JP2014183448A - Network monitoring device and network monitoring method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To take an appropriate countermeasure when a plurality of failures occur at the same time.SOLUTION: A network monitoring device comprises: an information collection unit which collects states of communication apparatuses as pieces of monitoring information; a tag attachment unit which attaches a predetermined tag to the pieces of monitoring information and output the pieces of monitoring information with the predetermined tag as pieces of acquired monitoring information; a database which stores the pieces of acquired monitoring information, and also stores preset importance reference and alarm reference; a failure determination unit which calculates failure importance degrees by standardizing the pieces of acquired monitoring information on the basis of the importance reference, and when the failure importance degree satisfies the alarm reference, creates alarm information; and a distribution unit which distributes the alarm information.

Description

  The present invention relates to a network monitoring apparatus and a network monitoring method.

  Today, various electronic devices are connected to a network for various purposes. Therefore, when an abnormality occurs in the network, a failure such as the fact that many electronic devices cannot be used simultaneously occurs. For this reason, it is necessary to monitor the network to prevent the occurrence and expansion of failures.

  As such a technique, for example, in Japanese Patent Application Laid-Open No. 2007-318740, it is possible to cope with operations such as abnormality detection, failure detection, and examination of response methods without depending on the skill and knowledge of the person in charge. A support method has been proposed.

  In this response support method, the communication quality of a communication network that provides a plurality of types of communication services is measured, and the measured communication quality is compared with a preset reference to determine the abnormality type and necessity of response. In addition, the information processing apparatus includes a providing apparatus that provides a communication service, and a database in which information on correspondence is associated with service types and abnormality types. If it is determined that a response is required, the corresponding information is extracted from the database, and notification, device control, and the like are performed based on the information.

JP 2007-318740 A

  However, in the response support method according to Japanese Patent Application Laid-Open No. 2007-318740, there is a problem that complex failure determination is not determined. In other words, failures occur in various contents in a plurality of regions and a plurality of protocol layers. At this time, a severe failure may occur due to the overlap of minor failures. However, in the response support method according to Japanese Patent Application Laid-Open No. 2007-318740, the importance of a failure can be determined only by an abnormality type that is assumed in advance and registered in the database. For this reason, when a plurality of failures occur at the same time, there are cases where appropriate notification or the like cannot be performed.

  Therefore, a main object of the present invention is to provide a network monitoring apparatus capable of appropriately responding even when a plurality of failures occur simultaneously.

  In order to solve the above problems, an invention relating to a network monitoring apparatus that monitors the status of a plurality of communication devices connected to a network and outputs failure information, an information collection unit that collects the status of communication devices as monitoring information, and a monitoring A tag adding unit for giving a predetermined tag to information and outputting it as acquisition monitoring information, storing acquisition monitoring information, a database for storing preset weight criteria and alarm criteria, and using acquisition monitoring information as a weight reference It is characterized by comprising a failure determination unit that calculates a standardized failure importance degree based on the alarm criteria and creates alarm information when the alarm criteria are satisfied, and a distribution unit that distributes the alarm information.

  The invention according to the network monitoring method for monitoring the status of a plurality of communication devices connected to the network and outputting fault information includes an information collection procedure for collecting the status of the communication devices as monitoring information, Tag assignment procedure for obtaining acquisition information by adding tags, failure importance calculation procedure for calculating failure importance by standardizing acquisition monitoring information based on weight criteria stored in the database, and failure importance in the database When stored alarm criteria are satisfied, an alarm information creation procedure for creating alarm information and a delivery procedure for delivering alarm information are included.

  According to the present invention, failure information is collected, and these are classified and managed, so that even if a plurality of failures occur at the same time, an appropriate response can be performed.

It is a block diagram of a network monitoring apparatus. It is the figure which showed the specific example of failure generation | occurrence | production. It is the flowchart which showed the alarm information preparation procedure. It is the figure which showed the format of acquisition monitoring information.

  An embodiment of the present invention will be described. FIG. 1 is a block diagram of a network monitoring device 2 according to the present embodiment. The network monitoring device 2 is connected to the network 3 and monitors a plurality of communication devices 4 connected to the network 3. And when the abnormality of the content registered previously is detected, it notifies to the communication apparatus 4 concerned. Note that the network 3 itself is also a monitoring target.

  The network monitoring device 2 includes an information collection unit 11, a tag addition unit 12, a database (DB) 13, a failure determination unit 14, and a distribution unit 15 as main components. The acquisition monitoring information storage unit 13a includes an acquisition monitoring information storage unit 13a that stores the acquired monitoring information (acquisition monitoring information), a determination criterion storage unit 13b that stores a weight criterion and an alarm criterion that indicate the importance of the failure occurrence, and a failure A countermeasure information storage unit 13c is included.

  FIG. 2 shows a case where a failure occurs in the first intermediate router Rb_1 when the network 3 includes the upper router Ra, the first and second intermediate routers Rb_1 and Rb_2, and the first to fourth lower routers Rc_1 to Rc_4. It is the figure shown as an example. In the following, each element will be described according to the flowchart shown in FIG.

  Steps S1 and S2: First, the information collection unit 11 periodically collects communication logs and the like from the communication device 4 as monitoring information. In principle, the communication device 4 voluntarily transmits monitoring information when it is determined that a failure has occurred in its own device. For example, when the control unit of the first middle router Rb_1 in FIG. 2 detects that a failure has occurred in its own device, it outputs a communication log as monitoring information to the network monitoring device.

  However, the control unit may not be able to detect the occurrence of a failure because the content of the failure is minor. In this case, even if one obstacle is a slight injury, it may become a serious obstacle by compounding. Therefore, the information collection unit 11 periodically collects communication logs and the like from the communication device 4 as monitoring information.

  Step S3: The tag assigning unit 12 assigns a tag to the monitoring information and outputs it as acquired monitoring information. FIG. 4 is a diagram showing the format of such acquisition monitoring information. This tag T includes a monitoring information identification number T1 characterizing the monitoring information, a failure occurrence area information T2, a device name T3 of the communication device 4, a user name T4 of the communication device 4, a monitoring information acquisition time T5, and the like. The monitoring information identification number T1 is a number uniquely assigned by the network monitoring device 2, but the failure area information T2, the device name T3 of the communication device 4, and the user name T4 of the communication device 4 are the acquired monitoring information. Extract from

  Step S4: As described above, the database 13 includes the acquisition monitoring information storage unit 13a, the determination criterion storage unit 13b, and the failure countermeasure information storage unit 13c. The acquisition monitoring information storage unit 13a stores the acquisition monitoring information generated by the tag assigning unit 13, and the judgment criterion storage unit 13b stores in advance a weight criterion and an alarm criterion that indicate the criterion of the degree of failure occurrence. Has been. The failure countermeasure information storage unit 13c stores information notified to the user when a failure occurs and information for directly controlling the failure generator (these are collectively referred to as failure response information). Yes.

  Step S5: The failure determination unit 14 determines the importance (influence range of the failure) of the failure based on the weight criterion and the alarm criterion stored in the determination criterion storage unit 13b with respect to the acquisition monitoring information stored in the acquisition monitoring information storage unit 13a. Etc.) is comprehensively determined.

  When determining the degree of failure importance, failure areas (for example, geographical locations such as Tokyo and Sendai), protocol layers (for example, protocol layers such as the first layer, second layer, etc.), failure contents (for example, upper routers) Are weighted against the failure criteria such as the failure criteria, etc., against the weight criteria stored in the judgment criteria storage unit 13b. Then, the total weight value (total weight value) for the failure is normalized, and the failure degree is calculated.

  Such failure importance determination processing is periodically performed every preset time and is performed each time new acquisition monitoring information is registered in the acquisition monitoring information storage unit 13a.

  As specific examples, Tokyo (4), Osaka (3), Sendai (2), Hokkaido (1) as the region, the first layer (7) to the seventh layer (1) as the protocol layer, and the upper router as the failure content (3) Consider the middle router (2) and the lower router (1). Here, the numbers in parentheses are weight values according to the weight criterion. In this case, classification by 4 * 3 * 7 = 84 weight values (maximum weight values) is possible.

  At this time, if the failure occurrence area included in the acquired monitoring information A is Sendai (2), the protocol layer is the fifth layer (3), and the failure content is the lower router (1), the total weight value is 6. Further, assuming that the failure occurrence area included in the acquired monitoring information B is Tokyo (3), the protocol layer is the second layer (6), and the failure content is the middle router (2), the total weight value is 11.

  Therefore, the failure determination unit 14 normalizes each total weight value with the maximum weight value (4 + 7 + 3 = 14 in the above example), sets the normalized value of the acquired monitoring information A to 6 / 14≈0.42, and the acquired monitoring information. The normalized value of B is calculated as 11/14 = 0.78. Accordingly, since the failure importance of the acquisition monitoring information B is greater than the failure importance of the acquisition monitoring information A, the acquisition monitoring information B is treated with priority.

  At this time, if the alarm criterion stored in the determination criterion storage unit 13b is 0.7, the content of the acquired monitoring information A is an alarm target. The failure determination unit 14 searches the failure countermeasure information storage unit 13c for information for notifying the user of the failure and information for direct control, and outputs the information as alarm information. The search at this time is performed using individual elements such as a fault occurrence area and a protocol hierarchy as keywords.

  The distribution unit 15 notifies the communication device 4 of the alarm information from the failure determination unit 14. Therefore, the user on the communication device 4 side can receive an alarm from the distribution unit 15 to determine what kind of danger has occurred and how to deal with it without requiring skill. become. Note that when directly controlling a faulty device, the user does not know that a fault has occurred.

  As described above, since the failure information is generated by comprehensively determining the contents of the failure and the like, for example, even if a plurality of minor failures occur at the same time, an appropriate response can be performed.

DESCRIPTION OF SYMBOLS 2 Network monitoring apparatus 3 Network 4 Communication apparatus 11 Information collection part 12 Tag provision part 13 Database 13a Acquisition monitoring information storage part 13b Judgment criteria storage part 13c Failure countermeasure information storage part 14 Failure judgment part 15 Distribution part

Claims (8)

A network monitoring device that monitors the status of a plurality of communication devices connected to a network and outputs failure information,
An information collection unit that collects the state of the communication device as monitoring information;
A tag giving unit for giving a predetermined tag to the monitoring information and outputting the obtained monitoring information;
A database for storing the acquisition monitoring information, a preset weight criterion, a warning criterion,
A failure determination unit that calculates the failure importance standardized based on the weight criterion for the acquired monitoring information, and creates warning information when the warning criterion is satisfied, and
A distribution unit for distributing the alarm information;
A network monitoring device comprising: The network monitoring device according to claim 1,
In the database, countermeasures for individual failures are stored as failure countermeasure information,
The network monitoring device, wherein the failure determination unit searches and outputs the failure countermeasure information from the database when the calculated failure importance satisfies the alarm criterion. The network monitoring device according to claim 1 or 2,
The information collecting unit collects monitoring information from the communication device every predetermined time and collects monitoring information transmitted from the communication device outside the predetermined time. The network monitoring device according to any one of claims 1 to 3,
The network monitoring apparatus, wherein the tag adding unit adds an identification number characterizing the monitoring information to the monitoring information to obtain the acquired monitoring information. A network monitoring method for monitoring the status of a plurality of communication devices connected to a network and outputting fault information,
An information collection procedure for collecting the state of the communication device as monitoring information;
A tagging procedure for obtaining monitoring information by adding a predetermined tag to the monitoring information;
A failure importance calculation procedure for calculating the failure importance by normalizing the acquired monitoring information based on the weight criteria stored in a database;
An alarm information creating procedure for creating alarm information when the failure severity satisfies the alarm criteria stored in the database;
A delivery procedure for delivering the alarm information;
A network monitoring method comprising: The network monitoring method according to claim 5, comprising:
The alarm information creation procedure includes a procedure for searching and outputting the failure countermeasure information stored in the database when the failure importance satisfies the alarm criteria. The network monitoring method according to claim 5 or 6, wherein
The information collecting procedure includes a procedure of collecting monitoring information from the communication device every predetermined time and collecting monitoring information transmitted from the communication device outside the predetermined time. . The network monitoring method according to any one of claims 5 to 7,
The tagging procedure includes a procedure of adding an identification number characterizing the monitoring information to the monitoring information to obtain the acquired monitoring information.

Images