WO2022083576A1 - 一种网络功能虚拟化设备运行数据的分析方法及装置 - Google Patents

一种网络功能虚拟化设备运行数据的分析方法及装置 Download PDF

Info

Publication number
WO2022083576A1
WO2022083576A1 PCT/CN2021/124662 CN2021124662W WO2022083576A1 WO 2022083576 A1 WO2022083576 A1 WO 2022083576A1 CN 2021124662 W CN2021124662 W CN 2021124662W WO 2022083576 A1 WO2022083576 A1 WO 2022083576A1
Authority
WO
WIPO (PCT)
Prior art keywords
log data
rules
analysis
cluster
data
Prior art date
Application number
PCT/CN2021/124662
Other languages
English (en)
French (fr)
Inventor
常诚
刘建华
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2022083576A1 publication Critical patent/WO2022083576A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
    • G06F11/0712—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in a virtual computing platform, e.g. logically partitioned systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0766—Error or fault reporting or storing
    • G06F11/0775—Content or structure details of the error report, e.g. specific table structure, specific error fields
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0766—Error or fault reporting or storing
    • G06F11/0781—Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/079—Root cause analysis, i.e. error or fault diagnosis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/18—File system types
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/23—Clustering techniques
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G06F18/243—Classification techniques relating to the number of classes
    • G06F18/24323—Tree-organised classifiers
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/26—Discovering frequent patterns

Definitions

  • the present disclosure relates to the field of virtualization technology.
  • Cloud-based layered decoupling brings more device components and massive event data, which brings greater difficulties to fault delimitation and location, such as: from the APP application layer/platform layer to the virtual layer/physical layer, etc.
  • the fault location cycle is long. Therefore, it is necessary to realize the automatic and rapid delimitation of the level where the fault occurs.
  • the fault delimitation and location are of great significance for the normal operation and network guarantee of the mobile communication virtualized network equipment, especially during the operation and upgrade of the virtualized equipment.
  • the in-depth analysis of event data is carried out through the vertical dimension of virtual devices, the horizontal dimension between network elements, and the dimension analysis of debugging data within network elements. In-depth analysis is very important for the intelligent operation and maintenance of network equipment. Locating the root cause of faults is also an urgent tool for operators' operation and maintenance and fault solvers.
  • One aspect of the present disclosure provides a method for analyzing network function virtualization (Network Function Virtualization, NFV) device operating data, the analysis method comprising: a log data collection step of acquiring log data generated by the NFV device; The log data is calculated by using the expert database model and clustering rules, and the definition of the preprocessing model is adopted for the virtual layer log data and the physical layer log data to standardize the log data.
  • NFV Network Function Virtualization
  • the log data cleaning step according to the keywords defined in the cluster rules
  • the frequent itemset analysis step Compare the association model rules in the library to identify valuable fault association rules and store the identified valuable fault association rules in the expert database. With the rete algorithm and the actual resource topology relationship, the application layer log data and the virtual layer log data are quickly associated to obtain root cause rules, so as to detect the log data of the root cause of the abnormal fault through the log data. Quick matching step.
  • Another aspect of the present disclosure provides an apparatus for analyzing operating data of an NFV device, the analyzing apparatus comprising: a log data acquisition module configured to acquire log data generated by the NFV device; a data analysis module configured to Cleaning the log data, standardizing the log data and performing cluster analysis, generating first-level association rules, performing frequent itemset analysis, generating second-level association rules, and identifying valuable fault association rules; fast matching
  • the module is configured to quickly associate the application layer log data with the virtual layer log data according to the fault association rule, using the drools rule engine and the rete algorithm, and the actual resource topology relationship to obtain the root cause rule.
  • FIG. 1 is an architectural diagram of a method for analyzing NFV device operation data according to an embodiment of the present disclosure
  • FIG. 2 is a flowchart of a method for analyzing NFV device operation data according to an embodiment of the present disclosure
  • FIG. 3 is a schematic diagram of cluster analysis according to an embodiment of the present disclosure.
  • FIG. 5 is a diagram of a fast matching algorithm according to an embodiment of the present disclosure.
  • FIG. 6 is a structural block diagram of an apparatus for analyzing operating data of an NFV device according to an embodiment of the present disclosure.
  • the terms “installed”, “connected” and “connected” should be understood in a broad sense, unless otherwise expressly specified and limited, for example, it may be a fixed connection or a detachable connection Connection, or integral connection; can be mechanical connection, can also be electrical connection; can be directly connected, can also be indirectly connected through an intermediate medium, can be internal communication between two elements.
  • installed should be understood in a broad sense, unless otherwise expressly specified and limited, for example, it may be a fixed connection or a detachable connection Connection, or integral connection; can be mechanical connection, can also be electrical connection; can be directly connected, can also be indirectly connected through an intermediate medium, can be internal communication between two elements.
  • the method for analyzing NFV device operation data includes steps S1 to S6.
  • step S1 log data is collected.
  • step S1 includes: acquiring log data generated by an NFV device, where the log data includes application layer (application server) log data, virtual layer (virtual machine/host) log data, physical layer server/switch/ router/firewall) log data, etc., and supports multiple log data formats.
  • application layer application server
  • virtual layer virtual machine/host
  • physical layer server/switch/ router/firewall physical layer server/switch/ router/firewall
  • NFV devices for example, virtualized network elements, cloud computing platforms, and virtualized management network elements as shown in Figure 1
  • the collection device generates internal statistics files after receiving the log data and stores them in the directory.
  • the cleaning component pulls the log data to clean the log data.
  • the storage method according to the embodiment of the present disclosure is as follows: the data generated by the business in real time is stored as service instances, and each instance generates a file, wherein the actual operation data of the service instance is described in the file.
  • the system will compress the data of multiple service instances into the same compressed package according to the collection granularity, and parse the above files by matching the format defined by the parsing model file, so that the correct analysis can be obtained. data. Through this analysis step, information such as service instance and module instance to which each file in the compressed package belongs can be obtained.
  • step S2 cleaning of log data is performed.
  • step S2 includes: using an expert database model and clustering rule calculation for application layer log data, and using a preprocessing model definition for virtual layer log data and physical layer log data to standardize log data. Different log data has different cleaning methods.
  • the method for cleaning application layer log data includes steps S211 and S212.
  • step S211 the log data is first processed using the expert database model calculation formula to obtain a business model, where the business model includes keyword and rule data.
  • the expert database model is a pre-established standard model, including rule name, rule description, rule data, summary instance and parameter features of file labels.
  • the preprocessing calculation result as a kind of data, needs to be calculated according to the expert database model (see Figure 3 Step0).
  • Table 1 provides several examples of the calculation formula of the expert database model.
  • the calculation formula of the expert database model is the rule data rather than the conditions, and the calculation data is cleaned from the original data through the rules in the patent database model.
  • step S212 an action table is generated from the rule data, and when the calculated rule data satisfies a condition set by an action, the action can be triggered.
  • the rule data will be used as rules to obtain cluster rules.
  • Table 2 shows examples of several trigger conditions in the application layer
  • the Rule value of granularity, and so on, can be;
  • Actions can be defined as:
  • this Rule data will be used as a rule, which is the same as the rules for generating log data, the difference is that it can be used as a rule only after the "Generation Rule" is specified.
  • the “continuous”/"failure rate"/"decline” in the description of the log data is the keyword information to be filled during cluster cleaning.
  • the method for cleaning virtual layer log data and physical layer log data is: extracting cluster rules through a preprocessing model from key information of the virtual layer log data and the operation log information of the physical layer log data.
  • the preprocessing model is the regular expression matching mode.
  • Table 3 lists an example of how regular expressions are matched:
  • step S3 first-level association rules are generated through cluster analysis.
  • step S3 includes: the core step of the analysis system, as shown in STEP2 in FIG. 3, according to the keyword information defined in the cluster rule, analyze the application layer log data, virtual layer log data, physical layer log data Cluster analysis is performed to form first-level association rules of cluster labels (eg, failure rate/address/message, etc.), that is, cluster rules.
  • cluster labels eg, failure rate/address/message, etc.
  • Table 4 lists examples of several clustering rules.
  • Cluster Rule ID Cluster Rule Description associated clusters The number of occurrences cRule1 failure rate*address assignment*failure*port C1000, C0010, C0020 M times cRule2 failure rate *message sending *failure* port C1000, C0010, C0030 N times
  • 1Cluster rule identification uniquely identifies this rule and is globally unique
  • 2Cluster rule description describes the function of this cluster, which belongs to auxiliary information
  • clustering rules In general, we want the clustering rules to be tree-like. As shown in Figure 3, a rule must belong to one or more levels. By specifying the type and number of clusters, the key attributes are described according to the rules. Process the hierarchical clustering algorithm.
  • clusters are generated by nesting of clusters, and in order to avoid mutual reference, some analysis constraints can also be set to effectively limit.
  • the original data can be converted into regular data that can be recognized by the analysis system.
  • step S4 frequent itemset analysis is performed to generate secondary association rules.
  • step S4 includes: the core step of the analysis system uses the FP-tree frequent itemset algorithm to perform deep rule mining on the thing data set in the cluster rules formed by the clustering in step S3, thereby generating secondary association rules (For example, computing/CPU/memory/network/storage, etc.), that is, frequent itemset rules.
  • secondary association rules For example, computing/CPU/memory/network/storage, etc.
  • step S4 the transaction data set of the cluster rule formed in step S3 is mined by the FP-tree frequent itemset algorithm in the analysis system (see FIG. 4), and the transaction data set is a set of related transactions in the cluster rule.
  • the step of mining the transaction data set includes: by scanning the transaction data set twice, the frequent items included in each transaction are compressed and stored in the FP-Tree in descending order of their support degrees.
  • Frequent patterns can be directly generated by recursively calling the FP-Growth algorithm, so there is no need to generate candidate patterns in the whole discovery process.
  • the FP-Growth algorithm overcomes the problems existing in the Apriori algorithm and is significantly better than the Apriori algorithm in terms of execution efficiency.
  • this step is based on the basic steps of cluster analysis, so the mining accuracy and effectiveness of association rules will be significantly improved, avoiding the mining of invalid association data, and further improving the mining efficiency.
  • step S4 includes steps S11 to S13.
  • step S11 an item header table is created.
  • step S11 includes: by scanning the transaction data set of the cluster rule formed in S3, finding and sorting the item header table with the support degree > the set threshold, and obtaining the sorted log data set.
  • step S12 an FP-tree is established.
  • step S12 includes: scanning the item header table and the sorted log data set, and inserting all the scanned item headers and log data sets into the nodes of the cluster rule, thereby building an FP-Tree.
  • each FP-Tree is established on the last established FP-Tree. Therefore, when scanning the item header table and the sorted log data set, it is found that a new node appears, then the item The node corresponding to the header table will be linked to the new node until all data is inserted, and the establishment of the FP-Tree is completed.
  • step S13 the FP-tree is mined.
  • step S13 includes: based on the FP-Tree, the item header table and the node linked list, dig upwards in order from the bottom item of the item header table, and find the node corresponding to the FP-Tree in the item header table, and then find the Conditional pattern base, recursive mining based on conditional pattern base, can get frequent itemset rules.
  • step S5 rule storage is performed.
  • the result of the association rule of the frequent itemset analysis that is, the frequent itemset rules
  • the association model rules in the expert database that is, the frequent itemset rules
  • the frequent itemsets generated by the secondary association are compared with the association rules provided by the expert database according to the similarity, and after the differences are listed according to the comparison results, the rules are confirmed manually; The confirmed rules are stored in the database and used as the rule database associated with the log data for the next step.
  • step S6 fast matching of log data is performed.
  • step S6 includes: according to the fault association rule formed in step S5, using the drools rule engine and the rete algorithm, and the actual resource topology relationship, quickly associate the application layer log data with the virtual layer log data, Get root cause rules.
  • the root cause rule Root Rule1 is associated with rules Rule16 and cRule1, so as to detect the root cause of abnormal faults through log data.
  • the RETE algorithm is a forward rule fast matching algorithm.
  • the RETE algorithm performs pattern matching by forming a rete network, and utilizes the time redundancy and structural similarity features of the rule-based system, thereby improving the system pattern matching efficiency, and finally.
  • the problem in effect is the root cause.
  • the processed log data is called log working memory, and the association rules used for judgment are divided into two parts, LHS (left-hand-side) and RHS (right hand side), which represent the premise and conclusion respectively.
  • the main flow of the RETE algorithm includes steps 1 to step 4.
  • step 1 matching is performed to find out the log working memory set that conforms to the LHS part.
  • step 2 conflicts are eliminated to select a rule whose condition is satisfied.
  • step 3 the contents of the RHS are executed.
  • step 4 return to step 1, thereby repeating the cycle of execution from step 1 to step 4.
  • step S7 a fault warning is performed.
  • step S7 includes: before the failure occurs, according to the requirements of real-time detection, performing real-time analysis and early warning on the equipment failure.
  • step S8 fault tracing is performed.
  • step S8 includes: after the fault occurs, for the fault that has occurred (from equipment monitoring), reverse mining the historical log data to form the traceability of the abnormal fault problem.
  • the apparatus for analyzing the operation data of NFV equipment includes a log data collection module 1 , a data analysis module 2 , a fast matching module 3 , an early warning module 4 and a fault tracking module 5 .
  • the log data collection module 1 acquires log data generated by the NFV device.
  • the data analysis module 2 cleans the acquired log data, standardizes the log data, performs cluster analysis, generates first-level association rules, performs frequent itemset analysis, generates second-level association rules, and identifies valuable fault association rules .
  • the fast matching module 3 uses the drools rule engine and the rete algorithm, as well as the actual resource topology relationship, to quickly associate the application layer log data with the virtual layer log data according to the fault association rules, and obtain the root cause rules.
  • the data analysis module 2 includes a data cleaning sub-module 21 , a model training sub-module 22 and a verification sub-module 23 .
  • the data cleaning sub-module 21 is used to clean the acquired log data and standardize the log data.
  • the model training submodule 22 is used to perform cluster analysis on log data, generate first-level association rules, and perform frequent itemset analysis to generate second-level association rules.
  • the verification sub-module 23 is used to verify the accuracy of the frequent itemset rules generated by the secondary association, and identify valuable fault association rules.
  • the analysis device further includes an early warning module 4 .
  • the early warning module 4 is used for real-time analysis and early warning of equipment failures according to the requirements of real-time detection.
  • the analysis device further includes a fault tracking 5 .
  • the fault tracking module 5 is used to reversely mine historical log data for faults that have occurred to trace the source of abnormal faults.
  • the present disclosure collects operational data in real time for NFV network elements and devices of the cloud platform. First, the collected operational data is calculated and converted into log data to be analyzed, which reduces the amount of log data recorded by the device and caused by reporting a large amount of log data. shock.
  • the multi-dimensional data of complex structure is aggregated by the method of cluster analysis to standardize the complex structure data.
  • the dependency relationship between the data is found, and the cluster analysis method is continued to remove or merge the data with the close dependency relationship.
  • the present disclosure uses the matching rule engine to quickly and accurately associate and match log data according to the association rule relationship, so as to achieve the purpose of tracing the root cause of the fault.
  • the present disclosure solves the common difficulty of fault location in virtualization scenarios by mining, analyzing and correlating log data rules, and brings the following benefits:
  • the analysis method and the analysis device of the present disclosure greatly reduce the communication cost, and effectively improve the efficiency of cooperating with various departments to deal with problems.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Evolutionary Biology (AREA)
  • Evolutionary Computation (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Artificial Intelligence (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Quality & Reliability (AREA)
  • Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • Mathematical Physics (AREA)
  • Databases & Information Systems (AREA)
  • Debugging And Monitoring (AREA)

Abstract

本公开涉及一种网络功能虚拟化(NFV)设备运行数据的分析方法及分析装置。该分析方法包括：日志数据采集步骤、日志数据清洗步骤、聚类分析步骤、频繁项集分析步骤、规则入库步骤和日志数据的快速匹配步骤。

Description

一种网络功能虚拟化设备运行数据的分析方法及装置 技术领域
本公开涉及虚拟化技术领域。
背景技术
云化分层解耦带来了更多的设备组件以及海量事件数据，因此给故障定界定位带来了较大的困难，如：从APP应用层/平台层到虚拟层/物理层等，故障定位周期长。因此需要实现自动化快速定界故障所发生的层次，故障定界定位对于移动通信虚拟化网络设备的正常运行、网络保障具有重大的意义，尤其是在虚拟化设备运行、升级期间，通过对网络设备事件数据的深度分析，通过虚拟设备的垂直维度、网元之间的水平维度以及网元内部调试数据的维度分析。深度分析对网络设备智能化运维保障十分重要，定位故障发生的根源是也是运营商运维、故障解决人员迫切需要利器。
发明内容
本公开的一方面提供了一种网络功能虚拟化(Network Function Virtualization，NFV)设备运行数据的分析方法，该分析方法包括：获取所述NFV设备产生的日志数据的日志数据采集步骤；针对应用层日志数据采用专家库模型和聚类规则计算、针对虚拟层日志数据和物理层日志数据采用预处理模型的定义来将所述日志数据进行标准化的日志数据清洗步骤；根据簇规则中定义的关键字信息对应用层日志数据、虚拟层日志数据、物理层日志数据进行聚类分析从而形成聚类标签的作为一级关联规则的簇规则的聚类分析步骤；采用FP-tree频繁项集算法对所述聚类分析步骤中聚类形成的簇规则中的事物数据集进行深度规则挖掘从而生成作为二级关联规则的频繁项集规则的频繁项集分析步骤；通过将所述频繁项集规则与专家库中的关联模型规则进行比对来识别出有价值的故障关联规则并将识别出的有价值的故障关联规则持久化存储于专家库中的规则入库步骤；依据故障 关联规则利用drools规则引擎和rete算法以及实际的资源拓扑关系，将应用层日志数据与虚拟层日志数据进行快速关联以获得根因规则，从而通过所述日志数据检测出异常故障的根源的日志数据的快速匹配步骤。
本公开的另一方面提供了一种NFV设备运行数据的分析装置，该分析装置包括：日志数据采集模块，其被配置为获取所述NFV设备产生的日志数据；数据分析模块，其被配置为对所述日志数据进行清洗，将所述日志数据标准化并进行聚类分析，生成一级关联规则，进行频繁项集分析，生成二级关联规则，并识别出有价值的故障关联规则；快速匹配模块，其被配置为用于依据故障关联规则，利用drools规则引擎和rete算法，以及实际的资源拓扑关系，将应用层日志数据与虚拟层日志数据进行快速关联，获得根因规则。
附图说明
图1是根据本公开的实施例的NFV设备运行数据的分析方法的架构图；
图2是根据本公开的实施例的NFV设备运行数据的分析方法的流程图；
图3是根据本公开的实施例的聚类分析的示意图；
图4是根据本公开的实施例的规则频繁项集挖掘示意图；
图5是根据本公开的实施例的快速匹配算法图；以及
图6是根据本公开的实施例的NFV设备运行数据的分析装置的结构框图。
具体实施方式
下面将结合附图对本公开的技术方案进行清楚、完整地描述，显然，所描述的实施例是本公开一部分实施例，而不是全部的实施例。基于本公开中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本公开保护的范围。
在本公开的描述中，需要说明的是，术语“中心”、“上”、“下”、“左”、“右”、“竖直”、“水平”、“内”、“外”等指示的方位或位置关系为基于附图所示的方位或位置关系，仅是为了便于描述本公开和简化描述，而不是指示或暗示所指的装置或元件必须具有特定的方位、以特定的方位构造和操作，因此不能理解为对本公开的限制。此外，术语“第一”、“第二”、“第三”仅用于描述目的，而不能理解为指示或暗示相对重要性。
在本公开的描述中，需要说明的是，除非另有明确的规定和限定，术语“安装”、“相连”、“连接”应做广义理解，例如，可以是固定连接，也可以是可拆卸连接，或一体地连接；可以是机械连接，也可以是电连接；可以是直接相连，也可以通过中间媒介间接相连，可以是两个元件内部的连通。对于本领域的普通技术人员而言，可以具体情况理解上述术语在本公开中的具体含义。
以下结合图1至图5对本公开进行进一步详细的叙述。
根据本公开的实施例的NFV设备运行数据的分析方法包括步骤S1至S6。
在步骤S1，进行日志数据的采集。根据本公开的实施例，步骤S1包括：获取NFV设备产生的日志数据，所述日志数据包括应用层(应用服务器)日志数据、虚拟层(虚拟机/主机)日志数据，物理层服务器/交换机/路由器/防火墙)日志数据等等，并支持多种日志数据格式。
NFV设备(例如，如图1所示的虚拟化网元、云计算平台、虚拟化管理网元等)实时产生日志数据并上报，采集装置在接收日志数据后生成内部统计文件并存储在目录下，后续由清洗组件拉取日志数据进行日志数据的清洗。根据本公开的实施例的存储方式为：将业务实时生成的数据按服务实例存储，每个实例各自生成一个文件，所述文件中描述了所述服务实例的实际运行数据。在实际的应用中，为了节省存储空间，系统会按照采集粒度将多个服务实例的数据压缩到同一个压缩包中，并通过解析模型文件定义的格式匹配解析以上文件，以便分析获取到正确的数据。通过该分析步骤，能够得到此压缩包中每 个文件归属的服务实例、模块实例等信息。
在步骤S2，进行日志数据的清洗。根据本公开的实施例，步骤S2包括：针对应用层日志数据采用专家库模型和聚类规则计算、针对虚拟层日志数据和物理层日志数据采用预处理模型的定义，来将日志数据进行标准化。日志数据不同，其清洗方法也不同。
根据本公开的实施例的应用层日志数据的清洗方法包括步骤S211和S212。
在步骤S211，首先采用专家库模型计算公式处理日志数据以获得业务模型，所述业务模型包括关键字及规则数据。
所述专家库模型是事先建立好的一种标准模型，包括规则名、规则描述、规则数据，汇总实例及文件标签的参数特征。
预处理计算结果，作为一种数据，是需要根据专家库模型计算得到的，(见图3Step0)，表1中给出了专家库模型计算公式的几个示例。
表1
Figure PCTCN2021124662-appb-000001
经专家库模型计算公式计算得到的是规则数据而非条件，通过专利库模型中的各规则从原始数据中清洗出计算数据。
在步骤S212，将规则数据生成动作表，当计算出的规则数据满足一个动作设定的条件后，即可触发该动作。规则数据将作为规则使用，从而获得簇规则。
表2示出了应用层中几种触发条件的示例，
表2
Figure PCTCN2021124662-appb-000002
Figure PCTCN2021124662-appb-000003
在簇规则的触发条件中，“${N}”符号代表了某个粒度的Rule的值，如图3中Step1，其中N＝0时表示当前粒度的Rule值，N＝1时表示前一个粒度的Rule值，依此类推,即可；
动作可以定义为：
①触发问题：当满足一定条件后，触发关联的问题，此功能主要用于触发分析系统自动分析问题；
②生成规则：满足条件后，此Rule数据将作为规则使用，与通常的日志数据生成的规则一样，不同的是只有明确“生成规则”后，才能作为规则使用。
日志数据描述中的“连续”/“失败率”/“下降”等为聚类清洗时候填补的关键字信息。
根据本公开的实施例，虚拟层日志数据和物理层日志数据的清洗方法为：从虚拟层日志数据和物理层日志数据的运行日志信息的关键信息中，通过预处理模型提取出簇规则。所述预处理模型即正则表达匹配方式。
表3列出了正则表达匹配方式的一个示例：
表3
对象 触发条件 动作 描述 簇规则描述
云平台 日志数据关键字：端口, 生成簇规则 **端口*异常** C1000
  异常      
在步骤S3，通过聚类分析生成一级关联规则。根据本公开的实施例，步骤S3包括：分析系统的核心步骤,如图3中STEP2所示，根据簇规则中定义的关键字信息，对应用层日志数据、虚拟层日志数据、物理层日志数据进行聚类分析，形成聚类标签(例如，失败率/地址/消息等)的一级关联规则，即簇规则。
表4列出了几种簇规则的示例。
表4
簇规则标识 簇规则描述 关联的簇 出现次数
cRule1 失败率*地址分配*失败*端口 C1000,C0010,C0020 M次
cRule2 失败率*消息发送*失败*端口 C1000,C0010,C0030 N次
簇规则说明：
①簇规则标识：唯一标识了此规则，全局唯一；
②簇规则描述：描述了此簇的功能，属于辅助信息；
③关联的簇：与本簇关联的下级规则，可以关联多个，多个规则之间通过逗号分隔，此表描述了规则之间的上下级关系(没有明确规则的上下级关系，所以需要保证不能存在相互引用的场景，例如A规则关联了B规则，B规则又关联了A规则，这样会无穷无尽)。为了避免簇规则关联过程中相互引用，还需在分析系统中对所述簇规则的显示层数进行限定，可以限定所述簇规则在分析系统中的显示层数小于等于N，N为正整数，即N≥1。例如N＝5表示分析系统限制所述簇规则最多显示层数为5层，这样即使递归也不会引发灾难性后果。
一般情况下我们希望聚类的规则是树状的，如图3所示，一个规则一定是归属在某一个或多个层级上，通过指定聚类的簇种类和数量，按照规则的描述关键属性进行层次聚类算法的处理。
此外簇与簇之间通过聚类的嵌套生成，同时为了避免相互引用，也可以设置一些分析约束条件进行了有效的限制。
通过该聚类分析步骤就可以将原始数据转换成分析系统所能识别的规则数据。
在步骤S4，进行频繁项集分析，以生成二次关联规则。根据本公开的实施，步骤S4包括：分析系统的核心步骤采用FP-tree频繁项集算法对在步骤S3中聚类形成的簇规则中的事物数据集进行深度规则挖掘，从而生成二级关联规则(例如，计算/CPU/内存/网络/存储等)，即频繁项集规则。
该步骤S4在分析系统中通过FP-tree频繁项集算法挖掘步骤S3形成的簇规则的事务数据集(见图4)，所述事物数据集为簇规则中所关联的事务的集合。
根据本公开的实施例，挖掘事物数据集的步骤包括：通过两次扫描事务数据集，把每个事务所包含的频繁项目按其支持度降序压缩存储到FP-Tree中。在之后发现频繁模式的过程中，不需要再扫描事务数据集，而仅在FP-Tree中进行查找即可。通过递归调用FP-Growth算法可直接产生频繁模式，因此在整个发现过程中也不需产生候选模式。因为只对数据集扫描两次，因此FP-Growth算法克服了Apriori算法中存在的问题，在执行效率上也明显好于Apriori算法。同时该步骤是建立在聚类分析的基础步骤上，因此对关联规则的挖掘准确性和有效性会有明显的提高，避免无效关联数据的挖掘，同时进一步提升了挖掘效率。
根据本公开的实施例，步骤S4包括步骤S11至S13。
在步骤S11，建立项头表。根据本公开的实施例，步骤S11包括：通过扫描S3中形成的簇规则的事务数据集，找到支持度>设定阈值的项头表并排序，获得排序后的日志数据集。
在步骤S12，建立FP-tree。根据本公开的实施例，步骤S12包括：扫描项头表和排序后的日志数据集，将扫描到的所有的项表头和日志数据集插入簇规则的节点，从而建成FP-Tree。由于实际操作时，FP-Tree每次建立均是在上一次建立的FP-Tree上进行的，因此，当扫描项头表和排序后的日志数据集时，发现有新结点出现，则项头表对应的节点会链接上新结点，直到所有的数据都插入后，FP-Tree的建立完成。
在步骤S13，挖掘FP-tree。根据本公开的实施例，步骤S13包 括：基于FP-Tree、项头表及结点链表，从项头表的底部项依次向上挖掘，找到项头表对应于FP-Tree的节点，即可找到条件模式基，基于条件模式基进行递归挖掘，即可得到频繁项集规则。
在步骤S5，进行规则入库。根据本公开的实施例，在步骤S5，将频繁项集分析的关联规则结果(即频繁项集规则)与专家库中的关联模型规则进行比对，最终识别有价值的故障关联规则，并持久化存储。
将二次关联生成的频繁项集规则收入专家库前，需要验证二次关联生成的频繁项集规则的准确性。根据本公开的实施例，将二次关联生成的频繁项集与专家库提供的关联规则按照相似度进行比对，根据比对的结果列出差异后，由人工进行规则确认；对于匹配成功或确认的规则入库保存，作为日志数据关联的规则库，提供下一步的使用。
在步骤S6，进行日志数据的快速匹配。根据本公开的实施例，步骤S6包括：依据在步骤S5形成的故障关联规则，利用drools规则引擎和rete算法，以及实际的资源拓扑关系，将应用层日志数据与虚拟层日志数据进行快速关联，获得根因规则。如图5所示，根因规则Root Rule1关联有规则Rule16和cRule1,从而通过日志数据检测出异常故障的根源。
如图5所示，对分析结果来说，最关心的是故障发生的问题的原因，可以通过RETE算法进行快速匹配来确定故障发生的问题的原因。所述RETE算法是一种前向规则快速匹配算法，该RETE算法通过形成一个rete网络进行模式匹配，利用基于规则的系统的时间冗余性和结构相似性特征，从而提高系统模式匹配效率，最终生效的问题即根本原因。
在一个产生式系统中，被处理的日志数据叫做log working memory，用于判定的关联规则分为两个部分LHS(left-hand-side)和RHS(right hand side)，分别表示前提和结论。
所述RETE算法的主要流程包括步骤①至步骤④。
在步骤①，进行匹配，以找出符合LHS部分的log working memory集合。
在步骤②，消除冲突，以选出一个条件被满足的规则。
在步骤③，执行RHS的内容。
在步骤④，返回步骤①,从而重复循环执行步骤①至步骤④。
在步骤S7，进行故障警示。根据本公开的实施例，步骤S7包括：在故障发生前，根据实时检测的要求，对设备故障进行实时分析和预警。
在步骤S8，进行故障追踪。根据本公开的实施例，步骤S8包括：在故障发生后，对于已经发生的故障(来源于设备监控)，反向的挖掘历史日志数据，形成对异常故障问题的溯源。
下面将参照图6描述根据本公开的实施例的NFV设备运行数据的分析装置。
如图6所示，根据本公开的实施的NFV设备运行数据的分析装置包括日志数据采集模块1、数据分析模块2、快速匹配模块3、预警模块4和故障追踪模块5。
日志数据采集模块1获取NFV设备产生的日志数据。
数据分析模块2对获取的日志数据进行清洗，将日志数据标准化，并进行聚类分析，生成一级关联规则，进行频繁项集分析，生成二级关联规则，并识别出有价值的故障关联规则。
快速匹配模块3依据故障关联规则，利用drools规则引擎和rete算法，以及实际的资源拓扑关系，将应用层日志数据与虚拟层日志数据进行快速关联，获得根因规则。
根据本公开的实施例，所述数据分析模块2包括数据清洗子模块21、模型训练子模块22和验证子模块23。
数据清洗子模块21用于对获取的日志数据进行清洗，将日志数据标准化。
模型训练子模块22用于对日志数据进行聚类分析，生成一级关联规则，并进行频繁项集分析，生成二级关联规则。
验证子模块23用于验证二次关联生成的频繁项集规则的准确性，识别出有价值的故障关联规则。
根据本公开的实施例，所述分析装置还包括预警模块4。预警模 块4用于根据实时检测的要求，对设备故障进行实时分析和预警。
根据本公开的实施例，所述分析装置还包括故障追踪5。故障追踪模块5用于对于已经发生的故障，反向的挖掘历史日志数据，形成对异常故障问题的溯源。
本公开的有益效果在于：
1、本公开对NFV网元和云平台的设备实时采集运行数据，首先将采集的运行数据计算并转换为待分析的日志数据，降低了设备的记录大量日志数据以及上报大量日志数据带来的冲击。
2、本公开通过聚类分析在对日志数据预处理过程中，对于复杂结构的多维数据通过聚类分析的方法对原始数据进行聚集，使复杂结构数据标准化。
3、本公开中发现数据之间的依赖关系，继续采用聚类分析法，从而去除或合并有密切依赖关系的数据。为下一步的日志数据关联规则的挖掘提供可靠的数据；在日志数据关联规则二次的深度挖掘中采用频繁项集的方法，可以发现日志数据之间的关联规则，进而帮助决策树的形成；将形成的决策树与专家库进行比对分析，最终形成高效、准确的关联规则关系。
4、本公开通过匹配规则引擎，依据关联规则关系快速，准确地对日志数据进行关联匹配，达到追溯故障的根源的目的
5、本公开通过对日志数据规则的挖掘分析与关联处理，解决了虚拟化场景下故障定位普遍存在的难点，带来了以下的收益：
(1)、通过分析NFV设备内实时产生的日志数据可以即时了解当前NFV设备的运行实际情况，从而及时发现故障隐患，可以及时采取闭环措施的建议，达到预警/避免重大问题的发生。
(2)、当系统发生故障时，可以通过分析发生问题时所产生日志数据，根据其中的关联关系，快速的进行故障定界定位；同时通过回溯NFV设备的问题的根源并确定故障的范围及可能原因，方便故障人员的分析以及进一步的深层次挖掘分析NFV设备故障的状况。
(3)、通过智能的分析处理算法和机器学习方法，有效的避免了无效日志数据的占用、消耗系统处理资源，以及重要日志数据漏处 理的场景。
(4)、通过精准的问题定位，避免让运维产生困扰，影响故障的实际处理效率。快速的识别根因问题，避免了多系统频繁派单的无效处理，有效的降低了运营商的维护运营成本。
(5)、在NFV设备内跨层、NFV设备之间产生故障时，如果按照人工维护方式，需协调多部门，多地的合作分析定界定位。本公开的分析方法和分析装置使得沟通成本大幅减少，有效的提高了协同各部门之间处理问题的效率。
以上所述实施方式仅为了示出和描述本公开，而不意图对本公开进行限制。对于本领域一般技术人员而言，在不背离本公开原理和精神的前提下对其所作出的任何显而易见的改动，都应当被认为包含在本公开的权利要求保护范围之内。

Claims (10)

  1. 一种网络功能虚拟化(NFV)设备运行数据的分析方法，包括：
    获取所述NFV设备产生的日志数据的日志数据采集步骤；
    针对应用层日志数据采用专家库模型和聚类规则计算、针对虚拟层日志数据和物理层日志数据采用预处理模型的定义，来将所述日志数据进行标准化的日志数据清洗步骤；
    根据簇规则中定义的关键字信息对所述应用层日志数据、所述虚拟层日志数据、所述物理层日志数据进行聚类分析从而形成聚类标签的作为一级关联规则的簇规则的聚类分析步骤；
    采用FP-tree频繁项集算法对所述聚类分析步骤中聚类形成的所述簇规则中的事物数据集进行深度规则挖掘从而生成作为二级关联规则的频繁项集规则的频繁项集分析步骤；
    通过将所述频繁项集规则与专家库中的关联模型规则进行比对来识别出有价值的故障关联规则并将识别出的有价值的故障关联规则持久化存储于专家库中的规则入库步骤；
    依据故障关联规则利用drools规则引擎和rete算法以及实际的资源拓扑关系，将所述应用层日志数据与所述虚拟层日志数据进行快速关联以获得根因规则，从而通过所述日志数据检测出异常故障的根源的日志数据的快速匹配步骤。
  2. 根据权利要求1所述的NFV设备运行数据的分析方法，还包括：
    在故障发生前，根据实时检测的要求，对设备故障进行实时分析和预警的故障警示步骤。
  3. 根据权利要求1或2所述的NFV设备运行数据的分析方法，还包括：
    在故障发生后，对于已经发生的故障，反向的挖掘历史日志数 据，形成对异常故障问题的溯源的故障追踪步骤。
  4. 根据权利要求1所述的NFV设备运行数据的分析方法，其中，所述日志数据采集步骤中的所述日志数据包括所述应用层日志数据、所述虚拟层日志数据和所述物理层日志数据。
  5. 根据权利要求1所述的NFV设备运行数据的分析方法，其中，所述聚类分析步骤包括在分析系统中对所述簇规则的显示层数进行限定。
  6. 根据权利要求1所述的NFV设备运行数据的分析方法，其中，所述频繁项集分析步骤包括：
    通过扫描所述聚类分析步骤中形成的所述簇规则的事务数据集，找到支持度大于设定阈值的项头表并排序，从而获得排序后的日志数据集的建立项头表的步骤；
    扫描所述项头表和所述排序后的日志数据集，将扫描到的所有的项表头和日志数据集插入所述簇规则的节点，从而建成FP-Tree的建立FP-Tree的步骤；
    基于所述FP-Tree、所述项头表及结点链表，从所述项头表的底部项依次向上挖掘，找到所述项头表对应于所述FP-Tree的节点，从而找到条件模式基，并基于所述条件模式基进行递归挖掘以得到所述频繁项集规则的挖掘FP-Tree步骤。
  7. 一种NFV设备运行数据的分析装置，包括：
    日志数据采集模块，其被配置为获取所述NFV设备产生的日志数据；
    数据分析模块，其被配置为对所述日志数据进行清洗，将所述日志数据标准化并进行聚类分析，生成一级关联规则，进行频繁项集分析，生成二级关联规则，并识别出有价值的故障关联规则；
    快速匹配模块，其被配置为用于依据故障关联规则，利用drools 规则引擎和rete算法，以及实际的资源拓扑关系，将应用层日志数据与虚拟层日志数据进行快速关联，获得根因规则。
  8. 根据权利要求7所述的NFV设备运行数据的分析装置，其中，所述数据分析模块包括：
    数据清洗子模块，其被配置为对所述日志数据进行清洗，将所述日志数据标准化，
    模型训练子模块，其被配置为对所述日志数据进行聚类分析，生成作为所述一级关联规则的簇规则，对所述簇规则进行频繁项集分析，生成作为所述二级关联规则的频繁项集规则；
    验证子模块，其被配置为验证所述频繁项集规则的准确性，以识别出有价值的故障关联规则。
  9. 根据权利要求7所述的NFV设备运行数据的分析装置，还包括预警模块，其被配置为根据实时检测的要求，对设备故障进行实时分析和预警。
  10. 根据权利要求7所述的NFV设备运行数据的分析装置，还包括故障追踪，其被配置为对于已经发生的故障，反向的挖掘历史日志数据，形成对异常故障问题的溯源。
PCT/CN2021/124662 2020-10-22 2021-10-19 一种网络功能虚拟化设备运行数据的分析方法及装置 WO2022083576A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011137873.9 2020-10-22
CN202011137873.9A CN114385391A (zh) 2020-10-22 2020-10-22 一种nfv虚拟化设备运行数据分析方法及装置

Publications (1)

Publication Number Publication Date
WO2022083576A1 true WO2022083576A1 (zh) 2022-04-28

Family

ID=81193038

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/124662 WO2022083576A1 (zh) 2020-10-22 2021-10-19 一种网络功能虚拟化设备运行数据的分析方法及装置

Country Status (2)

Country Link
CN (1) CN114385391A (zh)
WO (1) WO2022083576A1 (zh)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114710368A (zh) * 2022-06-06 2022-07-05 杭州安恒信息技术股份有限公司 一种安全事件检测方法、装置及计算机可读存储介质
CN115497267A (zh) * 2022-09-06 2022-12-20 江西小手软件技术有限公司 基于时序关联规则的设备预警平台
CN115565596A (zh) * 2022-11-29 2023-01-03 中科亿海微电子科技（苏州）有限公司 一种对FinFET存储器故障的测试方法及装置
CN115934492A (zh) * 2023-01-09 2023-04-07 中兴系统技术有限公司 一种基于智能运维平台大数据的数据采集方法
CN116074127A (zh) * 2023-04-03 2023-05-05 成都工业职业技术学院 一种基于大数据的自适应网络安全态势评估模型
CN116155956A (zh) * 2023-04-18 2023-05-23 武汉森铂瑞科技有限公司 一种基于梯度决策树模型的多路复用通信方法及系统
CN117131110A (zh) * 2023-10-27 2023-11-28 南京中鑫智电科技有限公司 一种基于关联分析的容性设备介质损耗监测方法及系统

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117114116A (zh) * 2023-08-04 2023-11-24 北京杰成合力科技有限公司 一种基于机器学习的根因分析方法、介质和设备
CN117033947B (zh) * 2023-10-08 2023-12-22 国网四川省电力公司电力科学研究院 一种隐私保护的云边协同的频繁项目挖掘方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106130809A (zh) * 2016-09-07 2016-11-16 东南大学 一种基于日志分析的IaaS云平台网络故障定位方法及系统
CN111190876A (zh) * 2019-12-31 2020-05-22 天津浪淘科技股份有限公司 日志管理系统及其运行方法
CN111726248A (zh) * 2020-05-29 2020-09-29 北京宝兰德软件股份有限公司 一种告警根因定位方法及装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106130809A (zh) * 2016-09-07 2016-11-16 东南大学 一种基于日志分析的IaaS云平台网络故障定位方法及系统
CN111190876A (zh) * 2019-12-31 2020-05-22 天津浪淘科技股份有限公司 日志管理系统及其运行方法
CN111726248A (zh) * 2020-05-29 2020-09-29 北京宝兰德软件股份有限公司 一种告警根因定位方法及装置

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114710368A (zh) * 2022-06-06 2022-07-05 杭州安恒信息技术股份有限公司 一种安全事件检测方法、装置及计算机可读存储介质
CN114710368B (zh) * 2022-06-06 2022-09-02 杭州安恒信息技术股份有限公司 一种安全事件检测方法、装置及计算机可读存储介质
CN115497267A (zh) * 2022-09-06 2022-12-20 江西小手软件技术有限公司 基于时序关联规则的设备预警平台
CN115565596A (zh) * 2022-11-29 2023-01-03 中科亿海微电子科技（苏州）有限公司 一种对FinFET存储器故障的测试方法及装置
CN115934492A (zh) * 2023-01-09 2023-04-07 中兴系统技术有限公司 一种基于智能运维平台大数据的数据采集方法
CN116074127A (zh) * 2023-04-03 2023-05-05 成都工业职业技术学院 一种基于大数据的自适应网络安全态势评估模型
CN116074127B (zh) * 2023-04-03 2023-07-04 成都工业职业技术学院 一种基于大数据的自适应网络安全态势评估系统
CN116155956A (zh) * 2023-04-18 2023-05-23 武汉森铂瑞科技有限公司 一种基于梯度决策树模型的多路复用通信方法及系统
CN116155956B (zh) * 2023-04-18 2023-08-22 武汉森铂瑞科技有限公司 一种基于梯度决策树模型的多路复用通信方法及系统
CN117131110A (zh) * 2023-10-27 2023-11-28 南京中鑫智电科技有限公司 一种基于关联分析的容性设备介质损耗监测方法及系统
CN117131110B (zh) * 2023-10-27 2024-01-23 南京中鑫智电科技有限公司 一种基于关联分析的容性设备介质损耗监测方法及系统

Also Published As

Publication number Publication date
CN114385391A (zh) 2022-04-22

Similar Documents

Publication Publication Date Title
WO2022083576A1 (zh) 一种网络功能虚拟化设备运行数据的分析方法及装置
CN113723632B (zh) 一种基于知识图谱的工业设备故障诊断方法
CN111209131B (zh) 一种基于机器学习确定异构系统的故障的方法和系统
CN111984499B (zh) 一种大数据集群的故障检测方法和装置
WO2020001642A1 (zh) 一种运维系统及方法
JP4162250B2 (ja) 分散した部品木から故障部品の組み合わせを求める方法、システム
CN106209405B (zh) 故障诊断方法及装置
CN107171819A (zh) 一种网络故障诊断方法及装置
CN102117302B (zh) 传感器数据流复杂查询结果的数据起源跟踪方法
Fu et al. Digging deeper into cluster system logs for failure prediction and root cause diagnosis
CN115809183A (zh) 基于知识图谱的信创终端故障发现及处置的方法
CN112559237B (zh) 运维系统排障方法、装置、服务器和存储介质
CN114398442B (zh) 一种基于数据驱动的情报处理系统
CN104468193A (zh) 一种基于组件发现对业务系统进行监控的方法
Xie et al. Logm: Log analysis for multiple components of hadoop platform
CN110391936A (zh) 一种基于时序性告警的新型聚类算法
CN117331794A (zh) 基于大数据的应用软件监控分析系统及方法
CN116955469A (zh) 一种基于血缘分析的业务告警溯源方法
CN113485878B (zh) 一种多数据中心故障检测方法
LYU et al. Alarm-Based Root Cause Analysis Based on Weighted Fault Propagation Topology for Distributed Information Network
Anand et al. Anomaly Detection in Disaster Recovery: A Review, Current Trends and New Perspectives
Valletta CaseID Detection for Process Mining: A Heuristic-Based Methodology
Jubo et al. Application Analysis of Machine Learning in Intelligent Operation and Maintenance System
Reccia et al. CaseID detection for Process Mining: a heuristic-based methodology
Zhang et al. RiskRoot: Multi-Dimensional Root Causes Location Model Based on Risk Score and Iterative Search

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21881992

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 310823)

122 Ep: pct application non-entry in european phase

Ref document number: 21881992

Country of ref document: EP

Kind code of ref document: A1