JPH06326752A - Method and device for analyzing fault of communication protocol - Google Patents

Abstract

PURPOSE:To find out a fault of a communication protocol in a short period without intelligence and experience. CONSTITUTION:A fault cause storage section 24 stores a data key of unit communication data to be subjected to fault analysis as a designated key and stores a scope of a fault cause corresponding to the designation key. A fault diagnostic intelligent database 27 stores symptom of a communication fault as a node and each symptom as a diagnostic tree and stores a retrieval rule to retrieve a cause to a symptom and a counter measure method serviced for a maintenance personnel corresponding to each symptom. When an abnormality takes place in communication data, a diagnosis object data extract section 23 extracts unit communication data having the designation key and unit communication data belonging to a scope of fault cause stored corresponding to the designation key as diagnosis object data out of all of collected communication data. Fault cause output sections 26, 28 apply a detection rule of a host node of a diagnostic tree sequentially to the extracted diagnosis object data and extracts the fault cause and the countermeasure method and provides them as outputs.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a communication protocol failure analysis method and apparatus for monitoring communication data flowing on a communication line and analyzing a cause of failure related to a communication protocol.

[0002]

2. Description of the Related Art A conventional protocol analyzer monitors and fetches communication data flowing on a line, stores the fetched communication contents in a secondary storage device (eg magnetic disk), and displays it on a display. Is configured. Further, the contents displayed by the protocol analyzer are those in which the monitored contents are displayed in hexadecimal (some translations are performed to some extent). When a communication failure occurs, an engineer uses a protocol analyzer to analyze a large amount of communication data while observing a protocol analyzer screen display or a hard copy in order to find a communication protocol (communication protocol) failure.

[0003]

However, the conventional discovery of a communication protocol failure depends largely on the technical ability and experience of the engineer himself. In addition, in order to find the failure location from a large amount of communication data. It took a lot of time.

In view of the above problems, it is an object of the present invention to provide a method and apparatus for detecting a protocol failure in communication data in a short period of time without requiring the knowledge or experience of an engineer.

[0005]

A communication protocol failure analysis method of the present invention for monitoring communication data flowing on a communication line and analyzing a cause of failure related to a communication protocol is a unit communication data constituting the communication data. A data key indicating the type of each unit communication data is given to, the data key of the unit communication data to be subjected to failure analysis is specified as a designated key, and when an abnormality occurs in the communication data, it causes an abnormality or A range on the communication data that may be affected is stored as a failure cause range corresponding to the specified key, and a symptom indicating a communication abnormality is set as a node, and a symptom that causes the symptom is the symptom. It is stored as a diagnostic tree that is structured in a tree structure from upper to lower by setting it as the lower symptom of each node. Grant and the search rules for searching, and workarounds that are presented to maintenance personnel in response to symptoms,
When an abnormality occurs in the communication data, the unit communication data having the data key corresponding to the designated key and the unit communication belonging to the failure cause range stored corresponding to the designated key are selected from all the collected communication data. Data is extracted as the diagnosis target data, and the detection rules of the lower nodes of the diagnosis tree are sequentially applied to the extracted diagnosis target data, and the extracted failure cause and the coping method are output. Further, it is preferable that the nodes are arranged in the order from the upper order to the lower order, in which the diagnosis does not take time.

Further, the communication protocol failure analysis apparatus of the present invention for monitoring the communication data flowing on the communication line and analyzing the cause of failure related to the communication protocol indicates the type of each unit communication data constituting the communication data. Among the data keys given for this purpose, the data key of the unit communication data to be subjected to failure analysis is stored as a designated key, and
When an abnormality occurs in the communication data, the cause of failure stored in correspondence with the designated key is defined as a failure cause range that is the cause of the error or may be affected by the abnormality. By storing the storage unit and a symptom indicating a communication abnormality as a node, and setting the symptom that causes the symptom as a lower symptom of the symptom, it is stored as a diagnostic tree sequentially arranged in a tree structure from upper to lower. , A fault diagnosis knowledge database that stores the search rule for searching the cause of the symptom of the node and the coping method presented to the maintenance person in response to the symptom, and the communication data has an abnormality If you do, from all the communication data collected,
A unit of communication data having a data key corresponding to the designated key and unit of communication data belonging to the failure cause range stored corresponding to the designated key are extracted as diagnosis target data, and a diagnosis target data extraction unit is extracted. With respect to the data to be diagnosed, it has a failure cause output unit that sequentially applies the detection rules of the lower nodes from the detection rules of the upper node of the diagnosis tree of the failure diagnosis knowledge database, and outputs the extracted failure cause and the coping method.

[0007]

In the failure cause storage unit, among the data keys of the unit communication data, the data key of the unit communication data to be subjected to failure analysis is stored as a designated key, and the failure cause range is stored in correspondence with the designated key. The fault diagnosis knowledge database stores a symptom indicating a communication abnormality as a node, and a symptom that causes the symptom is a lower symptom of the symptom, and is stored as a diagnostic tree sequentially arranged in a tree structure from upper to lower. In addition, each node stores a search rule for searching the cause of the symptom of the node and a coping method presented to the maintenance person in response to the symptom. When an abnormality occurs in communication data, the diagnosis target data extraction unit stores unit communication data having a data key corresponding to the designated key and stored corresponding to the designated key from all collected communication data. The unit communication data belonging to the failure cause range is extracted as the diagnosis target data. The failure cause output unit sequentially applies the detection rule of the lower node to the detection rule of the upper node of the diagnosis tree of the failure diagnosis knowledge database for the extracted diagnosis target data, and outputs the extracted failure cause and the coping method. .

[0008]

Embodiments of the present invention will now be described with reference to the drawings. 1 is a block diagram showing an embodiment of a communication protocol failure analysis device of the present invention, and FIG. 2 is a diagram showing an example of a data flow in the embodiment of FIG. The exchange 1 and the terminal 2 communicate with each other via a communication line, and the communication protocol failure analysis device 4 uses a monitor point 3 of the communication line.
Monitor and capture communication data with.

The communication protocol failure analysis device 4 comprises a secondary storage device 10 and a processing unit 20. The secondary storage device 10 includes a communication data storage unit 11, a diagnosis target data storage unit 12, and a diagnosis result storage unit 13. Further, the processing unit 20 includes a monitor interface unit 21, a data reading unit 22, a diagnosis target data file creation unit 23, a failure cause storage unit 24, a data expansion unit 25, a failure cause search unit 26, a failure diagnosis knowledge database 27 (hereinafter, Fault diagnosis knowledge DB
27)) and a coping method output unit 28.

The monitor interface unit 21 converts the communication data fetched from the monitor point 3 into a fixed format and stores it in the communication data storage unit 11. The communication data stored in the communication data storage unit 11 is read by the data reading unit 22 and passed to the diagnosis target data file creating unit 23. Diagnostic target data file creation unit 23
Compares the data key, which is the key attached to the passed data, with the specified key listed in the failure cause range table stored in the failure cause storage unit 24, and when they match, the failure occurs. In accordance with the failure cause range described in the cause storage section 24 corresponding to the designated key, the communication data having the same data key as the designated key or the communication data before and after the communication data are extracted to create a diagnostic target data file. Then, the data is stored in the diagnosis target data storage unit 12. In this case, the designated key and the failure cause range are respectively determined by past data such as failure cases.

Next, the operation of the embodiment shown in FIG. 1 will be described with reference to FIG. The data reading unit 22 reads the stored communication data stored in the communication data storage unit 11 and transfers it to the diagnosis target data file creation unit 23 (step S1), and the diagnosis target data file creation unit 23 determines the failure range of the transferred storage communication data. Data of the diagnosis target data is created by applying the data of the table, and the diagnosis target data storage unit 1
2 (step S2).

A specific example of steps S1 and S2 will be described with reference to FIG. Communication data storage unit 11
The stored communication data 11a stored in the data reading unit 2
The data is read out to 2 and is passed to the diagnosis target data file creation unit 23. The diagnosis target data file creation unit 23 uses the designated keys CR and C of the extracted failure cause range table 24a.
It is searched whether communication data having data keys corresponding to C and RR exists in the stored communication data 11a. If it exists, the failure cause range of the failure cause range table 24a is referred to, and the data before and after the communication data corresponding to the specified number of packets is extracted as the diagnosis target data file 12a. In this specific example, when the designated number of packets is 1, only the self is shown. Therefore, since the failure cause range of the designated keys CR and CC is 1 before and after, it is only the self-packet, and is applicable to the packet N.
o. These are communication data 1 and 2. Further, the range of the cause of failure of the designated key RR is 2 for the front and 1 for the rear, so that it is the self-packet and the previous packet. Two
As a result, the diagnostic target data file 12a is created and stored in the diagnostic target data storage unit 12.

After the diagnostic target data file is thus stored in the diagnostic target data storage unit 12, the data reading unit 22 reads it and transfers it to the data expansion unit 25 (step S3). The data expanding unit 25 divides the diagnosis object data of the passed diagnosis object data file into each frame and one packet, and expands the contents of the communication data in the memory (step S4). The expansion into the memory is for speeding up the reference of communication data when the detection rule described below is applied, and is not an essential requirement for configuring the present invention.

The failure cause searching unit 26 acquires a cause list from the failure diagnosis knowledge DB 27 corresponding to the initial symptom of the diagnosis target data (step S5). Based on the detection rule of each cause listed in the cause list, each diagnosis target data is checked according to a diagnosis tree having a structure as shown in FIG. 4 (steps S6 and S7). Each node shown in FIG. 4 represents a symptom and includes the following information.

Symptoms: Cause: List of lower symptoms that cause the current symptoms Cause: Source: List of higher symptoms that are caused by the current detection rules: Detection rules for symptoms Action method: Detect failure When this is done, the content of measures shown to the maintenance person Node connection: The node is connected from the cause-source node to the cause-node, and normally, there are a plurality of cause-nodes.

If the diagnosis target data to be checked is as shown in FIG. 5, for example, the diagnosis is performed as shown in FIG. Since the initial symptom A1 in the diagnosis tree is the communication interruption (if the initial symptom is unknown, it is executed for all the initial symptom), the cause RI is given, and the packet P4 (see FIG. 5) related to RI is detected. The symptom 1 in the diagnosis tree is RI. Detection rule RULE-R
I is applied, the cause is detected as "local procedure error", and symptom 2 is "local procedure error".
In the symptom 2, RULE-RI5 is applied, and it is determined whether the packet P4 is CAUSE: 5. CAUS
Since it is E: 5, the cause is "transmission sequence number error" and the symptom 3 is "transmission sequence number error".

In symptom 3, "transmission sequence number error"
The RULE-RI51 relating to is applied. RULE-
The RI 51 determines whether the packet P4 is DIAG: 1. If DIAG: 1, a packet having a contradiction in the transmission sequence number is searched from the mutual relation of the packets P1 to P3 that are earlier than the packet P4. Inconsistent packet (Fig. 5
If so, if the packet P2) is detected, the cause packet P2 and the result packet P4 are stored in the diagnostic result storage unit 13 via the coping method output unit 28. Further, when the cause of failure is searched for in all the diagnosis target data (step S8), the coping method output unit 28 acquires a coping method (for example, a terminal software investigation) corresponding to them (step S8).
9), and stores it in the diagnostic result storage unit 13 (step S1).
0).

It should be noted that the above-mentioned diagnosis trees are arranged such that it takes time to diagnose (detect) the symptom as the hierarchy becomes deeper such as initial symptom, symptom 1 and symptom 2. Therefore, if the symptom cannot be detected in the data to be diagnosed in the shallow hierarchy, the subsequent symptom diagnosis is not executed, resulting in less waste of time. Further, for each protocol failure in the data to be diagnosed, only the diagnosis corresponding to each failure is performed, so that it is not necessary to search all the diagnosis trees, and the diagnosis time is shortened.

[0019]

As described above, according to the present invention, the data key of the unit communication data to be subjected to the failure analysis is designated as the designated key, and when an abnormality occurs in the communication data, it causes the abnormality or the abnormality. The range on the communication data that may be affected is stored as a failure cause range, and when a failure occurs, only the communication data related to the designated key and the failure cause range need be analyzed, so all communication data is analyzed. There is an effect that it can be processed promptly without the need to perform. Further, since the data related to the technique and the experience is stored in advance as a diagnosis tree or the like, there is an effect that even an inexperienced person can easily perform the maintenance.

[Brief description of drawings]

FIG. 1 is a block diagram showing an embodiment of a communication protocol failure analysis device of the present invention.

FIG. 2 is a flowchart showing the operation of the embodiment of FIG.

FIG. 3 is a diagram showing an example of a data flow in the embodiment of FIG.

4 is a diagram showing an example of a diagnosis tree showing the structure of a failure diagnosis knowledge DB in the embodiment of FIG.

FIG. 5 is a diagram showing an example of diagnostic target data to be checked.

6 is a diagram showing how the diagnosis target data of FIG. 5 is diagnosed.

[Explanation of symbols]

 1 exchange 2 terminal 3 monitor point 4 communication protocol failure analysis device 10 secondary storage device 11 communication data storage unit 12 diagnostic target data storage unit 13 diagnostic result storage unit 20 processing unit 21 monitor interface unit 22 data reading unit 23 diagnostic target data file Creation unit 24 Failure cause storage unit 25 Data expansion unit 26 Failure cause search unit 27 Failure diagnosis knowledge DB 28 Coping method output unit

Claims (3)

[Claims] 1. A communication protocol failure analysis method for monitoring communication data flowing on a communication line and analyzing a cause of failure related to a communication protocol, comprising a type of each unit communication data in each unit communication data constituting the communication data. , The data key of the unit communication data to be subjected to failure analysis is specified as the designated key, and if an abnormality occurs in the communication data, it may cause the abnormality or be affected by the abnormality. The range on the communication data is stored as a failure cause range corresponding to the specified key, and a symptom indicating communication abnormality is set as a node, and a symptom causing the symptom is set as a subordinate symptom of the symptom. In order to search the cause of the symptom of the node in each node, If the communication data is abnormal, the data key corresponding to the specified key is added from the collected communication data. The unit communication data that it has and the unit communication data that belongs to the failure cause range stored corresponding to the specified key are extracted as diagnosis target data, and the extracted diagnosis target data is extracted from the detection rule of the node above the diagnosis tree. A communication protocol failure analysis method characterized in that detection rules of lower nodes are sequentially applied and the extracted failure cause and coping method are output. 2. The arrangement of the nodes from higher to lower is:
2. The communication protocol failure analysis method according to claim 1, wherein the diagnosis is performed in order of those that do not require time. 3. A communication protocol failure analysis device for monitoring communication data flowing on a communication line and analyzing a cause of failure related to a communication protocol, which is assigned to indicate a type of each unit communication data constituting the communication data. The data key of the unit communication data to be subjected to the failure analysis is stored as the designated key among the data keys that have been analyzed, and when an abnormality occurs in the communication data, it may cause the abnormality or may be affected by the abnormality. A range on the communication data is defined as a failure cause range, a failure cause storage unit stored corresponding to the designated key, a symptom indicating a communication abnormality is a node, and a symptom that causes the symptom is a subordinate of the symptom. According to the symptom of the above, it is stored as a diagnostic tree that is structured in a tree structure from upper to lower, and each node has a cause of the symptom of the node. Failure diagnosis knowledge database that stores the search rules for searching and the coping method that is presented to the maintenance person in response to the symptom, and if an error occurs in the communication data, from all the collected communication data A unit for communication data having a data key corresponding to the designated key and unit communication data belonging to the failure cause range stored corresponding to the designated key as target diagnostic data, and a diagnostic target data extraction unit, With respect to the data to be diagnosed, it has a failure cause output unit which sequentially applies the detection rules of the lower nodes from the detection rules of the upper nodes of the diagnosis tree of the failure diagnosis knowledge database, and outputs the extracted failure cause and the coping method. A communication protocol failure analysis device characterized by the above.