Summary of the invention
In view of the above problems, the present invention has been proposed in order to a kind of method for supervising and supervisory control system of the content distributing network that overcomes the problems referred to above or address the above problem at least in part are provided.
According to one aspect of the present invention, provide a kind of method for supervising of content distributing network.This content distributing network comprises a plurality of network nodes that are associated with the webserver, the method comprises: the appointment moment access log before that obtains the webserver, therefrom obtain network node and return Source log, return Source log according to network node and determine effective network node tabulation; The active block node listing is sent to one or more monitor node, so that each network node in one or more monitor node access active block node listing, and access log monitored in record separately; And according to the monitoring access log that a plurality of monitor nodes record, determine unusual network node tabulation; Travel through each the unusual network node in the unusual network node tabulation, search the Source log that returns that whether has this unusual network node the access log after the appointment constantly of the webserver, if there is no, then should the deletion from unusual network node tabulation of unusual network node.
Alternatively, obtain the appointment moment access log before of the webserver, therefrom obtaining network node returns Source log and comprises: each the bar access log before the appointment of the webserver that traversal is obtained constantly, judge by the access links in this access log whether this access log returns Source log as network node, then to keep, otherwise deletion is returned Source log thereby obtain network node.
Alternatively, return Source log according to network node and determine that effective network node tabulation comprises: return each network node that occurs in the Source log for network node, according to network node return Source log judge this network node return the source number of times whether be less than preset value and last Hui Yuan whether second specify constantly before, be to judge that then this network node is invalid, otherwise network node is put into the active block node listing.Wherein, second specify the moment to be a time point before specifying constantly.
Alternatively, the monitoring access log that records according to a plurality of monitor nodes, determine that unusual network node tabulation comprises: for a network node, if the monitoring access log that one or more monitor nodes record shows, at least one monitor node is accessed this network node abnormality, and the number of times of access exception reaches pre-determined number, determines that then this network node is unusual network node, and this node is put into unusual network node tabulation.
Alternatively, a plurality of monitor nodes are a plurality of monitor nodes that are distributed in the heterogeneous networks position.
According to a further aspect in the invention, provide a kind of supervisory control system of content distributing network, this supervisory control system comprises: one or more monitor nodes and monitoring server.Each monitor node is suitable for accessing each network node in the active block node listing, and record monitoring access log, and the monitoring daily record of recording is returned to monitoring server; This monitoring server comprises: journal processing unit, be suitable for obtaining the access log before the appointment constantly of the webserver, and therefrom obtain network node and return Source log; Effectively the node determination unit is suitable for returning Source log according to the network node that journal processing unit obtains and determines effective network node tabulation; The monitor node linkage unit, be suitable for the active block node listing is sent to one or more monitor nodes, and receive the monitoring access log that one or more monitor nodes return, generate when monitoring access log by each network node in the monitor node access active block node listing; And the abnormal nodes determining unit, be suitable for according to the monitoring access log, determine unusual network node tabulation.
Alternatively, journal processing unit is suitable for obtaining the appointment moment access log afterwards of the webserver; The abnormal nodes determining unit is suitable for traveling through each the unusual network node in the unusual network node tabulation, search the Source log that returns that whether has this unusual network node the access log after the appointment of the webserver that obtains from journal processing unit constantly, if there is no, then should the deletion from unusual network node tabulation of unusual network node.
Alternatively, journal processing unit is suitable for traveling through the appointment moment each bar access log before of the webserver that obtains, judge by the access links in this access log whether this access log returns Source log as network node, then to keep, otherwise deletion is returned Source log thereby obtain network node.
Alternatively, effectively the node determination unit is suitable for network node is returned each network node that occurs in the Source log, according to network node return Source log judge this network node return the source number of times whether be less than preset value and last Hui Yuan whether second specify constantly before, be to judge that then this network node is invalid, otherwise network node is put into the active block node listing.Wherein, second specify the moment to be a time point before specifying constantly.
Alternatively, the monitoring access log that the abnormal nodes determining unit is suitable for recording at one or more monitor nodes shows, for a network node, at least one monitor node is accessed this network node abnormality, and when the number of times of access exception reaches pre-determined number, determine that this network node is unusual network node, this node is put into unusual network node tabulation.
Alternatively, a plurality of monitor nodes are distributed in the different network sites.
According to this appointment moment access log before that obtains the webserver of the present invention, therefrom obtain network node and return Source log, return Source log according to network node and determine effective network node tabulation, the active block node listing is sent to one or more monitor node, so that each network node in one or more monitor node access active block node listings, and access log monitored in record separately, and, the monitoring access log that records according to a plurality of monitor nodes, determine the technical scheme of unusual network node tabulation, can effectively monitor the unusual network node of content distributing network, solve thus the monitoring problem of the unusual network node in the content distributing network, obtained the beneficial effect that effectively content distributing network is carried out maintenance and management.
Above-mentioned explanation only is the general introduction of technical solution of the present invention, for can clearer understanding technological means of the present invention, and can be implemented according to the content of specification, and for above and other objects of the present invention, feature and advantage can be become apparent, below especially exemplified by the specific embodiment of the present invention.
Embodiment
Exemplary embodiment of the present disclosure is described below with reference to accompanying drawings in more detail.Although shown exemplary embodiment of the present disclosure in the accompanying drawing, yet should be appreciated that and to realize the disclosure and the embodiment that should do not set forth limits here with various forms.On the contrary, it is in order to understand the disclosure more thoroughly that these embodiment are provided, and can with the scope of the present disclosure complete convey to those skilled in the art.
Fig. 2 shows according to an embodiment of the invention composition and the outside connection diagram of the supervisory control system 200 of content distributing network.Here content distributing network comprises a plurality of network nodes 320 that are associated with the webserver 310, does not illustrate the incidence relation between the webserver 310 and the network node 320 among Fig. 2.The distribution of the service content that network node 320 realizations and the webserver 310 provide.The supervisory control system 200 of content distributing network comprises one or more monitor nodes 210 and monitoring server 220.The monitoring management that the supervisory control system 200 of content distributing network realizes each network node 320.
Fig. 3 shows the according to an embodiment of the invention deployment schematic diagram of supervisory control system in real network of content distributing network.Referring to Fig. 3, user terminal 110, CDN node 120, Web server 130, monitor node 210 and monitoring server 220 have been illustrated in this network design schematic diagram.User terminal 110 obtains the service that Web server 130 provides by CDN node 120, CDN node 120 is for guaranteeing the ageing of service that web server 130 provides, timer access web server 130, with the information on the assurance CDN node 120 and the consistency of the information on the web server 130, these CDN nodes 120 have formed a content distributing network.And the supervisory control system of monitor node 210 and monitoring server 220 constitution content distributing networks is used for realization to the monitoring of each CDN node 120.Here, Web server 130 is the webserver 310 among Fig. 2, and CDN node 120 is the network node 320 among Fig. 2.
Referring to Fig. 2 and Fig. 3 technical scheme of the present invention is elaborated.
Referring to Fig. 2 and Fig. 3, the supervisory control system 200 of content distributing network comprises one or more monitor nodes 210 and monitoring server 220.In Fig. 2, illustrated two monitor nodes 210, illustrated three monitor nodes 210 among Fig. 3, but this all can not be as the restriction to the monitor node number in the supervisory control system of content distributing network of the present invention.
Referring to Fig. 2, monitoring server 220 comprises journal processing unit 221, effective node determination unit 222, monitor node linkage unit 223 and abnormal nodes determining unit 224.
Journal processing unit 221 obtains the appointment moment access log before of the webserver 310, therefrom obtains network node and returns Source log, use when determining effective network nodes tabulation for effective node determination unit 222.
Particularly, journal processing unit 221 is suitable for traveling through the appointment moment each bar access log before of the webserver 310 that obtains, judge by the access links in this access log whether this access log returns Source log as network node, then to keep, otherwise deletion is returned Source log thereby obtain network node.
For example, in network design shown in Figure 3, it is as follows that the CDN node returns the Source log example:
119.146.194.11121.8.137.56--[18/Sep/2012:23:59:59+0800]"GET/secache.html?39130838.html?HTTP/1.1″20085861"-""Mozilla/4.0(compatible;MSIE8.0;Windows?NT6.1;WOW64;Trident/4.0;SLCC2;.NETCLR2.0.50727;.NET?CLR3.5.30729;.NET?CLR3.0.30729;MAAR;.NET4.0C;.NET?CLR1.1.4322;.NET4.0E;Media?Center?PC6.0;360SE)″"-"hao.360.cn75686138167984
Wherein " GET/secache.html 39130838.html HTTP/1.1 " represents the http request secache.html(page of access node, this page does not exist in fact, web server receives this request will return home tip), namely the CDN node returns the source request and will send the request such as the http of upper pathway to web server.Owing to asking with timestamp parameter, and not preserving corresponding page info on the CDN node, therefore request penetrates the CDN node and directly accesses web server.
The log example of normal users request is as follows:
61.164.60.244175.180.112.40,203.66.41.51--[19/Sep/2012:00:00:00+0800]"GET/xinwenmeiti.html?HTTP/1.1"20015886"http://hao.360.cn/""Mozilla/5.0(compatible;MSIE9.0;Windows?NT6.1;WOW64;Trident/5.0;MAAU)""-"hao.360.cn702161377374
Above-mentioned daily record represents that http asks the normal http request xinwenmeiti.html page, belongs to normal user's request, is not the request of CDN node.
Therefore, in network design shown in Figure 3, distinguish the CDN node according to the access links in the daily record and return Source log and other daily record.If the access links in the daily record starts with secache.html, then this daily record is that the CDN node returns Source log.As returning in the example of Source log at above-mentioned CDN node, access links is " GET/secache.html 39130838.html HTTP/1.1 ", and it starts with secache.html, therefore can confirm that this daily record is that the CDN node returns Source log.And in the log example of above-mentioned normal users request, access links is " GET/xinwenmeiti.html HTTP/1.1 ", with the secache.html beginning, is not that the CDN node returns Source log therefore.Whether the above is to being that the judgement that the CDN node returns Source log only is way of example, so the CDN node that can distinguish in the webserver daily record returns the mode of Source log and general access log all within protection scope of the present invention.
In addition, first IP address in the daily record is visitor's IP address.Therefore after having confirmed that the CDN node returns Source log, can determine the CDN node according to first IP address that the CDN node returns in the Source log.As returning in the example of Source log at above-mentioned CDN node, 119.146.194.11 is the IP address of CDN node.
Effective node determination unit 222 is suitable for returning Source log according to the network node that journal processing unit 221 obtains and determines effective network node tabulation, and what comprise in the active block node listing is the IP address of active block node.Specifically, effectively node determination unit 222 is suitable for network node is returned each network node that occurs in the Source log, according to network node return Source log judge this network node return the source number of times whether be less than preset value and last Hui Yuan whether second specify constantly before, judge that if it is this network node is invalid, otherwise this network node is put into the active block node listing, is that the active block node listing is put in the IP address of this network node specifically.Wherein, second specify the moment to be a time point before specifying constantly.
For example, in one embodiment of the invention, specifying constantly be the zero point of today, then second specify constantly be zero point today before sometime, for example can be zero point today moment of 1 hour before, i.e. 23 of yesterday points.If the time of a last Hui Yuan of network node before 23 of yesterday, then illustrate this network node 23 of yesterday to zero point today during this period of time in do not have Hui Yuan, this network node may lose efficacy when zero point today.Therefore, whether be less than preset value and last Hui Yuan whether at the second judgment rule before specifying constantly by returning the source number of times, failed network node when effectively zero point today can be eliminated in node determination unit 222, thereby unspent each network node when remaining into zero point today, these during to zero point today unspent each network node be the object that will monitor today.
Monitor node linkage unit 223 and each monitor node 210 communication issue the active block node listing that will monitor to each monitor node 210, and receive the monitoring access log that each monitor node reports.Specifically, monitor node linkage unit 223 sends to one or more monitor nodes 210 with the active block node listing, and receive the monitoring access log that one or more monitor nodes 210 return, generate when monitoring access log by each network node in the monitor node 210 access active block node listings.
Each monitor node 210 is suitable for accessing each network node in the active block node listing, and record monitoring access log, and the monitoring daily record of recording is returned to monitor node linkage unit 223 in the monitoring server 220.A plurality of monitor nodes 210 are distributed in the different network sites among Fig. 2.Specifically, each monitor node 210 is after receiving the active block node listing that issues, and the all-network node in this active block node listing carries out the access of respective service, and record monitoring daily record.The abnormal conditions of access have been recorded in the monitoring daily record.
Abnormal nodes determining unit 224 is suitable for according to the monitoring access log, determines unusual network node tabulation.Specifically, the monitoring access log that abnormal nodes determining unit 224 is suitable for recording at one or more monitor nodes shows, for a network node, at least one monitor node is accessed this network node abnormality, and when the number of times of access exception reaches pre-determined number, determine that this network node is unusual network node, this node is put into unusual network node tabulation.
In one embodiment of the invention, for a network node, abnormal nodes determining unit 224 can determine just that when a monitor node is accessed this network node abnormality this network node is unusual network node.Perhaps consider different monitor nodes because its residing position is different, some monitor node may be owing to the relatively poor problem that causes accessing this network node abnormality of himself residing network environment, in another embodiment of the present invention, abnormal nodes determining unit 224 can be accessed this network node abnormality at a plurality of monitor nodes or even whole monitor node, and when the number of times of access exception reaches pre-determined number, determine that this network node is unusual network node.
Alternatively, abnormal nodes determining unit 224 can also further be determined unusual network node in conjunction with journal processing unit 221.At first, journal processing unit 221 can also be suitable for obtaining the appointment moment access log afterwards of the webserver.Subsequently, abnormal nodes determining unit 224 is after determining unusual network node tabulation according to the monitoring access log as mentioned above, can also travel through each the unusual network node in the unusual network node tabulation, search the Source log that returns that whether has this unusual network node the access log after the appointment of the webserver that obtains from journal processing unit 221 constantly, if there is no, then should the deletion from unusual network node tabulation of unusual network node.Here, if there is the Source log that returns of this unusual network node in the access log after specifying constantly, then show this unusual network node still in network not by undercarriage, illustrate that the CDN network does not also have this unusual network node of discovery, therefore need to notify to the keeper of CDN network this unusual network node information.Otherwise show this unusual network node at the normal undercarriage of CDN network quilt, therefore there is no need to be placed on this network node in the unusual network node tabulation and to inform the keeper of CDN network.
Thus, abnormal nodes determining unit 224 can further deletion from the tabulation of unusual network node, after specifying constantly to be found its unusually also normal network node of undercarriage.
Above-mentioned supervisory control system can be monitored the unusual network node of content distributing network effectively, solve thus the monitoring problem of the unusual network node in the content distributing network, obtained the beneficial effect that effectively content distributing network is carried out maintenance and management.
Fig. 4 shows according to an embodiment of the invention a kind of flow chart of method for supervising of content distributing network.This content distributing network comprises a plurality of network nodes that are associated with the webserver.
The method for supervising of this content distributing network starts from step S410 as shown in Figure 4, obtains the access log before the appointment constantly of the webserver in this step, therefrom obtains network node and returns Source log.
This step is the Source log that returns that filters out network node from the daily record of the webserver.In one embodiment of the invention, obtain the appointment moment access log before of the webserver, therefrom obtaining network node returns Source log and comprises: each the bar access log before the appointment of the webserver that traversal is obtained constantly, judge by the access links in this access log whether this access log returns Source log as network node, then to keep, otherwise deletion is returned Source log thereby obtain network node.
This step S410 carries out in the monitoring server 220 of system shown in Figure 1 in the above, is specifically carried out by journal processing unit in the monitoring server 220 221.
In step S420, return Source log according to network node and determine effective network node tabulation subsequently.
In one embodiment of the invention, return Source log according to network node and determine that effective network node tabulation comprises: return each network node that occurs in the Source log for network node, according to network node return Source log add up this network node return the source number of times whether be less than preset value and last Hui Yuan whether second specify constantly before, be to judge that then this network node is invalid, otherwise network node is put into the active block node listing.Wherein, second specify the moment to be a time point before specifying constantly.
For example, in one embodiment of the invention, specifying constantly be the zero point of today, then second specify constantly be zero point today before sometime.Effectively unspent each network node before zero point today can be determined in node determination unit 222, and these unspent each network nodes before zero point today are the objects that will monitor today.The effect of this step S420 is to eliminate as far as possible failed network node today.
This step S420 carries out in the monitoring server 220 of system shown in Figure 1 in the above, is specifically carried out by the effective node determination unit 222 in the monitoring server 220.
In step S430, the active block node listing is sent to one or more monitor node, so that each network node in one or more monitor node access active block node listing, and access log monitored in record separately.
In one embodiment of the invention, each monitor node is after receiving the active block node listing that issues, and the all-network node in this active block node listing carries out the access of respective service, and record monitoring daily record.The abnormal conditions of access have been recorded in the monitoring daily record.These a plurality of monitor nodes are a plurality of monitor nodes that are distributed in the heterogeneous networks position.
This step S430 carries out in the monitoring server 220 of system shown in Figure 1 in the above, is specifically carried out by the monitor node linkage unit 223 in the monitoring server 220.
In step S440, according to the monitoring access log that a plurality of monitor nodes record, determine unusual network node tabulation.
In one embodiment of the invention, the monitoring access log that records according to a plurality of monitor nodes, determine that unusual network node tabulation comprises: for a network node, if the monitoring access log that one or more monitor nodes record shows, at least one monitor node is accessed this network node abnormality, and the number of times of access exception reaches pre-determined number, determines that then this network node is unusual network node, and this node is put into unusual network node tabulation.
In one embodiment of the invention, for a network node, can when accessing this network node abnormality, a monitor node determine just that this network node is unusual network node.Perhaps consider different monitor nodes because its residing position is different, some monitor node may be owing to the relatively poor problem that causes accessing this network node abnormality of himself residing network environment, in another embodiment of the present invention, can access this network node abnormality at a plurality of monitor nodes or even whole monitor node, and when the number of times of access exception reaches pre-determined number, determine that this network node is unusual network node.
This step S440 carries out in the monitoring server 220 of system shown in Figure 1 in the above, is specifically carried out by the abnormal nodes determining unit 224 in the monitoring server 220.
In step S450, travel through each the unusual network node in the unusual network node tabulation, search the Source log that returns that whether has this unusual network node the access log after the appointment constantly of the webserver, if there is no, then should the deletion from unusual network node tabulation of unusual network node.
In this step S450, have the Source log that returns of this unusual network node in the access log after specifying constantly, then show this unusual network node still in network not by undercarriage, otherwise show normal undercarriage of this unusual network node.Thus, can be from the tabulation of unusual network node further deletion after specifying constantly to be found its unusually also normal network node of undercarriage.
This step S450 carries out in the monitoring server 220 of system shown in Figure 1 in the above, is specifically carried out by the abnormal nodes determining unit 224 in the monitoring server 220.
Above step only is a kind of execution mode of the method for supervising of content distributing network of the present invention, and the inventive method can realize by other means.Especially, step S450 is optional step, if after not needing to confirm to specify constantly by the unusual network node of normal undercarriage, just execution in step S450 not then is execution of step S440 process ends.
Above-mentioned method for supervising can be monitored the unusual network node of content distributing network effectively, solve thus the monitoring problem of the unusual network node in the content distributing network, obtained the beneficial effect that effectively content distributing network is carried out maintenance and management.
Need to prove:
Intrinsic not relevant with any certain computer, virtual system or miscellaneous equipment with demonstration at this algorithm that provides.Various general-purpose systems also can be with using based on the teaching at this.According to top description, it is apparent constructing the desired structure of this type systematic.In addition, the present invention is not also for any certain programmed language.Should be understood that and to utilize various programming languages to realize content of the present invention described here, and the top description that language-specific is done is in order to disclose preferred forms of the present invention.
In the specification that provides herein, a large amount of details have been described.Yet, can understand, embodiments of the invention can be in the situation that there be these details to put into practice.In some instances, be not shown specifically known method, structure and technology, so that not fuzzy understanding of this description.
Similarly, be to be understood that, in order to simplify the disclosure and to help to understand one or more in each inventive aspect, in the description to exemplary embodiment of the present invention, each feature of the present invention is grouped together in single embodiment, figure or the description to it sometimes in the above.Yet the method for the disclosure should be construed to the following intention of reflection: namely the present invention for required protection requires the more feature of feature clearly put down in writing than institute in each claim.Or rather, as following claims reflected, inventive aspect was to be less than all features of the disclosed single embodiment in front.Therefore, follow claims of embodiment and incorporate clearly thus this embodiment into, wherein each claim itself is as independent embodiment of the present invention.
Those skilled in the art are appreciated that and can adaptively change and they are arranged in one or more equipment different from this embodiment the module in the equipment among the embodiment.Can be combined into a module or unit or assembly to the module among the embodiment or unit or assembly, and can be divided into a plurality of submodules or subelement or sub-component to them in addition.In such feature and/or process or unit at least some are mutually repelling, and can adopt any combination to disclosed all features in this specification (comprising claim, summary and the accompanying drawing followed) and so all processes or the unit of disclosed any method or equipment make up.Unless in addition clearly statement, disclosed each feature can be by providing identical, being equal to or the alternative features of similar purpose replaces in this specification (comprising claim, summary and the accompanying drawing followed).
In addition, those skilled in the art can understand, although embodiment more described herein comprise some feature rather than further feature included among other embodiment, the combination of the feature of different embodiment means and is within the scope of the present invention and forms different embodiment.For example, in the following claims, the one of any of embodiment required for protection can be used with compound mode arbitrarily.
All parts embodiment of the present invention can realize with hardware, perhaps realizes with the software module of moving at one or more processor, and perhaps the combination with them realizes.It will be understood by those of skill in the art that and to use in practice microprocessor or digital signal processor (DSP) to realize according to the monitoring server of the content distributing network of the embodiment of the invention and some or all some or repertoire of parts in the supervisory control system.The present invention can also be embodied as be used to part or all equipment or the device program (for example, computer program and computer program) of carrying out method as described herein.Such realization program of the present invention can be stored on the computer-readable medium, perhaps can have the form of one or more signal.Such signal can be downloaded from internet website and obtain, and perhaps provides at carrier signal, perhaps provides with any other form.
It should be noted above-described embodiment the present invention will be described rather than limit the invention, and those skilled in the art can design alternative embodiment in the situation of the scope that does not break away from claims.In the claims, any reference symbol between bracket should be configured to limitations on claims.Word " comprises " not to be got rid of existence and is not listed in element or step in the claim.Being positioned at word " " before the element or " one " does not get rid of and has a plurality of such elements.The present invention can realize by means of the hardware that includes some different elements and by means of the computer of suitably programming.In having enumerated the unit claim of some devices, several in these devices can be to come imbody by same hardware branch.The use of word first, second and C grade does not represent any order.Can be title with these word explanations.