DE102013010205A1 - Error detection and localization in network services - Google Patents

Abstract

Common methods for identifying an error and / or for locating the cause of the error in a computer network consisting of several components 2, 3, 4, 5, 6, 7, 8 and / or a network service composed of several services 9-16 consistently set a sufficient level precise information about functional dependencies ahead. This information is often not available in a dynamic environment or quickly becomes obsolete without being recognized. In order to be able to carry out troubleshooting without this information, it is proposed to first define a first time period as the reference time period and to record and save data on a first number of selected operating state variables of the components and / or services at selected points in time of the reference time period, followed by one To calculate a target corridor for the operating state variables for a specific period, to define a second period as the detection period with the length of the period and to compare the data from the detection period with the target corridor in order to obtain a numerical value for a second number of the selected operating state variables assign as a measure of the respective deviation.

Description

Technical field of the invention

The present invention relates to the detection of errors and the location of the cause of the error in a network service. In particular, the present invention relates to a method for detecting an error and locating the cause of the error to a service within a network service or to a component in a computer network and to a computer network configured to execute such a method.

In modern data processing, increasingly structurally identical processes of user interaction and data manipulation occur. The most well-known examples are certainly the Internet services and the so-called application servers. Consistently, a reverse trend towards centralization can be discerned, which, however, does not aim at the monolithic system architectures of the era of mainframes, but at so-called distributed systems and network services. Physically, these are computer networks with a number of often very differently equipped computers, which are interconnected via communication networks. Part of these computers are the workstations or consoles available to the user. However, only a few subprocesses of the data processing are done there. The essential contributions to the user-initiated or requested data processing are taken over by the network services. The term "network service" refers to a service distributed over several physical computers and thereby virtualized in distinction from the original meaning of the term "service", which is used for a background process on a computer system.

The typically diverse dependence of the network services of local services on different computers and the intervening communication links makes troubleshooting difficult. Special problems are caused by computer networks and network services with dynamic functional dependency. A functional dependency exists between two components or services with respect to a user request, if their processing on one component or service requires the functioning of the other component or service. In this sense, the processing of a remote from a user's computer system user request by a service on a remote computer system requires the functioning of the link between the user's computer and the remote computer. In the case of said dynamic functional dependencies, neither the computing system provided for processing nor the communication link serving for the transport thereof is known before the user request is issued. Both depend on the respective utilization.

In this respect, it is an economically important goal to provide ways for error detection, error isolation and error localization. In the text which follows, error detection means the provision of a criterion by means of which an objective statement about the presence or absence of an error situation is made possible. Error localization is understood to be a means or a method sequence which is intended to facilitate the limitation of the causal or resulting contributions to or from an error situation to a subset of the components present in the computer network or a subset of the services bundled in the network service.

Underlying state of the art

A common method for detecting errors, namely so-called service failures in distributed systems, such as computerized services, telecommunications networks and application programs, and for estimating the costs caused by a service failure, is disclosed by the official document WO 02/45315 A2 , This method is based on the assumption of a temporal correlation between the loss of service and other operating state variables that can be detected within the distributed system, namely the so-called events occurring therein. Accordingly, data on the occurrence of selected events in a database is collected over a longer period of time. In particular, the type of event in the sense of a category and the time of occurrence as a so-called time stamp are stored there. Furthermore, the known method continuously collects data on the availability and utilization of certain services, which are, strictly speaking, network services. Upon detection of a significant deterioration in availability (error situation), a weighted time window is used to provide a forecast of the causality of the events stored in the database. Furthermore, the known method uses historical data from earlier error situations to improve the Reliability of subsequent forecasts. In part, these additional data are derived from historical records of past error situations, in part from static models for error propagation or from information about functional dependencies within the distributed system.

Another common method of error detection in network services is in the article "Error detection in networks" on pages 30 ff. In issue 10/2011 of the magazine "Funkschau" shown.

Technical problem

The essential separation in the above-described known methods in the data acquisition between, on the one hand, error-related operating state variables, namely the so-called service failures, and on the other hand causes-related operating state variables, namely the so-called events, may under certain circumstances constitute a disadvantageous restriction. For example, the prior art method mentioned above in the previous section only allows tracking of causality from a service outage to one or more logged events. Thus, the method can give no indication of a connection between two errors. However, this would be useful in situations where the cause of the failure can not be detected with the event data alone. Furthermore, the known method provides a rigid standard for the evaluation of the quality of a response of the computer network to a user request. However, this often does not do justice to the actual situation. In order to ensure that the typical and unavoidable fluctuations in the recorded quality during incorrect operation are not incorrectly assessed as errors, the rigid benchmark must be set tolerantly. In particular, in the case of a binary detection of the quality as a good / bad value thereby useful data on the behavior of the computer network are lost. Finally, the known method has a tendency to overestimate the temporal proximity.

Although in this point the common method mentioned second in the previous section offers a first improvement, this method also requires sufficiently accurate information about functional dependencies. This information is often not available in a dynamic environment or quickly becomes obsolete. In practice, it is difficult to ensure that the temporary shutdown of a computer system or of a communication device for maintenance purposes is promptly stored in the data collection for the functional dependencies. To ensure this, the method would also have to automatically track and capture the functional dependencies.

Technical solution

The disadvantages of the known solutions are resolved with respect to a method by the procedure proposed in claim 1. With regard to a device, the disadvantages of the known solutions are eliminated by a computer network having the properties specified in claim 8.

Advantageous effects

The method according to the invention and the device according to the invention enable a targeted search for errors and error causes without knowledge of functional dependencies in a network service or a computer network. In particular, the inventive method allows such a search even in an environment with highly dynamic functional dependence, as occurs, for example, in computer networks and network services with dynamic load distribution.

Description of the drawings

A preferred embodiment of a method according to the invention and a computer network configured to carry it out will be described below with reference to the appended drawings. It shows:

1 a schematic representation of a computer network with a running network service as a block diagram.

Best way / way to carry out the invention

According to 1 includes a computer network 1 for running a network service, a number of physical components 2 . 3 . 4 . 5 . 6 . 7 . 8th hereinafter abbreviated to the generic term "components" and in a simplistic view in communication devices 3 . 5 . 7 and computer systems 2 . 4 . 6 . 8th to divide. This classification relates primarily to the physical location of the components and their suitability for processing data. The term "computer equipment" summarizes those components that are particularly suitable for processing data. The term "communication devices", on the other hand, combines those components which transport data essentially unchanged. Typically, data processing services are mainly performed on the computers as the services, and data services are mainly performed on the communication devices as the services. Error causes and consequences are therefore to be understood in relation to the aforementioned components and the useful services executed thereon.

Outside the computer network 1 an example user B is a workstation R1 with an application, namely a web browser R2, available via a communication interface R3 with the network service on the computer network 1 can contact. The workstation R1 is therefore not here as a component of the computer network 1 understood and consistent running on the workstation R1 web browser R2 is not part of the network service. This view is similar to that of a typical internet network service operator who, for example, maintains an online shop or a search engine and wants to restrict his actions to the devices, applications and services that are under his direct supervision or influence. The operator of a system landscape with an operating software within a company would presumably prefer a different view and include both the workstations and the applications executed thereon in his definition of the computer network or the network service.

The following description of an embodiment assumes for simplicity as a substrate or target object for a method according to the invention to a network service, exclusively from Nutzsiensten on the computers 3 of the computer network 1 is formed. In terms of communication devices 2 it is assumed that these are faultless connections with unlimited bandwidth and optimum speed and / or latency. In this respect, no user services on the communication devices are considered as a simplification, such as, for example, firewall services or router services, although these should be regarded as further sources of error in mostly more complex practical applications.

The entry point into the network service for the user R2 application R2 is through a first load distribution service associated with the network service 9 providing the user request to one of several web server services also associated with the network service 10 . 11 . 12 transfers. The load distribution service 9 can as shown in the sketch on a computer 2 of the computer network 1 running on the same time a web server service 11 is performed. In the presently constructed application, the data manipulation triggered by the user request can not be handled solely by the web server service 10 be made. Rather, the example provides for one of the database services 13 . 14 . 15 that is not part of a web server service 10 . 11 . 12 but on another computer 8th as standalone services belonging to the network service. The assignment of a specific database service 13 to the requesting web server service 10 is related to the present user request by a second load distribution service 16 which also belongs to the network service. Strictly speaking, the assignment is made not with respect to the user request but with respect to a request from the Web server service involved in its processing 10 to an abstract database service. This request from the web server service 10 is, however, a consequence of the user request directed there, which justifies the simplifying view.

In any case, a web server service is considered schematically simplified by an incoming user request 10 and a database service 14 by means of two load distribution services 9 . 16 temporarily linked, as indicated by the dotted line V in the sketch. The possibility of such a temporary link within a number of services and components is usually used in practice for dynamic load balancing. Depending on the performance of the computer systems used and the communication devices arranged therebetween, the typical user requests, which are received in large numbers, are divided among various user services and ultimately processed and / or transported distributed over different components.

In addition to the commercial services 9 - 16 be on some computers 2 . 4 . 8th monitoring services 17 - 19 executed for carrying out a method according to the invention for error detection and fault localization. These monitoring services provide a continuous or in a temporal grid repeated capture of selected operating state sizes of the user services 9 - 16 and these performing components 2 . 4 . 6 . 8th , For the following explanations, two exemplary operating state variables are designated by X, Y. When assigning the monitoring services to the components (allocation), it is expedient to ensure that the functioning of the monitoring services is not affected by the occurrence of the errors whose purpose is detection and localization.

The selection of the recorded and logged selected operating state variables should suitably all in the Nutzsiensten 9 - 16 and components 2 . 4 . 6 . 8th already available operating state variables. A self-monitoring of the surveillance services 17 - 19 is not provided for in this framework. Continuously or more precisely quasi-continuously available operating state variables are preferably logged by reading in a predetermined narrow time frame. For the exemplified selected operating state variables X, Y, the time series X _{i, i = 1... N} and Y _{i, i = 1... N.}

Sporadic or rarely occurring states and events are preferably provided with a time stamp and logged in the manner known from the prior art only when occurring.

In addition, data that provides an objectified description of the user assessment of the network service is also acquired in a further developed implementation form as further operating state variables. These data are preferred from the behavior of the computer network 1 gained in response to simulated user requests. As in the presently chosen embodiment, the user's workstation R1 does not belong to the computer network 1 The simulated user request must be generated by other components within the computer network. As a result, errors on the workstation computer can not be detected as mentioned at the beginning.

In particular, stored real user requests or portions thereof may be provided by the monitoring services as simulated user requests 17 - 19 automatically in the input service 9 or directly into one of the downstream user services 10 - 16 be fed. The behavior detectable in response to these simulated user requests is provided by the monitoring services 17 - 19 Quantified and logged according to a given quality standard. For example, the speed at which database queries are handled or the rate at which data is delivered for Internet content can be measured and logged.

In practice, the logging of the operating state variables expediently takes place endlessly continuously, with the respectively oldest data for the recovery of storage space being continuously overwritten with the most recent ones. This measure fulfills the first logical step in a method according to the invention, as soon as the data for the selected operating state variables are recorded over a predetermined reference period.

In a subsequent or previous step, a value for an expected temporal periodicity of the operating state variables within the reference period is then determined. In the simplest case, this can be done by the user on the basis of a hypothetical model. For example, it may be a good approximation to assume a dependency of the operating state variables exclusively on the time of day. For the sake of simplicity, it is also assumed here that the exemplary time series _{X.sub.i, i = 1... N} , Y.sub.i _{, i = 1... N} contain data from a uniform time grid with exactly p values within one period and that the total number N of the values within the time series is a positive integer multiple thereof, ie N = r * p.

In a further developed form of implementation, a periodicity is independently searched for in the already acquired data for the selected operating state variables. Suitable algorithms for this purpose are known to the person skilled in the art. For example, the already acquired reference period can be divided for a predetermined period and the correlation of the data acquired in the sections obtained thereby can be calculated. Finally, a search for the maximum correlation leads to a preferred approximation for the periodicity of the data. Of course, even more complicated models can be developed for a temporally recurring behavior of the operating state variables.

With the specified period, the data acquired in the reference period becomes a target corridor for each of the selected operating state variables, that is to say a series of intervals I _{i, i = 1 ... p} = [X max / i, X _i ] calculated. In the simplest case, this set corridor can be considered a constant fluctuation width d around the mean value X _{i, i = 1 ... p} are formed from the periods contained in the reference period:

By comparing the data from the detection period with the target corridor, a weighting numerical value w _X , w _{Y is} obtained for each of the selected operating state variables X, Y, which quantitatively reflects the respective degree of the deviation. In the exemplary case, the number of values in the recognition period with the p values X _{j = s ... (s + p-1)} ; 1 ≤ s ≤ (s + p-1) ≤ N, which are not in the previously calculated interval of the target corridor:

In a further developed embodiment, the numerical value can be determined by applying a strictly monotonically decreasing function to the previously calculated value of the correlation between the data series of the detection period and the associated desired corridor.

As a result, in a still further developed implementation form, the administrator can subsequently display or otherwise display an overview of the selected operating state variables arranged in descending order of the numerical value.

In an even more advanced implementation form, the administrator is given the opportunity, based on the ordered overview, to search for other operating state variables with an objectively similar deviation from the target corridor for a selected operating state variable. In this respect, a further expedient refinement is to limit the ordered overview at the beginning of the interaction with the administrator to the so-called further operating state variables which, according to the preceding definition, convey an objectified description of the user assessment of the services which can be called up from the computer network. As a result, the administrator's attention is directed to the deviations particularly relevant for operation at the first moment of the troubleshooting. As a suitable measure of the objective similarity, for example, the static correlation between the time series to be compared during the observation period can be used. Details on the calculation of the correlation can be found in the relevant technical literature and are therefore not carried out here.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• WO 02/45315 A2 [0005]

Cited non-patent literature

• "Error detection in networks" on pages 30 ff. In issue 10/2011 of the journal "Funkschau" [0006]

Claims (9)

Method for detecting a fault in a computer network ( 1 ) and / or network service and / or localization of the cause of the error to a component ( 2 . 4 . 6 . 8th ) of the computer network or a service ( 9 - 16 ) in the network service with steps to: i. Acquiring and storing data on a first number of selected operating state quantities of the components ( 2 . 4 . 6 . 8th ) and / or services ( 9 - 16 ) at selected times within a predetermined reference period; ii. Determining a period duration and calculating a target corridor for the operating state quantities during a period from the previously acquired and stored data; iii. Defining a second period as a detection period with the length of the period; and iv. Comparing the data from the detection period with the desired corridor and assigning a numerical value as a measure of the deviation for a second number of the selected operating state variables. The method of claim 1, wherein the period duration in step (ii) is determined by periodic self-correlation of the stored data for a number of operating state quantities. Method according to one of the preceding claims, wherein the selected operating state variables contain measured values for response times of the network service to selected incoming requests. Method according to one of the preceding claims, wherein in the comparison in step (v) a correlation of the data from the observation period with the desired corridor is calculated. The method of claim 3, wherein for smaller correlated operating state quantities, a smaller numerical value is selected in step (v) than for lower correlated ones. Method according to one of the preceding claims, wherein in a further step a user dialogue is carried out for selecting a number of operating state variables from a list ordered according to the calculated numerical value. The method of claim 6, wherein in a further step, the amount of operating state variables selected by the user in the set of sensed periods is searched for other operating state quantities that are similar to the deviation from the target corridor compared to the selected one. The method of claim 7, wherein the similarity of the deviation is determined by a correlation and in particular by a correlation of the deviations from the respective target corridor. Computer network ( 1 ) arranged to carry out a method according to any one of the preceding claims.

Images