CN105577440A

CN105577440A - Network fault time location method and analyzing device

Info

Publication number: CN105577440A
Application number: CN201510990708.0A
Authority: CN
Inventors: 宋跃忠; 林程勇; 戴龙飞; 谭屯子; 杨文国
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2015-12-24
Filing date: 2015-12-24
Publication date: 2016-05-11
Anticipated expiration: 2035-12-24
Also published as: CN105577440B

Abstract

The invention discloses a network fault time location method and an analyzing device, which relates to the field of data mining and network management and solves a problem that the fault location efficiency is lower due to the fact that a large amount of labors and time needs to be used for analyzing network logs in the existing network fault locating process. The network fault time location method comprises the steps: obtaining at least one log information of a network device; processing the at least one log information to form a log action matrix including M log action vectors, wherein each log action vector comprises N elements, N is the number of log types, and an i-th element of a log action vector represents the number of log information, which belongs to the i-th log type within a time interval of the log action vector; according to a preset model, calculating the log action vectors in the log action matrix and determining fault occurrence time of the network device.

Description

A kind of network downtime localization method and analytical equipment

Technical field

The present invention relates to data mining and field of network management, particularly relate to a kind of network downtime localization method and analytical equipment.

Background technology

Along with the development of network technology, broadband router application in a network becomes more and more extensive, and occupies critical role in a network.Then, broadband router there will be fault unavoidably in running, when broadband router breaks down, if solve not in time, network then can be caused to occur temporary interruption, bring inconvenience and loss to enterprise, therefore, to detect in time and the fault solving broadband router is necessary.

Due to, contain major part in the network log that broadband router produces and run relevant information with broadband router, therefore, the many faults of locating broadband router by analyzing network log of existing technical staff.But realizing in process of the present invention, technical staff finds: in existing log analysis process, the artificial part participated in is more, a large amount of manpowers and time are dropped into, meanwhile, need again the time occurred in conjunction with a large amount of professional knowledge locating network faults, the efficiency of causing trouble location is lower.

Summary of the invention

For solving the problem, the embodiment of the present invention provides a kind of network downtime localization method and analytical equipment, existing in the process of locating network fault to solve, need to adopt a large amount of manpowers and time to analyze network log, the problem that the fault location efficiency caused is lower.

For achieving the above object, embodiments of the invention adopt following technical scheme:

First aspect, the embodiment of the present invention provides a kind of network downtime localization method, can comprise:

Obtain at least one log information of the network equipment;

Described at least one log information is processed, forms the daily record behavioural matrix comprising M daily record behavior vector; Wherein, each daily record behavior vector takies a time interval, and each daily record behavior vector comprises N number of element; Described N is the number of Log Types, i-th element representation in described daily record behavior vector: within the time interval of described daily record behavior vector, belong to the number of the log information of the i-th class;

According to preset model, the daily record behavior vector in described daily record behavioural matrix is calculated, determine the time of failure of the described network equipment; Wherein, described preset model is used for: the daily record behavior vector filtering out the behavioural characteristic met when the network equipment breaks down.

So, carried out compressing process to original log, using the distribution of daily record various in each time interval as a line, analyzed with to daily record with behavior unit, greatly reduce the agency of log processing, and then improve the efficiency of network downtime location.

Due to, certain difference is there is between the log information that different manufacturers distinct device and disparate modules produce, inconvenience is brought to the identification of log content, therefore, before united analysis process is carried out to it, first can carry out standardization processing to the different information fields of each bar daily record, log information is converted into unified journal format easy to identify, then, daily record more similar for content in log information after consolidation form is treated with same class information, finally, at least one log information after sorting out is built into daily record behavioural matrix according to predetermined time interval, namely can in implementation in the first of first aspect, optionally, following method can be adopted to process described at least one log information, form the daily record behavioural matrix comprising M daily record behavior vector:

The content format of every bar log information is converted to default journal format;

Log information after format conversion is sorted out, and replaces described log information with the classification logotype belonging to log information, form a time series be made up of classification logotype;

According to prefixed time interval, described time series is divided;

For each time interval, classification logotype identical in the described time interval is carried out counting statistics, and statistics number is arranged in a N dimension daily record behavior vector;

All daily record behavior vectors are formed described daily record behavioural matrix according to time sequencing.

Further, because the network equipment often can with obvious feature when fault occurs, for this reason, invention technician is in conjunction with a large amount of fars, the log information produced near a large amount of fault time is analyzed, the relevance that excavation daily record behavioural characteristic and fault occur, finally, through calculating as drawn a conclusion in a large number: the frequency of log information produced in (1) unit interval and species number and network equipment failure there is stronger relevance, be embodied in: when the network equipment breaks down, frequency and the species number of the log information produced in the unit interval can be undergone mutation, (2) change of the daily record behavior pattern of adjacent time inter and network equipment failure has stronger relevance, be embodied in: when the network equipment breaks down, the difference value between the daily record behavior pattern that adjacent time inter is corresponding can increase suddenly.

This day aims at frequency and species number, or the change in behavior pattern is generally exclusive feature adjoint when the network equipment breaks down, based on this theory, invention technician proposes the preset model of the daily record behavior vector that can filter out the behavioural characteristic met when the network equipment breaks down, according to this model, the daily record behavioural matrix built is calculated, determine at frequency and species number, or the log information that behavior pattern is suddenlyd change, namely the log information produced when the network equipment breaks down, and then the time residing for this log information determine delimit network downtime, so, can in implementation, optionally, (1) (2) two kinds of modes can be adopted to carry out fault location at the another kind of first aspect:

(1) daily record frequency and the daily record kind of each daily record behavior vector in described daily record behavioural matrix is calculated respectively;

For the arbitrary daily record behavior vector in described daily record behavioural matrix, calculate the daily record frequency variance between described daily record behavior vector sum at least one daily record behavior vector adjacent with described daily record behavior vector and daily record kind variance;

If the average of described daily record frequency variance and daily record kind variance is greater than predetermined threshold value, then the time interval corresponding for described daily record behavior vector is defined as described network equipment failure time of origin.

Wherein, due in periodicity daily record, the log information number of the generation in the unit interval to change, i.e. daily record frequency is changeless, so, for periodicity daily record, do not have meaning in the fault detect intermediate frequency numerical mutation of aforesaid way, affect failure detection result, in order to address this problem, before the daily record frequency calculating each daily record behavior vector in described daily record behavioural matrix respectively and daily record kind, described failure location unit 203, also for:

According to formula assignment is weighted to the jth element in each daily record behavior vector;

Wherein, a described jth element is the arbitrary element in described daily record behavior vector; n _jfor: the number in the time interval that jth class log information occurs; Std (j) is: the distribution variance of jth class log information.

(2) each daily record behavior vector in described M daily record behavior vector is traveled through, similitude between the daily record behavior vector that more described daily record behavior vector sum is adjacent with described daily record behavior vector after described daily record behavior vector time, obtains the comparison value corresponding with described daily record behavior vector;

By vectorial for each daily record behavior in traversal described M daily record behavior vector, that obtain with each daily record behavior vector in described M daily record behavior vector one to one comparison value arrange from big to small;

The time interval of the daily record behavior vector of k value correspondence before after arrangement is defined as described network equipment failure time of origin; Wherein, k be more than or equal to 1 integer.

Concrete, can according to formula similitude between the daily record behavior vector that more described daily record behavior vector sum is adjacent with described daily record behavior vector after described daily record behavior vector time, obtains the comparison value corresponding with described daily record behavior vector; Wherein, the time interval of t residing for daily record behavior vector, x _t,irepresent i-th element of t capable daily record behavior vector.

Wherein, in embodiments of the present invention, k be more than or equal to 1 integer, and number k can experience choose, can also set a threshold value, being defined as abnormal daily record behavior vector occurs by k the daily record behavior vector being greater than this threshold value in comparison value, is network equipment failure origination point.

It should be noted that, above-mentioned two kinds of modes can perform separately, also can combine execution, with the exact time of locating network fault generation more accurately, such as: can determine that the frequency of the 1st row, the 5th row daily record behavior vector and kind are undergone mutation by first pass-through mode (1), for fault origination point, then, only the similitude of the 1st row, the 5th row is calculated according to mode (2) again, determine the 1st row or the 5th behavior fault origination point, accelerate the efficiency of the network failure analysis of causes.

Second aspect, the embodiment of the present invention provides a kind of analytical equipment, for performing said method, can comprise:

Acquiring unit, for obtaining at least one log information of the network equipment.

Matrix construction unit, processes at least one log information got described acquiring unit, forms daily record behavioural matrix; Wherein, described daily record behavioural matrix comprises M daily record behavior vector, and each daily record behavior vector takies a time interval, and each daily record behavior vector comprises N number of element; Described N is the number of Log Types, i-th element representation in described daily record behavior vector: within the time interval of described daily record behavior vector, belong to the number of the log information of the i-th class.

Failure location unit, calculates for the daily record behavior vector in the daily record behavioural matrix that formed described matrix construction unit according to preset model, determines the time of failure of the described network equipment; Wherein, described preset model is used for: the daily record behavior vector filtering out the behavioural characteristic met when the network equipment breaks down.

Due to, certain difference is there is between the log information that different manufacturers distinct device and disparate modules produce, inconvenience is brought to the identification of log content, therefore, before united analysis process is carried out to it, first can carry out standardization processing to the different information fields of each bar daily record, log information is converted into unified journal format easy to identify, then, daily record more similar for content in log information after consolidation form is treated with same class information, finally, at least one log information after sorting out is built into daily record behavioural matrix according to predetermined time interval, namely can in implementation in the one of second aspect, optionally, described matrix construction unit, specifically may be used for:

According to prefixed time interval, described time series is divided;

Can in implementation in another of second aspect, because the network equipment often can with obvious feature when fault occurs, for this reason, invention technician is in conjunction with a large amount of fars, the log information produced near a large amount of fault time is analyzed, the relevance that excavation daily record behavioural characteristic and fault occur, finally, through calculating as drawn a conclusion in a large number: the frequency of log information produced in (1) unit interval and species number and network equipment failure there is stronger relevance, be embodied in: when the network equipment breaks down, frequency and the species number of the log information produced in the unit interval can be undergone mutation, (2) change of the daily record behavior pattern of adjacent time inter and network equipment failure has stronger relevance, be embodied in: when the network equipment breaks down, the difference value between the daily record behavior pattern that adjacent time inter is corresponding can increase suddenly.

This day aims at frequency and species number, or the change in behavior pattern is generally exclusive feature adjoint when the network equipment breaks down, based on this theory, invention technician proposes the preset model of the daily record behavior vector that can filter out the behavioural characteristic met when the network equipment breaks down, according to this model, the daily record behavioural matrix built is calculated, determine at frequency and species number, or the log information that behavior pattern is suddenlyd change, namely the log information produced when the network equipment breaks down, and then the time residing for this log information determine delimit network downtime, so in the another kind of implementation of second aspect, optionally, described failure location unit, specifically may be used for:

Calculate daily record frequency and the daily record kind of each daily record behavior vector in described daily record behavioural matrix respectively;

Wherein, due in periodicity daily record, the log information number of the generation in the unit interval to change, i.e. daily record frequency is changeless, so, for periodicity daily record, do not have meaning in the fault detect intermediate frequency numerical mutation of aforesaid way, affect failure detection result, in order to address this problem, before the daily record frequency calculating each daily record behavior vector in described daily record behavioural matrix respectively and daily record kind, described failure location unit, also for:

Or, described failure location unit, specifically for:

Travel through each daily record behavior vector in described M daily record behavior vector, similitude between the daily record behavior vector that more described daily record behavior vector sum is adjacent with described daily record behavior vector after described daily record behavior vector time, obtains the comparison value corresponding with described daily record behavior vector;

It should be noted that, above-mentioned two kinds of modes can perform separately, and also can combine execution, with the exact time of locating network fault generation more accurately, accelerate the efficiency of the network failure analysis of causes.

The third aspect, the embodiment of the present invention provides a kind of analytical equipment, for performing said method, can comprise:

Receiver, for obtaining at least one log information of the network equipment.

Processor, processes at least one log information got described receiver, forms daily record behavioural matrix; Wherein, described daily record behavioural matrix comprises M daily record behavior vector, and each daily record behavior vector takies a time interval, and each daily record behavior vector comprises N number of element; Described N is the number of Log Types, i-th element representation in described daily record behavior vector: within the time interval of described daily record behavior vector, belong to the number of the log information of the i-th class.

And the daily record behavior vector in the daily record behavioural matrix formed described processor according to preset model calculates, and determines the time of failure of the described network equipment; Wherein, described preset model is used for: the daily record behavior vector filtering out the behavioural characteristic met when the network equipment breaks down.

Due to, certain difference is there is between the log information that different manufacturers distinct device and disparate modules produce, inconvenience is brought to the identification of log content, therefore, before united analysis process is carried out to it, first can carry out standardization processing to the different information fields of each bar daily record, log information is converted into unified journal format easy to identify, then, daily record more similar for content in log information after consolidation form is treated with same class information, finally, at least one log information after sorting out is built into daily record behavioural matrix according to predetermined time interval, namely can in implementation in the one of the third aspect, optionally, described processor, specifically may be used for:

According to prefixed time interval, described time series is divided;

Can in implementation in another of the third aspect, because the network equipment often can with obvious feature when fault occurs, for this reason, invention technician is in conjunction with a large amount of fars, the log information produced near a large amount of fault time is analyzed, the relevance that excavation daily record behavioural characteristic and fault occur, finally, through calculating as drawn a conclusion in a large number: the frequency of log information produced in (1) unit interval and species number and network equipment failure there is stronger relevance, be embodied in: when the network equipment breaks down, frequency and the species number of the log information produced in the unit interval can be undergone mutation, (2) change of the daily record behavior pattern of adjacent time inter and network equipment failure has stronger relevance, be embodied in: when the network equipment breaks down, the difference value between the daily record behavior pattern that adjacent time inter is corresponding can increase suddenly.

This day aims at frequency and species number, or the change in behavior pattern is generally exclusive feature adjoint when the network equipment breaks down, based on this theory, invention technician proposes the preset model of the daily record behavior vector that can filter out the behavioural characteristic met when the network equipment breaks down, according to this model, the daily record behavioural matrix built is calculated, determine at frequency and species number, or the log information that behavior pattern is suddenlyd change, namely the log information produced when the network equipment breaks down, and then the time residing for this log information determine delimit network downtime, so in the another kind of implementation of the third aspect, optionally, described processor, specifically may be used for:

Wherein, due in periodicity daily record, the log information number of the generation in the unit interval to change, i.e. daily record frequency is changeless, so, for periodicity daily record, do not have meaning in the fault detect intermediate frequency numerical mutation of aforesaid way, affect failure detection result, in order to address this problem, before the daily record frequency calculating each daily record behavior vector in described daily record behavioural matrix respectively and daily record kind, described processor, also for:

Or, described processor, specifically for:

As from the foregoing, the embodiment of the present invention provides a kind of network downtime localization method and analytical equipment, obtains at least one log information of the network equipment; Described at least one log information is processed, forms daily record behavioural matrix; Wherein, described daily record behavioural matrix comprises M daily record behavior vector, and each daily record behavior vector takies a time interval, and each daily record behavior vector comprises N number of element; Described N is the number of Log Types, i-th element representation in described daily record behavior vector: within the time interval of described daily record behavior vector, belong to the number of the log information of the i-th class; According to preset model, the daily record behavior vector in described daily record behavioural matrix is calculated, determine the time of failure of the described network equipment; Wherein, described preset model is used for: the daily record behavior vector filtering out the behavioural characteristic met when the network equipment breaks down.So, carried out compressing process to original log, not only similar log information same way has been treated; And be identical theory substantially based on the behavior expression of the network equipment in a certain time interval, using the distribution of daily record various in each time interval as a line, analyze with to daily record with behavior unit, greatly reduce the agency of log processing, and then improve the efficiency of network downtime location.

Accompanying drawing explanation

In order to be illustrated more clearly in the embodiment of the present invention or technical scheme of the prior art, be briefly described to the accompanying drawing used required in embodiment or description of the prior art below, apparently, accompanying drawing in the following describes is only some embodiments of the present invention, for those of ordinary skill in the art, under the prerequisite not paying creative work, other accompanying drawing can also be obtained according to these accompanying drawings.

The theory diagram of the network downtime location that Fig. 1 provides for the embodiment of the present invention;

The structure chart of the analytical equipment 20 that Fig. 2 provides for the embodiment of the present invention;

The flow chart of the network downtime localization method that Fig. 3 provides for the embodiment of the present invention;

The structure chart of the analytical equipment 30 that Fig. 4 provides for the embodiment of the present invention.

Embodiment

Below in conjunction with the accompanying drawing in the embodiment of the present invention, be clearly and completely described the technical scheme in the embodiment of the present invention, obviously, described embodiment is only the present invention's part embodiment, instead of whole embodiments.Based on the embodiment in the present invention, those of ordinary skill in the art, not making the every other embodiment obtained under creative work prerequisite, belong to the scope of protection of the invention.

General principle of the present invention is: first carry out data mining and machine learning to a large amount of offline logs that the network equipment produces, the form of expression of daily record when finding the network equipment to break down, then according to this form of expression, real-time analysis is carried out to online daily record, if there is the daily record meeting this form of expression in online daily record, then determine that this daily record is the daily record that the network equipment produces when breaking down, is defined as the time that network failure occurs the time corresponding for this daily record.Wherein, in order to improve the efficiency of fault location, the embodiment of the present invention, before to online log analysis, first the processing procedure such as standardization, preliminary treatment is carried out to network log, made the daily record after process become the compressed version of original log, and there is relevant information to fault in preservation major part, so, significantly reduce the cost of log analysis, and then promote the efficiency of consequent malfunction timi requirement.

Such as, the theory diagram of the network downtime location that Fig. 1 provides for the embodiment of the present invention, as shown in Figure 1, online daily record is delimited to the work of three aspects through daily record standardization, log integrity, fault, orient the correct time that network failure occurs, and then testing staff will be fed back to by analytical statement fault time; Wherein, daily record standardization mainly comprises: the standardization of logging time mark, and other identifies standardization; Log integrity mainly comprises: Log Clustering, for processing unified for the daily record of uniform type; Fault is delimited and is mainly referred to: according to the form of expression of daily record when offline logs being carried out to fault that data mining and machine learning obtain (as: frequency type changes, logging mode change), daily record after premenstrual two aspect process is analyzed, finds time of failure.It should be noted that, in the theory diagram shown in Fig. 1, offline logs refers to that the present invention trains the daily record of use, and online daily record refers to the actual log that the present invention applies.

Wherein, method provided by the invention can analytical equipment 20 as shown in Figure 2 perform, for carrying out accident analysis and location to the network equipment 10.Described analytical equipment 20 can be: any one equipment in the equipment such as switch, router, Network Management Equipment, server, software defined network (SoftwareDefinedNetwork, SDN) controller.Concrete, as shown in Figure 2, described analytical equipment 20 can comprise: processor 2011, memory 2012, receiver 2013, transmitter 2014 and at least one communication bus 2015, for realizing connection between these devices and intercoming mutually;

Receiver 2013 can be used for carrying out data interaction between ext nal network element, as: the network log that collection analysis equipment 20 produces.

Memory 2012 can be volatile memory (volatilememory), such as random access memory (random-accessmemory, RAM); Or nonvolatile memory (non-volatilememory), such as read-only memory (read-onlymemory, ROM), flash memory (flashmemory), hard disk (harddiskdrive, or solid state hard disc (solid-statedrive, SSD) HDD); Or the combination of the memory of mentioned kind.

Processor 2011 may be a central processing unit (centralprocessingunit, referred to as CPU), also can be specific integrated circuit (ApplicationSpecificIntegratedCircuit, ASIC), or be configured to the one or more integrated circuits implementing the embodiment of the present invention, such as: one or more microprocessor (digitalsingnalprocessor, DSP), or, one or more field programmable gate array (FieldProgrammableGateArray, FPGA); The form of expression of daily record during for first carrying out to offline logs the fault that data mining and machine learning obtain, then according to this form of expression, real-time analysis is carried out to online daily record, then daily record standardization, log integrity are carried out to online daily record, and according to the form of expression of daily record during fault, the daily record after process is analyzed, complete fault to delimit, orient the time that network failure occurs.

Transmitter 2014 can be used for carrying out data interaction between ext nal network element, as: can be a human-computer interaction interface, feed back to testing staff for the fault time of being oriented by processor 2011.

Communication bus 2015 can be divided into address bus, data/address bus, control bus etc., can be industry standard architecture (IndustryStandardArchitecture, ISA) bus, peripheral component interconnect (PeripheralComponent, PCI) bus or extended industry-standard architecture (ExtendedIndustryStandardArchitecture, EISA) bus etc.For ease of representing, only representing with a thick line in Fig. 2, but not representing the bus only having a bus or a type.

Concrete, receiver 2013, for obtaining at least one log information of the network equipment.

Processor 2011, processes at least one log information got described receiver 2013, forms daily record behavioural matrix; Wherein, described daily record behavioural matrix comprises M daily record behavior vector, and each daily record behavior vector takies a time interval, and each daily record behavior vector comprises N number of element; Described N is the number of Log Types, i-th element representation in described daily record behavior vector: within the time interval of described daily record behavior vector, belong to the number of the log information of the i-th class.

Processor 2011, calculates for the daily record behavior vector in the daily record behavioural matrix that formed described processor 2011 according to preset model, determines the time of failure of the described network equipment; Wherein, described preset model is used for: the daily record behavior vector filtering out the behavioural characteristic met when the network equipment breaks down.

Due to, certain difference is there is between the log information that different manufacturers distinct device and disparate modules produce, inconvenience is brought to the identification of log content, therefore, before united analysis process is carried out to it, first can carry out standardization processing to the different information fields of each bar daily record, log information is converted into unified journal format easy to identify, then, daily record more similar for content in log information after consolidation form is treated with same class information, finally, at least one log information after sorting out is built into daily record behavioural matrix according to predetermined time interval, i.e. described processor 2011, specifically for:

According to prefixed time interval, described time series is divided;

This day aims at frequency and species number, or the change in behavior pattern is generally exclusive feature adjoint when the network equipment breaks down, based on this theory, invention technician proposes the preset model of the daily record behavior vector that can filter out the behavioural characteristic met when the network equipment breaks down, according to this model, the daily record behavioural matrix built is calculated, determine at frequency and species number, or the log information that behavior pattern is suddenlyd change, namely the log information produced when the network equipment breaks down, and then the time residing for this log information determine delimit network downtime, so, described processor 2011, specifically for:

Wherein, due in periodicity daily record, the log information number of the generation in the unit interval to change, i.e. daily record frequency is changeless, so, for periodicity daily record, do not have meaning in the fault detect intermediate frequency numerical mutation of aforesaid way, affect failure detection result, in order to address this problem, before the daily record frequency calculating each daily record behavior vector in described daily record behavioural matrix respectively and daily record kind, described processor 2011, also for:

Or, described processor 2011, specifically for:

As: can according to formula similitude between the daily record behavior vector that more described daily record behavior vector sum is adjacent with described daily record behavior vector after described daily record behavior vector time, obtains the comparison value corresponding with described daily record behavior vector; Wherein, the time interval of t residing for daily record behavior vector, x _t,irepresent i-th element of t capable daily record behavior vector.

It should be noted that, above-mentioned two kinds of modes can perform separately, also can combine execution, with the exact time of locating network fault generation more accurately, such as: first can determine that the frequency of the 1st row, the 5th row daily record behavior vector and kind are undergone mutation, be fault origination point, then, only the similitude of the 1st row, the 5th row is compared again, determine the 1st row or the 5th behavior fault origination point, accelerate the efficiency of the network failure analysis of causes.

As from the foregoing, the embodiment of the present invention provides a kind of analytical equipment, obtains at least one log information of the network equipment; Described at least one log information is processed, forms daily record behavioural matrix; Wherein, described daily record behavioural matrix comprises M daily record behavior vector, and each daily record behavior vector takies a time interval, and each daily record behavior vector comprises N number of element; Described N is the number of Log Types, i-th element representation in described daily record behavior vector: within the time interval of described daily record behavior vector, belong to the number of the log information of the i-th class; According to preset model, the daily record behavior vector in described daily record behavioural matrix is calculated, determine the time of failure of the described network equipment; Wherein, described preset model is used for: the daily record behavior vector filtering out the behavioural characteristic met when the network equipment breaks down.So, carried out compressing process to original log, not only similar log information same way has been treated; And be identical theory substantially based on the behavior expression of the network equipment in a certain time interval, using the distribution of daily record various in each time interval as a line, analyze with to daily record with behavior unit, greatly reduce the agency of log processing, and then improve the efficiency of network downtime location.

For convenience of description, following examples one illustrate with the form of step and describe the network downtime localization method that in the present invention, analytical equipment 20 performs in detail, wherein, the step illustrated also can perform in the computer system of the such as one group of executable instruction except network failure equipment 20, as: method of the present invention can also be performed by the network equipment 10 self, the unit of the execution method provided by the invention comprised in the analytical equipment 20 namely shown in Fig. 2 can be included in the network equipment 10, network downtime localization method provided by the invention is performed by the network equipment 10.In addition, although show logical order in the drawings, in some cases, can be different from the step shown or described by order execution herein.

Embodiment one

The flow chart of the network downtime localization method that Fig. 3 provides for the embodiment of the present invention, analytical equipment 20 as shown in Figure 2 performs, and for carrying out accident analysis and timi requirement to the analytical equipment 20 in Fig. 2, as shown in Figure 3, described method can comprise:

Step 101: at least one log information obtaining the network equipment.

Wherein, described at least one log information is the recorded information of the crawler behavior of the network equipment within a period of time, every bar log information describes the once independent crawler behavior of the network equipment, and every bar log information can comprise: the network equipment performs the information such as the timestamp of event, main frame or module name, event level, information profile, event message.

Optionally, analytical equipment can capture at least one log information of the technical limit spacing network equipment by existing log scan, as: can by least one log information of the web crawlers technical limit spacing network equipment, in this not go into detail.

Due to, in actual applications, the generation of log information is a large amount of in real time, and the content of log information is also extremely complicated and changeable, thus similar log information same way is treated the cost that significantly can reduce log processing, simultaneously, from the time, many log informations are the time serieses be made up of a rule log information, and the behavior expression of the network equipment is identical substantially in a certain time interval, therefore, at the same time a large amount of log informations is divided, using the distribution of daily record various in each time interval as a line, analyze with to daily record with behavior unit, also the agency of log processing can be greatly reduced, and then promote the efficiency of consequent malfunction location, namely a large amount of and diversified log information to be sorted out and after time-division processing, can when preserving major part, to fault, relevant information occurring, the cost of log processing is reduced greatly, based on this theory, next the present invention carries out the process that step 102 realizes log information, to reduce log analysis cost.

Step 102: process described at least one log information, forms daily record behavioural matrix; Wherein, described daily record behavioural matrix comprises M daily record behavior vector, and each daily record behavior vector takies a time interval, and each daily record behavior vector comprises N number of element; Described N is the number of Log Types, i-th element representation in described daily record behavior vector: within the time interval of described daily record behavior vector, belong to the number of the log information of the i-th class.

Wherein, the time interval between adjacent daily record behavior vector can be equal.

Due to, certain difference is there is between the log information that different manufacturers distinct device and disparate modules produce, inconvenience is brought to the identification of log content, therefore, before united analysis process is carried out to it, first can carry out standardization processing to the different information fields of each bar daily record, log information is converted into unified journal format easy to identify, then, daily record more similar for content in log information after consolidation form is treated with same class information, finally, at least one log information after sorting out is built into daily record behavioural matrix according to predetermined time interval, namely described step 102 can comprise following (1) (2) (3) three main process:

(1) daily record standardization

In at least one log information step 101 obtained, the content format of every bar log information is converted to default journal format.

Wherein, the journal format preset can preset as required, and the embodiment of the present invention does not limit this.Such as: log information can comprise: the information fields such as timestamp/host name/event level/information profile/event information (Timestamp/Device/Eventseverity/Brieflyinformation/Eventm essage); And the form of each field can specification be form as shown in table 1 below, as: " timestamp " in log information is represented by the temporal information of shape as " Apr21201502:34:25 " form, with representing that the numeral of grade represents " event class ", now, if the timestamp that there is a log information is: 2015-11-1109:00:00, then need this timestamp to be converted to " Nov11201509:00:00 ".

Table 1 daily record standardization form

It should be noted that, in actual applications, the log information that the network equipment produces may be the invalid log information that the testing staff such as not free stamp or event menace level thinks, now, carry out follow-up analyzing and processing if still preserved by these log informations, unnecessary burden can be increased undoubtedly, in order to solve the appearance of this problem, carrying out, in the normalized process of daily record, also needing log information invalid in rejecting at least one log information, specific as follows:

Inquire about the every bar log information in described at least one log information;

Invalid log information at least one log information described is rejected; Wherein, described invalid daily record is the log information of the call format not meeting the log information that the network equipment produces.

Such as, due under normal circumstances, the log information that the network equipment produces must comprise this information of event menace level, now, if log information does not comprise event class or event class not in rating database, then can think that this log information is invalid information, reject from numerous log informations; Wherein, described rating database stores more common some events grade; As: be stored in rating database with digitized representation event class arbitrary in digital 1-5, numeral is larger, represent that rank is larger, now, if the event class that there is a log information at least one log information is 6, be not included in rating database, then can determine that this log information is invalid log information, at least one log information should be eliminated.

(2) log integrity

Log information after format conversion is sorted out, and replaces described log information with the classification logotype belonging to log information, form a time series be made up of classification logotype.

Wherein, described classification logotype is used for representing: Log Types; Such as: if log information " Apr21201512:12:12Userlogin " belongs to Log Types 1, then this log information can be represented by numeral " 1 ".

Preferably, the method of hierarchical clustering can be adopted to sort out the every bar log information after format conversion, wherein, described hierarchical clustering is the classic algorithm in artificial intelligence, adopt the cluster analysis instrument of q-gram algorithm to weigh character string similarity degree, using q-gram distance as the diversity factor value between different daily record, cluster is carried out to the every bar log information after format conversion, by adjustment clustering parameter q, obtain optimum Log Types number N; Wherein, the difference of q value can cause the difference of analog result, and from experimentally a large amount of, q preferably gets 3 in the present invention, and this value is little on the impact of Log Clustering result, and specific implementation repeats no more.

So, after the preliminary treatment of this process, at least one log information becomes a series of time series be made up of class formative, next, carries out segment processing to this time series, then can identify the Behavioral change of daily record.

(3) daily record behavioural matrix builds

According to prefixed time interval, described time series is divided;

Wherein, the described time interval can be arranged as required, and the embodiment of the present invention does not limit this, as: can be 1 minute or 5 minutes.Such as, if the number of Log Types is N, the time interval according to presetting marks off M time period, then the daily record behavioural matrix constructed is:

[\begin{matrix} x_{T 1, 1} & x_{T 1, 2} & ... & x_{T 1, N} \\ x_{T 2, 1} & x_{T 2, 2} & ... & x_{T 1, N} \\ ... & ... & ... & ... \\ x_{T M, 1} & x_{T M, 2} & ... & x_{T M, N} \end{matrix}]

Wherein, (x _t1,1x _t1,2..., x _{t1, N}) represent that the daily record behavior of time interval T1 is vectorial, i-th element x in this daily record behavior vector _{t1, i}represent: the number belonging to the log information of the i-th class.Such as: the number of Log Types is 10, and by the numeral of 1-10 as classification logotype, Log Types 1-10 is identified one to one, now, if get 100 log informations within the T1 time interval, the classification logotype 1 of 10 log informations is wherein had, article 20, the classification logotype 7 of classification logotype 3,70 log informations of log information, then the daily record behavior vector in the T1 time interval is: (10,0,20,0,0,0,70,0,0,0).

So far, by operations such as standardization, preliminary treatment, original a large amount of log information is reduced to a vector matrix, it characterizes the patterns of change of daily record, contains fault relevant information, improves the efficiency of subsequent analysis.

Step 103: according to preset model, the daily record behavior vector in described daily record behavioural matrix is calculated, determine the time of failure of the described network equipment; Wherein, described preset model is used for: the daily record behavior vector filtering out the behavioural characteristic met when the network equipment breaks down.

Due to, the network equipment often can with obvious feature when fault occurs, for this reason, invention technician is in conjunction with a large amount of fars, the log information produced near a large amount of fault time is analyzed, the relevance that excavation daily record behavioural characteristic and fault occur, finally, through calculating as drawn a conclusion in a large number: the frequency of log information produced in (1) unit interval and species number and network equipment failure there is stronger relevance, be embodied in: when the network equipment breaks down, frequency and the species number of the log information produced in the unit interval can be undergone mutation, (2) change of the daily record behavior pattern of adjacent time inter and network equipment failure has stronger relevance, be embodied in: when the network equipment breaks down, the difference value between the daily record behavior pattern that adjacent time inter is corresponding can increase suddenly.

This day aims at frequency and species number, or the change in behavior pattern is generally exclusive feature adjoint when the network equipment breaks down, based on this theory, invention technician proposes the preset model of the daily record behavior vector that can filter out the behavioural characteristic met when the network equipment breaks down, according to this model, the daily record behavioural matrix that step 102 builds is calculated, determine at frequency and species number, or the log information that behavior pattern is suddenlyd change, namely the log information produced when the network equipment breaks down, and then the time residing for this log information determine delimit network downtime, concrete, realized by following two kinds of modes:

(1) fault location is carried out in the change based on daily record frequency and daily record kind

Calculate daily record frequency and the daily record kind of each daily record behavior vector respectively;

Wherein, predetermined threshold value can be obtained by a large amount of fault log analysis, the present invention does not limit at this, if the average of described daily record frequency variance and daily record kind variance is greater than predetermined threshold value, then representing that daily record frequency and the daily record kind of daily record behavior vector are undergone mutation, for there is network failure in this time period; If the average of described daily record frequency variance and daily record kind variance is less than or equal to predetermined threshold value, then represent that the daily record frequency of daily record behavior vector and daily record kind be network equipment normal operation are behavioural characteristics.

It should be noted that, at least one daily record behavior vector adjacent with described daily record behavior vector can be the several daily record behavior vectors before this daily record behavior vector, also can be the several daily record behavior vectors after this daily record behavior vector, can also for occurring in the several daily record behavior vectors before and after this daily record behavior vector, its number can be arranged as required, and the embodiment of the present invention does not limit this; Preferably, according to great many of experiments, at least one daily record behavior vector adjacent with described daily record behavior vector can be: four daily record behavior vectors adjacent after described daily record behavior vector.

Such as, if the daily record frequency variance calculated and daily record kind variance are respectively a _iand b _i, now, if λ ₁for by obtaining predetermined threshold value to a large amount of fault log analysis, then time corresponding for this vector is defined as some fault time.

It should be noted that, due in periodicity daily record, the log information number of the generation in the unit interval to change, i.e. daily record frequency is changeless, so, for periodicity daily record, do not have meaning in the fault detect intermediate frequency numerical mutation of aforesaid way, affect failure detection result, in order to address this problem, power method is composed in the daily record that the present invention proposes based on information extraction technology, has considered the distribution situation of all kinds of daily record, effectively promotes the accuracy of delimiting fault time; Concrete, when the network equipment produces periodically daily record, the embodiment of the present invention, before the daily record frequency calculating each daily record behavior vector respectively and daily record kind, also needs to carry out following process:

Wherein, a described jth element is the arbitrary element in described daily record behavior vector; n _jfor the number in the time interval that jth class log information occurs, namely refer to that jth class log information occurred within n the time interval; Std (j) is: the distribution variance of jth class log information.

The distribution variance of described jth class log information is: the number of jth class log information in described daily record behavior vector, and in other all daily record behavior vectors in described daily record behavioural matrix except described daily record behavior vector jth class log information number between variance.

Such as, two daily record behavior vector fractional integration series are not: (10, 0, 20, 0, 0, 0, 70, 0, 0, 0), (10, 0, 20, 0, 20, 0, 30, 0, 10, 10), namely within the identical time interval, all produce 100 log informations, daily record frequency is identical, now, each element that can be respectively in these two daily record behavior vectors according to above-mentioned assignment formula is weighted assignment, obtain: (11.7307, 0, 4.79, 0, 0, 0, 2.348, 0, 0, 0), (2.5597, 0, 3.9780, 0, 2.67, 0, 30, 0, 5.648, 10), so, characterization value corresponding to each daily record behavior is different, replace original daily record frequency that fault time point location can be made more accurate with it.

(2) fault location is carried out in the change based on daily record behavior pattern

It should be noted that, above-mentioned two kinds of modes can perform separately, also can combine execution, with the exact time of locating network fault generation more accurately, such as: can determine that the frequency of the 1st row, the 5th row daily record behavior vector and kind are undergone mutation by first pass-through mode (1), for fault origination point, then, only the similitude of the 1st row, the 5th row is compared according to mode (2) again, determine the 1st row or the 5th behavior fault origination point, accelerate the efficiency of the network failure analysis of causes.

As from the foregoing, the embodiment of the present invention provides a kind of network downtime localization method, obtains at least one log information of the network equipment; Described at least one log information is processed, forms daily record behavioural matrix; Wherein, described daily record behavioural matrix comprises M daily record behavior vector, and each daily record behavior vector takies a time interval, and each daily record behavior vector comprises N number of element; Described N is the number of Log Types, i-th element representation in described daily record behavior vector: within the time interval of described daily record behavior vector, belong to the number of the log information of the i-th class; According to preset model, the daily record behavior vector in described daily record behavioural matrix is calculated, determine the time of failure of the described network equipment; Wherein, described preset model is used for: the daily record behavior vector filtering out the behavioural characteristic met when the network equipment breaks down.So, carried out compressing process to original log, not only similar log information same way has been treated; And be identical theory substantially based on the behavior expression of the network equipment in a certain time interval, using the distribution of daily record various in each time interval as a line, analyze with to daily record with behavior unit, greatly reduce the agency of log processing, and then improve the efficiency of network downtime location.

According to the embodiment of the present invention, the present invention is following embodiment still provides a kind of analytical equipment 30, is preferably used for realizing the method in said method embodiment.

Embodiment two

The structure chart of a kind of analytical equipment 30 that Fig. 4 provides for the embodiment of the present invention, described analytical equipment 30 can be: switch, router, Network Management Equipment, Web (webpage) server, software defined network (SoftwareDefinedNetwork, SDN) any one equipment in the equipment such as controller, for performing the method described in embodiment one, as shown in Figure 4, described analytical equipment 30 can comprise:

Acquiring unit 201, for obtaining at least one log information of the network equipment.

Matrix construction unit 202, processes at least one log information got described acquiring unit 201, forms daily record behavioural matrix; Wherein, described daily record behavioural matrix comprises M daily record behavior vector, and each daily record behavior vector takies a time interval, and each daily record behavior vector comprises N number of element; Described N is the number of Log Types, i-th element representation in described daily record behavior vector: within the time interval of described daily record behavior vector, belong to the number of the log information of the i-th class.

Failure location unit 203, calculates for the daily record behavior vector in the daily record behavioural matrix that formed described matrix construction unit 202 according to preset model, determines the time of failure of the described network equipment; Wherein, described preset model is used for: the daily record behavior vector filtering out the behavioural characteristic met when the network equipment breaks down.

Due to, certain difference is there is between the log information that different manufacturers distinct device and disparate modules produce, inconvenience is brought to the identification of log content, therefore, before united analysis process is carried out to it, first can carry out standardization processing to the different information fields of each bar daily record, log information is converted into unified journal format easy to identify, then, daily record more similar for content in log information after consolidation form is treated with same class information, finally, at least one log information after sorting out is built into daily record behavioural matrix according to predetermined time interval, i.e. described matrix construction unit 202, specifically for:

According to prefixed time interval, described time series is divided;

This day aims at frequency and species number, or the change in behavior pattern is generally exclusive feature adjoint when the network equipment breaks down, based on this theory, invention technician proposes the preset model of the daily record behavior vector that can filter out the behavioural characteristic met when the network equipment breaks down, according to this model, the daily record behavioural matrix built is calculated, determine at frequency and species number, or the log information that behavior pattern is suddenlyd change, namely the log information produced when the network equipment breaks down, and then the time residing for this log information determine delimit network downtime, so, described failure location unit 203, specifically for:

Or, described failure location unit 203, specifically for:

It should be noted that, the acquiring unit in analytical equipment shown in Fig. 4 of the present invention can be the receiver 2011 of the analytical equipment shown in Fig. 2; Matrix construction unit, failure location unit can for the processors set up separately, also can be integrated in some processors of analytical equipment and realize, in addition, also can be stored in the memory of analytical equipment with the form of program code, called by some processors of analytical equipment and perform the function of above construction of knowledge base.Processor described here can be a central processing unit (CentralProcessingUnit, CPU), or specific integrated circuit (ApplicationSpecificIntegratedCircuit, or be configured to implement one or more integrated circuits of the embodiment of the present invention ASIC).

Those skilled in the art can be well understood to, and for convenience and simplicity of description, the unit of foregoing description and the specific works process of system, with reference to the corresponding process in preceding method embodiment, can not repeat them here.

In several embodiments that the application provides, should be understood that, disclosed system, equipment and method, can realize by another way.Such as, apparatus embodiments described above is only schematic, such as, the division of described unit, be only a kind of logic function to divide, actual can have other dividing mode when realizing, such as multiple unit or assembly can in conjunction with or another system can be integrated into, or some features can be ignored, or do not perform.

The described unit illustrated as separating component or can may not be and physically separates, and the parts as unit display can be or may not be physical location, namely can be positioned at a place, or also can be distributed in multiple network element.Some or all of unit wherein can be selected according to the actual needs to realize the object of the present embodiment scheme.

In addition, each functional unit in each embodiment of the present invention can be integrated in a processing unit, also can be that the independent physics of unit comprises, also can two or more unit in a unit integrated.Above-mentioned integrated unit both can adopt the form of hardware to realize, and the form that hardware also can be adopted to add SFU software functional unit realizes.

The above-mentioned integrated unit realized with the form of SFU software functional unit, can be stored in a computer read/write memory medium.Above-mentioned SFU software functional unit is stored in a storage medium, comprising some instructions in order to make a computer equipment (can be personal computer, server, or the network equipment etc.) perform the part steps of method described in each embodiment of the present invention.And aforesaid storage medium comprises: USB flash disk, portable hard drive, read-only memory (Read-OnlyMemory, be called for short ROM), random access memory (RandomAccessMemory, be called for short RAM), magnetic disc or CD etc. various can be program code stored medium.

One of ordinary skill in the art will appreciate that all or part of step in the various methods of above-described embodiment is that the hardware (such as processor) that can carry out instruction relevant by program has come, this program can be stored in a computer-readable recording medium, and storage medium can comprise: read-only memory, random asccess memory, disk or CD etc.

Last it is noted that above embodiment is only in order to illustrate technical scheme of the present invention, be not intended to limit; Although with reference to previous embodiment to invention has been detailed description, those of ordinary skill in the art is to be understood that: it still can be modified to the technical scheme described in foregoing embodiments, or carries out equivalent replacement to wherein portion of techniques feature; And these amendments or replacement, do not make the essence of appropriate technical solution depart from the spirit and scope of various embodiments of the present invention technical scheme.

Claims

1. a network downtime localization method, is characterized in that, comprising:

Analytical equipment obtains at least one log information of the network equipment;

Described analytical equipment processes described at least one log information, forms daily record behavioural matrix; Wherein, described daily record behavioural matrix comprises M daily record behavior vector, and each daily record behavior vector takies a time interval, and each daily record behavior vector comprises N number of element; Described N is the number of Log Types, i-th element representation in described daily record behavior vector: within the time interval of described daily record behavior vector, belong to the number of the log information of the i-th class;

Described analytical equipment calculates the daily record behavior vector in described daily record behavioural matrix according to preset model, determines the time of failure of the described network equipment; Wherein, described preset model is used for: the daily record behavior vector filtering out the behavioural characteristic met when the network equipment breaks down.

2. method according to claim 1, is characterized in that, describedly calculates daily record behavior vector in described daily record behavioural matrix according to preset model, determines that the time of failure of the described network equipment comprises:

3. method according to claim 2, is characterized in that, before the daily record frequency calculating each daily record behavior vector in described daily record behavioural matrix respectively and daily record kind, described method also comprises:

4. method according to claim 1, is characterized in that, describedly calculates the daily record behavior vector in described daily record behavioural matrix according to preset model, determines that the time of failure of the described network equipment specifically comprises:

5. method according to claim 4, it is characterized in that, similitude between the daily record behavior vector that described daily record behavior vector sum is adjacent with described daily record behavior vector after described daily record behavior vector time, obtains the comparison value corresponding with described daily record behavior vector and specifically comprises:

According to formula similitude between the daily record behavior vector that more described daily record behavior vector sum is adjacent with described daily record behavior vector after described daily record behavior vector time, obtains the comparison value corresponding with described daily record behavior vector; Wherein, the time interval of t residing for daily record behavior vector, x _t,irepresent i-th element of t capable daily record behavior vector.

6. the method according to any one of claim 1-5, is characterized in that, describedly processes described at least one log information, forms daily record behavioural matrix and comprises:

According to prefixed time interval, described time series is divided;

7. an analytical equipment, for locating network fault time of origin, is characterized in that, comprising:

Acquiring unit, for obtaining at least one log information of the network equipment;

Matrix construction unit, processes at least one log information got described acquiring unit, forms daily record behavioural matrix; Wherein, described daily record behavioural matrix comprises M daily record behavior vector, and each daily record behavior vector takies a time interval, and each daily record behavior vector comprises N number of element; Described N is the number of Log Types, i-th element representation in described daily record behavior vector: within the time interval of described daily record behavior vector, belong to the number of the log information of the i-th class;

8. equipment according to claim 7, is characterized in that, described failure location unit, specifically for:

9. equipment according to claim 8, is characterized in that, described failure location unit, also for:

Before the daily record frequency calculating each daily record behavior vector in described daily record behavioural matrix respectively and daily record kind, according to formula assignment is weighted to the jth element in each daily record behavior vector;

10. equipment according to claim 7, is characterized in that, described failure location unit, specifically for:

11. equipment according to claim 10, is characterized in that, described failure location unit, specifically for:

12. equipment according to any one of claim 7-11, is characterized in that, described matrix construction unit, specifically for:

According to prefixed time interval, described time series is divided;