A network device monitoring method, system and electronic device

Abstract

Embodiments of the present application disclose a network device monitoring method and device and electronic equipment. The method comprises obtaining log data corresponding to each network device in a preset data center, normalizing the log data to obtain normalized log data corresponding to each network device, determining a topology relationship corresponding to each network device and updating the topology relationship in a preset topology database, obtaining performance index data corresponding to each network device and storing the performance index data in a performance index database, analyzing the performance index data corresponding to each network device according to a preset model to obtain an analysis result, and displaying the normalized log data corresponding to each network device and the analysis result according to the topology relationship in the preset topology database. The technical problem that it is difficult to effectively monitor network devices in a data center due to the fact that the network devices are managed and viewed in blocks according to network management systems provided by manufacturers in the related art is solved.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a network device monitoring method, system, and electronic device. Background Technology

[0002] In recent years, most data centers have adopted a three-tier network architecture: access layer, aggregation layer, and core layer. Critical path design often employs equal-cost multi-path routing, while a small number of data center modules utilize SDN (Software-Defined Networking) technology for network deployment. A failure in a network device at any layer will directly lead to link interruption or network instability. This network device and its surrounding devices will generate a large number of log alerts. Data centers generally have comprehensive monitoring of device metrics, and the logs generated by these devices are collected and stored using the SNMP (Simple Network Management Protocol) protocol.

[0003] Due to the differences in alarm logs generated by network devices from various manufacturers and of various types, most data center network management devices now rely on the network management systems provided by each manufacturer for segmented viewing and management. This makes it difficult to monitor data center network devices quickly and accurately, and consequently, difficult to locate the faults that occur. Summary of the Invention

[0004] This invention provides a network device monitoring method, system, and electronic device to at least solve the technical problem that makes it difficult to effectively monitor network devices in data centers due to the segmented viewing and management based on network management systems provided by various manufacturers in related technologies.

[0005] According to one aspect of the present invention, a network device monitoring method is provided. The method includes: acquiring log data corresponding to each network device in a preset data center, and normalizing the log data to obtain normalized log data corresponding to each network device; determining the topology relationship corresponding to each network device, and updating the topology relationship in a preset topology database; acquiring performance indicator data corresponding to each network device, and storing the performance indicator data in a performance indicator database; analyzing the performance indicator data corresponding to each network device according to a preset model to obtain analysis results; and displaying the normalized log data corresponding to each network device and the analysis results according to the topology relationship in the preset topology database.

[0006] Furthermore, the step of obtaining log data corresponding to each network device in the preset data center and normalizing the log data to obtain normalized log data corresponding to each network device includes: normalizing the log data corresponding to each network device to obtain data in a preset format; and removing redundancy and noise from the preset format data to obtain the normalized log data.

[0007] Furthermore, the step of acquiring log data corresponding to each network device in the preset data center and normalizing the log data to obtain normalized log data corresponding to each network device further includes: modeling a log database based on the device document corresponding to the network device, wherein the log database includes hit information; matching the normalized log data in the log database according to a preset algorithm to update the hit information corresponding to the normalized log data; and performing early warning analysis on the normalized log data corresponding to each network device based on historical key security logs.

[0008] Furthermore, determining the topology relationship corresponding to each network device and updating the topology relationship in the preset topology database includes: remotely logging into each network device and obtaining first neighbor relationship data for each network device; and updating the second neighbor relationship data for each network device in the preset topology database based on the first neighbor relationship data.

[0009] Furthermore, the step of obtaining the performance indicator data corresponding to each network device and storing the performance indicator data in the performance indicator database includes: receiving the performance indicator data corresponding to each network device sent by a preset monitoring platform; filtering the performance indicator data according to preset rules to obtain standard performance indicator data; storing the standard performance indicator data in the performance indicator database; and updating the monitoring items in the preset monitoring platform according to the standard performance indicator data.

[0010] Furthermore, the step of analyzing the performance index data corresponding to each network device according to the preset model to obtain the analysis results includes: obtaining the traffic data corresponding to each network device from the performance index database; and analyzing the traffic data corresponding to each network device according to the pre-trained traffic classification anomaly detection model to obtain the analysis results.

[0011] Furthermore, the preset data center includes multiple functional partitions, each corresponding to a different function. Each function includes one or more network devices. The step of analyzing the performance index data corresponding to each network device according to a preset model to obtain analysis results includes: obtaining traffic data corresponding to each network device from the performance index database; and performing anomaly detection on the traffic data corresponding to the network device using a pre-trained logical anomaly detection model, based on the network layer where the network device is located and the inbound and outbound traffic models corresponding to the functional partition, to obtain the analysis results.

[0012] Furthermore, the step of displaying the normalized log data corresponding to each network device and the analysis results based on the topology relationships in the preset topology database includes: displaying the topology diagram corresponding to the topology relationships in the graphical user interface; and / or, displaying key abnormal logs in the graphical user interface; and / or, displaying the indicator data of the network devices in the graphical user interface; and / or, if the analysis results include abnormal events, displaying the abnormal events in the graphical user interface.

[0013] According to one aspect of the present invention, a network device monitoring system is also provided. The network device monitoring system includes a log module, a dynamic discovery module, a performance indicator module, a performance analysis module, and a front-end display module. The system includes: acquiring log data corresponding to each network device in a preset data center through the log module, and normalizing the log data to obtain normalized log data corresponding to each network device; determining the topology relationship corresponding to each network device through the dynamic discovery module, and updating the topology relationship in a preset topology database through the dynamic discovery module; acquiring performance indicator data corresponding to each network device through the performance indicator module, and storing the performance indicator data in a performance indicator database through the performance indicator module; analyzing the performance indicator data corresponding to each network device according to a preset model through the performance analysis module to obtain analysis results; and displaying the normalized log data corresponding to each network device and the analysis results through the front-end display module according to the topology relationship in the preset topology database.

[0014] According to one aspect of the present invention, an electronic device is also provided, including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the network device monitoring method as described above.

[0015] In this embodiment of the invention, log data corresponding to each network device in a preset data center is obtained and normalized to obtain normalized log data for each network device; the topology relationship corresponding to each network device is determined and the topology relationship in the preset topology database is updated; performance index data corresponding to each network device is obtained and stored in the performance index database; the performance index data corresponding to each network device is analyzed according to a preset model to obtain analysis results; and the normalized log data and analysis results corresponding to each network device are displayed according to the topology relationship in the preset topology database. In this embodiment, the log information generated by the network devices in the preset data center is processed by normalization format, which reduces the difficulty of operation and maintenance; the log data and performance index data generated by the network devices are sorted and analyzed, and combined with the topology relationship corresponding to the preset data center, the fault location of the network devices can be quickly achieved. This solves the technical problem that it is difficult to effectively monitor network devices in the data center due to the segmented viewing and management based on the network management system provided by each manufacturer in related technologies. Attached Figure Description

[0016] The accompanying drawings, which form part of this specification, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0017] Figure 1 This is a schematic diagram of an optional application scenario in an embodiment of the present invention;

[0018] Figure 2 This is a flowchart illustrating an optional network device monitoring method in an embodiment of the present invention;

[0019] Figure 3 This is a schematic diagram of the framework of an optional network device monitoring method system according to an embodiment of the present invention. Detailed Implementation

[0020] The present invention will now be described in detail with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0021] The following detailed description is exemplary and intended to provide further detailed explanation of the invention. Unless otherwise specified, all technical terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this invention is for describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention.

[0022] The network device monitoring method proposed in this embodiment of the invention is applied to, for example, Figure 1 The data center network shown includes multiple network devices 100, a network management device 110, and a management platform 120. The network devices 100 are connected to the network management device 110 via a network, and the network management device 110 is connected to the management platform 120 via a network. The network management device 110 collects log data from the multiple network devices 100. In this embodiment, the multiple network devices 100 send their own log data and performance data to the network management device 110 at preset time intervals. The network management device 110 then uploads and synchronizes the collected log data and performance data to the management platform 120. The management platform 120 monitors the log data and performance data of the multiple network devices 100 and performs fault location. In practical application scenarios, the network management device includes, but is not limited to, a monitoring platform, such as the ZABBIX platform. It should be noted that ZABBIX, as a network underlying data collection and monitoring platform, allows network devices to send network device logs and device indicator data to the ZABBIX server via SNMP configuration. ZABBIX provides functions such as monitoring remote server / network status and data collection.

[0023] This invention provides a method for monitoring network devices, which specifically includes the following steps:

[0024] S201, Obtain log data corresponding to each network device in the preset data center, and normalize the log data to obtain normalized log data corresponding to each network device;

[0025] In this embodiment, data is collected from network devices, security devices, and load balancers in a preset data center using various protocols such as SYSLOG, TCP (Transmission Control Protocol) / UDP (User Datagram Protocol), FTP (File Transfer Protocol), and SNMP (Simple Network Management Protocol). Simultaneously, this data is stored in various ways, such as through distributed stream processing platforms like Kafka and OPENTSDB (Open Time Series Database).

[0026] In specific application scenarios, log data generated by devices can be collected uniformly through network management devices in a preset data center, or log data can be reported separately by various network devices in the preset data center. This embodiment does not limit this approach.

[0027] Then, logs from different manufacturers and types of devices are normalized to a unified format to facilitate log data storage and analysis. After normalizing the log data from network devices in the preset data center, normalized log data is obtained and input into Syslog and Kafka.

[0028] S202, determine the topology relationship corresponding to each network device, and update the topology relationship in the preset topology database;

[0029] Specifically, using the LLDP (Link Layer Discovery Protocol) and SSH (Secure Shell) to remotely log in to network devices in a preset data center, the topology relationships between key devices in the access layer, aggregation layer, and core layer of the preset data center network are discovered. The topology relationships include the following four pieces of information: local device, local port, peer device, and peer port.

[0030] At the same time, remote login to network devices is used to ensure that all network devices are in normal working order and can be remotely logged in. If a network device cannot be remotely logged in, it indicates that the network device is faulty, and a corresponding alarm message will be generated.

[0031] S203, obtain the performance index data corresponding to each network device, and store the performance index data in the performance index database;

[0032] Specifically, network devices collect performance metrics data via the SNMP protocol. This data includes network device CPU, memory, network port inbound and outbound traffic, and CRC (Cyclic Redundancy Check) information. In this embodiment, the network management device stores this data in a metrics database and simultaneously sends it to Kafka.

[0033] S204, Analyze the performance index data of each network device according to the preset model to obtain the analysis results;

[0034] Specifically, it obtains data such as data center network equipment indicators and port traffic to perform traffic calculations, displays equipment hardware indicators in real time, and shows neighbor relationships, topology relationships, and abnormal traffic.

[0035] S205 displays the normalized log data and analysis results for each network device based on the topology relationships in the preset topology database.

[0036] Specifically, it displays network device performance metrics, port traffic metrics, topology relationships, and dynamic key log information. When anomalies are detected in the network device analysis results, the anomaly analysis results are mapped and fed back into the topology diagram, enabling emergency shutdown operations for abnormal device ports.

[0037] This embodiment acquires log data corresponding to each network device in a preset data center and normalizes the log data to obtain normalized log data for each network device; determines the topology relationship corresponding to each network device and updates the topology relationship in a preset topology database; acquires performance indicator data corresponding to each network device and stores the performance indicator data in a performance indicator database; analyzes the performance indicator data corresponding to each network device according to a preset model to obtain analysis results; and displays the normalized log data and analysis results corresponding to each network device based on the topology relationship in the preset topology database. In this embodiment, the log information generated by the network devices in the preset data center is processed using a normalized format, reducing the difficulty of operation and maintenance; by sorting and analyzing the log data and performance indicator data generated by the network devices, combined with the topology relationship corresponding to the preset data center, rapid fault location of network devices can be achieved. This solves the technical problem that related technologies rely on segmented viewing and management based on network management systems provided by various manufacturers, making it difficult to effectively monitor network devices in the data center.

[0038] Optionally, in this embodiment, log data corresponding to each network device in a preset data center is acquired, and the log data is normalized to obtain normalized log data corresponding to each network device. This includes, but is not limited to: normalizing the log data corresponding to each network device through a data acquisition module to obtain data in a preset format; and removing redundancy and noise from the preset format data to obtain normalized log data.

[0039] Specifically, the log data is normalized to a preset format through normalization processing, and then redundant and other noisy log data is removed to make the data source more regular, thus obtaining normalized log data.

[0040] Logs generated by pre-defined data center network devices are normalized and then matched against the database model. Further categorization is performed based on different device brands, log levels, and log content to complete feature matching and identification of key information in the log model. Specific metrics are shown in Table 1.

[0041] Table 1 Network Device Log Indicators

[0042]

[0043] In this embodiment, logs generated by the device in real time are input into Syslog and Kafka, filtered according to key information (server logs, some non-compliant logs), and the obtained log data is segmented and stored according to device name, block name, log level, time, etc., to provide a standardized data source for subsequent log analysis.

[0044] Optionally, in this embodiment, log data corresponding to each network device in a preset data center is obtained and normalized to obtain normalized log data corresponding to each network device. This also includes, but is not limited to: modeling a log database based on the device documentation corresponding to the network device, wherein the log database includes hit information; matching the normalized log data in the log database according to a preset algorithm to update the hit information corresponding to the normalized log data; and performing early warning analysis on the normalized log data corresponding to each network device based on historical key security logs.

[0045] Specifically, based on the equipment documentation provided by the network equipment manufacturer, a log data database model is established, and relationships such as log information levels are established, including information such as timestamp, hostname, vendor identifier, version number, module name, log level, and log type. At the same time, a log statistics and relational database model is established, including log ID, vendor identifier, module name, log level, log type, log format, Chinese explanation, solution, hit count, last occurrence time, and key log information identifiers.

[0046] Furthermore, key security logs are identified based on historical data, and the relationships between key security logs and other device logs are planned. Corresponding logs from different devices that appear at the same time are processed with priority and analyzed to facilitate early warning of faults.

[0047] In practical application scenarios, due to the different manufacturers, types, and models of various network devices in the preset data center network, and the different forms of log display, it is necessary to perform matching analysis algorithms and classification algorithms based on the logs to better match the database model in the log analysis module and update the database hit information in a timely manner.

[0048] In some application scenarios of this embodiment, abnormal log items in critical information monitoring are collected based on all logs generated within a certain time range. The coverage of these logs can be divided into: abnormal log items in the entire data center network, abnormal log items within a partition, abnormal logs of a single device, and abnormal log items of a single module of a single device. Combined with specific scenarios, further filtering and log classification algorithms are used to define specific models of faults caused by some abnormal logs.

[0049] In some application scenarios of this embodiment, logs generated by preset data center network devices are divided into many categories, such as device performance, management, port data, and routing data. Due to the diversity of logs generated by devices, the importance of logs also varies. If a sudden increase in traffic logs is a normal access phenomenon, it does not constitute an abnormal log. However, if it is a log from other types of devices, it indicates a decline in the performance of the network device. Therefore, the filtering rules established according to different logs are different.

[0050] In some application scenarios of this embodiment, logs generated by data center network devices are categorized by layer into core layer device logs, aggregation device logs, and access layer device logs. The criteria for judging abnormal logs differ depending on the network architecture layer. Therefore, the judgment of abnormal logs should be configured according to the layer to which the network device belongs. Logs generated by access layer devices are far less important than those generated by core layer devices. Logs generated by core layer devices have a higher processing priority than those generated by access layer devices.

[0051] In some application scenarios of this embodiment, the anomaly log detection model devices vary depending on the functions of the preset data center network devices. The location within the three-layer network architecture is determined by the relationships between some network device types, so the anomaly log judgment model is determined according to the device type (firewall, load balancer). The main function of a switch is to forward data. Under normal switch forwarding mechanism conditions, the traffic entering the switch should be approximately equal to the traffic forwarded (with some latency). Therefore, the switch's anomaly log judgment model can be determined based on the device's own forwarding mechanism or logs generated by the protocol layer (excluding specific logs generated by ports).

[0052] Through the above example, the log database is modeled according to the device documentation corresponding to the network device; the normalized log data is matched in the log database according to the preset algorithm to update the hit information corresponding to the normalized log data; and the normalized log data corresponding to each network device is analyzed for early warning based on historical key security logs, thereby realizing unified monitoring of network devices in the preset data center and enabling timely early warning of network device failures.

[0053] Optionally, in this embodiment, the dynamic discovery module determines the topology relationship corresponding to each network device and updates the topology relationship in the preset topology database, including but not limited to: remotely logging into each network device and obtaining the first neighbor relationship data of each network device; and updating the second neighbor relationship data of each network device in the preset topology database based on the first neighbor relationship data.

[0054] Specifically, in this embodiment, a link relationship and partition relationship table for all network devices in the data center is established. This table includes information such as: the partition to which the device belongs, configuration item information from the preset topology database CMDB (Configuration Management Database), local device, local port, peer device, peer port, device manufacturer information, device type, and device relationship discovery type. The acquired neighbor relationship data undergoes further data standardization, cleaning, and classification, and the standardized device association information is then transferred to the preset topology database.

[0055] Furthermore, at preset time intervals, the first neighbor relationship data of the network device topology in the actual production environment is compared with the second neighbor relationship data in the CMDB. The above information is pushed to the CMDB in real time through interface calls. The CMDB is updated with the first neighbor relationship data collected in the actual production environment to ensure the accuracy of the information.

[0056] In addition, the system updates the monitoring devices in the preset monitoring platform ZABBIX that have not been added to the monitoring list at preset time intervals. By periodically comparing the dynamic topology data with the existing monitoring devices in ZABBIX, the system updates and provides feedback to devices for which no data has been collected, ensuring the reliability and accuracy of the underlying data collection.

[0057] Optionally, in this embodiment, the performance indicator module obtains the performance indicator data corresponding to each network device and stores the performance indicator data in the performance indicator database, including but not limited to: receiving the performance indicator data corresponding to each network device sent by the network management device through the storage module; filtering the performance indicator data according to preset rules to obtain standard performance indicator data; storing the standard performance indicator data in the performance indicator database; and updating the monitoring items in the preset monitoring platform according to the standard performance indicator data.

[0058] Specifically, based on Kafka's high throughput advantage, the above performance metrics data are filtered and processed. The performance metrics data include network device CPU, device memory, network port inbound and outbound traffic, CRC information, etc.

[0059] Furthermore, the Kafka-filtered data is stored in REDIS (Remote Dictionary Server), where REDIS uses the Sort set data type. The uniqueness of the key is ensured by using ITEMID (each monitoring item in ZABBIX has a unique ITEMID, a unique identifier for the monitoring item). At the same time, the value and branch score are determined based on the timestamp to ensure the orderliness of the data so as to facilitate the writing and reading of the data, thereby ensuring the timeliness of data query and calculation.

[0060] Then, by iterating through the keys in Redis and comparing them with the ZABBIX monitoring items, the performance indicators of data center network devices can be collected. Monitoring items are added to the devices by updating reports on a regular basis, ensuring the accuracy and effectiveness of all monitoring items in ZABBIX, CMDB, Redis, and Kafka.

[0061] Optionally, in this embodiment, the performance analysis module analyzes the performance index data corresponding to each network device according to a preset model to obtain analysis results, including but not limited to: obtaining traffic data corresponding to each network device from the performance index database; and analyzing the traffic data corresponding to each network device according to a pre-trained traffic classification anomaly detection model to obtain analysis results.

[0062] In practical application scenarios, the analysis of anomalies left by network devices includes, but is not limited to: obtaining the inbound and outbound traffic ratio of devices by accumulating the inbound and outbound traffic based on the traffic data of all device ports obtained at the same time, setting the anomaly ratio range in combination with the IP health of the network device, and establishing a traffic anomaly model through redundancy denoising, etc., to reduce the abnormal traffic caused by device oscillation and reduce the generation of abnormal traffic alarms.

[0063] Specifically, in this embodiment, for traffic trend charts of different granularities, statistical algorithms are used to obtain anomalies in each individual or calculated traffic monitoring item, identify anomaly types, add preset filtering rules to the traffic anomaly model algorithm, and modify the traffic anomaly model based on the actual application scenario of the preset data center. The traffic data corresponding to each network device is then analyzed to obtain the analysis results. Through the above example, the monitoring of abnormal traffic data of network devices is realized.

[0064] Optionally, in this embodiment, the preset data center includes multiple functional partitions, each corresponding to a different function. Each function includes one or more network devices. The performance analysis module analyzes the performance index data corresponding to each network device according to a preset model to obtain analysis results, including but not limited to: obtaining traffic data corresponding to each network device from the performance index database; and performing anomaly detection on the traffic data corresponding to the network device according to the network layer where the network device is located and the inbound and outbound traffic models corresponding to the functional partitions using a pre-trained logical anomaly detection model to obtain analysis results.

[0065] In this embodiment, for traffic data from different functions and directions corresponding to various network devices, the traffic trend chart of individual monitoring items is masked downwards. By analyzing the inbound and outbound traffic models of the network layer and functional partition to which the network device belongs, as well as the relationship between north-south and east-west traffic, a more macroscopic logic-based anomaly detection model is abstracted as a supplement to traffic-level anomaly detection. Anomaly detection is performed on the traffic data corresponding to the network device to discover some problems in the forwarding mechanism or protocol layer of the network device itself.

[0066] Optionally, in this embodiment, the front-end display module displays normalized log data and analysis results corresponding to each network device according to the topology relationships in the preset topology database. This includes, but is not limited to: displaying the topology diagram corresponding to the topology relationships in the graphical user interface through the front-end display module; and / or displaying key abnormal logs in the graphical user interface; and / or displaying the indicator data of the network devices in the graphical user interface; and / or, if the analysis results include abnormal events, displaying the abnormal events in the graphical user interface.

[0067] In this embodiment, the graphical user interface may specifically include the following parts:

[0068] 1. Key Log Display Interface: Based on the logs generated by the devices, this interface displays key abnormal logs from the collected model. Displayed information includes device name, specific log details, log count, and time. Specific device pages can also display the number of log entries, level, and specific log content generated by that device. This provides a detailed front-end display of log information.

[0069] 2. Network Device Link Topology Diagram: After logging into the devices and obtaining the LLDP relationships, a link topology diagram is generated, displaying port and connection information, device connectivity information, port traffic information, etc. in real time. Through the linkage of CMDB, Zabbix, and database information, various device information is displayed to ensure timely updates. At the same time, maintenance personnel can intuitively view various device link information, facilitating emergency isolation of devices and port activation in case of faults.

[0070] 3. Network Device Information Display: Displays network device indicator data, including device CPU, memory, device inbound / outbound traffic ratio, device port traffic, CRC check, etc. Under ideal conditions, the inbound and outbound traffic of the network device is basically balanced to a ratio of 1 (excluding Span, mirrored ports, etc.), which can intuitively display the basic information of the network device and provide intuitive comparison and judgment of abnormal situations.

[0071] 4. Event Notification: This section displays the output exceptions in a list format, forming an event notification similar to that in an alarm platform, and interacts with existing monitoring platforms, such as through email notifications.

[0072] This invention provides an embodiment that obtains log data corresponding to each network device in a preset data center, normalizes the log data to obtain normalized log data for each network device, determines the topology relationship of each network device, and updates the topology relationship in a preset topology database. It also obtains performance indicator data corresponding to each network device and stores the performance indicator data in a performance indicator database. Furthermore, it analyzes the performance indicator data of each network device according to a preset model to obtain analysis results. Finally, based on the topology relationship in the preset topology database, it displays the normalized log data and analysis results for each network device. In this embodiment, the log information generated by the network devices in the preset data center is processed using a normalized format, reducing the difficulty of operation and maintenance. By sorting and analyzing the log data and performance indicator data generated by the network devices, combined with the topology relationship corresponding to the preset data center, rapid fault location of network devices can be achieved. This solves the technical problem that related technologies rely on segmented viewing and management based on network management systems provided by various manufacturers, making it difficult to effectively monitor network devices in the data center.

[0073] As is known from common technical knowledge, this invention can be implemented through other embodiments that do not depart from its spirit or essential characteristics. Therefore, the disclosed embodiments described above are merely illustrative in all respects and are not the only ones. All modifications within the scope of this invention or its equivalents are included in this invention.

[0074] In this embodiment of the invention, a network device monitoring system is also proposed, such as... Figure 3 As shown, the system includes a logging module 30, a dynamic discovery module 32, a performance indicator module 34, a performance analysis module 36, and a front-end display module 38. The system includes:

[0075] The log module 30 obtains log data corresponding to each network device in the preset data center and normalizes the log data to obtain normalized log data corresponding to each network device.

[0076] The dynamic discovery module 32 determines the topology relationship corresponding to each network device and updates the topology relationship in the preset topology database.

[0077] The performance indicator module 34 obtains the performance indicator data corresponding to each network device and stores the performance indicator data in the performance indicator database.

[0078] The performance analysis module 36 analyzes the performance index data corresponding to each network device according to a preset model to obtain the analysis results.

[0079] The front-end display module 38 displays the normalized log data and analysis results corresponding to each network device based on the topology relationships in the preset topology database.

[0080] Optionally, in this embodiment, the step of obtaining log data corresponding to each network device in the preset data center through the log module 30 and normalizing the log data to obtain normalized log data corresponding to each network device includes: normalizing the log data corresponding to each network device to obtain preset format data; and removing redundancy and noise from the preset format data to obtain the normalized log data.

[0081] Optionally, in this embodiment, the step of obtaining log data corresponding to each network device in a preset data center through the log module 30 and normalizing the log data to obtain normalized log data corresponding to each network device further includes: modeling a log database based on the device document corresponding to the network device, wherein the log database includes hit information; matching the normalized log data in the log database according to a preset algorithm to update the hit information corresponding to the normalized log data; and performing early warning analysis on the normalized log data corresponding to each network device based on historical key security logs.

[0082] Optionally, in this embodiment, determining the topology relationship corresponding to each network device through the dynamic discovery module 32 and updating the topology relationship in the preset topology database includes: remotely logging into each network device through the dynamic discovery module, and obtaining the first neighbor relationship data of each network device; and updating the second neighbor relationship data of each network device in the preset topology database based on the first neighbor relationship data.

[0083] Optionally, in this embodiment, obtaining the performance indicator data corresponding to each network device through the performance indicator module 34 and storing the performance indicator data in the performance indicator database includes: receiving the performance indicator data corresponding to each network device sent by a preset monitoring platform through the storage module; filtering the performance indicator data according to preset rules to obtain standard performance indicator data; storing the standard performance indicator data in the performance indicator database; and updating the monitoring items in the preset monitoring platform according to the standard performance indicator data.

[0084] Optionally, in this embodiment, the step of analyzing the performance index data corresponding to each network device through the performance analysis module 36 according to a preset model to obtain the analysis results includes: obtaining the traffic data corresponding to each network device from the performance index database; and analyzing the traffic data corresponding to each network device according to a pre-trained traffic classification anomaly detection model to obtain the analysis results.

[0085] Optionally, in this embodiment, the preset data center includes multiple functional partitions, each corresponding to a different function. Each function includes one or more network devices. The step of analyzing the performance index data corresponding to each network device through the performance analysis module 36 according to a preset model to obtain analysis results includes: obtaining traffic data corresponding to each network device from the performance index database; and performing anomaly detection on the traffic data corresponding to the network device according to the network layer where the network device is located and the inbound and outbound traffic models corresponding to the functional partitions using a pre-trained logical anomaly detection model to obtain the analysis results.

[0086] Optionally, in this embodiment, the step of displaying the normalized log data corresponding to each network device and the analysis results through the front-end display module 38 according to the topology relationship in the preset topology database includes: displaying the topology diagram corresponding to the topology relationship in the graphical user interface through the front-end display module; and / or displaying key abnormal logs in the graphical user interface; and / or displaying the indicator data of the network device in the graphical user interface; and / or, if the analysis results include abnormal events, displaying the abnormal events in the graphical user interface.

[0087] This method involves acquiring log data from various network devices in a preset data center and normalizing the log data to obtain normalized log data for each network device. It also involves determining the topology relationships for each network device and updating the topology relationships in a preset topology database. Furthermore, it involves acquiring performance indicator data for each network device and storing this data in a performance indicator database. The method analyzes the performance indicator data for each network device according to a preset model to obtain analysis results. Finally, it displays the normalized log data and analysis results for each network device based on the topology relationships in the preset topology database. In this embodiment, the log information generated by network devices in the preset data center is processed using a normalized format, reducing the difficulty of operation and maintenance. By sorting and analyzing the log data and performance indicator data generated by the network devices, combined with the topology relationships of the preset data center, rapid fault location of network devices can be achieved. This solves the technical problem of difficulty in effectively monitoring network devices in a data center due to the reliance on segmented viewing and management based on network management systems provided by various vendors in related technologies.

[0088] According to an embodiment of the present invention, an electronic device is also provided, including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the network device monitoring method described above.

[0089] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0090] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0091] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0092] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0093] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for monitoring network devices, characterized in that, The method includes: Obtain log data corresponding to each network device in a preset data center, and normalize the log data to obtain normalized log data corresponding to each network device; Determine the topology relationship corresponding to each network device and update the topology relationship in the preset topology database; Obtain the performance index data corresponding to each network device, and store the performance index data in the performance index database; The performance index data corresponding to each network device are analyzed according to the preset model to obtain the analysis results; The front-end display module displays the normalized log data corresponding to each network device and the analysis results based on the topological relationships in the preset topology database. The step of determining the topology relationship corresponding to each network device and updating the topology relationship in the preset topology database specifically includes: determining the topology relationship corresponding to each network device through the dynamic discovery module and updating the topology relationship in the preset topology database, including: remotely logging into each network device and obtaining the first neighbor relationship data of each network device; and updating the second neighbor relationship data of each network device in the preset topology database based on the first neighbor relationship data.

2. The method according to claim 1, characterized in that, The step of acquiring log data corresponding to each network device in a preset data center and normalizing the log data to obtain normalized log data corresponding to each network device includes: The log data corresponding to each network device is normalized to obtain data in a preset format; Redundancy and noise removal are performed on the preset format data to obtain the normalized log data.

3. The method according to claim 1, characterized in that, The step of acquiring log data corresponding to each network device in a preset data center and normalizing the log data to obtain normalized log data corresponding to each network device further includes: The log database is modeled based on the device documentation corresponding to the network device, wherein the log database includes hit information; According to a preset algorithm, the normalized log data is matched in the log database to update the hit information corresponding to the normalized log data; Based on historical key security logs, early warning analysis is performed on the normalized log data corresponding to each network device.

4. The method according to claim 1, characterized in that, The step of obtaining the performance indicator data corresponding to each network device and storing the performance indicator data in the performance indicator database includes: Receive performance index data corresponding to each network device sent by the preset monitoring platform; The performance index data is filtered according to preset rules to obtain standard performance index data; The standard performance index data is stored in the performance index database; and, The monitoring items in the preset monitoring platform are updated based on the standard performance index data.

5. The method according to claim 1, characterized in that, The step of analyzing the performance index data corresponding to each network device according to a preset model to obtain analysis results includes: Obtain the traffic data corresponding to each network device from the performance index database; Based on the pre-trained traffic classification anomaly detection model, the traffic data corresponding to each network device is analyzed to obtain the analysis results.

6. The method according to claim 1, characterized in that, The preset data center includes multiple functional zones, each corresponding to a different function. Each function includes one or more of the network devices. The step of analyzing the performance index data corresponding to each network device according to a preset model to obtain analysis results includes: Obtain the traffic data corresponding to each network device from the performance index database; By using a pre-trained logical anomaly detection model, anomalies are detected in the traffic data corresponding to the network device based on the network layer and the incoming and outgoing traffic model corresponding to the functional partition, so as to obtain the analysis results.

7. The method according to claim 1, characterized in that, The step of displaying the normalized log data corresponding to each network device and the analysis results based on the topology relationships in the preset topology database includes: Display the topological relationships and their corresponding topological graphs in a graphical user interface; and / or, The graphical user interface displays key exception logs; and / or, The graphical user interface displays the network device's metrics data; and / or, If the analysis results include anomalies, then the anomalies are displayed in the graphical user interface.

8. A network device monitoring system, characterized in that, The network device monitoring system includes a log module, a dynamic discovery module, a performance indicator module, a performance analysis module, and a front-end display module. The log module is used to acquire log data corresponding to each network device in the preset data center, and normalize the log data to obtain normalized log data corresponding to each network device. The dynamic discovery module is used to determine the topology relationship corresponding to each network device and update the topology relationship in the preset topology database. The performance indicator module is used to obtain the performance indicator data corresponding to each network device and store the performance indicator data in the performance indicator database. The performance analysis module is used to analyze the performance index data corresponding to each network device according to a preset model to obtain analysis results. The front-end display module is used to display the normalized log data corresponding to each network device and the analysis results according to the topological relationship in the preset topology database. The step of determining the topology relationship corresponding to each network device and updating the topology relationship in the preset topology database specifically includes: determining the topology relationship corresponding to each network device through the dynamic discovery module and updating the topology relationship in the preset topology database, including: remotely logging into each network device and obtaining the first neighbor relationship data of each network device; and updating the second neighbor relationship data of each network device in the preset topology database based on the first neighbor relationship data.

9. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the network device monitoring method as described in any one of claims 1-7.

Images