JP2000151605A - Communication network management support system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To easily report, record, store and utilize of events by simply displaying a plurality of events incident to a communication network so as to support jobs of the operator without high grade experience and intelligence based on many journal logs received from monitoring device whose detailed specification is unknown and from a plurality of monitoring devices. SOLUTION: The communication network management support system is provided with a means 601 that receives a journal log 130 received from a monitoring device, a means 602 that stores the journal log for a decided time, a means 605 that extracts a partial character string denoting a time from a character string configuring the journal log, a means 606 that decodes the partial character string denoting the time as a generation time of the journal log, a means 608 that generates a histogram by checking a distribution of the generation time of the journal log and a means that displays or prints out the histogram.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a communication network management support system, and more particularly, to a journal log indicating the state of a communication network, which is displayed in real time to an operator in an easy-to-understand manner and prompts the operator to perform an appropriate operation. The present invention relates to a communication network management support system for supporting business.

[0002]

2. Description of the Related Art A communication network is usually managed by monitoring a "journal log". The “journal log” is a character string generated by a monitoring device connected to communication devices arranged in various parts of the communication network to notify an operator of a current state of the communication network or a change in the state. The operator is C
Monitor the RT screen and the journal log output to the printer and perform appropriate operations. When an event such as a failure occurs in a communication network, the communication device generates a signal called an “alarm”. The monitoring device aggregates the alarms and converts them into journal logs that are easier for the operator to understand. The journal log contains detailed contents of the event, the time at which the event occurred, the location of the communication device that detected the event, and the like.
Generally, when one event occurs, a plurality of communication devices detect this, and a plurality of journal logs are reported to the operator. Therefore, the operator looks at these journal logs, extracts the association, and estimates the event that has occurred.
However, this required a high degree of experience and knowledge. In a large-scale communication network, journal logs are generated not only by failures but also by works such as construction and operation tests, and tens of thousands of journal logs are reported every day. Therefore, a heavy burden is imposed on the operator who monitors this. If a failure occurs in the communication network, emergency measures, repair work, tests, etc. are performed continuously. As a method of managing such a series of events, a journal log is recorded on a recording medium such as a magnetic tape and stored. However, this method requires an enormous amount of recording medium, and in practice, it has been difficult to use this as an example. As a method for solving such a problem, a method described in Japanese Patent Application Laid-Open No. H6-131054 is known. According to this method, important items are selected from journal logs and the amount of recording media is reduced, thereby reducing the burden on the operator and facilitating business management.

[0003]

The conventional technique has a problem that the amount of recording media cannot be reduced until the task management becomes sufficiently easy. In particular, when managing communication network management operations, paper is often used as a medium for reporting and recording, and there is a great need to record a series of events that have occurred on the communication network on paper. . However, this method requires several tens of sheets of paper just to record hundreds of journal logs directly generated by a failure, and requires several hundred sheets to include journal logs generated by subsequent work. Paper was needed. Therefore, it was difficult to grasp the temporal relationship between events.

An object of the present invention is to provide a communication network based on a large number of journal logs which are notified from a monitoring device or a plurality of monitoring devices whose detailed specifications are unknown and are assumed to be read and understood by an operator. By displaying multiple events that occur in a concise manner, it helps operators without advanced experience and knowledge to report, record, save, and store events.
The purpose is to facilitate utilization.

[0005]

According to the present invention, there is provided a communication network management support system which receives a journal log notified from a monitoring device, stores a journal log for a predetermined time, and comprises a journal log. Means for extracting a partial character string representing the time from the character string to be interpreted, means for interpreting the partial character string representing the time as the occurrence time of the journal log, and means for examining the distribution of the occurrence time of the journal log to create a histogram. And means for displaying or printing the histogram.

[0006]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 shows a configuration of a communication network management support system 100 according to an embodiment of the present invention.
The communication network management system 100 includes a log occurrence time analysis unit 101, a failure diagnosis knowledge storage unit 102, a failure diagnosis unit 103, a display unit 104, and an input unit 10.
5 is provided. The log generation time analysis unit 101 receives the journal log 130 notified from the monitoring device 111 placed in the communication network 110, checks the distribution of the generation time, and checks the log generation time distribution 131 and the histogram 132 Is output in two formats. The detailed configuration of the log occurrence time analysis means 101 will be described later with reference to FIG.

The log occurrence time analysis means 101 is notified of the journal log 130 from the plurality of monitoring devices 111. FIG. 2 shows an example of the journal log 130. The journal log 130 is often created on the assumption that it is displayed as it is to the operator 120, and the notation is sometimes inconsistent. Also in this example, a plurality of different notations are used to represent the same content, for example, as follows. "Air conditioning" and "Air conditioning equipment""Unit 1 operation" and "No. 1 operation" As described above, the inconsistency in the notation of the journal log 130 means that the contents of the journal log 130 are automatically interpreted by a computer. This is a major detriment to doing so. However, the occurrence time is written in the journal log 130, and it is relatively easy to take out and use it. The log occurrence time analysis unit 101 checks the journal log 1
30 occurrence times, and log occurrence time distribution 13
1 and a histogram 132 are created.

FIG. 3 shows an example of the log occurrence time distribution 131. In this example, the number of journal logs 130 generated from 0:00 to 24:00 on a certain day is represented in increments of 20 minutes. As described above, in order to create the log occurrence time distribution 131, the operator 120 sets the reference time / time increment 1
37 must be specified. Journal log 13
When 0 is caused by a failure, that is, when some response is required, generally, a plurality of communication devices are affected by the failure, and many journal logs 130 occur almost simultaneously. Such a phenomenon is called "spillover".
When the ripple occurs, the frequency of the journal log 130 sharply increases, and a sharp maximum point is created. Such a maximum point is called "peak"
Call. The histogram 132 shows the log occurrence time distribution 131 as a graph. The specific appearance of the histogram 132 will be described later with reference to FIG.

The failure diagnosis knowledge storage means 102 is a knowledge base for storing knowledge used to determine whether the cause of occurrence of the journal log 130 is an accidental failure or a work as a business. FIG. 4 shows the contents of the fault diagnosis knowledge storage means 102, that is, an example of the fault diagnosis knowledge 133. The fault diagnosis knowledge 133 is a formal description of the content of the judgment made by the experienced operator 120 so far so that it can be processed by a computer. Fault diagnosis knowledge storage means 102
Generally, a plurality of fault diagnosis knowledges 133 are stored. The fault diagnosis knowledge 133 includes a condition 401 and a fault diagnosis result 134. Since the correspondence of the operator 120 is made to the peak, the condition 401 is a description for the peak. These failure diagnosis knowledge 1
Since there is a basis in 33, it is necessary to change the contents of the fault diagnosis knowledge storage means 102 when the basis changes. This method will be described later with reference to FIG.

The fault diagnosing means 103 stores the fault diagnosing knowledge 13
3 is used to diagnose the cause of the occurrence of the journal log 130 included in the selected peak. However,
Since it is difficult to diagnose each journal log 130, all journal logs 1 included in the peak
30 is assumed to have been caused by propagation, and it is assumed that these causes are the same. Therefore, in order to make a diagnosis, the peak needs to be specified. When the operator 120 inputs the peak selection instruction 138, the fault diagnosis unit 103 sets the peak as a target of diagnosis. However, when the peak selection instruction 138 is not input, the failure diagnosis unit 103 determines the newest peak as the diagnosis target. set to target.
The input of the peak selection instruction 138 by the operator 120 will be described later with reference to FIG. Fault diagnosis means 103
Indicates the cause of the journal log 130 included in the specified peak, in the log occurrence time distribution 13
1 and the fault diagnosis knowledge 133, and outputs a fault diagnosis result 134. Detailed processing of the failure diagnosis means 103 will be described later with reference to FIG.

The display means 104 is realized by software for creating a display screen and a display device such as a CRT. The display unit 104 creates a basic screen 500 based on the failure diagnosis result 134 and the histogram 132,
It is displayed to the operator 120. The basic screen 500 is shown in FIG. The basic screen 500 includes a histogram display window 510 and a failure diagnosis result display window 520.
The histogram display window 510 displays the histogram 1
32 and a cursor 512
Is displayed. The cursor 512 is used to select a peak or a region, and moves according to an input from the operator 120. Thereby, the operator 120 can easily select a specific peak or specify a region. In this example, the peak 511e is selected.
When another peak is selected, the fault diagnosing means 103 is automatically selected.
Is started, and the failure diagnosis result 134 displayed on the failure diagnosis result display window 520 is updated. The fault diagnosis result display window 520 displays the fault diagnosis result 134 for the selected peak 511e.

The input means 105 receives input information 136 from the operator 120, and is realized by a keyboard, a mouse, or the like. The input information 136 includes a reference time / time interval 137, a fault diagnosis parameter 138, and a peak selection instruction 139. The input unit 105 has several operation modes so that various kinds of information can be input, and these operation modes can be switched by inputting a command. When the operation mode is switched, the screen displayed by the display unit 104 also changes, and notifies the operator 120 of the current operation mode.

The communication network management system 100 includes:
Since the basic screen 500 can be displayed by the above configuration, the burden on the operator 120 who tries to diagnose the cause of the occurrence of the journal log 130 can be significantly reduced. In addition, since the histogram 132 shows the time relationship between the events occurring in the communication network 110 in an easy-to-understand manner, looking at the histogram 132 helps the operator 120 with little experience to learn. Also, since the operator 120 reports the business to the manager 121,
When preparing the report 140, the histogram 132
Can be put together very easily. Therefore, it is advantageous in storage and reuse as compared with the conventional method in which the journal log 132 is described as it is.

Next, the log occurrence time analyzing means 101 and the fault diagnosing means 103 will be described in detail in order. The log occurrence time analysis means 101 has the configuration shown in FIG. Log receiving means 601, log storing means 602, log sorting condition storing means 603, unnecessary log removing means 604, time character string extracting means 605, and time character string interpreting means 606.
The log generation frequency calculation means 607 and the histogram creation means 608 are the requirements. The log receiving means 601
Monitoring device 1 placed in communication network 110
The journal log 130 notified from the server 11 is received, and the journal log 130 is stored in the log storage unit 702 as the reception log 610. The log storage unit 602 is a memory that stores the reception log 610. The storage capacity of the log storage unit 102 is designed to be able to store, for example, all the reception logs 610 arriving during 48 hours under normal conditions. However, when the reception log 610 larger than the storage capacity is likely to arrive due to a large-scale failure or the like, the reception log 610 is not deleted in order from the old reception log 610, but is randomly deleted regardless of the new or old reception log 610. I will do it. This prevents peaks appearing in the histogram 132 and other characteristics from being lost. The reception logs 610 that individually arrived during the 48 hours are collected into one accumulation log 611, and can be processed collectively. The log selection condition storage means 603
The journal log 130 and the histogram 13 generated by an event unrelated to the operation of the communication network 110
2 is a database that stores the characteristics of the character strings included in the journal logs 130 generated by permanent events that are not useful for performing fault diagnosis by using the journal logs 130. FIG. 7 shows an example of the log selection condition 612 stored in the log selection condition storage unit 603. The unnecessary log removing unit 604 removes the unnecessary journal log 130 from the accumulated log 611 using the log selection condition 612, and leaves the useful log 613. The unnecessary log removing unit 604 sequentially applies the log selection condition 612 to the journal log 130 in the accumulation log 611, and separates the unnecessary log from the unnecessary log. Note that those that have not been sorted out to either end until the end are useful for convenience. By such processing, a clear peak can appear on the histogram. FIG. 8 shows a useful log 613 obtained by processing the journal log 130 shown in FIG. The time character string extracting unit 605 determines whether the journal log 13
The time character string 614 is extracted from the character string included in 0, that is, the log character string. FIG. 8 shows an example of the time character string 614 obtained by processing the useful log 613. Generally, the partial character string representing the time is located at a predetermined position in the log character string, so that the time character string 614 can be easily created simply by extracting this part. When the position of the partial character string representing the time changes exceptionally, for example, “*
The time character string 614 can also be created by extracting a partial character string that matches the format “*: **: **”. Here, “*” is a wildcard character that matches an arbitrary number or a blank character. The time character string interpreting means 606 outputs the time character string 61 which is a character string.
4 is converted into a time value 615 as a numerical value.
FIG. 8 shows an example of a time value 615 obtained by processing the time character string 614. In this example, the time character string 6
14 is interpreted as a time, and the number of seconds from 0:00 of the day is calculated to obtain a time value 615. The log occurrence frequency calculation means 607 obtains the frequency distribution of the time value 615. The reference time / time interval 137 includes a start time, an end time, and a time interval. Log occurrence frequency calculation means 6
In step 07, the time from the start time to the end time is equally divided in time steps, and the time step to which each time in the time value 615 belongs is checked. Then, the number of times belonging to each time interval is counted and output as a log occurrence time distribution 131. The histogram creating means 608 calculates the log occurrence time distribution 131 and the reference time
A histogram 132 is created. Histogram 1
Reference numeral 32 denotes graphic data, which can be displayed on the screen of the display unit 104 as it is. Histogram 13
In 2, an appropriate scale or numerical value based on the start time and the end time included in the reference time / time interval 137 is added. It should be noted that since the peak becomes extremely high depending on the event, a method of graphing the logarithm of the frequency instead of graphing the frequency directly may be considered.

Next, FIG. 9 shows a process 900 of the fault diagnosis means 103. In the process 901, two variables, “work certainty” and “accident certainty” are defined, and both are initialized to zero. In process 902, the fault diagnosis knowledge storage unit 102
Out of the failure diagnosis knowledge 133 is extracted. In the process 903, it is checked whether or not the condition 401 included in the extracted fault diagnosis knowledge 133 matches the peak of the log occurrence time distribution 131 to be diagnosed. If not, the fault diagnostic knowledge 133 cannot be used for diagnosis, and the process returns to the process 902 to try to use another fault diagnostic knowledge 133. In the process 904, it is checked whether the judgment 402 of the failure diagnosis knowledge 133 is “work” or “accident”. If the decision 402 is “work”,
The peak is likely to be due to work, and an “accident” indicates that it is likely to be due to an accident. In the process 905, the failure diagnosis knowledge 13
According to the result of the diagnosis of 3, any one of “work certainty” and “accident certainty” is increased. The fault diagnosis knowledge 133 includes those having a high possibility of erroneous judgment and those having a small possibility of erroneous judgment, and the magnitude of the certainty factor 403 is different depending on this. In the process 906, the failure diagnosis knowledge storage unit 102
It is checked whether or not all the fault diagnosis knowledge 133 has been extracted from. If the fault diagnosis knowledge 133 remains, the process returns to step 902, so that all the fault diagnosis knowledge 133 is finally extracted. In the process 907, the fault diagnosis result 134 is created after converting the abstract numerical values “work certainty” and “accident certainty” into statistically significant values. Usually, it is appropriate to find the difference between “work confidence” and “accident confidence” and use that as the standard deviation to calculate the probability, but “work confidence” and “accident confidence” If both are large or small, the failure diagnosis knowledge 133 may be incomplete, so that fact is written in the failure diagnosis result 134.

Next, the input information 136 input by the operator 120 will be described in detail with reference to the screen displayed on the display means 104. Basic screen 5
In the histogram 132 displayed at 00, the operator 120 can enlarge and observe a part of the histogram 132 when the time interval is too large to accurately grasp the event that has occurred in the communication network 110. . When the operation mode of the input unit 105 is switched, an enlarged area selection screen 1000 shown in FIG. 10 is displayed. On the enlarged area selection screen 1000, the left end 1 of the cursor 512
001 and the right end 1002 are moved independently, and the cursor 51
By changing the width and position of 2, the area to be enlarged can be specified. In this example, 16: 20-17:
Forty regions have been selected. Since the peak cannot be selected on the enlarged area selection screen 1000,
The cause of the journal log 130 is not diagnosed, and an operation guide display window 1010 is displayed instead of the failure diagnosis result display window 520. Cursor 512
When the width and the position of are determined, the enlarged screen 11 shown in FIG.
00 is displayed. On the enlarged screen 1100, only the area selected on the enlarged area selection screen 1000 is enlarged and displayed. The time interval 1101 of the newly created histogram 132 is automatically set based on the magnification of enlargement. Since the time step 1101 after the enlargement is smaller than the time step 1101 before the enlargement, the operator 120 can observe the structure of the peak in more detail. In the basic screen 500 and the enlarged screen 1100, individual peaks can be selected by moving the cursor 512. If you select a peak and enter a command,
A peak feature display screen 1200 shown in FIG. 12 is displayed. On this screen, various characteristics of the peak are displayed, which can be used for diagnosis of the operator 120. By clicking the button 1201, the screen returns to the basic screen 500 or the enlarged screen 1100. When a special command is input, a failure diagnosis knowledge setting screen 130 shown in FIG.
0 is displayed. On the fault diagnosis knowledge setting screen 1300,
By inputting the fault diagnosis parameter 139, the existing fault diagnosis knowledge 133 can be changed or the fault diagnosis knowledge 133 can be newly added. Fault diagnosis parameter 139
Has a name 1301, a code 1302, a constant 1303,
The judgment and certainty factor 1304 is included. The name 1301 is a character string used to specify the failure diagnosis knowledge 133. This may be used to show the basis of the failure diagnosis result 134 in response to the request of the operator 120. Code 1302 describes the condition in a format that can be interpreted by a computer. The constant 1303 specifically sets a constant value used in the code 1302. The judgment / certainty level 1304 indicates the failure diagnosis result 13
4 is reflected.

As described above, the communication network management support system 100 not only displays the cause of the occurrence of the journal log 130 but also determines the basis of the diagnosis result by the operator 12.
It also provides a function to check for zero. Therefore, it is also useful for the skilled operator 120.

[0018]

As described above, according to the present invention,
Even if the contents of each journal log are not interpreted, the relationship between a plurality of events occurring in the communication network can be displayed to the operator in an easy-to-understand manner. In addition, since multiple events occurring in the communication network can be described on a single graph, the temporal relationship between many events can be grasped at a glance, and reporting, recording, storage, and utilization of events can be performed. It becomes easier and can be used for business management and education. In addition, in order to grasp the relationship between events, a graph can be displayed at the optimal reference time and time interval,
The cause of the failure can be easily understood. In addition, the reference time and the time interval when displaying the graph can be designated by an intuitive operation. Further, the occurrence time of the journal log can be extracted by simple character string processing. Further, features such as peaks appearing in the graph can be clarified, and the relationship between a plurality of events can be more easily grasped. Unnecessary journal logs that do not appear in the graph can be removed by simple character string processing. Also, by associating each peak with an event, the content of the event can be estimated based on the characteristics of the peak. Further, the work of estimating the content of the event from the characteristics of the peak can be automated.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of a communication network management support system according to an embodiment of the present invention.

FIG. 2 is a list showing an example of a journal log.

FIG. 3 is a diagram illustrating an example of a log occurrence time distribution.

FIG. 4 is a diagram showing an example of fault diagnosis knowledge;

FIG. 5 is a diagram showing an example of a basic screen.

FIG. 6 is a diagram showing a configuration of a log occurrence time analysis unit.

FIG. 7 is a diagram showing an example of log selection conditions.

FIG. 8 is a diagram showing examples of useful logs, time character strings, and time values.

FIG. 9 is a flowchart showing detailed processing of a failure diagnosis unit;

FIG. 10 is a diagram showing an example of an enlarged area selection screen.

FIG. 11 shows an example of an enlarged screen.

FIG. 12 is a diagram showing an example of a peak feature display screen.

FIG. 13 is a diagram showing an example of a failure diagnosis knowledge setting screen.

[Explanation of symbols]

100 ... communication network management support system, 110 ...
Communication network, 120: operator, 121: manager, 130: journal log, 131: log occurrence time distribution, 132: histogram, 133: fault diagnosis knowledge, 1
34: Failure diagnosis result, 135: Screen, 136: Input information, 137: Reference time / time increment, 138: Peak selection instruction, 139: Failure diagnosis parameter, 140: Report,
510: histogram display window, 511: peak, 512: cursor, 520: failure diagnosis result display window, 610: reception log, 611: accumulation log, 612
… Log selection condition, 613 useful log, 614 time character string, 615 time value, 1001 start time, 1002
End time, 1010 ... Guidance display window, 1101 ...
Time increment, 1201 ... button

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Nobuyuki Tanaka 5-2-1 Omikacho, Hitachi City, Ibaraki Prefecture Inside the Omika Plant of Hitachi, Ltd. (72) Inventor Junji Sato 5-chome Omikacho, Hitachi City, Ibaraki Prefecture No. 1 Hitachi, Ltd. Omika Plant (72) Inventor Nobuyuki Kansu 4-7-1 Hatchobori, Chuo-ku, Tokyo Inside Japan Telecom Co., Ltd. (72) Inventor Kiichi Muratsubaki 4-chome, Hatchobori, Chuo-ku, Tokyo No. 1 Japan Telecom Co., Ltd. (72) Inventor Masakuni Niwa 4-7-1 Hatchobori, Chuo-ku, Tokyo Japan Telecom Co., Ltd. F-term (reference) 5B089 GA01 GA21 JB11 JB23 KA04 KA13 KC36 KC51 KE03 LB17 MC03 5E501 AA05 AB30 AC25 AC32 AC35 AC36 BA03 CA03 DA17 EA32 EB05 FA13 FA14 FA42 5K030 GA18 HB00 HB15 JA10 KA21 MA01 5K035 AA07 BB02 DD01 K K04 MM03 MM07 9A001 CC07 LL09

Claims (9)

[Claims] 1. A communication network management support system having a function of displaying a journal log on a communication network to an operator, wherein a partial character string representing the time of occurrence of the journal log is converted from a character string constituting the journal log. Means for extracting, a means for interpreting the partial character string as time, a means for estimating the cause of the occurrence of the journal log based on the distribution of the time of occurrence of the journal log, and a means for displaying the cause of occurrence A communication network management support system, characterized in that: 2. The communication network management support system according to claim 1, further comprising means for displaying a distribution of occurrence times of the journal logs by using a histogram. 3. The communication network management support system according to claim 2, further comprising means for the operator to specify a reference time or a time interval for creating or displaying the histogram. 4. The communication network management support system according to claim 3, further comprising means for knowing that a cursor displayed on the histogram has been moved, and changing the reference time or the time interval. . 5. The communication according to claim 1, further comprising: means for extracting a partial character string conforming to a predetermined format from a character string constituting the journal log as a character string representing an occurrence time of the journal log. Network management support system. 6. The communication network management support system according to claim 1, further comprising means for removing a journal log generated by an event having no direct relation to the operation of the communication device from the journal log. 7. The method according to claim 6, wherein when the character string constituting the journal log includes a specific partial character string, the journal log is determined to be a journal log generated by an event that is not directly related to the operation of the communication device. A communication network management support system comprising means. 8. The apparatus according to claim 1, wherein the operator selects one of a plurality of peaks appearing in the histogram, and a maximum frequency, a duration, or a number of journal logs included in the selected peak. A communication network management support system. 9. The communication network management support system according to claim 1, further comprising means for the operator to input a parameter for estimating a cause of occurrence of the journal log.