JPH10200527A - Network service failure diagnosis method and apparatus - Google Patents

Abstract

(57) [Problem] To provide a network service failure diagnosis method and a device thereof that enable early investigation of a failure cause and reduce time required for recovery. SOLUTION: A facility information database 21 is searched based on a user name and a use service name of a user who has reported a failure, a facility model when the user uses the service is generated, and a design information database 22 is searched. Then, a communication sequence is generated when each service component constituting the equipment model fails, and each communication sequence is compared with observation information at the time of reporting a failure to estimate which communication sequence has occurred. To estimate the failed service component.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network service failure diagnosis method and apparatus for diagnosing a failure in response to a report from a user who uses a service via a network.

[0002]

2. Description of the Related Art Today's networks are constructed by intricately connecting a private network represented by a LAN and a public network or a dedicated network, which is a wide area network, in which users share equipment and the like. Services.

[0003] In such a network system, when a user uses a service, a plurality of facilities (including a terminal and an information source itself) such as a communication cable and a LAN board are arranged between the terminal and the information source. )
If a failure occurs in any of the following (hereinafter, referred to as a service component), the user cannot receive the service.

[0004] At this time, the user reports to the system maintenance person that the service cannot be received, but the contents of the report from the user are mostly fragmentary, and the method of handling by the maintenance person and each user Since the expressions for the same event differ depending on the type, they are not regarded as important, and are often treated only as notification of the occurrence of a failure. The maintenance staff has investigated the cause of the failure based on alarms and error messages mainly generated on the carrier (maintenance / management device of the network itself), various test results, and the like, and has taken measures.

[0005]

However, in such a failure diagnosis method mainly performed by the maintenance / management device for the network itself, there is a problem that it takes time to find out the cause of the failure and the time required for recovery from the failure becomes long. In addition, although it is possible to estimate which service component is faulty, among the users currently using the service via the network, the service component of the faulty service component There is a problem that it is difficult to determine whether or not it affects, and the determination becomes more difficult as the user's use form of the network becomes more complicated.

The present invention has been made in view of the above-mentioned conventional problems,
It is an object of the present invention to provide a network service failure diagnosis method and device capable of using a report content itself from a user as diagnostic information to enable early investigation of a failure cause and shortening a time required for recovery.

Further, the present invention makes it possible to estimate which service a failed service component will affect which service of which user, and to notify the user in advance of a service stop or the like. An object of the present invention is to provide a network service failure diagnosis method and a device thereof.

[0008]

According to the present invention, in order to solve the above-mentioned problems, a failure is declared in a network service failure diagnosis method for diagnosing a failure by receiving a report from a user who uses a service via a network. Based on the user name and the service name of the user, generating a facility model including a plurality of service components arranged between the terminal and the information source when the user uses the service, A step of generating a communication sequence when each service component has failed together with a communication sequence when all service components constituting the equipment model are normal, and the plurality of generated communication sequences and at the time of failure reporting. Compare with the observation information,
Estimating which communication sequence is occurring, and estimating a failed service component from the estimated communication sequence.

In a network service failure diagnosis apparatus for diagnosing a failure by receiving a report from a user who uses a service via a network, the network service failure diagnosis apparatus is arranged between a terminal and an information source when the user uses a service. Equipment information database that describes the roles of each of a plurality of service components, a design information database that describes the normal and failure operations of each service component, and the user name and service name of the user who declared the failure Means for searching the equipment information database based on the, and generating an equipment model consisting of a plurality of service components arranged between the terminal and the information source when the user uses the corresponding service, Search the design information database and find all service components that make up the equipment model Means for generating a communication sequence when each of the service components has failed together with a normal communication sequence, and comparing the generated plurality of communication sequences with the observation information at the time of the failure report to determine which communication sequence has occurred. Means for estimating whether or not the service component has failed, and estimating the service component that has failed.

According to the present invention, an equipment model up to an information source for providing a corresponding service is generated based on a user's failure report, and a communication sequence when each service component constituting the equipment model has failed is generated. Generates and compares these with the declared contents to estimate the occurring communication sequence and estimates the failed service component, so the failed service component can be estimated even if the user's declared content is not unique. This enables early investigation of the cause of the failure and shortens the time required for recovery.

At this time, the logical relationship between information such as alarms and error messages observed by the maintenance / management device of the network itself, alarms and error messages observed by terminals, and events is defined by a prescribed protocol. The use of the communication sequence generating means for generating the communication sequence expressed above makes it possible to more accurately estimate the failed service component.

Further, if a service component is used as a heading and a facility information database capable of retrieving the name of another user or the name of another service using the service component is used, the service component presumed to have failed can be identified. The user name and service name used can be searched.

Further, a user name and a use service name using the service component presumed to be faulty are searched from the facility information database, and another service of the user who has reported the fault or a service of another user is used. If it is included, by generating a facility model composed of a plurality of service components arranged between the terminal and the information source when the user uses the corresponding service, by generating a communication sequence at that time By estimating the event observed at the terminal of the user, it is possible to estimate which service the failed service component affects which user and which service, and notifies the user in advance of the service stop and the like. It is possible to do.

Furthermore, if the event of the user terminal estimated in another service of the user who has reported the failure or the service used by the other user matches the event of the user reporting the failure, the same service is provided. By presuming that the failure is caused by a component failure, it is possible to eliminate wastefulness of repeatedly diagnosing a failure caused by the same service component.

[0015]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS FIG. 1 is an apparatus configuration diagram showing an example of an embodiment of the present invention, in which 1 is an input device, 2 is a facility information database (DB) 21 and a design information database (DB). A storage device with 22; 3 a display device;
Is equipment model generation means 41, communication sequence generation means 4
2 and a processing device provided with a failure service component estimating means 43.

The facility information database 21 describes the role of each of a plurality of service components arranged between a terminal and an information source when a user uses a service. In addition, the facility information database 21 can search for another user name or another use service name using the one service component as a heading. The design information database 22 describes the normal operation and the failure operation of each service component.

The equipment model generating means 41 searches the equipment information database 21 on the basis of the user name of the user who has reported the failure and the name of the service used. , An equipment model including a plurality of service components arranged between the two is generated. In addition, the user name and service name using the service component presumed to be faulty are searched from the facility information database 21, and the other service or the user service of the user who has reported the fault is included. In this case, when the user uses the corresponding service, a facility model including a plurality of service components arranged between the terminal and the information source is generated.

The communication sequence generating means 42 searches the design information database 22 and, together with the communication sequence when all the service components constituting the equipment model are normal, the communication sequence when each service component fails. Generate

The failure service component estimating means 43 compares the plurality of generated communication sequences with the observation information at the time of the failure report, estimates which communication sequence has occurred, and based on this estimates which service configuration failed. Estimate the elements. In addition, if the event of the user terminal estimated in another service used by the user who has reported the failure or the service used by another user matches the event at the time of reporting the failure of the user, the failure of the same service component It is estimated that

FIGS. 2 to 4 show the flow of processing in the present apparatus, and the operation will be described below in accordance with the flow.

First, when a maintenance person who has received a failure report from a user inputs a corresponding user name (here, a user ID) and a service name used, the maintenance person searches the facility information DB 21 and the user who has reported a failure reports the corresponding service. Between the terminal and the information source (server) when using END-E (END-E
An equipment model including a plurality of service components arranged in ND) is generated (step 1).

Next, the design information DB 22 is searched, design information for each service component of the generated equipment model is extracted, and a communication sequence when all service components are normal is generated. A communication sequence when each element has failed is generated (step 2).

To generate a communication sequence at the time of a failure,
For example, in a service, a service component called a communication cable has a role of “transmitting a signal”, but when this role cannot be fulfilled due to a failure, the communication cable operates on the model as “does not transmit a signal”. This is equivalent to generating a communication sequence in the equipment model of the failure report user at that time.

Next, the maintenance staff can provide information on the failure event itself such as "screen does not move" observed at the terminal of the failure reporting user, information on alarms and error messages observed at the terminal, and information on the network side. When the information of the alarm or error message to be observed is input, the input observation information is compared with the communication sequence at the time of normality and at the time of failure of the equipment model of the failure report user generated in step 2, and information common to both is obtained. It is checked whether it is not included, and a service component that does not play its original role is extracted from each service component in the communication sequence that includes the common information (step 3).

Next, in step 3, a user name having a service component which did not play its original role, that is, a service component presumed to have a failure, in the equipment model and its used service name are extracted from the equipment information DB 21. An equipment model is generated for the extracted user name and the service name using the same method as in step 1. Further, among the service components constituting the generated equipment model, when the service component presumed to have failed performs an operation that cannot fulfill its original role, that is, a communication sequence at the time of failure is generated (step 4). ).

Next, for each communication sequence generated in step 4, alarms and messages estimated to be observed at each user terminal and the network maintenance / management device, etc.
All events such as "screen does not move" are identified and displayed (step 5).

Next, before the cause of the failure of the reporting user is determined and recovered, it is determined whether there is a failure report from another user or whether there is an alarm or message from a network management device or the like.

Here, when a failure report is made by another user, the maintenance person inputs the user ID and the service name of the user, and this is the equipment information of the service component estimated as a failure in step 4. Is confirmed, and if it is included, the maintenance person checks the connection destination ID and the "screen does not move" observed on the user's terminal.
The user inputs the information of the failure event itself and the alarms and error messages observed on the terminal side after consulting the user and comparing them to see if any of the information extracted in step 5 contains the same information. In this case, it is determined that the report from any user and the failure of the user first received are the same cause, and the maintenance person is notified of the same failure cause (step 6a).

On the other hand, if there is an alarm or message observed by the network management device or the like before the cause of the failure of the declared user is identified and recovered, the maintenance person will use the observation information and the fault generated in step 4 Service that did not play its original role among the service components in the included communication sequence. Re-estimate the component as a faulty facility (step 6)
b).

If no common information is included in step 6b, the equipment information is referred to, equipment models for all services of all users are generated, and the same processing as steps 2 and 3 is performed (step 7). .

[Embodiments] Specific embodiments of the present invention will be described below with reference to the drawings. Here, a description will be given of a WWW communication service in an intranet as an example.

FIG. 5 shows an equipment model generation step (step 1). When a failure report is made by the user A, the maintenance person enters the user ID of the user A (here, I
The equipment information DB is searched based on the P address = 10.10.10.1) and the use service name (here, an electronic bulletin board), and the END-END equipment model of the communication of the user A is provided to the use service. The role below, that is, the service component, is generated as a unit.

FIG. 6 shows a process (step 2) of generating a normal communication sequence. The design information DB is obtained by referring to the design information DB based on the generated equipment model. Then, based on this, a normal communication sequence in the equipment model is generated.

FIG. 7 shows a step (step 2) of generating a communication sequence in the event of a failure. Referring to the design information DB for each service component constituting the generated equipment model, an inverse of its role is obtained. . In the design information DB,
The role for each service component and its inverse (for example,
If the role is "transmit a signal", "do not transmit a signal" is one of the opposites. ) Are described, and the operation of signal processing corresponding thereto is described. Then, a communication sequence in the equipment model when one service component in the equipment model has performed signal processing corresponding to an antonym is generated, and the same processing is performed for all service components in the equipment model. , These are the communication sequence at the time of failure.

FIG. 8 shows a comparison step (step 3) between the observed information and the communication sequence. The generated communication sequence at the time of normal operation and at the time of failure and the observation at the network management device and the like inputted by the maintenance staff. It compares the reported alarm and message with the error message of "No response from host" observed at the reporting user's terminal and checks for similar information. In the example shown in FIG.
Since similar information is included in the communication sequences 1, 3, and 5, these three sequences are extracted.

FIG. 9 shows a process of estimating a fault location (process 4). In each of the communication sequences 1, 3, and 5, it is determined which service component is performing an “operation that does not play its original role”.
In the example shown in FIG. 48th NIC in 1 communication sequence
No. "No signal transmission", No. In the communication sequence of No. 3, the 96th HUB “does not transmit a signal”; In the communication sequence of No. 5, the second router "signal destination is wrong."
Thus, the three service components are estimated as failures.

FIG. 10 shows a step (step 5) of extracting a failure-related user name and a service name. The three service components, the 48th NIC, the 96th HUB and the 2nd router, which are presumed to have a failure, are provided. The information DB is searched to extract an IP address and a used service name of a user having these service components as a part of the equipment model. In the illustrated example, the extraction of the 96th HUB is shown.

FIG. 11 shows a process (step 6) of generating the equipment model for the extracted failure-related user and service used. In the illustrated example, the 96th HUB estimated to have a failure is included in the service component. An END-END facility model relating to the use service “book search” of Z (IP address = 10.10.10.99) is generated in the same manner as in the example of FIG.

FIG. 12 shows a step (step 6) of generating a communication sequence at the time of a failure in the extracted failure-related user and the service used. In the generated equipment model, the corresponding service component (96th HUB) A communication sequence at the time of performing the signal processing “not transmit a signal” corresponding to the inverse of the role is generated in the same manner as in the example of FIG. As a result of this communication sequence generation, user Z
Tries to use "book search", a message "host connection error" appears on the terminal.

The same processing as described above is performed for all the users having the 96th HUB, the 48th NIC, and the 2nd router as service components and the services used by the users.

FIG. 13 shows a processing step (step 7) for a failure report from another user. If a failure report is received from another user, for example, Y before the failure is recovered, the maintenance person will User ID (IP address 10.10.1
0.88), the name of the failed service (e-mail) and an alarm or error message such as "Currently, e-mail is not available" that can be observed by User Y. The user Y inquires about the event itself such as "display is performed" and inputs it.

Next, the input information, the user ID and the service name extracted in the step of extracting the failure-related user name and the service name, the equipment model of the failure-related user and the service used, and the step of generating the communication sequence at the time of the failure Is compared with the communication sequence generated in step 2 to search for a matching alarm, error message, or event.

As a result, if there is a match, the failure report of user A and the failure report of user Y are displayed as the same cause of failure, and if they do not match, the failure report of user Y is regarded as a new failure. Since it is necessary to perform the reception processing, the processing from step 1 is performed.

[0044]

As described above, according to the present invention,
Simultaneously with the estimation of the failed service component in the network system, it is possible to extract an event presumed to have occurred in a service using the service component.
Early limitation of the affected area is possible.

[Brief description of the drawings]

FIG. 1 is an apparatus configuration diagram showing an example of an embodiment of the present invention.

FIG. 2 is a diagram showing a processing flow in the apparatus of FIG. 1;

FIG. 3 is a diagram showing a processing flow in the apparatus of FIG. 1;

FIG. 4 is a diagram showing a processing flow in the apparatus of FIG. 1;

FIG. 5 is a diagram showing an example of an equipment model generation process.

FIG. 6 is a diagram showing an example of a communication sequence generation process in a normal state.

FIG. 7 is a diagram showing an example of a communication sequence generation process at the time of failure.

FIG. 8 is a diagram illustrating an example of a comparison process between observation information and a communication sequence.

FIG. 9 is a diagram showing an example of a failure location estimation process.

FIG. 10 is a diagram illustrating an example of a process of extracting a failure-related user name and a service name.

FIG. 11 is a diagram showing an example of a process of generating a facility model in a failure-related user and a service used;

FIG. 12 is a diagram illustrating an example of a process of generating a communication sequence when a failure occurs in a failure-related user and a service used

FIG. 13 is a diagram showing an example of processing steps for a failure report from another user.

[Explanation of symbols]

REFERENCE SIGNS LIST 1 input device 2 storage device 3 display device 4 processing device 21 equipment information database (DB) 22 design information database (DB) 41 equipment model generation means 42 communication sequence generation Means, 43 ... Failure service component estimating means.

Claims (6)

[Claims] 1. A network service failure diagnosis method for diagnosing a failure by receiving a report from a user who uses a service via a network, the method comprising the steps of: Generating an equipment model composed of a plurality of service components arranged between the terminal and the information source when using the corresponding service, and when all service components constituting the equipment model are normal Generating a communication sequence when each service component fails together with the communication sequence of, and comparing the plurality of generated communication sequences with the observation information at the time of reporting the failure, which communication sequence has occurred And estimating the failed service component from the estimated service component. Network service failure diagnosis method. 2. A network service failure diagnosis apparatus for diagnosing a failure by receiving a report from a user who uses a service via a network, wherein the network service failure diagnosis apparatus is arranged between the terminal and an information source when the user uses the service. Equipment information database that describes the roles of each of a plurality of service components, a design information database that describes the normal and failure operations of each service component, and the user name and service name of the user who declared the failure Means for searching the facility information database based on the, and generating a facility model consisting of a plurality of service components arranged between the terminal and the information source when the user uses the corresponding service, Search the design information database and find that all service components that make up the equipment model are Means for generating a communication sequence at the time of failure of each service component together with a normal communication sequence; comparing the plurality of generated communication sequences with the observation information at the time of the failure report; Means for estimating whether or not a service component has failed, and estimating a failed service component from the result. 3. The logical relationship between information such as alarms and error messages observed by a maintenance / management device of the network itself, alarms and error messages observed by terminals, and events is defined by a prescribed protocol. 3. The network service fault diagnosis device according to claim 2, wherein a communication sequence generating means for generating a communication sequence expressed by: 4. A service component as a heading,
3. The network service fault diagnosis apparatus according to claim 2, wherein a facility information database that can search for another user name or another used service name using the same is used. 5. Searching the equipment information database for the name of the user and the name of the service using the service component presumed to be faulty, and determining whether another service used by the user reporting the fault or a service used by another user is available. If it is included, by generating a facility model composed of a plurality of service components arranged between the terminal and the information source when the user uses the corresponding service, by generating a communication sequence at that time The network service fault diagnosis apparatus according to claim 4, wherein an event observed at the user terminal is estimated. 6. The same service configuration when an event of a user terminal estimated in another use service of a user who has reported a failure or a use service of another user and an event at the time of failure report of the user are the same. The network service failure diagnosis apparatus according to claim 5, wherein the failure is estimated to be due to a failure of the element.