JP2006059266A - Failure analysis method and device therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a failure analysis method and a device therefor capable of easily analyzing a failure which has occurred in an operation system and a network component in a short time. <P>SOLUTION: With respect to each function of the operation system, normal patterns in which processing sequences of a plurality of components and network components constituting the operation system in normal operation are patterned as time-series arrangements of component names and network component names and abnormal patterns in which they are patterned as time-series arrangements of component names and network component names in failures which occurred in the past are held. The processing sequence of a function in which failure occurs is extracted as a time-series arrangement of component names and network component names from the histories of processing the plurality of components and network components uniquely acquired to form a retrieval pattern, and the retrieval pattern of the function with failure is collated with the normal patterns and abnormal patterns held as a function corresponding to the function with failure to analyze the failure. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a failure analysis method and apparatus, and more particularly, to a failure analysis method and apparatus when a failure occurs in an operation system that controls network components including a transmission apparatus.

  2. Description of the Related Art Conventionally, network components such as transmission devices and routers constituting a network are managed and controlled by an operation system.

FIG. 1 is a block diagram illustrating an example of an operation system. In the figure, the operation system acquires / sets necessary information in response to requests from the GUI unit 10 and the GUI unit 10 having a plurality of GUI (Graphical User Interface) terminals 10 ₁ to 10 _N that perform screen display and operation. Control unit 12 that performs sequence management for executing the requested processing, basic unit 14 that makes a command request to a plurality of transmission devices 22 _{1 to} 22 _M constituting the control of the database and network 20, transmission It is composed of a plurality of components such as a communication unit 16 that performs transmission / reception management of information between the apparatus and the operation system, and a monitoring unit 18 that manages alarms, manages the state of transmission devices, and the like.

  Here, when the maintenance person performs control using the GUI terminal, in the operation system, the GUI unit 10 first, then the control unit 12, the basic unit 14, the communication unit 16,. Do. At that time, each component records and manages its own history at the timing of processing.

  When a failure occurs, the maintenance person analyzes the history of the GUI unit 10 to determine whether the GUI unit 10 is performing normal processing, that is, whether a normal value is set and passed to the next component, etc. Check. Next, the maintenance person analyzes the history of the control unit 12 and confirms whether the control unit 12 is performing normal processing. In this way, the location where the failure has occurred is identified by following the flow of processing and analyzing all the history from the GUI unit 10 to the communication unit 16 in order.

  In Patent Document 1, an equipment model for using a user service in which a failure is declared is created, a communication sequence when each service component constituting the equipment model fails, and each communication sequence and It describes that the service component that failed is estimated by comparing the observation information at the time of failure declaration.

  Japanese Patent Laid-Open No. 2004-228620 holds the procedure of setting commands transmitted and received between the operation system and the network element and operation maintenance information as detailed log data, and stores the contents of the device configuration information and setting information in the configuration database. It is described.

Further, Patent Document 3 models a situation in which an event of an arbitrary network element is generated in another network element, and when a failure occurs in a certain network element, the failure propagation model is traced from the failure event, Searching for is described.
Japanese Patent Laid-Open No. 10-200527 JP 2002-318736 A JP 07-245609 A

  The history acquisition method as in the prior art can acquire the history of each processing content, but cannot acquire the history in which the processing of the entire operation system is recorded. In addition, when it is known in advance at which part the problem has occurred at the time of failure, it is easy to analyze because the history is acquired, but in which part the problem has occurred in advance When it is not known, it is necessary to analyze all the histories in order, which requires a lot of man-hours for the analysis.

  In addition, the log acquisition format acquired by each component is a factor that requires a large amount of man-hours for analysis because information to be acquired by each component is mixed and cannot be shared. Further, since the number of components constituting the system increases as the scale of the system increases, the types of logs to be acquired and the acquisition amount increase, and there is a problem that problem analysis increases in complexity.

  Since the situation where such a problem occurs is an emergency in most cases, in many cases, the customer is not allowed to spend a lot of time for analysis in order to correct the problem early.

  The present invention has been made in view of the above points, and an object of the present invention is to provide a failure analysis method and apparatus that can easily and quickly analyze a failure that has occurred in an operation system and network components.

The invention according to claim 1 is an operation system failure analysis method for controlling and monitoring each of a plurality of network components constituting a communication network system.
For each function of the operation system, a normal pattern in which processing sequences of a plurality of components and network components constituting the operation system when operating normally are patterned as a time series of component names and network component names , Keep the anomaly pattern patterned as a chronological sequence of component names and network component names in past failures,
Create a search pattern by extracting the processing sequence of the function in which the failure occurred from the history of processing acquired independently by each of the plurality of components and network components as a time series of component names and network component names. ,
An operation system and a network component by performing a failure analysis by collating the search pattern of the function in which the failure has occurred with the normal pattern and the abnormal pattern held as a function corresponding to the function in which the failure has occurred Can be analyzed in a short time and easily.

The invention according to claim 2 is the failure analysis method according to claim 1,
The history of processing that each of the plurality of components and network components has independently acquired can be easily searched by sharing the name of the network component to be processed, the date and time of acquisition, and the format of the processing content. Can be created.

According to a third aspect of the present invention, there is provided a failure analysis apparatus for an operation system that controls and monitors each of a plurality of network components constituting a communication network system.
For each function of the operation system, a normal pattern in which processing sequences of a plurality of components and network components constituting the operation system when operating normally are patterned as a time series of component names and network component names A pattern holding means for holding an abnormal pattern patterned as a time-series arrangement of component names and network component names in a failure that has occurred in the past;
A processing pattern of a function in which a failure has occurred is extracted as a time-series sequence of component names and network component names from the processing history independently acquired by each of the plurality of components and network components, and a search pattern is created. Search pattern creation means;
An operation system comprising collating means for collating the search pattern of the function in which the fault has occurred with the normal pattern and the abnormal pattern held as a function corresponding to the function in which the fault has occurred to perform fault analysis In addition, a failure occurring in the network component can be analyzed easily in a short time.

The invention according to claim 4 is the failure analysis apparatus according to claim 3,
The history of processing that each of the plurality of components and network components has independently acquired can be easily searched by sharing the name of the network component to be processed, the date and time of acquisition, and the format of the processing content. Can be created.

The invention according to claim 5 is the failure analysis apparatus according to claim 3 or 4,
It is assumed in advance by having additional holding means for additionally holding the search pattern as a new abnormal pattern in the pattern holding means when the result of matching between the search pattern and the normal pattern and the abnormal pattern in the matching means does not match. Even if a new abnormality that could not be made occurs thereafter, if the same abnormality occurs, a quick response can be made.

  According to the present invention, a failure occurring in an operation system and a network component can be analyzed in a short time and easily.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

FIG. 2 shows a block configuration diagram including an operation system for explaining an embodiment of the failure analysis method of the present invention. In the figure, the operation system obtains / sets necessary information in response to requests from the GUI unit 30 and the GUI unit 30 having a plurality of GUI (Graphical User Interface) terminals 30 ₁ to 30 _N that perform screen display and operation. Control unit 32 that performs sequence management for executing the requested processing, basic unit 34 that performs a command request to a plurality of transmission devices 42 _{1 to} 42 _M constituting the control of the database and the network 40, transmission It is composed of a plurality of components such as a communication unit 36 that performs transmission / reception management of information between the device and the operation system, and a monitoring unit 38 that manages alarms, manages the state of transmission devices, and the like.

The GUI unit 30 records and manages the history in the GUI history 31 each time processing is performed, the control unit 32 records and manages the history in the control unit history 33 every time processing is performed, and the basic unit 34 performs processing. Is recorded and managed in the basic unit history 35, the communication unit 36 records and manages the history in the communication unit history 37 every time processing is performed, and the monitoring unit 38 performs each processing. The history is recorded in the monitoring unit history 39 and managed. Each of the transmission apparatuses 42 _{1 to} 42 _M records and manages the history in each of the transmission apparatus histories 43 ₁ to 43 _M each time processing is performed.

At this time, each component and transmission apparatus records header information added to the beginning of the history. FIG. 3 shows an embodiment of the header in the GUI history 31. In the figure, the header is set with the date and time of processing, the target device, which is the transmission device number to be processed, and the processing content indicating what processing has been performed. A header identifier such as “##” is provided at the head of each header. The header information of each of the control unit history 33, the basic unit history 35, the communication unit history 37, the monitoring unit history 39, and the transmission device history 43 ₁ to 43 _M is the same as that of the GUI history 31 of FIG.

The history analysis unit 44 illustrated in FIG. 2 accesses the GUI history 31, the control unit history 33, the basic unit history 35, the communication unit history 37, the monitoring unit history 39, and the transmission device history 43 ₁ to 43 _M , for example, when a failure occurs. Then, a search pattern is created by extracting header information related to the processing target and arranging them in time series. Then, the search pattern is matched (matched) with the sequence pattern registered in the database 46 to determine normality / abnormality.

  The database 46 stores a sequence pattern in which processing of functions (control) provided as a system in the operation system is patterned. As shown in FIG. 4, the sequence pattern includes a function name, a target device number 1, a target device number 2 (because some devices control a plurality of devices), a history name (component name and (Transmission device name), processing contents, and sequence number are recorded, and a normal pattern generated in advance for each function and one or a plurality of abnormal patterns that occurred in the past are stored. Furthermore, the problem pattern, the cause of failure, the coping method, etc. can be arbitrarily recorded in the abnormal pattern.

  In the history analysis unit 44, when the search pattern matches with the normal pattern, the processing of the function is normal. When the search pattern matches with the abnormal pattern, the problem summary recorded in the abnormal pattern, the cause of the failure, and the countermeasure By referring to the above, it becomes possible to immediately respond to the maintenance work.

Here, FIG. 5 shows a processing sequence in the case where PKG registration for enabling use by mounting a package on the transmission device 42 ₁ (# 1) is performed and the processing is normally completed.

In FIG. 5, the GUI unit 30 makes a PKG registration request (1). The numbers in parentheses indicate sequence numbers. Next, the control unit 32 sets parameters for the PKG registration request (2) and notifies the basic unit 34 of the PKG registration request (3). The basic unit 34 notifies the PKG registration request to the communication unit 36 (4), the communication unit 36 notifies the PKG registration request to the transmission apparatus 42 ₁ (5).

The transmission device 42 ₁ performs a PKG registration (6), the response of PKG registration (7). The communication unit 36 notifies the basic unit 34 of the PKG registration response (8). The basic unit 34 registers the PKG registration response in its own database (9), and notifies the control unit 32 of the PKG registration response (10). The control unit 32 notifies the PKG registration response to the GUI unit 30 (11), and the GUI unit 30 displays the PKG registration result (12).

Then, when the alarm in the transmission device 42 ₁ is generated (13), the communication unit 36 notifies the alarm to the basic unit 34 (14). The basic unit 34 notifies the alarm to the monitoring unit 38 (15), and the monitoring unit 38 registers the alarm in its own database (16), and notifies the GUI unit 30 of the alarm (17). The GUI unit 30 displays an alarm (18).

When the processing sequence shown in FIG. 5 is executed, the sequence pattern shown in FIG. 6 is generated and stored in the database 46 as a normal pattern. Further, when the PKG registration processing sequence shown in FIG. 5 is performed, the history of the GUI unit 30 is shown in three records of the date and time (2004/05/06/20: 00: 00) in FIG. FIG. 3 shows a case where the PKG registration of the transmission device 42 ₁ (# 1) is performed twice consecutively after the PKG deletion of the transmission device 42 ₂ (# 2) is performed.

  FIG. 7 shows a flowchart of processing executed by the history analysis unit 44. In step S10, analysis information is designated. As the analysis information, the target device number, the function name, and the implementation time (start date and end date) are input, and additional information may be specified in addition to this.

In step S12, the history analysis unit 44 accesses the GUI history 31, the control unit history 33, the basic unit history 35, the communication unit history 37, the monitoring unit history 39, and the transmission device history 43 ₁ to 43 _M , and the target device analyzes information. Header information whose date and time is within the implementation time (start date and end date and time) of the analysis information is extracted and arranged in chronological order so that the date and time of the extracted header information are in ascending order. A list of history names corresponding to (ie, read out) history information arranged in time series is extracted as a search pattern.

  Next, in step S14, the search pattern is compared with a normal pattern corresponding to the target device number and function name stored in the database 46, and in step S16, it is determined whether or not the search pattern matches the normal pattern. If the search pattern matches the normal pattern, the processing within the implementation time for the target device number and function name is normal, and this processing ends.

  On the other hand, if the search pattern does not match the normal pattern, one abnormal pattern corresponding to the target device number and function name stored in the database 46 in step S20 is selected and the search pattern is selected. In step S22, it is determined whether or not the search pattern matches the abnormal pattern. If the search pattern matches the abnormal pattern, the failure location is identified in step S24 with reference to the problem summary, the cause of the failure, the countermeasure, and the like recorded in the abnormal pattern.

  If the search pattern does not match the abnormal pattern in step S22, it is determined in step S26 whether or not there is another abnormal pattern that has not been verified, and other abnormal patterns that have not been verified yet. If there is, another abnormal pattern is selected in step S28, the process proceeds to step S20, and steps S20 to S26 are repeated.

  If there is no other abnormal pattern that has not been collated in step S26, the search pattern is stored in the database 46 as a new abnormal pattern corresponding to the target device number and the function name in step S30, and the process is terminated. The problem summary of the new abnormal pattern, the cause of the failure, the countermeasures, etc. are recorded after further analysis of the new abnormal pattern.

  Here, the database 46 stores the pattern shown in FIG. 8A as the normal pattern in the PKG registration of the transmission apparatus, and stores the pattern shown in FIG. 8B as the first abnormal pattern in the PKG registration of the transmission apparatus. Assume that the pattern shown in FIG. 8C is stored as the second abnormal pattern in the PKG registration of the transmission apparatus.

When the PKG registration of the transmission device 42 ₁ (# 1) has been performed but terminated abnormally, the history analysis unit 44 performs the process of FIG. 7, and the search pattern shown in FIG. 9 is obtained in step S12. The search pattern does not match the normal pattern in FIG. 8A in step S16. Further, although it does not match the abnormal pattern shown in FIG. 8B in step S22, it matches the abnormal pattern shown in FIG. 8C in step S22 again. Therefore, in step S24, an abnormality diagnosis is made to the effect that a timeout abnormality has occurred in the transmission device 42 ₁ (# 1).

  In this way, the history names of the search pattern and the normal or abnormal pattern are sequentially compared and analyzed sequentially, eliminating the need to compare all the information in the pattern and identifying when it is normal or when a failure occurs. It can be performed at high speed.

  By the way, the maintenance person prioritizes a plurality of abnormal patterns as shown in FIGS. 8B and 8C for each target device number and function name. For example, the highest priority priority 1 abnormality pattern is 3 patterns, the priority 2 abnormality pattern is 3 patterns, and the priority 3 abnormality pattern is 5 patterns. Then, priority n is designated as additional information in step S10 in FIG. 7, abnormal patterns are selected in order from priority 1 in steps S14 and S28, and the search pattern and abnormal pattern are selected until the priority reaches priority n. The collation is terminated when the priority order exceeds the priority n.

  In this case, as shown in FIG. 10, even when there are 20 abnormal patterns for a certain target device number and function name, if priority n = 2 is designated, for example, up to priority order 2 is obtained. The pattern abnormal pattern is matched with the search pattern. Thus, it is possible to perform a simple failure analysis by defining the number of abnormal patterns used for collation.

  Further, instead of the priorities being assigned in advance to the abnormal patterns for each target device number and function name, the number of times that the search pattern matches the search pattern is counted for each abnormal pattern. Note that when the abnormal pattern is registered in the database 46, the count value is zero. Prior to starting the processing of FIG. 7, priorities are given in order from the abnormal pattern having the highest number of matches (frequency) with the search pattern. That is, priority order 1 is assigned to the abnormal pattern having the highest search matching frequency, priority order 2 is assigned to the second abnormal pattern having the search matching frequency, and priority order 3 is assigned to the abnormal pattern having the third search matching frequency.

  In this case, as shown in FIG. 11, there are 20 abnormal patterns for a certain target device number and function name, the number of matching matches of the first abnormal pattern is 1, and the number of matching matches of the second abnormal pattern. Is 5, the number of matching matches of the third abnormal pattern is 2, and the number of matching matches of the remaining abnormal patterns is 0. If priority n = 3 is designated, the second abnormal pattern is searched first. Matches against a pattern. If this does not match, the third abnormal pattern is checked against the search pattern, and if not, the first abnormal pattern is checked against the search pattern.

  In this way, since the number of matching matches is large, that is, matching is performed with the search pattern in order from the abnormal pattern having the highest probability of matching, the time required for failure analysis can be shortened.

  According to the present invention, when the search pattern matches the normal pattern, the process is normal, and when the search pattern matches the abnormal pattern that has occurred in the past and is managed as a history, the failure factor can be specified by the abnormal pattern. An appropriate countermeasure can be promptly notified to a maintenance person. As a result, in the past, a maintenance person who spent 2-3 days of analysis time per failure can perform failure analysis on the order of minutes, for example. Furthermore, it is possible not only to minimize the in-house resources injected when a failure occurs, but also to satisfy customer requests for an early solution of the failure.

  Even if the search pattern does not match the normal pattern and all the abnormal patterns, the search pattern is retained and managed as a new pattern, so that it is possible to deal with new abnormalities that could not be assumed in advance. Thereafter, when the same abnormality occurs, a quick response is possible.

The database 46 corresponds to the pattern holding means described in the claims, step S12 corresponds to the search pattern creating means, steps S14 and S20 correspond to the collating means, and step S30 corresponds to the additional holding means.
(Appendix 1)
In an operation system failure analysis method for controlling and monitoring each of a plurality of network components constituting a communication network system,
For each function of the operation system, a normal pattern in which processing sequences of a plurality of components and network components constituting the operation system when operating normally are patterned as a time series of component names and network component names , Keep the anomaly pattern patterned as a chronological sequence of component names and network component names in past failures,
Create a search pattern by extracting the processing sequence of the function in which the failure occurred from the history of processing acquired independently by each of the plurality of components and network components as a time series of component names and network component names. ,
A failure analysis method, wherein a failure analysis is performed by collating a search pattern of a function in which the failure has occurred with the normal pattern and an abnormal pattern held as a function corresponding to the function in which the failure has occurred.
(Appendix 2)
In the failure analysis method described in Appendix 1,
The history of processing acquired independently by each of the plurality of components and network components is a failure analysis characterized by sharing the name of the network component to be processed, the date and time of acquisition, and the format of the processing content. Method.
(Appendix 3)
In an operation system failure analysis apparatus that controls and monitors each of a plurality of network components constituting a communication network system,
For each function of the operation system, a normal pattern in which processing sequences of a plurality of components and network components constituting the operation system when operating normally are patterned as a time series of component names and network component names A pattern holding means for holding an abnormal pattern patterned as a time-series arrangement of component names and network component names in a failure that has occurred in the past;
A processing pattern of a function in which a failure has occurred is extracted as a time-series sequence of component names and network component names from the processing history independently acquired by each of the plurality of components and network components, and a search pattern is created. Search pattern creation means;
It has collation means for collating the search pattern of the function in which the failure has occurred with the normal pattern and the abnormal pattern held as a function corresponding to the function in which the failure has occurred, and performing failure analysis Failure analysis device.
(Appendix 4)
In the failure analysis device according to appendix 3,
The history of processing acquired independently by each of the plurality of components and network components is a failure analysis characterized by sharing the name of the network component to be processed, the date and time of acquisition, and the format of the processing content. apparatus.
(Appendix 5)
In the failure analysis apparatus according to appendix 3 or 4,
And an additional holding means for additionally holding the search pattern as a new abnormal pattern in the pattern holding means when the result of matching between the search pattern and the normal pattern and the abnormal pattern in the matching means is inconsistent. Failure analysis device.
(Appendix 6)
In the failure analysis apparatus according to any one of appendices 3 to 5,
Prioritize each abnormal pattern held for each function in the pattern holding means,
The failure analysis apparatus characterized in that the collating means collates with the search pattern in order from an abnormal pattern having a high priority.
(Appendix 7)
In the failure analysis apparatus according to appendix 6,
Prioritize each abnormal pattern held for each function in the pattern holding means,
The failure analysis apparatus characterized in that the collating means collates with the search pattern in order from an abnormal pattern having a higher priority, and ends the collation when the priority of the abnormal pattern becomes lower than the priority specified as additional information.
(Appendix 8)
In the failure analysis apparatus according to any one of appendices 3 to 5,
Holds the frequency of matching with the search pattern for each abnormal pattern held for each function in the pattern holding means,
The failure analysis apparatus characterized in that the collating unit collates with the search pattern in order from the frequently occurring abnormal pattern.
(Appendix 9)
In the failure analysis apparatus according to appendix 8,
The collating means assigns priorities to the abnormality patterns in the descending order of frequency, collates with the search patterns in descending order of priority, and the priorities of the abnormal patterns are specified according to the priority specified as additional information. A failure analysis device characterized in that the collation is terminated when it becomes low.
(Appendix 10)
In the failure analysis apparatus according to any one of appendices 3 to 8,
The failure analysis apparatus, wherein the pattern holding unit holds at least one of a problem summary and a coping method corresponding to each abnormal pattern corresponding to each abnormal pattern.

It is a block block diagram of an example of an operation system. It is a block block diagram including the operation system for demonstrating one Embodiment of the failure analysis method of this invention. It is a figure which shows one Embodiment of the header in a GUI log | history. It is a figure which shows the sequence pattern stored in the database. It is a figure which shows the processing sequence of PKG registration. It is a figure which shows the sequence pattern of PKG registration. It is a flowchart of the process which a log | history analysis part performs. It is a figure which shows the normal pattern and abnormal pattern of PKG registration. It is a figure which shows a search pattern. It is a figure for demonstrating the collation process of priority designation | designated. It is a figure for demonstrating the collation process of the order according to the frequency.

Explanation of symbols

30 GUI unit 30 ₁ to 30 _N GUI terminal 31 GUI history 32 Control unit 33 Control unit history 34 Basic unit 35 Basic unit history 36 Communication unit 37 Communication unit history 38 Monitoring unit 39 Monitoring unit history 40 Network 42 _{1 to} 42 _M transmission device 43 ₁ to 43 _M transmission device history 44 history analysis unit 46 database

Claims (5)

In an operation system failure analysis method for controlling and monitoring each of a plurality of network components constituting a communication network system,
For each function of the operation system, a normal pattern in which processing sequences of a plurality of components and network components constituting the operation system when operating normally are patterned as a time series of component names and network component names , Keep the anomaly pattern patterned as a chronological sequence of component names and network component names in past failures,
Create a search pattern by extracting the processing sequence of the function in which the failure occurred from the history of processing acquired independently by each of the plurality of components and network components as a time series of component names and network component names. ,
A failure analysis method, wherein a failure analysis is performed by collating a search pattern of a function in which the failure has occurred with the normal pattern and an abnormal pattern held as a function corresponding to the function in which the failure has occurred. The failure analysis method according to claim 1,
The history of processing acquired independently by each of the plurality of components and network components is a failure analysis characterized by sharing the name of the network component to be processed, the date and time of acquisition, and the format of the processing content. Method. In an operation system failure analysis apparatus that controls and monitors each of a plurality of network components constituting a communication network system,
For each function of the operation system, a normal pattern in which processing sequences of a plurality of components and network components constituting the operation system when operating normally are patterned as a time series of component names and network component names A pattern holding means for holding an abnormal pattern patterned as a time-series arrangement of component names and network component names in a failure that has occurred in the past;
A processing pattern of a function in which a failure has occurred is extracted as a time-series sequence of component names and network component names from the processing history independently acquired by each of the plurality of components and network components, and a search pattern is created. Search pattern creation means;
It has collation means for collating the search pattern of the function in which the failure has occurred with the normal pattern and the abnormal pattern held as a function corresponding to the function in which the failure has occurred, and performing failure analysis Failure analysis device. The failure analysis apparatus according to claim 3,
The history of processing acquired independently by each of the plurality of components and network components is a failure analysis characterized by sharing the name of the network component to be processed, the date and time of acquisition, and the format of the processing content. apparatus. The failure analysis apparatus according to claim 3 or 4,
And an additional holding means for additionally holding the search pattern as a new abnormal pattern in the pattern holding means when the result of matching between the search pattern and the normal pattern and the abnormal pattern in the matching means is inconsistent. Failure analysis device.

Images