| Expansion of the scale of the software and Enterprise-class integration of software has brought higher requirements and greater challenges to system availability. How to position issue rapidly, when systems meet failure or abnormal, has become very important problem that large and medium-sized enterprises and software vendors are concerned about. This is not just to reduce the workload of system administrators, but also greatly improves the availability and maintainability of the software.In recent years, because of the open-source features, the Linux operating system has made rapid development and expansion. Linux-based software is also a large number of emerging, especially many large-scale management software. A current cost of the hardware needed eight in the cost of management, system maintainability of the system is the biggest problem, and a problem of system maintenance costs to a large extent depends on the quick resolution of the problem, which requires the issue accurate positioning. However, the current system needs most of the event log support staff, and even the developers only can understand and resolve. This increases the recovery time. This requires a unified event collection and analysis tools to deal with this problem.At present the main way of event analysis through the event correlation, analysis of the incident is event-related technology in the form of a difference. Event-related fault management is an emerging field, it adopted the event in time and space associated with the reduction of the number of events at same time, enhance the semantic events, help to identify the real causes of failure.A event of a system is a piece of information or an alarm when the system faces a unusual situation which present a description of a problem. Management system of Event analysis is responsible for the collection of these events, the system also can send these events to management system. Subsystem report of the event belong to a simple event, analysis by the event management system, in accordance with the knowledge gained from system, which some of the events associated together to form a more specific synthesis, the process is referred to as event correlation. At present, most of the technologies used in the event analysis is event related, the difference between the forms and methods. Through a variety of event correlation method of comparison, based on the code table of event correlation approach to the event analysis, the method not only understand the use of simple, and can be fuzzy decoding, this feature is very easy for a network fault and the delay, the environment of loss and reverse event.In this paper, based on the LINUX operating system, build a distributed event analysis system for centralized analysis of the subsystems event. Subsystem and analysis server exist in a LAN, the subsystem through the agent running on it , transfer the error message to the event server. Through the analysis of the results recorded in the database for user querying.Agent collected event by SEC (simple event corrector) open-source tools to log information acquisition subsystem. First of all the software used rule-based information collection, through the interface configuration files, a simple and convenient combination of agents, followed by SEC software very little consumption of resources, the subsystem can minimize the impact. SEC software functions very powerful, has a lot of system integration software, stability can be guaranteed. Actually agent is a SOAP client, make SOAP communication with the server, software agents will be responsible for transfer the wrong messages that collected from the log file by SEC, to the server.In this paper establish the hierarchical model of analysis server, the hierarchical structure of software modules can guarantee the independence and reusability of modules. Using a method of combination of codebook and cause pool for event analysis. By reducing unsuitable causes in pool, the remaining is the final analysis. the cause pool is actually a space of memory. pool information has the format specified. By introduced IPC::Shareable memory management module to complete the operation, the advantages of the use of the module system need not to care and manage the memory, only need to pass parameters to the module and everything will be automatically completed. this system can concentrate on the pool format and content of content management. Finally a fixed algorithm causes probability calculation is not only qualitative analysis and quantitative analysis can be completed. And the outcome of the analysis is based on the original events, and user-friendly for confirmation.In this paper, I design eight modules of the event analysis system, including the event agent modules: responsible for handling the event, database logic module: the logic functions of the database, the event receiver module: responsible for the collection of events inspection, event recognition module: to identify knowledge of the event. pool management module: the operation of the pool. correlate analysis module: calculate the results, results handling module: record result of the analysis, transaction control modules: the whole business work process, and then given implement of the function of each module.I established a true event analysis and test environment, two nodes as agents, the two agents are heterogeneous system for more representative. The establishment of a shell script is to complete the implementation of multiple test cases to ensure that the human factor will not affect the results of tests. Last, through analyzing the test results, determine that the event analysis system completed the design goal of function and performance.Finally, a summary of this paper, give the importance and necessity of event analysis, at home and abroad on the popular open-source and commercial events and log analysis software, and then introduced the principle of event analysis, event analysis and event correlation technology. A comprehensive analysis reveals the event in the subsystem research in the field of analysis is not yet in-depth, and there is no good solution. But this is now an urgent issue can not be avoided. Fault analysis of the subsystem and the positioning is a relatively new field, in the application of theoretical analysis and realize there are some problems exist to continue to study. The system is the need to improve some shortcomings, and gives an improved point. |
