KR100908131B1 - Fault detection device and method using log filtering and fault detection system using the device - Google Patents

Abstract

The present invention relates to a device for detecting a failure of a network device, a method thereof, and a failure detection system using the device. The present invention relates to a failure level by receiving a real-time log message from a network device and analyzing the log message to detect a failure of the network device. And detecting log contents and transmitting a failure notification message including the log contents to at least one receiving terminal set according to a failure level.

Log, network equipment, failure

Description

Apparatus and method for obstacle sensing of network equipment by log filtering and system algorithm}

The present invention relates to a failure occurrence detection device, a method and a failure detection system using the device, and more particularly, to a device and a method for detecting a failure of a network device, failure occurrence using the log information of each device An apparatus and method for detecting the same. The present invention also relates to a failure detection system for managing failure occurrence information using a failure detection device of a network device.

As the network is enlarged to provide various communication services, the communication equipment used for network construction has also been diversified by type and manufacturer. As communication equipments are diversified as described above, network management systems (NMSs) are used to systematically manage each device in a complex configuration.

Conventionally, in order to determine a failure of a communication device, the NMS collects log information of the communication device in a polling manner. That is, the NMS periodically transmits a log information request message to a plurality of communication devices and receives a response thereto. At this time, the NMS analyzed log information received from each communication device to determine whether the corresponding communication device has a failure.

However, the method of determining whether or not a failure of a communication device by periodically obtaining log information of the communication device has a disadvantage in that it is impossible to determine a failure of the communication device in real time. That is, the NMS may acquire log information of the communication device after a serious failure of the communication device. Therefore, it is necessary to prepare a countermeasure for detecting a failure indication of a communication device in advance.

In addition, since conventional NMS periodically collects log information of communication equipment, log information exceeding the capacity of the NMS memory buffer is likely to be lost. Accordingly, there is a need for a failure detection system capable of efficiently managing log information of communication equipment.

Therefore, a technical problem to be achieved of the present invention is to collect and log information of the network equipment in real time, the failure detection device and method for detecting the failure of the network device in real time, and to build and manage the detected failure occurrence information as a database It is to provide a fault detection system.

In order to achieve the above-described problem, at least one fault detection system of a network device according to an aspect of the present invention receives a real-time log message from the network device and is set according to a fault level detected using the log message. Database for storing the failure detection unit for notifying the occurrence of the failure to the receiving terminal and information for managing the failure of the network equipment, receiving the log message from the failure detection unit to manage the failure statistics information of the network equipment And a management unit, wherein the failure detection unit divides the reception terminal into a plurality of groups, and notifies the occurrence of the failure to a reception terminal belonging to a group determined according to the failure level.

The apparatus for detecting a failure of a network device according to another aspect of the present invention may detect a failure level by using a real-time log message received from the network equipment, and detect the failure level with at least one receiving terminal set according to the failure level. A log message processing unit for transmitting a failure notification message including a, a database in which failure detection information including the network equipment information, the failure level information and failure notification rule information is stored, and the format of the failure notification message according to the receiving terminal. And a message transmission processor for transmitting differently, wherein the log message processor divides the receiving terminal into a plurality of groups, and transmits the failure notification message to a receiving terminal belonging to a group determined according to the failure level.

In addition, the method for detecting a failure of the network equipment according to another aspect of the present invention comprises the steps of receiving a real-time log message from the network equipment, analyzing the log message to detect the failure level and log content and the failure level And transmitting a failure notification message including the log contents to at least one receiving terminal set according to the above. In the transmitting step, the receiving terminal is divided into a plurality of groups, and the group is determined according to the level of failure. The failure notification message is transmitted to the belonging receiving terminal.

According to this embodiment of the present invention, by detecting the failure of the network equipment in real time to notify the equipment manager there is an effect that can solve the failure quickly.

In addition, according to an embodiment of the present invention it is possible to solve the failure more efficiently by setting the failure notification receiving group according to the failure level of the network equipment.

In addition, according to an embodiment of the present invention, the log information of the network equipment is managed by a database, so that a failure indication can be quickly detected and a proactive measure can be taken.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise. In addition, the terms “… unit”, “… unit”, “module”, etc. described in the specification mean a unit that processes at least one function or operation, which may be implemented by hardware or software or a combination of hardware and software. have.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. At this time, the failure detection system according to an embodiment of the present invention to be described below collects log information from the network equipment to receive the log information from the failure detection unit and the failure detection unit to notify the receiving terminal of the occurrence of the failure to detect the failure of the network equipment It includes a database management unit for managing. In the following, the failure detection unit will be described as a failure detection device and the database management unit will be described as a relational database management system.

1 is a block diagram of a failure detection system according to an embodiment of the present invention.

As shown in FIG. 1, the failure detection system includes a plurality of network devices 100, a failure detection device 110, a relational database management system (hereinafter referred to as an 'RDBMS') 120, and a plurality of network devices 100. The receiving terminal 130 is included.

The network device 100 generates log information when the network is connected, and generates a log message including the generated log information. The network device 100 transmits the generated log message to the failure detection device 110 in real time.

At this time, the log message is generated in the Syslog protocol format and includes real-time event information of each network device 100. At this time, the real-time event information includes log level and fault content information. Here, the real-time event content information included in the log message is called log information. Meanwhile, in FIG. 1, a plurality of network equipments 100 are represented by one reference numeral, but each network equipment 100 means one or more types of equipment.

The failure detecting apparatus (or failure detecting unit) 110 detects log information by collecting log messages respectively received from each network device 100. The failure detecting apparatus 110 filters the detected log information and transmits a failure notification message to the receiving terminal 130 according to the failure level.

In this case, the failure detecting apparatus 110 may transmit a failure notification message in the form of a short massage service (SMS) or a voice notification according to the type of the receiving terminal 130. The failure detecting apparatus 110 stores the collected log message in the RDBMS 120.

Meanwhile, FIG. 1 illustrates that a failure notification message is transmitted to the receiving terminal 130, but when the receiving side to receive the failure notification message is an NMS (not shown), the failure detecting apparatus 110 may be configured according to a communication protocol with the NMS. A failure notification message can be sent.

A method of transmitting a failure notification message by filtering log messages of the plurality of network devices 100 collected by the failure detecting apparatus 110 will be described in detail with reference to FIG. 2.

The RDBMS 120 manages information of each network device, user information, receiving terminal information, failure level information, and failure notification rule information, and provides each information to the failure detection apparatus 110. In this case, the RDBMS 120 may receive and manage a plurality of network equipment 100 information, failure level information, user information, and the like from the NMS (not shown). In addition, the RDBMS 120 may receive receiving terminal information, failure level information, failure notification rule information, etc. from an administrator (or user) of the RDBMS 120 through a user interface.

The receiving terminal 130 is a mobile terminal of the network equipment 100 and an NMS (not shown) manager or a management system such as an NMS or a central event notification server (CENS). In this case, in FIG. 1, a plurality of receiving terminals 130 are indicated by one reference numeral. Here, CENS is a system for notifying the occurrence of a failure by a voice when a failure of the network equipment occurs.

Hereinafter, a failure detection and failure notification method according to an embodiment of the present invention will be described in detail with reference to FIGS. 2, 3A, and 3B.

2 is a block diagram of a failure detection apparatus according to an embodiment of the present invention.

3A is a diagram illustrating the structure of a log message according to an embodiment of the present invention, and FIG. 3B is a diagram for describing a failure level according to an embodiment of the present invention.

As shown in FIG. 2, the failure detecting apparatus 110 includes a memory database 111, a log message collecting unit 112, a log message processing unit 113, a message transmission processing unit 114, a log message storage processing unit 115, and An information management unit 116 is included.

The memory database 111 stores network equipment information, user information, failure level information, and failure notification rule information received from the RDBMS 120.

In this case, the network database information and the corresponding receiving terminal information is matched and stored in the memory database 111. In this case, at least one receiving terminal corresponding to each network device may be divided into a receiving group capable of receiving a failure notification message according to each level of failure. In this case, the receiving terminal information is obtained from the failure notification rule information, and each receiving terminal information includes receiving group information.

For example, at least one receiving terminal corresponding to one network device may be set as the first to third receiving groups. In this case, the first receiving group may be a group including a decision maker and a final reporter regarding the current state of the network equipment as the highest reporting group. In addition, the second receiving group may include a person who receives a report for each disorder and situation as a universal reporting group. In addition, the third receiving group may be a group that performs a task of the network equipment and may include an operator who manages the network equipment.

As described above, the failure of the network equipment can be divided into a plurality of groups, and the failure of the network equipment can be notified of the failure of the network equipment.

On the other hand, it is an example to separately set the receiving group in this way, it is possible to specify the receiving group of the receiving terminal according to other criteria.

The memory database 111 according to the embodiment of the present invention may be a memory resident database. In this case, the failure detection apparatus 110 may acquire the information more quickly than each information necessary for log filtering from the RDBMS 120 each time.

The log message collecting unit 112 collects real-time log messages of each network device 100. In this case, the log message collection unit 112 may be a Syslog daemon program and may be implemented by an online transaction processing (OLTP) mechanism. In this case, the log message collecting unit 112 may reliably collect a large amount of log messages at the same time using the OLTP mechanism.

The log message processing unit 113 detects log information by analyzing collected log messages of each network device 100, and filters the detected log information to transmit a failure notification message to the set receiving terminal 130. In this case, the log information includes the network device information, the log level, and the log content that generated the log message.

For example, the log message has a packet structure as shown in FIG. 3A. That is, the log message includes the date and time information, log level information, device identification information, and log content information when the log message is generated in the network device 100. In this case, the device identification information may be an IP address of each network device 100.

At this time, the log message processing unit 113 compares the log level and the log contents of the above log information with the failure level information stored in the memory database 111 and uses the comparison result to compare the log information according to the failure notification rule. To filter.

In detail, the log message processing unit 113 compares the log level and log contents of the detected log information with a failure level table stored in the memory database 111. In this case, the failure level table according to the embodiment of the present invention is as shown in FIG. 3B. In FIG. 3B, the failure level of the network equipment is divided into eight levels, and each level is represented by 'first level' to 'eighth level'.

First, the first level P301 is an emergency level, and message information generated when a system of a corresponding network device is unavailable is matched and stored. 3B illustrates that the log level of the log message corresponding to the first level P301 is "0".

The second level P302 is an alert level, and message information generated when immediate action is required for the corresponding network equipment is matched and stored. For example, when the network device needs immediate action, the network device may repeatedly generate a certain number of up / down links. The message 'LINK FLAPP' indicating such a case may be matched and stored at the second level P302. At this time, the log level of the log message corresponding to the second level P302 is represented by "1".

The third level P303 is a critical level, and message information generated when a serious problem occurs in the corresponding system is matched and stored. For example, the message 'STROM CONTROL' indicating that a port down occurs due to excessive broadcasting or the like on the corresponding network equipment may be stored in match with the third level P303. At this time, the log level of the log message corresponding to the third level P303 is represented by "2".

The fourth level P304 is an error level, and message information generated when a wrong setting or illegal packet operation is matched and stored. For example, a message 'UP / DOWN' indicating that the link information of the switch port is changed may be matched and stored at the fourth level P304. At this time, the log level of the log message corresponding to the fourth level P304 is represented by "3".

The fifth level P305 is a warning level, in which message information generated when a check is required due to duplication of resources or a network of a corresponding device is matched and stored. For example, the 'MAC FLAPP' message due to the same MAC information in different ports may be matched and stored at the fifth level P305. At this time, the log level of the log message corresponding to the fifth level P305 is represented by "4".

The sixth level P306 is a NOTICE level, in which message information when an operation performed by an administrator of the corresponding network device occurs is matched and stored. For example, a 'LOGIN / OUT' message indicating a case where a login or logout of the device occurs may be stored at the sixth level P306. In this case, the log level of the log message corresponding to the sixth level P306 is represented by “5”.

The seventh level P307 is an information level, and message information when connection and disconnection of the communication network of the corresponding network equipment occurs is matched and stored. At this time, the log level of the log message corresponding to the seventh level P307 is represented by “6”.

The eighth level P308 is a debug level, in which message information generated by debug and test is matched and stored for troubleshooting of a corresponding network device. For example, the message 'DEBUG MODE' indicating that the state of the corresponding network equipment is in the debug mode may be matched and stored at the eighth level P308. At this time, the log level of the log message corresponding to the eighth level P308 is represented by "7".

At this time, the log message processor 113 detects a failure level of the corresponding network equipment by comparing the log level included in the log information of the currently received log message with the log level of the failure level table. In this case, the log message processing unit 113 may detect the failure level by comparing the log contents included in the log information with the message information of the failure level table.

Then, the log message processing unit 113 filters the log information according to the failure notification rule information stored in the memory database 111 using the detected failure level and the network equipment information included in the log information. In this case, the failure notification rule information includes reception group information according to each failure level.

For example, in the failure notification rule information, the first to fourth levels of the failure levels are the first reception group, the fifth and sixth levels are the second reception group, and the seventh and eighth levels are the third reception group. The failure notification message may be set to be transmitted.

That is, the log message processor 113 transmits a failure notification message to the second receiving group through the message transmission processor 114 when the failure level is the third level as a result of analyzing the log message of the corresponding network device. At this time, the log message processing unit 113 requests the message transmission processing unit 114 to transmit a failure notification message including information on the reception terminal of the second reception group corresponding to the corresponding network device and the details of the failure.

Thereafter, the log message processing unit 113 transmits the currently received log message to the RDBMS 120.

The message transmission processing unit 114 receives a failure notification message transmission request from the log message processing unit 113, generates a failure notification message including the failure details, and transmits the failure notification message to each receiving terminal 130. At this time, the message transmission processor 114 checks the information on each receiving terminal included in the failure notification message transmission request. When the receiving terminal is a mobile terminal, the message transmission processing unit 114 generates a failure notification message in the form of an SMS message and transmits it to an SMSC (SMS Center).

Meanwhile, when the receiving terminal to receive the failure notification message is an NMS (not shown), the message transmission processor 114 generates a failure notification message according to a communication standard with the NMS and transmits the failure notification message to the NMS. In addition, when the receiving terminal is the CENS, the message transmission processor 114 converts the log contents into the set voice information data and transmits the same to the CENS.

The log message storage processor 115 transmits the currently collected log message to the RDBMS 120 to be stored in the RDBMS 120. In this case, the log message storage processing unit 115 may include its own memory unit (not shown), and temporarily store log messages of each network equipment currently collected and sequentially transmit them to the RDBMS 120.

In addition, the log message storage processor 115 may receive an acknowledgment that the log message delivery was successfully performed to the RDBMS 120 when the log message is delivered. At this time, if there is no acknowledgment from the RDBMS 120, the log message storage processor 115 retries the transmission of the corresponding log message.

As such, the log message storage processor 115 temporarily stores the real-time log message and then transfers the message to the RDBMS 120, thereby disconnecting the communication between the failure detecting apparatus 110 and the RDBMS 120 or down the system of the RDBMS 120. In case of down, it is effective to prevent the loss of log messages.

The information manager 116 receives each network device information, user information, receiving terminal information, failure level information, and failure notification rule information from the RDBMS 120 and stores them in the memory database 111. At this time, when the update occurrence notification message of each information is received from the RDBMS 120, the information manager 116 receives new information from the RDBMS 120 and updates the memory database 111.

On the other hand, the information manager 116 may include its own timer (timer) to periodically detect the information update status of the RDBMS 120, it is also possible to update the memory database 111 when new information is detected.

4 is a configuration diagram of an RDBMS according to an embodiment of the present invention.

As shown in FIG. 4, the RDBMS 120 includes a database 121, an input unit 122, a control unit 123, an output unit 124, and a transceiver unit 125.

The database 121 stores data for performing network device management, user information management, receiving terminal information management, failure level information management, and failure notification rule information management. In addition, the database 121 stores the real-time log message of each network equipment received from the failure detection device 110.

Specifically, the database 121 includes information, user information, receiving terminal information, failure level information, and failure notification rule information of each network device input by the user (or administrator) of the RDBMS 120 through the input unit 122. It is stored. In this case, each information stored in the database 121 may be received and stored from the NMS (not shown) in addition to the method of storing by the user of the RDBMS 120 through the input unit 122.

The input unit 122 receives information for failure management of each network device 100 from a user of the RDBMS 120 and transmits the information to the control unit 123. In addition, the input unit 122 receives a log message from the user of the RDBMS 120 and a request for information output for failure management of each network device, and transmits it to the control unit 123.

The controller 123 divides each information input from the user of the RDBMS 120 for each function and stores the information in the database 121, or obtains information requested from the user from the database 121 and outputs the information through the output unit 124. Print out for user confirmation.

In addition, the controller 123 stores a log message of each network device received from the failure detecting apparatus 110 in the database 121. In this case, the controller 123 may store the received log message in the database 121 for each network device or for each date and time when the log message is received.

On the other hand, the control unit 123 according to an embodiment of the present invention may execute a management application that allows a user of the RDBMS 120 to manage the failure of each network equipment.

In this case, the management application provides a user interface to perform a failure level management function, a user management function, a statistics management function, a failure notification rule management function, a device management function, and an inquiry management function. That is, a user (or an administrator) of the RDBMS 120 may input information for performing each function or output information for confirmation through a management application.

In detail, a user of the RDBMS 120 may set a failure level step and failure details belonging to each step by using a failure level management function of the management application.

For example, as illustrated in FIG. 3B, the user of the RDBMS 120 may set the failure level of the network device 100 in eight steps. At this time, when the user of the RDBMS 120 changes and sets the failure level and failure details, the changed contents are updated in the database 121. In addition, the failure level change and failure content change information is transmitted to the failure detection apparatus 110 through the transceiver 125.

Next, a user of the RDBMS 120 may store user information of each network device 100 in the database 121 by using a user management function of the management application. In addition, the user of the RDBMS 120 using the user management function can check the access history information of the user connected to the RDBMS (120). In this case, the user information includes a name of a user who can access the RDBMS 120, a contact number, and access authority. The access history information can be checked for each user or for a certain period of time.

Meanwhile, in the embodiment of the present invention, the user of the RDBMS 120 directly inputs user information by using a user management function of the management application provided by the controller 123. However, as another embodiment, the controller 123 may receive a user from an NMS (not shown) and store the user in the database 121. At this time, the user of the RDBMS 120 may further add or delete user information by using a user management function.

Next, a user of the RDBMS 120 may check the failure occurrence statistics of each network device by using the statistics management function of the management application. At this time, failure information for each network device or failure occurrence statistics value screen of the entire network device may be output along with each failure. Such a failure frequency statistics can also check the failure frequency statistics within a certain time.

As such, the user of the RDBMS 120 may determine the frequency of failure of each network device 100 by using the statistical management function. That is, a user of the RDBMS 120 may analyze the frequency of occurrence of failure of each network device 100 to detect a symptom of failure according to a specific failure level, thereby enabling rapid proactive measures.

Next, a user of the RDBMS 120 may store the failure notification rule information in the database 121 by using the failure notification rule management function of the management application. At this time, the failure notification rule information is updated in the database 121 each time the user updates. In addition, the updated failure notification rule information is transmitted to the failure detection device 110 through the transceiver 125.

Here, the failure notification rule information includes reception terminal information for receiving a failure notification message for each network device 100 and reception group information to which each reception terminal belongs. In this case, the failure notification rule information includes setting information of a reception group to which a receiving terminal belongs according to a failure level and a failure content (log contents), and log message filtering may be applied by applying this.

For example, by using a failure notification rule management function, a user of the RDBMS 120 may set a reception group grade to receive a failure notification message for each failure level among the eight levels of failure levels as shown in FIG. 3B.

Next, a user of the RDBMS 120 may store information of each network device in the database 121 using the device management function of the management application. At this time, the information of the network equipment may be an identification code or a unique IP address that can distinguish each network equipment. In addition, the user of the RDBMS 120 using the device management function may set a specific network device to receive the failure notification message from the network device 100 stored in the database 121. That is, it is possible to set a specific network device as a failure management device among all the network devices stored in the database 121.

Meanwhile, if the network device information stored in the database 121 is information received from an NMS (not shown), the user of the RDBMS 120 may add or delete the network device using a device management function.

Next, a user of the RDBMS 120 may inquire log messages of each network device stored in the database 121 by using the inquiry management function of the management application. In this case, the log message inquiry may be a real-time log message inquiry and the past log message inquiry.

The output unit 124 outputs a screen for managing a plurality of network devices and log messages of each network device under the control of the controller 123. At this time, the embodiment of the present invention has shown that the output unit 124 can output the management application on the screen (Web) format.

The transceiver 125 is responsible for data transmission and reception between the RDBMS 120 and a communication system such as the failure detection device 110 or NMS (not shown).

Next, a failure detection method through log filtering of the failure detection apparatus 110 will be described in detail with reference to FIG. 5.

5 is a flowchart illustrating a failure detection method of a failure detection apparatus according to an exemplary embodiment of the present invention.

First, the failure detection apparatus 110 collects real-time log messages of the plurality of network equipment 100 (S500). At this time, the log message of each network device 100 has log information including identification information, log level, and log contents of the corresponding network device.

Then, the failure detection apparatus 110 analyzes the received log message to detect log information, and performs log message filtering using the detected log information (S510). At this time, the failure detecting apparatus 110 compares the previously stored failure level information with the log level included in the log information and detects a corresponding failure level. In addition, the failure detecting apparatus 110 obtains the reception terminal information according to the detected failure level. In other words, log messages are filtered according to the level of failure.

Then, the failure detection apparatus 110 transmits a failure notification message to the receiving terminal according to the log message filtering result (S520). At this time, the failure notification message includes the current occurrence of the failure of the network equipment.

In detail, the failure detecting apparatus 110 transmits a failure notification message to one or more receiving terminals that are preset according to the failure level of the corresponding network equipment. In this case, the preset receiving terminal according to each level may be a mobile terminal of an administrator of the corresponding network equipment, or may be NMS or CENS. In addition, the receiving terminal may be set to a receiving group consisting of at least one receiving terminal.

At this time, each failure level is composed of a level of simple warning level to the level that needs immediate troubleshooting. Therefore, failure can be efficiently solved by transmitting a failure notification message to a reception group set according to each failure level.

Then, the failure detection apparatus 110 transmits the collected log message to the RDBMS 120 (S530). At this time, the transmitted log message is stored in the RDBMS 120 is used as data for managing the failure of each network equipment (100). In addition, in transmitting a log message to the RDBMS 120, the failure detection apparatus 110 may temporarily store a log message to be transmitted and then transmit the log message to the RDBMS 120.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

1 is a block diagram of a network failure detection system according to an embodiment of the present invention.

2 is a block diagram of a failure detecting apparatus according to an exemplary embodiment of the present invention.

3A is a diagram illustrating the structure of a log message according to an embodiment of the present invention.

3B is a diagram for describing a failure level according to an embodiment of the present invention.

4 is a configuration diagram of an RDBMS according to an embodiment of the present invention.

5 is a flowchart illustrating a failure detection method of a failure detection unit device according to an exemplary embodiment of the present invention.

Claims (15)

In the failure detection system of the network equipment, A failure detection unit configured to receive a real time log message from the network equipment and notify the occurrence of a failure to at least one receiving terminal set according to the detected failure level using the log message; And A database manager which stores information for managing a failure of the network equipment, and manages failure occurrence statistical information of the network equipment by receiving the log message from the failure detection unit; Including; The failure detecting unit divides the receiving terminal into a plurality of groups, and notifies the occurrence of the failure to a receiving terminal belonging to a group determined according to the failure level. Disability detection system, characterized in that. The method of claim 1, The failure detection unit, Detecting a log level and a log content from the log message, The failure level is determined by comparing the log level with a previously stored log level, Sending a failure notification message including the log contents to the receiving terminal Fault detection system. delete The method according to claim 1 or 2, The database management unit, And stores network failure management information including information of the network equipment, user information, failure level information, and failure notification rule information. Transmitting the network failure management information to the failure detection unit. Fault detection system. The method of claim 4, wherein The network equipment, Generating the log message of the syslog protocol format and transmitting to the failure detection unit in real time Fault detection system. In the device for detecting a failure of the network equipment, A log message processing unit configured to detect a failure level by using a real-time log message received from the network equipment, and to transmit a failure notification message including failure details to at least one receiving terminal set according to the failure level; A database storing failure detection information including the network equipment information, the failure level information, and failure notification rule information; And Message transmission processing unit for transmitting a different type of the failure notification message according to the receiving terminal Including; And the log message processing unit divides the receiving terminal into a plurality of groups, and transmits the failure notification message to a receiving terminal belonging to a group determined according to the failure level. The method of claim 6, An information management unit which receives the failure detection information from the outside and stores the failure detection information in the database, and obtains and updates the changed failure detection information in the database when each failure detection information is changed; And Message storage processing unit for transmitting the real-time log message to the outside, and temporarily storing the log message Failure detection device further comprising. The method according to claim 6 or 7, The log message processing unit, Detecting a log level and a log content from the log message, Compare the failure level information with the log level and detect a corresponding failure level; Obtaining the set receiver terminal information by comparing the failure notification rule information with the detected failure level; Fault detection device. The method of claim 8, The failure notification rule information, Receiving terminal information corresponding to the network equipment, The reception terminal information includes reception group information for each failure level. Fault detection device. The method of claim 8, The log message, Messages in syslog protocol format. The log message generation date and time, identification information of the network equipment, the log level and the log content Fault detection device. In the method for detecting a failure of the network equipment, Receiving a real time log message from the network equipment; Analyzing the log message to detect a failure level and log contents; And Transmitting a failure notification message including the log contents to at least one receiving terminal set according to the failure level; Including; In the transmitting, dividing the receiving terminal into a plurality of groups, and transmits the failure notification message to a receiving terminal belonging to a group determined according to the failure level Disability detection method, characterized in that. The method of claim 11, Prior to receiving the real time log message, Storing failure detection information including information of the network equipment, failure level information, and failure notification rule information; Failure detection method further comprising. The method of claim 12, Detecting the failure level and log content, Detecting a log level and the log contents from the log message, Comparing the log level with the log level included in the failure level information to detect a failure level corresponding to the log message. Fault detection method. The method of claim 13, The transmitting of the failure notification message may include: Confirm the set reception terminal information by comparing the failure level included in the failure notification rule information with the detected failure level, The fault notification message is transmitted in a different format according to the confirmed receiving terminal. Fault detection method. The method of claim 14, In order to confirm the receiving terminal information, Detect information of at least one receiving terminal corresponding to the network equipment; Detecting reception group information set for each failure level included in the reception terminal information; Fault detection method.

Images