JP2000244493A - Network management system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce a transmission data quantity on a network, to analyze, resolve the contents of the data and to output the result with emphasis. SOLUTION: The network management device has an ID read step where whether or not received abbreviated information is prescribed normal information is confirmed based on a class ID included in the abbreviated information received from a network and a specification coincidence confirmation step where whether or not the abbreviated information is information included in a database is retrieved by using the abbreviated information when the class ID satisfies the specification and changes an output of the database based on the class ID.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a search based on specific information in a network management system for managing a communication network and network devices constituting the communication network.

[0002]

2. Description of the Related Art When a communication failure occurs in a network device such as a computer, a router, or an exchange connected to a network, the reason for the failure is determined by a diagnostic function of the network device or other device that caused the failure. Code and issue an alarm. The alert that was issued
It is transmitted on the network as a sequence of packets. A network management device connected to the network for managing the network device receives a packet transmitted from the network device, displays the content on a display device, or outputs the content to a communication log database or the like.

When a network administrator obtains information on the system configuration of a network device,
The administrator operates the network management device to send a command to the network device, and the network device that receives the command codes the system configuration information according to the received command and sends it back to the network management device. The network management device displays the received system configuration information on a display device or outputs it to a communication log database or the like. The network manager, who receives the alarm and system configuration information from the network management device, confirms the contents of the code with specifications and manuals based on the displayed or output code, and checks the alarm and system configuration information. Understand the information and determine the action to be taken based on the description.

However, according to the above-mentioned method, it is necessary to investigate specifications and manuals in order to understand the contents of alarms and the contents of packets issued from the network device. If not received, it is necessary to investigate the specifications and manuals to understand the contents of alarms and packets, which takes a lot of time and can cause misinterpretation. The same occurs when the log of the packet from the network device stored in the network management device is referred to later. In some cases, the device is connected to the network and operated in a development stage or a test stage of the network device. In such a case, data that does not conform to the specifications may be included in data of a packet transmitted from the network device. Conventionally, even if such a packet is displayed on the network management device, the user of the management device sometimes misses the data of the packet that does not conform to the specifications, and as a result, overlooks a bug or failure of the network device. There was a possibility. In addition, information on the system configuration of the network device is collectively collected, system configuration information such as an alarm due to a failure, and a large amount of other packets flow on the network, which places a load on the network and requires communication time. .

As a second conventional example for solving this problem, there is, for example, a system disclosed in Japanese Patent Application Laid-Open No. 9-297721. This aims at shortening the time required for pursuing the cause of the trouble without having to refer to a manual or the like. Its configuration and operation are as follows: error message information, trace operation information, various operation or maintenance information, and visual information are stored in a database, and the error information of the managed system is first downloaded to the database, and then the error information is stored. Analyzes the error details based on the error code inside and displays it visually. Thus, a communication management support system that can grasp the cause of a failure in a short time has been proposed. However, since the error information once accumulated in the management target system is subjected to error analysis after being downloaded at predetermined time intervals, for example, there is no immediacy.

Another third conventional example is disclosed in Japanese Unexamined Patent Publication No.
There is a method disclosed in Japanese Patent No. 4463. This shows a method of coding monitoring items, classifying them into levels, and giving priority to only serious failures to print out a low output print display.

[0007]

The conventional online information transfer system is as described above, and according to the first conventional example, there is a problem that human intervention is required and it takes time. In the second conventional example, the transfer amount of information is reduced, but there is no immediacy, and only the detailed contents corresponding to the code are output, and the burden on the analyst is not reduced.
There was a problem that. According to the third conventional example, although the priority processing can be performed by the code, it is only shown that the immediately subsequent processing is classified by the code of the information.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problem, and is intended to reduce the amount of data transmitted on a network and to make it easy for anyone to easily understand from the small amount of information without immediate human intervention. It is an object of the present invention to obtain a network management device which is decomposed into a plurality of pieces and which emphasizes and outputs the information in an easily understood manner.

[0009]

A network management apparatus according to the present invention retrieves a database based on shortened information and outputs detailed contents. The network management apparatus uses a class ID included in the shortened information received from the network. An ID reading step for confirming that the information is predetermined regular information; and a specification matching confirming step for retrieving whether or not the abbreviated information is included in the database using the abbreviated information when the class IDs match. Changed database output based on

Still further, the shortened information includes a pointer,
Databases corresponding to pointers are sequentially searched, and database correspondence information for all pointers is output.

[0011]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiment 1 FIG. 1 is a configuration diagram of a network management device and a network device according to Embodiment 1 of the present invention. In the figure, reference numeral 1 denotes a network management device, which is a network device 2 managed by the network management device 1 via a network 3.
Is connected. The network management device 1 includes a communication control unit 11 that controls communication via the network 3.
And a packet decompression means 12 for decompressing the compressed packet sent from the network device 2.
A display device 13 for displaying input / output contents;
It has an alarm database 18 that stores the code numbers of the alarms and the contents of the alarms in association with each other, and a database of a specification information file 19 that stores the specifications of communication with the managed system. Further, a packet analysis unit 23 for analyzing a packet of a communication transmitted from the managed system, a communication log database 20 for storing a packet analysis result by the packet analysis unit, an alarm database search unit 21 for searching an alarm database, It has each analysis and search means of the specification information file search means 22 for searching the specification information file. Communication log display means 17 for displaying the contents of the communication log database on a display device.
Alarm information display means 14 for displaying the contents of the alarm database on the display device; and specification information display means 15 for displaying the contents of the specification information file on the display device.
A specification information pointer display unit 16 that obtains a pointer to specification information regarding the displayed communication log from the communication log database and displays the pointer on the display device, and an input device 24 that receives input from a user to the network management device. Be composed.

The network device 2 to be managed is:
It includes a communication control unit 31 for controlling communication via the network 3 and a packet compression unit 32 for compressing information data transmitted to the network management apparatus 1 via the network 3 into shortened information.

Next, the operation will be described. First, any alarm detected in the network device 2 is sent to the network management device 1 via the network 3 in the form of a packet. In the network management device 1, the packet including the alarm is sent to the packet analysis unit 23 through the communication control unit 11. Packet analysis means 23
Then, the packet including the alarm is analyzed, and the result is stored in the communication log database 20 as a log. The log stored in the communication log database is displayed on the communication log display unit 1.
7 is displayed on the display device 13 so that the user of the network management device 1 can refer to it.

The packet analyzing means 23 performs the operation flow shown in FIG. Further, for example, the input packet shown in FIG. 3 is analyzed. In the first step 101 of FIG. 2, the packet analysis unit 23 waits for the arrival of a packet. When the packet analyzing means 23 knows the arrival of the packet, it determines in step 102 whether the packet is an alarm packet. In the alarm packet, the value of the message ID field 201 is 05 and the value of the class ID field 203 is 03 in FIG. If it is determined that an alarm is included in the packet, the alarm database search means 21 searches the alarm database 18 based on the alarm code number set in the parameter field 204 in step 103.

The content of the alarm obtained as a result of the search is displayed on the display device 13 by the alarm content display means.
FIG. 4 shows an example of a screen on which the details of the alarm are displayed. The storage of the log in the communication log database 20 is performed at 106 in FIG.
In 107, the communication log display means 17
Is executed and the log is displayed. As described above, the content of the alarm issued from the network device 2 is the class ID,
Searching based on shortened information such as parameters, and displaying the contents as easy-to-understand contents on the display device 13 allows even a person who is not sufficiently familiar with the network device to quickly understand the contents of the alarm from the network device. This makes it easier to deal with alarms.

The packet analyzing means 23 also analyzes a packet containing information other than the alarm, and stores the analysis result in the communication log database 20. The analysis of the specification information by the packet analysis means is performed in the specification information analysis step 105 of FIG. The specification information analysis step 105 executes the operation flow shown in FIG.

In FIG. 5, first, at step 111,
The message ID is read. Read message ID
Are checked at 112 for conformity to specifications. Next, the class ID is read in step 113 of reading the class ID.
Is read, and it is checked at 114 whether or not it matches the specification as in the case of the message ID. Next, the result and the parameter are read by the result and parameter reading 115, and it is checked whether or not the specification matches the specification at 116 as in the case of the message ID. Next, at 117, the specification information file search means 22 to which the message ID read at 111 and the class ID read at 113 are passed,
Perform a search for. Then, at 118, the specification information display means 15 is started to activate the specification information file search means 22.
Is displayed on the display device 13 as specification information.

For example, in the packet sent from the network device 2, the value of the message ID field 211 as shown in FIG.
If the value of the D field 213 is 01 indicating a virtual path (VP), an example is displayed on the display device 13 as a set of the set response and the VP class specification information shown in FIG. As described above, the content of the packet indicating the specification information issued from the network device 2 is also searched based on the shortened information, and is displayed on the display device 13 as easy-to-understand content. Therefore, anyone can easily understand the contents of the packet.

The operation in the case where the transmitted packet includes an error content that does not conform to the prescribed communication specifications will be described. FIG. 8 shows an example of a packet including error contents that do not conform to the specifications. In the figure, a value 84 that does not match the specification is set in the message ID field 221. Packet analysis means 23
In FIG. 5, first, step 1 of reading a message ID
At 11, the value 84 is read from the message ID field 221 in the packet of FIG.

Next, at 112, it is checked whether or not the specification is satisfied. Here, it is determined that the specification is not satisfied, and a specification error 119 results. In the case of a specification error, the communication log display unit 17 is instructed to highlight the log of the error packet, and the communication log display unit 17 highlights the log of the error packet on the display device 13. Performs blinking display. FIG. 9 is an example of a screen for highlighting, in which a portion 401 is highlighted. As described above, if any of the received packets does not conform to the prescribed specifications, these are extracted and the log relating to the packets is highlighted and displayed. Therefore, it is possible to prevent a packet that does not conform to the specification, which may occur in a development stage or a test stage of the network device, from being missed, and to reliably deal with a bug or a failure of the network device.

The pointer to the specification information obtained by the packet information analysis means 23 by the specification information file search means 22 is used when the log is stored in the communication log database 20.
For example, it is stored in the format shown in FIG. When the user of the network management device 1 refers to the contents of the log later, the user instructs the communication log display unit 17 to display the log by using the input device 24. Communication log display means 17
The log content is displayed according to the operation flow shown in FIG. At this time, when the communication log database 20 includes the pointer 241 to the specification information, the pointer information is displayed on the display device 1 by the specification information pointer display means 16.
3 is displayed.

In the operation flow of FIG. 14, first, in the communication log database reading step 120, the communication log database 20 is read. The read communication log is displayed on the display device 13 in a communication log display step 121. After displaying the communication log, at 122, the first entry of the communication log displayed on the display device 13 is made the same as the state selected by the user. At 123, it is determined whether the head entry of the communication log selected at 122 includes a pointer to specification information. If it is included, the specification information pointer display means 16 causes the specification information pointer display means 16 to execute pointer display according to the operation flow shown in FIG. In the figure, first, communication log reading 1
At 25, an entry in the communication log is read. 126,12
At each of steps 7 and 129, a pointer to the specification information in the communication log is sequentially searched, and the search result is referred to as a pointer N.
Display 128 is displayed on display device 13.

First, the user uses the input device 24 to
When the pointer displayed on the specification information pointer display means 16 is selected, the selected specification information is displayed on the display device 13 by the specification information display means 15, for example, as shown in FIG. In FIG. 13, the communication log window 411 displayed by the communication log display unit 17
And a specification information pointer window 412 displayed by the specification information pointer display means 16 and a specification information window 413 displayed by the specification information display means 15. When the user selects any one entry 414 of the log from the communication log window 411, the specification information pointer display means 16 displays the specification information pointer window 41 based on the operation flow shown in FIG.
The pointer is displayed at 2. When any one entry 415 is selected from the displayed pointer, the specification information display means 1
In the operation flow 5 shown in FIG. 14, the specification selected by the user is displayed in the specification information window 413. In the operation flow of FIG. 14, in step 130, the specification information display unit 15 waits for the user to select an arbitrary pointer entry. When the user selects any one entry,
The pointer entry is read in the pointer reading step 131, the specification information display means 15 is started in the specification information display means start 132, the specification information file 19 is read, and the specification information is displayed on the display device 13.

When displaying the log of the alarm on the display unit 13 by the communication log display unit 17, if the user selects the code number of the alarm by the input unit 24, the alarm selected by the alarm information display unit 14 is selected. Is displayed on the display device 13. As described above, when a packet from the network device is stored in the log, the pointer to the specification information is included in the log,
, The specification information and the alarm content can be displayed, so that the contents of the alarm and the specification information and the like included in the log can be displayed in a manner that is easy for anyone to understand.

When collectively collecting information on the system configuration of the network device 2, the user only has to operate the input device 24 and input a command for collective information collection. The network management device 1 transmits this information batch collection command from the communication control unit 11 to the network 3.
To the network device 2 via The network device 2 receives the information collective command via the communication control unit 31.

After collecting the information in response to the information collective collection command, the network device 2 compresses the packet by the packet compression means 32, for example, by the Huffman method, and creates a compressed packet having the structure shown in FIG. In the figure, the packet compression means 32 sets an ID indicating a compressed packet in a message ID field 231, sets an ID indicating a Huffman method in a compression method ID field 232, and sets a compressed packet in a compression data field 233.

The communication control means 31 transmits the compressed packet to the network management device 1 via the network 3. The network management device 1 includes a communication control unit 11
Performs processing of the compressed packet. Communication control means 11
Recognizes that a compressed packet has arrived by reading the message ID field 231. If the packet is a compressed packet, the compression method is checked in the compression method ID field, and finally, the compressed data field 233 is expanded by the packet expansion unit 12. As described above, the developed data is analyzed by the packet analysis means 23, and is displayed on the display device 13 in the same procedure as the alarm display.

As described above, when a large amount of information about the system configuration of a network device is collectively collected by a command from the network management device, a packet to be transmitted to the network management device is compressed on the network device and then transmitted. However, since the packet is expanded after reception on the network management device, the traffic required for collective information collection can be reduced, and the time required for information collection can be shortened.

Further, an operation in the case where a large number of alarms from the network device 2 occur in a short time and the number of alarms reaching the network management device 1 exceeds a preset number of alarms per unit time will be described. First, when the communication control unit 11 detects that a large amount of data that cannot be processed in time is received, the communication control unit 31 instructs the communication control unit 31 of the network device 2 to compress a packet according to a sequence shown in FIG. That is, in FIG.
Occurs in a large amount in a short time, and a situation occurs where the number of alarms exceeds a preset number of alarms per unit time. Then, the network management device 1 requests a change to the compression mode.
A t command 302 is sent to the network device 2. The network device 2 sends to the network management device 1 a set response command 303 for notifying that the switching to the compression mode has been accepted. Thereafter, the network device 2 also compresses the packet by the packet compressing means 32 in the same manner as in the case of executing the collective information collection command, and transmits the compressed packet 304 via the network 3 to the network management device 1 in transmitting the alarm. Send to

Communication control means 1 of network management device 1
1 operates in the same manner as the detection at the time of executing the information collective collection command, and then the packet decompression means 12 decompresses the compressed packet. The developed packet is sent to the packet analysis unit 23.
The alarm database 18 is analyzed by the alarm database search means 21 based on the alarm code number.
Search for. The content of the alarm obtained as a result of the search is displayed on the display device 13 by the alarm content display means.
At the same time, the result of the analysis by the packet analysis means 23 is stored in the communication log database 20 as a log. The log stored in the communication log database is displayed in the communication log display unit 1
7 is displayed on the display device 13 so that the user of the network management device 1 can refer to it at any time. As described above, when a large number of alarms from the network device occur in a short time, the network device 2 compresses and transmits the packet to be transmitted to the network management device, and the received network packet is transmitted to the network management device 1. Is deployed, so that the number of packets flowing on the network can be reduced, and the load on the network can be reduced.

The present invention is not limited to the configuration and operation of the embodiment described above. For example, another compression method such as a case where a run-length method is used as a compression method may be used.

[0032]

As described above, according to the present invention, the appropriateness detection and search are performed based on the short reception information, and the information is displayed in an easy-to-understand manner. This has the effect of understanding and identifying information content and packets that violate specifications. That is, it is possible to prevent a packet that does not conform to the specification from being overlooked, and to reliably deal with a bug or failure of the network device. Also, when a large amount of information is collectively collected, it is compressed and transmitted, so that traffic can be reduced and time can be reduced.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a network management device and a network device according to a first embodiment of the present invention.

FIG. 2 is an operation flowchart of a packet analysis unit.

FIG. 3 is a diagram illustrating an example of information of a packet input to a network management device.

FIG. 4 is a diagram showing a display example of alarm contents.

5 is a diagram showing a detailed operation flow of an analysis step of specification information in the operation flow of FIG. 2;

FIG. 6 is a diagram illustrating an example of information of another packet input to the network management device.

FIG. 7 is a diagram showing an example in which the contents of specification information are displayed.

FIG. 8 is a diagram showing the contents of a packet including the read error contents.

FIG. 9 is a diagram showing an example in which error information is highlighted.

FIG. 10 is an operation flowchart of a communication log display unit.

FIG. 11 is an operation flowchart of a specification information pointer display means.

FIG. 12 is a diagram showing selected specification information displayed by the specification information display means.

FIG. 13 is a diagram in which three windows of a communication log, a specification information pointer, and specification information are simultaneously displayed.

FIG. 14 is a diagram illustrating a pointer selection operation of the specification information display means.

FIG. 15 is a diagram showing the contents of a compressed packet.

FIG. 16 is a diagram showing a sequence of generation of a large number of alarms and subsequent compression transmission.

[Explanation of symbols]

1 network management device, 2 network devices, 1
2 Packet expansion means, 14 Alarm contents display means, 15
Specification information display means, 16 specification information pointer display means, 17 communication log display means, 18 alarm database, 19 specification information file, 20 communication log database, 21 alarm database search means, 22 specification information file search means, 23 packet analysis means, 32
Packet compression means, 105 specification information analysis step,
111 Message ID reading step, class ID
Reading step, 112, 114, 116 specification conformity confirmation step, 122 log top entry selection step, 124 specification information pointer display execution step.

Claims (2)

[Claims] 1. A structure for searching a database based on shortened information and outputting detailed contents, wherein a class ID included in the shortened information received from a network confirms that the information is predetermined regular information.
D reading step; and when the class IDs match, a specification match check step of searching whether the shortened information is included in the database using the shortened information. A network management device, wherein the output of the network management device is changed. 2. The network management according to claim 1, wherein the shortened information includes a pointer, sequentially searches a database corresponding to the pointer, and outputs database correspondence information for all pointers. apparatus.