JP2002271328A - System and method for analyzing network fault - Google Patents

Abstract

PROBLEM TO BE SOLVED: To obtain a method and a system for analyzing a fault in which a fault can be located and the substantial cause thereof can be detected while suppressing repetition of fault greatly. SOLUTION: Fault information in a network system is detected and based on a data base defining the network elements constituting the network hierarchically and the detected fault information, a network element estimated as the cause of fault is extracted.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for analyzing a communication failure occurring in a system for providing a logical circuit service on a network constituted by a plurality of communication devices.

[0002]

2. Description of the Related Art FIG. 6 is a block diagram showing a configuration of a network system to which a conventional network failure analysis processing system disclosed in Japanese Patent Application Laid-Open No. 10-11332 is applied, and FIG. 7 shows a conventional network failure analysis process. It is a flowchart. In FIG. 6, reference numeral 60 denotes the entire network system, 61 and 62 denote transmission devices in the network system 60, 63 denotes a failure analysis system connected to the transmission devices 61 and 62, 6A, 6B, and 6C denote transmission devices 61,
Using the communication functions of 62, both business α and β, business β
Only, a terminal that performs only the process α. here,
It is assumed that each of the transmission devices 61 and 62 incorporates a communication failure detection device that detects a failure when a communication failure occurs and sends a signal to the failure analysis system. In the network system 60, when a failure occurs in a communication device on the network system, failure information such as the scope of the failure, the failure cause type, the failure operation, and the failure time is collected and notified to the failure analysis system 63. Is done. After the failure information is notified, the failure analysis system 63 refers to only the failure history reported within a predetermined time according to the flowchart of FIG. 7 and checks whether the newly generated failure information is a duplicate failure. That is, the newly generated fault information is compared with the fault history reported within a certain period of time to determine whether the fault is on the same physical line as the previous fault (step S71).
Whether the failure is of the same type as the previous failure (step S7)
2) Further, three conditions of whether a failure has occurred in the same job (step S73) are confirmed. When the above three conditions are satisfied by the confirmation of the three conditions, the newly generated failure is prevented from being explicitly reported as a duplicate failure of the same cause, and the failure information is reported to the network system 60. Omitted (step S74). In other cases, the report is made as it is (step S75). By such processing, even when a plurality of faults having the same cause are reported to the fault analysis system in a different form, the fault report is suppressed and the faults are reduced to the minimum necessary.

[0003]

In the conventional network fault analysis system, when a fault occurs on a line, the fault is duplicated only when the fault occurs on the same line and is determined as the same type of fault. Is determined. However, if a failure occurs in a communication device that provides a plurality of logical line services, a failure may be reported on all logical lines related to the communication device. It is difficult to suppress failure reporting in such a situation because failures caused by the same cause can be reported as different types of failures. In the case of a logical line service that spans multiple devices, it is expected that a fault will be reported from a plurality of related communication devices. Since the report is controlled so that it is a failure of the same type and the same service on the same physical line and is suppressed as a duplicate failure, there is a possibility that only a failure irrespective of the fundamental failure location is left. In addition, in a network system that provides communication services, there are many cases where the type of communication service to be provided is not known, and even if the contents of the same business are reported as a failure that occurred in a different business, on the same line, In the conventional method in which the same type of fault that occurred in the same task is suppressed as a duplicate fault, the same fault may not actually be suppressed as a duplicate fault, and a report may be made with duplication. . Furthermore, the conventional network failure analysis method focuses on thinning out failure reports to the minimum necessary, so it does not reach the root cause inference analysis. There is a problem that it is not possible to narrow down and identify the cause of the failure and the location of the failure, and it takes time to find out the root cause.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems, and has a high degree of suppression of duplicate faults, and a fault analysis which can identify a fault location and detect a root cause. It is an object to obtain a processing method and a failure analysis processing device.

[0005]

According to a first aspect of the present invention, there is provided a network fault analysis device, wherein fault information detecting means for detecting fault information in a network system, and network elements constituting the network system are hierarchically defined. And a failure analysis means for extracting a network element presumed to be the cause of the failure among the network elements based on the database and the failure information detected by the failure information detection means.

According to a second aspect of the present invention, there is provided the network failure analysis apparatus according to the first aspect, wherein a failure is detected for a network element presumed to be the cause of the failure extracted by the failure analysis means. It has a specifying means for executing a diagnostic program to be detected and specifying a network element causing a failure.

According to a third aspect of the present invention, there is provided a network failure analysis device according to the second aspect, wherein the network failure analysis device specifies the failure information based on the failure information detected by the failure information detection means and the database. The priorities are assigned to the degrees of influence of the respective pieces of fault information, and the network element that causes the fault is specified.

According to a fourth aspect of the present invention, there is provided a network failure analysis apparatus according to the second or third aspect of the present invention, wherein the network element which is the source of the failure information and the higher-level network element are provided. For this, a diagnostic program for detecting a failure is executed, and a network element causing the failure is identified.

According to a fifth aspect of the present invention, there is provided a network failure analysis apparatus according to any one of the first to fourth aspects, wherein the network element constituting the network system is a tree structure. It is to be defined.

A network failure analysis method according to a sixth aspect of the present invention provides a network failure analysis method, comprising: a database in which network elements constituting a network system are hierarchically defined; and failure information detected in the network system. The network element presumed to be the cause of the failure is extracted.

According to a seventh aspect of the present invention, in the network failure analysis method according to the sixth aspect, a diagnostic program is executed for a network element presumed to be the cause of the extracted failure. The network element causing the failure is specified.

According to an eighth aspect of the present invention, in the network failure analysis method according to the seventh aspect, the priority of the degree of influence of each failure information is determined based on the detected failure information and the database. The network element which causes the failure is specified by ranking.

According to a ninth aspect of the present invention, there is provided a network failure analysis method according to the seventh or eighth aspect, wherein the network of the source of the failure information is sequentially arranged along the hierarchy of the database. The diagnostic program is executed for the network element higher than the element, and the network element causing the failure is specified.

According to a tenth aspect of the present invention, there is provided a network failure analysis method according to any one of the sixth to ninth aspects, wherein a network element constituting the network system has a tree structure as a database. It is to be defined.

[0015]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiment 1 FIG. 1 is a block diagram showing an example of the configuration of a network system to which the network failure analysis device according to the present invention is applied. In FIG. 1, reference numeral 10 denotes a failure analysis unit, 101 denotes a tree structure database in which network elements constituting a network system are hierarchically defined in advance, and 11, 12 and 13 provide communication services. Communication devices 11a, 12a, 12b, and 13a are incorporated in each communication device to actually provide a communication service as an interface connecting a user terminal and a transmission path, 1A, 1B, 1C, 1D, and 1E. , 1F indicate user terminals that enjoy communication services. Each communication device 11, 1
2 and 13 are used for analyzing failure information when a failure occurs.
Is provided with a failure information detecting means for reporting to the user.

1AB is composed of a user terminal 1A and a user terminal 1
A logical line service transmission line between B (AB line);
In the example of FIG. 1, each communication card 11a, 12a, 13a
Via. 1CD is a logical line service transmission line (inter-CD line) between the user terminal 1C and the user terminal 1D, and in the example of FIG. 1, the communication line 11a and 12b are used. 1EF is the user terminal 1E and the user terminal 1
A logical line service transmission line between F (an inter-EF line),
In the example of FIG. 1, the communication is performed via the communication cards 12b and 13a.

FIG. 2 is a block diagram showing the configuration of the tree structure database 101 incorporated in the failure analysis means 10 in FIG. The tree structure database 101 includes information on the entire network system at the highest level (stem),
Below that, information on each communication device that is a network element that constitutes the network system, further below that information on the communication card that is mounted on each communication device, and below that for the logical line service provided to each communication card. It is assumed that transmission path information is defined and registered in a hierarchical manner.

In FIG. 2, reference numeral 2 denotes a trunk portion indicating information on the entire network system, 21, 22, and 23 denote branch portions indicating information on each of the communication devices 11, 12, and 13 in FIG. , 22a, 22b, and 23a are communication cards 11a, 12a, 12b, and 13 in FIG.
It is a branch part indicating the information of a.

The inter-AB line 1AB in FIG. 1 is defined under the branch 21a indicating the communication card 11a and the sub-line 2AB1 defined below the branch 22a indicating the communication card 12a in the database structure of FIG. It is expressed by an AB line 2AB2 and an AB line 2AB3 defined below the branch 23a indicating the communication card 13a. The inter-AB line 2AB1, the inter-AB line 2AB2, and the inter-AB line 2AB3 are defined on the tree structure database. In addition to this, bidirectional links are provided, and this is an efficient relation. It is possible to search for branches.

Similarly, the inter-CD line 1CD in FIG.
In the database structure of FIG. 2, the inter-CD line 2CD1 defined below the branch 21a indicating the communication card 11a,
C defined below the branch 22b indicating the communication card 12b
It is represented by the inter-D line 2CD2. In addition, these C
The inter-D line 2CD1 and the inter-CD line 2CD2 are also defined on the tree structure database in the same manner as described above. Search is possible.

Similarly, in the database structure of FIG. 2 in FIG. 1, the inter-EF line 1EF is connected to the branch 22b indicating the communication card 12b in the database structure of FIG.
EF line 2EF1, communication card 1 defined below
EF line 2E defined below branch 23a indicating 3a
It is represented by F2. Furthermore, the inter-EF line 2EF1 and the inter-EF line 2EF2 are defined on the tree structure in the same manner as described above. It is possible to search for related branches.

FIG. 3 is a flowchart showing a process performed by the failure analysis means 10 in FIG. 1 after receiving the failure report to extract a network element presumed to be the cause of the failure. FIG. 9 is a flowchart illustrating a process of identifying a network element presumed to be a root cause of failure performed after extracting a network element presumed to be the cause. FIG. 5 is an explanatory diagram showing an example when a failure occurs in the communication card 11a in FIG.

Next, the operation will be described. First, before performing the failure analysis processing, a tree as shown in FIG. 2 is previously stored on the failure analysis unit 10 based on the configuration information of each communication device such as a communication device and a communication card and the communication service information provided by them. The structure database 101 is registered. The connection information of each communication device and the information related to service provision are input by an operation manager through a database tool according to a change in the configuration of the communication device or the service, and are separately managed.

The failure analysis process is performed in two stages. In the first stage, a network element presumed to be the cause of the failure is extracted from the failure report received by the failure analysis means 10 according to the flowchart of FIG. In the second stage, the network element presumed to be the root cause is identified from the network element presumed to be the cause of the failure extracted in the first stage according to the flowchart of FIG.

In FIG. 3, first, a series of failure reports presumed to be related are listed in an "occurrence list" (step S31). That is, in the failure analysis means 10, a certain fixed time is set in advance as an occurrence failure time interval for judging a related failure report, and a failure report generated within the set fixed time is set to the predetermined time. It is assumed that there is a link between the failure reports. On the other hand, when the occurred failure report is reported after the occurrence failure time interval, it is determined that the relationship between the generated failure reports is weak.

Then, the following processing is performed for the failures listed in the "occurrence list". Step S
The processing from step 33 to step S38, that is, the parent branch of the branch corresponding to the failure listed in the “occurrence list” is searched, and the failure corresponding to the parent branch is listed in the “occurrence list”. If not, a series of processing of registering in the “candidate list” is repeated from the beginning to the end of the “occurrence list”. By performing this series of processing, a network element presumed to be the cause of the failure is extracted.

First, the pointer is set to the fault listed at the top of the "occurrence list" (step S3).
2). Then, it is determined whether the pointer is at the end of the "occurrence list" (step 33). If not, the branch information (for example, branch) of the branch in the tree structure database corresponding to the failed network element indicated by the pointer is determined. Are read out (step S34), and the branch information of the parent branch of the branch is read out from the tree structure database (step S35). ). And the parent branch is the "occurrence list"
Is checked (step S36). If it is registered (Yes in step S36), it is left as it is.
On the other hand, if it is not registered (N in step S36)
o), the parent branch is registered in the "candidate list" (step S37), and the pointer is advanced to the next failure listed in the "occurrence list" (step S38). By performing such processing until the failure listed in the “occurrence list” becomes the last (Yes in step S33), the “candidate” which is a branch extraction result indicating a network element presumed to be the root failure cause is extracted. List "is created.

Then, for the branches listed in the "candidate list", the processing from step S41 to step S48 in FIG. 4, that is, the parent branch of the branch listed in the "candidate list" is searched. And run the diagnostics on the parent branch, and if a failure is detected,
A series of processes of adding a failure detection mark, adding the parent branch at the end of the "candidate list", and deleting the branches listed in the "candidate list" from the "candidate list" are called "candidate list". Repeat from the beginning to the end. By performing this series of processing, the network element presumed to be the root cause of the failure is specified.

First, the pointer is set to the branch listed at the head of the "candidate list" (step S41).
Then, it is determined whether or not the pointer is at the end of the "candidate list" (step S42). If not, the parent branch of the branch indicated by the pointer is searched (step S43). If not, a diagnostic program is executed (step S44). It is checked whether a failure has been detected by executing the diagnostic program (step S4).
5) If a failure is detected (Yes in step S45)
s), a failure detection mark is added, the parent branch is added to the end of the “candidate list” (step S46), and the branch listed in the “candidate list” is deleted from the “candidate list” (step S46). S47) Move the pointer to “candidate list”
To the next branch listed in (step S4
8). If no failure is detected (step S45)
No), the process directly proceeds to step S48. By performing such processing until the branch listed in the "candidate list" becomes the last (Yes in step S42), the network element presumed to be the root cause of the failure is specified.

The above "occurrence list" and "candidate list"
When a series of processing for is completed, the "candidate list"
Are the root causes of the failure, and the last candidate in the “candidate list” is analyzed as the most probable candidate.
Then, finally, the branch registered in the “candidate list” is output together with the diagnostic program result in reverse order from the end of the list as the root cause of the failure (step S49). As an output destination, for example, a terminal display or the like on which an operation manager works can be considered.

Hereinafter, as a specific example, it is assumed that a failure occurs in the communication device 12. At this time,
Assuming that communication is performed on the AB line and the CD line, and a failure occurs on both logical line service transmission lines, the failure detection device of each communication device fails on the AB line and the CD line on the tree structure database 101. And sends a failure report to the failure analysis means 10. Specifically, the branch 21a indicating the communication card 11a in the database structure of FIG.
A line 2AB1 defined below the part, an inter-CD line 2CD1 defined below the branch 21a indicating the communication card 11a, an inter-CD line 2CD2 defined below the branch 22b indicating the communication card 12b, Communication card 11
It is assumed that fault reports for five branches, ie, the branch 21a indicating a and the branch 22a indicating the communication card 12a, are reported to the fault analyzing unit 10 in this order within a short time.

Based on this, the network element presumed to be the cause of the failure is extracted according to the flowchart of FIG. First, since the fault reports for the five branches are reported within a short period of time, the fault analysis unit 10 estimates that there is a relationship, and lists the five branches in the “occurrence list”. (Step S31).

Then, the processing is started from the beginning of the "occurrence list" (step S32), and the following processing is performed for all the items listed in the occurrence list. Specifically, the branch 2AB1 indicating the line between ABs listed in the “occurrence list”, the branch 2CD1 indicating the line between CDs, the branch 2CD2 indicating the line between CDs, and the branch 21 indicating the communication card 11a
a, the five cases of the branch 22a indicating the communication card 12a are sequentially processed.

First, AB at the top of the "occurrence list"
The branch 2AB1 indicating the interline is targeted. The branch information of the branch 2AB1 is read (step S34), the branch information of the parent branch 21a of the branch 2AB1 is read (step S35), and it is confirmed whether or not the branch 21a is registered in the current “occurrence list” (step S36). . In this case, the parent branch 21a
Is registered (Yes in step S36), the branch 2AB1 is not registered in the "candidate list", and the pointer is moved forward (step S38).

Next, the branch 2CD1 indicating the inter-CD line is targeted. The branch information of the branch 2CD1 is read (step S3
4), the branch information of the parent branch 21a of the branch 2CD1 is read (step S35), and it is confirmed whether this branch 21a is registered in the current "occurrence list" (step S36).
In this case, as in the case of the branch 2AB1, the parent branch 21a is registered (Yes in step S36), so that the branch 2CD1 is not registered in the "candidate list", and the pointer is advanced to the next (step S38).

Next, the branch 2CD2 indicating the inter-CD line is targeted. The branch information of the branch 2CD2 is read (step S3
4), the branch information of the parent branch 22b of the branch 2CD2 is read (step S35), and it is confirmed whether this branch 22b is registered in the current "occurrence list" (step S36).
In this case, since the parent branch 22b is not registered (No in step S36), the branch 2CD2 is registered in the "candidate list" (step S37), and the pointer is moved forward (step S38).

Next, the branch 21a indicating the communication card 11a is targeted. The branch information of the branch 21a is read (step S
34), the branch information of the parent branch 21 of the branch 21a is read (step S35), and it is confirmed whether this branch 21 is registered in the current "occurrence list" (step S36). In this case, since the parent branch 21 is not registered in the “occurrence list” (No in step S36), the branch 21a is registered in the “candidate list” (step S37), and the pointer is moved forward (step S37). S38).

Next, the branch 22a indicating the communication card 12a is targeted. The branch information of the branch 22a is read (step S
34), the branch information of the parent branch 22 of the branch 22a is read out (step S35), and it is confirmed whether this branch 22 is registered in the current “occurrence list” (step S36). In this case, since the parent branch 22 is not registered in the "occurrence list" (No in step S36), the branch 22a is registered in the "candidate list" (step S37). Here, the pointer is at the end of the “occurrence list” (Y in step S33).
es) That is, since the processing has proceeded to the end of the “occurrence list”, the processing on the “occurrence list” ends here.

At the stage where the processing on the "occurrence list" is completed, the "candidate list" includes a branch 2C indicating a line between CDs as a candidate for a network element presumed to be the root cause of the failure.
D2, branch 21a indicating communication card 11a, communication card 1
Three branches 22a indicating 2a are registered.

Next, processing for specifying a network element presumed to be the root cause of the failure is performed according to the flowchart of FIG. Specifically, the branch 2CD2 indicating the inter-CD line listed in the “candidate list”, the communication card 11
A branch 21a indicating a and a branch 22a indicating the communication card 12a are sequentially processed.

First, the processing is started from the beginning of the "candidate list" (step S41). First, the branch 2CD2 indicating the inter-CD line at the head of the "candidate list" is targeted.
The parent branch of branch 2CD2 is searched (step S43), and 2C
The diagnostic program is executed for the parent branch 22b of D2 (step S44). In this case, the failure is detected because the communication device 12 in which the communication card 12b corresponding to the branch 22b is incorporated has failed (step S45).
Therefore, the parent branch 22b of the branch 2CD2 is additionally registered at the end of the "candidate list" (step S46), and a failure detection mark is added as additional information of the branch 22b. Then, the branch 2CD2 is deleted from the "candidate list" (step S47), and the pointer is moved forward (step S47).
48).

Next, the branch 21a indicating the communication card 11a is targeted. Search for parent branch of branch 21a (step S4
3) Then, the diagnostic program is executed on the parent branch 21 of the branch 21a (step S44). In this case, the communication device 1 in which the communication card 12a corresponding to the branch 21a is incorporated.
Since No. 1 has not failed, no failure is detected (step S45). The fact that the parent branch is not out of order means that the branch 2
That is, 1a itself should be left as a candidate for the cause of the root failure, and the branch 21a remains in the "candidate list". Thereafter, the pointer is advanced to the next (step S48).

Next, the branch 22a indicating the communication card 12a is targeted. That is, the parent branch of the branch 22a is searched (step S43), and the diagnostic program is executed for the parent branch 22 of the branch 22a (step S44). In this case, since the communication device 12 itself corresponding to the branch 22 has failed,
A failure is detected (Step S45). Therefore, the branch 22
The branch 22 of the parent a is additionally registered at the end of the "candidate list" (step S46), and a failure detection mark is added as additional information of the branch 22. Then, the branch 22a is deleted from the "candidate list" (step S47), and the pointer is advanced to the next (step S48).

Next, the branch 22b indicating the communication card 12b newly registered during the processing on the "candidate list" is targeted. After searching for the parent branch of the branch 22b (step S43), the process proceeds to step S44. Since the diagnostic program has already been executed for the parent branch 22 of the branch 22b, the diagnostic program is not executed at this time. Next, step S
The process proceeds to S45, and since the failure “Yes” is detected from the diagnosis result that has been performed, the process proceeds to Step S46. Then, it is additionally registered at the end of the "candidate list" (step S46), and a failure detection mark is added as additional information of the branch 22b. Note that the branch 22 has already been registered in the “candidate list”, and if it is registered this time, it will be registered twice. Therefore, in such a case, the registration processing in step S46 may be omitted. Then, the branch 22b is deleted from the "candidate list" (step S47). Thereafter, the pointer is advanced to the next (step S48).

Next, the branch 22 indicating the communication device 12 newly registered during the processing on the "candidate list" is also targeted. The branch of the parent of the branch 22 is searched (step S43), and the branch 2
The diagnostic program is executed on the branch 2 of the second parent (step S44). In this case, no failure is detected because the entire network corresponding to the branch 2 has not failed (step S45). Therefore, the branch 22 remains in the “candidate list”, and remains as the candidate for the root cause.

Since the processing has proceeded to the end of the "candidate list", the processing on the "candidate list" ends here (Yes in step S42). From the above, finally, two branches, the branch 21a indicating the communication card 11a and the branch 22 indicating the communication device 12, remain in the "candidate list".

Since the last candidate in the “candidate list” is analyzed as a probable candidate of the root cause of the failure, the root cause of the failure is
In the reverse order from the end of the “candidate list”, the branches registered in the “candidate list” are output from the failure analysis unit 10 together with the result of the diagnostic program. That is, the communication device 12 corresponding to the branch 22 as the most probable root cause of the failure and the communication card 11a corresponding to the branch 21a as the next candidate are output from the failure analysis means 10 (step S49).
As described above, the network element causing the failure is specified, and the administrator can smoothly deal with the failure.

In the first embodiment, the database 1
Although 01 is described as a configuration inside the failure analysis means 10, it may be a configuration outside.

[0049]

As described above, according to the present invention, fault information detecting means for detecting fault information in a network system, a database in which network elements constituting the network system are hierarchically defined, A failure analysis unit that extracts a network element presumed to be the cause of the failure among the network elements based on the failure information detected by the failure information detection unit. Even if a plurality of faults are reported with the same root cause due to the fault that has occurred, the redundant fault can be eliminated by estimating the fault cause from the fault that has occurred.

[0050] The apparatus further comprises a specifying means for executing a diagnostic program for detecting a fault with respect to the network element presumed to be the cause of the fault extracted by the fault analyzing means, and specifying the network element which is the cause of the fault. Therefore, the guessed part can be diagnosed, and the root cause can be specified even if the root cause is not reported.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an example of a configuration of a network system to which a network failure analysis device according to the present invention is applied;

FIG. 2 is a block diagram showing a configuration of a tree structure database incorporated in the failure analysis unit 10 in FIG.

FIG. 3 is a flowchart showing a process of extracting a network element presumed to be a cause of a failure performed by the failure analysis unit 10 in FIG. 1 after receiving a failure report.

FIG. 4 is a flowchart showing a process performed by the failure analysis unit 10 in FIG. 1 for extracting a network element presumed to be the cause of the failure, and identifying the network element presumed to be the cause of the failure;

FIG. 5 is an explanatory diagram showing an example of a case where a failure has occurred in the communication device 12 in FIG. 2;

FIG. 6 is a block diagram showing a configuration of a network system to which a conventional network failure analysis processing method is applied;

FIG. 7 is a flowchart showing a conventional network failure analysis process;

[Explanation of symbols]

10 failure analysis means, 101 database, 1
1, 12, 13 communication device, 11a, 12a, 12
b, 13a communication card, 1A, 1B, 1C, 1D,
1E, 1F user terminal, 60 entire network system, 61, 62 transmission equipment, 63 failure analysis system, 6A, 6B, 6C terminal

Claims (10)

[Claims] 1. Fault information detecting means for detecting fault information in a network system, a database in which network elements constituting the network system are hierarchically defined, fault information detected by the database and the fault information detecting means And a failure analysis means for extracting a network element presumed to be the cause of the failure among the network elements based on the above. 2. A method according to claim 1, further comprising the step of: executing a diagnostic program for detecting a fault with respect to the network element presumed to be the cause of the fault extracted by the fault analysis means, and specifying the network element which is the cause of the fault. The network failure analysis device according to claim 1, wherein: 3. The identification unit assigns a priority to the degree of influence of each failure information based on the failure information detected by the failure information detection unit and the database, and identifies a network element that is the cause of the failure. 3. The network fault analysis device according to claim 2, wherein: 4. The method according to claim 1, wherein the specifying means executes a diagnostic program for detecting a fault with respect to a network element that has generated the fault information and a higher-level network element, and specifies a network element that is the cause of the fault. The network failure analysis device according to claim 2 or 3, wherein 5. The network failure analysis device according to claim 1, wherein the database defines network elements constituting the network system as a tree structure. 6. A network element which is presumed to be a cause of a failure among the network elements is extracted based on a database in which network elements constituting the network system are hierarchically defined and failure information detected in the network system. A network failure analysis method, characterized in that: 7. The method according to claim 6, wherein a diagnostic program for detecting a failure is executed for the extracted network element presumed to be the cause of the failure, and the network element causing the failure is specified. Network failure analysis method. 8. The network element according to claim 7, wherein a priority is given to the degree of influence of each fault information based on the detected fault information and the database, and a network element causing the fault is specified. Network failure analysis method. 9. The network according to claim 7, wherein a diagnostic program for detecting a fault is executed for a network from which the fault information is generated and a higher-level network element, and a network element causing the fault is specified. Item 9. The network failure analysis method according to Item 8. 10. The network failure analysis method according to claim 6, wherein the database defines network elements constituting the network system as a tree structure.