Network failure estimation device, method, and program

Abstract

In one aspect of the present invention, when a failure corresponding to an alarm generated in a network is determined on the basis of a plurality of pieces of rule information created in advance to detect a failure, an alarm characteristic to be determined defined by the rule information is classified into a general-purpose alarm characteristic defined by a plurality of pieces of rule information and a feature alarm characteristic defined by a single piece of rule information, the matching rate of the alarm generated in the network with respect to the alarm characteristic defined by the rule information is derived separately for each of the general-purpose alarm characteristics and the feature alarm characteristic, and the failure is determined on the basis of the relationship between a first matching rate derived for the general-purpose alarm characteristic and a second matching rate derived for the feature alarm characteristic.

Description

Network failure estimation device, method and program

[0001] One aspect of the present invention relates to a network failure estimation device, method, and program for estimating the cause of a failure based on, for example, event information that has occurred in a network.

[0002] With the recent proliferation of IT services, network maintenance and management has become increasingly important for telecommunications carriers. In particular, when a network failure occurs, it is essential to identify the cause and quickly restore the network. However, as the use of IT technology has increased and the variety of network devices and services has increased, the technical level required of maintenance personnel has also increased. However, there is a shortage of experts in maintenance work, and it takes time to develop personnel with advanced maintenance skills.

[0003] To address this issue, a technique has been proposed that uses a rule engine to estimate faults based on event information (alarms) acquired by a monitoring system, with the aim of reducing the workload of network maintenance work. For example, one such technique predefines if-then rules for each fault case, with the if conditions being the "type of alarm" and the "locational relationship between the fault location and the alarm occurrence location," and then calculates the conformance rate for these rules to estimate the fault location and cause (see, for example, Patent Document 1 or Non-Patent Document 1). Using this technique, it becomes possible to autonomously estimate network faults, thereby eliminating the need for skilled maintenance staff and reducing workloads.

[0004] Japanese Patent No. 6637854

[0005] F. Asai et al., "Study on Autonomous Network Fault Estimation and Applicability Evaluation," IEICE Technical Report, vol. 122, no. 442, ICM2022-59, pp. 95-100.

[0006] However, if the conditions of a fault analysis rule define a general alarm characteristic, such as "Link Down," that occurs regardless of the type of fault, the matching rate for faults other than the actual fault may become high depending on the network configuration and alarm occurrence conditions, which may result in the actual fault not being detected. Also, even if a new fault occurs, if the occurrence conditions of a general alarm match the conditions of a registered rule and the matching rate becomes high, it will be impossible to determine whether the detected fault is an existing fault corresponding to the registered rule or a new fault, and ultimately the type of fault will have to be determined manually.

[0007] The present invention has been made in light of the above circumstances, and aims to provide a technique that makes it possible to detect original faults and new faults by distinguishing them from existing faults and the like.

[0008] In order to solve the above problems, one aspect of a network fault estimation device or estimation method according to the present invention is configured to, when estimating a fault corresponding to an alarm generated in a network based on a plurality of pieces of rule information created in advance to detect a fault, classify alarm characteristics to be determined, defined in the rule information, into general alarm characteristics defined in a plurality of pieces of rule information and characteristic alarm characteristics defined in a single piece of rule information, derive conformance rates of the alarm generated in the network with respect to the alarm characteristics defined in the rule information separately for the general alarm characteristics and the characteristic alarm characteristics, and estimate the fault based on the relationship between a first conformance rate derived for the general alarm characteristics and a second conformance rate derived for the characteristic alarm characteristics.

[0009] According to one aspect of the present invention, even if the rule information defines a general alarm characteristic that occurs frequently regardless of the type of fault, the conformance rate for the general alarm characteristic and the conformance rate for the characteristic alarm characteristic are derived separately, so that it is possible to reduce the influence of the general alarm and accurately determine the actual fault that caused the characteristic alarm. Furthermore, when a new fault occurs, it is possible to distinguish this new fault from existing faults and determine the type of fault autonomously without requiring human intervention.

[0010] That is, according to one aspect of the present invention, it is possible to provide a technology that makes it possible to detect original failures and new failures by distinguishing them from existing failures and the like.

[0011] FIG. 1 is a diagram showing an example of a network monitoring system according to an embodiment of the present invention. FIG. 2 is a block diagram showing an example of the hardware configuration of a network failure estimation device according to an embodiment of the present invention. FIG. 3 is a block diagram showing an example of the software configuration of the network failure estimation device according to an embodiment of the present invention. FIG. 4 is a flowchart showing an example of the processing procedure and processing content of the network failure estimation processing executed by the control unit of the network failure estimation device shown in FIG. 3. FIG. 5 is a diagram showing an example of the alarm characteristic classification processing among the procedures of the network failure estimation processing shown in FIG. 4. FIG. 6A is a diagram showing a failure occurrence case a in Example 1 of the present invention. FIG. 6B is a diagram showing a network configuration in failure occurrence case a shown in FIG. 6A. FIG. 6C is a diagram showing an example of a calculation result of the accuracy rate by alarm type in failure occurrence case a shown in FIG. 6A. FIG. 6D is a diagram showing a legend in FIG. 6B. FIG. 7A is a diagram showing a failure occurrence case b in Example 2 of the present invention. FIG. 7B is a diagram showing a network configuration in failure occurrence case b shown in FIG. 7A. FIG. 7C is a diagram showing an example of a calculation result of the accuracy rate by alarm type in failure occurrence case b shown in FIG. 7A. FIG. 8A is a diagram showing a failure occurrence case c in Example 3 of the present invention. FIG. 8B is a diagram showing a network configuration in failure occurrence case c shown in FIG. 8A. FIG. 8C is a diagram showing an example of calculation results of the conformance rate by alarm type in failure occurrence case c shown in FIG. 8A. FIG. 9 is a diagram showing a failure determination result based on the conformance rate shown in FIG. 6C. FIG. 10 is a diagram showing a failure determination result based on the conformance rate shown in FIG. 7C. FIG. 11 is a diagram showing a failure determination result based on the conformance rate shown in FIG. 8C. FIG. 12A is a diagram showing a failure occurrence case d in Example 4 of the present invention. FIG. 12B is a diagram showing an example of calculation results of the conformance rate by alarm type in failure occurrence case d shown in FIG. 12A and a failure determination result based on this conformance rate.

[0012] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0013] [One Embodiment] (Configuration Example) (1) System FIG. 1 is a diagram showing an example of a network monitoring system according to one embodiment of the present invention.

[0014] The network monitoring system of one embodiment monitors a network NW in which communication devices SWA to SWI are connected in a mesh pattern, and includes a network management server NM, a network monitoring device MS, a network failure estimation device CS, and a maintenance terminal TM.

[0015] Each of the communication devices SWA to SWI comprises a server, gateway, switch, router, etc., and is equipped with a communication card and port.

[0016] The network management server NM manages topology information that indicates the connection configuration of the communication devices SWA to SWI in the network NW.

[0017] The network monitoring device MS monitors the occurrence of failures in the communication devices SWA to SWI that constitute the network NW.

[0018] The maintenance terminal TM consists of, for example, a personal computer used by a maintenance person to operate the network NW, and transmits and receives various data related to network maintenance management between the network management server NM, the network monitoring device MS, and the network failure estimation device CS.

[0019] The network NW is composed of a wide area network such as the Internet and an access network for accessing this wide area network. The access network may be a wired or wireless local area network (LAN), an optical transmission network, or a mobile communication network that adopts the 5G standard.

[0020] (2) Network Failure Estimation Device CS FIGS. 2 and 3 are block diagrams showing an example of the hardware configuration and software configuration of the network failure estimation device CS, respectively.

[0021] The network failure estimation device CS is provided in a server computer located on the Web or on the cloud, for example.

[0022] The network failure estimation device CS comprises a control unit 1 having a hardware processor, and a memory unit having a program memory unit 2 and a data memory unit 3, and a communication I / F unit 4 connected to the control unit 1 via a bus 5.

[0023] The communication I / F unit 4 transmits and receives information data to and from the network management server NM, the network monitoring device MS, and the maintenance terminal TM in accordance with a communication protocol such as TCP / IP defined in the network NW.

[0024] The program storage unit 2 is, for example, a combination of a non-volatile memory such as a HDD (Hard Disk Drive) or SSD (Solid State Drive) as a storage medium that can be written to and read from at any time, and a non-volatile memory such as a ROM (Read Only Memory), and stores application programs necessary to execute various processes related to one embodiment of the present invention, in addition to middleware such as an OS (Operating System).

[0025] The data storage unit 3 is a combination of a non-volatile memory such as an HDD or SSD that can be written to and read from at any time, and a volatile memory such as a RAM (Random Access Memory), and its storage area includes a network configuration information storage unit 31, a rule information storage unit 32, and an alarm information storage unit 33.

[0026] The network configuration information storage unit 31 stores topology information representing the network configuration obtained from the network management server NM. The rule information storage unit 32 stores failure detection rules that are set in advance as If conditions of If-then rules. The alarm information storage unit 33 stores alarm information detected by the network monitoring device MS.

[0027] The control unit 1 includes, as processing functions necessary to realize one embodiment of the present invention, a network configuration information acquisition processing unit 11, an alarm characteristic classification processing unit 12, an alarm information acquisition processing unit 13, a conformance rate derivation processing unit 14, a fault judgment processing unit 15, and a fault information output processing unit 16.

[0028] Each of the processing units 11 to 16 is realized by causing a hardware processor in the control unit 1 to execute an application program stored in the program storage unit 2. Note that some or all of the processing units 11 to 16 may be realized using hardware such as an LSI (Large Scale Integration) or an ASIC (Application Specific Integrated Circuit).

[0029] The network configuration information acquisition processing unit 11 receives information representing the configuration of the network NW to be monitored from the network management server NM via the communication I / F unit 4, and stores the received network configuration information in the network configuration information storage unit 31.

[0030] The alarm characteristic classification processing unit 12 classifies alarm characteristics defined in the If section of the rule information stored in the rule information storage unit 32 into general alarm characteristics and characteristic alarm characteristics. General alarm characteristics are alarm characteristics that occur relatively frequently and are defined in multiple rules, such as a "Link Down" alarm. On the other hand, characteristic alarm characteristics are alarm characteristics that are defined in a single rule, such as an "abnormal temperature" or a "restart."

[0031] The alarm information acquisition processing unit 13 receives alarm information indicating a failure of the communication devices SWA to SWI detected by the network monitoring device MS from the network monitoring device MS via the communication I / F unit 4, and stores the received alarm information in the alarm information storage unit 33.

[0032] The relevance rate derivation processing unit 14 calculates the rate at which each piece of alarm information stored in the alarm information storage unit 33 conforms to the If condition of the fault detection rule, i.e., the alarm characteristics extracted from the alarm occurrence situation at the time of rule creation, by dividing the information into all alarm characteristics defined in the rule, general alarm characteristics, and characteristic alarm characteristics. An example of calculating the relevance rate will be explained in detail in the operation example.

[0033] The fault determination processing unit 15 determines the type of fault based on the conformance rate for the general alarm characteristic and the conformance rate for the feature alarm characteristic calculated for each rule by the conformance rate derivation processing unit 14. An example of this fault determination processing will also be described in the operation example.

[0034] The fault information output processing unit 16 transmits information indicating the fault determined by the fault determination processing unit 15 from the communication I / F unit 4 to, for example, the maintenance terminal TM.

[0035] (Example of Operation) Next, an example of operation of the network failure estimation device CS configured as above will be described.

[0036] FIG. 4 is a flowchart showing an example of the procedure and content of the fault estimation process executed by the control unit 1 of the network fault estimation device CS.

[0037] Prior to executing the failure estimation process, the control unit 1 of the network failure estimation device CS receives, from the network management server NM under the control of the network configuration information acquisition processing unit 11, information indicating the network configuration corresponding to the network NW that is the target of failure estimation, via the communication I / F unit 4. Then, the received network configuration information is stored in the network configuration information storage unit 31.

[0038] Note that fault detection rules set in advance as If conditions of If-then rules are stored in the rule information storage unit 32. The fault detection rules are generated, for example, manually by a maintenance person or automatically by a rule generation function provided in the maintenance terminal TM.

[0039] (1) Classification of Alarm Characteristics For example, suppose that a failure estimation request is transmitted from the maintenance terminal TM and this failure estimation request is detected by the control unit 1 of the network failure estimation device CS in step S1. Then, in step S2, under the control of the alarm characteristic classification processing unit 12, the control unit 1 of the network failure estimation device CS first performs a process of classifying alarm characteristics defined in the failure detection rules stored in the rule information storage unit 32.

[0040] For example, the alarm characteristic classification processing unit 12 reads fault detection rules one by one from the rule information storage unit 32. Then, for each fault detection rule read, the alarm characteristic defined in each If condition is determined to correspond to a general alarm characteristic or a specific alarm characteristic, and the classification result is added to the rule information and stored in the rule information storage unit 32. Note that the classification process can be performed by, for example, referring to a comparison table of alarm characteristics stored in advance in the rule information storage unit 32.

[0041] 5 shows an example of the classification results. In this example, for rules R1 and R2, "Link Down" defined in If1 is classified as a "general alarm," and "Temperature Abnormal (Danger)" and "Package Restart" defined in If2 are classified as "characteristic alarm properties."

[0042] The alarm characteristic classification processing unit 12 may classify the alarm characteristics defined in the If condition into only one of the general alarm characteristics and the characteristic alarm characteristics.

[0043] (2) Acquisition of Alarm Information Next, in step S3, the control unit 1 of the network failure estimation device CS, under the control of the alarm information acquisition processing unit 13, accesses the network monitoring device MS and receives, for example, alarm information generated during a time period specified by the failure estimation request, via the communication I / F unit 4. Then, the alarm information acquisition processing unit 13 stores the received alarm information in the alarm information storage unit 33.

[0044] The alarm information may be acquired periodically from the network monitoring device MS for a fixed period of time during a period when no failure estimation request is input, or may be acquired from the network monitoring device MS whenever a new alarm is detected in the network monitoring device MS.

[0045] (3) Calculation of conformance rate for alarm characteristics defined in rules Next, in step S4, under the control of the conformance rate derivation processing unit 14, the control unit 1 of the network fault estimation device CS calculates the proportion of conformance of the acquired generated alarm with the alarm characteristics defined in the If conditions of the fault detection rule for each of the all alarm characteristics, general alarm characteristics, and feature alarm characteristics defined in the If part of the rule.

[0046] For example, when the rule number is i and the node number indicating the location of the fault is j, the relevance ratio derivation processing unit 14 calculates the relevance ratio P all (i,j) and the accuracy rate P g (i,j) and the precision P c (i,j) and are calculated respectively.

[0047] This calculation is achieved by dividing the number of nodes where an alarm has occurred for each of the "All", "Generic", and "Feature" alarm characteristics in the If part of the rule by the number of nodes where an alarm may occur for each of the "All", "Generic", and "Feature" alarm characteristics in the If part of the rule.

[0048] First, the matching rate P all (i,j) (the overall accuracy of the rule) and P all When (i,j) > 0, the matching rate P g (i,j) and the precision P c (i,j) and P all When (i,j) = 0, P g (i,j) and P cIt is possible to avoid calculating (i,j).

[0049] (4) Fault Estimation Next, in step S5, the control unit 1 of the network fault estimation device CS, under the control of the fault determination processing unit 15, performs fault determination as follows.

[0050] That is, the fault determination processing unit 15 determines whether the type of fault is "existing" or "new" for each cause of rule j at fault occurrence location i in accordance with the following rules.

[0051] (4-1) When the If condition of the rule includes both general alarm characteristics and specific alarm characteristics, P g (i,j) >0 and P c If (i,j) > 0, it is determined to be an "existing fault". g (i,j) = 0 and P c If (i,j)>0, it is determined to be an "existing fault (general alarm missing)". g (i,j) >0 and P c If (i, j) = 0, it is determined to be a "new fault or existing fault (missing characteristic alarm)".

[0052] (4-2) When only general alarm characteristics are defined in the If condition of the rule (P g (i,j)>0) Determine as “new fault or existing fault (no characteristic alarm)”.

[0053] (4-3) When only the characteristic alarm characteristics are defined in the If condition of the rule (P c (i,j)>0) Determine as “existing fault”.

[0054] Then, the fault determination processing unit 15 passes the determination result of the existing fault or the new fault to the fault information output processing unit 16 .

[0055] (5) Output of Fault Determination Result Finally, in step S6, the control unit 1 of the network fault estimation device CS generates fault information based on the fault determination result output from the fault determination processing unit 15 under the control of the fault information output processing unit 16.

[0056] At this time, the fault information output processing unit 16 refers to the priority order that has been set in advance for each type of fault, selects a judgment result from the fault judgment results output from the fault judgment processing unit 15 in accordance with the priority order, and generates fault information based on the selected judgment result.

[0057] Furthermore, when there are multiple failures with the same ranking in different indices, the failure information output processing unit 16 may output these as the judgment results as they are, or may output judgment results in which the priorities have been reassigned based on other indices.Furthermore, the failure node numbers may be grouped by device, and the failure node with the highest alarm conformance rate for the rule, for example, may be output as the most likely candidate.

[0058] The fault information output processing unit 16 transmits the generated fault information from the communication I / F unit 4 to, for example, the maintenance terminal TM.

[0059] Next, as an example, several cases related to the occurrence of a fault will be taken as examples, and an example of a process for calculating the conformance rate for the alarm characteristics defined in the If section for each rule and determining the type of fault based on the calculation results will be described.

[0060] 6A to 6C show a case where a failure occurs in the card c2 of the communication device SWB, and FIG. 6D is a legend showing the names of the components of the network configuration shown in FIG. 6B.

[0061] As shown in Fig. 6A, assume that a card restart occurs in communication device SWB while communication devices SWA, SWB, SWC, and SWD are connected. In this case, as shown in the network configuration diagram of Fig. 6B, an alarm indicating the card restart is generated from card c2 of communication device SWB, and, influenced by the card restart, an alarm "Link Down" is generated from port P1 of adjacent communication device SWC.

[0062] When the information of each alarm is acquired, the control unit 1 of the network fault estimation device CS calculates the relevance P for all alarm characteristics for the rules R1 and R2 for each acquired alarm by the relevance ratio derivation processing unit 14. all (i,j) and the accuracy rate P g (i,j) and the precision P c Calculate (i,j) respectively.

[0063] FIG. 6C shows the relevance P of the detected alarms to the multiple alarm characteristics defined in the If part of the rules R1 and R2. all (i,j), P g (i,j), P c An example of the calculation result of (i,j) is shown below.

[0064] The control unit 1 of the network fault estimation device CS calculates the accuracy rate P g (i,j), P c Based on the calculation result of (i, j), the fault determination processing unit 15 determines whether the type of fault is an "existing fault" or a "new fault," and based on this determination result, the fault information output processing unit 16 generates and outputs fault information.

[0065] At this time, the fault information output processing unit 16 selects the fault type with the highest priority according to the priority order previously set for the fault type, and generates fault information corresponding to the selected fault determination result.

[0066] 9 shows an example of the result of determining the type of fault in case a. In this example, in rule R2 that defines "card restart", the matching rate P c (i,j) and the precision P for the general alarm characteristics g Since both (i, j) are > 0, it is determined to be an "existing fault." On the other hand, in the rule R1 that defines "server thermal abnormality," the matching rate P g Even if (i,j) is >0, the accuracy rate P cSince (i, j) = 0, it is determined to be a "new fault or existing fault (missing characteristic alarm)."

[0067] Then, among the results of the above-mentioned determinations of the malfunctions, malfunction information relating to the card malfunction that is set to a high priority is generated and output. For example, a message such as "A card malfunction has occurred in card C2 in communication device SWB" is generated and output as the malfunction information.

[0068] (Example 2) FIGS. 7A to 7C show a failure case b, that is, a case where a "dangerous temperature abnormality" occurs in the communication device SWB that is a server.

[0069] As shown in Fig. 7A, assume that communication devices SWA, SWB, SWC, SWD, and SWE are connected and a temperature abnormality due to heat generation occurs in communication device SWB, which is a server. In this case, as shown in the network configuration diagram of Fig. 7B, an alarm indicating a temperature abnormality (danger) is issued from communication device SWB. At the same time, a "Link Down" alarm is issued from port P1 of adjacent communication devices SWC and SWE connected to communication device SWB.

[0070] When the occurrence information of each of the above alarms is acquired, the control unit 1 of the network fault estimation device CS calculates, by the relevance rate derivation processing unit 14, the relevance rate P for all alarm characteristics for the rules R1 and R2 for each of the acquired alarms. all (i,j) and the accuracy rate P g (i,j) and the precision P c Calculate (i,j) respectively.

[0071] FIG. 7C shows the relevance ratio P of each of the detected alarms to the multiple alarm characteristics defined in the If part of rules R1 and R2. all (i,j), P g (i,j), P c An example of the calculation result of (i,j) is shown below.

[0072] Then, the control unit 1 of the network failure estimation device CS calculates the matching rate P g (i,j), Pc Based on the calculation result of (i, j), the fault determination processing unit 15 determines whether the type of fault is an "existing fault" or a "new fault", and based on this determination result, the fault information output processing unit 16 generates and outputs fault information. At this time, the fault information output processing unit 16 selects the fault type with the highest priority in accordance with the priority order previously set for the fault types, and generates fault information corresponding to the selected fault determination result.

[0073] 10 shows an example of the result of determining the type of failure in case b. In this example, in the rule R1 that defines "server thermal abnormality," the matching rate P c (i,j) and the precision P for the general alarm characteristics g Since both (i, j) are > 0, it is determined to be an "existing fault." On the other hand, in rule R2 that defines "card restart," the conformance rate P g Even if (i,j) is >0, the accuracy rate P c Since (i, j) = 0, it is determined to be a "new fault or existing fault (missing characteristic alarm)."

[0074] Then, among the results of the above-mentioned failure determinations, failure information regarding the server temperature abnormality that is set to a high priority is generated and output. For example, a message such as "A server thermal abnormality has occurred in the communication device SWB" is generated and output as the failure information.

[0075] (Example 3) Figs. 8A to 8C show case c of failure occurrence, that is, a case where a "new failure" occurs in a communication device.

[0076] As shown in Figure 8A, assume that communication devices SWA, SWB, SWC, and SWD are connected and the CPU usage rate in communication device SWB rises to a dangerous level. In this case, as shown in the network configuration diagram of Figure 8B, an alarm indicating an increase (danger) in the CPU usage rate is generated from communication device SWB. At the same time, a "Link Down" alarm is generated from each port P1 of adjacent communication devices SWA and SWC connected to communication device SWB.

[0077] When the occurrence information of each of the above alarms is acquired, the control unit 1 of the network fault estimation device CS calculates, by the relevance rate derivation processing unit 14, the relevance rate P for all alarm characteristics for the rules R1 and R2 for each of the acquired alarms. all (i,j) and the accuracy rate P g (i,j) and the precision P c Calculate (i,j) respectively.

[0078] FIG. 8C shows the relevance ratio P of each of the detected alarms to the multiple alarm characteristics defined in the If part of rules R1 and R2. all (i,j), P g (i,j), P c An example of the calculation result of (i,j) is shown below.

[0079] Then, the control unit 1 of the network failure estimation device CS calculates the matching rate P g (i,j), P c Based on the calculation result of (i, j), the fault determination processing unit 15 determines whether the type of fault is an "existing fault" or a "new fault", and based on the result of this determination, the fault information output processing unit 16 generates and outputs fault information. At this time, the fault information output processing unit 16 selects the fault type with the highest priority in accordance with the priority order set in advance for the fault types, and generates fault information corresponding to the selected fault determination result.

[0080] 11 shows the result of determining the type of fault in case c. In this example, in the rule R1 that defines "server thermal abnormality," the matching rate P g (i,j) is >0, but the accuracy rate P c Since (i, j) = 0, it is determined to be a "new fault or existing fault (missing characteristic alarm)." In addition, in the rule R2 that defines "card restart," the conformance rate P g (i,j) is >0, and the accuracy rate P cSince (i, j) = 0, it is determined to be a "new fault or existing fault (missing characteristic alarm)."

[0081] Then, among the above-mentioned fault determination results, fault information is generated and output for the determination result with the highest priority. For example, a message such as "There is a possibility of a new fault in the communication device SWB (there is a possibility of an existing fault such as a card restart or a server thermal abnormality, but the characteristic alarm is missing)" is generated and output as fault information.

[0082] Fourth Embodiment In the first to third embodiments, a case has been described in which a priority order is set in advance for each type of fault, and fault information is generated and output based on the determination result corresponding to the fault type with the highest priority order.

[0083] In contrast to this, in the fourth embodiment, not only the judgment result of the fault with the highest priority is selected, but also the judgment results of the faults with the second and subsequent priorities, and fault information with priorities assigned to each is generated and output.

[0084] FIG. 12A shows a failure case d, that is, a case where a "dangerous temperature abnormality" occurs in the communication device SWB that is a server.

[0085] 12A, assume that a temperature abnormality due to heat generation occurs in the communication device SWB, which is a server, while the communication devices SWA, SWB, SWC, SWD, SWE, and SWF are connected. In this case, an alarm indicating a temperature abnormality (danger) is generated from the communication device SWB, and a "Link Down" alarm is also generated from ports P1 of the adjacent communication devices SWC and SWF connected to the communication device SWB.

[0086] When the occurrence information of each of the above alarms is acquired, the control unit 1 of the network fault estimation device CS calculates, by the relevance rate derivation processing unit 14, the relevance rate P for all alarm characteristics for the rules R1 and R2 for each of the acquired alarms. all (i,j) and the accuracy rate P g (i,j) and the precision P c Calculate (i,j) respectively.

[0087] FIG. 12B shows the relevance P of each of the detected alarms to the multiple alarm characteristics defined in the If part of rules R1 and R2. all (i,j), P g (i,j), P c (i,j) is an example of the calculation result. In this example, the precision P all (i,j), P g (i,j), P c The calculation result of (i, j) is the same as the calculation result shown in the second embodiment.

[0088] The control unit 1 of the network fault estimation device CS calculates the accuracy rate P g (i,j), P c Based on the calculation result of (i, j), the fault determination processing unit 15 determines whether the type of fault is an "existing fault" or a "new fault." Then, the fault information output processing unit 16 generates and outputs fault information for each of the above determination results.

[0089] In this example, in the rule R1 that defines "server thermal abnormality," the matching rate P c (i,j) and the precision P for the general alarm characteristics g Since both (i, j) are > 0, it is determined to be an "existing fault." On the other hand, in rule R2 that defines "card restart," the conformance rate P g (i,j) is >0, but the accuracy rate P c Since (i, j) = 0, it is determined to be a "new fault or existing fault (missing characteristic alarm)."

[0090] Then, the fault determination processing unit 15 generates a message as fault information stating that "A server thermal abnormality has occurred in the communication device SWB" as the first priority, and generates a message as fault information stating that "Card C2 has failed in the communication device SWB" as the second priority, and outputs each of these.

[0091] (Effects) As described above, in one embodiment, the alarm characteristics defined in the If section of a fault detection rule are classified into general alarm characteristics defined by multiple rules and characteristic alarm characteristics defined by a single rule. In this state, when an alarm is generated in the network, in each fault detection rule, the conformance rate of the generated alarm with respect to the alarm characteristics defined in that rule is calculated separately for the classified general alarm characteristics and characteristic alarm characteristics. Then, based on the calculated conformance rate with respect to the general alarm characteristics and the conformance rate with respect to the characteristic alarm characteristics, it is determined whether the type of fault is an "existing fault" or a "new fault," and fault information corresponding to each of the determination results is generated and output in accordance with a predetermined priority order for the fault types.

[0092] Therefore, even if a rule defines a general alarm characteristic that occurs frequently regardless of the type of fault, such as "Link Down," the conformance rate for the general alarm characteristic and the conformance rate for the characteristic alarm characteristic are calculated separately, making it possible to reduce the influence of the general alarm and accurately determine the actual fault that caused the characteristic alarm. Also, when a new fault occurs, it becomes possible to distinguish this new fault from existing faults, which enables the network fault estimation device CS to autonomously determine the type of fault without requiring human intervention.

[0093] [Other Embodiments] (1) In one embodiment, the functions of the network failure estimation device are provided in a server computer on the Web or cloud, but they may also be provided in a network monitoring device or a maintenance terminal. Furthermore, the functions of the network failure estimation device may be distributed and provided in multiple server computers or personal computers.

[0094] (2) In addition, various modifications can be made to the type of network fault estimation device, the processing procedures and processing contents of each processing function provided by the network fault estimation device, the type of fault to be estimated, the contents of the conditions defined in the If section of the rule information, etc., without departing from the spirit of this invention.

[0095] Although the embodiments of the present invention have been described in detail above, the above description is merely an example of the present invention in every respect. It goes without saying that various improvements and modifications can be made without departing from the scope of the present invention. In other words, when implementing the present invention, specific configurations according to the embodiments may be appropriately adopted.

[0096] In short, this invention is not limited to the above-described embodiments, and in the implementation stage, the components can be modified and embodied without departing from the spirit of the invention. Furthermore, various inventions can be formed by appropriately combining multiple components disclosed in the above-described embodiments. For example, some components may be omitted from all the components shown in the embodiments. Furthermore, components from different embodiments may be appropriately combined.

[0097] CS...Network failure estimation device NM...Network management server MS...Network monitoring device TM...Maintenance terminal NW...Network SWA-SWI...Communication device 1...Control unit 2...Program storage unit 3...Data storage unit 4...Communication I / F unit 5...Bus 11...Network configuration information acquisition processing unit 12...Alarm characteristic classification processing unit 13...Alarm information acquisition processing unit 14...Conformance rate derivation processing unit 15...Failure judgment processing unit 16...Failure information output processing unit 31...Network configuration information storage unit 32...Rule information storage unit 33...Alarm information storage unit

Claims

1. A network fault estimation device that estimates a fault corresponding to an alarm generated in a network based on a plurality of rule information created in advance to detect a fault, comprising: a first processing unit that classifies alarm characteristics to be determined, defined in the rule information, into general alarm characteristics defined in a plurality of rule information and characteristic alarm characteristics defined in a single rule information; a second processing unit that acquires the alarm generated in the network; a third processing unit that derives conformance rates of the acquired alarms with respect to the alarm characteristics defined in the rule information, separately for the general alarm characteristics and the characteristic alarm characteristics; and a fourth processing unit that estimates the fault based on the relationship between the first conformance rate derived for the general alarm characteristics and the second conformance rate derived for the characteristic alarm characteristics.

2. The network fault estimation device described in claim 1, wherein the fourth processing unit determines the first precision rate and the second precision rate based on a preset threshold value, and estimates whether the fault is an existing fault or a new fault based on the relationship between the first judgment result for the first precision rate and the second judgment result for the second precision rate.

3. The network fault estimation device of claim 1, wherein the third processing unit derives an overall conformance rate for all alarm characteristics defined in the rule information, and, if the overall conformance rate is greater than a predetermined threshold, derives the first conformance rate for the general alarm characteristics and the second conformance rate for the characteristic alarm characteristics.

4. A network fault estimation device as described in claim 1, further comprising a fifth processing unit that, when multiple faults are estimated by the fourth processing unit, selects from the multiple faults a fault that satisfies a predetermined selection condition in accordance with a predetermined priority for each of the multiple faults, and generates and outputs information representing the selected fault.

5. A network fault estimation method in which an information processing device executes a process of estimating a fault corresponding to an alarm generated in a network based on a plurality of pieces of rule information created in advance to detect a fault, the network fault estimation method comprising: a step of classifying alarm characteristics to be determined, defined in the rule information, into general alarm characteristics defined in a plurality of pieces of rule information and characteristic alarm characteristics defined in a single piece of rule information; a step of acquiring the alarm generated in the network; a step of deriving conformance rates of the acquired alarms with respect to the alarm characteristics defined in the rule information separately for the general alarm characteristics and the characteristic alarm characteristics; and a step of estimating the fault based on the relationship between a first conformance rate derived for the general alarm characteristics and a second conformance rate derived for the characteristic alarm characteristics.

6. A program for causing a processor included in a network failure estimation device according to any one of claims 1 to 4 to execute at least one of the processes performed by the first to fourth processing units included in said network failure estimation device.

Images