CN109194520B

CN109194520B - Trap information processing method and device

Info

Publication number: CN109194520B
Application number: CN201811150567.1A
Authority: CN
Inventors: 吕照明
Original assignee: New H3C Technologies Co Ltd
Current assignee: New H3C Technologies Co Ltd
Priority date: 2018-09-29
Filing date: 2018-09-29
Publication date: 2022-04-26
Anticipated expiration: 2038-09-29
Also published as: CN109194520A

Abstract

The embodiment of the invention provides a Trap information processing method and device. In the embodiment of the invention, the network management server acquires the sent Trap information recorded by the managed equipment from the managed equipment, and simultaneously, the network management server locally records the received Trap information. And if the received Trap information does not include the Trap information sent by the managed equipment, alarming based on the included Trap information so as to avoid the alarm loss caused by the missing of the Trap information of the network management server.

Description

Trap information processing method and device

Technical Field

The present invention relates to the field of network communication technologies, and in particular, to a Trap information processing method and apparatus.

Background

In a Network Management system based on an SNMP (Simple Network Management Protocol), when a state of a managed device changes (for example, a fault), a Trap message is actively sent to a Network Management server. And the network management server gives an alarm according to the Trap information carried in the Trap message to remind a network administrator of timely processing the problems (such as fault repair) of the managed equipment.

After the managed device sends the Trap message to the network management server, the managed device waits for the response of the network management server to determine whether the network management server receives the Trap message. If the network management server can not receive the Trap message due to failure and respond, the managed device will retransmit the Trap message. And when the retransmission times reach a preset time threshold value, the retransmission is not carried out. During this period, if the webmaster server does not recover to normal, missing of the alarm due to missing of Trap information will be caused.

Disclosure of Invention

The invention provides a Trap information processing method and a Trap information processing device for solving the problem of alarm loss caused by missing Trap information of the existing network management server, and is used for avoiding the alarm loss caused by missing Trap information of the network management server.

In order to achieve the purpose, the invention provides the following technical scheme:

in a first aspect, the present invention provides a Trap information processing method, which is applied to a network management server, and the method includes:

acquiring a first Trap file from managed equipment, wherein the first Trap file is used for recording first Trap information sent by the managed equipment through a Trap message;

retrieving first Trap information from a second Trap file stored locally, wherein the second Trap file is used for recording second Trap information received by the webmaster server through a Trap message;

and if the first Trap information is not retrieved, alarming based on the first Trap information.

In a second aspect, the present invention provides a Trap information processing apparatus, applied to a network management server, the apparatus including:

an acquisition unit, configured to acquire a first Trap file from a managed device, where the first Trap file is used to record first Trap information sent by the managed device through a Trap message;

the searching unit is used for searching first Trap information from a second Trap file stored locally, wherein the second Trap file is used for recording second Trap information received by the network management server through a Trap message;

and the alarm unit is used for alarming based on the first Trap information if the first Trap information is not retrieved.

As can be seen from the above description, in the embodiment of the present invention, the network management server obtains the sent Trap information recorded by the managed device from the managed device, and at the same time, the network management server locally records the received Trap information. And if the received Trap information does not include the Trap information sent by the managed equipment, alarming based on the included Trap information so as to avoid the alarm loss caused by the missing of the Trap information of the network management server.

Drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the description of the embodiments will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.

FIG. 1 is a flowchart of a Trap information processing method according to an embodiment of the present invention;

fig. 2 is a second Trap file generation flow shown in the embodiment of the present invention;

FIG. 3 is a flowchart illustrating an implementation of step 102 according to an embodiment of the present invention;

fig. 4 is a schematic structural diagram of a Trap information processing apparatus according to an embodiment of the present invention.

Detailed Description

Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, like numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the invention, as detailed in the appended claims.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used in this specification and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

It is to be understood that although the terms first, second, third, etc. may be used herein to describe various information, these information should not be limited to these terms. These terms are only used to distinguish one type of information from another. For example, the negotiation information may also be referred to as second information, and similarly, the second information may also be referred to as negotiation information without departing from the scope of the present invention. The word "if" as used herein may be interpreted as "at … …" or "when … …" or "in response to a determination", depending on the context.

The embodiment of the invention provides a Trap information processing method, in the method, a network management server obtains sent Trap information recorded by a managed device from the managed device, and simultaneously, the network management server locally records the received Trap information. And if the received Trap information does not include the Trap information sent by the managed equipment, alarming based on the included Trap information so as to avoid the alarm loss caused by the missed Trap information of the network management server.

In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the following detailed description of the embodiments of the present invention is performed with reference to the accompanying drawings and specific embodiments:

referring to fig. 1, a flowchart of a Trap information processing method according to an embodiment of the present invention is shown. The flow is applied to a network management server.

As shown in fig. 1, the process may include the following steps:

step 101, a network management server obtains a first Trap file from a managed device.

The first Trap file is used for recording first Trap information sent by the managed device through a Trap message. Here, the first Trap file and the first Trap information are named for convenience of description, and are not intended to be limiting.

In particular implementations, the Trap log functionality of the managed device can be initiated. Each time the managed device sends a Trap message, one piece of Trap information (first Trap information) is recorded in a Trap log file (first Trap file).

When the network management server recovers from the fault state, a Trap log file acquisition request can be sent to the managed device so as to acquire a first Trap file from the managed device.

Step 102, searching the first Trap information from the second Trap file stored locally.

The second Trap file is used for recording second Trap information received by the network management server through the Trap message. Here, the second Trap file and the second Trap information are named for convenience of description only and are not intended to be limiting.

The process of retrieving the first Trap information is described below, and is not described herein for the sake of brevity.

And 103, if the first Trap information is not retrieved, the network management server gives an alarm based on the first Trap information.

That is, the Trap information received by the network management server does not include the first Trap information sent by the managed device, so the network management server gives an alarm based on the missed first Trap information.

Thus, the flow shown in fig. 1 is completed.

As can be seen from the flow shown in fig. 1, in the embodiment of the present invention, the network management server obtains the sent Trap information recorded by the managed device from the managed device, and at the same time, the network management server locally records the received Trap information. And if the received Trap information does not include the Trap information sent by the managed equipment, alarming based on the included Trap information so as to avoid the alarm loss caused by the missing of the Trap information of the network management server.

As an embodiment, before executing step 102, a generation flow of the second Trap file is further included.

As shown in fig. 2, the process may include the following steps:

step 201, the network management server stores the second Trap information into a temporary file.

In specific implementation, the webmaster server can analyze the second Trap information from the received Trap message and store the second Trap information into the temporary file.

Step 202, if the size of the temporary file reaches a preset size threshold value and/or the existing time length of the temporary file reaches a preset time length threshold value, the network management server generates a second Trap file according to the temporary file.

For example, if the preset size threshold is 100M and the preset duration threshold is 1 hour, then when the size of the temporary file reaches 100M and/or the existence duration of the temporary file reaches 1 hour, renaming the temporary file, and generating a second Trap file.

Thus, the flow shown in fig. 2 is completed.

Through the flow shown in fig. 2, the network management server generates the second Trap file.

The following describes retrieving the first Trap information from the second Trap file stored locally in step 102. Referring to fig. 3, a flow of implementing step 102 is shown for the embodiment of the present invention.

As shown in fig. 3, the process may include the following steps:

step 301, the network management server determines the time period of this retrieval.

In the embodiment of the invention, the managed device and the network management server utilize the existing time synchronization protocol to carry out time synchronization so as to ensure that the time scales of the managed device and the management server are uniform. The managed device records the generation time of the first Trap information in the first Trap file. And the network management server records the receiving time of the second Trap information in the second Trap file.

The starting time of the time period of the current retrieval is the deadline of the last retrieval, and specifically, the deadline is the generation time of the last first Trap information of the last retrieval; and the end time of the time period of the retrieval is the receiving time of the second Trap information received last in the second Trap file existing at present.

It should be noted that once retrieving in the embodiment of the present invention refers to retrieving, by the network management server, whether each piece of first Trap information in the first Trap file exists in the second Trap file after the first Trap file is read from the managed device once.

Step 302, from the second Trap files, a third Trap file with time intersection with the time period searched this time is determined.

As described above, the network management server generates the second Trap file based on the file size or the file existence duration, and therefore, a plurality of second Trap files generally exist in the network management server.

In this step, a third Trap file is selected from the second Trap files based on the time period determined in step 301 to narrow the search range. Here, the third Trap file is named for convenience of description only and is not intended to be limiting.

The process of specifically determining the third Trap file is described below, and is not described herein for the moment.

In step 303, the first Trap information is retrieved from the third Trap file.

The flow shown in fig. 3 is completed.

Through the flow shown in fig. 3, the network management server can reduce the retrieval range based on the time period, and avoid repeated retrieval.

Next, a description will be given of the step 302 of determining, from the second Trap files, a third Trap file having a time intersection with the time period searched this time.

As an embodiment, the network management server obtains the receiving time of each second Trap information in the second Trap file. And based on the receiving time of each second Trap message, the network management server determines the receiving time range of the second Trap message included in the second Trap file. And from the second Trap file, the network management server determines a third Trap file with intersection between the receiving time range and the time period of the retrieval.

For example, the following steps are carried out: if the receiving time of the first second Trap information recorded in the current second Trap file is 9:00 and the receiving time of the last second Trap information recorded in the current second Trap file is 10:00, the receiving time range of the second Trap information included in the second Trap file is 9: 00-10: 00. If the time period of the current retrieval is 9: 30-10: 30, a time intersection (9: 30-10: 00) exists between the receiving time period corresponding to the current second Trap file and the time period of the current retrieval, and therefore the current second Trap file is determined to be a third Trap file.

As another embodiment, when the second Trap file is named, time information may be included in the file name of the second Trap file. The time information is the receiving time of the first second Trap information recorded in the second Trap file. And determining a third Trap file with time intersection with the time period searched this time based on the time information included in the file name of the second Trap file.

For example, the following steps are carried out: if the first second Trap information recorded in file1 (second Trap file) is received at 9:00, the file name of file1 may be Trap0900, where "0900" represents time 9: 00; if the reception time of the first second Trap information recorded in the file2 (the second Trap file generated after the file 1) is 10:00, the file name of the file2 may be Trap1000, where "1000" represents the time 10: 00. The time period of the retrieval is 9: 30-10: 30. Acquiring time information contained in the file name of the file, namely 0900 in the file name of the file1 and 1000 in the file name of the file2, wherein the file1 may have 9:30 of second Trap information received later, and therefore the file1 is determined to be a third Trap file with time intersection with the time period of the current retrieval; since the second Trap information received 10:00 or later exists in the file2, the file2 is determined to be a third Trap file having a time intersection with the time period of the current search.

And the network management server determines a third Trap file based on the time period.

As an embodiment, the present invention further comprises: and the network management server determines the minimum deadline of the deadlines of the last retrieval corresponding to each managed device. And if the receiving time period corresponding to the second Trap file is less than the minimum cut-off time, deleting the second Trap file.

Because the number of the managed devices is multiple, each managed device corresponds to the respective part time of the last retrieval, and the network management server determines the minimum deadline time of the multiple deadline times according to the respective deadline time of the last retrieval corresponding to each managed device. That is to say, the second Trap file before the minimum deadline does not fall into the retrieval time period corresponding to any managed device, so that the second Trap file that is not used any more is deleted in the embodiment of the present invention, so as to save the storage space.

As an embodiment, the present invention further comprises: if the first Trap information in the first Trap file is retrieved (for example, the first Trap information in the first Trap file is usually stored according to the generated sequence, so that the network management server can sequentially retrieve each first Trap information in the first Trap file until the retrieval of the last first Trap information is completed, and it is not determined that each first Trap information in the first Trap file is retrieved), that is, whether each first Trap information in the first Trap file is verified to be the Trap information which is missed by the network management server or not, the network management server can delete the locally stored first Trap file, so as to save the storage space of the network management server.

The method provided by the embodiment of the invention is described by the following specific embodiment:

take a network management Server (denoted as Server1) and two managed devices (denoted as Device1 and Device2) as examples. Wherein, the Server1, the Device1 and the Device2 are time synchronized.

Managed devices (Device1, Device2) initiate Trap log functions. When a Trap event occurs, the managed device sends a Trap message to the Server1, and records corresponding Trap information in a Trap log file (recorded as log file).

The Server1 receives the Trap messages sent by the Device1 and the Device2, and stores the Trap information carried by the Trap messages into a temporary file, which is recorded as a Tempfile. Presetting the existence time threshold of the temporary file to be 1 hour, and the file size threshold to be 100M, then when the existence time of the Tempfile reaches 1 hour, and/or the file size reaches 100M, the Server1 renames the Tempfile to generate a formal Trap file, and recording the formal Trap file as the Trap file.

After the Server1 is restarted due to a failure, Logfile is read from Device1 and Device2, respectively. Here, the Logfile read from Device1 is denoted as Logfile 1; the Logfile read from Device2 is denoted as Logfile 2. As an embodiment, after the Server1 reads the Logfile from the managed device, the Logfile may be renamed by using the IP address of the managed device, so that the Trap information of which managed device is recorded in the file may be quickly confirmed according to the file name (IP address of the managed device) later.

See table 1 for an example of Logfile 1.

TABLE 1

See table 2 for an example of Logfile 2.

TABLE 2

The Server1 has currently generated 3 Trapfile, which are designated as Trapfile1, Trapfile2, and Trapfile 3.

See table 3 for an example of Trapfile 1.

TABLE 3

Wherein, IP1 is the IP address of Device 1; the IP2 is the IP address of Device2, and represents Trap information received from different managed devices.

See table 4 for an example of Trapfile 2.

TABLE 4

See table 5 for an example of Trapfile 3.

TABLE 5

For ease of description, the present example ignores possible slight delays between the generation time and the reception time. That is, the time when the Trap information is generated on the managed device is the same as the time when the Trap information is received by the Server 1.

It should be noted that the log file (Logfile) acquired by the network management server from the managed device may have a different format from the Trap file (Trap file) locally generated by the network management server, and therefore, before the retrieval, information that can be directly used for retrieval and comparison needs to be analyzed from the log file and the Trap file, that is, the IP address, the Trap information, the generation time, the reception time, and the like of the device recorded in the above file need to be analyzed.

The Server1 also records the expiration time of the last search (the time of generation of the last Trap information of the last search) for each managed device. If the managed device is not searched after being added into the network management system, the recorded deadline is the time when the managed device is added into the network management system. Referring to table 6, a table is recorded for the retrieval time recorded in the Server 1.

TABLE 6

Taking the Logfile1 read from Device1 as an example, the following search operation is performed on the Trap information recorded in Logfile 1:

as described above, after the Server1 reads the Logfile1 in the Device1, the Device1 IP address (IP1) can be used to rename the Device1 IP address, so the Server1 can query the table 6 according to the IP1 included in the file name to obtain the deadline of the last retrieval corresponding to the IP1 (T5); meanwhile, the reception time of the latest received Trap information recorded in the local Trap file is acquired (T10). And taking [ T5, T10] as the time period of the retrieval. T1 to T10 are time marks, and the larger the numerical value, the later the time.

Trapfile is determined that there is a time intersection with this time period [ T5, T10 ]. As can be seen from table 3, the reception period of Trapfile1 is [ T1, T4 ]; as can be seen from table 4, the reception period of Trapfile2 is [ T5, T7 ]; as can be seen from table 5, the reception period of Trapfile3 is T10. Thus, it may be determined that the Trapfile that has a time intersection with the time period [ T5, T10] includes Trapfile2 and Trapfile 3. I.e., the Trap information in Logfile1(Device1 log file) is retrieved in Trapfile2 and Trapfile 3.

Since the deadline of the last search is recorded as T5 in table 6, that is, the Trap information generated before T5 is searched, the search starts from the Trap information after T5 in Logfile1 (table 1).

First, the Server1 searches whether M14 exists in the Trapfile2 (generation time is T6). As can be seen from Table 4, M14 is present in Trapfile2, and therefore, Server1 determined that M14 was not missed.

The Server1 searches whether M15 is present in Trapfile2 (generation time is T8), and table 4 shows that M15 is not present in Trapfile 2. The presence of M15 in Trapfile3 was continuously searched, and as can be seen from Table 5, M15 was not present in Trapfile 3. Therefore, the Server1 determines that M15 is missed, records M15 in the alarm database, performs alarm entry, and performs an alarm based on M15.

M15 is the last Trap information in LogFile1 and this search ends. The Server1 records the generation time T8 of M15 in the retrieval time recording table as the start time of the next retrieval. The updated retrieval time log table is shown in table 7.

TABLE 7

Since the Trap information in the Logfile1 has been retrieved in its entirety, the Logfile1 stored in the Server1 can be deleted to save storage space.

Similarly, the Trap information in Logfile2 read from Device2 is retrieved, and is not described herein. After completing the search for the Trap information in the Logfile2, the search time record table is shown in table 8.

TABLE 8

As can be seen from table 8, the minimum search deadline is T8, and the Trapfile (Trapfile1 and Trapfile2) whose reception period is before T8 is no longer needed in subsequent searches, so the Trapfile1 and Trapfile2 are deleted to save the storage space.

The description of the present embodiment is completed so far.

The method provided by the embodiment of the invention is described above, and the device provided by the embodiment of the invention is described below:

fig. 4 is a schematic structural diagram of an apparatus according to an embodiment of the present invention. The device includes: an obtaining unit 401, a retrieving unit 402, and an alarming unit 403, wherein:

an obtaining unit 401, configured to obtain a first Trap file from a managed device, where the first Trap file is used to record first Trap information sent by the managed device through a Trap message;

a retrieving unit 402, configured to retrieve first Trap information from a second Trap file stored locally, where the second Trap file is used to record second Trap information received by the webmaster server through a Trap message;

an alarm unit 403, configured to perform an alarm based on the first Trap information if the first Trap information is not retrieved.

As an embodiment, the apparatus further comprises:

the generating unit is used for storing the second Trap information into a temporary file; and if the size of the temporary file reaches a preset size threshold value and/or the existing time length of the temporary file reaches a preset time length threshold value, generating a second Trap file according to the temporary file.

As an embodiment, the first Trap file further includes a generation time of the first Trap information;

the retrieving unit 402 is specifically configured to determine a time period of this retrieval, where a start time of the time period is an expiration time of a last retrieval, and an end time of the time period is a receiving time of a second Trap message received last in a second Trap file existing at present, where the expiration time of the last retrieval is a generation time of a last first Trap message of the last retrieval; determining a third Trap file with time intersection with the time period of the current retrieval from the second Trap file; first Trap information is retrieved from the third Trap file.

As an embodiment, the retrieving unit 402 determines, from the second Trap files, a third Trap file having a time intersection with the time period retrieved this time, including:

acquiring the receiving time of each second Trap message in the second Trap file;

determining a receiving time range of second Trap information included in a second Trap file based on the receiving time of each second Trap information;

determining a third Trap file with intersection between the receiving time range and the time period of the current retrieval from the second Trap file;

or,

the file name of the second Trap file comprises time information, and the time information is the receiving time of the first second Trap information recorded in the second Trap file;

and determining a third Trap file with time intersection with the time period searched this time based on the time information included in the file name of the second Trap file.

As an embodiment, the apparatus further comprises:

a deletion unit configured to determine a minimum deadline from deadlines of a last retrieval corresponding to each managed apparatus; if the receiving time period corresponding to the second Trap file is less than the minimum cut-off time, deleting the second Trap file; if the first Trap information in the first Trap file is searched, deleting the first Trap file stored locally.

The description of the apparatus shown in fig. 4 is thus completed. In the embodiment of the invention, the network management server acquires the sent Trap information recorded by the managed equipment from the managed equipment, and simultaneously, the network management server locally records the received Trap information. And if the received Trap information does not include the Trap information sent by the managed equipment, alarming based on the included Trap information so as to avoid the alarm loss caused by the missing of the Trap information of the network management server.

The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the present invention, and any modifications, equivalents, improvements and the like made within the spirit and principle of the embodiments of the present invention should be included in the scope of the present invention.

Claims

1. A Trap information processing method is applied to a network management server, and is characterized by comprising the following steps:

acquiring a first Trap file from managed equipment, wherein the first Trap file is used for recording first Trap information sent by the managed equipment through a Trap message and generation time of the first Trap information;

determining a time period of the retrieval, wherein the starting time of the time period is the ending time of the last retrieval, and the ending time of the time period is the receiving time of the second Trap information received last in the second Trap file existing at present, wherein the ending time of the last retrieval is the generation time of the last first Trap information of the last retrieval, and the second Trap file is used for recording the second Trap information received by the webmaster server through a Trap message;

determining a third Trap file with a time intersection with the time period of the current retrieval based on time information included in the file name of the second Trap file, wherein the time information is the receiving time of the first second Trap information recorded in the second Trap file;

retrieving the first Trap information from the third Trap file;

2. The method of claim 1, wherein determining the time period for the current search is preceded by:

storing the second Trap information into a temporary file;

and if the size of the temporary file reaches a preset size threshold value and/or the existing time length of the temporary file reaches a preset time length threshold value, generating a second Trap file according to the temporary file.

3. The method of claim 1, wherein the method further comprises:

determining the minimum deadline time in the deadline times of the last retrieval corresponding to each managed device;

if the receiving time period corresponding to the second Trap file is less than the minimum cut-off time, deleting the second Trap file;

if the first Trap information in the first Trap file is searched, deleting the first Trap file stored locally.

4. A Trap information processing device is applied to a network management server, and is characterized by comprising the following components:

an acquisition unit, configured to acquire a first Trap file from a managed device, where the first Trap file is used to record first Trap information sent by the managed device through a Trap message and generation time of the first Trap information;

the retrieval unit is used for determining a time period of the retrieval, wherein the starting time of the time period is the deadline of the last retrieval, and the ending time of the time period is the receiving time of the second Trap information received last in a second Trap file existing at present, wherein the deadline of the last retrieval is the generation time of the last first Trap information of the last retrieval, and the second Trap file is used for recording the second Trap information received by the webmaster server through a Trap message; determining a third Trap file with a time intersection with the time period of the current retrieval based on time information included in the file name of the second Trap file, wherein the time information is the receiving time of the first second Trap information recorded in the second Trap file; retrieving the first Trap information from the third Trap file;

5. The apparatus of claim 4, wherein the apparatus further comprises:

6. The apparatus of claim 4, wherein the apparatus further comprises: