Fault location estimation device, method, and computer program

Abstract

A fault location estimation device according to the present embodiment comprises: a database for registering, in association for each fault, fault origin information that includes the origin of the fault, fault event group information that characterizes the fault, and a rule for associating conditions that are met by the fault event group information and position information relative to a fault origin location and conclusions that represent the fault origin information, the rule including a condition part that includes at least one of the conditions and a conclusion part that includes a conclusion for when the condition part is true; a network configuration information database in which network configurations that include devices being monitored are registered; and a fault location estimation function unit that, when a fault occurs, calculates, as the degree of confidence that the device being monitored is the fault origin, an evaluation value pertaining to a value calculated for each condition using the number of devices being monitored in which a fault event included in the condition of a corresponding rule occurred and the total number of devices being monitored in which a fault event occurred.

Description

[Technical Field]

[0001] The present invention relates to a fault location estimation device, method, and computer program. [Background technology]

[0002] In the maintenance work of network services, there is a technique for creating IF-THEN rules that determine the cause of a failure based on an event (hereinafter referred to as a failure event) that occurs due to a failure in a monitored device.

[0003] For example, Patent Document 1 discloses a learning technology that specifies a time period during which a failure occurred (for example, from the time the failure occurred to its recovery), compares failure event information (alarms, logs, etc.) occurring during that time period with unique patterns of event information that characterize other failures, extracts the unique pattern of the failure event information that characterizes the failure, and also corrects the unique patterns of other failures. Patent Document 1 also calculates how well the failure event information that occurred matches the unique pattern (certainty), and determines that the higher the rate of match, the more likely it is to be similar to a failure that occurred in the past, thereby estimating the failure location. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent No. 6637854 Summary of the Invention [Problem to be solved by the invention]

[0005] In a configuration where there are many devices connected to the cause of the failure, the influence of certain conditions (for example, a large number of related devices) on the certainty factor becomes dominant (the proportion of the certainty factor in the denominator becomes extremely large), and the certainty factor may not reflect the actual situation. In other words, the certainty factor of other locations may be higher than the actual failure location.

[0006] The present invention has been made in view of the above circumstances, and has as its object to provide a highly reliable device, method and computer program for estimating a fault location in network service maintenance work. [Means for solving the problem]

[0007] A failure location estimation device according to a first aspect of the present invention comprises: a database in which, for each failure, failure cause information including a failure cause, failure event group information characterizing the failure, rules associating relative position information with a failure cause location and conditions based on the failure event group information, and a conclusion that is the failure cause information, the rules including a condition part including at least one of the conditions and a conclusion part including the conclusion when the condition part is true; a network configuration information database in which network configurations including monitored devices are registered; and a failure location estimation function unit that, when the failure occurs, calculates an average value of values ​​calculated for each of the conditions using the number of monitored target devices in which the failure event included in the condition of the corresponding rule has occurred and the total number of monitored target devices in which the failure event may occur, as a certainty that the monitored target device is the failure cause. [Effects of the Invention]

[0008] According to the present invention, it is possible to provide a highly reliable failure location estimation device, method, and computer program for use in network service maintenance work. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of a monitoring system including a failure location estimation device according to an embodiment. [Figure 2] FIG. 2 is a diagram schematically illustrating an example of the configuration of the server illustrated in FIG. [Figure 3] FIG. 3 is a diagram illustrating an example of the operation of the failure location estimation device according to the embodiment. [Figure 4]FIG. 4 is a diagram illustrating an example of the certainty factor calculated in the failure location estimation device of the embodiment. [Figure 5] FIG. 5 is a diagram showing an example of an example of a comparison of the certainty factors calculated for the faults shown in FIG. [Figure 6] FIG. 6 is a diagram for explaining an example of the certainty factor for each condition employed in the failure location estimation device of the third embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, a fault location estimation device, a method, and a computer program according to embodiments of the present invention will be described with reference to the drawings. In the following embodiments, parts with the same numbers perform similar operations, and redundant explanations will be omitted. FIG. 1 is a diagram illustrating an example of the configuration of a monitoring system including a failure location estimation device according to an embodiment.

[0011] 1 is a network NW that includes multiple devices that are to be monitored. The monitoring system is connected to the network NW that is to be monitored via a HUB 10 so that communication can be established between the monitoring system and the network NW. The monitoring system includes a monitoring device 20 and a failure location estimation device 50. The failure location estimation device 50 includes a server 30 and a display terminal 40. The monitoring device 20, the server 30, and the display terminal 40 each include at least one processor and a memory that stores a program executed by the processor, and realize various functions described below by software or a combination of software and hardware. The monitoring device 20, the server 30, and the display terminal 40 are connected to each other via a network so that they can communicate with each other. The monitoring device 20 receives failure event information from the monitored network NW, and periodically transmits the received failure event information to the server 30 of the failure point estimating device 50.

[0012] The server 30 generates rules and infers the location of a failure based on the failure event information received from the monitoring device 20. When a failure occurs for the first time, the server 30 extracts a unique pattern from the failure event information that characterizes the failure and creates a rule. The server 30 performs the process of inferring the location of a failure when a failure occurs for the second or subsequent time (for which a rule has already been generated) based on, for example, the time period during which the failure occurred (for example, at least a part of the time period from the time the failure occurred to the time of recovery) and the location of the failure input by a maintenance person. The server 30 outputs, for example, the failure location (monitored device) that matches at least a part of the rule and the confidence level (the likelihood of the inference result) as the inference result to the display terminal 40.

[0013] The display terminal 40 is a terminal equipped with, for example, a display unit and an operation unit. The operation unit is, for example, a keyboard, a mouse, a touch panel, or the like, and is a means for inputting information by being operated by an operator (maintenance person). The display unit includes a display means such as a liquid crystal display panel or an organic EL display panel, and can display the results of the failure location estimation by the server 30 and countermeasures therefor. By operating the display terminal 40, the maintenance person can input, for example, information on the true cause of the failure and its location. Furthermore, by operating the display terminal 40 and inputting the time period when the failure occurred, the maintenance person can have the display unit present the estimated location where the failure occurred and countermeasures therefor.

[0014] FIG. 2 is a diagram schematically illustrating an example of the configuration of the server illustrated in FIG. The server 30 includes a data acquisition unit 31, a rule learning control unit 32, a fault location estimation function unit 33, a countermeasure management function unit 34, a GUI (Graphical User Interface) unit 35, an API (Application Programming Interface) unit 36, a fault history / countermeasure history database D1, a rule database D2, an alarm information database D3, and a network (NW) configuration information database D4.

[0015] The fault history and response history database D1 records fault history information and response history information in association with a fault ID. For example, for each fault (fault ID), the fault history information includes one piece of fault cause information and multiple pieces of fault case information (fault case ID, etc.). For each fault case ID, the fault case information includes, for example, fault event log information (monitored device ID, event ID, event type, event occurrence date and time, etc.), information on the time period during which the related fault event occurred, and information on the location of the fault cause. A fault event is associated with a fault case ID and indicates an event that occurred due to the fault corresponding to the fault case ID. The location of the fault cause information indicates the location of the fault identified by the maintenance person (e.g., monitored device ID, IP address, etc.), and the location of the fault cause is a certain monitored device. The fault cause information indicates the cause of the fault indicated by the corresponding fault ID (fault cause type) and is information on the true cause of the fault identified by the maintenance person (e.g., a character string indicating the name of the fault). The response history information includes the actual response method performed by the maintenance person, the date and time of the response, etc.

[0016] In the rule database D2, a rule generated for each failure is recorded in association with a rule ID. A rule ID is assigned to each rule. The rules recorded in the rule database D2 are IF-THEN rules that associate failure event group information with failure cause information. An IF-THEN rule is composed of an if section (condition section) that represents a premise or condition, and a then section (conclusion section) that represents a conclusion or action when the if section is true. In the following description, multiple rules may be referred to as a rule set. In the embodiment, the condition section of a rule is a combination of failure events (e.g., alarms), and is represented by a pair combination of a relative position from the failure occurrence point (e.g., an identifier indicating whether the event is the local device or a connected device) and an event type (alarm type, level, etc.). One rule may include multiple condition sections. As an example, the condition section of rule A may include a first condition (alarm A occurs in the local device) and a second condition (alarm B occurs in a connected device). The conclusion section of a rule is failure cause information, and includes, for example, the failure cause type.

[0017] The alarm information database D3 records alarm information (monitored device ID, event ID, event type (alarm type, level, etc.), event occurrence date and time, etc.) issued by the monitored device.

[0018] The network configuration information database D4 stores network configuration information. The network configuration information is information indicating how the devices that make up the network are connected to each other, and includes, for example, monitored device information (IP address, device type, monitored device ID, etc.) and connection information between the monitored devices.

[0019] The data acquisition unit 31 acquires data supplied from outside the server 30. For example, the data acquisition unit 31 can acquire failure event group information from the monitoring device 20. The failure event group information includes information on at least one failure event or multiple failure event groups. The failure event group information acquired by the data acquisition unit 31 is recorded in the failure history / response history database D1 in association with the failure ID of a related failure that is recognized based on information such as the time period entered by a maintenance person.

[0020] Furthermore, the data acquisition unit 31 acquires network configuration information, for example, from outside the server 30. The data acquisition unit 31 can acquire the network configuration information at least when the configuration of the monitored network NW is changed. The data acquisition unit 31 records the acquired network configuration information in the network configuration information database D4 to update the information. Furthermore, the data acquisition unit 31 can acquire information that is input by the maintenance person operating the display terminal 40.

[0021] The rule learning control unit 32 extracts a combination of alarms that characterize a newly occurring fault (new fault) as a unique pattern based on alarm information included in fault event group information for the newly occurring fault. The rule learning control unit 32 generates a new rule by using the unique pattern extracted for the new fault as the condition part of the rule and the fault cause information that identifies the true cause and its location registered by the maintenance operator as the conclusion part of the rule. The rule learning control unit 32 associates the newly generated unique pattern for the new fault with a new rule ID, revises the rule set, and records the new rule ID and fault ID in association with each other in the rule database D2. Note that a rule ID is assigned to each rule.

[0022] An alarm combination is a combination of some or all of the alarms associated with each failure ID. A unique pattern is calculated for each failure ID from the alarm combination using a predetermined method. Each unique pattern has a one-to-one correspondence with a rule ID.

[0023] Furthermore, if the maintenance person's troubleshooting results in a correct answer, a fault event is registered.

[0024] When a failure for which a rule has already been generated occurs (when a maintenance person suspects the occurrence of a failure), the failure location estimation function unit 33 calculates, in the process of estimating the failure location, how much the combination of failure events included in the failure event group information matches the unique pattern (condition part) of the rule recorded in the rule database D2 (certainty level), for example, using the following formula (1):

number

[0025] The fault location estimation function unit 33 selects a rule to be applied based on the confidence level calculated as described above, and can obtain information on the fault location that is estimated to be the fault cause from the conclusion part of the selected rule.

[0026] The GUI unit 35 visually guides the maintenance person to make inputs on the display unit of the display terminal 40. For example, when a failure occurs, the GUI unit 35 can display visual information on the display unit of the display terminal 40 that guides the maintenance person to input the time period during which the failure occurred and the location of the failure. Furthermore, for example, after presenting information on the location of the cause of the failure and a solution (solution plan) to the maintenance person on the display unit of the display terminal 40, the GUI unit 35 can display visual information on the display unit of the display terminal 40 that guides the maintenance person to make inputs when the maintenance person registers whether the estimation result of the failure location estimation function unit 33 is correct or incorrect.

[0027] The countermeasure management function unit 34 presents to the maintenance person the location where the failure is estimated to have occurred based on the certainty calculated by the failure location estimation function unit 33, and also presents to the maintenance person a countermeasure based on the countermeasure history of failures to which the used rule was applied. The countermeasure management function unit 34 can present to the maintenance person, for example, at least one conclusion part of a rule including a unique pattern with a high certainty to the maintenance person via the display terminal 40. Furthermore, the countermeasure management function unit 34 presents to the maintenance person, via the display terminal 40, the countermeasure history of at least one past failure to which a rule including a unique pattern with a high certainty was applied to the maintenance person.

[0028] The API unit 36 ​​is an interface that acts as an intermediary when sending and receiving data between multiple applications. The API unit 36 ​​can, for example, link various functions of the server 30 with the monitoring device 20 and the display terminal 40.

[0029] FIG. 3 is a diagram illustrating an example of the operation of the failure location estimation device according to the embodiment. Here, an example will be described in which, when a failure N to which rule A applies occurs, the failure location estimation function unit 33 calculates the certainty that device X and device Y are the failure locations. In failure N, alarm A occurs in device X and alarm B occurs in device Z, and the true failure location is device X. Furthermore, the condition part of rule A includes the following first and second conditions. First condition: Alarm A occurs on the device itself Second condition: Alarm B occurs on the connected device

[0030] FIG. 4 is a diagram illustrating an example of the certainty factor calculated in the failure location estimation device of the embodiment. The failure location estimation function unit 33 calculates the certainty factors of device X and device Y for the above failure N using equation (1). In failure N, alarm A has occurred in device X itself, so in the first condition the number of alarms A (the number of locations where alarms have occurred) is 1, and the number of device itself (the total number of locations where alarms can occur) is 1. Also, alarm B has occurred in device Z, which is a connected device of device X, so in the second condition the number of alarms B (the number of locations where alarms have occurred) is 1, and the number of connected devices (peripheral devices) connected to device X (the total number of locations where alarms can occur) is 4. Therefore, the failure location estimation function unit 33 can calculate the certainty factor β of device X using equation (1) as follows: β=(β1+β2)÷2={(1÷1)×100+(1÷4)×100}÷2 =(1+0.25)×100÷2 =62.5%

[0031] In failure N, device Y has not generated alarm A itself, so in the first condition the number of alarms A (number of locations where alarms have occurred) is 0 and the number of device itself (total number of locations where alarms can occur) is 1. Also, since alarm B has occurred in device Z, which is a connected device of device Y, in the second condition the number of alarms B (number of locations where alarms have occurred) is 1 and the number of connected devices connected to device Y (total number of locations where alarms can occur) is 1. Therefore, the failure location estimation function unit 33 can calculate the certainty factor β of device Y using equation (1) as follows: β=(β1+β2)÷2={(0÷1)×100+(1÷1)×100}÷2 =(0+1)×100÷2 =50%

[0032] FIG. 5 is a diagram showing an example of an example of a comparison of the certainty factors calculated for the faults shown in FIG. Here, as a comparative example, we will explain the case where the certainty that device X and device Y are the fault locations when a fault N to which rule A applies occurs is β' = (number of locations where an alarm occurred / total number of locations where an alarm may occur) × 100 [%].

[0033] In failure N, alarm A occurs in device X itself and alarm B occurs in device Z, which is a connected device, so the number of locations where an alarm occurs under the first condition is 2 (=1+1), and the total number of locations where an alarm can occur is the sum of the number of devices itself and the number of connected devices (=1+4). Therefore, the certainty factor β' of device X can be calculated as follows: β´=(1+1)÷(1+4)×100 =2÷5×100 =40%

[0034] In failure N, device Y does not generate alarm A, but device Z, which is a connected device, generates alarm B, so the number of locations where an alarm occurred under the first condition is 1 (0 + 1), and the total number of locations where an alarm can occur is the sum of the number of device Y itself and the number of connected devices (1 + 1). Therefore, the confidence factor β' of device Y can be calculated. β´=(0+1)÷(1+1)×100 =1÷2×100 =50%

[0035] In the above comparative example, the certainty that device X is the faulty device is lower than the certainty that device Y is the faulty device, and the certainty of other locations is higher than the true fault location. In contrast, with the fault location estimation device of this embodiment, the certainty that device X is the true fault location is higher than the certainty of device Y, and a highly reliable estimation result is obtained. In other words, with the fault location estimation device of this embodiment, it is possible to present a more accurate true fault location to the maintenance person, and to support the maintenance person in quickly dealing with network faults. As described above, according to the present embodiment, it is possible to provide a highly reliable failure location estimation device, method, and computer program for use in network service maintenance work.

[0036] Next, a fault location estimation device, method, and computer program according to a second embodiment will be described. In the following description, the same components as those in the first embodiment will be denoted by the same reference numerals, and the description thereof will be omitted. In the failure location estimating device of this embodiment, the certainty factor calculated by the failure location estimating function unit 33 is different from that in the first embodiment described above.

[0037] When a failure occurs (for the second time or later), the failure location estimation function unit 33 calculates the degree of match (certainty) between the combination of failure events included in the failure event group information and the unique pattern (condition part) of the rule recorded in the rule database D2 using the following formula (2).

number

[0038] The failure location estimation function unit 33 may set the weight of a condition including an alarm generated by the own device to be greater than the weight of a condition including an alarm generated by a connected device. In this case, for example, since the first condition of the above-mentioned rule A includes alarm A generated by the own device, the weight α1 of the first condition is set to be greater than the weight α2 of the second condition.

[0039] For example, when estimating the location of the above-mentioned fault N to which rule A is applied, if the weight α1 of the first condition is set to 2 and the weight α2 of the second condition is set to 1, the confidence level β of device X is calculated as follows using equation (2): β=(2×1×100+1×0.25×100)÷(2+1)=75%

[0040] Furthermore, the confidence level β of device Y is calculated from equation (2) as follows: β=(2×0×100+1×1×100)÷(2+1)=approximately 33% As described above, by weighting the certainty of each condition included in the condition part of the rule, it is possible to make a significant difference between the certainty of device X, which is the true fault location, and the certainty of another device Y. This allows the fault location estimation function unit 33 to more accurately estimate the true fault location.

[0041] The fault location estimation function unit 33 may set weights for the conditions included in the condition part of the rule according to the level (type) of the alarm. The fault location estimation function unit 33 may set a higher weight for an alarm with a higher importance and a lower weight for an alarm with a lower importance according to the alarm level, for example, setting the weight of a condition including a "critical" level alarm to 1.0, the weight of a condition including an "info" level alarm to 0.3, and the weight of a condition including an "ignored" level alarm to 0.0. This enables the fault location estimation function unit 33 to increase the confidence level of a device that satisfies the conditions including a critical alarm, and to more accurately estimate the true fault location.

[0042] That is, the fault location estimation device of this embodiment can present a more accurate true fault location to the maintenance person, thereby assisting the maintenance person in taking prompt action against a network fault.

[0043] As described above, according to the present embodiment, it is possible to provide a highly reliable failure location estimation device, method, and computer program for use in network service maintenance work.

[0044] Next, a fault location estimation device, method, and computer program according to a third embodiment will be described. In the fault location estimation device of this embodiment, the certainty factor calculated by the fault location estimation function unit 33 differs from those of the first and second embodiments.

[0045] In this embodiment, in formulas (1) and (2), the confidence level β for each condition included in the condition part of the rule is i The fault location estimation function unit 33 may calculate, for example, either the first or second certainty factor below as the certainty factor β for each condition in the above-mentioned formulas (1) and (2), i It can be adopted as.

[0046]

number

[0047] FIG. 6 is a diagram for explaining an example of the certainty factor for each condition employed in the failure location estimation device of the third embodiment. In FIG. 6, the horizontal axis represents the value of x and the vertical axis represents the value of the confidence, and the values ​​of the first confidence and the second confidence are shown when a is approximated to 0 and when a is 0.5.

[0048] The first certainty factor is a convex graph, and the value of the first certainty factor is high even when only a small number of alarms have occurred. The second certainty factor is a downward convex graph, and the value of the second certainty factor becomes higher when many alarms occur. The failure location estimation function unit 33 may calculate the certainty factor for each condition based on the number of alarm occurrences in accordance with the above characteristics of the first certainty factor and the second certainty factor.

[0049] For example, in the case of fault N shown in FIG. 3, the confidence level β i is the first certainty factor, the certainty factor of device X is 69.5%, and the certainty factor of device Y is 50%. In other words, since the certainty factor of device X, which is the true fault location, is higher, the fault location estimation device of this embodiment can present a more accurate true fault location to the maintenance person, thereby supporting the maintenance person in quickly dealing with the network fault. As described above, according to the present embodiment, it is possible to provide a highly reliable failure location estimation device, method, and computer program for use in network service maintenance work.

[0050] The present invention is not limited to the above-described embodiments, and various modifications can be made in the implementation stage without departing from the spirit of the invention. Furthermore, the embodiments may be implemented in appropriate combinations, in which case the combined effects can be obtained. Furthermore, the above-described embodiments include various inventions, and various inventions can be extracted by combining selected elements from the disclosed elements. For example, if the problem can be solved and the desired effect can be obtained even if some elements are deleted from all elements shown in the embodiments, the configuration from which these elements are deleted can be extracted as an invention. [Explanation of symbols]

[0051] 20...Monitoring device 30...Server 31...Data acquisition section 32...Rule learning control unit 33...Fault location estimation function unit 34...Countermeasure Management Functions 35...GUI section 36…API section 40...Display terminal 50...Rule generation device D1: Database of fault history and response history D2...Rule Database D3: Alarm information database D4: Network configuration information database

Claims

1. a database in which, for each failure, fault cause information including a fault cause, fault event group information characterizing the failure, relative position information of the fault cause location and a condition based on the fault event group information, and a rule associating a conclusion which is the fault cause information, the rule including a condition part including at least one of the conditions and a conclusion part including the conclusion when the condition part is true, are registered in association with each other; a network configuration information database in which network configurations including monitoring target devices are registered; a failure location estimation function unit that, when the failure occurs, calculates an average value of values ​​calculated for each condition using the number of monitored devices in which the failure event included in the condition of the corresponding rule has occurred and the total number of monitored target devices in which the failure event may occur, as a certainty that the monitored device is the cause of the failure.

2. 2. The fault location estimation device according to claim 1, wherein the certainty factor is an arithmetic mean value of values ​​calculated for each condition by dividing the number of monitored devices in which the fault event has occurred by the total number of monitored devices in which the fault event may occur.

3. 2. The fault location estimation device according to claim 1, wherein the certainty factor is a weighted average value calculated by weighting, for each condition, the number of the monitored devices in which the fault event has occurred for each condition, divided by the total number of the monitored devices in which the fault event may occur, using a weight set for each condition.

4. the relative position information with respect to the failure location includes information as to whether the failure location is the device itself or a connected device connected to the device itself; 4. The failure location estimation device according to claim 3, wherein the weight for the condition including the failure event occurring in the device itself is greater than the weight for the condition including the failure event occurring in the connected device.

5. 4. The fault location estimation device according to claim 3, wherein the weight value is a value set according to the level of the fault event.

6. 2. The failure location estimation device according to claim 1, wherein the value calculated for each condition is a value calculated using a nonlinear function with respect to the number of the monitored devices in which the failure event has occurred.

7. A computer comprising: registering, for each failure, failure cause information including a failure cause, failure event group information characterizing the failure, relative position information of the failure cause location and a condition based on the failure event group information, and a conclusion which is the failure cause information, the rule including a condition part including at least one of the conditions and a conclusion part including the conclusion when the condition part is true; registering a network configuration including the monitored device in a network configuration information database; a failure location estimation method, which calculates, as a certainty that the monitored device is the cause of the failure, an average value of values ​​calculated for each condition using the number of monitored devices in which the failure event included in the condition of the corresponding rule occurred and the total number of monitored devices in which the failure event may occur when the failure occurs.

8. A computer program causing a computer to carry out the method according to claim 7.

Images