JP2000047912A - Method and device for monitorning network service and storage medium having recorded network service monitor program thereon - Google Patents

Abstract

PROBLEM TO BE SOLVED: To exactly monitor a network service by speedily dealing with an abnormal state while reducing the burden on a manager. SOLUTION: Concerning this network service monitoring method, the analytic procedure of log information is described in a data flow chart by a data flow chart editor 11 of a host 1 for management, this data flow chart is generated as a monitor program by a translator 13 and the monitor program is stored in a script data base 15. The log information generated by the service is monitored by a monitoring agent (RA) 19 of a server host 3 and when any change is detected in the log information and in response to the detection of the change in the log information, an analytic agent(AA) 17 executes the monitor program, outputs this result through a designated method such as a text file or electronic mail and reports it to a manager.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to whether a network service normally operates in a computer environment connected to a network in which a network service including e-mail, net news, and WWW (World Wide Web) is provided. The present invention relates to a network service monitoring method and apparatus for monitoring whether a network service is monitored, and a recording medium on which a network service monitoring program is recorded.

[0002]

2. Description of the Related Art With the recent rise of the Internet and intranet, network services such as electronic mail, net news, and WWW in an electronic computer environment have become indispensable. In order to provide network services without interruption, it is necessary to constantly check that individual services continue to operate normally, and to immediately detect any unauthorized use. Such a process is called network service monitoring.

[0003] A network service refers to an application realized by the cooperative operation of programs running on one or more general-purpose computers or dedicated computers connected to a network. For monitoring network services, see Standards for monitoring have not been established. II. The logs generated by the processes that make up the application are the only source of information. It may contain useful information for monitoring, but there is no uniformity because it is created independently for each application. III. Logs are always checked manually by a machine administrator, or an analysis program is individually developed and used by some administrators to reduce the checking work. That is the current situation.

[0004]

In the conventional network service monitoring method as described above, the service to be monitored generally differs for each management site, and the management items differ for each site even when the same service is managed. That is normal. Then, for example, every time a new service is introduced or the management policy is changed, it is necessary to rewrite the monitoring program, which causes a problem of increasing the burden on the administrator.

[0005] In the conventional network service monitoring method, since a machine administrator responds to services individually, only the administrator has the know-how for management. There is a problem that it is extremely difficult for a user to manage.

Further, different services have different management methods, which increases management difficulty.

In addition, in order to quickly detect and respond to unauthorized use of services, it is necessary to always pay attention to the status of use of services, and to quickly respond to troubles, log information must be collected. It is necessary to check frequently, but there is a problem that these are also a heavy burden on the administrator.

[0008] The present invention has been made in view of the above,
The purpose is to provide a network service monitoring method and apparatus capable of promptly responding to an abnormal state while appropriately monitoring network services while reducing the burden on an administrator, and a recording medium recording a network service monitoring program. To provide.

[0009]

According to one aspect of the present invention, there is provided a computer environment connected to a network in which network services including e-mail, net news, and WWW are provided. , By sequentially monitoring the log information generated by the network service, detecting a change in the log information, describing the log information analysis procedure in a data flow diagram, generating a monitoring program, and arranging the generated monitoring program. Then, when a change in the log information is detected, the gist is to execute the generated and arranged monitoring program and thereby monitor the network service.

According to the first aspect of the present invention, a log information analysis procedure is described in a data flow diagram, a monitoring program is generated and arranged, and the log information generated by the network service is sequentially monitored. When a change in log information is detected, a monitoring program is executed to monitor network services. This makes it possible to easily respond to changes in management policies and to reduce the burden on the administrator and quickly respond to abnormal situations. Can respond.

According to a second aspect of the present invention, in a computer environment connected to a network in which a network service including e-mail, net news, and WWW is provided, log information generated by the network service is sequentially stored. A log information change detecting unit that monitors and detects a change in log information, a log information analysis procedure is described in a data flow diagram, a generating unit that generates a monitoring program, and the generated monitoring program is arranged. Database means for storing, and a monitoring program executing means for executing a monitoring program stored in the database means when the log information change detecting means detects a change in log information, thereby monitoring a network service. Is the gist.

According to the second aspect of the present invention, a log information analysis procedure is described in a data flow diagram, a monitoring program is generated and arranged, and the log information generated by the network service is sequentially monitored. When a change in log information is detected, a monitoring program is executed to monitor network services. This makes it possible to easily respond to changes in management policies and to reduce the burden on the administrator and quickly respond to abnormal situations. Can respond.

Further, according to the present invention, in a computer environment connected to a network in which network services including e-mail, net news, and WWW are provided, log information generated by the network service is sequentially stored. Monitoring, detecting a change in log information, describing a log information analysis procedure in a data flow diagram, generating a monitoring program, arranging the generated monitoring program, and detecting a change in the log information, The gist is that the generated and arranged monitoring program is executed and a network service monitoring program for monitoring a network service is recorded on a recording medium.

According to the third aspect of the present invention, a log information analysis procedure is described in a data flow diagram, a monitoring program is generated and arranged, and the log information generated by the network service is sequentially monitored. When a change in log information is detected, a monitoring program is executed, and a network service monitoring program for monitoring a network service is recorded on a recording medium. Can be.

[0015]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a diagram showing a configuration of a network service monitoring device according to an embodiment of the present invention. The network service monitoring device shown in FIG. 1 is provided in each of the management hosts 1 and is adapted to a management policy of a site to be managed by an administrator.
Data flow diagram (DF) describing operations on log information, which is a procedure for analyzing log information to be executed, in a data flow diagram
D: Data Flow diagram) Editor 11, translator 13 for generating a monitoring program for executing the log information analysis procedure described in the data flow diagram in data flow diagram editor 11, monitoring program generated by translator 13 Database 15, which stores
It has an analysis agent (AA: Analyzing Agent) 17 for executing a monitoring program stored in the database 15 and monitoring network services, and is generated by the translator 13 of the management host 1 as provided in the server host 3. A script database (Script Database) 15 for storing a monitoring program transferred and arranged via a network, an analysis agent (AA) 17 for executing the monitoring program stored in the script database 15, and managed by the server host 3. It has a monitoring agent (RA: Retrieve Agent) 19 for sequentially monitoring log information generated by a service application (Service App.), Which is a network service to be performed, and detecting and notifying a change such as update of log information.

More specifically, data flow diagram editor 1
Reference numeral 1 indicates that a user performs an operation on log information in a graphical description using a combination of node components prepared in advance. By using the graphical description in this way, it can be used not only by a skilled administrator but also by a general user without prior knowledge.

The translator 13 is a subsystem for generating a program for executing a procedure for analyzing log information as a management policy described by a user in a data flow diagram. Conventionally, the administrator has generated the program, but in the present embodiment, the administrator can greatly reduce the trouble of writing the program.

The script database 15 is a subsystem that stores a monitoring program generated by the data flow diagram editor 11. The stored monitoring program is called by the analysis agent (AA) 17 as needed, and is automatically executed.

The analysis agent (AA) 17 is an agent for scheduling the execution of the monitoring program generated by the translator 13. One node on the data flow diagram described by the user is automatically converted into one program by the translator 13. The analysis agent (AA) 17 has a function of controlling the execution timing of each program.

The conditions for activating each program are as follows: (1) Execution is performed when data is prepared according to a data-driven execution rule. (2) Execute at predetermined time intervals. (3) Execute on demand under the instruction of the user. The system selects one of the three methods. The analysis agent (AA) 17 is a monitoring agent (R
A) It is started to execute the analysis in response to the notification from 19, whereby the analysis can be executed at the timing when the log information is updated. Further, the monitoring program can be started in accordance with a change in the log information, that is, a change in the state of the service.

The monitoring agent (RA) 19 is an agent for monitoring the update status of log information to be monitored. The collection period is set based on the “freshness of necessary information” specified by the user, and log information is monitored. When the monitoring agent (RA) 19 detects an update, it notifies the analysis agent (AA) 17 and updates the contents of the updated log information with the analysis agent (A).
A) Transfer to 17. This monitoring agent (RA) 1
9 makes it possible to perform real-time analysis on the log and quickly detect the occurrence of a service trouble.

Next, the operation of the network service monitoring device of FIG. 1 will be described with reference to FIG. In FIG. 2, first, (1) the administrator graphically describes the log analysis procedure to be executed in accordance with the management policy of the site to be managed, by using the data flow diagram by the data flow diagram editor 11 by combining parts. Describe. next,
(2) This graphically described data flow diagram is converted by the translator 13 into a monitoring program executable on the computer, and the host that needs to be further executed, that is, the server host 3 in FIG. 1 is determined. The monitoring program is transferred to the server host 3 via the network and stored in the script database 15. then,
The log information generated by a network service program (for example, a mesas server) to be monitored is constantly monitored by the monitoring agent (RA) 19, and the update of the log information is quickly detected. (3) When the update of the log information is quickly detected, the monitoring agent (RA) 19 notifies the detection result to the server host 3 and the management host 1, and the result analysis agent (AA) 17 stores the result in the script database 15. Executes the monitoring program that is being run to generate information about the service. (4) The result is notified to the administrator by a designated method such as an e-mail, a text file, a graph, and a pager call.

Next, as a specific example of the above-described embodiment, for example, an implementation in Java will be described. One of the features of Java is WORA (Write Once Run Anywhere), which offers the advantage of being able to use any operating environment. The program generated by the translator used a Perl script. This has a feature that it does not depend on an execution environment such as an OS. Above 2
From this point, in this specific example, a highly portable system can be realized.

Management items required at each management site,
The services to be managed are different. In order to be able to quickly follow the differences between the sites and changes in requirements at the sites, the individual nodes of the data flow diagram were constructed with software components (software components). As a result, even when a request such as a management policy changes, a quick response can be made simply by increasing or decreasing the number of components.

To specify log information on the data flow diagram editor, a log file name using a regular expression is specified. This makes it possible to handle regular file name rotation during operation.

Next, as an example of a network service using this implementation example, a DHCP (Dynamic Host Configurator) is used.
An example of application to the management of a (ation Protocol) server is shown below. DH
Examples of management items for managing the CP server include: (a). Monitoring unauthorized access (b). Two functions of monitoring the utilization of IP addresses are required. Hereinafter, a procedure for managing the above three management items using the present invention will be described.

First, with reference to a data flow diagram described by a user as shown in FIG. 3, detection of usage from a user other than a registered user, that is, monitoring of unauthorized access will be described.

Here, the contents described are as follows: From the log information (T1), a record indicating the assignment (assignment) of the IP address is extracted (T3), and the MAC address of the connected network interface is extracted (T4). 2. The MAC address to which the IP address is assigned is combined with the registered user database (T2) (T5). 3. The one assigned to the unregistered MAC address is extracted (T6), and this is notified to the administrator by e-mail. It manages. Next, the translator converts the described policy into an executable program, stores it in a script database, and issues a command to a monitoring agent and an analysis agent. The monitoring agent receiving the command watches the update of the log information, and the analysis agent executes the program.

Next, with reference to a data flow diagram described by the user as shown in FIG. 4, monitoring of the utilization rate of IP addresses, that is, creation of statistics on the excess and deficiency of assigned IP addresses will be described. .

Here, the contents described are as follows: From the log information (T1), a record indicating the assignment (assignment) and resource (return) of the IP address is extracted (T2). 2. The MAC address of the network interface of the connected terminal is extracted (T3). 3. The state is noted from the combination of the address, the assignment, and the resource (T4). 4. The utilization rate of the IP address is obtained (T5), and the administrator is notified. It manages. Next, the translator converts the described policy into an executable program, stores it in a script database, and issues a command to a monitoring agent and an analysis agent. The monitoring agent receiving the command watches the update of the log information, and the analysis agent executes the program.

In the embodiment described above, the log information analysis procedure is described in a data flow diagram in the data flow diagram editor 11 of the management host 1, and the described data flow diagram is generated in the monitoring program by the translator 13. This monitoring program is stored in the script database 15 of the management host 1, and is transferred to the server host 3 via the network, arranged and stored in the script database 15. Then, server host 3
Server agent 3 by the monitoring agent (RA) 19 of
The log information generated by the network service is sequentially monitored, and when a change in the log information is detected, the change is notified to the analysis agent (AA) 17. Analysis Agent (AA) 1
7 executes the monitoring program stored in the script database 15 in response to the detection of the change in the log information notified from the monitoring agent (RA) 19, and thereby, based on the policy specified by the data flow diagram. The log is analyzed, and the result is output by a designated method such as a text file or an e-mail, and is notified to an administrator.

As a result, the know-how possessed by the administrator can be realized as a system, and the monitoring by a general user who is not a skilled administrator can be supported. In addition, it is possible to quickly detect the update of the log information, and to assist in promptly responding to an abnormality. In addition, the network administrator can flexibly respond to a change in the management policy, does not need to continuously monitor that the log information has been updated, and can manage different services through the same interface. Become.

[0033]

As described above, according to the present invention,
Describe the log information analysis procedure in a data flow diagram, generate and arrange a monitoring program, monitor the log information generated by the network service sequentially, and execute the monitoring program when a change in log information is detected. In this way, network services are monitored, so that changes in management policies can be easily and quickly responded to, and the administrator does not need to constantly monitor changes in log information, thereby greatly reducing the burden on the administrator. , It is possible to respond quickly in the event of an abnormality.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of a network service monitoring device according to an embodiment of the present invention.

FIG. 2 is an explanatory diagram showing the principle of the network service monitoring device shown in FIG.

FIG. 3 is a data flow diagram showing detection of use by a user other than a registered user in DHCP server management as an application example of the network service monitoring device of FIG. 1;

FIG. 4 shows an assigned IP in a DHCP server as another application example of the network service monitoring device of FIG. 1;
It is a data flow figure which shows creation of the statistics of the excess and deficiency of an address.

[Explanation of symbols]

 1 Management Host 3 Server Host 11 Data Flow Diagram Editor 13 Translator 15 Script Database 17 Analysis Agent (AA) 19 Monitoring Agent (RA)

Claims (3)

[Claims] In a computer environment connected to a network in which a network service including e-mail, net news, and WWW is provided, log information generated by the network service is monitored sequentially, and a change in the log information is monitored. Detecting, describing the log information analysis procedure in a data flow diagram, generating a monitoring program, arranging the generated monitoring program, and when detecting a change in the log information, detecting the generated and arranged monitoring program. And a network service monitoring method for monitoring the network service. 2. In a computer environment connected to a network in which network services including e-mail, net news, and WWW are provided, log information generated by the network service is monitored one by one, and changes in log information are monitored. Log information change detecting means for detecting, log data analysis procedure described in a data flow diagram, generating means for generating a monitoring program, database means for arranging and storing the generated monitoring program, and the log information When the change detecting means detects a change in the log information, the monitoring means executes a monitoring program stored in the database means, thereby monitoring the network service. 3. In a computer environment connected to a network in which network services including e-mail, net news, and WWW are provided, log information generated by the network service is monitored one by one, and changes in log information are monitored. Detecting, describing the log information analysis procedure in a data flow diagram, generating a monitoring program, arranging the generated monitoring program, and when detecting a change in the log information, detecting the generated and arranged monitoring program. And a network service monitoring program for monitoring a network service.