JP2002330191A - Method and system for detecting abnormality - Google Patents

Abstract

PROBLEM TO BE SOLVED: To detect abnormality of a system under monitoring at an early stage, in performing a health check, by which a monitor ascertains whether specified functions provided by the system under monitoring are normal, via a communication line in a predetermined cycle in order to detect abnormality of the system. SOLUTION: A cycle for health check is prescribed according to a time necessary for completing the health check. A long cycle health check, such that the time necessary for completing the health check is longer than a predetermined time, is performed in the predetermined cycle, and A short cycle health check, such that the same necessary time is shorter than the predetermined time, is performed in a cycle shorter than the predetermined cycle. Thus, before performing the health check, classifying into health check in a functioning ascertainment level, by which specified failures provided by system under monitoring are detected in a long cycle, and one in a communication preparedness ascertainment level, by which such as system down in the monitor is checked in a short cycle, enables the detection at an early stage of abnormality in a system under monitoring.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an abnormality detection system and an abnormality detection system, and more particularly to a system for transmitting and receiving data between a plurality of devices connected via a communication line. The present invention relates to an abnormality detection method for checking the functional operation status and communication availability between them, and an abnormality detection system.

[0002]

2. Description of the Related Art Conventionally, as a technique relating to such an abnormality detection method, there has been known a method of performing a health check by checking from a monitoring apparatus whether or not a specific function provided by a monitored apparatus is normal at a predetermined cycle. . A health check from the monitoring device to the monitored device for operation confirmation is performed, for example, in JP-A-8-223191,
-336177 and JP-A-2000-115169.

In Japanese Patent Application Laid-Open No. 8-223191, if a response to transmitted health check data is not within a predetermined waiting time, the waiting time is extended or shortened and updated to take into account the magnitude of processing load. The system can determine the normality of the device. JP-A-10-3
In Japanese Patent No. 36177, the time required for one health check is reduced by suppressing the health check traffic.

In Japanese Patent Application Laid-Open No. 2000-115169, polling for a node is partially omitted in order to suppress traffic of a health check. In the health check described in each of the above publications, in any case, the monitoring device transmits a signal to one or more monitored devices at a predetermined interval, and the monitored device transmits the signal to the signal. It is confirmed that a response signal is returned to the monitoring device in response. By doing so, it is determined that the monitored device is operating normally.

The health check is performed not only by the simple method described above but also at various levels such as a function operation check level as necessary, to check whether a specific function provided by the monitored device is normal. You can also. By performing a health check at the functional operation confirmation level, it is possible to detect a specific functional failure provided by the monitored device. However, if you perform a health check at the function operation confirmation level,
Conversely, the load in the health check process increases.

In such a case, it is necessary to perform the health check in a long cycle so that the health check process does not affect other processes. However, if the health check is performed in a long cycle, it becomes difficult to detect the fault immediately when the fault occurs, and the time from the occurrence of the fault to the detection of the fault becomes longer.

[0007]

In the conventional abnormality detection method, when performing a health check at a function operation confirmation level, a long period in which the health check process does not affect processes other than the health check. Need to do a health check. On the other hand, it is desirable that the notification to the maintenance person at the time of occurrence of a failure be performed in a shorter time from the time of occurrence of the failure.

As described above, in the case of performing a health check at a function operation confirmation level in the conventional abnormality detection method,
Simply shortening the health check cycle increases the effect on the CPU load of the system and affects processes other than the health check, so the time from failure occurrence to failure detection becomes longer. There was a disadvantage. Such a drawback cannot be solved even by the techniques described in the above-mentioned patent publications.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned drawbacks of the prior art, and an object of the present invention is to provide an abnormality detection method capable of detecting an abnormality of a monitored device in a dry season,
And to provide an abnormality detection system.

[0010]

According to a first aspect of the present invention, there is provided an abnormality detection method, comprising: performing a health check in which a monitoring device checks via a communication line whether a specific function provided by a monitored device is normal; In this case, a cycle of performing the health check is determined according to a time required until the health check is completed.

[0011] The abnormality detection method according to claim 2 of the present invention comprises:
2. The health check system according to claim 1, wherein a long-period health check required for completing the health check is longer than a predetermined time in a first cycle, and a short-period health check shorter than the predetermined time is performed in the first cycle. Is performed in a second cycle shorter than the cycle of. In the abnormality detection method according to claim 3 of the present invention, in claim 2, the long-period health check is a function operation check level health check that detects the presence or absence of a function operation failure in a specific function provided by the monitored device. The short- and long-period health check is a communication health check level health check for detecting the presence or absence of a failure in communication between the monitoring device and the monitored device.

An abnormality detection system according to a fourth aspect of the present invention is characterized by including first and second health check executing means for performing health checks at mutually different periods. According to a fifth aspect of the present invention, in the abnormality detection system according to the fourth aspect, one of the first and second health check execution units has a length of time necessary for completing the health check being longer than a predetermined time. The periodic health check is performed in a first cycle, and the other of the first and second health check executing means performs a short-term health check shorter than the predetermined time in a second cycle shorter than the first cycle. 5. The abnormality detection system according to claim 4, wherein the abnormality detection is performed periodically.

According to a sixth aspect of the present invention, in the abnormality detection system according to the fifth aspect, the long-period health check is a function operation confirmation level health check for detecting the presence or absence of a function operation failure in a specific function provided by the monitored device. Wherein the short- and long-period health check is a communication availability confirmation level health check for detecting the presence or absence of a failure in communication between the monitoring device and the monitored device.

In short, according to the present invention, in a system which is connected via a communication line and communicates with each other, the health checks are classified and executed according to the time required until the health check is completed. That is, a function operation check level health check (hereinafter referred to as a long-term health check) that detects a specific functional failure provided by the monitored device in a long cycle, and whether the monitored device has a system down in a short cycle. And the like, and a communication availability confirmation level health check (hereinafter referred to as a short-term health check) is executed. In this way, the above-mentioned problem in the conventional health check is solved by determining the cycle of performing the health check according to the time required until the health check is completed, and the abnormality of the monitored device is detected during the dry season. it can.

[0015]

Next, an embodiment of the present invention will be described with reference to the drawings. In the drawings referred to in the following description, the same parts as those in the other drawings are denoted by the same reference numerals. FIG. 1 is a block diagram showing a configuration to be provided in a monitoring device to realize the abnormality detection method according to the present invention. As shown in the figure, in the abnormality detection method according to the present embodiment, a health level for performing a health check of a communication availability check level is to check whether or not a monitored device has a system down in a short cycle. Short-term health check execution unit 11 that outputs check data
A long-term health check execution unit 12 that detects a specific function failure provided by the monitored device in a long cycle, outputs health check data for performing a function operation check level health check, and is input to both of these execution units. 1 includes a timer 10 for outputting time data and a transmission / reception unit 13 for transmitting health check data to the monitored device and receiving a response from the monitored device.

In such a configuration, the short-term health check execution unit 11 and the long-term health check execution unit 12
The health check data is output at an independent cycle in accordance with the time data output by the timer 10. That is,
The short-term health check execution unit 11 and the long-term health check execution unit 12 perform health checks at mutually different cycles. In this example, the long-term health check execution unit 12 performs a long-period health check in a first cycle, the time required for completing the health check is longer than a predetermined time, and
The short-term health check execution unit 11 performs a short-period health check shorter than a predetermined time in a second cycle shorter than the first cycle. Health check data output from the long-term health check execution unit 12 and the short-term health check execution unit 11
The health check data output from the
Is sent to the transmission path network and sent to the monitored device.

FIG. 2 shows an image of a health check operation between a monitoring device and a monitored device when the abnormality detection method according to the present invention is employed in a communication network system. As shown in the figure, the health check from the monitoring device to the monitored device includes long-term health checks L1 and L2 performed at a relatively long cycle and short-term health checks performed between the long-term health checks. S
1, ..., Sn.

Here, the check range of the long-term health check is a function operation status of the monitored device that detects a specific functional failure provided by the monitored device in a long cycle. On the other hand, the check range of the short-term health check is a response by the health check process of the monitored device, which checks in a short period whether the system of the monitored device has failed. This short-term health check is performed, for example, by using a well-known PING (packet internet gro).
(per) command.

Since it takes some time until a response to the long-term health check is returned, an abnormality such as a system down can be detected early by performing the short-term health check within that time. In other words, short-term health checks that return a response in a much shorter time than in the case of long-term health checks are performed more frequently in a shorter cycle than long-term health checks, so that serious abnormalities such as a system failure can be detected early. Can be. As described above, according to the present method, abnormalities can be detected earlier by classifying into long-term health checks and short-term health checks and performing them at different periods.

Here, in the long-term health check,
Assume that an error is detected when the response to the long-term health check request times out. FIG. 3 shows an abnormality detection operation by a long-term health check between the monitoring device and the monitored device in the present invention. In the figure, a long-term health check L1, L2, L3,... Is performed by the monitoring device, and if there is no response from the monitored device within a predetermined time period (time-out), the monitored device becomes abnormal. Judge that there is.

On the other hand, in the short-term health check, it is assumed that an abnormality is detected when the response to the short-term health check request times out. FIG. 4 shows an abnormality detection operation by a short-term health check between the monitoring device and the monitored device in the present invention. In the figure, a short-term health check S1, S2, S3... Is performed by the monitoring device, and if there is no response from the monitored device within a predetermined time, it is determined that the monitored device is abnormal. When there is no response from the monitored device within a predetermined period of time, such as when the system is down (timeout), the monitoring device can recognize that the monitored device is abnormal. . When the system recovery is detected, the maintenance person is notified that the recovery is completed.
This recovery notification is performed when it is detected that all abnormalities have been recovered.

FIG. 5 is a block diagram showing an example of a network configuration to which the abnormality detection system according to the present invention is applied. The network shown in FIG. 1 includes four devices 1 to 4 connected via a transmission line network 10.
The devices 1 to 4 constituting this network are configured to mutually perform a health check. In order to perform a health check, it is assumed that each of the devices 1 to 4 has the configuration shown in FIG. 1 described above.

The arrows in the figure indicate the monitoring direction from the monitoring device to the monitored device. That is, the tip of the arrow in the figure is the monitored device, and the root of the arrow is the monitoring device. In the figure, the device 1 receives the above-mentioned health check signals from the devices 2 and 4 (monitoring direction,
). The monitoring devices 2 and 4 perform a health check on the monitored device 1 in the operation illustrated in FIG.
The health check performed here is the abnormality detection operation described above and shown in FIGS.

If the monitoring apparatuses 2 and 4 recognize that the monitoring target apparatus 1 has a system down, etc., the monitoring apparatuses 2 and 4 are monitoring target apparatuses. A short-term health check of the abnormality detection operation shown in FIG. When the restoration of the system is detected, the maintenance terminal 5 is notified that the restoration is completed. This recovery notification is performed when it is detected that all abnormalities have been recovered. Here, the maintenance terminal 5 is a device that monitors the system state of the device 1.

The health check is also performed on the devices 2, 3, and 4 in the same manner as described above (monitoring direction, monitoring direction, monitoring direction, and the like). In short, in this example, the devices 1 to 4 are monitoring devices or monitored devices, and mutually perform a health check. The maintenance terminal 6, the maintenance terminal 7, and the maintenance terminal 8 are devices that monitor the system states of the devices 2, 3, and 4, respectively.

The present invention can be applied to a network configuration other than the network configuration shown in FIG. 5, and it is needless to say that an abnormality can be detected.

[0027]

As described above, according to the present invention, when there are a plurality of devices that are connected via a communication line and transmit and receive data, the monitored device to be monitored from the monitoring device to the monitored device can be used. A health check is performed on the monitored device to check whether the specific function provided is normal, a function operation check level health check that detects a specific functional failure provided by the monitored device over a long period, and a monitoring device is performed over a short period Is a communication availability check level that checks whether the system has failed or not.A health check is performed, and the monitoring device performs each health check on the monitored device to check for abnormalities in the monitored device. There is an effect that can be detected.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration to be provided to realize an abnormality detection method according to the present invention.

FIG. 2 is a diagram illustrating a health check operation between a monitoring device and a monitored device.

FIG. 3 is a diagram showing an abnormality detection operation by a short-term health check between a monitoring device and a monitored device.

FIG. 4 is a diagram showing an abnormality detection operation by a long-term health check between a monitoring device and a monitored device.

FIG. 5 is a block diagram showing an example of a network configuration to which the abnormality detection method according to the present invention is applied.

[Explanation of symbols]

 1, 2, 3, 4 device 5, 6, 7, 8 maintenance terminal 10 timer 11 short-term health check execution unit 12 long-term health check execution unit 13 transmission / reception unit

 ──────────────────────────────────────────────────続 き The continuation of the front page F term (reference) 5B089 GA21 GB02 HA01 JA35 JB16 KA12 5K035 AA03 BB03 DD01

Claims (6)

[Claims] An abnormality detection method for detecting an abnormality in a system by performing a health check performed by a monitoring device via a communication line at a predetermined cycle to determine whether a specific function provided by the monitored device is normal. An abnormality detection method, wherein a cycle of performing the health check is determined according to a time required until the health check is completed. 2. A long-period health check that takes a longer time to complete the health check than a predetermined time is performed in a first cycle, and a short-period health check that is shorter than the predetermined time is performed by the first health check. 2. The abnormality detection method according to claim 1, wherein the detection is performed in a second period shorter than the period. 3. The long-period health check is a function operation confirmation level health check for detecting the presence or absence of a functional operation failure in a specific function provided by the monitored device. 3. The abnormality detection method according to claim 2, wherein the communication possibility confirmation level health check detects the presence or absence of a failure in communication with the monitored device. 4. An abnormality detection system comprising first and second health check executing means for performing health checks at mutually different periods. 5. One of the first and second health check execution means performs a long-period health check in which the time required until the health check is completed is longer than a predetermined time in a first cycle, and The other of the first and second health check executing means performs a short cycle health check shorter than the predetermined time in a second cycle shorter than the first cycle. Abnormality detection system. 6. The long-period health check is a function operation check level health check for detecting the presence or absence of a functional operation failure in a specific function provided by the monitored device, and the short- and long-period health check is performed by the monitoring device and the monitoring device. 6. The abnormality detection system according to claim 5, wherein the communication possibility confirmation level health check detects presence or absence of a failure in communication with the monitored device.