FR2801752A1 - DNS server monitoring procedure analyses responses to probe requests can detect imminent failure - Google Patents

Abstract

The DNS server (202) monitoring system (205) measures performance as response time to a flow of probe requests (203) from a simulated client (201) and checks the correctness of the responses and prepares performance tables for comparison with thresholds.

Description

 METHOD <B> AND <B> SYSTEM <B> TO MONITOR THE SERVICE OF <DOMAIN NAME </ B> SYSTEM (DNS) IN <B> UN </ B> NETWORK < TECHNICAL FIELD <B> <I> OF THE INVENTION </ B> <B> <B> <B> <B> <B> <B> <B> <B> particularly, a method and system in a network operating under Internet Protocol (IP), for monitoring the quality of an IP Domain Name System (DNS) service provided by a plurality of DNS servers, according to certain criteria, such as the response time and availability.

 Art <B> <I> previous </ I> </ B> INTERNET Internet is a global network of computers and computer networks (the "Net"). The Internet connects computers that use a variety of different operating systems or languages, including UNIX, DOS, Windows, Macintosh, and others. To facilitate and enable communication between these various systems and languages, the Internet uses a language called TCP / IP (Transmission Control Protocol / Internet Protocol). The TCP / IP protocol supports three fundamental applications on the Internet: transmission and reception of electronic mail chronological recording in remote computers (the "Telnet"), and # transfer of files and computer programs to another (" FTP "or" File Transfer Protocol ", File Transfer Protocol).

A goal of TCP / IP is to interconnect networks and offer a universal communications service: an inter-network, or the Internet. Each physical network has its own technology-dependent communications interface in the form of a programming interface with basic (primitive) communication functions. Communications services are provided software that works between the physical network and user applications. This software provides a common interface to these applications, independent of the underlying physical network.

The architecture of physical networks is hidden from the user.

The Internet Protocol (IP) is constantly evolving through the Request For Comments (RFC) mechanism. New protocols (essentially application protocols) are designed and implemented by researchers. They are brought to the attention of the Internet community in the form of an Internet Draft-ID. The largest source of ID is the Internet Engineering Task Force (IETF) IP ADDRESSES To interconnect two networks, a computer system capable of transmitting packets from one network to another is attached. This is called a "router." The term "IP router" is also used because the routing function is part of the IP layer of TCP / IP.

IP addresses are used by IP to uniquely identify a host on the Internet (more specifically, an IP address identifies an interface capable of sending and receiving IP datagrams) A system may have a plurality of such interfaces. However, both hosts and routers must have at least one IP address). Each IP datagram (basic data packet exchanged between hosts over the IP network) contains a source IP address and a destination IP address.

IP addresses are represented by a 32-bit unsigned binary value, which is usually expressed in a decimal format separated by periods. For example, 9.167.5.8 is a valid Internet address. A digital form is used by the IP software. The correspondence between the IP address and an easy-to-read symbolic name, for example, myhost.ibm.com, is produced by a Domain Name System (DNS) or IP address resolution.

DOMAIN NAMES Domain names or computer names (such as www.entreprise.com) are translated to digital Internet addresses (like 194.56.78.3), and vice versa, using a process called DNS ( "Domain Name Service" - "Domain Name Service"). DNS is supported by servers residing on the network, also known as domain name servers or DNS servers Because of the explosive growth in number of hosts, the DNS process has become practically essential in large networks, to replace simple files stored locally in each host, with hostnames and associated IP addresses. The Domain Name System allows a program, operating on a host server, to map a high-level symbolic name to an address for all other possible hosts, without each host having full names databases. hosts.

To simplify, to standardize and delegate the naming convention used, a distributed hierarchical namespace has been created, subdividing domains into subdomains, responsible for their own fields. Symbolic names are grouped authority areas, in which one or more hosts are responsible for maintaining a database of symbolic names and IP addresses, providing a server function to clients wishing to perform a match between Symbolic names and IP addresses. These local name servers are logically interconnected in a hierarchical tree of domains.

Additional explanations for the subject area presented in the above sections can be found in the following publications, incorporated herein by reference: ############################################################################################ R. Pugh, Kazunari Suzuki, David H. Wood, published by IBM International Technical Support Organization.

 # "Internet in a nutshell" by Valerie Quercia, published by O'Reilly, October 1997.

PROBLEM The problem is to monitor a Domain Name System (DNS) service provided by one or more DNS servers, in order to detect possible unavailability from any DNS server and possible degradation of DNS response time. .

a plurality of DNS servers are used, even if the DNS server fails, normally the DNS service continues to be provided to the users, but with degraded performance. The first DNS server to respond to the name mapping query with an IP address, in a list of potential DNS servers, provides the DNS service to the DNS client.

therefore, when a DNS server fails in an environment with a plurality of DNS servers, the DNS servers that are still available continue to provide the DNS service until they reach their maximum capacity. Eventually, the DNS service may crash when the available DNS servers can not support the total load.

The problems are then: # early anticipation and detection of DNS server failures; # early detection of abnormal response time by DNS servers; # early detection of DNS response time degradation.

Failures occurring on a DNS server must be detected as early as possible to anticipate and to avoid any interruption of the DNS service. The performance provided when a DNS server is down is usually lower than expected, because the remaining available DNS servers must handle an additional load. The DNS response time analysis is a good indicator to anticipate an interruption of the service.

<B> <I> Objects of the Invention </ I> </ B> # One of the aims of the invention is to provide a method for optimizing the Service of a Domain System (DNS).

 Another object of the present invention is to anticipate the failures of a DNS service.

 Another object of the present invention is to detect early a failure on any DNS server. Another object of the present invention is to detect early an abnormal response time any server.

 Another object of the present invention is to detect early degradation of the response time on any DNS server.

 Summary The present invention relates to the monitoring of a DNS service and, more particularly, a system and method in a network operating under Internet Protocol (IP). , to detect early and anticipate degradation and failures of a DNS service, using probes monitoring availability and response time.

The present invention also uses a DNS Service Analyzer program to analyze and correlate the availability and response time information provided by the probes.

The present invention describes a method and system for monitoring in a network operating under Internet Protocol (IP), a gold a plurality of Domain Name System (DNS) servers. The method includes for each DNS server the step of measuring DNS server performance and availability by simulating a DNS client on a monitoring system and, in particular, the step of measuring the required response time. to the simulated DNS client to retrieve information, in particular an IP address, from the DNS server. The method further comprises the steps of sending an information request to the DNS server; receive a response message from the DNS server; check that the information received, included in said response message, is correct.

<I> Drawings </ I> The features considered as constituting novel and inventive properties of the invention are set forth below in the appended claims. The invention itself, however, as well as a preferred mode of use thereof, other advantages thereof, will be better understood by referring to the following detailed description of a illustrative detailed embodiment, in conjunction with the accompanying drawings, in which: # Figure 1 shows the DNS mechanism for matching a high-level symbolic name (host name) with an IP address, according to the prior art.

 FIG. 2 is a view of the monitoring probe of availability and response time, according to the present invention.

 FIG. 3 is a flow chart of the monitoring probe of the availability and the response time according to the present invention. FIG. 4 is a view of the data flow associated with the availability monitoring probe and the response time according to the present invention.

 Figure 5 illustrates the storage of availability and response time measurements according to the present invention.

Fig. 6 is a flow chart showing the DNS service analyzer program according to the present invention.

The present invention relates to a method and a system for monitoring the quality of a DNS service provided by a plurality of DNS Servers based on criteria such as response time and availability. More particularly, the present invention describes a method for: resolving a symbolic host name into an IP address and vice versa, by the use of one or a plurality of DNS Servers, # the measurement of time associated response, # fault detection and response time degradation for each DNS server. <B> SETTING </ B> OF </ B> HOST NAMES WITH <B> IP ADDRESSES Figure 1 depicts the DNS Client / Server interactions that occur when a DNS Client wants to resolve (translate or map) a symbolic name (host name) to a network address (IP address). More particularly, Figure 1 shows the mechanism followed by a DNS Client, acquisition of an IP address by using a symbolic name as a parameter. The DNS Client (101) sends a matching request to a DNS Server belonging to a locally configured list of DNS servers. When the matching request is received by an active DNS Server (102), this Active DNS Server checks whether it is able to respond to the DNS client.

 # If the DNS Server can not find the IP address in the local database or its cache, the matching request can be passed to another DNS Server by using the hierarchical organization of the domains. DNS server.

 # If DNS Server can find in its local database or cache what the IP address is, the response is immediately returned to the DNS client.

the matching request is initially sent by the DNS Client to an inactive DNS server (or a failed DNS server), this request will not succeed, and the following DNS Server, in the local list of DNS Clients, will to be selected to attempt to answer the same query. The same process is repeated as long as the request has not received a response from an active DNS Server and until the DNS server list has been exhausted. The process will stop as soon as the DNS client finally receives an IP address from the first active DNS Server. This chain can however induce a significant delay.

<B> PROBES OF </ B> <B> SURVEILLANCE <B> <B> AVAILABILITY AND TIME </ B> RESPONSE Environment The general environment of the invention is described in Figure 2. The purpose A DNS server is to match a symbolic name (hostname) with a network address (IP address) and return that IP address to the DNS Client that originated the matching request. An availability and response time monitoring probe (201) operating on a computer system (205), simulates the request of a standard DNS client (monitoring stream 203), for mapping a specific name to a IP adress. This specific name is associated with a specific IP address, in the local database of the server (202). Upon receiving the response from the DNS Server (204), the monitoring probe for availability and response time checks that the name has successfully matched with the correct IP address, as part of predetermined time (preferably in a few seconds). The probe returns either a response time (preferably expressed in seconds) or a fault return code.

The same process can be used to simultaneously or successively measure the availability and response time of the plurality of DNS servers. Internal logic FIG. 3 is an internal logic diagram representing a sensor for monitoring availability and response time, according to the present invention.

 # (301) First start of a timer for a given period of time.

 # (302) The mapping of a specific symbolic name to an IP address is requested from a DNS Server. This DNS server is identified by its host or its IP address.

 # (303) If a positive response is returned within the given time limits, then: # (304) The timer is stopped, the response time is saved, the matching process is checked and, in particular, the IP address received in the positive response.

 # (305) If everything is valid, the response time is saved in a database.

 # (306) A positive return code is returned as the output title.

 # (307) If no response is returned within the given time period, a negative return code is returned as an output.

In summary, probe returns: # either a response time (preferably expressed in seconds) or # a trouble return code. The response time is stored in a database. Thus, for each DNS Server, the response time can be monitored and it is possible to detect failure in a DNS Server and / or detect a degradation of the response time.

Data Flow Figure 4 shows the flow of data generated a sensor monitoring availability and response time according to the present invention. For each DNS server (405), at regular time intervals, probes (406) are processed by a computer system called the DNS monitoring system (404). The availability and response time measurements are stored in a database called "Availability and Response Time Data Table" (408). Also, at regular time intervals, a DNS Service Analyzer program (401), operating in said DNS monitoring system (404), groups (407) analysis measures, to detect DNS server failures or the fluctuation / degradation of the DNS server. response time In particular, the DNS Service Analyzer: # generates reports (403); # calculate statistics; # detects the unavailability of DNS Servers; # detects abnormal response times Internal Storage Figure 5 describes the internal storage of availability and response time measurements in the DNS Monitoring System.

 # In the DNS Monitoring System, each probe (501) updates (502) a table (503) with the measurements of each Server it is monitoring. In this way, the table contains an up-to-date status of all monitored DNS Servers.

 # At configurable time intervals, availability monitoring and response time probes re-check DNS Servers (504) and the cycle is repeated.

Analyzer Figure 6 refers to the program's internal logic, running on the DNS Monitoring System and called "DNS Service Analyzer". The process of analyzing the quality of the service and, in the event of a problem, of reaction by using the measurements (601) provided by the monitoring sensors for availability and response time, comprises the following steps: # (602) A negative return code from a probe is interpreted as a DNS server failure. Detecting a DNS Server failure is particularly useful in an environment in which: # the same DNS Client can be served by a plurality of DNS Servers, and # in the event of a failure, the remaining Active DNS Servers can absorb the entire load the DNS service, without the network administrator being aware of the failure. The probes make it possible to carry out preventive actions instead of waiting for an interruption of service to occur.

 # (603) The fluctuation and, in particular, the degradation of the response time are monitored. When the actual measured response time the previous measurements are significantly different, one may think that the DNS Server has some problems.

 # (604) The measure can be compared to a calculated average response, to check whether the quality of the DNS Service itself is acceptable or not.

 # (605) The measured response time can be compared to a predefined threshold.

 # (606) Optionally, in case of abnormal behavior of a DNS Server, an alert can be sent to a network administrator.

 # (607) For long-term analysis, measurements and all other information are stored in a report file.

Although the invention has been shown and described in particular with reference to a preferred embodiment, it is obvious that various changes, in form and detail, can be made here, while respecting the spirit and without leaving the field of the invention.

Claims (1)

 1. A method of monitoring one or a plurality of servers (102) of an IP Domain Name System (DNS) in a network (103) operating under Internet Protocol (, said method comprising, for each server DNS (), 'step of measuring the performance and availability of the DNS server (202), by simulating a DNS client (201) on a monitoring system (205, 404) 2. The method according to the preceding claim, in wherein the step of measuring the performance and availability of a DNS server includes the step of measuring the response time required by the simulated client (201) to retrieve information, particularly an IP address, from the DNS server ( The method of any one of the preceding claims, wherein the step of retrieving information, particularly a predetermined IP address, from a DNS server includes the steps of: sending (203). ) an information request to the DNS server (202); receiving (204) a response message from the DNS server (202); check that the information received, included in said response message, is correct. The method of any one of the preceding claims, wherein the step of measuring the response time required for retrieval of information from a DNS server comprises the step of measuring the time elapsed between sending request (203) and receive the response message (). The method of any of the preceding claims wherein the step of measuring the availability of a DNS server comprises the step of. # compare 303) the response time measured at a given period of time and, when said measured time exceeds said given period of time, the DNS server is considered to be in failure. The method of any one of the preceding claims, wherein the step of measuring the performance of a DNS server comprises the step of. # compare the measured response time with previously measured response times; # determine the degradation or improvement of the measured response time. The method of any of the preceding claims, including the step of storing (305) the performance and availability measurements in the monitoring system. 8. A system (404), particularly a monitoring system, adapted to implement the method of any of the preceding claims. 9. A computer program comprising instructions adapted to implement all the steps of the method according to any of claims 1 to 7 when said program is run on a computer.