JP2003186702A - Terminal operation monitoring system and terminal operation monitoring method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To intensively monitor an operation status of a PC terminal connected to a network, to detect an abnormality to give an impact on the operation status and infection by a computer virus in their early stages, and to operate a whole network to which a plurality of terminals are connected in safety and stability. <P>SOLUTION: A monitor server 10 to monitor a plurality of PC terminals 12 and a server 13 is connected to the network to which the plurality of the PC terminals 12 and the server 13 are connected. The monitor server polls the plurality of terminals and the servers and reads data, and detects the abnormality on the plurality of the PC terminals 12 and the server 13 based on this data. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a terminal operation monitoring system and a terminal operation monitoring method, and is particularly suitable for application to management of system operating states of terminals and servers connected to a network.

[0002]

2. Description of the Related Art Conventionally, regarding terminals such as personal computers (PCs) connected to a network, the management of their operating states has been entrusted to the users of the respective terminals.

However, with recent technological advances in the hardware of PCs, the hardware configuration of PCs used as network terminals has become extremely complicated.

In order to operate these PC terminals, the control process of the operating system installed in the auxiliary storage device (hard disk) of the PC terminal is becoming complicated. Also,
At the same time, various programs are prepared for the operating system in order to continue the operation of the PC terminal. Therefore, the operation of the PC is unlikely to occur abnormally unless the user makes a large operation error or uses it excessively.

That is, in the conventional PC terminal, even when a failure occurs such that the input cannot be accepted, the user recognizes the failure and restarts the system.

However, it is unlikely that an immediate failure will occur due to a memory leak due to a bug in an application, etc. However, if the PC terminal continues to operate, an abnormality that causes a major failure occurs. There is.

It is difficult for the user to detect in advance such a hidden abnormality that does not occur as an immediate failure. Therefore, it is only possible to deal with the problem after the failure actually occurs, or the user must monitor the usage rate of the memory and take other measures.

[0008]

Therefore, when a slight abnormality occurs inside the PC terminal, the PC cannot be used during use.
However, even if there is a hidden abnormality that causes abnormal termination of the system, it is rarely recognized by the user.

Further, even when these PC terminals are infected by a computer virus and have not developed,
The user may not be able to recognize that the computer virus has infected the PC terminal.

In this case, a computer virus may spread from the PC terminal to the entire network and infect other PC terminals. In this case, not only the PC terminal alone, but also the entire network, such as the server managing this network and the terminals connected to the network, will be greatly affected.

Therefore, in advance, it is necessary to intensively predict the occurrence of a failure in the entire network and perform preventive maintenance to maintain a normal operating state. However, as described above, although there is no immediate failure, there is a problem that it is not possible to deal with an abnormality that causes a failure when the operation is continued until the failure occurs.

Therefore, an object of the present invention is to be able to centrally monitor the operating status of terminals connected to a network, and to detect abnormalities affecting the operation of terminals and computer virus infections at an early stage. It is possible to provide a system and method for monitoring the operation of a terminal, capable of stably operating the entire network to which a plurality of terminals are connected.

[0013]

In order to achieve the above object, a first invention of the present invention is for monitoring a network to which a plurality of terminals and a server are connected, for monitoring the plurality of terminals and the server. It is characterized in that a server is connected, a monitoring server circulates through a plurality of terminals and servers, reads data from the plurality of terminals and servers, and detects an abnormality in the plurality of terminals or servers based on the data. This is a terminal operation monitoring method.

According to a second aspect of the present invention, a monitoring server for monitoring a plurality of terminals and a server is connected to a network to which a plurality of terminals and a server are connected, and a plurality of servers are connected by the monitoring server. The terminal operation monitoring system is characterized in that the terminal and server are circulated to read data, and based on the data, an abnormality in a plurality of terminals or servers is detected.

In the present invention, typically, a monitoring center server in a monitoring center for centrally managing abnormality monitoring is connected to the network, and the monitoring server sends an electronic mail to the monitoring center server. Thus, the report data created from the data read from the plurality of terminals and the server is transmitted.

Further, in the present invention, typically,
When the monitoring server detects an abnormality in the operating state of a plurality of terminals, it sends an email notifying the existence of the abnormality to the management center server.

Further, in the present invention, it is preferable that the management center is provided with a maintenance staff terminal used by a maintenance staff who carries out an abnormality recovery work, and the monitoring server is a maintenance staff terminal. Notify the existence of anomalies in multiple terminals and servers.

Further, in the present invention, it is preferable that the patrol monitoring of abnormality in a plurality of terminals and servers is set to be performed at night.

In this invention, the network means
A network such as a local area network (LAN), a wide area network (WAN), the Internet, a single network such as an in-house LAN, or an LA.
A network configured by connecting a plurality of N, WAN, the Internet, and the like are also included.

According to the terminal operation monitoring system and the terminal operation monitoring method of the present invention configured as described above,
Although the failure does not occur immediately, it is possible to detect the occurrence of abnormalities that cause the failure if you continue operation. Therefore, detect the abnormalities that cause these before the failure occurs and suppress the occurrence of the failure. It becomes possible to do.

[0021]

DETAILED DESCRIPTION OF THE INVENTION An embodiment of the present invention will be described below with reference to the drawings. In all the drawings of the following embodiments, the same or corresponding parts are designated by the same reference numerals. FIG. 1 shows the overall configuration of a terminal operation monitoring system according to this embodiment.

As shown in FIG. 1, the terminal operation monitoring system according to this embodiment comprises a monitoring center 2 and a monitored system 3 connected to a network 1.

The network 1 is a local area network (LAN), a wide area network (WAN), the Internet, or the like. Through this network 1,
A plurality of terminals and a plurality of servers are configured to be able to communicate with each other.

The monitoring server 10 is for monitoring the monitored system 3, and is composed of at least the monitoring center server 4 and the maintenance person terminal 5.

In the terminal operation monitoring system according to this embodiment, a function of managing a failure of the terminal, a function of maintaining and managing the server, and a function of reporting the operation status of the server to the system administrator terminal. Have.

The monitoring target system 3 to be monitored for system abnormality by the monitoring center 2 is the network 1 whose abnormality is monitored by the monitoring server 10.
1, a PC terminal 12 used by each individual, a network 1
A server 13 on the server 1, a hub (HUB) 14 and a router 15 for connecting to the external network 1, a system administrator terminal 16 used by the system administrator to manage the system, etc. are connected.

The network 11 is connected to another network 17 via the router 15. In addition, to this network 17, via a router 18,
For example, a network 19 such as a LAN is connected. The network 19 is connected to a server 13 for an administrator who manages this network and a PC terminal 12.

The monitoring target system 3 according to this embodiment is configured as described above. The configuration of the monitored system 3 is merely an example, and is not necessarily limited to the above configuration.

The functional configurations of the monitoring center server 4 and the monitoring server 10 in the terminal operation monitoring system according to this embodiment will now be described. FIG. 2 shows the configurations of the monitoring center server 4 and the monitoring server 10.

As shown in FIG. 2, the monitoring center server 4 and the monitoring server 10 according to this embodiment include a monitoring function unit 31, a management function unit 32, and a browsing application 3.
3, the application processes 34a to 34d, and the management information database 35 are configured to be executable and controllable by the operating system 36.

The monitoring function unit 31 monitors the browsing application 33 such as a web browser and various processes and application processes constituting the platform,
This is a function for detecting abnormalities. In addition, the management function unit 3
Reference numeral 2 is a function for managing the various processes that make up the browsing application 33 and the platform and the dependency relationships between the application processes.

The browsing application 33 is an application for browsing, which is capable of executing a file in an HTML format, a script processing program, etc., and has a function of displaying a screen.

Further, the applications 34a to 34d
Are various processes and application processes that make up the platform, and are processes that provide platform functions and business functions. In this embodiment, the applications are mainly PF application process 34a, PF application process 34b, AP application process 34c, AP.
It is composed of an application process 34d.

Further, usually, the processes in the respective PF application processes 34a, 34b and the AP application processes 34c, 34d often have a mutual dependency relationship, and therefore it is assumed that there is a dependency relationship also here. To do.

The management information database 35 includes data of various processes constituting the browsing application 33 and the platform and dependency relationships among the application processes, and details of the PC failure, a cause of the PC failure, and a PC failure case including recovery support information. Information data of past PC failures in the monitored PC terminal is stored.

The operating system 36 is
It is a basic program for executing the respective functions of the monitoring center server 4 and the monitoring server 10. Each program installed in the auxiliary storage device (hard disk) by this operating system 36
Temporarily read to RAM (Random Access Memory),
The respective functions described above are executed on the system by being executed by the respective central processing units (CPU) of the monitoring center server 4 and the monitoring server 10. In addition,
Since other configurations are the same as those in the conventional art, detailed description will be omitted.

The monitoring center server 4 and the monitoring server 10 are configured as described above.

Of these, the monitoring server 10 uses the W through the network 11 of the PC terminals 12 to be monitored.
It is connected to a network 1 such as an AN. Further, the monitoring center server 4 and the maintenance staff terminal 5 are
It is connected to a network 1 such as an AN, and is configured to be able to send and receive various information to and from each other via the networks 1 and 11.

The monitoring server 10 is connected to the network 11 to which the server 13 to be monitored and the PC terminal 12 are connected. Then, the monitoring server 10 causes a failure of the server 13 or the PC terminal 12 on the network 11, an abnormal message of an operating system (OS) or middle software, an abnormal operation program, a computer virus infection, etc. (Collectively referred to as), and collects performance data, operation data including virus check, and resource data.

The monitoring server 10 monitors the PC failure of the server 13 and the PC terminal 12 by, for example, confirming the Ping response of the important equipment up to 10 nodes connected to the client server system.

The monitoring server 10 monitors the OS or middle software abnormal message for error messages by, for example, an event log monitoring program. Further, the monitoring server 10 monitors the business program for abnormalities by, for example, detecting a business abnormality message.

When the monitoring server 10 detects a PC failure, it generates a PC failure detection signal. The performance data is read by, for example, collecting hub MIB information and the like. In addition, the operation data is, for example, Pi of the reporting target node.
ng is used to monitor the operating time, and data is read based on the comparison result data with the virus information data relating to the transmitted and received files.
Further, the resource data can be obtained by reading out the server configuration, the client configuration, the network configuration, the facility / equipment configuration, the data resource, and the capacity / performance management data.

Then, the PC failure detection signal and the monitoring server 10 allow the respective servers 13 and PC terminals 1 to operate.
The performance data, the operation data, and the resource data read from No. 2 are supplied from the monitoring server 10 to the monitoring center server 4 via the network 11 and the network 1 sequentially.

The monitoring server 10 monitors the PC terminal 12 and the server 13 on the network 11 within a predetermined time (for example, 11:00 pm to 3:00 am the next night). Then, within a predetermined time,
When the monitoring of all the PC terminals 12 is completed, the function of monitoring the network 11 is automatically stopped.

On the other hand, the monitoring center server 4 installed in the monitoring center not only monitors the PC terminal 12 and the server 13 connected to the network 11, but also the PC terminal 12 and the server 13 connected to the network 19. To do.

The monitoring center server 4 is connected to the network 1 such as WAN. When the performance data, operation data, and resource data collected by the monitoring server 10 are supplied from the monitoring server 10, performance diagnosis processing is performed based on these data.

Further, the monitoring center server 4 is configured to grasp the operating status and resource status of each PC terminal 12 and the server 13 and create these reports as report data.

Then, the monitoring center server 4 sends the created report data to the system administrator terminal 16 by, for example, electronic mail. As a result, the system administrator can grasp the performance diagnosis, operating status, and resource status of each PC terminal 12 and server 13 connected to the network 11 through the system administrator terminal 16.

On the other hand, the monitoring center server 4 supplied with the PC failure detection signal from the monitoring server 10 is the server 13
The PC fault is notified to the system administrator terminal 16. At the same time, the monitoring center 2 analyzes the contents of the supplied PC failure, investigates the cause, and creates recovery support information such as a method for recovering the PC failure.

Then, in the monitoring center server 4,
The contents, causes, and recovery support information of these PC failures are converted into data and stored as PC failure case data in the management information database described later in the monitoring center server 4.

Further, in the monitoring server 10 as well, the contents, cause and recovery support information of the PC failure are supplied from the monitoring center server 4 as PC failure case data. Then, the PC failure case data is stored in the management information database 35 of the monitoring server 10.

Then, the monitoring server 10 uses the PC failure case data stored in the management information database to analyze the PC failures whose causes extend over a plurality of factors by classifying the failure types. Is possible. As a result, the recovery support information can be easily found even in the case of a complicated PC failure. Further, recovery from a PC failure in the PC terminal 12 is controlled by remote control.

Further, the monitoring center server 4 notifies the maintenance person terminal 5 of the information data of the PC failure by using an electronic mail or the like. In addition to this PC fault information data, by notifying the recovery support information, it is possible to refer to subsequent measures.

Further, the monitoring center server 4 further manages the history of PC failures in the server 13 and the PC terminal 12, and manages the performance of the server 13 and the PC terminal 12. Then, if necessary, the consulting information accompanying the change of the server 13 and the PC terminal 12 is provided. As a result, it is possible to provide the information regarding the modification work of the system accompanying the change of the server and the information necessary for the technical meeting.

The maintenance personnel terminal 5 is installed at the maintenance location of the monitoring center 2. When the PC failure occurs in the PC terminal 12 within the area in charge,
Personnel in charge of coping with the occurrence of C failure are resident.

The maintenance staff terminal 5 is connected to the network 1 and receives the report data, the PC failure detection data and the recovery support information data from the monitoring server 10 from the monitoring center server 4. Obtainable. The recovery support information includes information that supports on-site recovery work by e-mail or an electronic bulletin board, information necessary for recovering a system disk failure, information necessary for recovering user data, and the like.

Next, a monitoring method by the terminal operation monitoring system according to this embodiment will be described with reference to a flowchart. FIG. 3 shows an operation process of this terminal operation monitoring system.

As shown in FIG. 3, in the terminal operation monitoring system according to this embodiment, first, step ST
1, the monitoring server 10 performs patrol monitoring of each PC terminal 12 and the server 13 via the network 11. As a result, the communication state of each PC terminal 12 and server 13 connected to the network 11 is confirmed.

Then, in step ST2, it is determined whether or not the monitoring time is within the patrol monitoring time. If it is within the patrol monitoring time, specifically, the patrol monitoring time is set at night, for example, between 11:00 pm and 3:00 am the next day, and the time of the internal clock of the management server 10 is
If it is during this time, the process proceeds to step ST3.
On the other hand, when the time of the clock in the computer in the monitoring server 10 is not within the patrol monitoring time, step ST1
Move to 1. It should be noted that the monitoring server 10 is set to periodically access a predetermined site and set the time of the internal clock to the standard time of the place where this system is installed.

If it is within the patrol monitoring time, step ST
In 3, the monitoring server 10 collects performance data of the PC terminal 12 and the server 13. Then, in step ST4, the monitoring server 10 collects operation data of the PC terminal 12 and the server 13. Subsequently, in step ST5, the monitoring server 10 sets the PC terminal 12
And the resource data of the server 13 is collected. Then, it transfers to step ST6.

In step ST6, it is determined whether or not it is the reporting time. If it is the reporting time, the process proceeds to step ST7. If it is not the reporting time, the process proceeds to step ST14.

The process of the monitoring server 10 is step ST.
In the case of shifting to 7, the monitoring server 10 activates the e-mail application and sends the collected various data to the monitoring center server 4 by e-mail.

The monitoring center server 4, which has received various data relating to the PC terminal 12 and the server 13 by e-mail from the monitoring server 10, reports the performance, operation, resources, and failure status of the PC terminal 12 and the server 13. Create data for. Then, it transfers to step ST8.

In step ST8, the monitoring center server 4 sends the created report data to the maintenance staff terminal 5 by, for example, electronic mail. Subsequently, in step ST9, the created report data is transmitted to the PC terminal 12 and the system administrator terminal 16 of the server 13. After that, the process proceeds to step ST1 and the processes according to the flowchart are sequentially performed.

On the other hand, if it is not the reporting time in step ST6, the process proceeds to step ST14, and the PC failure is monitored by the monitoring server 10 in the PC terminal 12 and the server 13 connected to the network 11.

Then, in step ST15, the PC
A determination is made as to whether a failure has been detected. Where P
When the C fault is detected, the process proceeds to step ST16,
On the other hand, if the PC failure is not detected, the process returns to step ST1 and the processes according to the flowchart are sequentially performed again.

When a PC failure is detected and the process proceeds to step ST16, the monitoring server 10 sends an e-mail, for example, to notify the monitoring center server 4 that a PC failure has occurred. After that, in step ST17, the maintenance personnel terminal 5 is connected to the PC in the monitored system.
Notify that a failure has occurred.

Subsequently, in step ST18, the PC
The PC fault is notified to the system administrator terminal 16 of the network 11 to which the terminal 12 and the server 13 are connected, for example, by e-mail.

Then, in step ST19, the person in charge of the monitoring center 2 who has received and viewed these e-mails analyzes the contents of the PC failure and investigates the cause, and the monitoring center server 4 causes the PC failure. The recovery operation is remotely controlled with respect to the corresponding PC terminal 12 or server 13 in which the error has occurred.

Thereafter, in step ST20, the monitoring center server 4 notifies the maintenance staff terminal 5 of the on-site dispatch of the recovery operation staff (maintenance staff) by, for example, electronic mail.

After that, the process proceeds to step ST21, in which the failure content analysis, the cause investigation, and the recovery method are performed from the maintenance staff terminal 5 to the monitoring center server 4, the monitoring server 10, and the system administrator terminal 16, respectively. And send the resulting report data. The monitoring center server 4 and the monitoring server 10 that have received the report data store this report data in the management information database 35, and the subsequent PC
It can be referred to when the PC failure in the terminal 12 and the server 13 is recovered. Then, it returns to step ST1 and the process according to the above-mentioned flowchart is performed.

In the above-described embodiment, the PC
The terminal operation monitoring system for monitoring the terminal 12 and the server 13 and the monitoring server 10 have been described.
A computer-readable recording medium (for example, a CD, which records a program for causing a computer to execute a function of managing a PC failure of the terminal 12 and the server 13 and a function of maintaining and managing the PC terminal 12 and the server 13.
-ROM, DVD-ROM, etc.).

By using a recording medium storing this program, the personal computer can be made to function as the monitoring server 10. that time,
If necessary, one P from among the plurality of PC terminals 12
It is also possible to use the C terminal 12 as the monitoring server 10.

Although one embodiment of the present invention has been specifically described above, the present invention is not limited to the above-mentioned embodiment, and various modifications can be made based on the technical idea of the present invention. is there.

For example, the configuration of the monitored system described in the above embodiment is merely an example, and a system configuration different from this may be used if necessary.

[0076]

As described above, according to the present invention, the operating state of the terminal or server connected to the network is monitored, and when an abnormality is detected, the terminal for the administrator and the terminal for the maintenance person are displayed. By transmitting the occurrence of abnormalities by e-mail, it is possible to centrally monitor the operating status of terminals connected to the network, and to detect abnormalities that affect the operation of terminals and computer virus infections.
It can be discovered early and the whole network to which multiple terminals are connected can be operated stably.

[Brief description of drawings]

FIG. 1 is a block diagram showing an entire terminal operation monitoring system according to an embodiment of the present invention.

FIG. 2 is a functional block diagram showing a monitoring server and a monitoring center server of the terminal operation monitoring system according to the embodiment of the present invention.

FIG. 3 is a flowchart chart for explaining a terminal operation monitoring method according to an embodiment of the present invention.

[Explanation of symbols] 1,11,17,19 ・ ・ ・ Network 2 ... Monitoring center 3 ... Monitored system 4 ... Monitoring center server 5: Terminal for maintenance staff 10 ... Monitoring server 12 ... PC terminal 13 ... server 14 ... Hub 15 ... Router 16 ... Terminal for system administrator 18 ... Router 31 ... Monitoring function unit 32: Management function unit 33 ... Viewing application 34a to 34d ... Application process 35 ... Management information database 36 ... Operating system

   ─────────────────────────────────────────────────── ─── Continued front page    F term (reference) 5B042 GA12 GA36 GC10 JJ02 KK12                       LA20 MA08 MA09 MC17 MC33                       NN56                 5B076 FD08                 5B085 AC11 AC13 AC14 BA06 BE07                 5B089 GA11 GA21 JA35 JB17 KA12                       KB04 LA01 MC01

Claims (10)

[Claims] 1. A monitoring server for monitoring the plurality of terminals and the server is connected to a network to which the plurality of terminals and the server are connected, and the monitoring server connects the plurality of terminals and the server. A terminal operation monitoring method of cyclically reading data from the plurality of terminals and the server, and detecting an abnormality in the plurality of terminals or the server based on the data. 2. A monitoring center server in a monitoring center for centrally managing the monitoring of the abnormality is connected to the network, and the monitoring server sends the monitoring center server to the monitoring center server by e-mail. The terminal operation monitoring method according to claim 1, wherein report data created from the data read from a plurality of terminals and the server is transmitted. 3. The monitoring server according to claim 2, when the monitoring server detects an abnormality in the operating state of the plurality of terminals, sends an email notifying the presence of the abnormality to the management center server. Terminal operation monitoring method. 4. The management center is provided with a maintenance staff terminal used by a maintenance staff who performs the recovery work of the abnormality, and the monitoring server uses the maintenance staff terminal as the plurality of terminals. The terminal operation monitoring method according to claim 2, wherein the presence of an abnormality in the server is notified. 5. The terminal operation monitoring method according to claim 1, wherein the patrol monitoring for abnormality in the plurality of terminals and the server is set to be performed at night. 6. A monitoring server for monitoring the plurality of terminals and the server is connected to a network to which the plurality of terminals and the server are connected, and the monitoring server includes the plurality of terminals and the server. A terminal operation monitoring system which circulates a server, reads data from the plurality of terminals and the server, and detects an abnormality in the plurality of terminals or the server based on the data. 7. A monitoring center server in a monitoring center that centrally manages the monitoring of the abnormality is connected to the network, and the monitoring server sends the monitoring server to the monitoring center server by e-mail. 7. The terminal operation monitoring system according to claim 6, which transmits report data created from the data read from a plurality of terminals and the server. 8. The monitoring server according to claim 7, when the monitoring server detects an abnormality in the operating state of the plurality of terminals, sends an email notifying the presence of the abnormality to the management center server. Terminal operation monitoring system. 9. The management center is provided with a maintenance staff terminal used by a maintenance staff who performs the recovery work of the abnormality, and the monitoring server uses the maintenance staff terminal as the plurality of terminals. The terminal operation monitoring system according to claim 7, which notifies that there is an abnormality in the server. 10. The terminal operation monitoring system according to claim 6, wherein the patrol monitoring of abnormality in the plurality of terminals and the server is set to be performed at night.