JP2006203276A - Traffic monitoring system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a traffic monitoring system for collecting traffic information of nodes in a network management network that efficiently uses a plurality of monitors and for being able to warrant continuity of the traffic information under collection even on the occurrence of a fault in any of the monitors. <P>SOLUTION: Upon receipt of a collection request of traffic information of a node such as a node 6<SB>1</SB>from a user, a manager 36 assigns a monitor with a lightest load such as a monitor 37<SB>1</SB>to a main collection monitor, a monitor whose load is second highest such as a monitor 37<SB>2</SB>to an auxiliary collection monitor, and allows both the monitors to execute the traffic collection of the node 6<SB>1</SB>, the main monitor 37<SB>1</SB>stores the traffic information collected as the main monitor to a main storage device 25<SB>1</SB>and thereafter stores the information to an auxiliary storage device 4<SB>1</SB>, and the auxiliary monitor 37<SB>2</SB>stores the traffic information as the auxiliary monitor only in a main storage device 25<SB>2</SB>and does not store the information in an auxiliary storage device 4<SB>2</SB>. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a traffic monitoring system for collecting traffic of nodes (network elements) in a network management network. Specifically, the present invention relates to a continuity assurance technique for traffic information being collected when a monitor failure occurs in a traffic monitoring system.

FIG. 12 is a diagram showing an example of a conventional traffic monitoring system together with a network node and a user system. In FIG. 12, 1 is an example of a conventional traffic monitoring system, 2 is a manager device (hereinafter referred to as a manager), 3 ₁ , 3 ₂ and 3 _n are monitor devices under the manager 2 (hereinafter referred to as a monitor). . The monitors 3 _{3 to} 3 _n-1 are not shown.

Reference numerals 4 ₁ , 4 ₂ , and 4 _{n denote} auxiliary storage devices (for example, hard disk devices) that are external storage devices used by the monitors 3 ₁ , 3 ₂ , and 3 _n , and the monitors 3 _{3 to} 3 _n-1 are provided. The auxiliary storage devices 4 ₃ to 4 _n-1 are not shown.

Reference numeral 5 denotes a network to be monitored by the traffic monitoring system 1, and 6 _{1 to} 6 _m are nodes of the network 5. Reference numeral 7 denotes a user system used by a user who uses the traffic monitoring system 1.

In this example, the traffic monitoring system 1 has one manager 2 and n monitors 3 _{1 to} 3 _n , forms a network management network with the network 5, and the manager 2 includes monitors 3 ₁ to 3 ₁ . 3 _n and nodes 6 _{1 to} 6 _m are managed, and control is performed to collect traffic with no load leakage and load distribution. Monitors 3 _{1 to} 3 _n collect traffic of nodes assigned from manager 2 without duplication. I do.

FIG. 13 is a schematic block circuit diagram of the conventional traffic monitoring system 1 shown in FIG. In Figure 13, the manager 2, 9 a communication unit for communicating with the monitor 3 ₁ to 3 _n, 10 is a monitor management unit for managing the monitor 3 ₁ to 3 _n, 11 monitor 3 ₁ to 3 _n A monitor failure monitoring unit 12 for managing the state monitoring and the load status, and a monitor allocation unit 12 for allocating a monitor for collecting traffic of the node requested by the user.

  Further, 13 is a data management unit, 14 is a main storage device, 15 is an auxiliary storage device, 16 is a user interface communication unit for communicating with the user system 7, 17 is a user request reception unit that receives a request from the user, 18 Is a data reference part.

In the monitors 3 ₁ , 3 ₂ , 3 _n , 19 ₁ , 19 ₂ , 19 _n are communication units for communicating with the manager 2, and 20 ₁ , 20 ₂ , 20 _n are monitors assigned by the manager 2. Node communication units 21 ₁ , 21 ₂ , 21 _n for performing communication are node management units for managing the nodes, 22 ₁ , 22 ₂ , 22 _n are node fault monitoring units, 23 ₁ , 23 ₂ , 23 _n Is a traffic collector. Reference numerals 24 ₁ , 24 ₂ , and 24 _{n denote} data management units, and 25 ₁ , 25 ₂ , and 25 _{n denote} main storage devices that are internal storage devices. Monitors 3 _{3 to} 3 _{n-1 (} not shown) are similarly configured.

  In the traffic monitoring system 1 configured as described above, the manager 2 receives a node traffic collection request from the user via the user interface communication unit 16 at the user request reception unit 17 and the node requested by the user The monitor allocation unit 12 is requested to allocate a monitor for collecting the traffic.

In response to the monitor allocation request, the monitor allocation unit 12 acquires load information from the monitor failure monitoring unit 11 that manages the status monitoring of the monitors 3 _{1 to} 3 _n and the load status, and among the monitors 3 _{1 to} 3 _n The monitor 3 _k having the lowest load is allocated, and a traffic collection request is transmitted from the communication unit 9 to the monitor 3 _k .

The communication unit 19 _k of the monitor 3 _k which has received the traffic collection request, activates the traffic collecting portion 23 _k, the traffic collection unit 23 _k performs traffic collection node via the node communication unit 20 _k. The acquired traffic information is accumulated in the auxiliary storage device 4 _k by the data management unit 24 _k .

Note that when a failure occurs in communication with a node that is collecting traffic, the node failure monitoring unit 22 _k of the monitor 3 _k detects the failure. The monitor failure monitoring unit 11 of the manager 2 periodically communicates with all the monitors 3 _{1 to} 3 _n via the communication unit 9 to monitor the failures of all the monitors 3 _{1 to} 3 _n .

FIG. 14 is a diagram showing another example of a conventional traffic monitoring system together with a network node and a user system. In FIG. 14, reference numeral 27 denotes another example of a conventional traffic monitoring system. The traffic monitoring system 27 corresponds to each monitor 3 _i (where i = 1, 2,..., N) and monitors 28 having the same configuration. formed by providing a _i, 1: 1 is a traffic monitoring system hot standby system configuration. Reference _numeral 29 _i denotes an auxiliary storage device (for example, a hard disk device) which is an external storage device used by the monitor 28 _i .

Conventional traffic monitoring system 27 shown in FIG. 14, of the monitor 3 _i, 28 _i paired, for example, with operating the monitor 3 _i as the main system, the monitor 3 of the main system monitor 28 _i as the standby system _i and in the standby state while performing the same operation, if the monitor 28 _i of the standby may be held always in the same state as the monitor 3 _i of the main system, a failure in the monitor 3 _i of the main system has occurred, The primary monitor 3 _i and the standby monitor 28 _i are immediately switched.

FIG. 15 is a diagram showing still another example of a conventional traffic monitoring system together with a network node and a user system. In FIG. 15, reference numeral 31 denotes still another example of the conventional traffic monitoring system. The traffic monitoring system 31 is provided with one monitor 32 as a standby system monitor corresponding to all the monitors 3 _{1 to} 3 _n. , N: 1 configuration cold standby traffic monitoring system. Reference numeral 33 denotes an auxiliary storage device (for example, a hard disk device) which is an external storage device used by the monitor 32.

In the conventional traffic monitoring system 31 shown in FIG. 15, since n monitors 3 _{1 to} 3 _n are made redundant by one monitor 32, the main system monitors 3 _{1 to} 3 _n and the standby system monitor 32 are connected. Without synchronization, the standby monitor 32 is operated after a failure occurs in any of the primary monitors 3 _{1 to} 3 _n , and information on the failed primary monitor is sent to the standby monitor 32. After the takeover, the main monitor and the standby monitor 32 in which a failure has occurred are switched.
JP 2000-349801 A JP 2000-31866 A

Conventional traffic monitoring system shown in FIG. 14. 27, the main system and the monitor 3 ₁ to 3 _n and monitor many standby system, along with the necessary introduction of devices such as a shared disk device, a monitor 3 ₁ to the main system An expensive tool for synchronizing data between 3 _n and the standby system monitor is also required, and the entire system is very expensive.

In addition, since the conventional traffic monitoring system 31 shown in FIG. 15 activates the standby monitor 32 after a failure occurs in any of the main monitors 3 _{1 to} 3 _n , traffic information for at least one cycle is stored. It has the problem of being missing. For example, the traffic information such as the number of packet transmission / reception indicates an increase / decrease value obtained by taking the difference between the latest collected value and the collected value of the previous cycle, but such data requires the collected value of the previous cycle, If the collected value of the previous cycle does not exist in the standby monitor 32, two cycles cannot be displayed to the user.

  In view of this point, the present invention provides a traffic monitoring system that can efficiently use a plurality of monitors and guarantee the continuity of traffic information being collected even when a failure occurs in the monitors. The purpose is to do.

  The present invention relates to a request from a user in a traffic monitoring system having a manager, a plurality of monitors for collecting traffic of nodes in the network management network under the manager, and an external storage device provided for each monitor. On the other hand, the manager assigns the monitor with the lowest load to the main collection monitor, the monitor with the next lowest load to the auxiliary collection monitor, and executes the traffic collection of the node requested by the user. The main collected traffic information is stored in the internal storage device and the external storage device, and the auxiliary collection monitor stores the auxiliary collected traffic information only in the internal storage device.

  In the present invention, the auxiliary collection monitor performs auxiliary collection of the traffic information of the node requested by the user simultaneously with the main collection monitor, and stores the auxiliary collected traffic information in the internal storage device. Therefore, even if a failure occurs in the main collection monitor, the continuity of the traffic information being collected can be guaranteed by the traffic information stored in the internal storage device of the auxiliary collection monitor. Moreover, the auxiliary collection monitor stores traffic information only in its internal storage device. Therefore, the auxiliary collection monitor can perform main collection of other nodes, and a plurality of monitors can be used efficiently.

(Configuration of one embodiment of the present invention)
FIG. 1 is a schematic block circuit diagram showing an embodiment of the present invention together with a network node and a user system. In FIG. 1, 35 is an embodiment of the present invention, 36 is a manager, and 37 ₁ , 37 ₂ , and 37 ₃ are monitors under the manager. The monitors 37 _{4 to} 37 _n are not shown. Reference numeral 5 denotes the above-described network, 6 ₁ , 6 ₂ , 6 ₃ , and 6 _m denote nodes of the network 5, and 7 denotes a user system used by the user.

That is, an embodiment 35 of the present invention has a single manager 36 and n stand monitor 37 ₁ to 37 _n, to form a network management network with the network 5, manager 36, a monitor 37 ₁ To 37 _n and the nodes 6 _{1 to} 6 _m are managed, and control is performed to collect traffic with no load leakage and load distribution. The monitors 37 _{1 to} 37 _n are traffic of nodes allocated without duplication from the manager 36. Collect.

  The manager 36 is provided with a monitor management unit 38 having a configuration different from that of the conventional monitor management unit 10 shown in FIG. 13, and the others are configured in the same manner as the conventional manager 2 shown in FIG. The monitor management unit 38 is provided with a monitor switching request unit 39, and is otherwise configured in the same manner as the conventional monitor management unit 10 shown in FIG.

Each monitor 37 _i is provided with a monitor switching response unit 40 _i , and the others are configured in the same manner as the conventional monitor 3 _i shown in FIG. All the monitors 37 _{1 to} 37 _n perform time synchronization using NTP (Network Time Protocol) or the like.

(Operation example of one embodiment of the present invention)
One embodiment 35 of the present invention operates as follows. (1) manager 36, (in this example, node 6 ₁ to) certain node from the user collection request traffic information, accepted at the user request receiving unit 17 via the user interface communication unit 16, the node It requests the monitor allocation unit 12 in the monitor manager 38 the allocation of the monitor for _61.

(2) monitor allocation unit 12 which receives the monitor assignment request to the node ₆₁ obtains the load information from the monitor failure monitoring unit 11 that all monitors 37 ₁ to 37 _n of the condition monitoring and managing the load situation (in this example, the monitor 37 ₁₎ the main collector monitors the lowest monitor load for node ₆₁ assigned to further load the next lower monitor auxiliary collector monitors (this example for node ₆₁ includes a monitor 37 ₂ ), and the monitor allocation information is stored in the data management unit 13.

(3) manager 36, after assignment of the monitor with respect to node ₆₁ requests the main collection settings node ₆₁ traffic information via the communication unit 9 to the monitor 37 _1, further to the monitor 37 ₂ via the communication unit 9 to request the auxiliary collection settings node ₆₁ traffic information Te.

(4) traffic collecting portion 23 ₁ of the monitor 37 ₁ which has received the request of the main collection setting traffic information of the node 6 ₁ from the manager 36 determines that the main collection setting request node ₆₁ traffic information, the node communication unit via 20 ₁ starts collecting periodically traffic information from the node _61, after storing the collected traffic information in the main memory 25 ₁ as the latest data, it is stored in the auxiliary storage device 4 _1.

(5) traffic collecting portion 23 ₂ of the monitor 37 ₂ which has received the request for supplementary collection settings from the manager 36 node ₆₁ traffic information, it is determined that the request for the auxiliary collection settings node ₆₁ traffic information, node communication part 20 ₂ starts collecting periodically traffic information from the node ₆₁ via the, the collected traffic information stored main memory 25 ₂ only as the latest data, performed storage in the auxiliary memory 4 ₂ Absent.

(6) Next, (in this example, a node 6 ₂₎ another node in response to a request from the user when there is a collection request traffic information for the same procedure as above (1) to (5) are performed. That is, the monitor allocation unit 12 of the manager 36 assigns to each monitor 37 ₁ to 37 _n main collector monitors the lowest monitor load for the node 6 ₂ look at the load state of (in this example, the monitor 37 _2), further, the load (in this example, the monitor 37 ₁₎ auxiliary collector monitors the next lower monitor for node 6 ₂ assigned to, to start collecting traffic information.

(7) Here, for example, when a failure occurs in the monitor 37 ₁ , the monitor failure monitoring unit 11 of the manager 36 periodically performs communication confirmation with all the monitors 37 _{1 to} 37 _n via the communication unit 9. To detect the failure of the monitor 37 ₁ and notify the user of the failure of the monitor 37 ₁ . At the same time, the monitor switch request unit 39 of the manager 36 requests the monitor 37 ₂ that the monitor 37 ₁ of the auxiliary collection fails, the main collection settings temporarily, node 6 ₁ Traffic Information .

(8) monitoring the switching request section 39 node ₆₁ traffic collecting portion 23 ₂ of the monitor 37 ₂ receives the request of the main collection setting traffic information from the manager 36, the node ₆₁ of the main collection setting request traffic information determined that, since the monitor 37 ₂ is already in the auxiliary collection node ₆₁ traffic information, the monitor switch responding unit 40 ₂ of the monitor 37 _2, the main collection state of the node ₆₁ traffic information from the auxiliary collection switching to the collection, to start the main collecting node 6 ₁ traffic information in the traffic collection unit 23 _2, and sends the response of the main collection setting completion node ₆₁ to the manager 36, and the collected node 6 ₁ traffic information Are stored in the auxiliary storage device 4 ₁ after being stored in the main storage device 25 ₁ .

(9) After receiving the response of the completion of the main collection setting of the node 6 ₁ from the monitor 37 ₂ , the manager 36 requests reassignment to the monitor allocating unit 12, and the node 6 ₂ that the monitor 37 ₁ has implemented. the auxiliary collecting traffic information (in this example, the monitor 37 ₃₎ monitor not subjected to primary collection of the most load is low and node 6 ₂ traffic information at this point assigned to the node 6 ₂ traffic information in order to perform an auxiliary collection of the monitor 37 ₂ that mainly collects requests the auxiliary collection settings node 6 ₂ traffic information to the monitor 37 ₃ instead of the monitor 37 _1.

(10) where the request from the user, during the failure period of the monitor 37 _1, when referring to the traffic information of the node ₆₁ performs the temporary node ₆₁ of the main collecting traffic information display traffic information accumulated in the monitor 37 ₂ are.

(11) Then, when a failure recovery monitor 37 ₁ occurs, monitor 37 _1, only the main collecting node 6 ₁ traffic information by the information holding resume auxiliary node 6 ₂ traffic information Collection does not resume. Then, the monitor failure monitor 11 of the manager 36 detects restoration of the monitor 37 ₁ by communication confirmation performed periodically performs matching traffic collection configuration information between manager 36 and the monitor 37 _1.

(12) After completion of matching between the manager 36 and the monitor 37 ₁ , the manager 36 confirms that the monitor 37 ₁ has collected the traffic information of the node 6 ₁ for one period in the monitor allocation unit 12, and then the monitor 37. to temporarily winding requesting node ₆₁ traffic information is mainly collected at _2.

(13) Monitor 37 ₂ receives the winding requesting node ₆₁ traffic information from the manager 36, the monitor switch response unit 40 _2, switch the main collection of the requested node 6 ₁ traffic information to assist acquisition, temporarily transmits the accumulated node 6 ₁ traffic information in the period that was mainly collected in the manager 36 as traffic winding response.

(14) manager 36 receives the take-up response from the monitor 37 ₂ Node 6 ₁ traffic information, failure to transmit the deployment request for the wound node 6 ₁ traffic information to monitor 37 ₁ recovered .

(15) Monitor 37 ₁ receives the deployment request from the manager 36 node ₆₁ traffic information, the traffic information of the data management unit 24 _first node ₆₁ prior to that monitor 37 ₁ of the failure held in the monitor 37 It combines the wound node ₆₁ traffic information from the _2, after stored in the auxiliary storage device 4 _1, transmits a response of expansion completion of the traffic information to the manager 36.

(16) manager 36, notification and winding temporarily mainly collected node 6 ₁ traffic information on the monitor 37 _2, after deployment completion of traffic information to the monitor 37 _1, a disaster recovery of the monitor 37 ₁ to the user To do.

(17) Then, in response to a request from the user, the monitor 37 after recovery ₁ failure, node 6 ₁ when referring to the traffic information, traffic information and the monitor node ₆₁ accumulated before failure occurs in the monitor 37 ₁ by combining the temporarily accumulated node ₆₁ traffic information 37 _2, displays the node 6 ₁ traffic information including failure period of the monitor 37 _1.

(Monitor allocation operation in the monitor allocation unit 12)
2 and 3 are flowcharts showing the monitor assignment operation of the monitor assignment unit 12 of the manager 36. FIG. The monitor allocation unit 12 acquires the number of monitors under the manager 36 from the monitor failure monitoring unit 11 and confirms the monitor state.

  When assigning the main collection monitor, the number of nodes collecting the main collection of each monitor (hereinafter referred to as the main collection number) is calculated, and the monitor with the minimum main collection number is set as the main collection monitor. assign. In addition, when assigning auxiliary collection monitors, the number of nodes that perform auxiliary collection for each monitor (hereinafter referred to as the number of auxiliary collections) is calculated on the monitor that is not assigned to the main collection monitor of the target node. Allocate a monitor with the minimum number of collections.

  Table 1 shows a data structure held by the data management unit 13 of the manager 36 regarding the monitor allocation information.

  The data structure shown in Table 1 includes, in addition to the conventional data structure “name of collecting node”, traffic information collection “cycle (seconds)”, “main collection monitor allocation information” Auxiliary collection monitor allocation information ", and a" monitor switching flag "that determines whether the monitor assigned to the main collection monitor is collecting main data or whether the monitor assigned to the auxiliary collection monitor is temporarily collecting main data Yes.

(Traffic information collection operation by monitor)
FIG. 4 is a flowchart showing an operation when the monitor 37 _i collects traffic information of the target node. That is, the main collecting traffic information of the target node by the monitor 37 _i, the node traffic information of the target node from the communication unit 20 _i was collected periodically, once after storing the collected traffic information to the main memory 25 _i, auxiliary This is done by accumulating in the storage device 4 _i .

In addition, the auxiliary collection of the traffic information of the target node by the monitor 37 _i periodically collects the traffic information of the target node from the node communication unit 20 _i, and the main storage device always collects only the latest one cycle of the collected traffic information. This is done by storing in 25 _i . When the auxiliary collection is temporarily switched to the main collection in response to a request from the manager 36, the collection state is changed from the auxiliary collection to the main collection.

Table 2 shows a data structure held by the data management unit 24 _i of the monitor 37 _i . The data structure shown in Table 2 includes, in addition to the existing data structure “name of collecting node”, “node information”, and traffic collection “cycle (seconds)”, as a new element. It has a “collection state” indicating whether it is a collection or an auxiliary collection.

(Sequence when a failure occurs in the monitor)
Figure 5 is a monitor that has a main receptacle and an auxiliary collection, for example, is a diagram showing a sequence for the monitor 37 ₁ fails. That is, when a failure occurs in the monitor 37 ₁ , the monitor failure monitoring unit 11 of the manager 36 periodically performs communication confirmation (survival confirmation) with all the monitors 37 _{1 to} 37 _n via the communication unit 9 of the manager 36. the request), detects a failure of the monitor 37 _1, and notifies the failure of the monitor 37 ₁ to the user.

Monitor switching request section 39 of the manager 36 at the same time, the node monitor 37 ₁ is performing the main collecting traffic information, for example, a monitor that node 6 _first auxiliary collection, for example, the monitor 37 _2, a temporary Request the main collection setting of traffic information.

Node 6 ₁ of the monitor 37 ₂ traffic collecting portion 23 ₂ which has received the request of the main collection setting traffic information from the manager 36 determines that the main collection setting request node ₆₁ traffic information, the monitor 37 ₂ already node because 6 is in _one of the auxiliary collection, switching the monitor switch response unit 40 ₂ of the monitor 37 ₂ mainly collect collection state of the node ₆₁ traffic information from the auxiliary collection, monitor 37 ₂ traffic collection unit 23 ₂ in start main collecting node 6 ₁ traffic information, and transmits the response of the main collection settings node ₆₁ traffic information to the manager 36.

Manager 36, after receiving the response of the main collection settings from the monitor 37 ₂ Node 6 ₁ traffic information, request a re-assignment to monitor allocation unit 12, an auxiliary collection of nodes that monitor 37 ₂ had done, for example, node 6 _first auxiliary collection, low and node ₆₁ of the monitor that has not been the main collection of the most loaded at this point, for example, assigned to the monitor 37 _3, for performing the main receptacle to which the monitor 37 _second auxiliary collection to, requests the setting of the auxiliary collecting the monitor 37 ₃ node 6 ₁ traffic information.

Monitor 37 ₃ receives the request for supplementary collection settings node ₆₁ traffic information, starts an auxiliary collection node ₆₁ traffic information, the response of the auxiliary collection settings node ₆₁ traffic information manager 36 Send. Manager 36, after receiving the response of the auxiliary collection settings from the monitor 37 ₃ Node 6 ₁ traffic information, the monitor mode switching flag held by the monitor allocation unit 12 to "Yes".

(Sequence when the failed monitor recovers)
Figure 6 is a monitor of a failure, for example, is a diagram showing a sequence for monitoring 37 ₁ has recovered. If the monitor 37 ₁ failed is restored, monitor 37 _1, the main collecting traffic information by the information holding had done before the failure node, for example, resume the main collecting node 6 ₁ Traffic Information . However, in this case, the monitor 37 _1, the auxiliary collecting traffic information of the node which has been performed before the monitor failure, for example, an auxiliary collection of nodes 6 ₂ traffic information is not resumed.

Monitor failure monitor 11 of the manager 36, the communication confirmation performed periodically (survival confirmation request) to detect the recovery of the monitor 37 _1, matching the management information relating to the collection of traffic information between manager 36 and a monitor 37 ₁ I do. Manager 36 sends the data integrity requirements to the monitor 37 ₁ has recovered and transmits a monitor 37 _1, data integrity response received data matching request to the manager.

After completion data matching between the manager 36 and the monitor 37 _1, monitor 37 _1, the node ₆₁ of the resumed main collecting traffic information, after successful initial main collected in the node ₆₁ of the traffic to the manager 36 Send an information collection confirmation notification. Manager 36 which has received the acquisition acknowledgment traffic information from the monitor 37 ₁ node 6 _1, temporarily winding requesting node ₆₁ traffic information is mainly collected by the monitor allocation unit 12, the node ₆₁ of the monitor is temporarily mainly collect traffic information, for example, transmits to the monitor 37 _2.

Monitor 37 ₂ receives the winding requesting node ₆₁ traffic information from the manager 36, the monitor switch responding unit 40 _2, switch the main collection of the requested node 6 ₁ traffic information to assist the collection, temporary node 6 ₁ traffic information accumulated during the period that was mainly collected in the manager 36 transmits the traffic winding response.

Manager 36 monitors 37 ₁ receives the deployment request node ₆₁ traffic information from the data management unit 24 nodes wound to have the traffic information and the monitor 37 _second before the failure of the node 6 ₁ held at ₁ after storing 6 ₁ traffic information combining (combining the data) to the auxiliary storage device 4 _first monitor 37 _1, it transmits the expansion response of node ₆₁ traffic information manager 36.

Manager 36, after receiving from the monitor 37 ₁ node 6 ₁ traffic deployment response, the monitor mode switching flag held by the data management unit 13 of the manager 36 in the "no", notifies the failure recovery of the monitor 37 ₁ to the user To do.

(Operation of the monitor failure monitoring unit 11)
FIG. 7 is a flowchart showing the operation of the monitor failure monitoring unit 11 of the manager 36. The monitor failure monitoring unit 11 transmits a survival confirmation request from the manager 36 to the monitors 37 _{1 to} 37 _n by periodically confirming the survival with all the monitors 37 _{1 to} 37 _n, and from the monitors 37 _{1 to} 37 _n to the manager 36. The statuses of the monitors 37 _{1 to} 37 _n are acquired by receiving the survival confirmation response to the.

  Then, the latest acquired state is compared with the previously acquired state, and if there is no change in the state, it is assumed that there is no state transition and no particular processing is performed. On the other hand, when there is a change from the previous state and a failure occurs, after the failure is notified to the user, the monitor switching request unit 39 is activated to request the collection switching of traffic information. When there is a change from the previous state and the failure is recovered, the monitor switching request unit 39 is activated to request winding and deployment of traffic information and notify the user of the failure recovery.

(Operation of the monitor switching request unit 39)
8 and 9 are flowcharts showing the operation of the monitor switching request unit 39 of the manager 36. When the monitor failure occurs, the monitor switching request unit 39 inquires the monitor allocation unit 12 when the failed monitor is collecting the traffic information of a certain node, and performs the auxiliary collection of the node. The main collection setting request is transmitted to the monitor, and after the main collection setting response is received from the monitor, the switching flag for the node held in the monitor allocation unit is changed to “present”.

  When the monitor in which the failure has occurred is performing auxiliary collection of the traffic information of a certain node, the monitor allocation unit 12 is requested to reassign the auxiliary collection monitor, and when a monitor to be newly collected is obtained. , A request for auxiliary collection setting is transmitted to the monitor, and a response for auxiliary collection setting is received from the monitor.

  Also, the monitor switching request unit 39 inquires of the monitor allocation unit 12 whether there is a temporarily collected monitor at the time of failure recovery, transmits a traffic information winding request to the monitor, and loads the traffic information winding. Receive response.

  After receiving the traffic information take-up response from the monitor, send a traffic information expansion request to the monitor that has recovered from the failure, and after receiving the traffic information expansion response, the monitor allocation unit 12 holds the node Change the switch flag to “None”.

(Operation of the monitor switching response unit 40 _i )
FIG. 10 is a flowchart showing the operation of the monitor switching response unit 40 _i of the monitor 37 _i . When the monitor switching response unit 40 _i receives the traffic information main collection setting request from the manager 36, the monitor switching response unit 40 _i switches the auxiliary collection of traffic information to the main collection and accumulates the traffic information in the auxiliary storage device 4 _i . Thereafter, a response of the main collection setting is transmitted to the manager 36.

Further, when receiving a traffic information take-up request from the manager 36, the monitor switching response unit 40 _i switches the main collection to the auxiliary collection and transmits the accumulated traffic information to the manager 36 as a take-up response. Further, when receiving the deployment request traffic information from the manager 36, the traffic information stored in the data management unit 24 _i, the traffic information that is temporarily stored which primarily collected by the auxiliary collector monitor the defect period And a traffic information expansion response is transmitted to the manager 36.

(Monitor removal sequence)
FIG. 11 is a diagram showing a reduction sequence of the monitor. Manager 36 in response to a request from the user, degrowth want to monitor, for example, a monitor that is performing an auxiliary collection of the monitor 37 _1, for example, requests the main collection settings traffic information on the monitor 37 _2. The manager 36 receives the response of the primary collecting set from the monitor 37 _2, the take-up request traffic information which primarily collected in the monitor 37 ₁ opportunity to further receive a collection confirmation notification.

Monitor 37 ₁ receives the winding request traffic information from the manager 36 stops the main collecting traffic information, and transmits the traffic winding responses accumulated traffic information manager 36. The manager 36 receives the response of the winding completion traffic information from the monitor 37 ₁ transmits a deployment request traffic information on the monitor 37 ₂ that started the main collecting traffic information.

Monitor 37 ₂ receives the deployment request traffic information from the manager 36 combines the information of the traffic information and the traffic-deficient periods are accumulated by the data management unit 24 _2, after storage to auxiliary storage 4 _2, manager 36 Sends a traffic information deployment completion response to. Manager 36 which has received the response of the completely deployed traffic information from the monitor 37 ₂ transmits a response to the monitor 37 ₁ of degrowth completion to the user.

(Organization of main operations of Embodiment 35 of the present invention)
The main operations of the embodiment 35 of the present invention are summarized as follows. (Operation 1) The manager 36 and the monitors 37 _{1 to} 37 _n constituting the embodiment 35 of the present invention for managing the nodes 6 _{1 to} 6 _m in the network management network are connected to the network 5.

(Operation 2) One embodiment 35 of the present invention collects traffic information regarding nodes 6 _{1 to} 6 _m to be managed in response to a request from a user, and the data management units 24 _{1 to} 24 _n of the monitors 37 _{1 to} 37 _n Accumulate the collected traffic information.

  (Operation 3) One embodiment of the present invention 35 starts the main collection and auxiliary collection of traffic information on two monitors at the same time when a request for traffic collection is received. In the main collection monitor, the collected traffic information is stored in the main storage device and then stored in the auxiliary storage device. In the auxiliary monitor, the collected traffic information is not stored in the auxiliary storage device but is stored only in the main storage device.

  (Operation 4) When a failure occurs in the monitor during the main collection of traffic information, the manager 36 detects the failure and temporarily starts the main collection in the auxiliary collection monitor instead of the main collection monitor in which the failure has occurred. Let

  (Operation 5) Upon recovery from the failure of the monitor that collected the main traffic information, the manager detects the recovery by checking the existence of the traffic, and temporarily collects the accumulated traffic information from the monitor that mainly collects the traffic information. Then, transfer it to the restored monitor, and fill in the missing section by filling it.

  (Operation 6) One embodiment 35 of the present invention displays the traffic information in the failure time zone of the failed monitor to the user without any loss at the time of reference request from the user after the failure of the failed monitor is recovered. .

  (Operation 7) One embodiment 35 of the present invention notifies the user of the occurrence of a monitor failure.

  (Operation 8) One embodiment 35 of the present invention notifies the user of recovery of the monitor failure.

  As described above, according to one embodiment 35 of the present invention, the auxiliary collection monitor simultaneously collects the traffic of the node requested by the user at the same time as the main collection monitor and stores the traffic information being collected in the main storage device. Store. Therefore, even if a failure occurs in the main collection monitor due to device replacement, device relocation, system update, system failure, etc., the traffic information stored in the main storage device of the auxiliary collection monitor The continuity of traffic information can be guaranteed.

  In addition, the auxiliary collection monitor stores traffic information only in its main storage device and not in its auxiliary storage device. Therefore, the auxiliary collection monitor can perform main collection of other nodes, and a plurality of monitors can be used efficiently. In other words, it is not necessary to adopt a conventional redundant configuration, and it is possible to guarantee the continuity of traffic information in the operation configuration of an existing traffic monitoring system, thereby obtaining the effect of low cost.

  In the embodiment 35 of the present invention, the auxiliary collection monitor has described the case where the auxiliary collected traffic information is stored in the main memory for the latest one cycle. One cycle or more may be stored in the main memory.

  Here, when the traffic monitoring system of the present invention is organized, the traffic monitoring system of the present invention includes at least the following traffic monitoring system.

  (Supplementary Note 1) In a traffic monitoring system having a manager, a plurality of monitors for collecting traffic of nodes in the network management network under the manager, and an external storage device provided for each monitor, a request from a user On the other hand, the manager assigns the monitor with the lowest load to the main collection monitor, the monitor with the next lowest load to the auxiliary collection monitor, and executes the traffic collection of the node requested by the user. A traffic monitoring system characterized in that main collected traffic information is stored in its internal storage device and its external storage device, and the auxiliary collection monitor stores the auxiliary collected traffic information only in its internal storage device.

  (Supplementary note 2) The traffic monitoring system according to supplementary note 1, wherein the auxiliary collection monitor retains the auxiliary collected traffic information for the latest one cycle.

  (Supplementary Note 3) When a failure occurs in the main collection monitor, the manager requests the auxiliary collection monitor to collect traffic information, and the auxiliary collection monitor collects traffic information from the manager. The traffic monitoring system according to appendix 1 or 2, wherein the main collected traffic information is stored in the internal storage device and the external storage device when requested.

  (Supplementary Note 4) The manager, when a failure occurs in the main collection monitor, assigns the traffic collection of the node that the main collection monitor is executing as an auxiliary collection monitor to another monitor. Or the traffic monitoring system of 2 description.

  (Supplementary Note 5) When the failure of the main collection monitor is recovered, the traffic information stored in the external storage device by the auxiliary collection monitor is combined with the traffic information stored in the external storage device by the main collection monitor. The traffic monitoring system according to supplementary note 3 or 4.

  (Appendix 6) When any of the plurality of monitors is to be removed, the monitor with the lowest load is selected, and the traffic information of the node accumulated in the reduction target monitor is transferred to the selected monitor, and the selection is performed. The traffic monitoring system according to claim 1, wherein main collection of traffic information of the node targeted by the reduction target monitor is started by the monitor that has been added.

  (Supplementary note 7) For the auxiliary collection of traffic information of a node that has been performed by the monitor to be removed, the monitor having the lowest load and that has not performed the main collection of traffic information of the node is selected, and the selected monitor 7. The traffic monitoring system according to appendix 6, wherein reallocation is performed for the auxiliary collection.

  (Supplementary note 8) The traffic monitoring system according to supplementary note 6, wherein the traffic information reference request from the user after the monitor is removed is displayed on the monitor at the relocation destination.

1 is a schematic block circuit diagram showing an embodiment of the present invention together with a network node and a user system. FIG. It is a flowchart which shows the monitor allocation operation | movement of the monitor allocation part of the manager with which one Embodiment of this invention is provided. It is a flowchart which shows the monitor allocation operation | movement of the monitor allocation part of the manager with which one Embodiment of this invention is provided. It is a flowchart which shows operation | movement when the monitor with which one Embodiment of this invention is provided collects the traffic information of an object node. In one Embodiment of this invention, it is a figure which shows the sequence when a failure generate | occur | produces in the monitor which is performing the main collection and the auxiliary | assistant collection. FIG. 6 is a diagram illustrating a sequence in a case where a monitor in which a failure has occurred is recovered from a failure in an embodiment of the present invention. It is a flowchart which shows operation | movement of the monitor failure monitoring part of the manager with which one Embodiment of this invention is provided. It is a flowchart which shows operation | movement of the monitor switching request | requirement part of the manager with which one Embodiment of this invention is provided. It is a flowchart which shows operation | movement of the monitor switching request | requirement part of the manager with which one Embodiment of this invention is provided. It is a flowchart which shows operation | movement of the monitor switching response part of the monitor with which one Embodiment of this invention is provided. It is a figure which shows the reduction sequence of the monitor with which one Embodiment of this invention is provided. It is a figure which shows an example of the conventional traffic monitoring system with the node of a network, and a user system. It is a schematic block circuit diagram of the conventional traffic monitoring system shown in FIG. It is a figure which shows the other example of the conventional traffic monitoring system with the node of a network, and a user system. It is a figure which shows the further another example of the conventional traffic monitoring system with the node of a network, and a user system.

Explanation of symbols

1 ... An example of a conventional traffic monitoring system 2 ... Manager 3 _i ... monitor 4 _i ... auxiliary storage device 5 ... network 6 _i ... node 7 ... User System 9 ... communication unit 10 ... monitor manager 11 ... monitor failure monitor unit 12 ... Monitor allocation unit 13 ... Data management unit 14 ... Main storage device 15 ... Auxiliary storage device 16 ... User interface communication unit 17 ... User request reception unit 18 ... Data reference unit 19 _i ... Communication unit 20 _i ... Node communication unit 21 _i ... Node Management unit 22 _i ... Node failure monitoring unit 23 _i ... Traffic collection unit 24 _i ... Data management unit 25 _i ... Main storage device 27 ... Other examples of conventional traffic monitoring system 28 _i ... Monitor 29 _i ... Auxiliary storage device 31 ... Still another example of conventional traffic monitoring system 32... Monitor 33... Auxiliary storage device 35. (Traffic monitoring system)
36 ... Manager _37i ... Monitor 38 ... Monitor management unit 39 ... Monitor switching request unit _40i ... Monitor switching response unit

Claims (5)

A manager device;
A plurality of monitoring devices for collecting traffic of nodes in the network management network under the manager device;
In a traffic monitoring system having an external storage device provided corresponding to each monitor device,
In response to a request from the user, the manager device assigns the monitor device with the lowest load to the main collection monitor device and the monitor device with the next lowest load to the auxiliary collection monitor device, and collects the traffic of the node requested by the user. And execute
The main collection monitoring device stores main collected traffic information in its internal storage device and its external storage device, and the auxiliary collection monitoring device stores auxiliary collected traffic information only in its internal storage device. And traffic monitoring system.   The traffic monitoring system according to claim 1, wherein the auxiliary collection monitoring device holds the auxiliary collected traffic information for only one latest period. The manager device requests main collection of traffic information from the auxiliary collection monitor device when a failure occurs in the main collection monitor device,
The auxiliary collection monitor device stores the main collected traffic information in the internal storage device and the external storage device when the manager device requests the main collection of traffic information. 2. The traffic monitoring system according to 2.   The manager device, when a failure occurs in the main collection monitor device, allocates traffic collection of a node that the main collection monitor device is executing as an auxiliary collection monitor device to another monitor device. Item 3. The traffic monitoring system according to Item 1 or 2. When the failure of the main collection monitor device is recovered, the traffic information stored in the external storage device by the auxiliary collection monitor device is combined with the traffic information stored in the external storage device by the main collection monitor device. The traffic monitoring system according to claim 3 or 4.

Images