JPH06175887A - Fault monitoring/reporting system - Google Patents

Abstract

PURPOSE:To optimize maintenance and operations by arbitrarily setting a threshold value as the number of times of generating faults to be prevented and maintained from a manager and outputting a message to a terminal or the like when the number of times of generating faults by the fault contents of an alarm received on the manager side reaches the threshold value. CONSTITUTION:A manager function 1 receives alarm report information from an agent function 2 through a communication control part 22 and an alarm reception processing part 21, further moves to a counter control part 20 and updates a counter corresponding to the contents of the alarm stored in a memory 16. Then, the contents of the updated counter are compared with the threshold value stored in the memory 16 corresponding to the counter by a counter value/threshold value comparison processing part 19 and when the content of the counter is equal or larger than the threshold value, fault information corresponding to the contents of the alarm can be displayed at a monitor terminal 12. Thus, a system manager can recognize the generation of the fault to be prevented and maintained at the agent function 2.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network management system composed of a manager function and an agent function, and to a management system for alarm information reported from the agent function.

[0002]

2. Description of the Related Art In a network management system composed of a manager function and an agent function, there is an alarm notification function as a means for reporting a failure occurring on the agent side to the manager function.

Faults that occur on the agent side include serious ones that should be reported immediately, mild ones that cause fault recovery as a result of recovery processing or retry, or warnings.

Although it is necessary to immediately report a serious failure, the minor or warning failure related to the present invention shows a sign that it will eventually become a serious failure. Each time a failure occurs, the counter is updated and the corresponding counter is updated. When the number of failures exceeds the prescribed number (threshold value) determined in maintenance operation, it is reported to the system administrator and preventive maintenance of the system is performed. Was used for.

As described above, in the conventional method according to the present invention, the threshold value of the number of failure occurrences is determined by the experience of the person who maintains and operates the system.

As a related technique, for example, Japanese Patent Laid-Open No.
-117854 can be mentioned.

[0007]

As described above, conventionally, the threshold value for a minor or warning failure that has occurred on the agent side is determined by the experience of the person who performs maintenance and operation, etc. Since it is built in, the threshold may not be a value commensurate with maintenance.

Further, since the threshold value is manually input, there is a problem that the threshold value must be changed every time the system is changed.

[0009]

According to the present invention, a manager is provided with a mechanism for collecting the number of occurrences of minor or warning failures on the agent side for each alarm type for a certain period of time, and the number of failures occurrences collected The optimum threshold value is obtained based on the actual value of and the set threshold value. further,
The number of failures that occurred on the agent side is collected again, and the threshold is dynamically optimized.

[0010]

[Operation] The threshold value is optimized by comparing the actual value of the number of failure occurrences collected for a certain period with the threshold value and lowering the numerical value of the threshold value when the actual value is extremely smaller than the threshold value. If the value is larger than the threshold value, report it to the system administrator, and if there is no problem, increase the threshold value.

[0011]

Embodiments of the present invention will be described in detail below with reference to the drawings.

FIG. 1 is a diagram schematically showing an embodiment of the present invention, and FIG. 2 is a flow chart for explaining a threshold optimization operation. In FIG. 1, 1 is a manager function, 2
Is an agent function, and 3 is a communication line connecting the manager function and the agent function.

In the network system to which the present invention is applied, as shown in FIG. 1, the manager function 1 includes an operation terminal 11, a monitoring terminal 12, a threshold recording file 13, a counter recording file 14, and a threshold control. Part 15, MS
(Memory) 16, threshold value optimization processing unit 17, timer monitoring processing unit 18, counter value-threshold value comparison processing unit 19,
A counter control unit 20, an alarm reception processing unit 21, and a communication control unit 22 are provided, and the agent function 2 includes a communication control unit 3
1, an alarm creation processing unit 32, and a failure detection mechanism 33.

The manager function 1 is the agent function 2
Receives the alarm notification information from the communication control unit 22 and the alarm reception processing unit 21 and further shifts to the counter control unit 20 to update the counter corresponding to each alarm content stored in the MS (memory) 16 (+1). ) Do. Then, the counter value-threshold value comparison processing unit 19 compares the updated contents of the counter with the threshold value stored in the MS (memory) 16 corresponding to the counter, and compares the contents of the counter. Is equal to or larger than the threshold value, the failure information corresponding to the content of the alarm is displayed on the monitoring terminal 12. As a result, the system administrator can know that a failure symptom for preventive maintenance has occurred in the agent 2.

Further, the manager function 1 has a timer monitoring processing section 18 which is activated periodically, and reports to the threshold value control section 15 and the counter value control section 20 when a certain time elapses. Upon receiving the report, the threshold control unit 15 transfers control to the threshold optimization processing unit 17, compares the counter stored in the MS (memory) 16 with the threshold, Optimize. Upon receiving the report, the counter control unit 20 clears all the counters stored in the MS (memory) 16 to zero.

In the agent function 2, when a failure occurs, the failure detection mechanism 33 detects the failure, then the alarm creation processing section 32 creates alarm notification information, and the communication control section 3
The alarm notification information is transferred to the manager function 1 through 1 to perform the alarm notification.

Further, in the system stop processing of the manager function 1, the threshold information recording file 13 and the counter information recording file 14 are stored as the threshold information and the counter information stored in the MS (memory) 16, respectively. By storing and holding the information in the memory, it is possible to hold the threshold information that was effective before the system was stopped and the number of times the failure occurred.

In the system startup process of the manager function 1, the threshold information and the counter information stored / held in the threshold information recording file 13 and the counter information recording file 14 are read out, and the MS
By storing it in the (memory) 16, the alarm notification process can be continued after the system is stopped.

When it is necessary to change the threshold information, after displaying the set threshold information on the operation terminal 11 connected to the manager function 1,
New threshold information is arbitrarily manually input from the operation terminal 11. The input new threshold information is passed to the threshold control unit 15, and the new threshold information is transferred to the MS (memory).
The threshold information stored in 16 is replaced.

Next, the processing operation for threshold optimization will be described with reference to FIG.
It will be described with reference to the flowchart shown in FIG.

First, the number of times of failure of each alarm type is compared with the corresponding threshold value (step 100). If the number of times of failure is smaller than the threshold value, the number of times of failure occurrence and the threshold value are compared. Compare the differences (step 10
1) If the difference exceeds the allowable range, the threshold value is lowered (step 102). If the allowable range is not exceeded, the threshold will not be optimized. If the number of failures has exceeded the threshold value, the system administrator is requested to respond whether preventive maintenance is required (step 10).
3) Increase the threshold if not necessary (step 10
4) If necessary, the threshold value is not optimized.

Finally, it is judged whether or not the optimization of the threshold values of all the alarm types is completed (step 105), and if not completed, the alarm type to be judged is changed, the process returns to the beginning of the flowchart, and when it is completed. Ends the threshold optimization process.

[0023]

As described in detail above, according to the present invention, various fault information generated on the agent side is
When the manager sets an arbitrary value (threshold value) for the number of failure occurrences that should be preventatively maintained by the manager, and when the number of failure occurrences for each alarm content received by the manager reaches the threshold value, a message is sent to the terminal etc. By outputting, it is possible to avoid overlooking the failure occurrence content that requires early countermeasures.

Further, since the threshold optimization function automatically changes the actual value of the number of times of failure to an appropriate threshold, it becomes unnecessary to revise the threshold.

[Brief description of drawings]

FIG. 1 is a diagram schematically showing an embodiment of the present invention.

FIG. 2 is a flowchart illustrating an operation of optimizing a threshold value.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 ... Manager function, 2 ... Agent function, 3 ... Communication line, 11 ... Operation terminal, 12 ... Monitoring terminal, 13 ... Threshold recording file, 14 ... Counter recording file, 15 ... Threshold control part, 16 ... MS (Memory), 17 ... Threshold optimization processing section, 18 ... Timer monitoring processing section, 19 ... Counter value-threshold comparison processing section, 20 ... Counter control section, 21 ... Alarm reception processing section, 22 ... Communication control section , 31 ... Communication control unit, 32 ... Alarm creation processing unit, 33 ... Failure detection mechanism.

Claims (4)

[Claims] 1. A fault management function of a network management system comprising a manager function and an agent function in a computer network system, wherein an alarm function is reported to the agent function, and a failure occurs for each alarm type in the manager function. Update the number /
If a failure occurs in the network resource where the agent function exists, the manager function is provided with the processing unit that holds it and the specified number (threshold value) of the failure occurrence number that is dynamically optimized corresponding to the alarm type. When the number of alarm occurrences reported in the above is reached within a certain period of time and the corresponding threshold value is reached, the output device reports to the operator or network / system administrator, and when a certain period of time is reached, A fault monitoring / notification method characterized in that the number of fault occurrences for each alarm type is cleared to zero. 2. The specified number (threshold value) of the dynamically optimized failure occurrence number according to claim 1, wherein the failure occurrence count corresponds to the alarm type that has occurred within a certain period of time. Fault monitoring / notification method characterized by automatically determining based on the value. 3. The system according to claim 1, further comprising means for storing and holding the threshold value and the counter for the number of failures in an external storage device from a memory by an operator command or a system stop instruction, after the system is stopped. ,
A fault monitoring / notification method that can recover from external storage to memory when the system is restarted. 4. The manager according to claim 1, wherein the manager function includes means for displaying the threshold value on an output device and means for resetting the threshold value from an input device, and the threshold value can be arbitrarily changed. Fault monitoring / notification method.