JP2001027990A - Method for gathering and storing server operation data - Google Patents

Abstract

PROBLEM TO BE SOLVED: To continuously store operation log data and operation data that each server on a network gather at one place in time series. SOLUTION: Servers 11, 12, and 13 and a gathering and storage controller 1 are connected through a network. A gathering program 4 on the gathering and storage device requests the servers to transfer operation logs in specific cycles. An agent program 9 on each server transfers the operation data to the gathering program 9 at a request. The gathering program 4 stores the operation data sent from each server as time-series data.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for collecting operation data of a server connected to a network system, and more particularly, to collecting operation data held by a group of servers providing different functions, and continuously collecting the operation data at one location. The present invention relates to a method for collecting and accumulating server operation data suitable for accumulating in a server.

[0002]

2. Description of the Related Art In a recent network system, a plurality of servers realizing different systems are connected to the same network, and a user can use the functions of any of the servers from a client. A special example of such a network system is, for example, "SU
N System Management ”(ASCII 1991)
It is described in Chapter "System Management by NIS and Name Server". Here, a single OS (O
In a configuration in which there are multiple server systems controlled by a perating system, registration of user authentication information is performed for only one server system, and user authentication is performed from other server systems using this authentication information. Done. By doing so, when the number of server systems increases, it is possible to eliminate the need for the user to newly add and register user registration information. Further, the user can log in to the system by using the same user ID and password and using the same procedure for any server.

However, in a general network system having a plurality of servers, it is necessary to register a user for each server and log in according to a procedure determined for each server. Generally, when logging in to a server, it is necessary to input user authentication information such as a network address of the server, a user ID, and a password. Conventionally, a so-called auto-login method has been used for inputting such information. That is, the user registers the network address and the user authentication information in a communication program such as a personal computer or a workstation to be used in advance. At the time of server access, it is devised to reduce the number of terminal operations by the user by using a registered network address or the like. These facilitate access procedures to various servers in a network system.

On the other hand, for efficient operation of a network system, it is necessary to constantly grasp the operating status of each server in the network. For this reason, conventionally, each server side independently collects operation log information and stores it in a file of the server. In order to efficiently operate and manage the entire network system, operation data and operation log data accumulated in each of these servers are collected and analyzed. The system operator can grasp the operation status of each service system operating on each server from the analysis result. The operating status of the system ascertained in this way can be useful when making a resource enhancement plan. Further, by performing an analysis in which the operation statuses of the respective servers are associated with each other, a new analysis such as a behavior characteristic of the user can be performed.

[0005]

However, under the present circumstances, operation data and operation log data are collected for each server and analyzed independently by an analysis tool, and the results of the analysis are later compared. Therefore, it is desirable that the operation log data and the operation data collected by each server group and the network monitoring tool group in the network system can be continuously accumulated in one place in chronological order.

Accordingly, an object of the present invention is to provide a method for periodically collecting operation data and operation log data collected and accumulated by each server in a network system, and continuously accumulating them as time-series data; And a device.

[0007] A more specific object of the present invention is to collect and accumulate operation data and operation log data collected and accumulated by each server in a network system in one place.
An object of the present invention is to provide a storage method capable of distinguishing between servers.

[0008]

SUMMARY OF THE INVENTION In order to achieve the above object, collection of server operation data according to the present invention. In the storage method, a collection and storage control device having a storage file for storing operation data of a plurality of servers in a network system is provided. Then, the collection program in the collection and accumulation control device issues a request command for sequentially requesting a plurality of servers to transfer operation data. The agent programs provided in the plurality of servers respond to this request,
Operation data is extracted from the operation data file of each server and transferred to the collection program. The collection program generates an operation data record by adding identification information to each of the operation data transferred from the plurality of servers, and stores the generated operation data record in a file device of the collection and accumulation control device.

In a preferred embodiment of the present invention, the request command is issued at a predetermined timing. The identification information added to the collected operation data includes a time stamp indicating the time at which the operation data was transferred and the identifier of the server from which the operation data was transferred.

[0010]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described below in more detail with reference to embodiments shown in the drawings.

FIG. 1 is a block diagram briefly showing the configuration and functions of a system in an embodiment of a network system to which a method for collecting and storing server operation data according to the present invention is applied.

In the present embodiment, a local area network (LAN) 7 is used as a network. LAN
The server 7 is connected to a plurality of servers 11, 12, and 13 and the collection and accumulation control device 1. Although not shown, a plurality of client computers for receiving services provided by the servers 11, 12, and 13 are further connected to the LAN 7.

The collection / storage control device 1 includes a server 11
The server operation data indicating the operation statuses of 2 and 13 is collected. A file device that stores an operation data storage file 2 that stores collected server operation data is connected to the collection storage device 1. The operation data storage file 2 contains
Operation data is accumulated in chronological order.

Such a collection and accumulation control device 1 is realized by a processing device having a data processing capability and a storage area, for example, a computer such as a personal computer or a workstation. Further, as the file device 2, a storage device such as a magnetic disk device is used.

The collection / storage control device 1 includes an operating system (OS) 3 and a collection program (LGGAT) 4 which operates under the control of the OS 3. OS3
The collection program 4 is a program stored in a memory (not shown) in the collection and accumulation control device 1. These programs are executed by a central processing unit (CPU) (not shown) to The function is realized. The collection / accumulation control device 1 also includes the servers 11, 1
In order to manage the attributes 2 and 13, an identification table (CTLTBL) 5 holding the attribute information is stored in an internal memory (not shown).

Each of the servers 11, 12, and 13 is realized by a computer such as a personal computer or a workstation, similarly to the collection and accumulation control device 1. The servers 11, 12, and 13 have an OS 8 and an agent program (AGT program) 9 that operates under the control of the OS 8. The OS 8 and the agent program 9 are programs that are stored in a memory (not shown) of each of the servers 11, 12, and 13,
A predetermined function is realized by a central processing unit (CPU), also not shown, executing these programs. Each of the servers 11, 12, and 13 further has an application program for realizing a service provided to the client, but these are not directly related to the present invention. Illustration and description are omitted.

Each of the servers 11, 12, and 13 has a log file 11A, 11B or an operation file 12A for recording its operation status. In this specification, information that indicates the operating status of each server and that is held in the log files 11A and B and the operating file 12A is collectively referred to as operating data.

The collection program 4 requests the agent program 9 to transmit operation data at regular intervals, for example, every hour or every day. Upon receiving this request from the collection program 4, the agent program 9 extracts operation data in a specified range from the operation log file 11 </ b> A managed by its own server, and transmits it to the collection program 4 of the collection and accumulation control device 1. .

Collection program 4 that received operation data
Acquires the attribute information of the server corresponding to the transmission source of the operation data from the identification table 5. Then, the collection program 4 configures a record (RECORD) 6 by adding the acquired attribute information and the time stamp data indicating the collection time to the operation data received from the server. Next, the collection program 4 stores the record 6 in the operation data storage file 2.

FIG. 2 is a flowchart showing the processing flow of the collection program 4 in the collection and accumulation control device 1. Hereinafter, a process of collecting and accumulating operation data according to the present embodiment will be described with reference to these drawings.

In the present embodiment, the collection program 4
Collects operation data at regular intervals, for example, every hour and every day. For this purpose, the collection program 4 monitors, for example, a timer (not shown) provided in the collection and accumulation control device 1 and checks whether or not the collection time has come (step 200). When the cycle of collecting the operation data is reached, the collection number counter i is initialized in order to collect the operation data from all the servers for which the operation data exists in the network (step 2).
05).

Next, 1 is added to the number-of-collections counter i (step 210), and it is checked whether the value of the number-of-collections counter i exceeds the number of servers that collect operation data (step 215). If the value of the collection counter i exceeds the number of servers, the collection of operation data from all servers has been completed, and the process returns to step 200 and waits for the next collection cycle.

If the value of the number-of-collections counter i is equal to or less than the number of servers, a request message requesting collection of operation data, that is, log data, is sent to the i-th server (step 220). At this time, the request message includes
As a parameter, a parameter for requesting data accumulated after the previous operation data was collected is set. As this parameter, for example, a parameter that specifies a time range in which required operation data is accumulated, or
The one that specifies the number of records can be applied.

Communication between the collection program 4 and the agent program 9 is performed by well-known socket communication. For details on socket communication, see, for example, "Windows Network Programming with WinSock", published by Asuka Publishing Co., Ltd. (1995)
It is described in.

FIG. 3 is a flowchart of a process executed by the agent program 9 in the servers 11, 12, and 13 in response to the request message.

When each of the servers 11, 12, and 13 receives the request message from the collection and accumulation control device 1, the agent program 9 analyzes the parameters of the request message (step 300). The agent program 9 acquires operation data in the range specified by the parameter from the log file or the operation file according to the analysis result of the parameter (Step 305).
Then, the acquired operation data is transmitted to the collection and accumulation control device 1 (step 310).

Returning to FIG. 2 again, when log data in the designated range is sent from the agent program 9, the collection program 4 sends the time stamp and the log data registered in the identification table 5 to the server that sent the log data. A corresponding identifier is added to the log data to form a record 6 (step 225). Then, the generated record is stored in the operation data storage file 2 (step 23).
0).

Thereafter, the processing of the collection program returns to step 210, and repeats the processing of steps 210 to 230 until operation data is collected from all servers.

FIG. 4 shows that the collection program 4 described above and the agent program 9 in the server 11 cooperate with each other.
FIG. 4 is a schematic diagram schematically illustrating processing when collecting and accumulating operation data of a server 11.

As described above, the collection program 4 requests the server 11 to collect operation data at a predetermined timing. Upon receiving the operation data collection request from the collection program 4, the agent program 9 of the server 11 interprets the request code indicated by the parameter, and extracts a specified range of log data from the log file 11A storing the operation data. I do. Then, the extracted log data is transmitted to the collection program 4 as operation data.

The collection program 4 creates a record 6 to be stored in the operation data storage file 2 based on the operation data sent from the server 11.

The record 6 is large and has a header section 15 and a server specific information section 16. Header part 1
5 is formed by the identifiers 5A and 5B of the server 11 acquired from the identification table 5 and the collection time serving as a time stamp. Further, the server unique information section 16
Information indicating the data length (L) of the server unique information section 16;
The information includes information such as an event time, an event code, an address, and data sent from the agent program 9.

The record 6 thus created is
It is stored in the operation data storage file 2 as time-series data. In the record 6 of the operation data accumulation file 2, operation data and log data of each server are mixed.
Since the header section 15 is added to each record 6, subsequent analysis is easy.

According to the network system described above,
The operation data and operation log data collected and accumulated by each server in the network system can be periodically collected and continuously accumulated at one place as time-series data. Thus, the operating status of each service system operating on each server can be centrally grasped. The operation data accumulated in the collection and accumulation device can be used to make a resource enhancement plan. Further, the system operator or the like can perform a new analysis such as a behavior characteristic of the user by performing an analysis in which the operation statuses of the respective servers are associated with each other.

[0035]

According to the present invention, the operation data and the operation log data collected and stored by each server in the network system can be periodically collected and continuously stored as time-series data at one place.

[Brief description of the drawings]

FIG. 1 is a block diagram briefly showing the configuration and functions of a system in an embodiment of a network system to which the invention is applied.

FIG. 2 is a flowchart showing a processing flow of a collection program in the collection and accumulation control device.

FIG. 3 is a flowchart of a process performed by an agent program in a server in response to a request message.

FIG. 4 is a schematic diagram schematically showing a process when collecting and accumulating server operation data in cooperation with a collection program and an agent program in the server.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 ... Collection and accumulation control device, 2 ... File device, 3 ... Operating system (OS), 4 ... Collection program (LGGAT), 5 ... Identification table (CTLTBL), 6 ... Record RECORD, 7 ... LAN (Local Area Network) 8 server-side operating system (OS) 9 agent program (AGT) 11-13 server 11A log file 12A operation file

 ──────────────────────────────────────────────────続 き Continued on the front page (72) Inventor Nobuaki Tsuge 890 Kashimada, Saiwai-ku, Kawasaki-shi, Kanagawa Prefecture Information Systems Division, Hitachi, Ltd. F term in the Information Systems Division of the Works (reference) 5B045 BB33 BB49 GG01 JJ08

Claims (8)

[Claims] An operation of the server in a network system having a plurality of servers, a plurality of client terminals for accessing the plurality of servers, and a network connecting the plurality of servers and the plurality of client terminals. In a method for collecting and accumulating operation data representing a situation, a collection and accumulation control device having an accumulation file for accumulating operation data of the plurality of servers is provided in the network system; Issue a request command for sequentially requesting the transfer of operation data to the server, and extract operation data from an operation data file of each server by an agent program provided in the plurality of servers, and extract the operation data to the collection program. Transfer, the plurality of Server operation data, wherein an operation data record is generated by adding identification information to each of the operation data transferred from the server, and the operation data record is stored in a file device of the collection and accumulation control device. How to collect and accumulate. 2. The server operation data collection / accumulation method according to claim 1, wherein in the request command issuing process, the request command is issued at regular intervals. 3. The server operation data collection / accumulation according to claim 1, wherein the identification information comprises a time stamp indicating the time at which the operation data was transferred and an identifier of a server from which the operation data was transferred. Method. 4. The method according to claim 1, wherein said network system is a local area network. 5. A network system comprising: a plurality of servers; a plurality of client terminals for accessing the plurality of servers; and a network connecting the plurality of servers and the plurality of client terminals. In a storage medium storing a program for collecting and accumulating operation data indicating operation status, the storage medium is connected to the network system and implemented by a collection and accumulation control device having an accumulation file for accumulating operation data of the plurality of servers. A program for issuing a request command for sequentially requesting transfer of operating data to the plurality of servers, and in response to the request command, operating data transferred from the plurality of servers. Receive and add identification information to each received operation data to generate operation data record That processing and storage medium, characterized in that the operational data record storing a program including the process of storing a file system having said collecting and storage controller. 6. The storage medium, further executed by the plurality of servers, extracting operation data from an operation data file of each server in response to the request command, and storing the extracted operation data in the storage medium. 6. The storage medium according to claim 5, wherein an agent program including a process of transferring to the collection and accumulation control device is recorded. 7. The request command issuing process according to claim 6, wherein the request command is issued at regular intervals.
The storage medium according to the above. 8. The storage medium according to claim 6, wherein the identification information comprises a time stamp indicating a time at which the operation data was transferred and an identifier of a server from which the operation data was transferred.