JP4812716B2 - Management device, management method, management system, program, and storage medium - Google Patents

Description

  The present invention relates to a management apparatus, a management method, a management system, a program, and a storage medium that can remotely monitor the status of devices connected to a customer's network system and perform remote management.

  2. Description of the Related Art In general, a network system in which companies exchange data between a plurality of computers and share a peripheral device such as a printer is widely used in companies and other organizations.

  In such a network system, maintenance is required, but since this requires specialized knowledge and technology, it is usually entrusted to a specialized service operating body.

  Conventionally, in such a service operating body (service center), for example, a network management system that uses a network management device to monitor the states of a plurality of monitoring target devices that can communicate over a network is used.

  In such a network management system, the status information of a plurality of monitored devices that can communicate with this network is acquired by a network management device installed in the customer's network system. This network management device transmits status information of monitored devices (printers, servers, routers, etc.) to a service center (support center) site attached to an e-mail by controlling the mail server. The contents of the e-mail related to this status information include a device ID of the monitoring target device and a mail address identifying the group to which the device ID belongs.

Then, a network management system has been proposed in which the center server (management server) of the service center site that receives this e-mail monitors the operating status of the monitored device based on information included in the e-mail ( For example, see Patent Document 1).
Japanese Patent No. 3672192

  However, in the above-described network management system, the network management device transmits the status of a plurality of monitored devices in the customer's network system to the service center by e-mail. That is, the above-described network management system is a one-way information transmission system that only transmits an e-mail from the customer's network system side to the service center side. For this reason, it is not possible to access a plurality of monitoring target devices in the customer's network system by using e-mail from the service center side and individually control the required monitoring target devices or exchange information.

  Further, there is no bidirectional information transmission system using electronic mail between the service center side and a plurality of monitored devices in the customer's network system. Therefore, the service center side cannot send an operation stop or start command, an update (UpDate) file, or the like to each monitoring target device by electronic mail via the Internet.

  Therefore, when the service center side can individually control or transmit information to a plurality of monitored devices in the customer's network system using e-mail, it is necessary to ensure communication security. is there. That is, in this case, a plurality of monitoring target devices in the customer's network system need a function of encrypting and decrypting the e-mail. Further, in this case, a function for receiving an electronic mail transmitted from the center server via the Internet is required. In this case, a function for determining that the received electronic mail is an instruction mail transmitted from the center server is required. Moreover, in this case, it is necessary that each monitored device itself has a function for encrypting and decrypting an e-mail, a function for receiving an e-mail, and a function for determining whether it is an instruction mail. It becomes.

  In this case, since the center server on the service center side is connected to the network systems of a plurality of customers, a large number of devices to be monitored are managed. For this reason, in this case, the operation of a large number of monitored devices related to a network system of a plurality of customers is individually controlled by a single center server, or an update operation for a large number of monitored devices is individually performed. This increases the amount of work and makes processing difficult.

An object of the present invention, provides management device, management method that allows obtaining the monitoring result log file that records a log relating to failure from communicable equipment network to be managed, management system, a program, and storage medium There is to do.

In order to achieve the above object, the management device according to claim 1 manages devices that can communicate on a network, and in a management device capable of sending and receiving mails, from among the emails sent to a predetermined destination. A mail acquisition unit that acquires a mail including a command for controlling the device, and a command for controlling the device described in the mail text acquired by the mail acquisition unit, An instruction unit for instructing the device to be executed by the device, and an e-mail text generated based on information collected from the device in accordance with an instruction result for the device by the instruction unit by the instruction unit the obtained from the device when an instruction for the device is a request to obtain a monitoring result log file that records a log relating to failure A result mail creating unit that creates the results were seen results attach the log file write, and having a a result mail transmitting unit that transmits a result mail created in a predetermined destination by the result mail creation section.

In order to achieve the above object, the management method according to claim 7 is a management method in a management device capable of managing devices that can communicate on a network and capable of sending and receiving mails. A mail acquisition step for acquiring a mail including a command for controlling the device, and a command for controlling the device described in the mail body acquired by the mail acquisition step. An instruction step for instructing the device to execute an instruction in the device, and an email body generated based on information collected from the device according to an instruction result for the device in the instruction step, get the monitoring result log file that instruction to the device by the instruction step is to log relating to failure A result mail generation step of generating the monitoring results Results have attached log files mail acquired from the device if it is that request, the result of sending the result mail created by the result mail creation step to a predetermined destination And a mail sending step.

In order to achieve the above object, the program according to claim 8 is a program that can be executed in a management device that can manage devices that can communicate over a network and can send and receive mail, and is transmitted to a predetermined destination. In addition, a mail acquisition unit that acquires a mail including a command for controlling the device is extracted from the mail, and a command for controlling the device described in the mail text acquired by the mail acquisition unit is extracted. In order to execute the command in the device, an instruction unit for instructing the device, an email text generated based on information collected from the device according to an instruction result for the device by the instruction unit, when an instruction for the apparatus by the instruction unit is a request to obtain a monitoring result log file that records a log relating to failure Result mail creation unit for creating the monitoring results Results have attached log files mail acquired from said device, said management result mail that is created as a result mail transmitting unit, for transmitting to a predetermined destination by the result mail creation unit The apparatus is made to function.

In order to achieve the above object, a management system according to claim 15 manages devices communicable over a network, and in a management system capable of sending and receiving mails, from among the mails sent to a predetermined destination. A mail acquisition unit that acquires a mail including a command for controlling the device, and a command for controlling the device described in the mail text acquired by the mail acquisition unit, An instruction unit for instructing the device to be executed by the device, and an e-mail text generated based on information collected from the device in accordance with an instruction result for the device by the instruction unit by the instruction unit acquired from the device when a request instruction for the device to obtain a monitoring result log file that records a log relating to failure A result mail creating unit that creates the monitoring results Results have attached log file mail, the result mail transmitting unit that transmits a result mail created by the result mail creation unit to a predetermined destination, and characterized in that it has a To do.

According to the present invention, it is possible to acquire a monitoring result log file in which a log related to a failure is recorded from a device capable of communication on a management target network.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram showing a schematic configuration of a network management system according to an embodiment of the present invention.

  As shown in FIG. 1, the network management system of the present embodiment is a system configured in a user site 1 that enjoys a remote monitoring service of a network system.

  The user site 1 includes a network management device 11 (a management device so-called monitoring box for managing devices that can communicate on the network), a management target device 12 and a first mail server 13. The managed device 12 in the user site is a device that can communicate with each network such as a printer, a server, and a router connected to a network (for example, an intranet) in the user site 1. In the case of a device that can communicate over a network, the first mail server 13 and the network management device 11 itself are included in addition to the management target device 12. The network management device 11 has a function of monitoring the status of each managed device 12 and the first mail server 13 and performing operation control or various operations. The network management apparatus 11 can execute control such as stop or restart of the network management apparatus 11 itself, and has functions for encrypting and decrypting electronic mail.

  The first mail server 13 has a function of transmitting an encrypted electronic mail under the control of the network management apparatus 11 and receiving an electronic mail transmitted to the network management apparatus 11 via the Internet. The first mail server 13 can also have a firewall function, and the firewall can be controlled by the network management device 11 to open and close ports.

  The support center site 2 includes a second mail server 21, a center server (management server) 22, a management member device (remote operation center ROC) 23, and a support member device 24.

  The second mail server 21 transmits to the first mail server 13 an encrypted electronic mail (instruction mail) including at least a command for the network management device 11 or the management target device 12 and, if necessary, a data file. A function of receiving status information of the management target device 12 from the first mail server 13 is also provided.

  The center server 22 controls the second mail server 21 to perform transmission / reception of electronic mail to / from the first mail server 13 and encryption / decryption of electronic mail. The center server 22 creates various reports based on the status information of the management target device 12 attached to the e-mail, and transmits the various reports to the management member device 23. At the same time, the center server 22 controls the second mail server 21 to control the second mail server 21 to encrypt the electronic mail attached with various commands or files transmitted from the management member device 23. 13 is provided.

  The management member device 23 can be composed of a normal personal computer (PC) provided with communication means capable of transmitting and receiving Internet e-mail. Further, the support member device 24 can be configured by a normal personal computer (PC) provided with communication means capable of transmitting and receiving Internet electronic mail.

  In the network management system configured as described above, the network management apparatus 11 acquires the status information from the management target devices 12 such as routers and servers existing on the network, thereby changing the status of each management target device 12. Monitor. The network management apparatus 11 controls the mail server 13 to encrypt the acquired status information on a regular or immediate basis, attach it to an e-mail, and send it to the support center site 2 via the Internet.

  In the support center site 2, the e-mail transmitted from the first mail server 13 is received by the second mail server 21, the encrypted e-mail and the attached file are decrypted, and then attached to the e-mail. The status information is transmitted to the center server 22. The center server 22 can also decrypt the encrypted electronic mail even in a system in which the encrypted electronic mail is not decrypted by the first mail server 13, analyze the status information, The result is displayed on the screen of the personal computer (PC) of the management member device 23.

  The management member of the support center site 2 monitors the network system of the user site 1 by referring to the analysis result of the status information for the management target device 12 on the display screen of the management member device 23. Thereby, in this network management system, the operating state (failure status and performance) of each managed device 12 is managed in the support center site 2.

  Further, when the network management apparatus 11 detects that a failure has occurred in the management target device 12, it transmits an encrypted e-mail as an alert notification to the support center site 2 at that time.

  In the support center site 2, when the second mail server 21 receives the alert notification, the alert notification is decrypted and transmitted to the center server 22. If the received alert notification is not decrypted by the second mail server 21, the center server 22 decrypts it by the center server 22 and displays it on the display of the personal computer (PC) of the management member device 23.

  The management member recognizes that a failure has occurred in the managed device 12 by checking the display screen of the management member device 23. Thus, in this network management system, the failure of each managed device 12 is managed (fault management) at the support center site 2. In this failure management, the management member notifies the failure notification by telephone to the office of the administrator of the user site as necessary or notifies the personal computer (PC) 25 by e-mail. In this failure management, the management member transmits a failure notification mail to the support member device 24 as necessary. The support member who has received the failure notification mail may notify the administrator of the user site by telephone or notify the personal computer (PC) 25 by mail.

  Further, for example, when updating a program of a required managed device 12 in the user site 1, the management member transmits an update command and an update file to the center server 22. Then, the center server 22 generates an encrypted electronic mail and an encrypted update file. Further, the center server 22 controls the second mail server 21 to attach the encrypted update file to the encrypted electronic mail and send it to the first mail server 13 of the user site 1. Send.

  The first mail server 13 transmits the received encrypted electronic mail and the attached file for update to the network management apparatus 11. The network management device 11 decrypts the encrypted e-mail and the attached file for update, and executes an operation for installing the update file to the management target device 12 specified based on the command.

  Furthermore, the network management apparatus 11 restarts the management target device 12 in which the update file is installed, and acquires result information confirming that the management target device 12 has been updated appropriately. Then, the network management device 11 encrypts the e-mail and the update result information, controls the first mail server 13, and transmits it to the second mail server 21 of the support center site 2.

  The second mail server 21 decrypts the e-mail attached with the encrypted update result information and transmits it to the center server 22. The center server 22 transmits an e-mail attached with the update result information to the management member device 23 to display it on the display and notify the management member.

  The management member confirms the success of the update work, and if necessary, notifies the administrator of the user site by telephone or email to complete the work.

In the network management system, a setting file (FIG. 8) is created for each network management apparatus 11, and the instruction mail transmission destination address, the encrypted mail transmission destination address, and the like can be registered in this setting file. Thereby, the setting for each customer can be easily performed by changing the setting file. For example, in the case of the instruction mail transmission address (FIG. 8 F201), after entering the space or tab after the identifier order_mailfrom (FIG. 8 F202),
1189157778140_0.jp
Enter the e-mail address as shown in FIG. A plurality of mail addresses can be registered, and the mail address and the mail address can be separated by a semicolon (;).

  Further, in this network management system, the mail address of the personal computer (PC) 25 in the office of the administrator of the user site or the mobile phone 26 used by this administrator is set in the setting file (FIG. 8 encrypted mail destination address, non-encrypted By registering it in the email address), it is possible to send an alert notification by e-mail and register it in the setting file so that the instruction mail can be received (FIG. 8 instruction mail sender address). good. Further, in this network management system, information on troubles occurring on the user site 1 side is registered in a setting file so as to be notified to the vendor 27 in charge of this system by e-mail (see FIG. (Encrypted mail transmission destination address).

  Next, identification information used when electronic mail is used in the network management system described above will be described. In this network management system, a mail address is given as identification information for specifying a predetermined user site from among a plurality of user sites and sending an e-mail. Note that the identification information is not limited to a mail address, and a user ID or the like can be given to obtain identification information. In this network management system, when using e-mail, a device ID is assigned as identification information for identifying a predetermined management target device from among a plurality of management target devices at each user site.

  Here, the mail address is set in association with each network management apparatus 11. For example, when one user has a plurality of network environments and installs the network management device 11 for managing each of them, the user has a plurality of mail addresses. In this case, if one network environment is a group composed of a plurality of managed devices 12, the mail address serves as a group ID for identifying each group.

  The device ID is unique identification information associated with each of the plurality of managed devices 12 belonging to one network environment. The association with a plurality of managed devices 12 is managed in the network management apparatus 11 to which these devices belong.

  For example, as a device ID management method, a method of managing the IP address and device ID of each managed device 12 in association with each other on the master table can be used. When this method is used, when the network management apparatus 11 acquires state information from each managed device 12, the device ID corresponding to the IP address of the managed device 12 is referred from the master table. Then, the network management apparatus 11 adds the device ID to the e-mail and transmits it to the support center site 2 side.

  In this network management system, when the managed device 12 is replaced with another device having the same function, the IP address and device ID are updated on the master table. Further, in this network management system, the case where the IP address or device ID of the management target device 12 changes is dealt with similarly.

  For example, when the support center site 2 receives an e-mail from each network management device 11, the source mail address and subject added to the e-mail are collated with the device master table. Then, based on the sender mail address, subject, IP address, and device ID, which customer's network environment the status information attached to the e-mail belongs to, and which managed device 12 in that network environment Identify if there is.

  Thus, in this network management system, the management target device 12 is managed by the “device ID” and the “mail address”, and the network environment of a plurality of users is centrally managed by one management manager. Therefore, the management member who operates the service center can manage a plurality of network environments by operating one management member device 23, and manages the status of the managed devices 12 belonging to each network environment in detail and individually. it can.

  Next, a schematic configuration of a network management apparatus used in the above-described network management system will be described with reference to FIG. FIG. 2 is a block diagram showing a schematic configuration of the network management apparatus. As shown in FIG. 2, the network management device 11 includes a CPU (Central Processing Unit) 30 that is a central processing unit.

  A CPU 30 constituting the network management apparatus 11 is connected to a memory 33 having an HDD (Hard Disk Drive) 32 and a RAM (Random Access Memory) via a bus 31. Furthermore, a USB (Universal Serial Bus) 34, an FD drive 37, and a DVD-ROM drive 38 are connected to the CPU 30 via a bus 31. A network card 36 is connected to the CPU 30 via the bus 31.

  The CPU 30 executes a control operation based on a program read from the HDD 32 storing software (system boot program or the like).

  The RAM 33 is a system work memory for the CPU 30 to operate, and is also an image memory for temporarily storing image data. The bus 31 is a path for exchanging data between each unit or module.

  Next, main functions in the network management device 11 at the user site will be described with reference to FIG. FIG. 3 is a functional block diagram showing functions related to the network management apparatus 11 installed in the user site 1.

  As shown in FIG. 3, the first mail server 13 has a function of transmitting and receiving an electronic mail such as an instruction mail in the same manner as a generally used mail server. When the first mail server 13 receives the instruction mail transmitted from the second mail server 21 of the support center site 2, the first mail server 13 transmits the instruction mail to the instruction mail receiving unit 111 of the network management device 11.

  In the network management apparatus 11, the instruction mail received by the instruction mail receiving unit 111 is transmitted to the mail validity confirmation processing unit (instruction mail extracting unit) 112. The mail validity confirmation processing unit 112 (or validity confirmation part) authenticates the validity of the instruction mail based on information such as the transmission / reception source of the instruction mail, the subject, and the keyword (the authentication result is referred to as a confirmation result). . In this way, the network management apparatus 11 extracts only the instruction mail whose validity has been authenticated, and transfers the extracted instruction mail to the mail analysis / decryption processing unit 113 (or analysis unit).

  In the mail analysis / decryption processing unit 113, the encrypted instruction mail is decrypted by the decrypting means, the instruction mail is analyzed, and the instruction content (command content) described in the instruction mail is read. In this network management system, for example, PGP (public key cryptosystem) can be used as the mail encryption scheme.

  In this network management apparatus 11, the instruction mail command read by the mail analysis / decryption processing unit 113 is transmitted to the instruction execution processing unit 114. The instruction execution processing unit 114 acquires, for example, a file to be installed in the instructed management target device 12 according to the instruction mail command, and sends this file to the instructed management target device 12. Then, the instruction execution processing unit 114 controls the management target device 12 to perform an operation of installing a file. Furthermore, the instruction execution processing unit 114 sends an instruction to restart the process processing operation of the management target device 12 and then restarts, and whether or not the installation of the file from the management target device 12 after the restart is successful. Get the result of.

  At this time, the managed device 12 that received the instruction from the instruction execution processing unit 114 receives the file, installs it, restarts it, and indicates the result of whether the file has been successfully installed. Report to the execution processing unit 114.

  Further, as a normal monitoring process, the instruction execution processing unit 114 periodically acquires the operating state of the managed device 12 and monitors the status of each managed device 12 as a monitoring item (life check, resource check, operation check, failure Monitor every confirmation.

  Although not shown, this network management system is configured so that the instruction execution processing unit 114 can manage the first mail server 13. That is, the first mail server 13 is controlled by the network management apparatus 11 including the instruction execution processing unit 114 so that processing for installing, starting, stopping, or restarting files can be executed. Further, the network management apparatus 11 sends the file to the first mail server 13 to be installed and then restarted, and causes the instruction execution processing unit 114 to report the result of whether or not the file has been successfully installed. Constitute.

  The instruction execution processing unit 114 receives data such as a result report when a file is installed or an operating state of a monitoring item received from the management target device 12 or the first mail server 13. The instruction execution processing unit 114 transmits the information to be reported collected by the network management apparatus 11 to the mail creation / encryption processing unit 115.

  When the mail creation / encryption processing unit 115 receives the information and file to be reported collected by the network management device 11, the information to be reported to the support center site 2 is described and an e-mail attached with the necessary file is sent. create. Further, the mail creation / encryption processing unit 115 encrypts the electronic mail in which the information to be reported is described and the necessary file is attached, and transmits the encrypted electronic mail to the result mail transmission unit 116.

  Then, the result mail transmission unit 116 controls the encrypted electronic mail to be transferred to the first mail server 13 and transmitted to the support center site 2 that is the reception destination by the first mail server 13. .

  Next, management processing of devices communicable over a network performed by a network management system using the network management apparatus 11 having the above-described functions will be described with reference to FIGS. FIG. 4 is a flowchart showing a procedure of management processing of devices communicable over the network.

  In this network management system, an instruction mail is transmitted from the support center site 2 to the user site 1 via the Internet.

  At the user site 1, the first mail server 13 receives an instruction mail whose mail destination is the network management device 11. The network management apparatus 11 periodically acquires an instruction mail addressed to the network management apparatus 11 from the first mail server 13 (refers to mail acquisition by the mail acquisition unit, step S201). If the obtained instruction mail is encrypted, “----- BEGIN PGP MESSAGE -----” to “----- END PGP MESSAGE- It will be alphanumeric characters surrounded by "---" ". Further, when the acquired instruction mail is not encrypted, a character string as illustrated in FIG. 7 is obtained.

  Next, the network management device 11 deletes the instruction mail acquired from the first mail server 13 so that the contents of the instruction mail are not leaked to the outside (step S202).

  Next, when the source address of the acquired instruction mail matches the source address registered in the setting file stored in advance in the network management apparatus 11 (FIG. 8 instruction mail source address) Then, the validity of the instruction mail is authenticated (YES in step S203). Here, the authentication of validity is performed based on information such as an instruction mail transmission / reception source, a subject, and a keyword. In the network management device 11, before the instruction mail receiving unit 111 obtains the instruction mail, the mail server 13 is remotely accessed, validity is authenticated, and only the instruction mail whose validity is authenticated is received as the instruction mail. The reception unit 111 may acquire the information.

  Next, when the acquired instruction mail is not sent from the mobile phone (NO in step S204) and is an encrypted mail (YES in step S205), the network management apparatus 11 decrypts the instruction mail. This is performed (step S206). In addition, when the instruction mail is sent from the mobile phone and is not encrypted (YES in step S204) and when it is determined that the instruction mail is not encrypted (NO in step S205), the instruction mail is decrypted. Skip processing. The network management apparatus 11 refers to the instruction mail sender domain (@ ezweb.ne.jp / @ docomo.ne.jp / softbank.ne.jp (service mark), etc.) It is determined whether or not is a mobile phone.

  Next, when there is an attached file in the acquired instruction mail (YES in step S207) and the attached file is encrypted (YES in step S208), the network management apparatus 11 decrypts the attached file. (Step S209). If there is no attached file (NO in step S207) and if it is determined that the attached file is not encrypted (NO in step S208), the decryption process of the attached file is skipped. Here, the types of attached files include files (environment / setting file, script file, execution format file, package file, patch file) as illustrated in FIG.

  For example, as shown in FIG. 9B, the environment / setting file has a file format of a character string (this example is a setting file relating to a system log), and the script file includes a bash script file, bsh. There are a script file, a csh script file, a bat script file, a VB script file, and the like, and there is a Perl script file (in this example, a script for acquiring a Web page) as illustrated in FIG.

  Further, in the case of a setting file related to a system log, an unencrypted attachment file (FIG. 10 when not encrypted) and an encrypted attachment file (FIG. 10 when encrypted) are illustrated in FIG. It is like.

  Next, the network management apparatus 11 executes the command described in the instruction mail (instruction unit, step S210). As illustrated in FIG. 11, the instruction content of the instruction mail includes information acquisition, start or stop of the managed device 12, start or stop of a process, acquisition of a file, file acquisition, and the like. There are infeed, system setting change and restart. The contents of the instruction mail include a script execution instruction mail (FIG. 12 (a) for encryption / non-encryption) and a file acquisition instruction mail (FIG. 12 (b) for encryption / non-encryption). In the case of (1), a file sending instruction mail (FIG. 12 (c) in case of encryption / non-encryption) is exemplified.

  For example, as shown in the script execution instruction mail in FIG. 12A, the identifier “COM” of the instruction mail is described in the first line (M201) of the text to indicate that it is a script execution instruction mail (in addition to “GET”: file acquisition, “SET”: file sending). The second line (M202) has the management number of the network management apparatus, the third line (M203) has an identifier “/ BoxSet” indicating the start position of the script execution unit, the fourth line (M204), the fifth line ( M205) and the sixth line (M206) are execution scripts. On line 7 (M207), there is an identifier “BoxSet /” indicating the end of the script execution unit.

  Here, for example, when executing the command of the script execution instruction mail, the network management device 11 confirms the presence of the command. If there is a command that does not exist and a command that results in an error, an error result mail is sent to that effect. Regardless of whether the command on an arbitrary line does not exist or an error command, all registered commands in the instruction mail are executed up to the last line. Further, in most cases, the network management device 11 sends the compressed file to the management target device 12 as it is when the file is compressed. The network management device 11 can also decompress the compressed file and send it to the managed device 12. The network management apparatus 11 compresses the file acquired from the management target device 12 and transmits the compressed file to the support center site 2. In addition, when executing the instruction mail command, the network management apparatus 11 executes all the specified commands and obtains all the specified files or sends all the files without remaining. Furthermore, if the network management apparatus 11 is abnormally terminated when the instruction mail command is executed and fails due to a communication failure, the network management apparatus 11 retries a predetermined number of times (for example, twice). Further, if the network management apparatus 11 is abnormally terminated when the instruction mail instruction is executed and fails due to a failure related to the contents of the instruction, the network management apparatus 11 terminates abnormally without retrying. Furthermore, when the network management apparatus 11 executes the instruction mail command to the plurality of managed devices 12 or the first mail server 13, if any one fails, the network management apparatus 11 is abnormally terminated.

  Next, the network management device 11 determines the result of executing the instruction mail command, and if it ends normally (YES in step S211), creates a character string “normal end” used in the subject of the result mail (step S212). ) When the network management apparatus 11 ends in an abnormal state such as failure (NO in step S211), the network management apparatus 11 creates a character string “abnormal end” used for the subject of the result mail (step S213). Further, the network management apparatus 11 outputs a normal end log or an abnormal end log to a log file (step S214).

  Next, the network management apparatus 11 creates a result mail that reports the result of executing the instruction mail command (instruction result). For this reason, the network management apparatus 11 arranges so that the result of normal termination or abnormal termination is displayed for each managed device 12 for which the instruction mail command has been executed, as necessary. Further, the network management device 11 writes the execution result contents of the instruction by the instruction mail so as to be displayed in the main body of the result mail (creates the result mail. Step S215). The contents of the result mail are as illustrated in FIGS. 13A, 13B, and 13C. The result mail for the script execution instruction mail (FIG. 12A) is shown in FIG. )become that way.

  For example, the result of the “ls” command (M204) in FIG. 12 is like M210 in FIG. 13, and the result of the “/ product / box / sbin / boxctl start” command (M205) in FIG. The result of the “rsh 192.168.10.10 chkconfig -list | grep cv.” Command (M206) in FIG. 12 becomes M212 in FIG. The result mail for the file acquisition instruction mail (FIG. 12B) is shown in FIG. 13B, and the result mail for the file sending instruction mail (FIG. 12C) is shown in FIG. This is an example of (c).

  Next, when the log file or the setting file is requested by the instruction mail command, the network management apparatus 11 attaches the attached file to the result mail (YES in step S216). Further, when the transmission source address is registered in the setting file so as to encrypt the attached file (YES in step S217), the network management apparatus 11 performs an encryption process of the attached file (step S218). If there is no attached file (NO in step S216), and if the transmission source address is not registered in the setting file (NO in step S217), such as encrypting the attached file, the attached file is encrypted. To skip.

  Next, the network management device 11 encrypts the result mail when the result mail is not received by the mobile phone (NO in step S219) and the result mail needs to be encrypted (YES in step S220). This is performed (step S221). If the result mail is received by a mobile phone (YES in step S219) and if it is not necessary to encrypt the result mail (NO in step S220), the result mail encryption process is skipped. The network management device 11 refers to the transmission destination of the result mail from the setting file and encrypts it (FIG. 8 encrypted mail transmission destination address) or does not encrypt it (FIG. 8 unencrypted mail). (Destination address) is determined (step S222).

  Next, the network management apparatus 11 controls the first mail server 13 to transmit a result mail (step S223), and ends the management process for devices that can communicate on the network.

  Further, when the network management apparatus 11 obtains the instruction mail, the transmission source address matches the transmission source address registered in the setting file stored in advance in the network management apparatus 11 (FIG. 8 instruction mail transmission source address). If not, do not authenticate the validity. As described above, when the validity of the instruction mail cannot be authenticated, the process is terminated without transmitting the result mail (NO in step S203).

  Next, management processing of devices that can communicate with a plurality of networks performed by the network management system using the network management apparatus 11 will be described with reference to FIGS. 14 and 15. FIG. 14 and FIG. 15 are flowcharts showing the procedure of management processing for devices that can communicate with a plurality of networks.

  In this network management system, an instruction mail corresponding to devices communicable with a plurality of networks is transmitted from the support center site 2 to the user site 1 via the Internet.

  In the user site 1, the instruction mail is received by the first mail server 13. The network management apparatus 11 periodically obtains an instruction mail addressed to the network management apparatus 11 from the first mail server 13 (step S301). If the acquired instruction mail is not encrypted, it becomes a character string as illustrated in FIG.

  Next, the network management apparatus 11 deletes the instruction mail acquired from the first mail server 13 so that the contents of the instruction mail are not leaked to the outside (step S302).

  Next, when the transmission source address of the acquired instruction mail matches the transmission source address registered in the setting file stored in advance in the network management apparatus 11, the network management apparatus 11 determines the validity of the instruction mail. Authentication is performed (YES in step S303).

  Next, the network management device 11 decrypts the instruction mail when the acquired instruction mail is not sent from the mobile phone (NO in step S304) and is an encrypted mail (YES in step S305). This is performed (step S306). Also, when the instruction mail is sent from the mobile phone and is not encrypted (YES in step S304), and when it is determined that the instruction mail is not encrypted (NO in step S305), the instruction mail is decrypted. Skip processing. The network management device 11 refers to the instruction mail transmission source domain (@ ezweb.ne.jp / @ docomo.ne.jp / softbank.ne.jp (including service mark), etc.). It is determined whether or not the transmission source is a mobile phone.

  Next, when there is an attached file in the acquired instruction mail (YES in step S307) and the attached file is encrypted (YES in step S308), the network management apparatus 11 decrypts the attached file. Is performed (step S309). If there is no attached file (NO in step S307) and if it is determined that the attached file is not encrypted (NO in step S308), the decryption process of the attached file is skipped.

  Next, the network management apparatus 11 collects instruction mails for a plurality of managed devices 12 for each managed device 12 (step S310). Further, an instruction mail for each managed device 12 is created as an execution file (step S311). This is performed for each device. The network management apparatus 11 repeats the operations of step S310 and step S311 until it creates execution files for all the network management apparatuses 11 that should execute the instruction (NO in step S312). This is called assembling (gathering department).

  When the network management device 11 finishes creating the execution files for all the network management devices 11 (YES in step S312), the network management device 11 sequentially executes all the execution files for each managed device 12 (step S313). The instruction content of the instruction mail includes information acquisition, activation or termination of the managed device 12, activation or termination of a process, etc., file acquisition, file sending, system setting change, and restart. In step S312, after all the execution files are created, in step S313, instead of executing all the created execution files in order, when the execution file for each management target device 12 is created, the management target devices are sequentially created. 12 may be executed.

  Next, the network management apparatus 11 acquires an execution result when the execution file is executed (step S314). Then, the network management device 11 determines the result of executing the instruction mail command for each managed device 12 and, when the management is completed normally (YES in step S315), the character string “normal end” used for the subject of the result mail Is created (step S316). Further, when the network management apparatus 11 ends in an abnormal state such as failure (NO in step S315), the network management apparatus 11 creates a character string “abnormal end” used for the subject of the result mail (step S317). Further, the network management apparatus 11 outputs a normal end log or an abnormal end log to a log file (step S318).

  Next, the network management apparatus 11 creates a text of a result mail that reports a result of normal termination or abnormal termination for each managed device 12 for which the instruction mail command has been executed (step S319). Furthermore, the network management apparatus 11 writes the execution result contents of the instruction by the instruction mail so as to be displayed in the text of the result mail (step S320).

  Next, when the log file or the setting file is requested by the instruction mail instruction, the network management apparatus 11 attaches the attached file to the result mail (YES in step S321). Further, when the transmission source address is registered in the setting file so as to encrypt the attached file (YES in step S322), the network management apparatus 11 performs an encryption process of the attached file (step S323). Further, when there is no attached file (NO in step S321) and when the transmission source address is not set (NO in step S322) so that the attached file is encrypted, the encryption process of the attached file is skipped. .

  Next, the network management apparatus 11 does not receive the result mail as a mobile phone (NO in step S324), and the transmission source address is registered in the setting file so that the text of the result mail is encrypted ( The result mail is encrypted (YES in step S325) (step S326). In addition, when the result mail is received by a mobile phone (YES in step S324) and when the sender address is not registered in the setting file (NO in step S325) so as to encrypt the text of the result mail. Skips the process of encrypting the result mail.

  Next, the network management apparatus 11 determines whether a result mail transmission destination is designated for each management target device 12 (step S327). In step S327, whether or not the result mail transmission destination is designated for each managed device 12 is determined by referring to the setting file (FIG. 8). If the destination of the result mail is specified for each managed device 12 (YES in step S327), the network management apparatus 11 acquires the transmission destination from the setting file (YES in step S327). If the result mail transmission destination is not designated for each managed device 12 (NO in step S327), the network management apparatus 11 acquires the transmission destination from the setting file (step S329).

  Next, the network management apparatus 11 controls the first mail server 13 to transmit a result mail (step S330), and ends the management process for devices that can communicate on the network. In addition, when a plurality of transmission destinations are set as the transmission destination of the result mail for each management target device 12, the transmission is made to the set transmission destination.

  Further, when the network management apparatus 11 acquires the instruction mail, if the transmission source address does not match the transmission source address registered in the setting file stored in advance in the network management apparatus 11, the network management apparatus 11 does not authenticate the validity. . As described above, when the validity of the instruction mail cannot be authenticated, the result mail is not transmitted and the process is terminated (NO in step S303).

  As described above, according to the present invention, bidirectional information transmission can be performed using electronic mail transmitted and received via the Internet. Therefore, if a command is sent to a device management apparatus communicable over the network, the device management apparatus communicable over the network communicates with an instruction or network for controlling a device communicable over the network, such as a managed device. Instruct the possible devices to exchange information.

  In addition, a management apparatus for devices that can communicate over a network has a function of receiving an electronic mail transmitted via the Internet and extracting an appropriate instruction mail from the received electronic mail. Furthermore, since the management apparatus for devices that can communicate over the network can decrypt the instruction mail and encrypt the result mail, it is possible to ensure security when information is transmitted over the Internet. At the same time, managed devices managed by a management device for devices that can communicate over a network omit the functions for handling e-mail and the function of encryption or decryption, simplify the configuration, and manufacture inexpensively. It becomes possible.

  In addition, the administrator can control the management target device by the instruction mail, extract necessary information, receive the information by the result mail, analyze the information of the result mail, and instruct the required countermeasure by the instruction mail. it can. Therefore, there is an effect that the administrator can quickly control the management target device by remote control via the Internet without going to the location of the management target device or the like.

  Next, an effective usage example of the above-described network management system will be described. In this network management system, a network management device 11 at a remote location constantly monitors the device 12 to be managed and the first mail server 13. Then, when a failure occurs in the management target device 12 or the first mail server 13, the network management apparatus 11 notifies the support center site 2 side by an encrypted mail. Then, since the management member device 23 is notified that there is a failure, the management member who has received this notification is the personal computer (PC) 25 in the office of the administrator of the user site or the mobile phone used by the administrator. 26 is notified that there was a failure.

  The administrator of the user site transmits an instruction mail to the network management device 11 using the personal computer (PC) 25 or the mobile phone 26 in the office of the administrator of the user site in order to find the cause of the failure. In this instruction mail, contents for instructing acquisition of a monitoring result log file, a setting file, and the like in which a log (syslog) relating to a failure is recorded are described. Upon receiving this instruction, the network management apparatus 11 transmits the monitoring result log file, setting file, etc. relating to the failure to the personal computer (PC) 25 of the office of the administrator of the user site by e-mail. Upon receiving this e-mail, the administrator of the user site obtains information related to the failure and isolates the content of the failure.

  Thus, when the cause of the failure and the countermeasures are found, the administrator of the user site issues a command for restarting the managed device 12 or the first mail server 13, which serves as the countermeasure for the failure, to the network management. Transmit to device 11. At this time, the administrator of the user site can transmit an e-mail (instruction mail) for coping with the failure with the personal computer (PC) 25 from the office of the administrator of the user site located away from the user site 1. In addition, when the administrator of the user site is out, an e-mail (instruction mail) for coping with a failure can be transmitted from the mobile phone 26. Therefore, the administrator of the user site does not have to go to the location where the managed device 12 and the first mail server 13 of the user site 1 are installed and operate these devices, so that it is quick and easy to deal with a failure. I can deal with it.

  The network management apparatus 11 that has received the e-mail (instruction mail) for coping with this failure executes the content of the instruction described in the instruction mail, and sends the result to the e-mail (result mail). ) To report. The administrator of the user site that has received this report can confirm the result of the early response to the failure that has occurred.

  In particular, when the failure detected by the network management device 11 is an attack from the Internet against the Web server or the like of the user site 1, the attack content can be analyzed early by acquiring a log file of the device. Therefore, the administrator of the user site should take countermeasures appropriately corresponding to the attack contents from the Internet, such as sending an instruction mail to the network management device 11 and closing the firewall port of the first mail server 13. Can do. Furthermore, an attack from the Internet can be dealt with by stopping the device such as the first mail server 13 until the countermeasure is completed. In this way, if the administrator of the user site responds to an attack from the Internet at an early stage, damage can be minimized.

  When the vendor 27 requests a log file and a setting file regarding a failure detected by the network management device 11, the network management device 11 is instructed by an instruction mail, and the log file and the setting file are directly transmitted to the vendor 27. Can be made.

  It should be noted that the management of the support center site 2 may be performed in response to the above-described failure, instead of the administrator of the user site.

  In addition, the management member device 23, the personal computer (PC) 25, and the mobile phone 26 provide the network management device 11 with necessary instructions (for example, monitoring stop / restart / monitor setting change / log acquisition / command input). Is possible.

  Therefore, in this network management system, remote control can be performed using the management member device 23, the personal computer (PC) 25, and the mobile phone 26. When this remote control is used, it is possible to stop the device in the event of a sudden power failure, legal inspection, etc., and to restart the process / service in which the failure has occurred to restore the device. Furthermore, when using this remote control, it is possible to stop and restart the equipment in the maintenance plan, and to acquire data that will serve as materials for future maintenance plans.

  When using this remote control, it is possible to send files to the device, send new programs, add functions, install new packages and add functions.

  When using this remote control, it is possible to change the setting by sending a setting file to the device in the maintenance plan. When using this remote control, it is possible to send a patch file and apply a patch to the device during maintenance (Unix (registered trademark), network device). When this remote control is used, an Update file can be sent and Windows (registered trademark) update can be performed during maintenance (Windows (registered trademark) system).

  In this network management system, the functions are integrated in the network management apparatus 11. That is, in this network management system, the network management device 11 has a function of encrypting and decrypting an electronic mail (instruction mail, result mail) that ensures communication security. Further, the network management device 11 has a function of receiving an electronic mail transmitted from the center server via the Internet, and a function of determining that the received electronic mail is an instruction mail from the center server. Therefore, each managed device 12, the first mail server 13 and the like do not need a function for encrypting and decrypting an e-mail, a function for receiving an e-mail, and a function for determining whether it is an instruction mail. These configurations can be simplified.

  In addition, the network management device 11 individually controls a large number of monitoring target devices 12 and the first mail server 13 in the user site 1 to exchange data. Therefore, the management member device 23, the personal computer (PC) 25, and the like can eliminate operations such as individually controlling a large number of devices 12 to be monitored and the first mail server 13.

  Furthermore, in this network management system, the management target device 12 and the like can be remotely controlled via the network management device 11 using the electronic mail by the management member device 23, the personal computer (PC) 25, and the like. That is, the administrator of the user site or the management member of the support center site 2 does not need to go to the installation location of the management target device 12 and directly operate it. Therefore, the administrator of the user site or the management member of the support center site 2 can quickly cope with the emergency by remotely controlling the management target device 12 and the like from a location away via the Internet in an emergency.

  Note that the present invention is not limited to the above-described embodiment, and can be appropriately changed without departing from the gist of the present invention.

  The object of the present invention can be achieved by executing the following processing. That is, a storage medium that records a program code of software that implements the functions of the above-described embodiments is supplied to a system or apparatus. This can be achieved by the computer (or CPU, MPU, etc.) of the system or apparatus reading the program code stored in the storage medium and executing the processing.

  In this case, the program code itself read from the storage medium realizes the functions of the above-described embodiment, and the computer-readable storage medium storing the program code constitutes the present invention. become. In addition, in the present invention, an OS (operating system) or the like running on the computer performs part or all of the actual processing based on the instruction of the program code, and the functions of the above-described embodiments are realized by the processing. It may be configured as described above. Furthermore, in the present invention, the program code read from the storage medium is configured to be written into a memory provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer. Then, based on an instruction of the program code, a CPU or the like provided in the function expansion board or function expansion unit may be configured to perform part or all of the actual processing. The following can be used as a storage medium for supplying the program code. For example, floppy (registered trademark) disk, hard disk, magneto-optical disk, CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD + RW, magnetic tape, nonvolatile memory card, ROM or the like. Alternatively, the program code may be downloaded via a network.

It is a block diagram which shows schematic structure of the network management system concerning embodiment of this invention. It is a block diagram which shows the schematic structure of the network management apparatus used with the network management system concerning this Embodiment. It is a functional block diagram which shows the function in connection with the network management apparatus installed in the user site in the network management system concerning this Embodiment. It is a flowchart which shows the procedure of the management process of the apparatus which can communicate on a network. It is a flowchart which shows the procedure of the management process of the apparatus which can communicate on a network. It is explanatory drawing which illustrates the description content of the instruction | indication mail encrypted. It is explanatory drawing which illustrates the description content of the instruction mail which is not encrypted. It is explanatory drawing which illustrates the description content of the setting file stored in the network management apparatus. (A) (b) (c) is explanatory drawing which illustrates the kind of attachment file attached to an instruction | indication mail or a result mail. It is explanatory drawing which illustrates the unencrypted attachment file and encrypted attachment file which are attached to an instruction | indication mail or a result mail. It is explanatory drawing which illustrates the instruction | indication content described in the instruction | indication mail. (A) (b) (c) is explanatory drawing which illustrates the description content of instruction mail. (A) (b) (c) is explanatory drawing which illustrates the description content of a result mail. It is a flowchart which shows the procedure of the management process of the apparatus which can communicate in a some network. It is a flowchart which shows the procedure of the management process of the apparatus which can communicate in a some network. (A) (b) (c) is explanatory drawing which illustrates the description content of a result mail.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 User site 2 Support center site 11 Network management apparatus 12 Management object apparatus 13 1st mail server 21 2nd mail server 22 Center server 23 Management member apparatus 24 Support member apparatus 25 Personal computer (PC)
26 Mobile phone 27 Vendor 30 CPU
31 bus 32 HDD
33 RAM
34 USB
36 Network Card 37 FD Drive 38 DVD Drive 111 Instruction Mail Receiving Unit 112 Mail Validity Confirmation Processing Unit 113 Mail Analysis / Decryption Processing Unit 114 Instruction Execution Processing Unit 115 Mail Creation / Encryption Processing Unit 116 Result Mail Transmission Unit

Claims (15)

In the management device that can send and receive mail while managing devices that can communicate on the network,
A mail acquisition unit for acquiring a mail including a command for controlling the device from the mail transmitted to a predetermined destination;
An instruction unit for instructing the device to take out a command for controlling the device described in the mail text acquired by the mail acquisition unit, and to execute the command in the device;
In accordance with an instruction result for the device by the instruction unit, a monitoring result log file in which a log related to a failure of an instruction to the device by the instruction unit is recorded in a mail body generated based on information collected from the device. A result mail creation unit that creates a result mail with the monitoring result log file acquired from the device in the case of a request to be acquired;
A result mail sending unit for sending the result mail created by the result mail creating unit to a predetermined destination;
A management apparatus comprising: An attached file acquisition unit for acquiring a predetermined file attached to the email acquired by the email acquisition unit;
The instruction unit takes out a command for controlling the device described in the mail text acquired by the mail acquisition unit, sends the predetermined file acquired by the attached file acquisition unit to the device, and The management apparatus according to claim 1, wherein an instruction is given to the device according to a command. An analysis unit for analyzing the email acquired by the email acquisition unit;
If the analysis result by the analysis unit analyzes that the extracted mail is encrypted, a decryption processing unit that decrypts the mail;
When the destination sent by the result mail sending unit is a destination for sending an encrypted mail, an encryption processing unit for encrypting the created result mail;
The management apparatus according to claim 1, further comprising: A legitimacy confirmation unit for confirming the legitimacy of the mail from the sender, subject and keyword of the mail sent to a predetermined destination;
The said mail acquisition part acquires the mail containing the instruction | command for controlling the said apparatus according to the confirmation result by the said validity confirmation part, The one of Claims 1 thru | or 3 characterized by the above-mentioned. Management device. If the mail acquired by the mail acquisition unit includes a command for controlling a plurality of the devices, the mail acquisition unit further includes an assembly unit that collects the commands for each device,
The said instruction | indication part instruct | indicates with respect to every said apparatus so that the said instruction | command for every said apparatus assembled | assembled by the said assembly part may be performed for every said apparatus. The management device according to item.   6. The result mail creation unit creates a result mail for each device when information collected according to an instruction result by the instruction unit is collected for each device. The management device according to any one of the above. In the management method in the management device capable of sending and receiving mails while managing devices that can communicate on the network,
A mail acquisition step of acquiring a mail including a command for controlling the device from the mail transmitted to a predetermined destination;
An instruction step for instructing the device to take out a command for controlling the device described in the mail text acquired by the mail acquisition step and to execute the command in the device;
According to the instruction result for the device in the instruction step, a monitoring result log file in which a log related to a failure in the instruction to the device in the instruction step is recorded in a mail body generated based on information collected from the device. A result e-mail creation step for creating a result e-mail attached with the monitoring result log file acquired from the device when the request is to be acquired; and
A result mail sending step for sending the result mail created by the result mail creating step to a predetermined destination;
The management method characterized by having. A program that can be executed on a management device capable of sending and receiving mail while managing devices that can communicate on a network,
A mail acquisition unit for acquiring a mail including a command for controlling the device from the mail transmitted to a predetermined destination;
An instruction unit for instructing the device to take out a command for controlling the device described in the mail text acquired by the mail acquisition unit and to execute the command in the device;
In accordance with an instruction result for the device by the instruction unit, a monitoring result log file in which a log related to a failure of an instruction to the device by the instruction unit is recorded in a mail body generated based on information collected from the device. A result mail creation unit that creates a result mail with the monitoring result log file acquired from the device attached when the request is to be acquired;
A result mail sending unit for sending the result mail created by the result mail creating unit to a predetermined destination;
A program for causing the management device to function as: Causing the management device to function as an attached file acquisition unit that acquires a predetermined file attached to an email acquired by the email acquisition unit;
The instruction unit takes out a command for controlling the device described in the mail text acquired by the mail acquisition unit, sends the predetermined file acquired by the attached file acquisition unit to the device, and The program according to claim 8, wherein an instruction is given to the device according to a command. An analysis unit for analyzing the mail acquired by the mail acquisition unit;
If the analysis result by the analysis unit analyzes that the extracted mail is encrypted, a decryption processing unit that decrypts the mail,
If the destination sent by the result mail sending unit is a destination for sending encrypted mail, an encryption processing unit for encrypting the created result mail;
The program according to claim 8 or 9, wherein the management device is caused to function as: Causing the management device to function as a legitimacy confirmation unit that verifies the legitimacy of the mail from the sender, subject, and keyword of the mail transmitted to a predetermined destination;
The said mail acquisition part acquires the mail containing the instruction | command for controlling the said apparatus according to the confirmation result by the said validity confirmation part, The any one of Claim 8 thru | or 10 characterized by the above-mentioned. Program . If the mail acquired by the mail acquisition unit includes a command for controlling a plurality of the devices, the management device functions as a collecting unit that collects the commands for each device,
The said instruction | indication part instruct | indicates with respect to the said every apparatus so that the said instruction | command for every said apparatus assembled | assembled by the said assembly part may be performed for every said apparatus. The program described in the section. 13. The result mail creation unit creates a result mail for each device when information collected according to an instruction result by the instruction unit is collected for each device. The program according to any one of the above items.   A computer-readable storage medium storing the program according to claim 8. In a management system that can send and receive mail while managing devices that can communicate on the network,
A mail acquisition unit for acquiring a mail including a command for controlling the device from the mail transmitted to a predetermined destination;
An instruction unit for instructing the device to take out a command for controlling the device described in the mail text acquired by the mail acquisition unit, and to execute the command in the device;
In accordance with an instruction result for the device by the instruction unit, a monitoring result log file in which a log related to a failure of an instruction to the device by the instruction unit is recorded in a mail body generated based on information collected from the device. A result mail creation unit that creates a result mail with the monitoring result log file acquired from the device in the case of a request to be acquired;
A result mail sending unit for sending the result mail created by the result mail creating unit to a predetermined destination;
A management system comprising:

Images