Network fault information correction system, method, and program

Abstract

To correct fault information based on inter-node dependencies in a virtual network.SOLUTION: A network fault monitoring unit 1 detects service impacts and abnormalities in a communication network and notifies fault information. A dependency management unit 2 determines which nodes have a relationship (dependency) with each other based on criteria and logic established by an operator, and outputs this information as dependency information for the communication network. A fault information correction unit 3 corrects the communication network fault information based on the dependency information output by the dependency management unit 2 and outputs the corrected fault information.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a network fault information correction system, method and program, and more particularly to a network fault information correction system, method and program for automatically collecting and correcting fault information in network operation management. [Background technology]

[0002] Patent Document 1 discloses a fault monitoring device that takes appropriate recovery measures in a virtual network system, which includes a notification acquisition unit that acquires a notification indicating that a fault has occurred from a virtual network device, and a recovery action unit that executes recovery measures for the virtual network device that has acquired the notification, the physical device that implements the virtual network device, and other virtual network devices that have dependencies on the virtual network device, which has the highest priority for fault response. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] WO2016 / 125387 Summary of the Invention [Problem to be solved by the invention]

[0004] In the operation of a communications network, fault information is recorded, including when, where, what type of fault occurred, what caused it, and when it was restored. However, if the relationships between faults and the dependency relationships between nodes are unknown, it may not be possible to accurately determine the time of fault occurrence / recovery and suspected nodes, which could impair the performance of systems that use fault information (for example, fault detection / cause identification systems). Patent Document 1 discloses a function for managing node dependency relationships in a table format, but is unable to capture or correct fault information that affects fault propagation.

[0005] An object of the present invention is to solve the above technical problems and to provide a network fault information correction system, method, and program that can correct fault information based on dependency relationships between nodes in a virtual network. [Means for solving the problem]

[0006] In order to achieve the above object, the present invention provides a network fault information correction system that corrects fault information of a virtual network, and includes means for monitoring faults in the virtual network and generating fault information, means for determining the dependency relationships of each node that constitutes the virtual network, and means for correcting the fault information based on the dependency relationships, and obtains log information from the virtual network of nodes that are dependent on the suspect node described in the fault information, and corrects the fault information based on the log information. [Effects of the Invention]

[0007] According to the present invention, fault information can be corrected based on the dependency relationships between nodes in a virtual network, thereby reducing the possibility of misidentifying a node that has no dependency relationship with the node where the fault occurred as a suspect node, or misidentifying a node that has a dependency relationship with the node where the fault occurred as not a suspect node. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a block diagram showing the configuration of a main part of a network fault information correction system according to an embodiment of the present invention. [Figure 2] FIG. 2 is a block diagram showing the configuration of a network failure monitoring unit. [Figure 3] FIG. 2 is a block diagram showing the configuration of a dependency management unit. [Figure 4] FIG. 2 is a block diagram showing the configuration of a fault information correction unit. [Figure 5] FIG. 2 is a functional block diagram showing the configuration of the main parts of a communication network. [Figure 6] FIG. 1 is a diagram showing an example of a failure that may occur in a communication network. [Figure 7]FIG. 1 is a diagram showing the timing of service impacts due to failures expected in a communication network. [Figure 8] FIG. 10 is a diagram showing an example of fault information output by a NW fault monitoring unit in response to a NW fault. [Figure 9] FIG. 10 is a diagram illustrating an example of a dependency extraction function in a dependency management unit. [Figure 10] 10 is a flowchart showing a correction procedure performed by a suspected node information correction function of a fault information correction unit. [Figure 11] FIG. 10 is a diagram illustrating an example of extracting dependency relationships using an adjacency matrix. [Figure 12] FIG. 10 is a diagram showing an example of an error log issued by each node. [Figure 13] 10 is a flowchart showing the operation of a failure occurrence time information correction function. [Figure 14] 10 is a flowchart showing the operation of a fault cause information correction function. [Figure 15] FIG. 10 is a diagram showing an example of corrected fault information. DETAILED DESCRIPTION OF THE INVENTION

[0009] The present invention will be described in detail below with reference to the accompanying drawings, in which: Fig. 1 is a block diagram showing the configuration of the main components of a network fault information correction system according to an embodiment of the present invention, and the main components include a communication network (NW), a NW fault monitoring unit 1, a dependency management unit 2, and a fault information correction unit 3.

[0010] Such a network fault information correction system can be configured by installing an application (program) that realizes each of the functions detailed below on at least one general-purpose computer or server equipped with a CPU, ROM, RAM, bus, interface, etc. Alternatively, it can be configured as a dedicated machine or a single-function machine in which part of the application is implemented as hardware or software.

[0011] The communication network assumed in the present invention is a group of facilities including communication devices (nodes) such as routers and switches and transmission lines for providing mobile phone and Internet connection services.

[0012] The NW fault monitoring unit 1 detects service impacts and abnormalities in the communication network and notifies the failure information. The dependency management unit 2 determines which nodes have a relationship (dependency) with each other based on standards and logic defined by the operator, and outputs this as dependency information for the communication network. The fault information correction unit 3 corrects the communication network fault information output by the NW fault monitoring unit 1 based on the dependency information output by the dependency management unit 2, and outputs the corrected fault information.

[0013] 2 is a block diagram showing the configuration of the NW fault monitoring unit 1, which is equipped with a fault information creation function 101. The fault information creation function 101 detects service impacts based on information output from the communication NW, and creates fault information including suspected node detection, abnormality content confirmation, and the cause of the fault.

[0014] FIG. 3 is a block diagram showing the configuration of the dependency management unit 2, which includes a dependency extraction function 201 and a dependency DB 202.

[0015] The dependency extraction function 201 acquires node information having mutual dependency relationships. The dependency DB 202 stores the information acquired by the dependency extraction function 201 or information created by the operator by directly inputting the dependency relationships.

[0016] FIG. 4 is a block diagram showing the configuration of the fault information correction unit 3, which comprises a suspected node information correction function 301, a fault occurrence time extraction function 302, and a fault cause information correction function 303.

[0017] The suspected node information correction function 301 acquires equipment information of nodes connected up to a predetermined number of hops away from the suspected node based on the dependency information output from the dependency management unit 2, and corrects any differences in the information about the suspected node in the fault information, taking into account whether or not an abnormality has occurred.

[0018] The failure occurrence time extraction function 302 corrects the failure occurrence time of the failure information. The failure cause information correction function 303 identifies the event that caused the abnormality based on the equipment information acquired from the communication network, and corrects the failure information.

[0019] Figure 5 is a functional block diagram showing the configuration of the main parts of the communication network assumed in this embodiment, and is composed of virtual machines that run each application of the 5G core network (AMF, AUSF, NRF, SMF, UDM, UPF) in a virtual environment constructed by two physical servers "tam5compute01" and "tam5compute02" on which an open source cloud management system (Openstack) is implemented on the host OS.

[0020] FIG. 6 is a diagram showing examples of failures assumed in the communication network in this embodiment, and FIG. 7 shows the timing at which the assumed failures will affect services.

[0021] Here, we assume a situation in which a memory leak occurs, causing an abnormal increase in memory usage in the compute resource control process (nova livbert) provided by Openstack running on the physical server tam5comopute01, resulting in the depletion of memory capacity that should be available to the virtual machine "tam5ausf01."

[0022] After a memory leak occurs at time t1 in Figure 7, when a user equipment (UE) sends a connection request for new Internet communication to the AMF via the gNB, the AMF inquires of the AUSF whether the UE is a terminal authorized to connect to the Internet. If the AUSF's memory is depleted at this time, the application will crash at time t2 in Figure 7, resulting in an unserviceable state.

[0023] As a result, the AMF also outputs an error due to a failure in the authentication query to the AUSF, and rejects the connection request to the UE at time t3 in Figure 7. The service impact is considered to have occurred at the time when the AMF rejects the connection request to the UE.

[0024] 8 is a diagram showing an example of fault information for the above faults output by the NW fault monitor 1. The NW fault monitor 1 stores information necessary for fault information among information acquired from the communication NW manually or by an arbitrary system.

[0025] This stores information about the "date and time of the failure," "date and time of recovery," "service impact information," "suspect nodes" that are the results of detecting nodes (physical servers and virtual machines in the communication network) that are behaving abnormally, "what is happening" at the suspect nodes, and "the cause of the failure."

[0026] 9 is a diagram showing an example of the dependency extraction function in the dependency management unit 2. Node dependencies are extracted from information acquired based on the configuration information of each node constituting the communication network ((a) in the figure), such as dependencies (vertical dependencies) between virtual machines that share the communication network's hardware resources (CPU, memory, network interface cards, disks), OS, and middleware, as well as dependencies (horizontal dependencies) between virtual machines that cooperate with each other via a communication protocol, and these nodes are treated as nodes that have dependencies ((b) in the figure). Then, by converting the graph structure between the nodes into an adjacency matrix ((c) in the figure), it can be stored in a data format that the system can recognize.

[0027] FIG. 10 is a flowchart showing the correction procedure performed by the suspected node information correcting function 301 of the fault information corrector 3.

[0028] In step S101, the suspected node information correction function 301 executes the processes in Fig. 9 in response to the error notification output from the NW fault monitoring unit 1, and acquires the node dependency relationship in the form of an adjacency matrix as shown in Fig. 11. In Fig. 11, the intersection of the matrices at "1" indicates that there is a dependency relationship between node combinations.

[0029] In step S102, the position of the suspected node in the dependency relationship is confirmed. In step S103, device information (error logs) is acquired for nodes connected within a predetermined range (number of hops) centered on the suspected node.

[0030] FIG. 12 is a diagram showing an example of the error log of each node acquired by the suspicious node information correcting function 301, and a node in which an ERROR is issued in the log is determined to be a suspicious node.

[0031] The log " / var / log / libvirt / libvirtd.log" in Figure (a) is an operation log of the API "nova-libvirt" used by Openstack when manipulating the allocation of compute resources for virtual machines, and indicates that the process for the API in question was started at 2024-02-08 12:45, and that a memory leak occurred in the libvirt process at 2024-02-08 12:45.

[0032] The log " / var / log / nova / nova-compute.log" in Figure 1(b) is an operation log of the Openstack program "nova-compute" that controls the physical server. It indicates that the nova.compute.manager function detected the startup of the nova-compute process on 2024-02-08 12, and that a memory leak occurred in the nova-compute process at 2024-02-08 12:45.

[0033] The log in Figure (c), " / var / log / free5gc / free5gc-ausf.log," is an operation log of AUSF (a function that authenticates whether UEs can connect) in the 5G core network, and indicates that a kernel panic occurred due to a memory shortage in AUSF at 2024-02-08 16:45, causing the function to stop.

[0034] The log " / var / log / free5gc / free5gc-amf.log" in Figure (d) is an operation log of the AMF (a function that manages the status of the UE, such as which base station the UE is connected to and whether it is able to connect to the Internet) in the 5G core network, and indicates that at 2024-02-08 17:30:45, an attempt to establish a connection with AUSF for UE authentication failed, and at 2024-02-08 17:30, UE authentication failed (due to a failure to establish a connection with AUSF).

[0035] If, as a result of the above log reference, it is discovered that an error has occurred in tam5compute01, which was not originally a suspect node, then in step S104, this suspect node is added as a suspect node to the fault information.

[0036] If the fault information describes a suspected node whose hop count from the suspected node exceeds the predetermined hop count, the suspected node may be deleted from the fault information.

[0037] 13 is a flowchart showing the operation of the failure occurrence time extraction function 302. In step S201, the occurrence time of information suggesting a failure is extracted from among the suspected nodes. In step S202, the failure occurrence time information in the failure information is updated, with the oldest time set as the failure occurrence time.

[0038] 14 is a flowchart showing the operation of the fault cause information correction function 303. In step S301, items with a particularly high degree of abnormality are extracted from each item of performance management information that can be obtained from a suspect node. To extract the degree of abnormality, a time series analysis method such as LSTM-AutoEncoder can be used. In step S302, performance management information with a high degree of abnormality is automatically or manually added to the explanation of "what is happening" in the fault information.

[0039] FIG. 15 shows an example of fault information after correction. Compared to the initial fault information described in relation to FIG. 8, fault information has been added and corrected (underlined parts) based on the dependency, starting from the node that was treated as a suspect node based on the judgment result of the network fault monitoring unit.

[0040] According to the above embodiment, fault information can be corrected based on the dependency relationships between nodes in a virtual network, thereby reducing the possibility of misidentifying a node that has no dependency relationship with the node where the fault occurred as a suspect node, or misidentifying a node that has a dependency relationship with the node where the fault occurred as not a suspect node.

[0041] Therefore, it will be possible to contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), "Build resilient infrastructure and promote inclusive and sustainable industrialization," and Goal 11, "Make cities inclusive, safe, resilient and sustainable." [Explanation of symbols]

[0042] 1... Network fault monitoring unit, 2... Dependency management unit, 3... Fault information correction unit, 101... Fault information creation function, 201... Dependency extraction function, 202... Dependency DB, 301... Suspected node information correction function, 302... Fault occurrence time extraction function, 303... Fault cause information correction function

Claims

1. A network fault information correction system for correcting fault information of a virtual network, a means for monitoring a virtual network for failures and outputting failure information; A means for determining dependency relationships between nodes constituting a virtual network; means for correcting the fault information based on the dependency relationship; A network fault information correction system characterized in that the correction means obtains log information of nodes that are dependent on the suspected node described in the fault information from the virtual network and corrects the fault information based on the log information.

2. 2. The network fault information correction system according to claim 1, wherein said correcting means comprises means for correcting a suspected node of said fault information based on error log information.

3. 3. The network fault information correction system according to claim 2, wherein said correcting means comprises means for correcting fault occurrence time information of said fault information based on said corrected suspect node.

4. The network fault information correction system according to claim 2, characterized in that the correction means includes means for correcting information describing what is occurring in the fault information based on the corrected suspect node.

5. The network fault information correction system described in any one of claims 1 to 4, characterized in that the correction means calculates the number of hops from the suspected node to each other node based on the dependency relationship, acquires log information from each node within a predetermined number of hops, and adds nodes in which an abnormality has been recorded in the log information as suspect nodes to the fault information.

6. A network fault information correction system as described in any one of claims 1 to 4, characterized in that the correction means calculates the number of hops from the suspected node to each other node based on the dependency relationship, and excludes from the suspected nodes any node whose number of hops from the suspected node exceeds a predetermined number of hops.

7. A network fault information correction method in which a computer corrects fault information of a virtual network, Monitors virtual network failures and outputs failure information. Determine the dependencies of each node that makes up the virtual network, A network fault information correction method characterized by obtaining log information of nodes that are dependent on the suspected node described in the fault information from a virtual network based on the dependency relationship of the fault information, and correcting the fault information based on the log information.

8. A network fault information correction program for correcting fault information of a virtual network, A procedure for monitoring a virtual network for failures and outputting failure information; A procedure for determining the dependency of each node that constitutes a virtual network; a step of correcting the fault information based on the dependency relationship; A network fault information correction program characterized in that the correction procedure involves obtaining log information from a virtual network of nodes that are dependent on the suspected node described in the fault information, and correcting the fault information based on the log information.

Images