Patent Application
20050276385
This invention relates generally to communication networks and, in particular, to logging events associated with communication networks.
Diagnosing failures or problems in communication networks, such as failed telephone or data call attempts, for example, can be particularly challenging in busy networks with a relatively high level of setup or control plane traffic. In the presence of a high volume of setup traffic or other signalling messages used to establish, maintain, or end a call, it becomes difficult to retrieve a signalling message history, also generally referred to as a protocol trace, for specific calls which fail. This difficulty arises primarily from the typically large volume of similar protocol traces for other calls in progress in a communication network at the same time.
According to one conventional technique, a failed call attempt is diagnosed by running a trace on signalling messages used in the setup of the failed call. This involves turning on a signalling trace function at one or more communication network nodes experiencing a call failure to log signalling messages for all calls at the node or nodes, performing actions which caused the failed call attempt, turning the trace function off, and then reviewing stored trace logs.
However, the signalling trace function may result in very large volumes of protocol traces being collected on a node or nodes where suspect calls are failing. For example, a busy network may experience call volumes on the order of thousands of calls per second, each requiring multiple signalling messages during call setup. In one commonly used call setup protocol, call setup involves the exchange of 6 signalling messages, which in the above example would result in tens of thousands of signalling messages every second. In addition, protocol traces may be collected for several minutes or even longer before a failure or problem is repeated.
After protocol traces have been collected, an operator must then search through all of the traces, possibly at multiple nodes, for those relating to the failed call. As described above, this task can be intensive and time consuming due to the number of traces collected. Trace searching is further complicated by the similarity between protocol traces. There is also a possibility that trace logs at a node do not contain the required traces. This situation may occur, for example, where required traces have overwritten due to limited protocol trace log storage space or where the path of a call through the network is unknown and the operator is accessing trace logs at a node through which a call being traced was not established. Thus, the time spent searching must be weighed against the possibility that the search will be unsuccessful. This uncertainty further increases the difficulty of diagnosing communication network problems using conventional logging techniques.
One alternative to searching trace logs by accessing multiple nodes involves a transfer, using FTP for instance, of the trace logs from each node to a workstation. However, the transfer itself is a time consuming process, which consumes both CPU resources at each node and network resources throughout the network, and does not reduce the large volume of logged traces requiring inspection.
In some networks, signalling traces can be run only on a per interface or logical port basis. Since each interface typically supports a large number of connections, interface-specific trace logs are also often very large, and thus extraction of any information of interest for particular calls remains difficult.
Another logging technique provides for per-call trace logs at a single network node. However, this technique has a very limited logging trigger capability, such as a calling address, involves proprietary signalling trace formats, and does not provide for trigger detection and event logging at multiple nodes through which a call is routed.
Improved logging methods and systems for communication networks are provided. Events, illustratively protocol traces, associated with particular calls or other types of communication session are logged on a per-session basis, for only those sessions for which an event logging trigger has been detected. Per-session logging may thus drastically reduce the number of logs, thereby alleviating some of the problems described above. An operator can then more easily scan logs at different network elements in a communication network to quickly diagnose a problem.
Logging techniques as disclosed herein also facilitate diagnosis of intermittent or infrequent failures or problems. Through the use of appropriate event logging triggers, a logging function may be enabled at a network element for a significant amount of time without logging an unmanageable volume of information, as information is collected only for communication sessions for which an event logging trigger has been detected.
According to one aspect of the invention, there is provided a method for logging events in a communication system, comprising detecting any of a plurality of event logging triggers for a communication session, and logging events associated with the communication session responsive to detection of any of the plurality of event logging triggers.
The event logging triggers may include, for example, one or more of enabling event logging for the communication session, a particular initiator of the communication session, a particular terminator of the communication session, a characteristic of the communication session, and a characteristic of the communication network.
In one embodiment, logging involves storing records of the events associated with the communication session in a data store. According to another embodiment, events are logged by transmitting records of the events to a remote system, such as a network management system or other system at which event logs may be analyzed. Events may be transmitted substantially in real time as the events are logged, for instance.
Logged events may also be associated with each trigger responsive to the detection of which the event was logged, a communication session for which the event was logged, or both. Communication session associations may be particularly preferred where events are logged for multiple communication sessions.
Events may include, for example, signalling messages or operating characteristics of communication equipment in the communication network.
A communication session event logging system according to another aspect of the invention comprises a detector configured to detect any of a plurality of event logging triggers for a communication session and an event logging module responsive to the detector and configured to log events associated with the communication session after any of the plurality of event logging triggers is detected.
In one embodiment, the detector and the event logging module are implemented in a processor configured to detect any of the plurality of event logging triggers for a communication session and to log events associated with the communication session responsive to detection of any of the plurality of event logging triggers.
The system may also include a memory. In such a system, the event logging module may be further configured to log the events by storing records of the events in the memory. An interface may be provided to enable access to the records of the events in the memory. In some embodiments, the system includes a transmitter, and the event logging module logs events by transmitting records of the events using the transmitter.
Event logging triggers may include intrinsic triggers associated with signalling messages for the communication session, extrinsic triggers, or both. An event logging enable command, a particular initiator of the communication session, a particular terminator of the communication session, and an operating characteristic of the communication session represent examples of intrinsic triggers. Extrinsic triggers may include a time of day, a performance characteristic of the communication session, and an operating or performance characteristic of the communication network, for instance.
A method of per-communication session event logging for a communication network is also provided. The method may include establishing a plurality of event logging triggers at a network element in the communication network, and logging events associated with a communication session upon detection of any of the plurality of event logging triggers for the communication session.
A user interface is preferably provided for accepting user input, and establishing may then involve receiving the plurality of event logging triggers through the user interface. The user interface may be provided at a network management system of the communication network, for example.
Trigger conditions may be stored in a memory to establish the plurality of event logging triggers. An event logging trigger may have one or more trigger conditions.
In a further embodiment of the invention, a network element for a communication network comprises an interface configured to receive user inputs for establishing a plurality of event logging triggers, and an event logging system configured to log events associated with communication sessions for which any of the plurality of event logging triggers is detected.
A method of logging signalling messages for communication sessions in a communication network according to another aspect of the invention comprises receiving signalling messages associated with respective communication sessions, determining, for each signalling message, whether the signalling message or a previous signalling message associated with the same communication session satisfies any of a plurality of logging conditions, and logging each signalling message associated with a communication session for which the signalling message or the previous signalling message for the communication session satisfies any of the plurality of logging conditions.
Systems and methods in accordance with aspects and embodiments of the invention may be implemented, for example, in one or more network element in a communication network.
Other aspects and features of embodiments of the present invention will become apparent to those ordinarily skilled in the art upon review of the following description of specific illustrative embodiments of the invention.
Examples of embodiments of the invention will now be described in greater detail with reference to the accompanying drawings, in which:
The network elements 20, 22, 24, 26, 30 may be switches, routers, or analogous elements through which communication sessions may be established through the communication network. A communication session may be virtually any type of connection or communication signal exchange, including telephone calls and data communication sessions, for example. The particular types of communication session available in a communication network will be dependent upon the type of the network equipment and the protocols used therein, the services offered by service providers using the network, and/or the type of end user equipment between which communication sessions are established, for instance. Other factors affecting the particular types of communication sessions supported in a communication network will also be apparent to those skilled in the art.
In operation, the network elements 20, 22, 24, 26, 30 receive and process signalling messages to establish or set up, possibly to maintain, and to release or tear down communication sessions. For communication session setup, signalling messages may specify network addresses or other identifiers or information which allow a network element to determine a route through the network, or at least a local portion of the network, for establishing the communication session. Maintenance and release signalling messages may similarly identify a communication session by initiating and terminating addresses or identifiers, or some other identifier associated with the communication session, and provide commands or instructions to invoke an action or function on the part of one or more network elements. Identifiers and commands may be specified, for example, in information elements or fields which are configurable in signalling messages according to various communication session control protocols. ITU-T Q.2931 and Multiprotocol Label Switching (MPLS) Label Distribution Protocol (LDP) are examples of such protocols, although the invention is applicable to other protocols as well.
Several different mechanisms may be used for communication session management. Some communication networks support multiple types of connections for communication sessions, including so-called Permanent Virtual Connections (PVCs), Switched or Semi-Permanent Virtual Connections (SPVCs), and Switched Virtual Connections (SVCs). These types of connections are described below and represent illustrative examples of types of connection in conjunction with which embodiments of the invention may be implemented. However, the invention is in no way limited to these particular types of connection, and may be applied to other types of connections, including Label Switched Paths (LSPs) and Signalled LSPs (SLSPs), for example.
In the case of a PVC, the network elements 20, 22, 24, 26, 30 establish connections but do not participate in determining the routes of connections through the network. In contrast, SPVCs and SVCs involve routing decisions by the network elements 20, 22, 24, 26, 30.
In response to a connection request, a setup message, or an analogous signalling message, a network element establishes a connection with another network element. A signalling message of this type may be received from a network element, a network management or control system for an SPVC, or end user equipment for an SVC. Referring again to
The network element 20 then establishes a connection with the one of the network elements 22, 24, 26 selected for the SPVC or SVC being established, using further signalling messages. The next network element, illustratively the network element 22, then determines whether it should establish a connection to the network element 30 directly or through the network element 24. A virtual connection route through the network is thus determined by the network elements 20, 22, 24, 26, 30 instead of by a remote device or management system.
For a PVC, particular ones of the network elements 20, 22, 24, 26, 30 are instructed by a network management system or control terminal (not shown) to establish specified connections to other network elements. In the system of
It will be apparent from the foregoing that communication session setup may involve establishing connections through a network, as in the case of SPVCs and SVCs for instance, or using a pre-established connection such as a PVC. References herein to a communication session may therefore relate to connections, communication signal exchanges via connections, or both, and should be interpreted accordingly.
As described above, a communication network may handle thousands of calls and even more signalling messages every second. In the above example of a communication session between end user equipment connected to the network elements 20 and 30, conventional trace logging techniques would log traces for all communication sessions which were in progress at a network element during a logging period. For a connection path of 20-22-24-26-30 or an unknown connection path between 20 and 30, a network operator may be required to review trace logs for all communication sessions on each of the network elements 20, 22, 24, 26, 30 when attempting to diagnose a failure of a single communication session.
According to an aspect of the invention, a network element collects events associated with particular communication sessions on a per-session basis. In one embodiment, an event logging function is enabled during communication session setup, although other embodiments allow logging to be subsequently enabled. Per-session event logging may significantly reduce the number of logged events, illustratively traces or signalling messages, and thereby allow an operator to more easily scan logs at network elements and thus more quickly diagnose a problem.
At 32, an event logging trigger is established at a network element at which events associated with a communication session are to be logged. Where a trigger for a communication session is detected at 34, events associated with the communication session are logged at 36. In one embodiment, the logging at 34 continues for the duration of a communication session once a trigger has been detected for that communication session. For example, a logging or trace enable flag may be set or stored in a data structure associated with a communication session when logging for the session is triggered. Then, until the call is terminated, all events for the communication session may be logged.
A trigger may relate to virtually any characteristic of a communication session, including, for example:
In a preferred embodiment, an event logging trigger is an enable command or instruction provided in a setup or other initial signalling message for establishing a communication session. This type of command may be inserted as a field or flag in a signalling message, for example, and processed at a network element to invoke event logging for that communication session. The trigger (a) above is one example of this type of trigger.
The triggers (b) and (c) above are examples of triggers which may be established to log events associated with communication sessions initiated and/or terminated by particular end users or equipment. These types of trigger may be useful in diagnosing problems experience by particular end users or groups of end users. A trigger of type (c) may be used, for example, where telephone calls initiated by a first end user to a particular terminating second end user fail while calls to other end users do not similarly fail. In this case, a trigger is detected for any subsequent communication session with the first end user as initiator and the second end user as terminator. In an Asynchronous Transfer Mode (ATM) network, initiators and terminators may be identified using calling and called numbers, and in MPLS and other IP-based networks, IP addresses identify initiators and terminators of communication sessions, for example. Other types of identifier may also be used in further embodiments.
It will be apparent from the above description of command- and identifier-based triggers that triggers may have one or more associated trigger conditions. A command or instruction trigger normally has a single associated trigger condition, in particular whether the command or instruction has been provided in a signalling message or possibly by another source. An initiator/terminator trigger, however, may have one or more than one condition, to provide for different levels of selectivity between communications sessions in which a particular end user is a participant.
Triggers (d) and (e) above represent examples of triggers which relate to operating characteristics of a communication session. This type of trigger provides for logging of events associated with communication sessions which have been configured for operation in a particular manner or have unexpectedly ended for a particular reason.
The example trigger (f) above provides for logging events for failed communication session attempts. Events may be logged in response to a failure associated with a particular cause, or any of multiple causes specified as conditions for the trigger. For event logging associated with communication session attempt failures, a setup message and possibly other signalling messages has already been received and is being processed prior to the trigger. In this case, however, the setup message may provide information which would be useful in determining the conditions which led to the failure. According to a preferred embodiment, the setup message, and more generally events preceding a trigger, may be stored and thereby made available for logging in response to a subsequent trigger. For the above example of a setup message, the setup message might be stored during processing of the initial call attempt, and the deleted or overwritten once the communication session has been successfully routed.
The above list of event logging triggers is not intended to be exhaustive. Embodiments of the invention are in no way restricted to any particular types of trigger.
For example, the triggers described above may be considered intrinsic triggers, associated with signalling messages or a communication session itself. Other intrinsic triggers, as well as extrinsic triggers, are also contemplated. Examples of extrinsic triggers include time of day, performance characteristics of a communication session, and operating or performance characteristics of a communication network. A performance characteristic may include a user-configured performance threshold, for instance. When the threshold is crossed, event logging for the communication session is started. Triggers may also be based on other session or system characteristics, including coding scheme, protocol type, the occurrence of message decoding errors, error rates, and traffic load, for instance.
Other types of trigger and combinations of triggers may be established to provide for selection of communication sessions for event logging based on any desired criteria.
It should also be appreciated that more than one trigger may be established for use in event logging according to embodiments of the invention. Trigger detection at 34 may then involve detecting any of multiple event logging triggers.
In one embodiment of the invention, events are logged at 36 by storing records of the events in a data store, provided in a memory device at a network element, for example. Access to the data store is preferably provided to allow a network operator to review the event records and diagnose any problems experienced during communication sessions.
Where multiple triggers are established, each logged event is preferably associated with any triggers responsive to the detection of which the event was logged. This may be accomplished by storing a trigger number, type, identifier, or some other information relating to a detected trigger in an event log or along with event records. Alternatively, multiple per-trigger data stores or memory devices may be provided. Records of events are then stored in a corresponding data store or memory device. In order to conserve memory space, each event may be stored only once. In this case, records for events which are logged responsive to more than one trigger may include more than one trigger identifier. For per-trigger data store embodiments, event records may be stored in one of the per-trigger data stores or a separate data store, with references, illustratively pointers, to the stored record being stored in the per-trigger data store for each trigger which caused the event to be logged.
An association between events and communication sessions may also be indicated in event records. As described above, network elements may handle many communication sessions at any time. In this case, an indication of an association between each communication session and events logged for the communication session may be particularly useful.
The above associations between event records, triggers, and/or communication sessions facilitate a determination as to the reason an event was logged and for which communication session the event was logged, thereby significantly simplifying event log searching and thus diagnosis of problems or failures. Event record review and searching may be even further simplified by providing support for subsequent event record presentation functions including sorting event records into groups according to communication session or trigger for instance.
Event logging at 36 may also or instead include transmitting records of logged events to a remote device. The remote device may be a network management system or remote terminal at which the records may be stored for later review, for example. Substantially real-time transmission of event records as the events are logged may reduce the memory requirements for event logs, in that transmitted event records need not necessarily be stored at a network element after being transmitted, or preferably after receipt of transmitted records has been acknowledged. Event record transmission may also provide for more convenient review of event logs, as a network operator has access to event records from multiple nodes at a single device or system to which all logged events for a communication session are transmitted.
All event records collected within a communication network may be transmitted to a single central system, as a communication network is normally maintained by a single entity. However, different destination devices or systems may instead be supported, for different service providers or network maintenance personnel, for example. Multiple destinations for event record transmissions enable distribution of event records for review at different sites or by different personnel. Event record transmit destinations may be established along with triggers or in signalling messages, for instance.
The above event record transmission feature may be provided in many different ways. A so-called Simple Network Mail Protocol (SNMP) trap is one example of a suitable network messaging technology, although the invention is in no way limited thereto.
In one embodiment, events are signalling messages or protocol traces, although other information or types of event may also or instead be logged, including performance or operating information relating to the communication session or communication equipment in the communication network.
Selectivity between the types of events to be logged responsive to event logging triggers may also be provided. For example, a trigger might be configured to start logging resource request events after a certain number of resource allocation failures. Other types of event-selective triggers having different associated trigger conditions for logging different types of events may similarly be configured.
Many different mechanisms may be provided for establishing event logging triggers. In one embodiment, triggers are specified or configured by user inputs received through a user interface at a network element, network management system, or end user equipment, for example, and stored in a memory at a logging system. Triggers are specified in signalling messages, illustratively connection request or setup messages, for communication sessions in other embodiments.
The above description relates primarily to a method according to an embodiment of the invention, which may be implemented in instructions stored on a computer readable medium, for example.
The network element 38 of
The call processor 40 is a signal processing component which performs at least communication session establishment, teardown and possibly management functions. Implementations of the call processor 40 may include hardware components, software components, or some combination of hardware and software.
The transceiver 42 includes communication components compatible with a communication network, and may vary between different communication networks, depending upon communication network types and protocols, for example. Many modern transceivers include both hardware components and signal processing software.
The trigger store 44 represents a data store in a memory for storing triggers and associated trigger conditions. Although shown as separate blocks in
In the network element 38, triggers may be configured using the interface 46, illustratively a keyboard or other input device which receives user inputs. In a preferred embodiment, the interface 46 provides a command line interface (CLI) through which a user interacts with the network element 38. As those skilled in the art will appreciate, a CLI may be presented at a local control terminal at the network element 38 or at a remote terminal such as a network management system. Therefore, the interface 46 may include a local interface, as shown in
The detector 48 and the logging module 50 operate as described below to support per-session event logging at the network element 38, and may be implemented in hardware, software, or some combination thereof.
Thus, software modules may be provided at the network element 38 for performing multiple respective functions, including functions of any of the call processor 40, the transceiver 42, the interface 46, the detector 48, and the logging module 50. In some embodiments, a single general-purpose processor may be configured to execute all of the software modules. Dedicated-processor embodiments are also contemplated, where the network element 38 includes multiple cards or electronic devices with their own processors, for instance.
From a comparison of
The operation of the network element 38 in respect of communication session establishment and management may be substantially as described above. For example, the call processor 40 may process signalling messages to establish communication sessions in a communication network, illustratively by controlling a switching component (not shown) based on signalling messages received through the transceiver 42. However, event logging at the network element 38 is performed on a per-session basis and is dependent upon triggers configured in the trigger store 44 through the interface 46.
The detector 48 is configured to detect an event logging trigger for a communication session. In one embodiment, the call processor 40 passes received signalling messages, or information parsed or otherwise extracted from received signalling messages, to the detector 48, which determines whether the signalling message or information satisfies trigger conditions of any of the triggers in the trigger store 44. For identifier-based triggers, for example, the detector 48 determines whether an identifier in a signalling message partially or fully matches an identifier in the trigger store 44, and a trigger is detected where a match occurs. As described above, other types of trigger are also contemplated, and the detector 48 may thus include more than one type of detector or otherwise be configured to detect multiple triggers or types of trigger.
The event logging module 50 is responsive to the detector 48 and is configured to log events associated with the communication session after the event logging trigger is detected.
Several different event logging control schemes may be implemented to provide for per-session event logging. In one embodiment, the detector 48 is configured to receive events or information relating to events for a communication session from the call processor 40, and/or possibly from other components of the network element 38 depending upon the types of events to be logged. The detector 48 then determines whether the event satisfies trigger conditions of a trigger or a trigger has already been detected for the communication session, and, where the event is to be logged, passes the event to the logging module 50 for logging.
According to another embodiment, the detector 48 sets a flag or indicator, in the trigger store 44 or another store or memory device, when a trigger is detected. A flag or indicator may include or be associated with an identifier of a communication session, for example. In this type of embodiment, the logging module 50 preferably receives events for communication sessions and accesses the flag or indicator to determine whether each event should be logged.
In a still further embodiment, trigger detection for communication sessions is handled by the call processor 40. A flag or indicator is then set by the call processor 40, in a data structure associated with a communication session for which a trigger is detected for example. The flag may be stored in a memory or register of the call processor 40, the trigger store 44, or another data store or memory device. The detector 48 then determines whether events received from the call processor 40 are to be logged by accessing the flag.
It should be appreciated that other logging control mechanisms may also be used, and that the invention is not restricted to any particular control mechanism. It should also be appreciated that events may be received by the logging system 52 from other components than the call processor 40. A network element may include detectors, processors, measurement devices, and other equipment for detecting or generating events to be logged.
In the illustrative example network element 38, event logging involves storing records of the events in the memory 54. Subsequent access to stored event records may be provided, for example, at a remote device or system through the transceiver 42 or a separate control signal transceiver, or at the network element 38 through a local interface. In one embodiment, the interface 46 provides for both trigger configuration and stored event record access. A CLI as described above may support both trigger configuration and event record access.
As described above, event logging may involve storing event records in an event log in the memory 54 or transmitting event records, using a transmitter or transmit function of the transceiver 42, for example.
The interface 46 receives user inputs for establishing event logging triggers in the trigger store 44. In one embodiment, the interface 46 is a local interface which allows entry of triggers or trigger conditions using a keyboard or other input device at the network element 38. In other embodiments, trigger configuration may be accomplished through the transceiver 42 or a control signal transceiver, for instance, using a communication network management system or another remote device or system. The above event record transmission feature may be particularly desirable in conjunction with remotely configured triggers, to return records of logged events to the remote device or system using which the triggers were configured.
In some embodiments, the network element 38 supports establishment of event logging triggers in signalling messages as described above. The interface 46 may therefore be a signalling message interface, provided by the call processor 40, for example. The network element 38 may also support multiple types of trigger configuration mechanisms, with the call processor 40 supporting “on-the-fly” triggers specified in signalling messages for instance, and the interface 46 providing user input-based triggers.
Triggers may be stored in the trigger store 44, for example, in a block of allocated memory or in an array of trigger data structures. The trigger store 44 may also store trigger conditions and other trigger-related information organized by trigger type. Other trigger storage data structures or arrangements may also be used. The invention is in no way limited to any particular data structures, order, or arrangement of information in the trigger store 44.
What has been described is merely illustrative of the application of the principles of the invention. Other arrangements and methods can be implemented by those skilled in the art without departing from the scope of the present invention.
For example, embodiments of the invention preferably do not preclude full event logging according to conventional logging techniques. Per-session event logging may therefore be implemented in addition to full event logging, to permit more extensive logging of events in a communication network for diagnosis of equipment- or network-level failures which affect multiple communication sessions for instance. Similarly, a communication network may include different types of network elements, with some network elements supporting per-session event logging in accordance with embodiments of the invention and other network elements supporting only full event logging functionality. In the case of software-based per-session event logging, network elements may be configurable by software download to provide for per-session event logging.
When implemented in conjunction with full event logging, a per-session event logging system according to an embodiment of the invention may also search a full event log for previous events associated with a communication session for which a trigger is detected. This permits logging of a complete set of events for a communication session regardless of whether an event logging trigger is detected at the beginning of a communication session or at a later time. Timestamping and ordering of events in a full event log, for example, may facilitate this type of “retroactive” functionality.
It should also be appreciated that the invention is not limited to communication sessions involving signalling message exchange. Events and triggers need not necessarily be based on signalling messages.
