CN106130809B - A kind of IaaS cloud platform network failure locating method and system based on log analysis - Google Patents

Abstract

The invention discloses an IaaS cloud platform network fault location method and system based on log analysis, including a fault injection module, a log collection and analysis module, a knowledge generation module, and a fault detection and location module. First, by injecting various typical network faults , and form corresponding various fault logs. Then, for various types of faults, log information related to network faults at various levels such as physical resources, operating systems, virtual machines, and OpenStack are collected, and the Apriori algorithm is used to mine the fault characteristics of the collected network fault log information. On this basis, according to the maximum frequent itemsets and parameters such as support and confidence, the Bayesian formula is used to generate association rules and knowledge corresponding to specific network faults. Finally, when a network failure occurs in the system again, the collected failure log can be compared and analyzed with the association rules of the knowledge base, so as to locate the level of the network failure.

Description

A method and system for network fault location of IaaS cloud platform based on log analysis

technical field

The invention relates to the fields of cloud computing, computer networks and data mining, in particular to a network fault detection technology, and in particular to a cloud platform network fault location method based on log analysis.

Background technique

In today's cloud era with the rapid development of the Internet and big data applications, various new network applications combined with cloud computing continue to emerge, and cloud computing has gradually evolved into the mainstream computing generic of new information systems. Cloud computing is the product of the integration of a series of network technologies and computing technologies such as parallel computing, distributed computing, utility computing, and virtualization. Cloud computing platforms can usually be divided into IaaS, PaaS, and SaaS according to different service levels: IaaS (Infrastructure as a Service) provides virtualization services, that is, provides virtual machines and corresponding virtual computing, virtual storage and virtual network resources. Users usually pay attention to the type of virtual machine and related configurations (CPU, memory, disk, network, etc.), and the middleware and applications on the upper layer of the virtual machine are deployed by the user. PaaS (Platform as a Service) provides the operating environment and middleware services of application software, and users often only focus on the development of application software and the deployment of related data and applications in PaaS. SaaS (Software as a Service) provides application software services.

As the supporting infrastructure of cloud computing, IaaS cloud platform provides elastic and scalable infrastructure services, and can provide large-scale, on-demand computing services, storage services and network services for upper-layer applications. Among them, the network service of the IaaS cloud platform, as its core service, is the key to the service quality of various cloud applications. As shown in Figure 1, as the most popular cloud management platform at present, Openstack is deployed on the underlying physical computing, storage and network resources of the cloud platform, which can realize unified management of computing, storage and network resources, and provide the cloud foundation of the IaaS layer. Facility unified service. In particular, the Nova and Neutron service components of Openstack have a crucial impact on the virtual machine service and network service of the IaaS cloud platform. Among them, Nova, as the core service of OpenStack, manages the entire life cycle of virtual machines in the IaaS cloud platform; Neutron provides IaaS cloud platform network services, creating virtual networks for virtual machines and interconnecting with physical networks. Openstack has become the de facto deployment standard for IaaS cloud platforms in industry and academia today.

However, with the continuous expansion of the scale of the data center IaaS cloud platform, its overall network topology is more complex, the network services of the platform nodes themselves are also more vulnerable, and the network failures of the cloud platform occur more frequently. With the deployment of the cloud management platform OpenStack, when a network failure occurs on the IaaS cloud platform, the root cause of the failure may occur in physical resources (such as physical machine downtime), operating system (such as operating system failure), virtual machines (such as virtual machine failure, Configuration file error), OpenStack (such as Nova, Neutron service failure) and other layers of IaaS cloud platforms. By analyzing the appearance of the fault log, it is difficult to intuitively locate the root cause of the network fault, and every time a network fault occurs, it is necessary to check the logs of each level and each component, which consumes a lot of manpower and material resources, and the effect is not necessarily good. Therefore, when a network failure occurs on the IaaS cloud platform, it is very important and meaningful to quickly and accurately locate the cause of the failure, and then help to quickly repair the network failure.

SUMMARY OF THE INVENTION

Purpose of the invention: In order to overcome the deficiencies in the prior art, the present invention provides an IaaS cloud platform network fault location method and system based on log analysis. The present invention can diagnose and locate the location of network faults.

Technical scheme: In order to realize the above-mentioned purpose, the technical scheme adopted in the present invention is:

A method for locating network faults in an IaaS cloud platform based on log analysis, comprising the following steps:

Step 1, inject various typical network faults to form corresponding fault log information.

Step 2: Collect log information related to network faults at the physical resource layer, operating system layer, virtual machine layer, and OpenStack network service component layer caused by various typical network faults injected in step 1, respectively, and analyze the collected fault log information. Preprocess and form Boolean fault log data, and use Apriori algorithm to mine fault features.

Step 3: According to the parameters of support and confidence, the fault features are used to generate association rules and knowledge corresponding to specific network faults through Bayesian formula, and the obtained knowledge is added to the fault knowledge base.

Step 4, network fault location. When a network fault occurs, the collected fault log can be compared and analyzed according to the association rules of the fault knowledge base, so as to locate the level of the cloud platform network fault occurrence.

In the step 1, various types of typical network faults form corresponding fault log information, including log information related to network faults at the physical resource layer, the operating system layer, the virtual machine layer, and the OpenStack network service component layer. The OpenStack network service component layer includes fault log information of Nova, Neutron, Open vSwitch, and Libvirt.

The collection of the log information in the step 2 is mainly by centrally aggregating the fault logs formed in the step 1 to the nodes that perform data mining on the logs. The preprocessing of fault log information includes data cleaning, data reduction, data selection, and data integration, and then generates Boolean transaction data that can be used for data mining by Apriori algorithm. The main steps are as follows:

Step 201, data cleaning, mainly eliminates some logs irrelevant to data mining, and fills in the vacancies in the logs by using global variables or filling in the sample mean.

Step 202, data reduction, using regular expressions to perform pattern matching, separates each attribute of the log by describing the regular expression of the log format, and generalizes the timestamp and log content keywords respectively, and extracts the information related to the network fault. key data.

Step 203, data selection, select log attributes related to data mining.

Step 204, data integration, using the idea of time window to integrate logs with small time intervals, unify fault log information, and convert the integrated relational logs into Boolean transaction data through format conversion.

Step 205 , data mining, use the Apriori algorithm to mine the log according to the fault type, and generate the corresponding maximum frequent itemset corresponding to the fault. The input of the Apriori algorithm is Boolean transaction data, and the output is the maximum frequent itemset.

In the step 3, the fault feature is used to generate the association rules and knowledge corresponding to the specific network fault through the Bayesian formula: the maximum frequent itemsets excavated in step 2 are used according to the support and confidence parameters using the Bayesian formula. Generate association rules and knowledge corresponding to specific network faults, and add these knowledge to the fault knowledge base. The main steps are as follows:

Step 301, parameter setting, setting support and confidence parameters.

Step 302, knowledge generation, according to the Bayesian formula, and according to the set support and confidence parameters, generate the corresponding network fault knowledge, and add it to the fault knowledge base.

The method for locating the level at which the cloud platform network fault occurs in the step 4: according to the specific fault knowledge formed in the knowledge base in step 3, when the network fault occurs again, the fault log formed by the network fault is collected, and the collected fault log is collected. Through the method of step 2, the formed Boolean transaction data is obtained, and then the module that generates the fault log is obtained, and then according to the knowledge in the fault knowledge base, the fault is located in descending order of confidence.

The fault location in step 4 includes the following steps:

Step 401, log collection, centralized aggregation of the logs formed by the failure to the nodes that perform data mining on the logs, and by processing the logs including data cleaning, data reduction, data selection, and data integration operations, a Boolean transaction is generated. data, and then obtain the module that generates the fault log.

Step 402, fault location, according to the knowledge in the fault knowledge base and in combination with the information of the module that generates the fault log, the fault location is performed in descending order of confidence.

An IaaS cloud platform network fault location system based on log analysis, comprising a fault injection module, a log collection and analysis module, a knowledge generation module, and a fault detection and location module, wherein:

The fault injection module is used to inject various typical network faults to form corresponding fault log information. The fault log information includes physical resource layer fault log information, operating system layer fault log information, virtual machine layer fault log information, and OpenStack network service component fault log information.

The log collection and analysis module is used to collect the fault log information formed in the fault injection module 1 and collect the fault log information when the network fault occurs according to the control signal of the fault detection and location module. Information 2 is preprocessed to form corresponding Boolean fault log data 1 and fault log data 2, and the Apriori algorithm is used to mine fault log data 1.

The knowledge generation module is used to generate the association rules and knowledge corresponding to specific network faults through the Bayesian formula of the fault features obtained by the log collection and analysis module according to the parameters of support and confidence, and add the obtained knowledge to the fault knowledge base middle.

The fault detection and location module is used to control the log collection and analysis module to collect fault log information when a network fault occurs, and based on the Boolean fault log data obtained by the log collection and analysis module and the fault knowledge base The association rules in the cloud platform are compared and analyzed, so as to locate the level of the cloud platform network failure.

Compared with the prior art, the present invention has the following beneficial effects:

(1) Collect the logs of each physical resource, virtual machine and OpenStack platform network components in the IaaS cloud platform in real time, and through preliminary training, the knowledge corresponding to specific network faults in the cloud platform can be mined;

(2) When an unknown network fault occurs on the IaaS cloud platform, specific fault knowledge can be formed through fault injection, thereby providing knowledge for fault location.

(3) When a network fault occurs on the Iaas cloud platform, by comparing the fault-related logs with the existing fault types, the location of the network fault can be better diagnosed and located;

(4) The modular design makes the coupling between the components of the network fault location system low and can adapt to new requirements and expansion.

Description of drawings

Figure 1 is a hierarchical diagram of network components in the IaaS cloud platform.

FIG. 2 is an interaction diagram of the network fault location module of the IaaS cloud platform implemented by the present invention.

FIG. 3 is a flowchart of network fault location of the IaaS cloud platform implemented by the present invention.

FIG. 4 is a schematic diagram of the positioning flow of network components in the IaaS cloud platform.

Detailed ways

Below in conjunction with the accompanying drawings and specific embodiments, the present invention will be further clarified. It should be understood that these examples are only used to illustrate the present invention and are not used to limit the scope of the present invention. Modifications in the form of valence all fall within the scope defined by the appended claims of the present application.

An IaaS cloud platform network fault location method based on log analysis, as shown in Figures 1, 3, and 4, includes the following steps:

Step 1, inject various typical network faults to form corresponding fault log information.

Various types of typical network faults form the corresponding fault log information, including log information related to network faults at the physical resource layer, operating system layer, virtual machine layer, and OpenStack network service component layer. The OpenStack network service component layer includes fault log information of Nova, Neutron, Open vSwitch, and Libvirt.

Step 2: Collect log information related to network faults at the physical resource layer, operating system layer, virtual machine layer, and OpenStack network service component layer caused by various typical network faults injected in step 1, respectively, and analyze the collected fault log information. Preprocess and form Boolean fault log data, and use Apriori algorithm to mine fault features.

By centrally aggregating the fault logs formed in step 1 to the nodes that perform data mining on the logs. The preprocessing of fault log information includes data cleaning, data reduction, data selection, and data integration, and then generates Boolean transaction data that can be used for data mining by Apriori algorithm. The main steps are as follows:

Step 201, data cleaning, mainly eliminates some logs irrelevant to data mining, and fills in the vacancies in the logs by using global variables or filling in the sample mean.

Step 202, data reduction, using regular expressions to perform pattern matching, separates each attribute of the log by describing the regular expression of the log format, and generalizes the timestamp and log content keywords respectively, and extracts the information related to the network fault. key data.

Step 203, data selection, select log attributes related to data mining.

Step 204, data integration, using the idea of time window to integrate logs with small time intervals, unify fault log information, and convert the integrated relational logs into Boolean transaction data through format conversion.

Step 205 , data mining, use the Apriori algorithm to mine the log according to the fault type, and generate the corresponding maximum frequent itemset corresponding to the fault. The input of the Apriori algorithm is Boolean transaction data, and the output is the maximum frequent itemset.

Step 3: According to the parameters of support and confidence, the fault features are used to generate association rules and knowledge corresponding to specific network faults through Bayesian formula, and the obtained knowledge is added to the fault knowledge base.

Based on the maximum frequent itemsets mined in step 2, the Bayesian formula is used to generate association rules and knowledge corresponding to specific network faults according to the parameters of support and confidence, and these knowledges are added to the fault knowledge base. The main steps are as follows:

Step 301, parameter setting, setting support and confidence parameters.

Step 302, knowledge generation, according to the Bayesian formula, and according to the set support and confidence parameters, generate the corresponding network fault knowledge, and add it to the fault knowledge base.

Step 4, network fault location. When a network fault occurs, the collected fault log can be compared and analyzed according to the association rules of the fault knowledge base, so as to locate the level of the cloud platform network fault occurrence.

According to the specific fault knowledge formed in the knowledge base in step 3, when the network fault occurs again, the fault log formed by the network fault is collected, and the collected fault log is processed by the method of step 2 to obtain the formed Boolean transaction data, and then obtain Find the module that generates the fault log, and then locate the fault according to the knowledge in the fault knowledge base and in descending order of confidence. It mainly includes the following steps:

Step 401, log collection, centralized aggregation of the logs formed by the failure to the nodes that perform data mining on the logs, and by processing the logs including data cleaning, data reduction, data selection, and data integration operations, a Boolean transaction is generated. data, and then obtain the module that generates the fault log.

Step 402, fault location, according to the knowledge in the fault knowledge base and in combination with the information of the module that generates the fault log, the fault location is performed in descending order of confidence.

An IaaS cloud platform network fault location system based on log analysis is shown in Figures 2 and 4. In the architecture of the IaaS cloud platform, the bottom layer is the physical node, and the nodes are connected through Ethernet. Install the virtualization software KVM on the physical nodes, virtualize the underlying physical nodes, realize the virtualization management of hardware, and integrate the scattered server computing resources into a unified management resource pool. The upper layer of the resource pool is the IaaS platform layer, which mainly deploys Openstack software to provide management such as opening, closing, restarting, and snapshotting of virtual machines. The top layer is the user interface layer for users to access IaaS services. On the basis of this IaaS basic structure, a fault injection module, a log collection and analysis module, a knowledge generation module, and a fault detection and location module are added, so that the specific location occurs at the physical resource layer, operating system layer, virtual machine layer or OpenStack service components. Location of network failures (eg Nova, Neutron, Open vSwitch). in:

The fault injection module is used to inject various typical network faults to form corresponding fault log information. The fault log information includes physical resource layer fault log information, operating system layer fault log information, virtual machine layer fault log information, and OpenStack network service component fault log information.

In the fault injection module, based on experience, the typical network fault types of the IaaS cloud platform are obtained, and various types of faults that may cause network problems are injected respectively: The typical network faults that can be injected include physical resource faults, operating system faults, virtual machine faults, OpenStack faults, etc., thus forming fault log information corresponding to various typical network faults, including the log information of the physical resource layer, operating system layer, virtual machine layer, and OpenStack network service components (such as: Nova, Neutron, Open vSwitch) , Taking the simplified version of OpenStack DevStack as an example, the logs of most of the other components such as Nova and Neutron are stored in the /opt/stack/logs directory.

The log collection and analysis module is used to collect the fault log information formed in the fault injection module and collect the fault log information when the network fault occurs according to the control information of the fault detection and location module. Information 2 is preprocessed to form corresponding Boolean fault log data 1 and fault log data 2, and the Apriori algorithm is used to mine fault log data 1.

In the log collection and analysis module, according to the specific file location in the file system where the relevant network failure logs are located, all network failure logs in the data center are collected in real time, and the collected logs are transmitted to the log analysis section. After data cleaning, data reduction, data selection, and data integration operations are performed according to the network fault log, Boolean transaction data that can be used for data mining by the Apriori algorithm is generated. The network fault log is copied to the analysis node by using the Linux system remote file copy SCP method. Through regular expressions, the operating system logs, OpenStack logs, Libvert logs, OpenVSwitch logs, etc. are uniformly formatted into the following basic formats: <timestamp><log level><code module><Request ID><log content> <source code location>. On this basis, data cleaning is mainly to eliminate the data mining irrelevant logs of network fault knowledge, and fill in the vacancies in the logs by using global variables or filling in the sample mean. Through data reduction, the specific value of each attribute is generalized to a level suitable for data mining. For the results of the data reduction, select fields that are useful to subsequent modules and discard useless fields. Suppose the original network failure log looks like this: 2015-12-10 20:46:49.671ERROR nova.compute.manager[req-5c973fff-e9ba-4317-bfd9-76678cc96584None None]No compute node record for hostdevstack-controller.

According to the above steps, the result of processing the above log is as follows: 2015-12-10 20:46nova.compute[5c973fff-e9ba-4317-bfd9-76678cc96584].

During data integration, fault logs with small time intervals correspond to the same fault, and one fault can cause all code modules that generate fault logs to be integrated together. Finally, for a specific network failure, the log format is: <ordinal number><code module 1><code module 2>...<code module x>.

The following table describes the results obtained after all the above data processing by injecting 10 network faults at the virtual machine level:

<1><os><n-sch><q-dhcp><openvswitch><libvirt> <2><os><n-cpu><n-net> <3><os><n-cpu><n-sch><q-dhcp><q-l3><openvswitch> <4><n-cpu><n-net><q-dhcp><q-l3><openvswitch><libvirt> <5><os><n-cpu><openvswitch><libvirt> <6><os><n-sch><libvirt> <7><os><n-cpu><n-net><q-dhcp><q-l3><openvswitch><libvirt> <8><os><n-cpu><n-sch><libvirt> <9><os><n-cpu><n-sch><n-net><openvswitch><libvirt> <10><os><n-cpu><n-sch><n-net><q-dhcp><q-l3><openvswitch><libvirt>

The first fault represents that the four modules of the operating system, nova-schedule, neutron-dhcp, openvswitch and libvirt will generate error logs. Other entries are similar. Since the Apriori algorithm of data mining requires input Boolean data, it is necessary to perform simple format conversion on the above data. The resulting boolean data is shown in the following table:

The input of the Apriori algorithm is Boolean transaction data, and the output is the maximum frequent itemset. It is easy to derive the largest frequent itemset for the above example data: ABGH.

The above data cleaning is mainly to eliminate some logs that are not related to the data mining of network fault knowledge, and fill in the vacancies in the logs by using global variables or filling in the sample mean. Data reduction uses regular expressions to perform pattern matching. By describing the regular expressions of the log format, it separates the attributes of the log and generalizes the timestamps, log content keywords, etc., to extract key data related to network failures. Data selection, select log attributes related to data mining. Data integration uses the idea of time window to integrate logs with small time intervals, unifies fault log information, and converts the integrated relational logs into Boolean transaction data through format conversion.

The knowledge generation module uses the Bayesian formula to generate association rules and knowledge corresponding to specific network faults from the fault features obtained by the log collection and analysis module according to the maximum frequent itemsets, support, confidence and other parameters, and adds the obtained knowledge to into the fault knowledge base. Therefore, it mainly performs the following steps:

Step 1, parameter setting. Set parameters such as support and confidence.

Step 2, knowledge generation. According to the Bayesian formula, the corresponding network fault knowledge is generated and added to the knowledge base.

In the knowledge acquisition module, the Bayesian conditional probability formula is used:

where N represents the count, then if we replace the count N with the support number, we can get the following formula:

Using the maximum frequent itemsets and related parameters (such as: confidence) to further generate association rules. The generation rules of association rules are as follows: For a frequent itemset B, for each of its non-empty subsets A, if there is: P(B|A)>min_conf, then the association rules can be generated: A->B. The value of P(B|A) is the confidence of the rule, where min_conf is the minimum confidence.

For the example, set the degree of support to 0.5 (50%), then the number of supports is 10*0.5=5. For the previously obtained maximum frequent itemsets ABGH. Enumerate all its non-empty subsets, and then calculate its conditional probability, such as:

The other calculation processes are similar and will not be listed here. The final probability is as follows:

Subset A B G H AB AG AH probability 55.6% 62.5% 71.4% 62.5% 71.4% 83.3% 71.4% Subset BG BH GH ABG ABH AGH BGH probability 100% 83.3% 83.3% 100% 100% 100% 100%

If the confidence level is set to 0.7, the following knowledge can be obtained:

1) If it is detected that the Open vSwitch component that manages the virtual network generates error logs, then we can infer that a network failure occurs at the virtual machine level. The confidence level is 71.4%.

2) If it is detected that the Linux operating system and the Nova-compute computing module of the Nova component generate error logs, then we can infer that a network failure has occurred at the virtual machine level. The confidence level is 71.4%.

3) If an error log is generated by the Linux operating system and the Open vSwitch component that manages the virtual network, then we can infer that there is a network failure at the virtual machine level. The confidence level is 83.3%.

4) If it is detected that the Linux operating system and the Libvirt component that manages the virtual machine generate error logs, then we can infer that a network failure has occurred at the virtual machine level. The confidence level is 71.4%.

5) If it is detected that the Nova-compute computing module Nova-compute and the Open vSwitch component that manages the virtual network generate error logs, then we can infer that a network failure has occurred at the virtual machine level. The confidence level is high probability.

6) If it is detected that the computing module Nova-compute of the Nova component and the Libvirt component that manages the virtual machine generate error logs, then we can infer that a network failure has occurred at the virtual machine level. The confidence level is 83.3%.

7) If it is detected that the Open vSwitch component that manages the virtual network and the Libvirt component that manages the virtual machine generate error logs, then we can infer that a network failure occurs at the virtual machine level. The confidence level is 83.3%.

8) If it is detected that the Linux operating system, the Nova-compute computing module of the Nova component, and the Open vSwitch component that manages the virtual network generate error logs, then we can infer that a network failure has occurred at the virtual machine level. The confidence level is high probability.

9) If it is detected that the Linux operating system, the Nova-compute computing module of the Nova component, and the Libvirt component that manages the virtual machine generate error logs, then we can infer that a network failure has occurred at the virtual machine level. The confidence level is high probability.

10) If error logs are detected from the Linux operating system, the Open vSwitch component that manages the virtual network, and the Libvirt component that manages the virtual machine, then we can infer that there is a network failure at the virtual machine level. The confidence level is high probability.

11) If it is detected that the computing module Nova-compute of the Nova component, the OpenvSwitch component that manages the virtual network, and the Libvirt component that manages the virtual machine generate error logs, then we can infer that a network failure occurs at the virtual machine level. The confidence level is high probability.

The fault detection and location module is used to control the log collection and analysis module to collect fault log information when a network fault occurs, and based on the Boolean fault log data obtained by the log collection and analysis module and the fault knowledge base The association rules in the cloud platform are compared and analyzed, so as to locate the level of the cloud platform network failure.

In the fault detection and location module, when the network fault occurs again, the fault log can be collected according to the generated network fault knowledge base. After the same log processing procedure, the network components and modules that generate the fault log can be obtained. Based on the knowledge of network faults in the network, the fault location is realized in the order of confidence from large to small.

The present invention provides a method for locating network faults in a cloud platform based on log analysis for an IaaS cloud platform where OpenStack is deployed. The problem of network fault location when network faults occur at all levels of the platform. The present invention forms various types of corresponding fault logs by injecting various typical network faults. For various types of faults, log information related to network faults at various levels such as physical resources, operating systems, virtual machines, and OpenStack are collected, and the Apriori algorithm is used to mine the fault characteristics of the collected network fault log information. On this basis, according to the maximum frequent itemsets and parameters such as support and confidence, the Bayesian formula is used to generate association rules and knowledge corresponding to specific network faults. When a network fault occurs again in the system, the collected fault logs can be compared and analyzed with the association rules of the knowledge base, so as to locate the level of the network fault.

The above is only the preferred embodiment of the present invention, it should be pointed out that: for those skilled in the art, without departing from the principle of the present invention, several improvements and modifications can also be made, and these improvements and modifications are also It should be regarded as the protection scope of the present invention.

Claims (9)

1. a kind of IaaS cloud platform network failure locating method based on log analysis, which comprises the following steps:

Step 1, all kinds of typical network failures are injected, corresponding fault log information is formed；

Step 2, physical resource layer that all kinds of typical network failures injected in acquisition step 1 respectively generate, operating system layer, The relevant log information of network failure of virtual machine layer and OpenStack web services component layer, to collected failure day Will information is pre-processed and is formed the fault log data of Boolean type, carries out fault signature excavation using Apriori algorithm；

Step 3, according to support, confidence level parameter, fault signature is generated into corresponding particular network failure by Bayesian formula Correlation rule and knowledge, and obtained knowledge is added in fault knowledge library；

Step 4, network failure positions, can be according to fault log collected and fault knowledge library when network failure occurs Correlation rule is compared and is analyzed, to position the level of cloud platform network failure generation.

2. the IaaS cloud platform network failure locating method according to claim 1 based on log analysis, it is characterised in that: In the step 1 all kinds of typical network failures formed corresponding fault log information include physical resource layer, operating system layer, Virtual machine layer and the relevant log information of OpenStack web services component layer network failure；The OpenStack network clothes Business component layer includes the fault log information of Nova, Neutron, Open vSwitch, Libvirt.

3. the IaaS cloud platform network failure locating method according to claim 1 based on log analysis, it is characterised in that: The acquisition of log information is mainly by converging to the fault log formed in step 1 to day centralizedly in the step 2 Will carries out on the node of data mining；The pretreatment of fault log information includes data scrubbing, hough transformation, data selection, number According to integrated, and then generate and can be used for the Boolean type Transaction Information that Apriori algorithm carries out data mining.

4. the IaaS cloud platform network failure locating method according to claim 3 based on log analysis, it is characterised in that: Boolean type Transaction Information is generated in the step 2 mainly executes following steps:

Step 201, the part log unrelated with data mining is mainly eliminated in data scrubbing, and logical to the vacancy value in log It crosses and is filled in using global variable or filled in sample average；

Step 202, hough transformation carries out pattern match using regular expression, by describing the regular expression of journal format, Each attribute of log is separated and extensive processing is carried out respectively to timestamp, log content keyword, extracts same network failure Relevant critical data；

Step 203, data decimation selects log properties related with data mining；

Step 204, data integration is integrated the log of time interval very little using the thought of time window, by failure day Will information unification, and Boolean type Transaction Information is converted by the relationship type log that format will be converted after integrating；

Step 205, data mining carries out the excavation by failure mode to log using Apriori algorithm, it is corresponding to generate failure Corresponding maximum frequent itemsets, the input of Apriori algorithm are Boolean type Transaction Informations, and output is maximum frequent itemsets.

5. the IaaS cloud platform network failure locating method according to claim 1 based on log analysis, it is characterised in that: Fault signature is generated to the correlation rule of corresponding particular network failure and the side of knowledge in the step 3 by Bayesian formula Method: the maximum frequent itemsets that will be excavated in step 2 generate corresponding spy using Bayesian formula according to support, confidence level parameter Determine the correlation rule and knowledge of network failure, and these knowledge are added in fault knowledge library.

6. the IaaS cloud platform network failure locating method according to claim 1 based on log analysis, it is characterised in that: Knowledge is added in network failure knowledge base in the step 3 and mainly executes following steps:

Step 301, support and confidence level parameter is arranged in parameter setting；

Step 302, knowledge formation generates corresponding according to Bayesian formula, and according to the support of setting and confidence level parameter Network failure knowledge, and be added in fault knowledge library.

7. the IaaS cloud platform network failure locating method according to claim 1 based on log analysis, it is characterised in that: The method for the level that the step 4 positioning cloud platform network failure occurs: according to the specific fault formed in knowledge base in step 3 Knowledge, when network, failure occurs again, the fault log that acquisition network failure is formed, by collected fault log by walking The Boolean type Transaction Information that rapid 2 method is formed, and then obtain the module for generating fault log, further according to fault knowledge library In knowledge, carry out fault location according to the sequence of confidence level from big to small.

8. the IaaS cloud platform network failure locating method according to claim 1 based on log analysis, it is characterised in that: Fault location in the step 4 the following steps are included:

Step 401, the log that failure is formed is converged to the node that data mining is carried out to log by log collection centralizedly On, by the processing to log including data scrubbing, hough transformation, data selection, data integration operation, generate Boolean type Transaction Information, and then obtain the module for generating fault log；

Step 402, fault location according to the knowledge in fault knowledge library, and combines the information for generating the module of fault log, presses Fault location is carried out according to the sequence of confidence level from big to small.

9. a kind of IaaS cloud platform network fault positioning system based on log analysis, it is characterised in that: including direct fault location mould Block, log collection and analysis module, knowledge formation module and fault detection and location module, in which:

Direct fault location module forms corresponding fault log information for injecting all kinds of typical network failures；The failure day Will information includes physical resource layer fault log information, operating system layer fault log information, virtual machine layer fault log information And OpenStack web services component fault log information；

Log collection and analysis module, for acquiring the fault log information one formed in direct fault location module, and for adopting Collection acquires the fault log information two when network failure occurs according to fault detection and location module control signal, to collected Fault log information one, fault log information two are pre-processed and form the fault log data one and event of corresponding Boolean type Hinder daily record data two, fault signature excavation is carried out to fault log data one using Apriori algorithm；

Knowledge formation module is used for according to support, confidence level parameter, the fault signature that log collection and analysis module are obtained The correlation rule and knowledge of corresponding particular network failure are generated by Bayesian formula, and obtained knowledge is added to failure and is known Know in library；

Fault detection and location module, for when network failure occurs, controlling log collection and analysis module acquisition network event Fault log information when barrier occurs, and the fault log data two of the Boolean type obtained according to log collection and analysis module with Correlation rule in fault knowledge library is compared and is analyzed, to position the level of cloud platform network failure generation.