JP2001268087A - Event log control system and method for network management - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an even log control system and method for network management utilizing the UDP where a management unit recognizes an event notice not received yet from a unit to be managed and reads a required event lot from the unit to be managed before the event log stored in the device to be managed is lost. SOLUTION: The device to be managed 2 has a state change detection section 23 that detects a state change and an event processing section 21 that stores an event log with a state change and a sequence number added thereto into an even storage buffer section 25 and transmits an event notice with the event lot added thereto the management device 1, and the management device 1 has an event processing section 11 that detects an event notice not received yet by analyzing the sequence number added to the event notice. Furthermore, than the event processing section 11 detects the presence of a required unreceived event notice and full buffer capacity from the sequence number, the processing section 11 reads an event log not received yet from the device 2 to be managed via an event log read request response processing section 14 and clears the buffer of the device to be managed 2 via a buffer clear request response processing section 15.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to an event log control method and method in network management, and more particularly, to an event log control method and method in network management accompanying an event notification received from a managed device by a management device.

[0002]

2. Description of the Related Art Generally, an event notification is issued from a managed device to a management device due to a change in the state of the managed device. The management device manages the managed device in real time, so that high-speed communication UDP (Use
r Datagram Protocol) is often used. However, UDP simply transfers a UDP datagram on an IP datagram and does not perform acknowledgment for reliability or order adjustment of received data passing through different paths in a network. That is, although the use of UDP enables high-speed communication, there is no guarantee that data is reliably transmitted from the managed device to the management device. Therefore, the managed device stores the issued event notification as an event log in a log storage buffer, and stores the event notification (UDP) from the managed device.
If the management device cannot receive the datagram (set in the UDP data field of the datagram), the management device can arbitrarily extract the state change information from the managed device at the discretion of the management device. When a managed device of the related art issues a certain event notification, the event log storage buffer becomes full. When the managed device issues the next event notification, it overwrites the buffer area of the old log and saves the event log.

[0003]

However, the event log in the managed device used for maintenance, etc.,
It must be able to provide necessary information to the management device when needed. However, buffers for storing event notifications in the managed device as event logs are limited.
That is, when the managed device issues a certain event notification, the event log storage buffer becomes full. When the managed device issues the next event notification, it overwrites the buffer area of the old log and saves the event log. There is no guarantee that the management device receives the old event log overwritten at that time, and the management device cannot provide information when needed.

SUMMARY OF THE INVENTION In view of the above problems, an object of the present invention is to provide a UD
In a network management system using the P communication protocol, regarding the event log in which the management device knows the unreceived event notification and the event notification that the managed device issues due to a change in the status of the own device is stored in the own device,
The management device manages the maximum number of event logs of the managed device, so that the managed device does not clear the event log required by the management device.

[0005]

In order to achieve the above object, an event log control method in network management according to the present invention is provided in which a management device connected to a network transmits a UDP communication from a managed device connected to the network. In an event log control method in network management that receives an event notification using a protocol, the managed device includes state change detection means for detecting a state change,
An event log storage unit that assigns a sequence number to the content of the status change in the order in which the status change has occurred, and stores the content of the assigned status change in a buffer as an event log; and And an event notification transmitting means for transmitting the event notification to the management device as an event notification.When the management device receives the event notification, the management device analyzes the sequence number added to the event notification, and It has a non-received event detecting means for detecting an event notification.

Further, upon receiving the event notification, the management device analyzes a sequence number added to the event notification to detect whether or not the capacity of the buffer has reached a maximum. It is characterized by having detecting means.

Further, the management device may detect that the maximum buffer capacity detecting means detects that the capacity of the buffer has reached the maximum and that the unreceived event detecting means detects a necessary unreceived event notification. , An event log read request unit for requesting reading of an unreceived event log, and a buffer clear request unit for requesting clearing of the buffer.

Further, the event log storage means stores an event log for each type in the buffer in which an area is secured for each type.

Further, according to a first method of controlling an event log in network management of the present invention, a network management apparatus in which a management apparatus connected to a network receives an event notification using a UDP protocol from a managed apparatus connected to the network. Wherein the managed device detects a status change, assigns a sequence number to the content of the status change in the order in which the status change occurred, and stores the content of the assigned status change in an event log. As well as transmitting the event change and the event log to the management device as an event notification, and upon receiving the event notification, the management device is added to the event notification. Whether there is an unreceived event notification by analyzing the sequence number It is characterized in that the check.

In a second aspect of the invention, there is provided a method for controlling an event log in a network management, wherein a management device connected to a network receives an event notification using a UDP protocol from a managed device connected to the network. Wherein the managed device detects a status change, assigns a sequence number to the content of the status change in the order in which the status change occurred, and stores the content of the assigned status change in an event log. As well as transmitting the event change and the event log to the management device as an event notification, and upon receiving the event notification, the management device is added to the event notification. Whether there is an unreceived event notification by analyzing the sequence number Checking whether the buffer capacity of the managed device has reached the maximum from the sequence number attached to the event notification, detecting that the buffer capacity has reached the maximum, and When a received event notification is detected, a request to read an unreceived event log is made, and when an unreceived event log is received, a request to clear the buffer is made.

[0011]

Next, an embodiment of the present invention will be described with reference to the drawings. Referring to FIG. 1, a transmission path 3, a management device 1 connected to the transmission path 3, and a transmission path 3
And a plurality of managed devices 2 connected to the network. The communication protocol between the management device 1 and the managed device 2 uses a UDP communication protocol.

The managed device 2 includes a status change detection unit 23 that detects a status change of the managed device 2, an event processing unit 21 that performs an event notification process when a status change occurs, an event storage buffer unit 25, It comprises a communication processing unit 22 and a buffer control unit 24.

The event storage buffer 25 may be any of a volatile memory capable of reading and writing data, a non-volatile memory, and a non-volatile recording medium device. In the example, the power of the device is turned off. A non-volatile memory (for example, flash memory) is used so that the contents are not erased even if it is performed. Further, the event storage buffer unit 25 reserves an area for each type of event log, and is assigned to each area so that up to N (N is a positive integer) log information can be stored.

The event processing unit 21 has a function of saving an event notification to which a type and a sequence number are assigned as an event log and a function of issuing an event notification. The event log is stored in an event storage buffer via a buffer control unit 24. Stored in the unit 25. When the event processing unit 21 issues an event notification, an event log (type, sequence number) and a code indicating the event notification are set in the UDP data field of the UDP datagram.

The communication processing unit 22 performs communication processing of transmitting an event notification to the management apparatus 1, receiving a request from the management apparatus 1, and transmitting a response (reply) to the management apparatus 1.

The buffer control unit 24 controls the buffer when receiving from the management device 1 a request to read an event log of a sequence number corresponding to the specified type or a request to clear a buffer.

The management device 1 includes a communication processing unit 12 that performs communication processing of receiving an event notification and receiving a response (reply) from the managed device 2 and transmitting a request to the managed device 2. , A management information storage / storage unit 13 for managing management information of the managed device 2, an event log read request / response processing unit 14, and a buffer clear request / response processing unit 15. are doing.

The event processing unit 11 has a function of storing the received event notification in the management information storage unit 13 of the management device 1. Further, the event processing unit 11 has a function of detecting the state of the maximum buffer capacity of the managed device and a function of detecting a non-received event notification by analyzing the sequence number added to the received event notification. Furthermore, the event processing unit 11 manages the managed device 2
When the status of the maximum buffer capacity is detected, the necessity of reading the event log of the unreceived event notification is determined based on the presence / absence of the unreceived event notification and the importance of the presence / absence. Processing unit 1
4 has a function of transmitting the detection status of the sequence number of the not-received event notification, and a function of transmitting the clearable event log sequence number to the memory clear request / response processing unit 15 if not necessary.

The management information storage unit 13 may be any of a volatile memory capable of reading and writing data, a non-volatile memory, and a non-volatile recording medium device, but secures a large amount of data. Therefore, it is desirable to use a nonvolatile recording medium device (for example, a magnetic disk). Further, the management information storage / storage unit 13 secures an area for each managed device 2, and further, each area secures a sub-area for each type of the content (event log) of the state change that has occurred. Each sub area is assigned so that up to N log information can be stored.

Event log read request / response processing unit 1
4, when the event processing unit 11 requests the reading of the notification of the unreceived event, the specified type of the unreceived event and the sequence number are added (U of the UDP datagram).
It has a function of creating an event log read request set in the DP data field) and transmitting the request to the managed device 2. Further, after receiving the response to the event log read request, the event log read request / response processing unit 14 stores the management information storage unit 13 of the managed device.
Has a function of supplementing management information of the managed device for storing the unreceived event in the storage device.

The buffer clear request / response processing unit 15
If the event processing unit 11 requests the managed device 2 to clear the buffer, the type of the clearable event log and the sequence number range specified for the managed device 2 are added (in the UDP data field of the UDP datagram). Is created, the request is transmitted to the managed device 2, and the response is received to recognize that the buffer clear has been executed in the managed device 2.

Incidentally, regarding the identification of each request and each response,
A specific area of the UDP data field in the UDP datagram is coded for each type of request or response, and is set on the transmitting side, and by reading the specific area on the receiving side, identification of each type of request or response can be performed. Do.

Next, the operation of the embodiment of the present invention will be described with reference to FIGS. Now, when an event notification is generated from the managed device 2, the management device 1 is required to manage a plurality of management devices in real time, so that a high speed is required. The communication protocol uses a UDP communication protocol. In order to make the description easy to understand, it is assumed that the state change occurs in the same managed device 2 and the same type occurs.

Sequence S1: FIG. 2 When a status change occurs in the managed device 2, the status change detection unit 23 detects the status change and uses the type and the content of the status change with the sequence number 1 as an event log. Is stored in the event storage buffer unit 25 via the buffer control unit 24. In addition, the state change detection unit 23 is passed to the communication processing unit 22 so as to transmit, as an event notification (sequence number 1), a content obtained by adding an event log to the content notifying that a status change has occurred, to the management device 1. . The communication processing unit 22 having received the event notification transmits the event notification to the management device 1 via the transmission path 3. The communication processing unit 12 of the management device 1 that has received the event notification of the sequence number 1 passes the event notification to the event processing unit 11. The event processing unit 11 analyzes the sequence number from the received event notification (the event log of the sequence number 1) and stores the contents of the event in the management information storage unit 13
To update the management information.

Sequence S2: When a status change occurs in the managed device 2, the status change detection unit 23 detects the status change, and uses the content of the status change assigned with the type and the sequence number 2 as an event log to perform buffer control. The data is stored in the event storage buffer unit 25 via the unit 24.
In addition, the state change detection unit 23 is passed to the communication processing unit 22 so as to transmit, as an event notification (sequence number 2), a content obtained by adding an event log to the content of notification that a status change has occurred, to the management device 1. . Upon receiving the event notification, the communication processing unit 22 transmits the event notification to the transmission path 3
To the management device 1 via the At this time, if a line failure occurs, the management device 1 and the managed device 2 cannot recognize that the event notification of the sequence number 2 has disappeared halfway.

Sequence S3: When a state change occurs in the managed device 2, the state change detection unit 23 detects the state change and uses the contents of the state change assigned with the type and the sequence number 3 as an event log to perform buffer control. The data is stored in the event storage buffer unit 25 via the unit 24.
In addition, the state change detection unit 23 is passed to the communication processing unit 22 so as to transmit, as an event notification (sequence number 3), a content obtained by adding an event log to the content that notifies that a status change has occurred, to the management device 1. . Upon receiving the event notification, the communication processing unit 22 transmits the event notification to the transmission path 3
To the management device 1 via the Communication processing unit 12 of management device 1 that has received the event notification of sequence number 3
Passes the event notification to the event processing unit 11. The event processing unit 11 analyzes the sequence number from the passed event notification (the event log of the sequence number 3), and updates the management information by storing the contents of the event in the management information storage unit 13. At this time, the event processing unit 11 of the management device 1 detects that the continuity of the sequence number has been lost in the process of analyzing the sequence number, thereby confirming that the event notification of the sequence number 2 has not been received. To detect.

As described above, every time a state change occurs in the managed device 2, the managed device 2 assigns a sequence number, saves the sequence number in an event log, and transmits an event notification to the management device 1. Further, each time the management device 1 receives the event notification, the management device 1 updates the management information of the corresponding managed device 2.

Sequence S4: When a state change occurs in the managed device 2, the state change detection unit 23 detects the state change and provides a type change and a sequence number N-1 (N is a positive integer). Is stored in the event storage buffer unit 25 via the buffer control unit 24 as an event log. In addition, the state change detecting unit 23 performs event notification (sequence number N-1) by adding an event log to the content notifying that a state change has occurred.
Is transmitted to the communication processing unit 22 so as to be transmitted to the management apparatus 1. The communication processing unit 22 having received the event notification transmits the event notification to the management device 1 via the transmission path 3. The communication processing unit 12 of the management device 1 that has received the event notification of the sequence number N-1 passes the event notification to the event processing unit 11. The event processing unit 11 analyzes the sequence number from the received event notification (the event log of the sequence number N-1), and updates the management information by storing the content of the event in the management information storage unit 13.

Sequence S5 in FIG. 3: When a state change occurs in the managed device 2, the state change detection unit 23 detects the state change and records the contents of the state change with the type and the sequence number N as an event log. Is stored in the event storage buffer unit 25 via the buffer control unit 24. In addition, the state change detection unit 23 is passed to the communication processing unit 22 so as to transmit, as an event notification (sequence number N), a content obtained by adding an event log to the content notifying that a status change has occurred, to the management device 1. . The communication processing unit 22 having received the event notification transmits the event notification to the management device 1 via the transmission path 3. The communication processing unit 12 of the management device 1 that has received the event notification of the sequence number N passes the event notification to the event processing unit 11. The event processing unit 11 analyzes the sequence number from the received event notification (event log of the sequence number N), and stores the contents of the event in the management information storage unit 13.
To update the management information. At this time, in the process of analyzing the sequence number, the event processing unit 11 of the management apparatus 1 stores the event log of the managed apparatus 2 based on the sequence number (because the maximum number is N) (event storage). It is detected that the area of the corresponding type in the buffer unit 25 has reached the maximum capacity.

Sequence S6: The maximum buffer capacity of the managed device 2 is detected from the sequence number (sequence S
5) Since the event processing unit 11 of the device 1 has detected that the event notification of the sequence number 2 has not been received, the event processing unit 11 requests the reading of the event log of the sequence number 2 of the corresponding type to the event log read request. Request to the response processing unit 14. The event log read request / response processing unit 14 creates an event log request of sequence 2 of the corresponding type and passes the request to the communication processing unit 12 so as to transmit the request to the managed device 2. , An event log read request is transmitted via the transmission path 3 of the managed device. Upon receiving the event log read request, the communication processing unit 22 of the managed device 2 passes control to the buffer control unit 24. The buffer control unit 24 to which the control is passed analyzes the event log read request, determines that the event log of the sequence 2 of the corresponding type is read, and reads the sequence from the area of the corresponding type in the event storage buffer unit 25. 2 is read. Further, the buffer control unit 24 passes the read event log of the sequence 2 of the corresponding type to the communication processing unit 22 in order to return it to the management device 1. The communication processing unit 22 returns the event log of the sequence 2 of the corresponding type to the management device 1 via the transmission path 3. The communication processing unit 12 of the management device 1 stores the received event log of the sequence 2 of the corresponding type in the event read request / response processing unit 14.
Pass to. Event log read request / response processing unit 14
Stores the event log of the sequence 2 of the corresponding type in the type sub-area of the corresponding managed device area in the management information storage unit 13. In the management device 1,
This processing (sequence S6) is skipped when there is no event log of the unreceived event or when the event log of the unreceived event is unnecessary.

Sequence S7: The maximum buffer capacity of the managed device 2 is detected from the sequence number (sequence S5)
The event processing unit 11 of the device 1
The management apparatus 1 sends a buffer clear request to the buffer clear request / response processing unit 15 to which a range (1 to N) of the sequence number of the corresponding type of the event log that is unnecessary is added. Upon receiving the request, the buffer clear request / response processing unit 15 sets the sequence number (1 to
A buffer clear request indicating clearing of the event log in the range of N) is created, and the buffer clear request is transmitted to the communication processing unit 12 so as to be transmitted to the managed device 2. Communication processing 12
Transmits the passed buffer clear request to the managed device 2 via the transmission path 3. The communication processing unit 22 of the managed device 2 that has received the buffer clear request
Pass control to. The buffer control unit 24 to which the control is passed,
It is determined that the buffer is to be cleared by analyzing the buffer clear request, and the event log in the range of the designated sequence number (1 to N) in the corresponding type area of the event storage buffer unit 25 is cleared, and the designated event log is cleared. A buffer clear response notifying that the sequence number (1 to N) of the corresponding type has been deleted is created, and the communication processing unit 2
Hand over to 2. The passed communication processing unit 22 returns the communication processing unit 22 to the management device 1 via the transmission path 3. The communication processing unit 12 of the management device 1 that has received the buffer clear response passes the buffer clear response to the buffer clear request response / processing unit 15. The buffer clear request / response processing unit 15 recognizes that the managed device 2 has cleared the buffer by analyzing the buffer clear response, and responds to the event processing unit 11 with the result. The event processing unit 11 recognizes that the buffer of the managed device 2 has been cleared by the response from the buffer clear request / response processing unit 15. As a result, the event log required by the management device 1 is not deleted by the managed device 2.

By repeating the above-described sequences S1 to S7, the managed device 2 arbitrarily receives the status change information of the managed device 2 that has not been received by the management device 1 without causing a buffer overflow in the managed device 2. It will not be deleted. Then, since the managed device 2 deletes only the event log determined to be unnecessary by the management device 1 from the event log, the management device 1 deletes the necessary event log when necessary.
Can be obtained from

Therefore, by assigning a sequence number to the event notification for each status change type with a sequence number assigned each time an event notification is issued, the management device can recognize even the event log type of the unreceived event notification. It can be used as a criterion for reading the reception event log.

In the above description, the type of the event log has been considered, but if the types are combined into one, the management device 1
It is not necessary to provide a sub-area for each type in the upper storage unit 13, but only to provide an area for each managed device 2. In addition, the event storage buffer unit 25 of the managed device 2 stores It is not necessary to provide one area and only one area needs to be provided.

As described above, according to the present invention, the managed device assigns a continuous sequence number (number incremented each time an event is issued) to an event notification to be issued, and the management device assigns the sequence number to the event notification. By analyzing, the number of event notifications issued by the managed device is managed. Further, when the event notification of the sequence number indicating that the event storage buffer of the managed device is full is received by the management device, the number of unreported events from the managed device is received. If the received event notification exists, the management device reads the event log of the managed device at the discretion of the management device.
Before overwriting the event storage buffer of the managed device,
The management device can know the state of the event storage buffer, and can avoid receiving necessary event logs.

When there is no unreceived event or when it is determined that the information of the unreceived event is unnecessary, the management device sends a clear request for the event storage buffer to the managed device. At this time, when the management device sends a clear request to the managed device, by specifying the range of clearable sequence numbers, the managed device clears the log storage buffer at the discretion of the management device. Become
The managed device does not overwrite the event log required for the management device.

Since the management device uses the sequence number when detecting the unreceived event notification, the management device can detect the unreceived event notification from the discontinuity of the sequence number of the received event notification. . Since the sequence number of the unreceived event notification detected at that time is known, only the necessary information can be read by specifying the sequence number in the read request. Since the detection of the unreceived event notification is determined from the event notification received next to the unreceived event notification, the information of the unreceived event notification at that time is information that does not need to be managed in real time, Information used in

That is, since the management device manages the buffer state of the managed device, the managed device does not clear the event log of the not-received event notification required by the management device. Event log required for the event can be read.

[0039]

As described above, according to the present invention, a sequence number is assigned to a managed device that issues an event notification with low communication reliability and an event log is saved, so that the managed device reaches the management device. The management device can arbitrarily read the event notification that has not been performed, and furthermore, by assigning a sequence number to the event notification, the management device can analyze the sequence number, There is an effect that the number can be detected.

Further, according to the present invention, when the maximum number of event logs of the managed device has been reached, the not-yet-received event notification is read out if necessary, and the event log of the managed device is cleared if unnecessary. Therefore, there is an effect that the management device can acquire only necessary information from the managed device. Further, since the management device manages the maximum number of events of the managed device, there is an effect that the managed device does not overwrite the event log required by the management device due to the overflow of the event storage buffer.

According to the present invention, the management device detects a discontinuous sequence number by analyzing the sequence number,
It is possible to detect an event notification that has not arrived from the managed device to the management device, and it is possible to easily determine the sequence number of an unreceived event notification and read out a necessary event log.

[Brief description of the drawings]

FIG. 1 is a functional block diagram showing an embodiment of the present invention.

FIG. 2 is a sequence diagram (1/2) showing an overall operation in the embodiment of the present invention.

FIG. 3 is a sequence diagram (2/2) showing an overall operation in the embodiment of the present invention.

[Explanation of symbols]

 REFERENCE SIGNS LIST 1 management device 2 managed device 3 transmission path 11, 21 event processing unit 12, 22 communication processing unit 13 management information storage and storage unit 14 event log read request / response processing unit 15 buffer clear request / response processing unit 23 state change detection unit 24 Buffer control unit 25 Event storage buffer unit

Continued on the front page (51) Int.Cl. ⁷ Identification code FI Theme coat II (Reference) H04L 29/14 9A001 F term (Reference) 5B042 GA12 MA07 MC40 5B089 GA21 GB02 HB10 JA35 JB15 KA12 KA13 KD01 KD09 MC03 5K030 GA12 GA14 HA08 HC14 HD06 JA10 KA03 LA01 MB01 MC08 MC09 MD04 5K033 AA06 BA08 CB03 CC01 DA01 DB13 DB14 DB20 EA06 EA07 EC01 5K035 AA03 BB03 DD01 EE01 FF01 JJ02 MM03 MM07 9A001 BB02 BB03 BB04 CC06 DD10 JJ18 KK56 LL56

Claims (6)

[Claims] 1. An event log control method in network management in which a management device connected to a network receives an event notification using a UDP communication protocol from a managed device connected to the network. State change detection means for detecting a change, an event log storage means for adding a sequence number to the content of the status change in the order in which the status change has occurred, and storing the content of the status change in a buffer as an event log; An event notification transmitting unit configured to transmit the occurrence of a state change and the event log to the management device as an event notification, wherein the management device is attached to the event notification when the event notification is received. Unreceived event notification is detected by analyzing the sequence number. An event log control method in network management, comprising a communication event detection unit. 2. The management device, upon receiving the event notification, analyzes a sequence number added to the event notification to detect whether or not the capacity of the buffer has reached a maximum. 2. The event log control method in network management according to claim 1, further comprising a detection unit. 3. The management apparatus according to claim 1, wherein said maximum buffer capacity detection means detects that the capacity of said buffer has reached a maximum and said unreceived event detection means detects a necessary unreceived event notification. 3. The event log control in network management according to claim 2, further comprising: an event log read request unit for requesting a read of an unreceived event log; and a buffer clear request unit for requesting a clear of the buffer. method. 4. The event log control method in network management according to claim 1, wherein said event log storage means stores an event log for each type in said buffer having an area secured for each type. 5. An event log control method in network management in which a management device connected to a network receives an event notification using a UDP protocol from a managed device connected to the network, wherein the managed device comprises: Detecting a state change, assigning a sequence number to the content of the state change in the order in which the state change has occurred, storing the assigned content of the state change in a buffer as an event log, and that the state change has occurred. The event log is transmitted to the management device as an event notification.When the management device receives the event notification, the management device analyzes a sequence number added to the event notification to determine whether there is an unreceived event notification. Event log system in network management characterized by checking whether Your way. 6. An event log control method in network management in which a management device connected to a network receives an event notification using a UDP protocol from a managed device connected to the network, wherein the managed device comprises: Detecting a state change, assigning a sequence number to the content of the state change in the order in which the state change has occurred, storing the assigned content of the state change in a buffer as an event log, and that the state change has occurred. The event log is transmitted to the management device as an event notification.When the management device receives the event notification, the management device analyzes a sequence number added to the event notification to determine whether there is an unreceived event notification. Check the sequence number attached to the event notification Check whether the buffer capacity of the management device has reached the maximum, detect that the capacity of the buffer has reached the maximum, and, when detecting a necessary unreceived event notification, An event log control method in network management, wherein a request for clearing the buffer is made when a read request is made and an unreceived event log is received.