementation example of the abnormal root cause method of the business indicator in this application:

[0060] In related technologies, fault location of business systems can be achieved based on association analysis models: real-time collection of monitoring indicator data of business systems; data preprocessing and storage of collected monitoring indicator data; abnormality detection of processed monitoring indicator data, and passing abnormal indicator information into the association analysis model to find suspected root cause events of faults; abnormal indicator information and suspected root cause events of faults located by the association analysis model are used as alarm information and pushed to corresponding operation and maintenance personnel to assist operation and maintenance personnel in quickly repairing system abnormalities. This method can provide more valuable information for locating root cause events of system faults. Compared with traditional fault location methods, the association analysis model is faster and more accurate. However, this method is difficult to detect resource anomalies and cannot find the root cause of resource anomalies.

[0061] In reality, traditional physical network functions (PNFs) are becoming less and less, and most have been updated to virtual network functions (VNFs). In many cases, service problems are caused by resource environment, but the service management system (OMC) and resource management system (NFVO) belong to different systems, which further increases the difficulty of root cause analysis. Figure 2 FIG. 4 shows a schematic diagram of the architecture of the root cause analysis system in this example. Figure 2 As shown, the root cause analysis system is connected to one or more service management systems or resource management systems, and each service management system or resource management system may also be connected to one or more traditional physical network elements or virtualized network elements. Therefore, in a complex network architecture, the analysis of abnormal root causes becomes increasingly difficult.

[0062] In order to solve the above problems, this example can collect two types of data: business data and resource data, and discover abnormal root cause events of the resource class by performing correlation analysis on the two types of data. Figure 3 The implementation flow chart of this example is shown as Figure 3 As shown, the abnormal root cause method of the business indicator in this example includes the following steps:

[0063] Step S301: Acquire resource data corresponding to the resource system and business data corresponding to the business system.

[0064] Among them, it is necessary to collect data from the business system (also called the business management system) and the resource system (also called the resource management system). For example, multiple types of data from different types of systems can be collected in real time:

[0065] On the one hand, performance indicator data, configuration data, and log data (such as operation logs, debug logs, etc.) of various types of network elements are collected from the business management system (Operation and Maintenance Center, OMC).

[0066] On the other hand, performance indicator data, configuration data, and log data (such as operation logs, debug logs, etc.) of various resources are collected from the resource management system (Network Functions Virtualisation Orchestrator, NFVO).

[0067] Among them, after the data is collected, data preprocessing can also be performed on the collected data to find problems: for example, the Debug log data itself has no format information and is not suitable for data mining. Therefore, it is necessary to first convert the Debug log data into a form suitable for data mining according to the Debug log template. For example, users of the system preset universal log template can add and modify custom log templates at any time through the GUI interface. Optionally, the converted log contains at least: operation time, operation object, and operation type, so as to perform associated mining. For another example, business data and resource data can be associated through configuration data, so as to set the scope of business impact according to the resource type. For another example, anomaly checks can be performed to locate problematic performance indicators (i.e., the abnormal business indicators mentioned below).

[0068] Step S302: performing correlation analysis on the performance indicator data and log data contained in the business data.

[0069] Among them, we can combine the single-system business class rules in the current expert knowledge base and use association algorithms (such as Pearson correlation coefficient, Bayesian formula, etc.) to analyze the association between abnormal performance indicators and operation log events and debug logs of business data. Each association rule contains at least one of the operation log event and debug log record; it also contains a performance indicator.

[0070] Step S303: performing correlation analysis on the performance indicator data and log data contained in the resource data.

[0071] Among them, we can combine the single system resource class rules in the current expert knowledge base and use association algorithms (such as Pearson correlation coefficient, Bayesian formula, etc.) to perform association analysis on abnormal performance indicators, operation log events, and debug logs for resource data. Each association rule contains at least one of the operation log event and debug log record; it also contains a performance indicator.

[0072] Step S304: performing association calculation on the business data and resource data through a preset association algorithm, and determining the associated abnormal resources corresponding to the abnormal business indicators according to the association calculation results.

[0073] The preset association algorithm may be the Pearson correlation coefficient, Bayesian formula, or other algorithms mentioned above, or other types of association algorithms, as long as the association relationship between the two data can be determined.

[0074] For example, we can combine the multi-system rules in the current expert knowledge base and use association algorithms (such as Pearson correlation coefficient, Bayesian formula, etc.) to perform association analysis on business data and resource data. Each association rule contains at least one of resource operation log events and debug log records; it also contains a business performance indicator. If the associated abnormal resource cannot be found, it is considered that the abnormality is not related to the resource, and the root cause analysis ends. If the associated abnormal resource is found, the associated abnormal resource is used as the associated abnormal resource corresponding to the abnormal business indicator.

[0075] Step S305: acquiring the associated business indicator corresponding to the associated abnormal resource, acquiring the resource abnormality level of the associated abnormal resource, and calculating the predicted abnormality level of the associated business indicator according to the resource abnormality level of the associated abnormal resource.

[0076] The predicted abnormality level of the associated service indicator can be calculated according to the resource abnormality level and the correlation coefficient between the associated service indicator and the associated abnormal resource. The correlation coefficient can be determined according to the resource dependency index of the associated network element service for the associated abnormal resource and / or the influence of the associated abnormal resource on the associated service indicator.

[0077] Step S306: when the actual abnormality level of the associated business indicator matches the predicted abnormality level, the associated abnormal resource is determined to be an abnormal root cause resource, and the abnormal root cause of the abnormal business indicator is determined according to the abnormal root cause resource.

[0078] It can be seen that in this example, if the associated abnormal resource corresponding to the abnormal business indicator can be found, then the analogy rules in the current expert knowledge base are combined to make analogies with other network elements with the same resource: first, determine other network elements (i.e., associated network elements or associated network element services) that also use this associated abnormal resource, and check whether other network elements also have the same problem. At the same time, calculate the matching degree based on the proportion of other network elements using this resource, and determine whether this associated abnormal resource is the root cause of the abnormality based on the calculation result. If other network elements with the same resource do not have the same problem, reduce the correlation coefficient between the network element and the resource, and continue to analyze until the resource with the largest correlation coefficient is found as the root cause.

[0079] In the above example, first, the target network element service corresponding to the abnormal business indicator is determined according to the configuration information of the business management system, and all resources associated with the target network element service are determined according to the configuration information of the resource management system, from which the associated abnormal resources that may be abnormal are determined. Then, other network element services (i.e., associated network element services) that use the associated abnormal resources are reversely searched according to the configuration information of the resource management system, and indicators related to the associated network element services (i.e., associated business indicators) are reversely searched according to the configuration information of the business management system. Finally, the predicted abnormal level of the associated business indicator is determined according to the resource dependency index of the associated network element service for the associated abnormal resource and the influence of the associated abnormal resource on the associated business indicator.

[0080] For example, the predicted abnormal level of the associated business indicator can be represented by the indicator decline ratio. The higher the indicator decline ratio, the higher the predicted abnormal level. Accordingly, the indicator decline ratio of the associated business indicators of each associated network element service can be calculated based on the resource usage ratio (i.e., resource dependence index) and the impact of the business on the resource. If the actual decline ratio of the associated business indicator is consistent with the calculated indicator decline ratio, the associated abnormal resource is considered to be the root cause; if not, the correlation coefficient between the associated abnormal resource and the abnormal business indicator is reduced, and the analysis continues.

[0081] For example, by comparing the difference between the actual value of the indicator and the standard value, it is determined that the indicator value of indicator x (i.e., abnormal business indicator) of network element service A has dropped by 25%, that is, the actual value of indicator x is 25% lower than the standard value. In other words, the indicator abnormality level of the abnormal business indicator is 25%. Through correlation analysis, it is found that a magnetic array in the resource system has an abnormality in the same time period, so the magnetic array with the abnormality is determined as the associated abnormal resource of indicator x.

[0082] Next, obtain the resource anomaly level of the associated abnormal resource. Among them, the resource anomaly level of the associated abnormal resource can be determined by the percentage of decrease in the resource performance indicator of the associated abnormal resource. For example, suppose that it is found through monitoring that the performance indicator I / O of the abnormal magnetic array has decreased by 50%. In addition, in addition to determining the resource anomaly level through actual monitoring methods, the resource anomaly level of the associated abnormal resource can also be inferred through the correlation coefficient between the abnormal business indicator and the associated abnormal resource. Among them, the correlation coefficient between the abnormal business indicator and the associated abnormal resource is determined according to the resource dependency index and the degree of influence. The resource dependency index is determined in the following way: Assuming that the network element service A corresponding to the abnormal business indicator uses a total of 2 magnetic array resources, that is: the number of resources of the same type corresponding to the associated abnormal resource used by the network element service A is 2, and accordingly, the resource dependency index of the network element service A for the abnormal magnetic array, the associated abnormal resource, is 50%. In addition, assuming that the influence of the associated abnormal resource on the abnormal business indicator is 100%, the correlation coefficient between the abnormal business indicator and the associated abnormal resource is equal to the product of the resource dependence index of the network element service A for the abnormal magnetic array, the associated abnormal resource, and the influence of the associated abnormal resource on the abnormal business indicator. Therefore, the correlation coefficient between the abnormal business indicator and the associated abnormal resource is equal to 50%. Correspondingly, the indicator abnormality level of the abnormal business indicator is equal to the product of the resource abnormality level and the correlation coefficient between the abnormal business indicator and the associated abnormal resource. Therefore, by calculation, it is obtained that: resource abnormality level = indicator abnormality level of abnormal business indicator / correlation coefficient, that is: 25% / 50% = 50%. It can be seen that the resource abnormality level of the associated abnormal resource can also be inferred through the correlation coefficient between the abnormal business indicator and the associated abnormal resource.

[0083] Then, according to the resource anomaly level and the correlation coefficient between the associated business indicator and the associated abnormal resource, the predicted anomaly level of the associated business indicator is calculated. Assume that in this example, the associated abnormal resource is determined to correspond to the associated network element service B according to the preset resource configuration information, and the business indicator y corresponding to the associated network element service B is determined to be the associated business indicator according to the preset business configuration information. In order to calculate the predicted anomaly level of the associated business indicator, it is necessary to first calculate the correlation coefficient between the associated business indicator y and the associated abnormal resource. The correlation coefficient also needs to be determined based on the resource dependency index and the degree of influence. The resource dependency index is determined in the following way: Assume that the associated network element service B that uses this magnetic array resource (i.e., the associated abnormal resource) uses a total of 3 magnetic array resources, that is: the number of resources of the same type corresponding to the associated abnormal resource used by the network element service B is 3, and accordingly, the resource dependency index of the network element service B for the abnormal magnetic array, the associated abnormal resource, is 33.3%. In addition, assuming that the influence of the associated abnormal resource on the associated business indicator y is also 100%, correspondingly, the correlation coefficient between the associated business indicator and the associated abnormal resource is equal to the product of the resource dependence index of the network element service B on the abnormal magnetic array, the associated abnormal resource, and the influence of the associated abnormal resource on the abnormal business indicator. Therefore, the correlation coefficient between the associated business indicator and the associated abnormal resource is equal to 33.3%. Correspondingly, the predicted abnormal level of the associated business indicator is equal to the product of the resource abnormal level and the correlation coefficient between the associated business indicator and the associated abnormal resource. Therefore, by calculation, it is obtained that: the predicted abnormal level of the associated business indicator = resource abnormal level * correlation coefficient, that is: 50% * 33.3% = 16.7%. It can be seen that the predicted abnormal level of the associated business indicator can be inferred by the resource abnormal level and the correlation coefficient between the associated business indicator and the associated abnormal resource.

[0084] Finally, verify whether the actual abnormal level of the associated business indicator y matches the predicted abnormal level. Assuming that the performance of the associated business indicator y has dropped by 16.7% through monitoring, it is considered to be a complete match, so the abnormal magnetic array is the root cause, otherwise reduce the correlation coefficient between the abnormal magnetic array and the abnormal business indicator and continue the analysis.

[0085] For ease of understanding, in the above example, the impact of associated abnormal resources on abnormal business indicators and associated business indicators is the same. In actual situations, the impact of associated abnormal resources on abnormal business indicators and associated business indicators may be different. The specific calculation method is similar and will not be repeated here.

[0086] In addition, the impact can be determined based on the correlation between the resource anomaly level in the historical resource data and the indicator anomaly level in the historical business data. For example, assuming that both the resource anomaly level and the indicator anomaly level are expressed by a decrease ratio (such as a percentage), the impact = business indicator decrease ratio / resource performance decrease ratio. For example, for business indicator 1, through monitoring of historical resource data and historical business data, it is found that when the indicator value of business indicator 1 decreases by 50%, the performance indicator of resource A also decreases by 50%, then the impact of resource A on business indicator 1 is 100%. For another example, for business indicator 2, through monitoring of historical resource data and historical business data, it is found that when the indicator value of business indicator 2 decreases by 25%, the performance indicator of resource B decreases by 50%, then the impact of resource B on business indicator 2 is 50%. In short, by monitoring historical data, the impact between each indicator and each resource can be determined.

[0087] In summary, this example provides a root cause analysis and processing method for abnormal performance indicator logs based on resource analogy, including: data collection from business and resource systems; data preprocessing and problem discovery; expert knowledge base and root cause analysis and other operations. This example can reduce the analysis time of abnormal performance indicator problems in virtualization scenarios, improve problem solving efficiency, and help quickly locate and solve problems. In particular, with the large-scale promotion of 5G networks, higher challenges have been brought to system maintenance. The system needs to be able to discover, analyze and solve problems more intelligently and quickly, reduce the cost of network operation and maintenance, and accelerate industry applications. When using other root cause analysis systems, the analysis accuracy of resource problems is not high, and the root cause of resource abnormalities cannot be found. This system can significantly improve the accuracy of root cause analysis of resource problems by collecting resource system data and performing analogies with the same resources, and can further find the root cause of resource abnormalities.

[0088] Figure 4 FIG. 4 shows a schematic diagram of the structure of the root cause analysis system in the above example. Figure 4 As shown, the root cause analysis system in this example includes: a collection component 41 , a pre-processing component 42 , a root cause analysis component 43 , a storage device 44 , and an expert knowledge base 45 .

[0089] Among them, the collection component 41 is connected to the external business management system and resource management system respectively, and is used to collect performance data (PM), configuration data (CM) and log data (LOG) in the business management system, as well as performance data, configuration data and log data (LOG) in the resource management system.

[0090] The preprocessing component 42 is used to preprocess the contents such as debug logs to convert them into a form suitable for data mining, and associate business data with resource data through configuration data so as to quickly discover abnormal performance indicators through detection.

[0091] The storage device 44 is used to store various data that have been collected and pre-processed, such as performance configuration log data, abnormal performance indicator data, related data, etc.

[0092] The root cause analysis component 43 is used to implement multi-system joint analysis and analogy, so as to find out the root cause of the problem more accurately.

[0093] The expert knowledge base 45 is used to store various information such as business rules, resource rules, multi-system association rules, resource analogy rules, etc.

[0094] It can be seen that in the above example, in the data collection stage, the specific information of the external business management system and resource management system that needs to be collected (including: IP, port, user name, password and other login information) is configured; the agent module in the collection component is injected into the external system so that data can be collected using the query interface, without the need for the external system to add a new interface, and without the need for upgrading and coordination. For the business management system, the agent module regularly collects performance data, configuration data, log data (such as operation logs, Debug logs), etc. of various types of network elements from the business management system. Among them, network element types include but are not limited to: AMF, SMF, UPF, PCF, NRF, NSSF, NEF, UDM. Among them, configuration data and log data have their own fixed formats and can be processed uniformly; for performance data, the services of various types of network elements are different and the differences are great. It is necessary to establish a model according to the network element type sub-category (the system configures the influence of each network element and each indicator on each type of resource in advance: such as the network influence of indicator A is 80%, and the network influence of indicator B is 60%), and process them separately.

[0095] Table 1 lists some of the resources and the groups they belong to:

[0096] Table 1

[0097]

[0098] Among them, business data and resource data can be associated through configuration data, and the business scope and degree of influence can be set according to the resource type, such as:

[0099] Virtual machine resources: A network element contains M types of functional virtual machines, a total of N virtual machines (N>=M). The business scope and impact degree are set according to the type of virtual machines and the number of the same type.

[0100] Host resources: Set the overall impact range based on the virtual machines on the host.

[0101] For storage and network: set the initial impact based on business characteristics (for example, if indicator x needs to be read and written frequently, it is I / O sensitive and the storage device has a high impact), and then continuously optimize and correct this impact value through big data learning.

[0102] In addition, outlier discarding, missing value filling, and sensitive data desensitization can also be performed. Anomaly check procedures can be executed to quickly find problematic performance indicators through fixed thresholds, historical floating rules, and other methods. The pre-processed data can also be stored in storage devices by category for use by subsequent root cause analysis systems. The storage devices can be Oracle, PostgreSQL, and other databases. In addition, the system provides a user interface to facilitate operation and maintenance personnel to import and export expert rules, view problems and root causes, and update the latest rules to the expert knowledge base for continuous improvement. This example can improve the accuracy of root cause analysis of network element performance problems in virtualization scenarios and find resource root causes. This example can also be applied to general communication management to help quickly locate and solve problems.

[0103] Figure 5 This is a structural diagram of a device for detecting abnormal root causes of business indicators provided by an embodiment of the present disclosure. Figure 5 The embodiment of the present disclosure provides a device for detecting abnormal root causes of business indicators, including:

[0104] The indicator acquisition module 51 is adapted to determine the associated abnormal resource corresponding to the abnormal business indicator included in the business data, and acquire the associated business indicator corresponding to the associated abnormal resource;

[0105] A level calculation module 52, adapted to obtain the resource abnormality level of the associated abnormal resource, and calculate the predicted abnormality level of the associated business indicator according to the resource abnormality level of the associated abnormal resource;

[0106] The root cause module 53 is adapted to determine, when the actual abnormality level of the associated business indicator matches the predicted abnormality level, that the associated abnormal resource is an abnormality root cause resource, and determine the abnormality root cause of the abnormal business indicator according to the abnormality root cause resource.

[0107] The specific working principle of each module can refer to the description of the corresponding part in the above embodiment, which will not be repeated here.

[0108] Reference Figure 6The embodiment of the present disclosure also provides an electronic device 50, which includes: at least one processor 501; at least one memory 502; and one or more I / O interfaces 503, connected between the processor 501 and the memory 502; wherein the memory 502 stores one or more computer programs that can be executed by at least one processor 501, and the one or more computer programs are executed by at least one processor 501, so that at least one processor 501 can execute the abnormal root cause method of the business indicator provided in any of the above aspects.

[0109] The embodiment of the present disclosure also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the abnormal root cause method of the business indicator provided in any of the above aspects is implemented.

[0110] Those skilled in the art will appreciate that all or some of the steps, systems, and functional modules / units in the apparatus disclosed above may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0111] In hardware implementations, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be performed by several physical components in cooperation.

[0112] Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit (CPU), a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-temporary medium) and a communication medium (or temporary medium). As known to those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH) or other disk storage; read-only compact disk (CD-ROM), digital versatile disk (DVD) or other optical disk storage; magnetic cassettes, magnetic tapes, disk storage or other magnetic storage; any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0113] The present disclosure has disclosed example embodiments, and although specific terms are employed, they are used and should be interpreted only in a general illustrative sense and not for limiting purposes. In some instances, it will be apparent to those skilled in the art that, unless otherwise expressly stated, features, characteristics, and / or elements described in conjunction with a particular embodiment may be used alone or in combination with features, characteristics, and / or elements described in conjunction with other embodiments. Therefore, those skilled in the art will appreciate that various changes in form and detail may be made without departing from the scope of the present disclosure as set forth in the appended claims.

Claims

1. A method for determining the root cause of abnormality of a business indicator, characterized in that: include: Determine an associated abnormal resource corresponding to the abnormal business indicator included in the business data, and obtain an associated business indicator corresponding to the associated abnormal resource; Acquire the resource anomaly level of the associated abnormal resource, and calculate the predicted anomaly level of the associated business indicator according to the resource anomaly level of the associated abnormal resource; When the actual abnormality level of the associated business indicator matches the predicted abnormality level, the associated abnormal resource is determined to be an abnormal root cause resource, and the abnormal root cause of the abnormal business indicator is determined according to the abnormal root cause resource.

2. The method according to claim 1, characterized in that: The calculating the predicted abnormality level of the associated service indicator according to the resource abnormality level of the associated abnormal resource includes: Determining a correlation coefficient between the associated business indicator and the associated abnormal resource; The predicted abnormality level of the associated business indicator is calculated according to the resource abnormality level and the correlation coefficient between the associated business indicator and the associated abnormal resource.

3. The method according to claim 2, characterized in that The determining of the correlation coefficient between the associated business indicator and the associated abnormal resource comprises: Determine an associated network element service corresponding to the associated business indicator, and determine a resource dependency index of the associated network element service for the associated abnormal resource; Determine the correlation coefficient between the associated business indicator and the associated abnormal resource according to the resource dependency index; Among them, the resource dependence index is determined according to the number of similar resources corresponding to the associated abnormal resources used by the associated network element service. If the number of similar resources is larger, the resource dependence index of the associated network element service for the associated abnormal resources is smaller.

4. The method according to claim 2 or 3, characterized in that: The determining of the correlation coefficient between the associated business indicator and the associated abnormal resource comprises: Determining the influence of the associated abnormal resource on the associated business indicator according to the resource type of the associated abnormal resource and the indicator type of the associated business indicator; Determine, according to the impact degree, a correlation coefficient between the associated business indicator and the associated abnormal resource; The impact degree is determined according to the correlation between the resource anomaly level in the historical resource data and the indicator anomaly level in the historical business data.

5. The method according to any one of claims 1 to 3, characterized in that: The determining of the associated abnormal resources corresponding to the abnormal business indicators included in the business data includes: Obtain resource data corresponding to the resource system; By using a preset association algorithm, an association calculation is performed on the business data and the resource data, and an associated abnormal resource corresponding to the abnormal business indicator is determined according to the association calculation result.

6. The method according to any one of claims 1 to 3, characterized in that: The acquiring of the associated business indicator corresponding to the associated abnormal resource comprises: Determining an associated network element service corresponding to the associated abnormal resource according to preset resource configuration information; The service indicator corresponding to the associated network element service is determined according to preset service configuration information, and the associated service indicator is determined according to the service indicator corresponding to the associated network element service.

7. The method according to any one of claims 1 to 3, characterized in that: The actual abnormal level of the associated business indicator is determined in the following manner: Obtaining the actual value of the associated business indicator and the standard value of the associated business indicator; The actual abnormality level of the associated business indicator is determined according to a comparison result between the actual value of the indicator and the standard value of the indicator.

8. The method according to any one of claims 1 to 3, characterized in that: The determining the abnormal root cause of the abnormal business indicator according to the abnormal root cause resource includes: Obtain associated log information corresponding to the abnormal root cause resource, and determine the abnormal root cause of the abnormal business indicator according to the associated log information.

9. The method according to any one of claims 1 to 3, characterized in that: The obtaining of the resource abnormality level of the associated abnormal resource comprises: Acquire the indicator abnormality level of the abnormal business indicator, and determine the correlation coefficient between the abnormal business indicator and the associated abnormal resource; The resource abnormality level of the associated abnormal resource is determined according to the indicator abnormality level and the correlation coefficient between the abnormal business indicator and the associated abnormal resource.

10. A device for detecting abnormal root causes of business indicators, characterized in that: include: An indicator acquisition module, adapted to determine an associated abnormal resource corresponding to an abnormal business indicator included in the business data, and acquire an associated business indicator corresponding to the associated abnormal resource; a level calculation module, adapted to obtain the resource anomaly level of the associated abnormal resource, and calculate the predicted abnormal level of the associated business indicator according to the resource anomaly level of the associated abnormal resource; The root cause module is adapted to determine that the associated abnormal resource is an abnormal root cause resource when the actual abnormal level of the associated business indicator matches the predicted abnormal level, and determine the abnormal root cause of the abnormal business indicator according to the abnormal root cause resource.

11. An electronic device, characterized in that: It includes a memory and a processor; the memory stores a computer program that can be executed by the processor, and when the computer program is executed by the processor, the abnormal root cause method of the business indicator described in any one of claims 1 to 9 is implemented.

12. A computer-readable medium, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor, the abnormal root cause method of the business indicator described in any one of claims 1 to 9 is implemented.

Images