Fault root cause localization method, electronic device, storage medium, and program product

Abstract

The present application relates to the field of device operation and maintenance, and discloses a fault root cause localization method, an electronic device, a storage medium, and a program product. The method comprises: constructing a fault record window chain on the basis of a plurality of collected anomaly events, wherein each time window node of the fault record window chain comprises the number of all anomaly events collected within a corresponding time window and the frequency of each anomaly event collected within the corresponding time window; on the basis of the fault record window chain, determining an anomaly event frequency, an inverse anomaly window frequency, and an inverse global anomaly event frequency of each anomaly event; determining an anomaly score of each anomaly event on the basis of the anomaly event frequency, the inverse anomaly window frequency, and the inverse global anomaly event frequency of each anomaly event; and performing fault root cause localization on the basis of the anomaly score of each anomaly event.

Description

Method for locating fault root cause, electronic device, storage medium and program product

[0001] Cross-reference

[0002] The present application claims priority to the Chinese patent application No. 202410779327.7, filed on June 17, 2024, and entitled "Method for locating fault root cause, electronic device, storage medium and program product", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0003] The present application belongs to the field of device operation and maintenance, and specifically relates to a method for locating fault root cause, an electronic device, a storage medium and a program product. BACKGROUND

[0004] With the continuous increase of network communication scale, the frequency of abnormality of network element devices in the network is also increasing. The current root cause positioning scheme for network element abnormality generally includes: first, manual root cause positioning, the operation and maintenance personnel analyze the abnormal data of the current network element, based on expert knowledge, use the rules set in the knowledge base or based on the past cases to guide the root cause positioning. The efficiency of manual root cause positioning is affected by the professional ability of the operation and maintenance personnel, and it is highly dependent on the quality of knowledge and has poor generalization. When the system configuration changes or the environment changes, the effect will be greatly discounted, resulting in long root cause analysis time and inaccurate root cause positioning. Second, root cause positioning based on graph model: use knowledge graph or learn the causal graph of the fault scene based on the correlation between abnormal indicators, and use random walk or heuristic search method to infer the root cause of the fault. This method generally only uses alarm data and cannot fully utilize the fine-grained data collected on the network element device, resulting in inaccurate root cause positioning. Third, data-driven root cause positioning, which adopts an end-to-end solution, extracts features based on fault scenarios, then inputs these features into a machine learning model, and finally determines the location of the root cause through the model output. This method needs to construct a large amount of data to train the model, cannot handle unknown fault types that have not been trained, and the results lack interpretability, resulting in inaccurate root cause positioning.

[0005] In summary, the above-mentioned related root cause positioning schemes all have the problem of inaccurate fault root cause positioning. SUMMARY

[0006] The present application provides a method for locating fault root cause, an electronic device, a storage medium and a program product.

[0007] In a first aspect, an embodiment of the present application provides a method for locating a fault root cause, the method comprising: constructing a fault record window chain based on collected abnormal events, wherein each time window node of the fault record window chain comprises a number of all abnormal events collected in a corresponding time window and a number of each abnormal event collected in the corresponding time window; determining abnormal event frequencies, inverse abnormal window frequencies and inverse global abnormal event frequencies of each abnormal event based on the fault record window chain; determining abnormal scores of each abnormal event according to the abnormal event frequencies, the inverse abnormal window frequencies and the inverse global abnormal event frequencies of each abnormal event; and locating the fault root cause according to the abnormal scores of each abnormal event.

[0008] In a second aspect, an embodiment of the present application provides a device for locating a fault root cause, the device comprising: a mobile phone module configured to construct a fault record window chain based on collected abnormal events, wherein each time window node of the fault record window chain comprises a number of all abnormal events collected in a corresponding time window and a number of each abnormal event collected in the corresponding time window; an analysis module configured to determine abnormal event frequencies, inverse abnormal window frequencies and inverse global abnormal event frequencies of each abnormal event based on the fault record window chain; a determination module configured to determine abnormal scores of each abnormal event according to the abnormal event frequencies, the inverse abnormal window frequencies and the inverse global abnormal event frequencies of each abnormal event; and a locating module configured to locate the fault root cause according to the abnormal scores of each abnormal event.

[0009] In a third aspect, an embodiment of the present application provides an electronic device, which comprises a processor, a memory, and a program or instructions stored in the memory and executable in the processor, and the program or instructions, when executed by the processor, implement the steps of the method according to the first aspect.

[0010] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores a program or instructions, and the program or instructions, when executed by a processor, implement the steps of the method according to the first aspect.

[0011] In a fifth aspect, an embodiment of the present application provides a computer program product, which comprises a computer program stored in a non-transitory computer readable storage medium, and the computer program comprises program instructions, and the program instructions, when executed by a computer, cause the computer to perform the steps of the method according to the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0012] FIG. 1 is a flow diagram of a method for locating a fault root cause according to an embodiment of the present application;

[0013] FIG. 2 is a structural diagram of a network element device according to an embodiment of the present application;

[0014] FIG. 3 is a software architecture diagram according to an embodiment of the present application;

[0015] FIG. 4 is an abnormal event diagram according to an embodiment of the present application;

[0016] FIG. 5 is a fault record window diagram according to an embodiment of the present application;

[0017] FIG. 6 is a flowchart of an information subscription process according to an embodiment of the present application;

[0018] FIG. 7 is a flowchart of a fault record window chain construction process according to an embodiment of the present application;

[0019] FIG. 8 is a structural diagram of a fault root cause positioning apparatus according to an embodiment of the present application;

[0020] FIG. 9 is a structural diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0022] The fault root cause positioning method, the electronic device, the storage medium and the program product provided by the embodiments of the present application will be described in detail below with reference to the drawings and specific embodiments and application scenarios.

[0023] FIG. 1 shows a fault root cause positioning method according to an embodiment of the present application, which can be executed by a network element device, which can include a router, a switch or the like. In other words, the method can be executed by software or hardware installed in the network element device, and the method includes the following steps:

[0024] Step 102: Based on the collected multiple abnormal events, a fault record window chain is constructed.

[0025] The method for locating a fault root cause provided in the embodiments of the present application is executed by a network element device. FIG. 2 shows a structural schematic diagram of a network element device provided in the embodiments of the present application, and FIG. 3 shows a software architecture schematic diagram provided in the embodiments of the present application. In combination with FIG. 2 and FIG. 3, the software architecture includes a data collection module, which mainly collects data through monitoring of hardware devices and communication with other devices through a communication interface. The data collection module sends the collected data to a processor, in which a data analysis module is arranged. The data analysis module judges the collected data for abnormalities, and writes abnormal events into an abnormal event storage module, corresponding to a memory in the hardware architecture. When the data analysis module triggers or receives a root cause locating process, the root cause analysis module in the processor is called, and the root cause analysis module completes analysis and calculation of a root cause according to the abnormal events in the abnormal event storage module, and arranges the root cause result and sends it to the abnormal event storage module.

[0026] In the embodiments of the present application, the abnormal event storage module and the root cause analysis module involve recording of abnormal events. Based on the collected various abnormal events, a fault record window chain is constructed. Each time window node of the fault record window chain includes the number of all abnormal events collected in a corresponding time window, and the number of each abnormal event collected in the corresponding time window. As shown in FIG. 4, the abnormal event chain and as shown in FIG. 5, the fault record window chain, the collected abnormal events can be recorded in the abnormal event chain, and the types of abnormal events are recorded in the abnormal event chain in chronological order. The fault record window chain is a linked list, and each node in the linked list records the time window number, the number of abnormal events collected in the time window (total number), and a hash table of each abnormal event and the corresponding number of times in the time window. In the fault record window chain, n represents the number of time windows, sum represents the number of abnormal events collected in the time window, i.e., the total number of abnormal events, and the abnormal map includes the abnormal event event and the number value corresponding to the abnormal event event.

[0027] Step 104: determining the abnormal event frequency, the inverse abnormal window frequency and the inverse global abnormal event frequency of each abnormal event based on the fault record window chain.

[0028] Specifically, after obtaining the fault record window chain, if the analysis process of root cause locating is triggered, it is necessary to determine the abnormal event frequency, the inverse abnormal window frequency and the inverse global abnormal event frequency of each abnormal event. The triggering condition can be in various ways, for example, the total number sum of abnormal events in the current time window exceeds a set threshold value, which is determined as the current device, or the abnormal device monitors a serious alarm event or a high-level abnormality of a specific KPI, or the system normal function is affected, and initiates a detection signal actively, or the upstream and downstream devices send a root cause locating instruction, and initiate detection actively.

[0029] In an implementation manner, the plurality of abnormal events includes a target abnormal event, and the determining of the abnormal event frequency, the inverse abnormal window frequency and the inverse global abnormal event frequency of each abnormal event based on the abnormal event chain table comprises: determining the abnormal event frequency of the target abnormal event according to the number of the target abnormal event in the current time window node and the number of all abnormal events in the fault record window chain; determining the inverse abnormal window frequency of the target abnormal event according to the number of time window nodes including abnormal events in the fault record window chain and the number of time window nodes including the target abnormal event in the fault record window chain; and determining the inverse global abnormal event frequency of the target abnormal event according to the number of abnormal events in the fault record window chain and the number of the target abnormal event in the fault record window chain.

[0030] In the root cause positioning process, the most important abnormal event needs to be found from a plurality of abnormalities in the fault record window chain, and therefore in the embodiment of the present application, the abnormal event frequency, the inverse abnormal window frequency and the inverse global abnormal event frequency of each abnormal event need to be obtained, and the most important abnormal event is determined based on the three.

[0031] The abnormal event frequency (EF, Event Frequency) indicates the proportion of a certain abnormal event in all abnormal events in the current time window, and the greater the proportion, the greater the possibility of being a root cause. In the fault operation and maintenance scenario, abnormalities often occur in large quantities and exponentially, and therefore the EF calculation is exponentially smoothed. The following takes the target abnormal event A as an example, and the specific calculation formula is as follows:

[0032] N is a hyperparameter, which aims to adjust the distribution of EF to a suitable range.

[0033] In addition, the target abnormal event frequency of the abnormal event can also be calculated by any one of the alternative formulas 1-4.

[0034] Alternative 1:

[0035] Alternative 2:

[0036] Alternative 3:

[0037] Alternative 4:

[0038] Inverse Window Frequency (IWF): represents the inverse of the proportion of a certain abnormal event in the past period, the smaller the proportion, the more rare the abnormality, the greater the value of root cause positioning in the current window, and the more likely it is the root cause. Compared with IDF, the inverse frequency has greater guiding significance in the operation and maintenance scene, and it can be tried to remove the exponential smoothing to guide the weight calculation in a linear form. Similarly, taking the target abnormal event A as an example, the specific calculation formula is as follows:

[0039] In addition, the inverse window frequency of the target abnormal event can also be calculated by any one of alternatives 5-7.

[0040] Alternative 5:

[0041] Alternative 6:

[0042] Alternative 7:

[0043] Inverse Global Event Frequency (IGEF): represents the inverse of the proportion of an abnormal event in the global abnormal event, some abnormalities appear very high in each window, or the reporting frequency of some alarms is very high, resulting in a high EF value, resulting in a high overall weight, here introduces a regular penalty to this part of the abnormality. Similarly, taking the target abnormal event A as an example, the specific calculation formula is as follows:

[0044] In addition, the inverse global abnormal event frequency of the target abnormal event can also be calculated by any one of alternatives 8-10.

[0045] Alternative 8:

[0046] Alternative 9:

[0047] Alternative 10:

[0048] The three frequencies proposed in the embodiments of the present application, event frequency (EF), inverse window frequency (IWF), and inverse global event frequency (IGEF), respectively calculate the proportion of a certain abnormal event in all abnormalities in the current time window, the inverse proportion of the occurrence of an abnormal event in a certain period of time in the past, and the ratio of the number of occurrences of all abnormalities in history and the number of occurrences of an abnormal event in history. Log smoothing terms, exponential smoothing terms, square root smoothing terms, or inverse smoothing terms can be added to the calculation methods of these three frequencies. At the same time, the three frequencies can be replaced in sequence, arranged and combined, discarded, or the formulas can be fused.

[0049] Step 106: determining the abnormal score of each abnormal event according to the event frequency, inverse window frequency, and inverse global event frequency of each abnormal event.

[0050] Specifically, after obtaining the event frequency, inverse window frequency, and inverse global event frequency of each abnormal event, the abnormal score of each abnormal event can be calculated.

[0051] In an implementation manner, the determining of the abnormal score of each abnormal event according to the event frequency, inverse window frequency, and inverse global event frequency of each abnormal event comprises:

[0052] The product of the event frequency, inverse window frequency, and inverse global event frequency of each abnormal event is determined as the abnormal score of each abnormal event.

[0053] Specifically, the product of the event frequency, inverse window frequency, and inverse global event frequency of each abnormal event can be determined as the abnormal score of each abnormal event. Taking a target abnormal event A as an example, the abnormal score Abn(A) of the target abnormal event A is calculated according to the following formula: Abn(A)=EF(A)*IWF(A)*IGEF(A)

[0054] Finally, the effect of calculating the abnormal score is as follows:

[0055] a. Common abnormality, appearing less in the current time window, appearing in most time windows, and we want to ignore the influence of this information: the EF value is small, the IWF value is small, the IGEF value is small, and the overall score is extremely small.

[0056] b. Common anomaly, appears frequently in the current time window, appears in most time windows, we hope its impact is small, but give a larger score than case a: EF value is larger, IWF value is smaller, IGEF value is smaller, overall weight is smaller.

[0057] c. Rare anomaly, appears less frequently in the current time window, appears in a very small number of time windows, we hope to increase the score of this part of the anomaly: EF value is smaller, IWF value is very large, IGEF value is very large, overall weight is larger

[0058] d. Rare anomaly, appears frequently in the current time window, appears in a very small number of time windows, we hope to increase the score of this part of the anomaly, larger than case C: EF value is larger, IWF value is very large, IGEF value is very large, overall weight is very large.

[0059] The process of calculating the score of an abnormal event is described in detail below. When an abnormality detection is triggered, first lock the time window of the current record, and traverse the abnormal event records in the time window to identify and collect the target abnormal event (event_A), and create a score set for each abnormal event. For each target abnormal event event_A, the following steps are performed:

[0060] Abnormal event frequency: Calculate the abnormal frequency EF of the event, which is obtained by logarithmic transformation of the probability of occurrence of the target abnormal event A relative to the total event, aiming to reflect the abnormality degree of the abnormal event A.

[0061] Historical data analysis: Initialize the counter to record the number of occurrences and the number of abnormalities of event_A in the current and all time windows. This step involves checking each time window to determine whether event_A appears and updating the statistics accordingly.

[0062] Inverse abnormal window frequency and global abnormal event frequency: Calculate the inverse abnormal window frequency IWF and the inverse global abnormal event frequency IGEF, the former reflects the rarity of event_A relative to other abnormal events, and the latter represents the proportion of the abnormal contribution of event_A relative to all abnormal events.

[0063] Comprehensive abnormal score calculation: Finally, the algorithm combines the above indicators to calculate the total abnormal score of event_A. This score is the product of the abnormal event frequency, the inverse abnormal window frequency and the inverse global abnormal frequency, which is used to measure the overall abnormality of event_A.

[0064] Through the above steps, not only the abnormal events in the current time window are considered, but also the context of the fault record window chain is integrated, making the scoring of each abnormal event more accurate and based on reason. It can better identify and respond to potential abnormal behavior, improving the effectiveness and sensitivity of anomaly detection.

[0065] Step 108: Locating the fault root cause according to the abnormal scores of each abnormal event.

[0066] Specifically, after obtaining the abnormal scores of each abnormal event, the root cause can be located according to the abnormal scores of each abnormal event.

[0067] In an implementation manner, the locating the fault root cause according to the abnormal scores of each abnormal event comprises: sorting the multiple abnormal events in descending order according to the abnormal scores of each abnormal event; determining the first pre-set number of abnormal events in the sorted abnormal events as key abnormal events; and locating the fault root cause from the fault information corresponding to the key abnormal events in the pre-set rule table.

[0068] Specifically, after obtaining the abnormal scores of each abnormal event, the multiple abnormal events can be sorted in descending order according to the abnormal scores of each abnormal event, and then the first pre-set number of abnormal events in the sorted abnormal events can be determined as key abnormal events; and then the fault root cause can be located from the fault information corresponding to the key abnormal events in the pre-set rule table. For example, the first pre-set number can be Top3 or Top4, and here the first pre-set number is not limited.

[0069] As an example, assuming that the Top3 abnormal events in the sorted abnormal events are abnormal event A, abnormal event B and abnormal event C, the abnormal event A, the abnormal event B and the abnormal event C can be determined as key abnormal events, and the fault information corresponding to the key abnormal events can be queried from the rule table according to the abnormal event A, the abnormal event B and the abnormal event C. At this time, the fault cause can be located from the fault information.

[0070] In addition, if a certain abnormal event is not recorded in the rule table, it is considered that this abnormal event is the direct root cause. Finally, the fault root cause, the common related abnormal event chain, the EF, IWF and IGEF scores of the first pre-set number of abnormal events, and the overall abnormal score are output as results for the maintenance personnel to troubleshoot, which can help the maintenance personnel to better verify and repair.

[0071] The method for locating a fault root cause provided by the embodiments of the present application can improve the accuracy of locating a fault root cause and solve the problem of inaccurate locating of a fault root cause by constructing a fault record window chain based on collected abnormal events, wherein each time window node of the fault record window chain includes the number of all abnormal events collected in a corresponding time window and the number of each abnormal event collected in the corresponding time window; determining the abnormal event frequency, inverse abnormal window frequency and inverse global abnormal event frequency of each abnormal event based on the fault record window chain; determining the abnormal score of each abnormal event according to the abnormal event frequency, inverse abnormal window frequency and inverse global abnormal event frequency of each abnormal event; and locating a fault root cause according to the abnormal score of each abnormal event.

[0072] The three abnormal frequency calculation mechanisms can distinguish the importance of abnormal events, and the frequency of unknown fault corresponding abnormal events in the past time window is less, so the IWF and IGEF scores are high, so the unknown fault corresponding abnormal events can be accurately identified when they occur. Moreover, the frequencies are weighted to obtain scores as the importance of abnormal events to determine which abnormal events are classified as key abnormal events, which can effectively filter the "noise" in the abnormal events and identify the "key abnormal events" in the root cause analysis. The frequency calculation mechanism can effectively identify unknown faults and has strong generality, which can be adapted to different device environments. Meanwhile, the mechanism of three different dimensional abnormal scores makes the root cause analysis report have stronger interpretability. The present application is a lightweight algorithm, which is friendly to run on network element devices. Compared with the graph-based or model-based method, the present application only needs to maintain the fault record window chain and calculate the abnormal score when the root cause locating process is triggered, without a large number of calculation operations, thereby reducing the consumption of the computing resources of the network element device.

[0073] In an implementation manner, before the step of constructing a fault record window chain based on the collected abnormal events, the method further includes: subscribing to key indicators, logs and alarms of a network element device; and determining abnormal key indicators, abnormal logs and abnormal alarms in the key indicators, logs and alarms as the abnormal events.

[0074] Specifically, by subscribing to key performance indicators (KPIs), logs and alarms of the network element device, a fault record window chain is constructed accordingly. As shown in FIG. 6, the KPIs, logs and alarms are subscribed to, and real-time stream data is extracted and counted. When the KPI data is determined to be an abnormal key indicator by an abnormality detection module, it is added to the abnormal event chain. Similarly, the log data is counted in real time under a set template, and when it exceeds the limit at a certain time, the abnormal log is written into the abnormal event chain. For the alarm data, after being accepted, it is directly arranged into an abnormal alarm of a unified format and written into the abnormal event chain. Then, the fault record window chain is constructed based on the abnormal event chain.

[0075] The three kinds of multi-modal information, i.e., KPI abnormal information, log abnormality and alarm information, are unified into abnormal event data, and an abnormal frequency calculation mechanism is used to sort the abnormal events. Finally, according to the sorting result, a set rule is used to realize accurate root cause positioning. The KPI abnormality, log abnormality and alarm event are unified, the operation and maintenance information on the network element device is fully utilized, and the efficiency of fault root cause positioning is improved.

[0076] In an implementation manner, at least one of the key indicators, logs and alarms of the network element device can be subscribed to; and abnormal data corresponding to the subscribed at least one of the key indicators, logs and alarms is determined as an abnormal event. For example, the key indicators and logs of the network element device can be subscribed to, and real-time stream data is extracted and counted. When the key indicator data is determined to be an abnormal key indicator by an abnormality detection module, it is added to the abnormal event chain. Similarly, the log data is counted in real time under a set template, and when it exceeds the limit at a certain time, the abnormal log is written into the abnormal event chain. As another example, the key indicators and alarms of the network element device can be subscribed to, and real-time stream data is extracted and counted. When the key indicator data is determined to be an abnormal key indicator by an abnormality detection module, it is added to the abnormal event chain. For the alarm data, after being accepted, it is directly arranged into an abnormal alarm of a unified format and written into the abnormal event chain. Then, the fault record window chain is constructed based on the abnormal event chain. In this way, the multi-modal information can be flexibly adjusted and unified into abnormal event data, the operation and maintenance information on the network element device can be flexibly utilized, and the efficiency of fault root cause positioning is improved.

[0077] In an implementation manner, the fault record window chain is constructed based on the collected multiple abnormal events, including: constructing an abnormal data chain based on time sequence according to the multiple abnormal events; segmenting the abnormal data chain according to the time window, and distributing the multiple abnormal events to corresponding time window nodes to obtain the fault record window chain.

[0078] Specifically, the three modalities of abnormal key indicators, abnormal logs and abnormal alarms are unified into a unified data form, and are collectively referred to as abnormal events. According to a plurality of abnormal events, an abnormal data chain based on time sequence is constructed; the plurality of abnormal events are distributed to corresponding time window nodes according to time windows, and the fault record window chain is obtained. For example, as shown in the flowchart of constructing a fault record window chain in FIG. 7, a global fault record window chain and a current time fault window are initialized, and the fault record window chain records abnormal events in a time T (including the total number of abnormal events in the time window, the map of the number of various abnormalities), and the abnormal events include KPI abnormal events, log abnormal events and alarm abnormal events. Every T time, the original window structure is stored in the head of the current chain table of the fault record window chain, as shown in FIG. 5. The window records the total number of abnormalities sum and the abnormal map. When an abnormality is pushed, the sum value is incremented by 1. The key of the current abnormality is queried in the abnormal map. If it is in the abnormal map, the value corresponding to the key is incremented by 1. If it is not in the abnormal map, the key value is added to the map and set to 1.

[0079] In an implementation manner, after the fault record window chain is obtained, the method further includes: in a case where the time window nodes of the fault record window chain are greater than a preset number, releasing the time window nodes after the preset number of time window nodes in the fault record window chain.

[0080] Specifically, in order to prevent the chain table from growing indefinitely, in a case where the time window nodes of the fault record window chain are greater than a preset number, the time window nodes after the preset number of time window nodes in the fault record window chain are released. For example, when the head of the window chain is updated each time, the current window ID is calculated. If the window ID is a multiple of 200, the time window chain is traversed, and the nodes after 100 chain table nodes are released.

[0081] It should be noted that the execution subject of the fault root cause positioning method provided in the embodiments of the present application can be a fault root cause positioning device, or a control module in the fault root cause positioning device for executing the fault root cause positioning method. In the embodiments of the present application, the fault root cause positioning device is taken as an example to illustrate the fault root cause positioning device provided in the embodiments of the present application.

[0082] FIG. 8 is a structural schematic diagram of a fault root cause positioning device according to an embodiment of the present application. As shown in FIG. 8, the fault root cause positioning device 800 includes a collection module 810, an analysis module 820, a determination module 830 and a positioning module 840.

[0083] The collection module 810 is configured to construct a fault record window chain based on the collected multiple abnormal events, wherein each time window node of the fault record window chain includes a number of all abnormal events collected in a corresponding time window and a number of each abnormal event collected in the corresponding time window; the analysis module 820 is configured to determine an abnormal event frequency, an inverse abnormal window frequency, and an inverse global abnormal event frequency of each abnormal event based on the abnormal event chain table; the determination module 830 is configured to determine an abnormal score of each abnormal event according to the abnormal event frequency, the inverse abnormal window frequency, and the inverse global abnormal event frequency of each abnormal event; and the positioning module 840 is configured to locate a fault root cause according to the abnormal score of each abnormal event.

[0084] In an implementation manner, the analysis module 820 is configured to determine an abnormal event frequency of the target abnormal event according to a number of the target abnormal event in a current time window node and a number of all abnormal events in the fault record window chain; determine an inverse abnormal window frequency of the target abnormal event according to a number of time window nodes including abnormal events in the fault record window chain and a number of time window nodes including the target abnormal event in the fault record window chain; and determine an inverse global abnormal event frequency of the target abnormal event according to a number of abnormal events in the fault record window chain and a number of the target abnormal event in the fault record window chain.

[0085] In an implementation manner, the determination module 830 is configured to determine a product of the abnormal event frequency, the inverse abnormal window frequency, and the inverse global abnormal event frequency of each abnormal event as the abnormal score of each abnormal event.

[0086] In an implementation manner, the collection module 810 is further configured to subscribe to key indicators, logs, and alarms of a network element device; and determine abnormal key indicators, abnormal logs, and abnormal alarms in the key indicators, the logs, and the alarms as the abnormal events.

[0087] In an implementation manner, the collection module 810 is configured to construct an abnormal data chain based on time sequence according to the multiple abnormal events; and segment the abnormal data chain according to the time window, to distribute the multiple abnormal events to corresponding time window nodes, to obtain the fault record window chain.

[0088] In an implementation manner, the positioning module 840 is configured to sort the multiple abnormal events in descending order according to the abnormal scores of the abnormal events; determine a preset number of abnormal events in the sorted abnormal events as key abnormal events; and locate a fault root cause from fault information corresponding to the key abnormal events in a preset rule table.

[0089] In an implementation manner, the positioning module 840 is further configured to release time window nodes after a preset number of time window nodes in the fault record window chain in a case where the number of time window nodes in the fault record window chain is greater than the preset number.

[0090] The fault root cause positioning apparatus in the embodiments of the present application can be an apparatus, or a component, an integrated circuit, or a chip in a terminal. The apparatus can be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, a tablet computer, a notebook computer, a palm computer, a vehicle-mounted electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc., and the non-mobile electronic device can be a server, a Network Attached Storage (NAS), a personal computer (PC), a television (TV), a teller machine, or a self-service machine, etc., and the embodiments of the present application are not limited in this regard.

[0091] The fault root cause positioning apparatus in the embodiments of the present application can be an apparatus with an operating system. The operating system can be an Android operating system, an ios operating system, or other possible operating systems, and the embodiments of the present application are not limited in this regard.

[0092] The fault root cause positioning apparatus provided in the embodiments of the present application can implement each process implemented by the method embodiments of FIGS. 1 to 7, and thus details are not repeated here.

[0093] As shown in FIG. 9, the embodiments of the present application further provide an electronic device 900, which includes a processor 901 and a memory 902, and the memory 902 has stored programs or instructions executable on the processor 901. When the programs or instructions are executed by the processor 601, the programs or instructions implement the following: based on collected multiple abnormal events, constructing a fault record window chain, wherein each time window node of the fault record window chain includes a number of all abnormal events collected in a corresponding time window, and a number of each abnormal event collected in the corresponding time window; based on the fault record window chain, determining an abnormal event frequency, an inverse abnormal window frequency, and an inverse global abnormal event frequency of each abnormal event; determining an abnormal score of each abnormal event according to the abnormal event frequency, the inverse abnormal window frequency, and the inverse global abnormal event frequency of each abnormal event; and performing fault root cause positioning according to the abnormal score of each abnormal event.

[0094] In an implementation manner, the abnormal event frequency of the target abnormal event is determined according to the number of the target abnormal event in the time window node and the number of all abnormal events in the fault record window chain; the inverse abnormal window frequency of the target abnormal event is determined according to the number of time window nodes including abnormal events in the fault record window chain and the number of time window nodes including the target abnormal event in the fault record window chain; and the inverse global abnormal event frequency of the target abnormal event is determined according to the number of abnormal events in the fault record window chain and the number of the target abnormal event in the fault record window chain.

[0095] In an implementation manner, the product of the abnormal event frequency, the inverse abnormal window frequency and the inverse global abnormal event frequency of each abnormal event is determined as the abnormal score of each abnormal event.

[0096] In an implementation manner, before the fault record window chain is constructed based on the collected multiple abnormal events, the key indicators, logs and alarms of the network element device are subscribed; and the abnormal key indicators, abnormal logs and abnormal alarms in the key indicators, the logs and the alarms are determined as the abnormal events.

[0097] In an implementation manner, the time-sequential abnormal data chain is constructed according to the multiple abnormal events; and the fault record window chain is obtained by segmenting the abnormal data chain according to the time window and distributing the multiple abnormal events to corresponding time window nodes.

[0098] In an implementation manner, the multiple abnormal events are sorted in descending order according to the abnormal scores of the abnormal events; the first preset number of abnormal events in the sorted abnormal events are determined as key abnormal events; and the fault root cause is located from the fault information corresponding to the key abnormal events in the preset rule table.

[0099] In an implementation manner, after the fault record window chain is obtained, if the number of time window nodes in the fault record window chain is greater than a preset number, the time window nodes after the preset number of time window nodes in the fault record window chain are released.

[0100] The specific implementation steps can refer to each step of the method for locating the fault root cause, and the same technical effects can be achieved. To avoid repetition, details are not described herein.

[0101] It should be noted that the electronic device in the embodiments of the present application includes a router, a switch or other devices other than the switch and the router.

[0102] The above electronic device structure does not constitute a limitation on the electronic device, which can include more or fewer components than those shown, or combine some components, or have different arrangements of components, for example, the input unit can include a Graphics Processing Unit (GPU), and the display unit can be configured in the form of a liquid crystal display, an organic light-emitting diode, etc. The user input unit includes at least one of a touch panel and other input devices. The touch panel is also referred to as a touch screen. The other input devices can include, but are not limited to, a physical keyboard, function keys (such as volume control keys, on-off keys, etc.), trackballs, mice, joysticks, and the like, which will not be described here.

[0103] The memory can be used to store software programs and various data. The memory can mainly include a first storage area storing programs or instructions and a second storage area storing data, wherein the first storage area can store an operating system, application programs or instructions required by at least one function (such as a sound playing function, an image playing function, etc.), and the like. In addition, the memory can include a volatile memory or a non-volatile memory, or the memory can include both volatile and non-volatile memories. The non-volatile memory can be a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically EPROM (EEPROM), or a flash memory. The volatile memory can be a Random Access Memory (RAM), a Static RAM (SRAM), a Dynamic RAM (DRAM), a Synchronous DRAM (SDRAM), a Double Data Rate SDRAM (DDR SDRAM), an Enhanced SDRAM (ESDRAM), a Synch link DRAM (SLDRAM), and a Direct Rambus RAM (DRRAM).

[0104] The processor can include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to an operating system, a user interface, and an application program, and the modem processor mainly processes a wireless communication signal, such as a baseband processor. It can be understood that the above-mentioned modem processor can also not be integrated into the processor.

[0105] The embodiment of the present application further provides a computer readable storage medium, which stores a program or instructions, and the program or instructions are executed by a processor to implement each process of the above-mentioned fault root cause positioning method embodiment and achieve the same technical effects. To avoid repetition, details are not described herein.

[0106] The processor is the processor in the electronic device described in the above-mentioned embodiment. The readable storage medium includes a computer readable storage medium, such as a ROM, a RAM, a magnetic disc, or an optical disc.

[0107] The embodiment of the present application further provides a computer program product, which includes a computer program stored on a non-transitory computer readable storage medium, and the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes each process of the above-mentioned fault root cause positioning method embodiment and achieves the same technical effects. To avoid repetition, details are not described herein.

[0108] It should be noted that, in this document, the terms "comprising", "including", or any other variant thereof are intended to cover non-exclusive inclusions, so that processes, methods, articles, or devices that include a series of elements not only include those elements, but also include other elements not explicitly listed, or include elements inherent to such processes, methods, articles, or devices. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article, or device that includes the element. In addition, it should be noted that the scope of the methods and devices in the present application is not limited to the order of performing functions as shown or discussed, but can also include performing functions in a substantially simultaneous manner or in a reverse order, for example, the described method can be performed in an order different from that described, and various steps can be added, omitted, or combined. In addition, the features described with reference to certain examples can be combined in other examples.

[0109] Through the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned example methods can be realized by means of software and a necessary general hardware platform, and of course, can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a computer software product in essence or in the form of a part that contributes to the prior art, which is stored in a storage medium (such as a ROM / RAM, a magnetic disk, or an optical disk) and includes a plurality of instructions for causing a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application.

[0110] The embodiments of the present application are described above in combination with the drawings, but the present application is not limited to the above-mentioned specific embodiments, and the above-mentioned specific embodiments are only illustrative and not restrictive. Those skilled in the art can make many forms under the inspiration of the present application without departing from the scope of the present application and the scope protected by the claims.

Claims

1. A method for locating the root cause of a fault, wherein, include: Based on the collected abnormal events, a fault record window chain is constructed, wherein each time window node of the fault record window chain includes the number of all abnormal events collected within the corresponding time window and the number of each abnormal event collected within the corresponding time window. Based on the fault record window chain, the abnormal event frequency, inverse abnormal window frequency, and inverse global abnormal event frequency of each abnormal event are determined. The abnormal score of each abnormal event is determined based on the abnormal event frequency, inverse abnormal window frequency, and inverse global abnormal event frequency of each abnormal event. The root cause of the failure is located based on the anomaly score of each of the aforementioned abnormal events.

2. The positioning method according to claim 1, wherein, The various abnormal events include target abnormal events. The step of determining the abnormal event frequency, inverse abnormal window frequency, and inverse global abnormal event frequency for each of the abnormal events based on the abnormal event linked list includes: The frequency of the target abnormal event is determined based on the number of the target abnormal events in the current time window node and the total number of all abnormal events in the fault record window chain. The inverse anomaly window frequency of the target anomaly event is determined based on the number of time window nodes in the fault record window chain that include the anomaly event and the number of time window nodes in the fault record window chain that include the target anomaly event. The inverse global anomaly frequency of the target anomaly event is determined based on the number of anomaly events in the fault record window chain and the number of the target anomaly events in the fault record window chain.

3. The positioning method according to claim 1, wherein, The step of determining the anomaly score of each anomaly event based on its anomaly event frequency, inverse anomaly window frequency, and inverse global anomaly event frequency includes: The product of the abnormal event frequency, the inverse abnormal window frequency, and the inverse global abnormal event frequency of each abnormal event is determined as the abnormal score of each abnormal event.

4. The positioning method according to claim 1, wherein, Before constructing the fault log window chain based on the collected multiple abnormal events, the following is also included: Subscribe to key metrics, logs, and alarms of network element devices; The abnormal key indicators, abnormal logs, and abnormal alarms in the key indicators, logs, and alarms are identified as the abnormal events.

5. The positioning method according to claim 1, wherein, The fault record window chain is constructed based on the collected various abnormal events, including: Based on the aforementioned multiple abnormal events, construct an abnormal data chain based on time sequence; The abnormal data chain is segmented according to the time window, and the various abnormal events are assigned to the corresponding time window nodes to obtain the fault record window chain.

6. The positioning method according to claim 1, wherein, The step of locating the root cause of the fault based on the anomaly score of each of the aforementioned abnormal events includes: The various abnormal events are sorted in descending order according to their abnormality scores. The first preset number of abnormal events among the sorted abnormal events are identified as critical abnormal events; The root cause of the fault is located from the fault information corresponding to the key abnormal events in the preset rule table.

7. The positioning method according to claim 5, wherein, After obtaining the fault record window chain, the method further includes: If the number of time window nodes in the fault record window chain exceeds a preset number, release the time window nodes after the preset number of time window nodes in the fault record window chain.

8. An electronic device, wherein, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the fault root cause localization method as described in any one of claims 1-7.

9. A computer-readable storage medium, wherein, The computer-readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the fault root cause localization method as described in any one of claims 1-7.

10. A computer program product, wherein, The computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions that, when executed by a computer, cause the computer to perform the steps of the fault root cause localization method as described in any one of claims 1-7.

Images