CN114245242A - User offline detection method and device and electronic equipment - Google Patents
User offline detection method and device and electronic equipment Download PDFInfo
- Publication number
- CN114245242A CN114245242A CN202111590067.1A CN202111590067A CN114245242A CN 114245242 A CN114245242 A CN 114245242A CN 202111590067 A CN202111590067 A CN 202111590067A CN 114245242 A CN114245242 A CN 114245242A
- Authority
- CN
- China
- Prior art keywords
- offline
- online
- user
- network element
- group
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 78
- 238000000034 method Methods 0.000 claims abstract description 32
- 238000012216 screening Methods 0.000 claims description 4
- 238000012423 maintenance Methods 0.000 abstract description 19
- 230000007246 mechanism Effects 0.000 abstract description 3
- 238000004458 analytical method Methods 0.000 description 13
- 238000012545 processing Methods 0.000 description 8
- 238000010586 diagram Methods 0.000 description 7
- 238000012544 monitoring process Methods 0.000 description 7
- 230000008569 process Effects 0.000 description 7
- 230000008901 benefit Effects 0.000 description 4
- 238000004590 computer program Methods 0.000 description 4
- 230000006870 function Effects 0.000 description 4
- 230000004888 barrier function Effects 0.000 description 3
- 230000003287 optical effect Effects 0.000 description 3
- 230000002159 abnormal effect Effects 0.000 description 2
- 230000006399 behavior Effects 0.000 description 2
- 238000007405 data analysis Methods 0.000 description 2
- 230000003203 everyday effect Effects 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000008447 perception Effects 0.000 description 2
- 230000004044 response Effects 0.000 description 2
- 230000004075 alteration Effects 0.000 description 1
- 238000013475 authorization Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000003745 diagnosis Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 230000006855 networking Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 238000005067 remediation Methods 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q11/00—Selecting arrangements for multiplex systems
- H04Q11/0001—Selecting arrangements for multiplex systems using optical switching
- H04Q11/0062—Network aspects
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q11/00—Selecting arrangements for multiplex systems
- H04Q11/0001—Selecting arrangements for multiplex systems using optical switching
- H04Q11/0062—Network aspects
- H04Q11/0067—Provisions for optical access or distribution networks, e.g. Gigabit Ethernet Passive Optical Network (GE-PON), ATM-based Passive Optical Network (A-PON), PON-Ring
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q11/00—Selecting arrangements for multiplex systems
- H04Q11/0001—Selecting arrangements for multiplex systems using optical switching
- H04Q11/0062—Network aspects
- H04Q2011/0079—Operation or maintenance aspects
- H04Q2011/0083—Testing; Monitoring
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Debugging And Monitoring (AREA)
Abstract
The invention discloses a user offline detection method and device and electronic equipment. The method comprises the following steps: receiving log messages of online and offline of a whole network user, and determining time slices and network element equipment corresponding to the log messages of online and offline; carrying out group offline feature detection on the online and offline log messages which have the same time slice and belong to the same network element equipment; if the offline feature detection of the group is passed, acquiring an offline user list, wherein the offline user list at least comprises the offline duration of each offline user; and generating a group offline event of the network element equipment under the time slice according to the offline user list. According to the technical scheme, the user offline list caused by faults is accurately identified by the aid of the network operation and maintenance platform through generation of the group offline event, and an early warning mechanism is improved.
Description
Technical Field
The invention relates to the technical field of internet connection management, in particular to a user offline detection method and device and electronic equipment.
Background
With the continuous development and expansion of broadband services and the increasing complexity of networking structures, home-wide users who are caused by network faults and engineering operations claim to be high for a long time. At present, fault early warning and order dispatching mechanisms formed based on traditional equipment monitoring and alarming are still not perfect, and faults of an Optical Line Terminal (OLT for short) and specific users affected by the faults cannot be accurately identified, so that the situation of untimely early warning can occur, fault interception short messages are mistakenly sent to customers, user declaration is caused, and the home-wide satisfaction degree is not high.
Disclosure of Invention
In view of this, the main object of the present invention is to provide a user offline detection method, device and electronic device, which assist a network operation and maintenance platform in accurately identifying a user offline list caused by a fault, and improve an early warning mechanism.
According to a first aspect of the present invention, there is provided a user offline detection method, including: receiving log messages of online and offline of a whole network user, and determining time slices and network element equipment corresponding to the log messages of online and offline; carrying out group offline feature detection on the online and offline log messages which have the same time slice and belong to the same network element equipment; if the offline feature detection of the group is passed, acquiring an offline user list, wherein the offline user list at least comprises the offline duration of each offline user; and generating a group offline event of the network element equipment under the time slice according to the offline user list.
According to a second aspect of the present invention, there is provided a user offline detection apparatus, comprising: the receiving unit is used for receiving log messages of online and offline of a whole network user and determining time slices and network element equipment corresponding to the log messages of online and offline; the detection unit is used for carrying out group offline feature detection on the online and offline log messages which have the same time slice and belong to the same network element equipment; the statistical unit is used for acquiring an offline user list if the offline feature detection of the group is passed, wherein the offline user list at least comprises the offline duration of each offline user; and the generating unit is used for generating the group offline event of the network element equipment under the time slice according to the offline user list.
According to a third aspect of the present invention, there is provided an electronic apparatus comprising: a processor; and a memory arranged to store computer executable instructions that, when executed, cause the processor to perform a user offline detection method.
According to a fourth aspect of the present invention, there is provided a computer-readable storage medium storing one or more programs which, when executed by an electronic device including a plurality of application programs, cause the electronic device to execute a user offline detection method.
The invention adopts at least one technical scheme which can achieve the following beneficial effects: the user offline detection method and device of the embodiment perform group offline feature detection on the online and offline log messages according to the time slice and the network element equipment by acquiring the online and offline log messages of the users in the whole network, determine the actually affected offline user list and the offline duration of each offline user according to the offline log messages with the group offline features, generate the group offline event of the network element equipment under the time slice based on the offline user list, and assist the operation and maintenance platform to accurately identify the actually affected users and the duration of faults based on the group offline event provided by the embodiment, so that the operation and maintenance platform can accurately, quickly and comprehensively monitor and analyze the group offline event.
Drawings
Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the invention. Also, like reference numerals are used to refer to like parts throughout the drawings. In the drawings:
FIG. 1 shows a flow chart of a user offline detection method according to an embodiment of the invention;
FIG. 2 is a flow chart illustrating a user offline detection based on the AAA system according to an embodiment of the present invention;
FIG. 3 is a schematic diagram illustrating an application scenario of a user offline detection method according to an embodiment of the present invention;
FIG. 4 is a schematic structural diagram of a user offline detection device according to an embodiment of the present invention;
fig. 5 shows a schematic structural diagram of an electronic device according to an embodiment of the invention.
Detailed Description
Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. These embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be embodied in various forms and should not be limited to the embodiments set forth herein.
With the construction of the broadband service diagnosis support capability, the operation and maintenance platform of each network operator is widely applied, and the requirement that operation and maintenance personnel can find and solve the offline event causing part of user groups through the operation and maintenance platform is more urgent, but the following problems are found in the practical process:
firstly, the existing analysis logic of the log of the online and offline can only find the problem of frequent offline of a single user, and the offline event of the user group cannot be accurately identified and positioned, so that operation and maintenance personnel cannot find the offline event of the group in time, users affected by the offline event of the group cannot normally use broadband services, and the user experience is poor.
Secondly, in the active group barrier data analysis or the manual group barrier data analysis at the present stage, the group barrier problems are gathered and then point to a network element of a certain area or a certain area, so that the purpose of identifying the offline event of the user group is achieved. However, the method has weak identification capability, and a large number of events in the group fault data are discovered through user declaration, which seriously affects the user satisfaction.
Thirdly, the related art also combines and analyzes the group fault data and the frequent offline of a single user, which can find the offline and flash-off problems of the user to a certain extent, but cannot accurately identify the user list and the fault duration which are actually influenced by the group offline event, thus bringing inconvenience to subsequent user care and centralized remediation.
In view of the above problems, embodiments of the present invention provide a user offline detection method, which includes collecting single-user online and offline log messages of a network security system (Authentication, Authorization, Accounting, abbreviated as AAA), performing detailed analysis and operation on online and offline behavior characteristics of users in a whole network, extracting online and offline log messages with group offline characteristics in a time slice, and generating a group offline event based on the extracted online and offline log messages, so that an operation and maintenance platform accurately identifies users and fault durations actually affected by the group offline event based on an offline user list in the group offline event.
The broadband access network is an access part from a user terminal to a backbone network, and equipment in the broadband access network forms a network in a tree-shaped structure. Therefore, when a core node fails, other devices and user terminals connected to the node in the downstream direction are affected by the node, and thus a large-area failure is caused, which results in that fewer users can use the network normally, and more users can use the network abnormally.
Fig. 1 shows a flowchart of a user offline detection method according to an embodiment of the present invention, and as shown in fig. 1, the method of the present embodiment at least includes the following steps S110 to S140:
step S110, receiving the log messages of the online and offline of the whole network user, and determining the time slice and the network element equipment corresponding to the log messages of the online and offline.
In practical application, the AAA system server records the user online and offline request conditions in real time, and forms online and offline log messages at regular time, where the online and offline log messages include information such as user identification, user name, online start time, online end time, and resource attribution network element.
In this embodiment, an analysis server acquires an uplink log message and a downlink log message generated by a server of an AAA system, and determines a Network element device corresponding to the uplink log message and the downlink log message according to a resource attribution Network element in the uplink log message and the downlink log message, where the Network element device includes but is not limited to OLT device information and Passive Optical Network (PON) device information, and the acquisition manner of the uplink log message and the downlink log message by the analysis server may be a quasi-real-time manner or a real-time acquisition manner, and a person skilled in the art may flexibly select the Network element device according to an application requirement and the computing capability of the analysis server.
The time slice in this embodiment refers to a time slice of monitoring time, for example, in a 24-hour monitoring scene of a whole day, if the time granularity is 5 minutes, 288 time intervals can be divided from 24 hours, and each time interval corresponds to one time slice, so that the time slice corresponding to the log messages of the upper line and the lower line can be determined according to the end time of the upper line included in the log messages of the upper line and the lower line.
And step S120, performing group offline feature detection on the online and offline log messages which have the same time slice and belong to the same network element equipment.
Step S130, if the group offline feature detection is passed, an offline user list is obtained, and the offline user list at least comprises the offline duration of each offline user.
Step S140, generating a group offline event of the network element device in the time slice according to the offline user list.
In practical application, due to network element equipment failure, network element equipment power failure and other reasons, part or all of users may be offline successively within a certain time range, and the offline events of the users due to the same reasons have the same group offline characteristics.
It should be noted that, in this embodiment, the steps S110 to S140 may be executed by the analysis server, or in practical applications, may be executed by other devices, and those skilled in the art may flexibly select the steps.
It can be seen that, in the method shown in fig. 1, group offline feature detection is performed on the online and offline log messages according to a time slice and the network element device by collecting the online and offline log messages of the users in the whole network, an actually affected offline user list and offline durations of each offline user are determined according to the offline log messages with the group offline feature, a group offline event of the network element device in the time slice is generated based on the offline user list, and the operation and maintenance platform is assisted to accurately identify actually affected users and durations of faults based on the group offline event provided by this embodiment, so that the operation and maintenance platform can accurately, quickly and comprehensively monitor and analyze the group offline event.
As shown in fig. 2, in practical application, the AAA system server records online and offline requests of an authenticated user in real time, and generates an online log message and an offline log message at regular time. The AAA System server associates with data of a Business Operation Support System (BOSS, abbreviated as BOSS) through user information such as an internet account number of an authenticated user, and forms an online and offline record of a single user with 84 fields, where the following is one of the online and offline records:
dacp::Cb4JVrRInVQxhnCUxKpOJQ＝＝jtkd NULL 1 1 0 120.202.10.243 trunk 2/0/3:2653.1275 192.168.2.110/0/0/11/0/10/NBELb16f6fe5 GCOB 15 0 0 NULL NULL NULL 280 94:fe:9d:b6:61:05 100.64.44.141 94:fe:9d:b6:61:05 0 1 NULL 10 -1 2020-07-19 10:24:06 2020-07-20 00:00:00 2020-07-20 16:39:06 59946 0 NULL 0 HBEZH-M04209265301275f342bf155125 NULL NULL 1 1 0 dacp::Cb4JVrRInVQxhnCUxKpOJQ＝＝HBEZH–MC–CMNET-BAS04–CQ-ME60-15997155155@jtkd 1 -1 0 0 NULL 0NULL 19 10010 3 16 0 0 0 0 0 NULL NULL 202007 20200720
the jtkd in the upper and lower line records is the user identification, 15997155155 is the user name, 2020-07-2000: 00:00 is the value of the upper line starting time field, and 2020-07-2016: 39:06 is the value of the upper line ending time field.
In this embodiment, after receiving log messages of online and offline of a full network user, time slices corresponding to the log messages of online and offline are determined through the following steps:
grouping the log messages of the online and offline of the whole network users according to time slices according to the online end time in the log messages of the online and offline; and determining the time slice corresponding to the log messages according to the grouping information of the log messages.
As described above, in this embodiment, the monitoring time is time-divided in advance to obtain at least one time slice, where the time intervals corresponding to the time slices are not overlapped and are independent of each other, for example, the time interval corresponding to the time slice 1 is 2021 year 12 month 7 day [15:55, 16:00 ], and the time interval corresponding to the time slice 1 is 2021 year 12 month 7 day [16:00, 16: 05). Each time slice corresponds to a time interval, the log messages of the upper line and the lower line are divided into groups corresponding to the time intervals according to the time zone where the end time of the upper line in the log messages of the upper line and the lower line is located, and the time slices corresponding to the log messages of the upper line and the lower line are determined according to the grouping condition. In practical application, the log messages of the upper line and the lower line in each group can be stored, so that the full amount of the log messages of the upper line and the lower line can be stored, and data support is provided for other applications.
The time length of the monitoring time in this embodiment should be not less than the time length of the time slice, and may be 24 hours, 12 hours, a week, and the like, and those skilled in the art can flexibly set the time length.
For convenience of description, the log messages of the online and offline belonging to the same network element device with the same time slice are marked as the log messages of the online and offline of the first type.
In practical application, the method for determining the first-type online and offline log messages comprises the following steps: and determining a first type of log messages of the online and the offline according to the log messages of the online and the offline in each group.
Taking the determination of the first type of the uplink and downlink log messages in the packet 1 as an example, assuming that the network element device corresponding to the first part of the uplink and downlink log messages in the packet 1 is the OLT1, the network element device corresponding to the second part of the uplink and downlink log messages is the OLT2, and the network element device corresponding to the third part of the uplink and downlink log messages is the OLT3, it can be determined that the first part of the uplink and downlink log messages, the second part of the uplink and downlink log messages, and the third part of the uplink and downlink log messages are the first type of the uplink and downlink log messages.
In some embodiments, the performing group offline feature detection on the online and offline log messages belonging to the same network element device and having the same time slice includes:
calculating the total number of offline users corresponding to each network element device in the corresponding time slice according to the first type of online and offline log messages; here, the total number of offline users corresponding to each network element device in the corresponding time slice may be calculated according to the number of the user identifiers corresponding to the first type of online and offline log messages and the online end time corresponding to the first type of online and offline log messages.
In practical application, the log messages of online and offline in the same time slice include a plurality of log messages of online and offline corresponding to the repeated online and offline of the same user, and also include log messages of online and offline corresponding to the passive offline caused by system timeout, for example, in some scenarios, at 0 point every day, that is, at 00: at 00.00 all online users are collectively taken offline. For this problem, in the embodiment, when the total number of offline users is calculated, a plurality of online and offline log messages generated by offline of one user for multiple times are determined as one offline user, and the online and offline log messages caused by system timeout are not counted in the total number of offline users.
If the total number of offline users corresponding to a certain network element device in the time slice is smaller than the threshold value of the offline users, determining that the online and offline log messages belonging to the network element device in the time slice do not pass group offline feature detection; and if the total number of offline users corresponding to a certain network element device in the time slice is not less than the offline user threshold value, determining that the online and offline log messages belonging to the network element device in the time slice pass the group offline feature detection.
For example, the total number of offline users corresponding to the network element device OLT1 in the time slice 1 is less than 200, and it is determined that the first type of online and offline log messages do not have the group offline feature and do not pass the detection; if the total number of offline users corresponding to the network element device OLT1 in the time slice 1 is greater than 200, determining that the first type of online and offline log messages have the group offline characteristics, and detecting that the time slice 1 is the offline time slice.
In some embodiments, before performing group offline feature detection on online and offline log messages belonging to the same network element device and having the same time slice, the method further includes:
and carrying out user screening on the log messages of the online and offline with the same time slice, and screening out the log messages of the online and offline of the target user. For example, the user Identification field in the log messages of online and offline is intercepted, the data content of the @ domain name is intercepted, the intercepted data content is matched with the internet account information in the user data (client Identification, abbreviated as CID) in fig. 2, and the matched log messages of online and offline describe the online/offline event of the concerned target user.
Correspondingly, the group offline feature detection is performed on the online and offline log messages which have the same time slice and belong to the same network element device, and the group offline feature detection method comprises the following steps: and performing group offline feature detection on the online and offline log messages of the target users with the same time slice and belonging to the same network element device, wherein the group offline feature detection on the first type of online and offline log messages is referred to in the detection method at this time, and the detailed description is omitted here.
When the offline characteristics of the group are detected, acquiring offline user information corresponding to the user identification according to the user identification corresponding to each online and offline log message detected through the offline characteristics of the group; determining the offline duration of the offline user according to the online end time and the next online start time corresponding to each online and offline log message detected through the offline characteristics of the group, wherein the next online start time is extracted from the next online and offline log message according to the user identification; and generating an offline user list according to the offline user information and the offline duration of the offline user.
Taking the first type of log messages in the group 1 as an example, assuming that the first part of log messages in the group 1 passes the group offline feature detection, the offline user information can be obtained according to the user identifier of the first part of log messages, where the offline user information includes, but is not limited to, personal information such as a user name, an authentication account, a registered phone number, and a registered mailbox.
And searching the log messages of the offline according to the user identification, wherein the log messages of the offline are stored in groups in the analysis server, searching the online starting time closest to the offline ending time of the time, and determining the time length between the offline ending time of the time and the searched online starting time as the offline duration. Here, the present offline end time refers to the offline end time in the first type of online/offline log message in the packet 1.
According to the embodiment, each network element device is used as a target object in the group offline event of the embodiment, the affected offline user list under each target object is determined through the group offline event, and the group offline time of the embodiment is uploaded to the operation and maintenance platform because the offline user list comprises the personal user information and the offline time length, so that the operation and maintenance platform can be assisted to accurately identify the users affected by the fault and the duration of the fault, and support is provided for overcoming the platform. In practical application, the group offline event may further include offline start time and offline end time of each offline user, and assist the operation and maintenance platform in evaluating the event influence range and influence duration. Here, the offline start time is the online end time in the log messages of the upper and lower lines, and the offline end time is the next online start time described above.
In some embodiments, after generating the group offline event, further comprising: and determining a fault network element according to the group offline event generated within the set time. For example, if N group offline events of the same network element device are generated within a set time, it is determined that the network element device corresponding to the N group offline events is a faulty network element, where N is a natural number not less than 1.
For example, a timing task may be set, the timing task is used to monitor and analyze the group offline event generated by the analysis server, and if it is monitored that more than two group offline events exist in the same network element device, the group offline event existing in the same network element device is determined as an abnormal group offline event, where the network element device is a faulty network element.
Through tests, if the analysis server analyzes about 760 ten thousand log records of the online and offline events every day, the number of the log records of the offline events of the group is about 11 ten thousand, which indicates that the proportion of the number of the offline records of the whole network group is about 1.64%. The quantity of the same network element equipment of the group offline event is counted, high-frequency fault network element equipment can be effectively determined, centralized treatment and re-protection are carried out on the high-frequency fault network element equipment, and the equipment fault probability is reduced.
The user offline detection method based on the embodiment at least has the following advantages:
first, fault location is assisted. The online and offline behavior characteristics of the users in the whole network are analyzed and calculated in detail by collecting and analyzing the online and offline log messages of the users in the whole network, the online and offline log messages with the group offline characteristics and the same time slice and the same network element equipment are extracted, and the group offline event is generated based on the extracted online and offline log messages, so that the operation and maintenance platform monitors and analyzes the group offline event, and discovers the hidden fault of the network element equipment in time.
Secondly, accurate early warning is carried out on the fault influence user. The method comprises the steps that on the basis of monitoring and analyzing a group offline event appearing in the whole network, a user list of network element equipment hung down when a hidden fault occurs and the actual influence condition of the fault on a user are accurately obtained; the fault early warning and the group fault pushing of the whole network group offline users are realized through interfaces of online companies and BOSS service platforms; the method has the advantages that the list of users affected by the fault is accurately identified, whether the fault really affects the service interruption condition of the user is determined, and the group offline event of the users in the whole network can be accurately, quickly and comprehensively monitored and analyzed.
And thirdly, effectively intercepting the declaration of the user. The operation and maintenance platform can timely and accurately acquire the group fault and the user service interruption condition in the wide scene of the whole province home by pushing the group fault information and the condition that the group fault affects the user, and can judge whether the offline reason declared by the user is caused by the fault interruption or not at the first time when receiving the user declaration, so that more accurate response and response are given to the user, the user is dulled timely, and the perception of the fault interruption to the user experience is reduced.
Fig. 3 shows an application of the user offline detection method in the embodiment in an operation and maintenance platform, where the operation and maintenance platform acquires an online log message and an offline log message of an AAA system through a preset interface in a group fault processing process, processes the online log message and the offline log message by using the user offline detection logic of the embodiment, and sends a group offline event and a faulty network element device obtained by logic processing to an upper data service layer, so that the operation and maintenance platform performs real-time fault analysis processing, real-time early warning cancellation processing, batch processing convergence analysis, and the like in combination with the group offline event and the faulty network element device.
The embodiment of the invention realizes the monitoring of the whole network group offline event and can find the occurrence and influence range of the group offline event in time; the problem that the offline event of the abnormal group affects user perception is solved, early warning is timely performed on a fault user, user satisfaction is improved, and user loss is reduced. If the fee per user is 100/month, the method of the embodiment can reduce the lost users by 1 kilo households, and predict the revenue loss of reducing 100 × 12 × 1000 ═ 120 ten thousand yuan. It can be seen that the method of the present embodiment has significant market competitiveness.
The user offline detection method in the embodiment belongs to the same technical concept as the user offline detection method in the embodiment, and the embodiment of the invention also provides a user offline detection device which is used for realizing the user offline detection method in the embodiment.
Fig. 4 is a schematic structural diagram illustrating a user offline detection apparatus according to an embodiment of the present invention, and as shown in fig. 4, the user offline detection apparatus 400 includes:
a receiving unit 410, configured to receive log messages of an online/offline user of a whole network, and determine time slices and network element devices corresponding to the log messages of the online/offline user;
a detecting unit 420, configured to perform group offline feature detection on the online and offline log messages belonging to the same network element device and having the same time slice;
a counting unit 430, configured to obtain an offline user list if group offline feature detection is passed, where the offline user list at least includes offline durations of offline users;
a generating unit 440, configured to generate a group offline event of the network element device in the time slice according to the offline user list.
In some embodiments, the receiving unit 410 groups the log messages of the whole network users according to time slices according to the end time of the online log messages; and determining the time slice corresponding to the log messages according to the grouping information of the log messages.
In some embodiments, the receiving unit 410 is further configured to perform user filtering on the log messages of the online and offline with the same time slice to filter out the log messages of the online and offline of the target user.
Correspondingly, the detecting unit 420 is configured to perform group offline feature detection on the online and offline log messages of the target users having the same time slice and belonging to the same network element device.
In some embodiments, the detecting unit 420 is configured to calculate, according to the offline log messages, a total number of offline users corresponding to each network element device in a corresponding time slice; if the total number of offline users corresponding to a certain network element device in the time slice is smaller than the threshold value of the offline users, determining that the online and offline log messages belonging to the network element device in the time slice do not pass group offline feature detection; and if the total number of offline users corresponding to a certain network element device in the time slice is not less than the offline user threshold value, determining that the online and offline log messages belonging to the network element device in the time slice pass the group offline feature detection.
In some embodiments, the detecting unit 420 is further configured to calculate, according to the number of the user identifiers corresponding to the log messages about online and offline and the online end time corresponding to the log messages about online and offline, the total number of offline users corresponding to each network element device in the corresponding time slice.
In some embodiments, the statistical unit 430 is configured to obtain offline user information corresponding to a user identifier according to the user identifier corresponding to each offline log message detected through the group offline characteristics; determining the offline duration of the offline user according to the online end time and the next online start time corresponding to each online and offline log message detected through the offline characteristics of the group, wherein the next online start time is extracted from the next online and offline log message according to the user identification; and generating an offline user list according to the offline user information and the offline duration of the offline user.
In some embodiments, the offline user detection apparatus in fig. 4 further includes an analysis unit;
an analysis unit for determining the fault network element equipment according to the group offline event generated in the set time
In some embodiments, the analyzing unit is specifically configured to generate N group offline events of the same network element device within a set time, and determine that the network element device corresponding to the N group offline events is a faulty network element device, where N is a natural number not less than 1.
It can be understood that the user offline detection device can implement the steps of the user offline detection method provided in the foregoing embodiment, and the explanations related to the user offline detection method are applicable to the user offline detection device, and are not repeated here.
It should be noted that:
fig. 5 shows a schematic structural diagram of an electronic device according to an embodiment of the invention. Referring to fig. 5, at a hardware level, the electronic device includes a processor and a memory, and optionally further includes an internal bus and a network interface. The Memory may include a Memory, such as a Random-Access Memory (RAM), and may further include a non-volatile Memory, such as at least 1 disk Memory. Of course, the electronic device may also include hardware required for other services.
The processor, the interface module, the communication module, and the memory may be connected to each other via an internal bus, which may be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, an EISA (Extended Industry Standard Architecture) bus, or the like. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one double-headed arrow is shown in FIG. 5, but this does not indicate only one bus or one type of bus.
A memory for storing computer executable instructions. The memory provides computer executable instructions to the processor through the internal bus.
A processor executing computer executable instructions stored in the memory and specifically configured to perform the following operations:
receiving log messages of online and offline of a whole network user, and determining time slices and network element equipment corresponding to the log messages of online and offline; carrying out group offline feature detection on the online and offline log messages which have the same time slice and belong to the same network element equipment; if the offline feature detection of the group is passed, acquiring an offline user list, wherein the offline user list at least comprises the offline duration of each offline user; and generating a group offline event of the network element equipment under the time slice according to the offline user list.
The functions performed by the user offline detection method according to the embodiment of the present invention shown in fig. 1 can be implemented in or by a processor. The processor may be an integrated circuit chip having signal processing capabilities. In implementation, the steps of the above method may be performed by integrated logic circuits of hardware in a processor or instructions in the form of software.
An embodiment of the present invention also provides a computer-readable storage medium storing one or more programs, which when executed by a processor, implement a user offline detection method.
As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
The memory may include forms of volatile memory in a computer readable medium, Random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.
Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.
It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in the process, method, article, or apparatus that comprises the element.
It is to be understood that although the terms first, second, third, etc. may be used herein to describe various information, these information should not be limited to these terms. These terms are only used to distinguish one type of information from another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information, without departing from the scope of the present invention.
The above are merely examples of the present invention, and are not intended to limit the present invention. Various modifications and alterations to this invention will become apparent to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.
Claims (10)
1. A user offline detection method is characterized by comprising the following steps:
receiving log messages of online and offline of a whole network user, and determining time slices and network element equipment corresponding to the log messages of online and offline;
carrying out group offline feature detection on the online and offline log messages which have the same time slice and belong to the same network element equipment;
if the offline feature detection of the group is passed, acquiring an offline user list, wherein the offline user list at least comprises the offline duration of each offline user;
and generating a group offline event of the network element equipment under the time slice according to the offline user list.
2. The method of claim 1, wherein the time slice corresponding to the log messages is determined by:
grouping the log messages of the online and offline of the whole network users according to the time slice according to the online end time in the log messages of the online and offline;
and determining the time slice corresponding to the log messages according to the grouping information of the log messages.
3. The method of claim 1, wherein before performing group offline feature detection on online and offline log messages belonging to the same network element device and having the same time slice, the method further comprises:
carrying out user screening on the log messages of the online and offline with the same time slice, and screening out the log messages of the online and offline of a target user;
the group offline feature detection is carried out on the online and offline log messages which have the same time slice and belong to the same network element equipment, and the group offline feature detection comprises the following steps:
and performing group offline feature detection on the online and offline log messages of the target users with the same time slice and belonging to the same network element equipment.
4. The method of claim 1, wherein performing group offline feature detection on online and offline log messages belonging to the same network element device and having the same time slice comprises:
calculating the total number of offline users corresponding to each network element device in the corresponding time slice according to the online and offline log messages;
if the total number of offline users corresponding to a certain network element device in the time slice is smaller than the threshold value of the offline users, determining that the online and offline log messages belonging to the network element device in the time slice do not pass group offline feature detection;
and if the total number of offline users corresponding to a certain network element device in the time slice is not less than the offline user threshold value, determining that the online and offline log messages belonging to the network element device in the time slice pass the group offline feature detection.
5. The method of claim 4, wherein calculating the total number of offline users corresponding to each network element device in the corresponding time slice according to the offline log messages comprises:
and calculating the total number of offline users corresponding to each network element device in the corresponding time slice according to the number of the user identifications corresponding to the online and offline log messages and the online end time corresponding to the online and offline log messages.
6. The method of claim 1, wherein obtaining an offline user list if group offline feature detection is passed comprises:
according to a user identification corresponding to each log message of the online and offline through the group offline feature detection, acquiring offline user information corresponding to the user identification;
determining the offline duration of the offline user according to the online end time and the next online start time corresponding to each online and offline log message detected through the offline characteristics of the group, wherein the next online start time is extracted from the next online and offline log message according to the user identification;
and generating an offline user list according to the offline user information and the offline duration of the offline user.
7. The method of claim 1, further comprising, after generating the population down event:
and determining the fault network element equipment according to the group offline event generated within the set time.
8. The method of claim 7, wherein determining the faulty network element device according to the group offline event generated within the set time comprises:
if the network element equipment is in the set time, generating N group offline events of the same network element equipment, and determining that the network element equipment corresponding to the N group offline events is fault network element equipment, wherein N is a natural number not less than 1.
9. A user offline detection device, comprising:
the receiving unit is used for receiving log messages of online and offline of a whole network user and determining time slices and network element equipment corresponding to the log messages of online and offline;
the detection unit is used for carrying out group offline feature detection on the online and offline log messages which have the same time slice and belong to the same network element equipment;
the statistical unit is used for acquiring an offline user list if the offline feature detection of the group is passed, wherein the offline user list at least comprises the offline duration of each offline user;
and the generating unit is used for generating the group offline event of the network element equipment under the time slice according to the offline user list.
10. An electronic device, characterized in that,
a processor; and
a memory arranged to store computer executable instructions which, when executed, cause the processor to perform the method of user logoff detection of any one of claims 1 to 8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111590067.1A CN114245242B (en) | 2021-12-23 | 2021-12-23 | User offline detection method and device and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111590067.1A CN114245242B (en) | 2021-12-23 | 2021-12-23 | User offline detection method and device and electronic equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114245242A true CN114245242A (en) | 2022-03-25 |
| CN114245242B CN114245242B (en) | 2023-10-27 |
Family
ID=80762062
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111590067.1A Active CN114245242B (en) | 2021-12-23 | 2021-12-23 | User offline detection method and device and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114245242B (en) |
Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JPS6133046A (en) * | 1984-07-25 | 1986-02-15 | コ−デツクス・コ−ポレ−シヨン | Network forming circuit |
| CN1825812A (en) * | 2005-02-25 | 2006-08-30 | 华为技术有限公司 | System and method for managing network web log information |
| US20070061302A1 (en) * | 2005-09-14 | 2007-03-15 | Jorey Ramer | Location influenced search results |
| WO2016048283A1 (en) * | 2014-09-23 | 2016-03-31 | Hewlett Packard Enterprise Development Lp | Event log analysis |
| US20180097844A1 (en) * | 2016-09-30 | 2018-04-05 | Fortinet, Inc. | Selective enforcement of event record purging in a high volume log system |
| CN110224850A (en) * | 2019-04-19 | 2019-09-10 | 北京亿阳信通科技有限公司 | Telecommunication network fault early warning method, device and terminal device |
| CN112162705A (en) * | 2020-09-30 | 2021-01-01 | 新浪网技术(中国)有限公司 | RAID (redundant array of independent disk) set fault automatic offline repair reporting method and system |
| CN112291075A (en) * | 2019-07-23 | 2021-01-29 | 中国移动通信集团浙江有限公司 | Network fault positioning method and device, computer equipment and storage medium |
| CN113298672A (en) * | 2021-05-21 | 2021-08-24 | 中国电信股份有限公司 | Commercial power fault monitoring method, device, system, storage medium and electronic equipment |
-
2021
- 2021-12-23 CN CN202111590067.1A patent/CN114245242B/en active Active
Patent Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JPS6133046A (en) * | 1984-07-25 | 1986-02-15 | コ−デツクス・コ−ポレ−シヨン | Network forming circuit |
| CN1825812A (en) * | 2005-02-25 | 2006-08-30 | 华为技术有限公司 | System and method for managing network web log information |
| US20070061302A1 (en) * | 2005-09-14 | 2007-03-15 | Jorey Ramer | Location influenced search results |
| WO2016048283A1 (en) * | 2014-09-23 | 2016-03-31 | Hewlett Packard Enterprise Development Lp | Event log analysis |
| US20180097844A1 (en) * | 2016-09-30 | 2018-04-05 | Fortinet, Inc. | Selective enforcement of event record purging in a high volume log system |
| CN110224850A (en) * | 2019-04-19 | 2019-09-10 | 北京亿阳信通科技有限公司 | Telecommunication network fault early warning method, device and terminal device |
| CN112291075A (en) * | 2019-07-23 | 2021-01-29 | 中国移动通信集团浙江有限公司 | Network fault positioning method and device, computer equipment and storage medium |
| CN112162705A (en) * | 2020-09-30 | 2021-01-01 | 新浪网技术(中国)有限公司 | RAID (redundant array of independent disk) set fault automatic offline repair reporting method and system |
| CN113298672A (en) * | 2021-05-21 | 2021-08-24 | 中国电信股份有限公司 | Commercial power fault monitoring method, device, system, storage medium and electronic equipment |
Non-Patent Citations (2)
| Title |
|---|
| 陆世鹏: "基于Spark Streaming的海量日志实时处理系统的设计", 《电子产品可靠性与环境试验》, pages 1 - 3 * |
| 陆杰;李丰;李炼;: "分布式系统中的日志分析及应用", 高技术通讯, no. 04 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114245242B (en) | 2023-10-27 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110995468B (en) | System fault processing method, device, equipment and storage medium of system to be analyzed | |
| CN105354126B (en) | Monitor method and apparatus abnormal in page script file | |
| CN103246735B (en) | A kind of method for processing abnormal data and system | |
| CN113176978B (en) | Monitoring method, system, equipment and readable storage medium based on log file | |
| CN110046073B (en) | Log collection method and device, equipment and storage medium | |
| EP2800024A1 (en) | System and methods for identifying applications in mobile networks | |
| CN105306246B (en) | A kind of method, apparatus and server of the complaint of automatic-answering back device network class | |
| CN112631913A (en) | Method, device, equipment and storage medium for monitoring operation fault of application program | |
| CN102882701A (en) | Alarm system and method for intelligently monitoring power grid core service data | |
| CN111585837A (en) | Internet of things data link monitoring method and device, computer equipment and storage medium | |
| CN108933693A (en) | A kind of Domain Name Service System fault handling method and system | |
| CN111726359A (en) | Account information detection method and device | |
| CN114301800A (en) | Network equipment quality difference analysis method and device | |
| CN109963292B (en) | Complaint prediction method, complaint prediction device, electronic apparatus, and storage medium | |
| CN114245242B (en) | User offline detection method and device and electronic equipment | |
| CN115658443B (en) | Log filtering method and device | |
| CN107329876A (en) | A kind of server operation and monitoring method and system | |
| CN107769957A (en) | A kind of domain name system failure cause analysis method and device | |
| CN117040664A (en) | Computer system detection method based on network operation safety | |
| CN105376091B (en) | A kind of offline system and method for server | |
| CN114168423A (en) | Abnormal number calling monitoring method, device, equipment and storage medium | |
| CN116827762A (en) | Link fault positioning method, device, equipment and computer readable storage medium | |
| CN112508207A (en) | Fault detection method, device, equipment and storage medium | |
| CN113411828A (en) | Method, device and equipment for sensing call quality and computer readable storage medium | |
| Fiadino et al. | Towards automatic detection and diagnosis of Internet service anomalies via DNS traffic analysis |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |