JP4299210B2 - Network monitoring method and apparatus - Google Patents

Description

  The present invention relates to a network monitoring method and apparatus, and more specifically, a plurality of monitored devices constituting a network voluntarily transmit its own alarm information and the performance information of its own station from the network monitoring device. The present invention relates to a network monitoring method and apparatus of a network monitoring system that transmits in accordance with an inquiry.

  In this type of network monitoring system, alarm information indicating line congestion, failure, device failure, etc. occurs suddenly and requires urgency, so it is immediately transmitted from the monitored device at the time of occurrence. The performance information indicating the operation status (performance) of the monitored device is periodically collected by polling from the network monitoring device.

  In this case, generally, a monitored device that is not in an alarm state can respond quickly to an inquiry about performance information because the load on the CPU is relatively light. However, in a monitored device that is in an alarm state, Due to the heavy load, even if there is an inquiry about performance information, it cannot respond promptly.

  In general, this type of network monitoring information is collected via a common monitoring line for each group including a plurality of monitored devices. If an alarm condition occurs in a group, the common line is Due to congestion, collection of performance information is delayed.

  Under such circumstances, the conventional network monitoring device inquires performance information (polling) in a certain order regardless of whether or not the monitored device is in the alarm state. When performance information is inquired to the monitoring device, the response is not easily returned, and there is a problem that the inquiry of alarm information to the remaining monitored devices is significantly delayed.

  In the past, priority was given to alarm collection polling to other monitored devices involved in the line where the alarm was detected, so that related alarms could be detected early, thus enabling quick cause analysis. A network monitoring system is known (Patent Document 1).

However, in this method, since the polling for detecting related alarms is concentrated on the line where the alarm is detected, the collection of performance information becomes increasingly delayed.
JP 03-123230 (summary, figure)

  The present invention has been made in view of the above problems of the prior art, and an object of the present invention is to provide a network monitoring method and apparatus capable of efficiently collecting both alarm information and performance information of a network system.

The above problem is solved by the configuration of FIG. That is, according to the network monitoring method of the present invention (1), a plurality of monitored devices 50 constituting the network 100 voluntarily transmit the alarm information of the own station and the performance information of the own station from the network monitoring device 10. A network monitoring method of a network monitoring system for transmitting according to an information inquiry, wherein the network monitoring device 10 totals the number of alarm information generated within a predetermined time immediately before each monitored device 50, and the totaled alarm information The performance information is preferentially inquired from the monitored apparatus whose number does not exceed the predetermined threshold.

In the present invention (1), in order to preferentially inquire performance information from a monitored device whose number of alarm information in the immediately preceding section does not exceed a predetermined threshold, the performance information inquiry is made over the monitored device during alarm processing. It is possible to effectively avoid the state of being performed and to efficiently collect performance information from more monitored devices in the system.
In the present invention (2), the network monitoring device compares the alarm information numbers of the monitored devices whose aggregated alarm information numbers do not exceed a predetermined threshold with each other, and performs performance preferentially from the monitored devices with a small number of alarm information items. Ask for information.
In the present invention (3), the network monitoring apparatus sequentially issues inquiries of performance information to a plurality of monitored apparatuses in accordance with a totaling result for one time regarding the number of alarm information generated within the predetermined time immediately before.
In the present invention (4), the network monitoring device does not inquire performance information every time the number of alarm information generated within the predetermined time immediately before has been executed, and the number of alarm information has a predetermined threshold value. The monitored devices that do not exceed the priority are preferentially extracted and the performance information is inquired.

In the network monitoring device of the present invention ( 5 ), a plurality of monitored devices constituting the network voluntarily transmit the alarm information of the local station and transmit the performance information of the local station according to the performance information inquiry from the network monitoring device. In the network monitoring device of the network monitoring system, the totaling means for totaling the number of alarm information generated within a predetermined time immediately before each monitored device, and the monitored device where the total number of alarm information does not exceed a predetermined threshold And performance inquiry means for preferentially inquiring performance information.
In the present invention (6), the performance inquiry means compares the alarm information numbers of the monitored devices whose aggregated alarm information numbers do not exceed a predetermined threshold with each other, and gives priority to the monitored devices with a small number of alarm information items. Queries performance information.
In the present invention (7), the performance inquiry means sequentially inquires performance information for a plurality of monitored devices according to the result of one aggregation by the aggregation means.
In the present invention (8), the performance inquiry means preferentially extracts monitored devices whose performance information has not been inquired and whose number of alarm information does not exceed a predetermined threshold for each aggregation by the aggregation means. , Query performance information.

In the network monitoring device of the present invention ( 9 ), a plurality of monitored devices constituting the network voluntarily transmit the alarm information of the own station and also transmit the performance information of the own station according to the performance information inquiry from the network monitoring device. In the network monitoring device of the network monitoring system, the monitoring device that shares the monitoring line is grouped, and the totaling means for counting the number of alarm information generated within a predetermined time immediately before a plurality of groups, Performance inquiry means for preferentially inquiring performance information from monitored devices of a group whose alarm information number does not exceed a predetermined threshold value.

In the present invention ( 9 ), since the performance information is preferentially inquired from the monitored device of the group whose alarm information number in the immediately preceding predetermined time does not exceed the predetermined threshold value, the alarm information is transferred to the monitoring shared line being transferred. It is possible to effectively avoid the situation where performance information is repeatedly inquired, and it is possible to efficiently collect performance information from more monitored devices in the system.
In the present invention (10), the performance inquiry means compares each alarm information number for each group in which the total number of alarm information does not exceed a predetermined threshold value, and gives priority to the monitored devices of the group having a small number of alarm information. Ask for performance information.
In the present invention (11), the performance inquiry means sequentially inquires performance information for a plurality of groups of monitored devices according to the result of one aggregation by the aggregation means.
In the present invention (12), the performance inquiry means is used for each aggregation by the aggregation means.
In addition, performance information inquiries are performed by preferentially extracting monitored devices in groups in which performance information inquiries have not been performed and the number of alarm information does not exceed a predetermined threshold.

  As described above, according to the present invention, both alarm information and performance information of the network system can be efficiently collected, so that it greatly contributes to improving the operability and reliability of the network monitoring system.

  DESCRIPTION OF EXEMPLARY EMBODIMENTS Hereinafter, preferred embodiments of the invention will be described in detail with reference to the accompanying drawings. Note that the same reference numerals denote the same or corresponding parts throughout the drawings. In the present specification, an alarm may be abbreviated as ALM, a performance as PFM, a database as DB, and a network as NW. FIG. 1 is a diagram showing a configuration of a network monitoring system according to an embodiment. A typical configuration for remotely monitoring a plurality of nodes (monitored devices) 50 constituting a main signal network 100 via a monitoring network 200 is shown. Show.

In the figure, 10 is a network monitoring device, 15 is a reception alarm data processing unit that receives and processes alarm information (line congestion, line disconnection, equipment failure, etc.) generated by each monitored device 50, and 11 is a record of the alarm information. An alarm database to be held, 12 is a performance inquiry item database that holds item information (device name, performance data type, etc.) that is a target of performance inquiry to each monitored device 50, and 13 is a performance inquiry item database. A line sharing information database that holds information on which monitoring line is shared, 17 is a performance inquiry order determination processing unit that determines the inquiry order of performance information based on the number of alarm information within the predetermined time immediately before, etc. Reference numeral 16 denotes each monitored device 5 according to the determined order. A performance inquiry processing unit that inquires performance information (bit error rate, received signal level, error duration, etc.), 18 a reception performance data processing unit that receives and processes performance information returned from each monitored device 50, 14 is a performance database for recording / holding the performance information, and 20 is a monitor for monitoring used by a maintenance person.

  The monitoring network 200 may be configured virtually using the overhead of the signal flowing through the main signal line, or may be configured as a dedicated monitoring line. The monitoring network 200 in FIG. 1 is configured by Ethernet (registered trademark) that transfers monitoring packets, and includes a group of monitored devices A to C connected to the router 41 and a monitored device a connected to the router 42. -C groups are shown.

  With such a configuration, each monitored device 50 immediately generates alarm data and notifies the network monitoring device 10 when it detects an alarm state. The reception alarm data processing unit 15 generates necessary alarm information (monitored device name, alarm occurrence time, alarm type name, etc.) based on the received alarm data, and writes it in the alarm database 11.

  On the other hand, the performance inquiry processing unit 16 inquires the performance information of each monitored device 50 by polling activated at a predetermined time interval (for example, every 15 minutes). It is assumed that this performance information is collected in each monitored device at intervals of 1 minute, for example, and is aggregated and analyzed at intervals of 15 minutes. In this state, the performance inquiry process according to the embodiment will be described in detail below.

  FIG. 3 is a sequence diagram of performance inquiry processing according to the first embodiment, and shows a case where performance information inquiries are made in the order determined immediately before a plurality of monitored devices A to C. When the performance inquiry time is reached, this process is entered. In step S11, the performance inquiry processing unit 16 requests the performance inquiry order determination processing unit 17 for performance inquiry order information.

  In response to this, the performance inquiry order determination processing unit 17 first requests the line sharing information database 13 to search for the line sharing information in step S12, and in the example of FIG. Get information that is connected.

  Next, in step S13, the performance inquiry item database 12 is requested to search for performance inquiry items, and in this example, performance inquiry item information about the monitored devices A to C is acquired. FIG. 2A shows a storage mode of performance inquiry item information in the performance inquiry item database 12. For monitored device A, inquires about items a (bit error rate), b (reception level), c (error duration), and for monitored device B, items d (bit error rate), e (reception level), It is recorded to inquire about (error duration). The same applies to the monitored device C. Further, the order of the monitored devices A, B, and C recorded here may be considered as the default performance inquiry order. Further, in step S14, the alarm database 11 is requested for information on the number of alarms generated within the predetermined period immediately before the monitored devices A to C, and the number of each alarm is acquired.

In step S18, the performance inquiry order for the monitored devices A to C is determined based on the obtained information. This determination is performed, for example, by comparing the number of alarms with a predetermined threshold value. This predetermined threshold value is used to determine whether or not the monitored device is in an alarm state to the extent that the performance monitoring order should be changed. The order is turned backwards. Here, it is assumed that the number of alarms in the monitored device B exceeds a predetermined threshold value, and therefore the monitored device B is burdened with alarm processing. Alternatively, the obtained number of alarms may be compared to create a performance inquiry order in which monitored devices with a small number of alarms are young. FIG. 2B shows an example of the execution order of performance inquiries. Here, the inquiry order of the monitored devices A, C, and B is used. In step S19, the performance inquiry processing unit 16 is returned with information on the execution order of the performance inquiry.

  In response to this, the performance inquiry processing unit 16 first makes an inquiry about the performance information A, B, C to the monitored device A in step S21, and the monitored device A receiving this receives the performance information I, B, B in step S22. , Answer C. Further, the reception performance data processing unit 18 receiving this records the received performance information in the performance database 14 (not shown), and notifies the performance inquiry processing unit 16 of the processing completion in step S23.

  The performance inquiry processing unit 16 makes a second performance inquiry to the monitored device C in step S24 in response to the processing completion notification. Thereafter, the process proceeds in the same manner. In step S27, the third performance inquiry is executed to the monitored device C. When the processing completion notification is received in step S29, a series of performances based on the determined order is received in step S30. Complete the inquiry process. Then, the next inquiry process is started after a predetermined time (15 minutes) has elapsed.

  FIG. 2C shows a flow of performance inquiry processing when, for example, two threads are used. In application software that performs advanced processing, a plurality of processes can be apparently executed simultaneously by occupying the CPU alternately and running a plurality of threads. In the illustrated example, since two threads are used, the inquiry process for the monitored apparatus C can be started without waiting for the process of the monitored apparatus A to end. As a result, the monitored devices A and C can promptly answer performance information under a relatively light load, and the monitoring device 10 can efficiently and quickly monitor these systems. On the other hand, for the monitored device B having a large number of alarms, even if the performance information cannot be answered promptly under an overload caused by alarm processing, the performance information is obtained by using the remaining time of the monitoring cycle (for example, 15 minutes). Can be collected reliably.

  FIG. 4 is a sequence diagram of performance inquiry processing according to the second embodiment, and shows a case where performance inquiries are made one by one in a determined order for each of a plurality of monitored devices A to C. The processing in steps S11 to S14 may be the same as that described in FIG. In step S18, the performance inquiry order determination processing unit 17 has not yet inquired performance information about the monitored devices A to C based on the information obtained from the databases 11 to 13, and the performance inquiry order. Extract the youngest one. In this example, the monitored device A is first extracted and notified to the performance inquiry processing unit 16 in step S19.

  In response to this, the performance inquiry processing unit 16 makes a performance inquiry to the monitored apparatus A in step S21. In step S22, the reception performance data processing unit 18 receives the response and records it in the performance database 14, and in step S23. The performance inquiry processing unit 16 is notified of the completion of processing.

  In response to this, the performance inquiry processing unit 16 inquires of the performance inquiry order determination processing unit 17 again about the next inquiry destination in step S41, and the performance inquiry order determination processing unit 17 that has received the inquiry inquires about the monitored devices A to C. The performance information inquiries are not executed, and the performance inquiries rank the youngest. In this example, the monitored device C is then extracted and notified to the performance inquiry processing unit 16 in step S49. In step S50, a performance inquiry is made to the monitored device C. Although not shown, the performance inquiry to the monitored device B is finally executed, and when the performance inquiry to all the monitored devices A, C, B is completed (one cycle), the performance inquiry at a predetermined time interval is performed. Processing is complete.

  In the second embodiment, since the performance inquiry order is determined each time, the alarm status of each monitored device is grasped in substantially real time and is reflected in the next performance inquiry order determination even during performance inquiry execution. be able to. Therefore, an efficient performance inquiry can be made in accordance with the operation status of the system.

  In the above embodiments, application examples to the monitored devices A to C are described, but the same applies to the monitored devices a to c. In addition, the present invention provides a group of monitored devices that share a monitoring line as one group, totals alarm number information within a predetermined time immediately before each group, and the total number of alarms obtained is a predetermined threshold value. Performance information queries are preferentially executed from monitored devices in groups that do not exceed the maximum, or the total number of alarms is compared with each other, and priority is given to monitored devices in groups that have a low total number of alarms. Also good. In this way, it is possible to efficiently collect performance information from a wide range of networks while avoiding congestion on the shared monitoring line.

  The performance inquiry order determination processing unit 17 in this case totals the number of alarms of each of the monitored device groups A to C and a to c sharing the monitoring line, and the obtained total number of alarms is predetermined. A group of monitored devices A to C or a to a group with a small number of total alarms by comparing the total number of alarms with priority from the group of monitored devices A to C or a to c of a group that does not exceed the threshold. The performance information query is preferentially executed from c. As a result, the maximum value of the data amount of the monitoring shared line can be lowered, and the number of monitored devices that share the monitoring line can be increased, so that the subdivision of the monitoring line can be suppressed. .

  FIG. 5 is a diagram showing an application example of the present invention to a mobile communication system. In the figure, MS is a mobile station, 50 is a radio base station (BTS), 51 is a radio network controller (RNC), and 100 is a mobile network as a main signal network (also serving as a monitoring network). It has become.

  When the base stations A to C detect an alarm state, the base stations A to C transmit OAM cells loaded with alarm information, and the alarm cells are transferred to the network monitoring apparatus 10 via the radio network controller 51. On the other hand, the performance inquiry cell from the network monitoring device 10 is transferred to the base station A, B or C via the radio network controller 51, and the response cell is collected by the network monitoring device 10 via the radio network controller 51. The

Under this condition, if the number of alarms at a predetermined time immediately before the base station B exceeds a predetermined threshold due to the occurrence of fading or the like, the network monitoring device 10 makes an inquiry about the next performance information to the base stations A, C, Perform in order B. In this case, since fading errors in the radio channel are often temporary, according to the present invention, fading of the base station B is canceled while the performance inquiry is made in the order of the base stations A and C. If the fading of the base station B is eliminated, the performance information can be collected without delay in the order of the base stations A, C, and B. The same applies to the base stations a to c. Thus, the present invention is particularly effective when applied to a mobile communication system.

  FIG. 6 is a diagram showing an application example of the present invention to the SDH transmission system. In the figure, 60 is a transmission terminal station device, 61 is a repeater, 200 is a monitoring network composed of Ethernet (registered trademark) and the like. . Network monitoring of each section S1, S2 is performed using the D1 to D12 bytes of the section overhead SOH in the main signal frame. The monitoring information of the sections S1 and S2 is terminated at the transmission terminal devices 60A, 60B, and 60C, and the monitoring information is taken out to the monitoring network 200 by a router or the like (not shown).

  Under such a state, if the alarm total count at a predetermined time immediately before section S2 exceeds a predetermined threshold value, the network monitoring device 10 makes an inquiry about the next performance information and the terminal devices 60A and 60B and relay of the section S1. Preferentially from the devices 61a and 61b. This effectively avoids the congestion of the monitoring information in section S2.

  Although the preferred embodiment of the present invention has been described, it goes without saying that various changes in the configuration, processing, and combination of each part can be made without departing from the spirit of the present invention.

    (Supplementary note 1) Network monitoring of a network monitoring system in which a plurality of monitored devices constituting a network voluntarily transmit alarm information of the local station and transmit performance information of the local station in accordance with performance information inquiries from the network monitoring device The network monitoring device counts the number of alarm information generated within a predetermined time immediately before each monitored device, and preferentially from the monitored devices where the total number of alarm information does not exceed a predetermined threshold value A network monitoring method characterized by inquiring performance information.

    (Supplementary note 2) Network monitoring of a network monitoring system in which a plurality of monitored devices constituting a network voluntarily transmit the alarm information of the local station and transmit the performance information of the local station according to the performance information inquiry from the network monitoring device The network monitoring device counts the number of alarm information generated within a predetermined time immediately before each monitored device, and compares the total number of alarm information with each other to monitor the number of alarm information. A network monitoring method characterized by inquiring performance information preferentially from the network.

(Supplementary note 3) Network monitoring of a network monitoring system in which a plurality of monitored devices constituting a network voluntarily transmit the alarm information of the local station and transmit the performance information of the local station according to the performance information inquiry from the network monitoring device In the apparatus, a totaling unit that totals the number of alarm information generated within a predetermined time immediately before each monitored apparatus, and the performance information is preferentially received from the monitored apparatus in which the total number of alarm information does not exceed a predetermined threshold. A network monitoring apparatus comprising: performance inquiry means for making an inquiry.

    (Supplementary note 4) The network monitoring device according to supplementary note 3, wherein the performance inquiry means sequentially inquires performance information for a plurality of monitored devices in accordance with a result of one aggregation by the aggregation means.

    (Supplementary note 5) The performance inquiry means preferentially extracts monitored devices whose performance information has not been inquired and the number of alarm information does not exceed a predetermined threshold for each aggregation by the aggregation means. 4. The network monitoring device according to appendix 3, characterized in that:

    (Appendix 6) Network monitoring of a network monitoring system in which a plurality of monitored devices constituting a network spontaneously transmit alarm information of the local station and transmit performance information of the local station in accordance with an inquiry of performance information from the network monitoring device In the apparatus, the monitored devices that share the monitoring line are grouped, and a totaling unit that totals the number of alarm information generated within a predetermined time immediately before a plurality of groups, and the total number of alarm information is a predetermined threshold value A network monitoring device comprising: performance inquiry means for preferentially inquiring performance information from monitored devices of groups not exceeding.

It is a figure which shows the structure of the network monitoring system by embodiment. It is a figure explaining the performance inquiry process by embodiment. It is a sequence diagram of the performance inquiry process by 1st Embodiment. It is a sequence diagram of the network monitoring process by 2nd Embodiment. It is a figure which shows the example of application to the mobile communication system of this invention. It is a figure which shows the example of application to the SDH transmission system of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Network monitoring apparatus 11 Alarm database 12 Performance inquiry item database 13 Line share information database 14 Performance database 15 Reception alarm data processing part 16 Performance inquiry processing part 17 Performance inquiry order determination processing part 18 Reception performance data processing part 20 Monitoring monitor 32, 33 Monitoring common line 41, 42 Router 100 Main signal network 200 Monitoring network

Claims (12)

A network monitoring method for a network monitoring system in which a plurality of monitored devices constituting a network voluntarily transmit alarm information of the local station and transmit performance information of the local station according to an inquiry of performance information from the network monitoring device. ,
The network monitoring device totals the number of alarm information generated within the predetermined time immediately before each monitored device, and preferentially inquires performance information from the monitored device whose total number of alarm information does not exceed a predetermined threshold. The network monitoring method characterized by performing. The network monitoring device compares the alarm information numbers of the monitored devices whose aggregated alarm information numbers do not exceed a predetermined threshold with each other, and preferentially inquires performance information from the monitored devices with a small number of alarm information items. The network monitoring method according to claim 1, wherein: 3. The network monitoring apparatus, according to claim 1, wherein the network monitoring apparatus sequentially inquires performance information with respect to a plurality of monitored apparatuses in accordance with a result of a single count regarding the number of alarm information generated within the predetermined time immediately before. Network monitoring method. The network monitoring device gives priority to monitored devices that have not been inquired about performance information and the number of alarm information does not exceed a predetermined threshold every time the number of alarm information generated within the predetermined time immediately before is counted. 2. The network monitoring method according to claim 1, wherein the network information is extracted and the performance information is inquired. In the network monitoring device of the network monitoring system, a plurality of monitored devices constituting the network voluntarily transmit the alarm information of the local station and transmit the performance information of the local station according to the performance information inquiry from the network monitoring device. Totaling means for totalizing the number of alarm information generated within a predetermined time immediately before the monitored device, and performance for preferentially inquiring performance information from the monitored device for which the total number of alarm information does not exceed a predetermined threshold A network monitoring apparatus comprising: inquiry means. The performance inquiry means compares the alarm information numbers of the monitored devices whose aggregated alarm information numbers do not exceed a predetermined threshold with each other, and preferentially inquires performance information from the monitored devices with a small number of alarm information items The feature
The network monitoring device according to claim 5 . 6. The network monitoring apparatus according to claim 5, wherein the performance inquiry means sequentially inquires performance information for a plurality of monitored apparatuses according to a result of one aggregation by the aggregation means. The performance inquiry means preferentially extracts monitored devices whose performance information has not been inquired and the number of alarm information does not exceed a predetermined threshold for each aggregation by the aggregation means, and inquire performance information 6. The network monitoring apparatus according to claim 5, wherein In a network monitoring device of a network monitoring system, a plurality of monitored devices constituting a network voluntarily transmit the alarm information of the local station and transmit the performance information of the local station according to the performance information inquiry from the network monitoring device. A grouping unit for grouping monitored devices that share a common line and totaling the number of alarm information generated within a predetermined time immediately before a plurality of groups, and a group in which the total number of alarm information does not exceed a predetermined threshold A network monitoring apparatus comprising performance inquiry means for preferentially inquiring performance information from the monitored apparatus. The performance inquiry means compares the number of alarm information for each group in which the total number of alarm information does not exceed a predetermined threshold, and inquires performance information from a monitored device in a group with a small number of alarm information. The network monitoring apparatus according to claim 9. 10. The network monitoring apparatus according to claim 9, wherein the performance inquiry means sequentially inquires performance information for a plurality of groups of monitored apparatuses according to a result of one aggregation by the aggregation means. The performance inquiry means preferentially extracts the monitored devices of a group whose performance information has not been inquired and the number of alarm information does not exceed a predetermined threshold for each aggregation by the aggregation means. The network monitoring apparatus according to claim 9, wherein:

Images