CN113704046B

CN113704046B - Fault alarm processing method and device, equipment and storage medium

Info

Publication number: CN113704046B
Application number: CN202010436320.7A
Authority: CN
Inventors: 何威; 柳园园; 汤煜; 曹彬; 闫兴安
Original assignee: China Mobile Communications Group Co Ltd; China Mobile Suzhou Software Technology Co Ltd
Current assignee: China Mobile Communications Group Co Ltd; China Mobile Suzhou Software Technology Co Ltd
Priority date: 2020-05-21
Filing date: 2020-05-21
Publication date: 2024-05-03
Anticipated expiration: 2040-05-21
Also published as: CN113704046A

Abstract

The application discloses a fault alarm processing method, a device, equipment and a storage medium, wherein the method comprises the following steps: obtaining fault alarm of a virtualized network element and logic structure information of the virtualized network element; converting the format of the fault alarm into a data format of a preset general fault deduction template; performing root cause analysis on the fault alarms after the data format conversion by utilizing the general fault deduction template to obtain root causes of the fault alarms; and determining an alarm processing action to be executed according to the root cause of the fault alarm so as to clear the fault alarm.

Description

Fault alarm processing method and device, equipment and storage medium

Technical Field

The present application relates to the field of communications technologies, and in particular, to a fault alarm processing method and apparatus, a device, and a storage medium.

Background

The rapid development of cloud computing technology lays a foundation for network function virtualization, NFV (Network Function Virtualization ) is proposed by the alliance of operators, and software is utilized to install, control and operate network functions running on general hardware, so that cloud and virtualization technologies are fused, and new generation network services have better scalability and automation capability.

In general, the virtualized network element (Virtual Network Function, VNF) is the core of NFV, so that monitoring management needs to be performed on the virtualized network element, so that when the virtualized network element fails, the failure can be rapidly handled. In the prior art, a processing method for performing fault monitoring on a virtualized network element and performing manual fault processing according to detailed information of faults is proposed; or determining the processing steps corresponding to the faults according to the processing rules by using the self-defined fault processing rules, and performing the processing method of automatic fault processing. However, when a large number of fault alarms occur in the virtualized network element, performing corresponding processing on each fault alarm may reduce the efficiency of resolving the fault alarm.

Disclosure of Invention

In view of the above, the present application provides a fault alarm processing method, device, apparatus, and storage medium, so as to solve the following problems in the prior art: 1) In the process of processing the fault alarm, the format of the fault alarm is inconsistent, which is not beneficial to analyzing the root cause of the fault alarm. 2) When a large number of fault alarms occur in the virtualized network element, executing corresponding processing on each fault alarm may reduce the efficiency of resolving the fault alarm.

The technical scheme of the application is realized as follows:

in a first aspect, the present application provides a fault alert processing method, including:

obtaining fault alarm of a virtualized network element and logic structure information of the virtualized network element;

converting the format of the fault alarm into a data format of a preset general fault deduction template;

Performing root cause analysis on the fault alarms after the data format conversion by utilizing the general fault deduction template to obtain root causes of the fault alarms;

And determining an alarm processing action to be executed according to the root cause of the fault alarm so as to clear the fault alarm.

In some embodiments, before the obtaining the fault alert of the virtualized network element and the logical structure information of the virtualized network element, the method further comprises:

after power-on, loading a topological structure of the network; the topological structure of the network comprises a topological structure between a physical machine and a virtual machine in the network;

Correspondingly, before the format of the fault alarm is converted into the data format of the preset general fault deduction template, the method further comprises:

And after obtaining the fault alarm of the virtualized network element, determining logic structure information of the virtualized network element according to the topological structure of the network.

In some embodiments, the obtaining the fault alert of the virtualized network element and the logical structure information of the virtualized network element includes:

Subscribing the fault alarm of the virtualized network element to the virtual machine according to service requirements, and receiving the fault alarm of the virtualized network element sent by the virtual machine; or alternatively

Actively inquiring the performance index of the virtual machine from the virtual machine, and requesting the virtual machine for fault warning of the virtualized network element when the virtualized network element is abnormal according to the performance index of the virtual machine.

In some embodiments, before the converting the format of the fault alert to the data format of the preset generic fault derivation template, the method further comprises:

determining a possible generated fault alarm set according to the logic structure information of the virtualized network element;

Writing the general fault deduction template according to the logic structure information of the virtualized network element and the fault alarm set;

And storing the general fault deduction template in a database.

In some embodiments, before the determining, according to the root cause of the fault alert, an alert processing action that needs to be performed to clear the fault alert, the method further comprises:

defining an alarm processing action to be executed on the alarm according to the root cause of the fault alarm and the logic structure information of the virtualized network element;

The root cause of the fault alarm and the corresponding alarm processing action are used as a fault clearing table and stored in a database;

Correspondingly, the determining the alarm processing action to be executed to clear the fault alarm according to the root cause of the fault alarm includes: inquiring a fault clearing table in a database according to the root cause of the fault alarm to obtain an alarm processing action; and clearing the fault alarm according to the alarm processing action.

In some embodiments, the performing root cause analysis on the fault alarm after the data format conversion by using the general fault deduction template to obtain the root cause of the fault alarm includes:

calling a general fault deduction template in a database according to the fault alarm converted by the data format and the logic structure information of the virtualized network element;

deducing the fault alarm by using the general fault deducing template to obtain a deducing result;

and determining the root cause of the fault alarm from the deduction result.

In some embodiments, after the determining, according to the root cause of the fault alert, an alert processing action that needs to be performed to clear the fault alert, the method further comprises:

Clearing the fault alarm according to the alarm processing action of the fault alarm;

generating state information for clearing the fault alarm according to the result of clearing the fault alarm, wherein the state information is used for indicating whether the fault alarm is cleared or not;

the state information is sent to a fault model learning network for iterative training, and an optimized general fault deduction template is obtained;

and optimizing the fault clearing table according to the state information.

In a second aspect, the present application provides a fault alert processing apparatus, comprising:

The obtaining module is used for obtaining fault alarms of the virtualized network element and logic structure information of the virtualized network element;

The format conversion module is used for converting the format of the fault alarm into a data format of a preset general fault deduction template;

The root cause analysis module is used for carrying out root cause analysis on the fault alarms after the data format conversion by utilizing the general fault deduction template to obtain root causes of the fault alarms;

And the first determining module is used for determining an alarm processing action to be executed according to the root cause of the fault alarm so as to clear the fault alarm.

In some embodiments, the apparatus further comprises:

The loading module is used for loading the topological structure of the network after power-on; the topological structure of the network comprises a topological structure between a physical machine and a virtual machine in the network;

And the second determining module is used for determining logic structure information of the virtualized network element according to the topological structure of the network after the fault alarm of the virtual machine is obtained.

In some embodiments, the obtaining module is further configured to subscribe, to the virtual machine, a fault alert of the virtual machine according to a service requirement, and receive the fault alert of the virtualized network element sent by the virtual machine; or actively inquiring the performance index of the virtual machine from the virtual machine, and requesting the fault alarm of the virtualized network element from the virtual machine when the virtualized network element is abnormal according to the performance index of the virtual machine.

In some embodiments, the apparatus further comprises:

A third determining module, configured to determine a set of possible fault alarms according to the logical structure information of the virtualized network element;

The template writing module is used for writing the general fault deduction template according to the logic structure information of the virtualized network element and the fault alarm set;

and the first storage module is used for storing the general fault deduction template in a database.

In some embodiments, the first determination module includes a definition unit and a second save unit, wherein:

the definition unit is used for defining the alarm processing action required to be executed for the alarm according to the root cause of the fault alarm and the logic structure information of the virtualized network element;

The second storage unit is used for storing the root cause of the fault alarm and the corresponding alarm processing action in a database as a fault clearing table;

the first determining module is further used for inquiring a fault clearing table in a database according to the root cause of the fault alarm to obtain an alarm processing action; and clearing the fault alarm according to the alarm processing action.

In some embodiments, the root cause analysis module comprises a calling unit, a deriving unit, and a root cause determining unit, wherein:

The calling unit is used for calling a general fault deduction template in a database according to the fault alarm converted by the data format and the logic structure information of the virtualized network element;

The deduction unit is used for deducting the fault alarm by utilizing the general fault deduction template to obtain a deduction result;

and the root cause determining unit is used for determining the root cause of the fault alarm from the deduction result.

In some embodiments, the apparatus further comprises: the system comprises a clearing module, a state information generating module, an iterative training module and an optimizing module, wherein:

The clearing module is used for clearing the fault alarm according to the alarm processing action of the fault alarm;

The state information generation module is used for generating state information for clearing fault alarms according to the result of clearing the fault alarms, and the state information is used for indicating whether the fault alarms are cleared or not;

The iterative training module is used for sending the state information to a fault model learning network for iterative training to obtain an optimized general fault deduction template;

and the optimizing module is used for optimizing the fault clearing table according to the state information.

In a third aspect, the present application provides a fault alert processing apparatus, the apparatus comprising: a memory and a processor, the memory storing a computer program executable on the processor, the processor implementing the steps of the above method when the program is executed.

In a fourth aspect, the present application provides a computer readable storage medium having stored thereon a computer program which, when executed by a processor, performs the steps of the above method.

The application provides a fault alarm processing method, a device, equipment and a storage medium, wherein firstly VNMM obtains fault alarms of a virtualized network element and logic structure information of the virtualized network element, then converts the format of the fault alarms according to the data format of a general fault deduction template for carrying out root cause analysis on the fault alarms, analyzes the root cause, and finally clears the fault alarms according to the root cause. Therefore, the technical scheme provided by the application can carry out root cause analysis on the fault alarms of the virtualized network element, find out the root cause alarms from a large number of complicated fault alarms, and then carry out fault processing on the root cause alarms. In this way, the problems arising from virtualizing network elements can be quickly solved.

Further, the fault alarm of the virtualized network element can be obtained according to the performance index of the subscription or inquiry virtual machine, and the fault alarm of the appointed type can be obtained.

Still further, the root cause of the fault alarm of the appointed type can be rapidly positioned according to the logic structure information of the virtualized network element, which is beneficial to carrying out root cause analysis on the fault alarm of the virtualized network element and obtaining the fault root cause alarm. And finally, the action required to be executed is acquired through the fault root cause alarm to clear the alarm information, so that the fault problem can be accurately solved, meanwhile, the general fault deduction template and the alarm processing action can be optimized through the combination of a machine learning algorithm and a fault clearing processing result, and the optimized general fault deduction model and processing action are trained, so that the general fault deduction model and processing action can be optimized in time, the fault can be accurately solved, and the fault solving efficiency is improved.

Finally, the accuracy of fault deduction and fault processing can be improved according to the optimized general fault deduction model and processing actions, and the problems generated by the virtualized network element can be solved.

Drawings

Fig. 1 is a schematic implementation flow chart of a fault alarm processing method according to a first embodiment of the present application;

fig. 2 is a schematic implementation flow chart of a fault alarm processing method according to a second embodiment of the present application;

fig. 3 is a schematic implementation flow chart of a fault alarm processing method according to a third embodiment of the present application;

fig. 4 is a schematic diagram of a composition structure of a fault alarm processing device according to a fourth embodiment of the present application;

fig. 5 is a schematic implementation flow chart of a fault alarm processing method according to a fifth embodiment of the present application;

fig. 6 is a schematic implementation flow chart of a fault alarm processing method according to a sixth embodiment of the present application;

Fig. 7 is a schematic implementation flow chart of a fault alarm processing method according to a seventh embodiment of the present application;

fig. 8 is a schematic implementation flow chart of a fault alarm processing method according to an eighth embodiment of the present application;

Fig. 9 is a schematic diagram of a composition structure of a fault alarm processing device according to a ninth embodiment of the present application;

fig. 10 is a schematic diagram of a hardware entity of a fault alarm processing device according to an embodiment of the present application.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, a specific technical solution of the present application will be described in further detail with reference to the accompanying drawings. The following examples are illustrative of the application and are not intended to limit the scope of the application.

Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing the application only and is not intended to be limiting of the application.

In the following description, reference is made to "some embodiments" which describe a subset of all possible embodiments, but it is to be understood that "some embodiments" can be the same subset or different subsets of all possible embodiments and can be combined with one another without conflict.

It should be noted that the term "first\second\third" related to the present application is merely to distinguish similar objects, and does not represent a specific order for the objects, it being understood that the "first\second\third" may interchange a specific order or sequence, where allowed, to enable the present application described herein to be implemented in an order other than that illustrated or described herein.

The NFV is used as a virtualization technology, and by deploying the software network function on a stable commercial computing resource platform, complex connection configuration work in the traditional heterogeneous hardware network function deployment process is avoided, and the problems of high equipment price, difficult management and high failure rate caused by connection configuration, network flow overload and the like of traditional network function hardware equipment are effectively solved by combining flexible load balancing and other management mechanisms.

The european telecommunications standardization institute (European Telecommunications Standards Institute, ETSI) standardizes NFV architecture, which generally includes three parts, namely (1) virtualized network function 110 (Virtual Network Function, VNF), (2) network function virtualization management and orchestration 120 (MANAGEMENT AND Orchestration, MANO), and (3) network function virtualization infrastructure 130 (NFV Infrastructure, NFVI), wherein MANO includes virtualized network function manager 12 (Virtual Network Function Management, VNFM).

VNFs are various types of software that can be deployed on virtual resources. Different VNFs are typically developed by mutually independent software developers according to the NFV standard. A single VNF may be composed of multiple internal components, and thus, a single VNF may be distributed over multiple Virtual Machines (VMs), with different Virtual machines hosting different VNF components.

NFVI is a generic term for a hardware and software architecture that provides the environment required for NFVI deployment, management, and operation, including hardware resources, virtualization layers, and virtualized resources. Where virtualized resources are abstractions of computing resources, network resources, and storage resources. Including virtualized computing resources, virtualized storage resources, and virtualized network resources. Virtualized network resources are typically represented as virtual nodes and virtual network links. Wherein the virtual node is software (e.g., an operating system in a VM) with hosting or routing functionality; the virtual links provide connectivity for the virtual nodes, so that the virtual nodes have physical link attributes which can be dynamically changed.

The MANO is responsible for providing the NFV platform with the functions and operations (e.g., configuration of VNFs and virtual resources) required for coordinated control of all VNFs, enabling all VNFs to operate in an orderly fashion. The MANO mainly comprises three parts, namely a virtualized facility manager, a virtualized network function manager and a virtualized network function scheduler.

In the NFV network, the cooperative coordination of different components can affect the reliability of the whole system, and the NFV network should have perfect fault monitoring, fault diagnosis and positioning and fault repairing. Thus, improving reliability in NFV environments, work can be undertaken from three aspects: firstly, fault monitoring, namely judging whether faults occur or not through working such as data control flow checking, performance monitoring, network equipment log analysis and anomaly checking; secondly, fault diagnosis positioning, namely starting fault positioning once a fault is found, and determining the relevance of the fault by analyzing and confirming where the fault occurs; thirdly, fault repair, namely starting a fault recovery program according to the fault position to finish recovery actions such as service migration, redundancy backup, data protection and the like, and improving the NFV reliability through the three steps. Therefore, monitoring the fault alarm, analyzing the root cause alarm of the fault alarm and clearing the fault alarm is particularly important for the reliability of the NFV network system.

From the background, the drawbacks of the prior art in the field of self-healing of virtualized network elements are as follows: 1) After the virtual network element is monitored to generate the fault alarm, the root cause analysis is not performed on the fault alarm, and the corresponding processing is directly performed on the fault alarm, so that the root cause of the problem cannot be accurately solved, and the root cause analysis is performed on the fault alarm in the application, so that the root cause of the problem is found. 2) The processing rules of the faults need to be manually customized and then imported into a database, and when a large number of fault alarms exist, a large number of processing rules need to be customized, so that the maintenance cost of the processing rules can be increased.

Example 1

The embodiment of the application provides a fault alarm processing method, which is used for carrying out root cause analysis on reported fault alarms of a virtualized network element, searching out root cause fault alarms from a large number of complex fault alarms, and then carrying out fault processing on the problems, so that the problems generated by the virtualized network element can be rapidly solved.

Fig. 1 is a schematic implementation flow chart of a fault alarm processing method according to an embodiment of the present application, as shown in fig. 1, where the method includes:

step 101: obtaining fault alarm of a virtualized network element and logic structure information of the virtualized network element;

VNFs are various types of software that can be deployed on virtual resources, which are network elements after virtualization. The VNF is carried on the NFV infrastructure, deployed on a virtual machine, and the network element service functions remain consistent with the interfaces and non-virtualized time. After network function virtualization, the VNF replaces the physical/physical network function (Physical Network Function, PNF). A single VNF may be built up of multiple internal components, and thus, a single VNF may be distributed over multiple Virtual Machines (VMs), with different Virtual machines hosting different VNF components.

The monitoring management of the virtualized network elements is mainly completed by MANO. MANO mainly includes VNFM and VIM. Therefore, the VNFM may obtain fault alert information of the virtual network element and logical structure information of the virtualized network element in the NFVI. The logical structure information of the virtualized network elements is connectivity between virtual machines, namely dynamically changing physical link attributes.

Step 102: converting the format of the fault alarm into a data format of a preset general fault deduction template;

Here, the generic fault derivation template is used to derive a root cause alarm of the fault alarm according to the fault alarm and the logical structure information of the virtualized network element.

Here, the general fault derivation template is written according to the service scenario of the virtualized network element, i.e. the logical structure information, and the fault alarms that may be generated in the service scenario. The format of the fault alarm is converted into the format of a general fault deduction template, so that root cause analysis can be conveniently carried out according to the fault alarm, and the root cause of the fault alarm can be found.

Step 103: performing root cause analysis on the fault alarms after the data format conversion by utilizing the general fault deduction template to obtain root causes of the fault alarms;

The physical machine sending the fault alarm can be found according to the fault alarm, the virtual machine connected with the physical machine is found through the logic structure information in the general fault deducing template, the virtual machine sending the alarm is deduced, and the root cause alarm of the fault alarm is found.

Step 104: and determining an alarm processing action to be executed according to the root cause of the fault alarm so as to clear the fault alarm.

By deriving the root cause of the fault alarm, the action of alarm processing which needs to be executed by the root cause can be determined, and the alarm processing action is a series of processing actions for solving the fault of the virtualized network element.

The first embodiment of the application provides a fault alarm processing method, firstly, VNM obtains fault alarm of a virtualized network element and logic structure information of the virtualized network element, then converts the format of the fault alarm according to the data format of a general fault deduction template for carrying out root cause analysis on the fault alarm, analyzes the root cause, and finally clears the fault alarm according to the root cause. Therefore, the technical scheme provided by the application can carry out root cause analysis on the fault alarms of the virtualized network element, find out the root cause alarms from a large number of complicated fault alarms, and then carry out fault processing on the root cause alarms. In this way, the problems arising from virtualizing network elements can be quickly solved.

Example two

The embodiment of the application provides a fault alarm processing method. Fig. 2 is a schematic implementation flow chart of a fault alarm processing method according to an embodiment of the present application, as shown in fig. 2, where the method includes:

Step 201: after power-on, loading a topological structure of the network; the topological structure of the network comprises a topological structure between a physical machine and a virtual machine in the network;

after the VNM is electrified, the topology structure of the network, which is the connection relationship between the physical machine and the virtual machine of the network, is automatically loaded.

Step 202: obtaining fault alarm of a virtualized network element and logic structure information of the virtualized network element;

step 203: after obtaining fault alarms of the virtualized network element, determining logic structure information of the virtualized network element according to the topological structure of the network;

After the VNFM obtains the fault alert of the virtualized network element, connectivity between the virtual machines, i.e. dynamically changing physical link properties, provided between the virtual machines is established according to the topology of the network. Since the virtualized network elements are distributed on a plurality of virtual machines, the logical structure information of the virtualized network elements can be determined according to the physical link attributes of the virtual machines.

Step 204: converting the format of the fault alarm into a data format of a preset general fault deduction template;

Step 205: performing root cause analysis on the fault alarms after the data format conversion by utilizing the general fault deduction template to obtain root causes of the fault alarms;

Step 206: and determining an alarm processing action to be executed according to the root cause of the fault alarm so as to clear the fault alarm.

The second embodiment of the application provides a fault alarm processing method, firstly, loading a topology structure of a network, and secondly, determining logic structure information of a virtualized network element according to fault alarms of the virtualized network element and the topology structure of the network. Therefore, the technical scheme provided by the application can determine the logic structure information of the virtualized network element borne on the virtual machine according to the topological structure of the network, so that the root cause of the fault alarm can be rapidly positioned according to the logic structure information of the virtualized network element, and the problem generated by the virtualized network element can be solved.

Example III

The embodiment of the application provides a fault alarm processing method. Fig. 3 is a schematic implementation flow chart of a fault alarm processing method according to an embodiment of the present application, as shown in fig. 3, where the method includes:

Step 301: subscribing the fault alarm of the virtualized network element to the virtual machine according to service requirements, and receiving the fault alarm of the virtualized network element sent by the virtual machine; or actively inquiring the performance index of the virtual machine from the virtual machine, and requesting the virtual machine for fault warning of the virtualized network element when the virtualized network element is abnormal according to the performance index of the virtual machine;

The traffic demands typically include network element traffic, network element operation maintenance, storage and management of user data. The VNM subscribes the fault alarm of the virtualized network element related to the service according to the service requirement, and receives the subscribed fault alarm sent by the virtual machine.

Or actively inquiring each performance index of the virtual machine, monitoring whether each performance index is abnormal, and requesting to receive fault alarms of the virtualized network element when the performance indexes are abnormal. The performance index of the virtual machine includes various kinds, such as CPU occupancy rate, database load, and the like. When the concurrent processes during business processing are too many, and the business volume is too large, the abnormal problems of the virtual machines such as too high CPU occupancy rate, too large load and the like can exist.

For example, a service scenario is a network element service, such as a virtual machine with functions of signaling distribution, signaling proxy and media proxy, in which the CPU occupancy rate of the virtual machine needs to be monitored in real time, so that according to service requirements, fault alarms with the CPU occupancy rate exceeding a threshold value of the virtual machine need to be subscribed. When the alarm level is customized: secondary: the CPU occupancy rate of the virtual machine is less than 90% and is important: the CPU occupancy rate of the virtual machine is more than or equal to 90 percent. And when the CPU occupancy rate of the virtual machine exceeds a threshold value, receiving a fault alarm of the virtual machine. Or monitoring the value of the CPU occupancy rate of the virtual machine by fixed interval time, detecting the CPU occupancy rate of the virtual machine by the system according to a period of 60 seconds, and generating an alarm by the system when detecting that the CPU occupancy rate of the virtual machine is greater than or equal to the alarm threshold value set by the system three times continuously. The virtual machine forwards the alert to the VNFM.

Step 302: converting the format of the fault alarm into a data format of a preset general fault deduction template;

Step 303: performing root cause analysis on the fault alarms after the data format conversion by utilizing the general fault deduction template to obtain root causes of the fault alarms;

Step 304: and determining an alarm processing action to be executed according to the root cause of the fault alarm so as to clear the fault alarm.

The third embodiment of the application provides a fault alarm processing method, which is used for subscribing the fault alarm of a virtualized network element to a virtual machine according to service requirements or actively inquiring performance indexes of the virtual machine to obtain the fault alarm of the virtualized network element. Therefore, the technical scheme provided by the application can acquire the fault alarm of the virtualized network element according to the performance index of the subscription or inquiry virtual machine, and is beneficial to solving the problem generated by the virtualized network element.

Example IV

The embodiment of the application provides a fault alarm processing device of a virtualized network element, which can accurately obtain root cause fault alarms by monitoring various fault alarms of the virtualized network element and carrying out root cause analysis on fault alarm information, and can carry out fault processing on the virtualized network element by combining corresponding fault processing actions, and can optimize a fault model and generate a new fault model according to the state of the virtualized network element after the fault is processed by utilizing a machine learning algorithm.

The embodiment of the application firstly provides a fault alarm processing device, as shown in fig. 4, which comprises:

Alarm monitoring module 410: various fault alarms for monitoring and receiving virtualized network elements; before receiving the fault alarm, a general deduction model of the fault alarm needs to be defined, a general fault deduction template is written according to the service scene of the virtualized network element and is stored in a database, and the processing action of the self-defined alarm is needed for the root cause alarm and the corresponding execution script is stored in the database. After receiving various fault alarms of the virtualized network element, the fault alarms need to be formatted into a data format of the root cause analysis module and sent to the root cause analysis module for root cause analysis of the fault alarms.

Root cause analysis module 420: the root cause analysis is used for carrying out root cause analysis on the reported fault alarms of various virtualized network elements;

After receiving the fault alarm of the virtualized network element, the alarm is corresponding to the logic structure of the virtualized network element, a general fault deduction model in a database is called to deduce the fault alarm, the root cause alarm can be obtained from the deduction result, and the alarm processing action required to be executed in the database is inquired according to the root cause alarm of the fault.

Fault handling module 430: the method is used for processing the fault alarm of the virtualized network element by combining the derived root cause alarm with the corresponding fault processing action;

After the fault processing action of the virtualized network element is executed, the executed state information can be obtained, whether the executed action solves the fault alarm or not is judged, a result is sent to a fault model learning module, and iterative training is carried out, so that a general fault deduction template and the fault processing action are optimized.

Fault model learning module 450: and the universal fault template is used for obtaining the optimized root cause alarm according to the processing result of the fault alarm.

The method comprises the steps of learning a general deduction fault template and an alarm processing action by combining an obtained fault processing result of a virtualized network element with a self-defined fault processing action, optimizing the processing action of the general deduction fault template and the alarm, simultaneously collecting the fault alarm of the virtualized network element in the past period on line, learning the general deduction fault template by combining the self-defined general deduction fault template by utilizing a machine learning algorithm, optimizing the processing action of the general deduction fault template and the root cause alarm, and simultaneously producing a new general fault template.

Network function virtualization manager 440: for controlling the alarm monitoring module 410, the root cause analysis module 420, the fault handling module 430, the fault model learning module 450.

Based on the above provided device, an embodiment of the present application provides a fault alarm processing method, including:

Step 401, customizing a general deduction template of fault alarm according to a service scene of a virtualized network element on a VNFM, and simultaneously customizing a corresponding processing action aiming at root cause alarm, if a certain virtual machine receiving the virtualized network element is unavailable, if the computing node where the virtual machine is located is likely to be faulty, if the action to be executed is to migrate the virtual machine.

Step 402, subscribing to the fault alarm of the virtualized network element, the fault alarm of the virtualized network element can be actively received, and meanwhile, various performance indexes of the virtualized network element can be actively inquired, and whether the virtualized network element has abnormality or not is judged according to the performance indexes.

In the implementation process, the user can subscribe the alarm of the virtualized network element, and the device can actively subscribe according to the service requirement.

Step 403, starting the virtualized network element fault self-healing service, which mainly comprises an alarm monitoring module, a root cause analysis module, a fault template learning module and a fault processing module.

Here, the fault self-healing service is the device provided above.

Step 404, if the alarm monitoring module of the VNFM receives a fault alarm reported by the virtualized network element, the fault alarm information needs to be formatted according to a fixed format and sent to the root cause analysis module;

step 405, the root cause analysis module derives the root cause alarm of the fault according to the logic structure of the virtualized network element and simultaneously by combining with the custom general deriving fault template.

Step 406, according to the derived fault root alarm, inquiring the corresponding root alarm clearing action in the database, sending the execution permission of the action to the VNF, and determining whether to execute or not according to the returned result of the VNF.

Step 407, if yes, executing an alarm processing action, inquiring whether the virtual network element fault alarm is cleared or not according to the executed result, and returning the result to the fault template learning module;

step 408, learning the general deduction fault template through the returned processing result, optimizing the general fault template and the alarm processing action, and generating new general fault template and alarm processing action information.

In the embodiment of the application, 1) root cause analysis is carried out on the fault alarm information of the virtualized network element, and the most fundamental fault cause is found out from various fault alarms. 2) Through a machine learning algorithm, the universal deduction fault template and the alarm processing action are continuously and iteratively trained, and the accuracy of fault deduction is improved. 3) And automatically executing the self-healing action of the virtualized network element through the fault root cause alarm, and simultaneously optimizing the general fault deduction model and the processing action according to the self-healing result.

Compared with the related art, the fourth embodiment of the application has the following technical advantages: the root cause analysis is carried out on the fault alarms of the virtualized network element, the root cause of the fault alarms is obtained, the alarm information is cleared through the actions required to be executed obtained by the fault root cause alarms, so that the fault problem can be accurately solved, meanwhile, the general fault deduction template and the alarm processing actions can be optimized through the machine learning algorithm in combination with the fault clearing processing results, and the new general fault deduction model and the new general fault processing actions are trained.

Example five

The embodiment of the application provides a fault alarm processing method. Fig. 5 is a schematic implementation flow chart of a fault alarm processing method according to an embodiment of the present application, as shown in fig. 5, where the method includes:

step 501: obtaining fault alarm of a virtualized network element and logic structure information of the virtualized network element;

step 502: determining a possible generated fault alarm set according to the logic structure information of the virtualized network element;

The virtualized network element can be respectively deployed on a plurality of virtual machines, logic structure information of the virtualized network element can be determined according to the connection relation between the physical machine and each virtual machine and the connection relation between the virtual machines, and a set of possible fault alarms is obtained through possible fault alarms generated by the virtualized network element and other virtualized network elements associated with the network element.

For example, when two virtual machines cannot communicate, a communication fault alarm is generated; the functions of the virtualized network elements deployed on the two virtual machines cannot be carried out together, and when the virtual machines process network element services and cannot carry out signaling distribution, distribution fault alarms can be generated. Thus, based on the logical structure of the virtualized network element, a set of these potentially generated fault alarms can be determined.

Step 503: writing the general fault deduction template according to the logic structure information of the virtualized network element and the fault alarm set;

According to the logic structure information of the virtualized network element and the fault alarm set, the virtualized network element generating the fault alarm can be positioned according to the displayed fault alarm, so that the root cause generating the fault alarm is positioned. Therefore, the general fault deduction template can be written to describe the corresponding relation between the fault alarm and the logic structure information, and the fault root cause can be deduced according to the fault alarm.

Step 504: storing the generic fault derivation template in a database;

And storing the general fault deduction template into a database, and calling the general fault deduction model in the database to deduce the fault alarm, wherein the general fault deduction template corresponds to the logic structure of the virtualized network element after the fault alarm is detected.

Step 505: converting the format of the fault alarm into a data format of a preset general fault deduction template;

step 506: performing root cause analysis on the fault alarms after the data format conversion by utilizing the general fault deduction template to obtain root causes of the fault alarms;

Step 507: and determining an alarm processing action to be executed according to the root cause of the fault alarm so as to clear the fault alarm.

The fifth embodiment of the application provides a fault alarm processing method, which is characterized in that the general fault deduction template is stored in a database; and converting the format of the fault alarm into a data format of a preset general fault deduction template. Therefore, the storage and management of fault alarms are facilitated, the problem of faults can be accurately solved, and the problem solving efficiency is improved.

Example six

The embodiment of the application provides a fault alarm processing method. Fig. 6 is a schematic implementation flow chart of a fault alarm processing method according to an embodiment of the present application, as shown in fig. 6, where the method includes:

step 601: obtaining fault alarm of a virtualized network element and logic structure information of the virtualized network element;

Step 602: converting the format of the fault alarm into a data format of a preset general fault deduction template;

Step 603: performing root cause analysis on the fault alarms after the data format conversion by utilizing the general fault deduction template to obtain root causes of the fault alarms;

Step 604: defining an alarm processing action to be executed on the alarm according to the root cause of the fault alarm and the logic structure information of the virtualized network element;

according to the root cause of the fault alarm and the logic structure information of the virtualized network element, the root cause of the fault alarm can be positioned, and the root cause of the fault alarm can be solved and can be executed through a series of fault alarm processing actions. The alarm handling action is some operation instruction capable of solving the failure of the virtualized network element. For example, when the CPU occupancy exceeds a threshold, the processing action is to shut down the idle thread/process.

Step 605: the root cause of the fault alarm and the corresponding alarm processing action are used as a fault clearing table and stored in a database;

According to the root cause of the fault alarm and the corresponding fault alarm processing action, a fault alarm clearing table can be established. The fault alert clearance table may be used to query the alert processing actions based on the root cause of the fault alert.

Step 606: the determining, according to the root cause of the fault alarm, an alarm processing action to be executed to clear the fault alarm includes: inquiring a fault clearing table in a database according to the root cause of the fault alarm to obtain an alarm processing action; and clearing the fault alarm according to the alarm processing action.

The sixth embodiment of the present application provides a fault alarm processing method, which defines an alarm processing action to be executed on the alarm, and stores the root cause of the fault alarm and the corresponding alarm processing action as a fault clearing table in a database, so that the speed of inquiring the processing action during fault processing of a virtualized network element can be improved, and the improvement of the fault processing efficiency is beneficial to solving the problem generated by the virtualized network element.

Example seven

The embodiment of the application provides a fault alarm processing method. Fig. 7 is a schematic implementation flow chart of a fault alarm processing method according to an embodiment of the present application, as shown in fig. 7, where the method includes:

Step 701: obtaining fault alarm of a virtualized network element and logic structure information of the virtualized network element;

Step 702: converting the format of the fault alarm into a data format of a preset general fault deduction template;

step 703: calling a general fault deduction template in a database according to the fault alarm converted by the data format and the logic structure information of the virtualized network element;

Step 704: deducing the fault alarm by using the general fault deducing template to obtain a deducing result;

when the fault alarm is deduced according to the general fault deduction template, the deduction result is the fault alarm of the virtual network element which causes the fault alarm.

Step 705: determining the root cause of the fault alarm from the deduction result;

the located virtualized network element of the fault alarm is the root cause of the fault alarm.

Step 706: and determining an alarm processing action to be executed according to the root cause of the fault alarm so as to clear the fault alarm.

The seventh embodiment of the application provides a fault alarm processing method, which deduces the fault alarm through a general fault deducing template, can carry out root cause analysis on the fault alarm of a virtualized network element, and finds out the most fundamental fault cause from various fault alarms. Therefore, the technical scheme provided by the application can find the root cause of the fault according to the fault alarm of the virtualized network element, and is beneficial to solving the problem generated by the virtualized network element.

Example eight

The embodiment of the application provides a fault alarm processing method. Fig. 8 is a schematic implementation flow diagram of a fault alarm processing method according to an embodiment of the present application, as shown in fig. 8, where the method includes:

step 801: obtaining fault alarm of a virtualized network element and logic structure information of the virtualized network element;

step 802: converting the format of the fault alarm into a data format of a preset general fault deduction template;

Step 803: calling a general fault deduction template in a database according to the fault alarm converted by the data format and the logic structure information of the virtualized network element;

Step 804: deducing the fault alarm by using the general fault deducing template to obtain a deducing result;

Step 805: determining the root cause of the fault alarm from the deduction result;

step 806: determining an alarm processing action to be executed according to the root cause of the fault alarm so as to clear the fault alarm;

step 807: clearing the fault alarm according to the alarm processing action of the fault alarm;

step 808: generating state information for clearing the fault alarm according to the result of clearing the fault alarm, wherein the state information is used for indicating whether the fault alarm is cleared or not;

After clearing the fault alert through a series of fault alert clearing actions, the VNFM may indicate the clearing result in a manner that clears status information of the fault alert. The status information for clearing the fault alert is a set of instructions, or a symbolic label, that indicates whether the fault alert was cleared.

For example, when the state information for clearing the fault alarm is set as a group of marks, setting 1 indicates clearing and 0 indicates not clearing, and then the fault alarm clearing action processing result can be intuitively judged from the marks of the state information.

Step 809: the state information is sent to a fault model learning network for iterative training, and an optimized general fault deduction template is obtained;

The fault model learning network is a machine learning algorithm network, and can be a supervised learning algorithm, a semi-supervised learning algorithm and an unsupervised learning algorithm network. The fault model learning network is used for correcting the general fault deducing template according to the state information of clearing fault alarms, obtaining logic structure information of the virtualized network element corresponding to the fault alarms, continuously correcting the general fault deducing template generated by the previous iteration again according to the state information of clearing fault alarms after one iteration, and optimizing the general fault deducing template in continuous loop iteration training to obtain the optimized general fault deducing template.

Step 810: and optimizing the fault clearing table according to the state information.

When the optimized general fault deduction template is used for optimizing the fault clearing table, the corresponding alarm processing action in the fault clearing table can be found according to the optimized general fault deduction template, and the alarm processing action is corrected according to whether the root cause alarm can be solved or not by the alarm processing action, so that the optimized fault clearing table is obtained.

The eighth embodiment of the application provides a fault alarm processing method, which is characterized in that a general deduction fault template and an optimized fault clearing table are trained through a machine learning algorithm in a continuous iteration mode, so that the accuracy of fault deduction is improved. And automatically executing the fault processing action of the virtualized network element through the fault root cause alarm, and simultaneously optimizing the general fault deduction model and the processing action according to the fault processing result. Therefore, the technical scheme provided by the application can improve the accuracy of fault deduction and fault processing according to the optimized deduction fault template, and is beneficial to solving the problems generated by the virtualized network element.

Example nine

Based on the foregoing embodiments, the embodiments of the present application provide a fault alert processing apparatus, where the apparatus includes each module included, and each unit included in each module may be implemented by a processor in a device (e.g., a fault alert processing device); of course, the method can also be realized by a specific logic circuit; in an implementation, the processor may be a Central Processing Unit (CPU), a Microprocessor (MPU), a Digital Signal Processor (DSP), a Field Programmable Gate Array (FPGA), or the like.

Fig. 9 is a schematic structural diagram of a fault alarm processing device according to an embodiment of the present application, as shown in fig. 9, where the device 900 includes an obtaining module 901, a format conversion module 902, a root cause analysis module 903, and a first determining module 904, where:

An obtaining module 901, configured to obtain a fault alarm of a virtualized network element and logic structure information of the virtualized network element;

the format conversion module 902 is configured to convert the format of the fault alarm into a data format of a preset general fault deduction template;

Here, the general fault deducing template is used for deducing the root cause alarm of the fault alarm according to the fault alarm and the logic structure information of the virtualized network element;

the root cause analysis module 903 is configured to perform root cause analysis on the fault alarm after the data format conversion by using the general fault deduction template, so as to obtain a root cause of the fault alarm;

A first determining module 904, configured to determine, according to the root cause of the fault alarm, an alarm processing action to be executed to clear the fault alarm.

Examples ten

Based on the foregoing embodiments, an embodiment of the present application provides a fault alert processing apparatus, including: the system comprises a loading module, an obtaining module, a second determining module, a format conversion module, a root cause analysis module and a first determining module, wherein:

the acquisition module is used for acquiring fault alarms of the virtual machine and logic structure information of the virtual machine;

The second determining module is used for determining logic structure information of the virtualized network element according to the topological structure of the network after obtaining the fault alarm of the virtual machine;

Example eleven

Based on the foregoing embodiments, an embodiment of the present application provides a fault alert processing apparatus, including: the system comprises an acquisition module, a format conversion module, a root cause analysis module and a first determination module, wherein:

The obtaining module is further used for subscribing the fault alarm of the virtual machine to the virtual machine according to the service requirement and receiving the fault alarm of the virtualized network element sent by the virtual machine; or actively inquiring the performance index of the virtual machine from the virtual machine, and requesting the virtual machine for fault warning of the virtualized network element when the virtualized network element is abnormal according to the performance index of the virtual machine;

Example twelve

Based on the foregoing embodiments, an embodiment of the present application provides a fault alert processing apparatus, including: the system comprises an acquisition module, a third determination module, a template writing module, a first storage module, a format conversion module, a root cause analysis module and a first determination module, wherein:

The first storage module is used for storing the general fault deduction template in a database;

Example thirteen

Based on the foregoing embodiments, an embodiment of the present application provides a fault alert processing apparatus, including: the system comprises an acquisition module, a format conversion module, a root cause analysis module and a first determination module, wherein the first determination module comprises a definition unit and a second storage unit:

The first determining module is used for: inquiring a fault clearing table in a database according to the root cause of the fault alarm to obtain an alarm processing action; and clearing the fault alarm according to the alarm processing action.

Examples fourteen

Based on the foregoing embodiments, an embodiment of the present application provides a fault alert processing apparatus, including: the system comprises an acquisition module, a format conversion module, a root cause analysis module and a first determination module, wherein the root cause analysis module comprises a calling unit, a deduction unit and a root cause determination unit:

a root cause determining unit, configured to determine a root cause of the fault alarm from the deduction result;

Example fifteen

Based on the foregoing embodiments, an embodiment of the present application provides a fault alert processing apparatus, including: the system comprises an acquisition module, a format conversion module, a root cause analysis module, a first determination module, a clearing module, a state information generation module, an iterative training module and an optimization module, wherein the root cause analysis module comprises a calling unit, a deduction unit and a root cause determination unit:

The first determining module is used for determining an alarm processing action to be executed according to the root cause of the fault alarm so as to clear the fault alarm;

The description of the apparatus embodiments above is similar to that of the method embodiments above, with similar advantageous effects as the method embodiments. For technical details not disclosed in the embodiments of the apparatus of the present application, please refer to the description of the embodiments of the method of the present application.

It should be noted that, in the embodiment of the present application, if the above-mentioned fault alarm processing method is implemented in the form of a software functional module, and sold or used as a separate product, the fault alarm processing method may also be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application may be essentially or partly contributing to the related art, and the computer software product may be stored in a storage medium, and include several instructions for causing an apparatus to execute all or part of the methods described in the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read Only Memory (ROM), a magnetic disk, an optical disk, or other various media capable of storing program codes. Thus, embodiments of the application are not limited to any specific combination of hardware and software.

Correspondingly, the embodiment of the application provides fault alarm processing equipment, which comprises a memory and a processor, wherein the memory stores a computer program capable of running on the processor, and the processor realizes the steps in the method when executing the program.

Accordingly, embodiments of the present application provide a computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements steps in the method.

It should be noted here that: the description of the storage medium and apparatus embodiments above is similar to that of the method embodiments described above, with similar benefits as the method embodiments. For technical details not disclosed in the embodiments of the storage medium and the apparatus of the present application, please refer to the description of the method embodiments of the present application.

It should be noted that, fig. 10 is a schematic diagram of a hardware entity of a fault alarm processing device (e.g. a virtualized network function manager) according to an embodiment of the present application, as shown in fig. 10, the hardware entity of the device 1000 includes: a processor 1001, a communication interface 1002 and a memory 1003, wherein

The processor 1001 generally controls the overall operation of the device 1000.

The communication interface 1002 may enable the device to communicate with other terminals or servers over a network.

The memory 1003 is configured to store instructions and applications executable by the processor 1001, and may also cache data to be processed or processed by each module in the processor 1001 and the device 1000, and may be implemented by a FLASH memory (FLASH) or a random access memory (Random Access Memory, RAM).

It should be appreciated that reference throughout this specification to "one embodiment" or "an embodiment" means that a particular feature, structure or characteristic described in connection with the embodiment is included in at least one embodiment of the present application. Thus, the appearances of the phrases "in one embodiment" or "in an embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. It should be understood that, in various embodiments of the present application, the sequence numbers of the foregoing processes do not mean the order of execution, and the order of execution of the processes should be determined by the functions and internal logic thereof, and should not constitute any limitation on the implementation process of the embodiments of the present application. The foregoing embodiment numbers of the present application are merely for the purpose of description, and do not represent the advantages or disadvantages of the embodiments.

It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

In the several embodiments provided by the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. The above described device embodiments are only illustrative, e.g. the division of the units is only one logical function division, and there may be other divisions in practice, such as: multiple units or components may be combined or may be integrated into another system, or some features may be omitted, or not performed. In addition, the various components shown or discussed may be coupled or directly coupled or communicatively coupled to each other via some interface, whether indirectly coupled or communicatively coupled to devices or units, whether electrically, mechanically, or otherwise.

The units described above as separate components may or may not be physically separate, and components shown as units may or may not be physical units; can be located in one place or distributed to a plurality of network units; some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated in one processing unit, or each unit may be separately used as one unit, or two or more units may be integrated in one unit; the integrated units may be implemented in hardware or in hardware plus software functional units.

Those of ordinary skill in the art will appreciate that: all or part of the steps for implementing the above method embodiments may be implemented by hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, where the program, when executed, performs steps including the above method embodiments; and the aforementioned storage medium includes: a mobile storage device, a Read Only Memory (ROM), a magnetic disk or an optical disk, or the like, which can store program codes.

Or the above-described integrated units of the application may be stored in a computer-readable storage medium if implemented in the form of software functional modules and sold or used as separate products. Based on such understanding, the technical solutions of the embodiments of the present application may be essentially or partly contributing to the related art, and the computer software product may be stored in a storage medium, and include several instructions for causing an apparatus to execute all or part of the methods described in the embodiments of the present application. And the aforementioned storage medium includes: various media capable of storing program codes, such as a removable storage device, a ROM, a magnetic disk, or an optical disk.

The foregoing is merely an embodiment of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily think about changes or substitutions within the technical scope of the present application, and the changes and substitutions are intended to be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A fault alert processing method, the method comprising:

Writing a general fault deduction template according to the logic structure information of the virtualized network element and the fault alarm set;

Converting the format of the fault alarm into the data format of the general fault deduction template;

2. The method according to claim 1, wherein prior to said obtaining the failure alarm of the virtualized network element and the logical structure information of the virtualized network element, the method further comprises:

3. The method according to claim 1, wherein said obtaining a fault alert of a virtualized network element and logical structure information of the virtualized network element comprises:

4. The method of claim 1, wherein prior to said converting the format of the fault alert to the data format of the generic fault derivation template, the method further comprises:

And storing the general fault deduction template in a database.

5. The method of claim 1, wherein prior to said determining an alarm handling action to be performed to clear the fault alarm based on the root cause of the fault alarm, the method further comprises:

6. The method according to claim 5, wherein the performing root cause analysis on the fault alarm after the data format conversion by using the generic fault derivation template to obtain the root cause of the fault alarm includes:

and determining the root cause of the fault alarm from the deduction result.

7. The method of claim 6, wherein after the determining, based on the root cause of the fault alert, an alert processing action that needs to be performed to clear the fault alert, the method further comprises:

and optimizing the fault clearing table according to the state information.

8. A fault alert processing apparatus, the apparatus comprising:

The template writing module is used for writing a general fault deduction template according to the logic structure information of the virtualized network element and the fault alarm set;

the format conversion module is used for converting the format of the fault alarm into the data format of the general fault deduction template;

9. A fault alert processing apparatus comprising a memory and a processor, the memory storing a computer program executable on the processor, wherein the processor implements the steps of the method of any one of claims 1 to 7 when the program is executed.

10. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, carries out the steps of the method according to any one of claims 1 to 7.