JP2003124933A - Monitoring method, system, monitor terminal, program and recording medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a method of easily monitoring a network device, a system, a monitor terminal, a program and a recording medium. SOLUTION: A monitoring center 1 transmits an event for setting a monitoring range to a network entity 4. A monitor terminal 2 transmits a monitor filter showing the condition of receiving an alarm event for informing about a failure of a network device to the entity 4. The entity 4 registers the event for setting the monitoring range and the monitor filter, and transfers them to other network entities. The network device 3 transmits to the entity 4 the alarm event for reporting a failure of itself upon detection thereof. The entity 4 transmits the alarm event to other network entities 4 and, if agreeing with the monitor filter, outputs a failure to the monitor terminal 2 which has registered the monitor filter.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a monitoring method, system, monitoring terminal, program and recording medium capable of easily monitoring network devices in an autonomous distributed network.

[0002]

2. Description of the Related Art Conventionally, L is used to monitor a network device.
For small-scale networks such as AN (Local Area Network), a monitoring terminal is prepared, and SNMP (Simple Network Man
A warning is generally received from each network device using a monitoring protocol such as agement protocol), or the network operator is conscious of the network configuration and specifies (connects) a specific device before receiving the alarm.

In a large-scale network such as a WAN (Wide Area Network), an operation center facility for centralized monitoring is prepared, and each network device is connected to the operation center and issues an alarm to the operation center. A plurality of monitoring terminals can be installed, and each monitoring terminal monitors each network device by connecting to the operation center.

[0004]

[Problems to be Solved by the Invention] Pure P2P (Peer
In an autonomous distributed configuration network in which network devices can be freely connected and disconnected, such as to networks, the network configuration becomes enormous and
It changes in various ways. Therefore, it is very difficult to provide center equipment for centralized monitoring and to monitor after grasping the network configuration. However, in order to succeed a new business through such a network, it is necessary to monitor the network equipment that needs to be monitored simply by defining the conditions that need to be monitored. The present invention has been made in view of the above circumstances, and an object thereof is to provide a monitoring method, a system, a monitoring terminal, a program, and a recording medium capable of easily monitoring a network device in an autonomous distributed network. To do.

[0005]

The present invention has been made to achieve the above object, and is a monitoring method for monitoring a network device for transmitting and receiving data on a network, wherein an event is a data And a process of creating a monitoring filter indicating a condition for receiving an alarm event, the monitoring terminal being configured from the semantic information of the data,
Transmitting the created monitoring filter to a network entity that controls the transmission and reception of events to and from the monitoring terminal based on the filter; the network device detecting an abnormality of the network device; When the alarm event is detected, a process of creating and notifying an alarm event for notifying the abnormality is provided, and when the notified alarm event matches the condition shown in the monitoring filter, the monitoring terminal is notified based on the alarm event. And a step of displaying an abnormality of the network device.

As a result, the monitoring terminal for monitoring the network device or the network operator (network administrator) operating the monitoring terminal does not have to be aware of the addition / removal of the network device to be monitored, and the monitoring target of the monitoring terminal concerned. It is possible to collect alarms from network devices that meet the conditions. Further, the network operator does not need to manage the connection of the network device with the monitoring terminal or the monitoring center.

Further, in the present invention according to the above invention, the monitoring center creates a monitoring event indicating a transmission range of the alarm event, and the created monitoring event,
And a step of transmitting to the network entity.

As a result, it is possible to limit the range of the network device and the monitoring terminal, which are the objects of monitoring, at which the event is transmitted and received, and avoid the unnecessary dissemination of the event. As a result, it is possible to realize a monitoring system that is highly scalable and maintainable.

Further, the present invention is a monitoring system for monitoring a network device for transmitting and receiving data on a network, wherein an event is composed of data and semantic information of the data, and the network device is Detection means for detecting an abnormality in the network device,
When an abnormality is detected by the detection means, a notification means for creating and notifying an alarm event for notifying the abnormality is provided,
The monitoring terminal includes a creating unit that creates a monitoring filter that indicates a condition for receiving an alarm event, and a transmitting and receiving unit that sends the created monitoring filter to a network entity that controls the sending and receiving of events to and from the monitoring terminal based on the filter. And a display unit that displays an abnormality of the network device based on the notified alarm event when the alarm event that matches the condition indicated by the monitoring filter is received.

Further, the present invention is a monitoring terminal for monitoring a network device for transmitting / receiving data on a network, wherein an event is composed of data and semantic information of the data, and is a condition for receiving an alarm event. And a transmission / reception unit for transmitting the generated monitor filter to a network entity that controls transmission / reception of an event to / from the monitor terminal based on the filter, and a condition shown in the monitor filter. And an alarm event created by the network device for notifying an abnormality, the display device displaying an abnormality of the network device based on the notified alarm event. Characterize.

The present invention is also a monitoring program for a monitoring terminal for monitoring a network device that transmits and receives data on a network, wherein an event is composed of data and semantic information of the data, and an alarm event. Creating a monitor filter indicating a condition for receiving a request, transmitting the created monitor filter to a network entity that controls transmission and reception of an event to the monitor terminal based on the filter, and a condition indicated in the monitor filter. When the network device receives an alarm event that is created to notify the abnormality of the network device, the step of displaying the abnormality of the network device based on the notified alarm event It is a monitoring program to be executed.

The present invention is also a monitoring program for a monitoring terminal for monitoring a network device for transmitting and receiving data on a network, wherein an event is composed of data and semantic information of the data, and an alarm event. Creating a monitor filter indicating the conditions for receiving the monitoring request, sending the created monitor filter to a network entity that controls the transmission and reception of events to and from the monitor terminal based on the filter, and the condition indicated in the monitor filter. When an alarm event that matches the above and is generated by the network device for notifying the abnormality is received, a step of displaying the abnormality of the network device based on the notified alarm event is displayed on the computer. A compilation of recorded monitoring programs A chromatography data readable media.

[0013]

DETAILED DESCRIPTION OF THE INVENTION An embodiment of the present invention will be described below with reference to the drawings. First, Semantic Information-Oriented Network (hereinafter S)
(Also referred to as ION).

<SION Architecture> First, SIO
The N network architecture will be described. FIG. 14 shows a network model of SION. SION
Is a network for transmitting and receiving an event composed of data and semantic information describing the characteristics of data as shown in FIG. Here, for convenience of description, the terminal 7 will be referred to as a transmitter 71 of the event sender and a receiving terminal 72 of the event receiver. The event receiver uses the receiving terminal 72 to register the semantic information (type of event to be received and acquisition condition) of the event that the event receiver desires to receive in the SION 6 as metadata. This is called a filter. On the other hand, the event sender gives an stimulus (Incentive) to SION by sending an event to SION6 using the transmission unit 71. The definition of the semantic information is shown in FIG. The semantic information is the metadata of the event, and the semantic information type (event type)
Is an instance of.

The SION 6 is an autonomous decentralized matching network for matching (filtering) the events sent by the event sender against the filter registered by the event receiver. As a result of the matching, the filter that the event passed (reacted to the event) is fired (Ignition)
Then, the receiving terminal 72 of the corresponding event receiver is autonomously activated. With this mechanism, the target terminal 7 can be searched and discovered in a scalable and real-time manner from an unspecified number of terminals 7.

Next, the event type will be described.
FIG. 17 shows an example of defining an event type which is a template of an event. As shown in FIG. 17, an event type includes an event type name (Event type name), a condition name (in FIG. 17, “Service” and “CPU power” correspond), and a data type for each condition name ( "Sti
rng "and" Long "are defined) and conditional expressions (" = "=" and ">=" are equivalent) are defined. Event type name is a name for uniquely identifying the event type. The parent type of the event type can be inherited.

As shown in FIG. 18, an event is created according to the data structure of the event type. The event is
It consists of an event type name, a combination of condition name and condition value, and a data part. An error will occur if the condition name, condition expression, or condition value defined in the event does not match the event type. However, the condition name used in the event may be a subset of the event type.

FIG. 19 shows an example of filter definition. The filter uses the event type name (Event type nam
e), attribute name (in FIG. 19, "CPU power" or "Age")
Corresponds to) and the attribute value ("200" in FIG. 19).
And "25" correspond). Only events that belong to the event type defined by the accepted event type name will be filtered. It is possible to define a plurality of event type names here, and it is also possible to target all events by specifying a wild card (*. *). If the attribute name defined by the filter does not exist in the event type condition name defined by the accepted event type name, an error occurs. However, it may be a subset of event types.

Next, the configuration of SION6 will be described. Figure 2
0 is a diagram showing a configuration example of SION6. As shown in an example in FIG. 20, SION6 is a semantic information switch (Sema
nticInformation-Switch, shown as SI-SW in the drawing), Semantic Information-Route
r, shown as SI-R in the drawing), Semantic Information-Getaway (SI-R in the drawing)
(Shown as GW).

The semantic information switch (SI-SW) is a switching mechanism for collating the semantic information registered as a filter with the semantic information given to the event and, as a result, activating the terminal 2 of the event receiver who has fired. provide. The semantic information switch (SI-SW) and each terminal 7 are connected in a star type.

The semantic information router (SI-R) performs event path selection between the semantic information switches and also the terminal 7
It is responsible for transferring the event sent from the to the semantic information switch to another semantic information switch. This is achieved by dynamic event routing based on semantic information.

The semantic information gateway (SI-GW) is
Transfer the event in the event place. Here, the event place is a minimum unit (ontology domain) that guarantees a common semantic information space. In the event place, the name of the event type,
The uniqueness of the ontology system such as concept, vocabulary, meaning, and association is guaranteed, and the semantic information is described based on the common ontology. Basically, the event sent from the event sender's terminal 7 circulates only in the event place, but the semantic information gateway (SI-G
Through W), the mutual distribution of events between event places having different ontology systems becomes possible. At this time, the semantic information gateway (SI-G
W) performs the ontology conversion of the event and then transfers the event to a different event place. The details of SION described above are described in the following paper. Takanari Hoshiai, et al .: "Semantic Information Network Architecture", IEICE Transactions B, vol.J84-B, N0.3, pp.411-424

Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a block diagram showing the configuration of a monitoring system according to an embodiment of the present invention. In this figure, 1 is a monitoring center for managing the monitoring system. Reference numeral 2 is a monitoring terminal for monitoring the network device. Reference numeral 3 is a network device to be monitored. 4 is a network entity. Here, the semantic information switch, the semantic information router, the event place management unit, etc. are collectively referred to as a network entity. The function of the event place management unit will be described later. A monitoring device 5 includes a monitoring center 1, a monitoring terminal 2, a network device 3, and a network entity 4. 6 is a semantic information network. Semantic information network 6
As described above, a network formed by the meaning information switch, the meaning information router, the event place management unit, etc., which are collectively referred to as the network entity 4, sending and receiving events to and from each other based on the set filter. Is.

The semantic information network 6 has a plurality of monitoring devices 5. Here, in order to distinguish the respective monitoring devices 5, the monitoring devices 5a to 5f will be described, and the monitoring devices 5a to 5f will be described.
The description will be given by assigning "a to f" to the monitoring center 1, the monitoring terminal 2, the network device 3, the network entity 4, and the respective units configuring those devices, which configure f. In FIG. 1, only the network entity 4 of the monitoring device 5c includes the semantic information switch, the semantic information router, and the event place management unit, but the network entities 4 of other monitoring devices also include the semantic information switch,
It is composed of a semantic information router and an event place management unit.

FIG. 2 is a block diagram showing the structure of the monitoring center 1 for setting the event place. In this figure, 11 is an alarm event type data storage unit,
Alarm event type data, an example of which is shown in FIG. 3, is stored. Reference numeral 12 is a semantic information network control unit, which uses the alarm event type data stored in the alarm event type data storage unit 11 to create a monitoring event type setting signal (event) and sends it to the semantic information network 6.

FIG. 4 is a block diagram showing the configuration of the monitoring terminal 2. In the figure, reference numeral 21 denotes an alarm event type data storage unit, which stores alarm event type data, an example of which is shown in FIG. An input unit 22 creates a monitoring filter condition setting signal (event) using the information input by the network operator, and transmits it to the network entity 4 via the transmitting / receiving unit 24. A screen display unit 22 displays a screen or the like presented to the network operator on a display or the like.

FIG. 5 is a block diagram showing the configuration of the network device 3. In the figure, reference numeral 31 is an alarm event type data storage unit, which stores alarm event type data as an example shown in FIG. A failure detection unit 32 detects a failure of the network device 3. Reference numeral 33 is an alarm event notification unit, which creates an alarm event signal (event) using the alarm event type data and transmits it to the transmission / reception unit 34. The transceiver 34 transfers the received alert event signal to the network entity 4.

Next, the operation will be described with reference to FIG. The network operator uses an input / output device (not shown) to specify a monitoring range, and instructs the monitoring center 1 to create a monitoring event type setting signal including the specified monitoring range.

The semantic information network control unit 12 of the monitoring center 1 uses the alarm event type data stored in the alarm event type data storage unit 11 to monitor events including a monitoring range as shown in FIG. Create a typesetting signal. Next, the semantic information network control unit 12 transmits the created monitoring event type setting signal to the network entity 4.

At this time, the network operator can set the event place as the monitoring range. For example, as shown in an example in FIG. 8, it is possible to divide the event place by region or divide the event place for each network device type. In FIG. 8, the event place setting case # 1 shows a case adapted to network monitoring for each region, and the event place setting case # 2 shows a case adapted to each network device model.

By setting the event place,
Since it is possible to limit the range of network devices and monitoring terminals to be monitored for sending and receiving events and to avoid wasteful dissemination of events, it is possible to realize a monitoring system that is highly scalable and maintainable.

The network entity 4 (event place management section) transfers the received monitoring event type setting signal to another network entity 4 according to a filter registered in advance. As a result, the monitoring event type setting signal is transmitted to the network entities 4a to 4f (semantic information network 6) (step S10 in FIG. 6), and as a result, the monitoring range is limited. Further, when the event place is set by the monitoring event type setting signal, the event place management unit of each network entity 4 transfers the monitoring filter condition setting signal and the alarm event signal, which are received later, to the designated event place. Control so that it is limited to within.

The input unit 22a constituting the monitoring terminal 2a of the monitoring device 5a uses the screen display unit 2 based on the monitoring event type setting signal set in the network entity 4a.
A monitoring screen, an example of which is shown in FIG. 9, is output to 3a to prompt the network operator to input search filter conditions. The filter condition is, for example, a network device sent to the semantic information network 6 in the case of setting a condition for each region or the case of setting a condition for each network device type as described above with reference to FIG. Three
It indicates that when the alarm event for notifying the abnormality is satisfied, the alarm event is received.

Based on the input of the network operator, the input unit 22a generates a monitoring filter condition setting signal, an example of which is shown in FIG. 10, and transmits it to the network entity 4a via the transmitting / receiving unit 24a. The network entity 4a transfers the monitoring filter condition setting signal to another network entity 4 according to a preset filter. Thereby, the network entity 4a
To 4f (semantic information network 6), the monitoring filter condition setting signal is transmitted (step S1 in FIG. 6).
1). The same operation as described above is performed by the other monitoring terminals 2 (b to f) such as the monitoring terminal 2b (step S1 in FIG. 6).
2).

It is assumed that an abnormality has occurred in the network device 3a of the monitoring device 5a after the above settings are made. Failure detection unit 32a of network device 3a
When detecting a failure, notifies the alarm event notification unit 33a of a network device individual failure signal. This network device individual failure signal is sent to each network device 3
Each is unique.

The alarm event notification unit 33a extracts alarm event type data from the alarm event type data storage unit 31a, and based on the network device individual failure signal received from the failure detection unit 32a, an alarm event signal shown in FIG. 11 as an example. Is generated and transmitted to the transmitting / receiving unit 34a. The transmission / reception unit 34a transmits the received alarm event signal to the network entity 4a.

The network entity 4a transfers the alarm event signal to another network entity 4 according to a preset filter. As a result, the alarm event signal is transmitted to the network entities 4a to 4f (semantic information network 6) (step S13 in FIG. 6). The alarm event signal sent to the semantic information network 6 (network entities 4a to 4f) is collated by the network entity 4 of each monitoring device 5 with the filter condition set in the above-described step S11 and step S12 shown in FIG. It If they match as a result of collation, they are transmitted as an alarm event signal to the monitoring terminal 2 that registered the matching filter conditions. Here, it is assumed that the monitoring terminals 2a and 2b match the registered filter conditions.

The network entity 4a sends an alarm event signal to the monitoring terminal 2a (step S14 in FIG. 6). The monitoring terminal 2a transmits an alarm event signal to the screen display unit 23a, and the screen display unit 23a displays a screen image as an example in FIG.
The fact that an abnormality has occurred in a is displayed. Further, the network entity 4b transmits an alarm event signal to the monitoring terminal (step S15 in FIG. 6). Monitoring terminal 2b
Transmits an alarm event signal to the screen display unit 23b, and the screen display unit 23b displays the fact that an abnormality has occurred in the network device 3a with a screen image as shown in an example in FIG.

Looking at the displayed screen, the network operator knows the abnormality of the network device 3a, takes appropriate action such as notifying the related departments or investigating the network device in which the abnormality has occurred.

In the above-described embodiment, the network entity 4 constitutes the monitoring device 5 together with the network device 3 and the monitoring terminal 2, and the network device 3 and the monitoring terminal 2 communicate with each other to obtain the semantic information. The function of the network 6 is configured.

However, as shown in FIG. 12 as an example, each network entity 4 constitutes the semantic information network 6, and the network device 3 and the monitoring terminal 2 are connected to the semantic information network 6 so that the above-mentioned operation is performed. May be realized. That is, the monitoring terminal 2, the network device 3, and the network entity 4 are not included as the monitoring device 5, but the plurality of network entities 4 form one network as the semantic information network 6, and the monitoring terminal 2, the network The devices 3 may be distributed and connected to the semantic information network 6, respectively.

FIG. 13 shows a setting example of the monitoring filter condition setting signal. Such a setting example is applied when only the network device which can be a substitute for the failed network device should receive the alarm. Each monitoring terminal 2
When the network configuration is changed, the ratio of the current processing capacity to the total processing capacity of the network device 3 monitored by itself is included in the monitoring filter condition setting signal,
The filter is registered in the semantic information network 6. Here, for example, the monitoring terminal 2a has a processing capacity of "40% or less", the monitoring terminal 2b has a processing capacity of "20% or less", the monitoring terminal 2c has a processing capacity of "10% or less", and the monitoring terminal 2e has a processing capacity. Is registered as "15% or less", and the processing capacity of the monitoring terminal 2f is registered as "10% or less".

For example, assume that an abnormality has occurred in the network device 3d. The alarm event notification unit 33d of the network device 3d creates an alarm event signal with the required terminal capacity of 30%, for example. The number “30%” is calculated, for example, from the processing amount that can substitute the normal processing amount of the network device. When the alert event signal including the required terminal capability is transmitted to the network entity 4d, the network entity 4d transfers the alert event signal to the other network entity 4 according to the pre-registered filter.

Here, the monitoring terminal 2a in which the condition that the processing capacity is "40% or less" is included in the monitoring filter condition setting signal
Meets the requirements of processing capacity. Therefore, the network entity 4a sends an alarm event signal to the monitoring terminal 2a. The monitoring terminal 2a transmits an alarm event signal to the screen display unit 23b, and the screen display unit 23a displays that an abnormality has occurred in the network device 3d. Looking at the displayed screen, the network operator knows the abnormality of the network device 3d and takes appropriate measures such as substituting the network device 3a to be monitored by the monitoring terminal 2a for the network device 3d. As a result, the alarm event is fired only to those that can substitute for the faulty device at the present time, and the substitution process can be performed more efficiently.
Note that such an embodiment can be applied to the monitoring system configuration of which an example is shown in FIG.

In FIG. 1, the monitoring center 1 is shown only in the monitoring device 5c, but the present invention is not limited to this, and there may be a plurality of monitoring centers 1 for one event place.

Further, in the above-described embodiment, one monitoring terminal 2 has been described as monitoring one network device 3, but one monitoring terminal 2 may monitor a plurality of network devices 3.

The alarm event type data storage unit 11,
The alarm event type data storage unit 21 and the alarm event type data storage unit 31 include a nonvolatile memory such as a hard disk device, a magneto-optical disk device, a flash memory, or a CD.
-Read-only storage medium such as ROM, RAM
It is based on a volatile memory such as (Random Access Memory), or a combination of these.

Note that each unit in FIGS. 2, 4, and 5 may be realized by dedicated hardware, and each unit is composed of a memory and a CPU (central processing unit), The function may be realized by loading a program for realizing the function into a memory and executing the program.

Further, a program for realizing the function of each unit in FIGS. 2, 4 and 5 is recorded in a computer-readable recording medium, and the program recorded in this recording medium is read by a computer system. It may be realized by executing. The “computer system” mentioned here includes an OS and hardware such as peripheral devices. In addition, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.

The "computer-readable recording medium" means a flexible disk, a magneto-optical disk,
A portable medium such as a ROM or a CD-ROM, or a storage device such as a hard disk built in a computer system. Furthermore, "computer-readable recording medium"
Means a program that dynamically holds a program for a short period of time, such as a communication line for transmitting a program through a network such as the Internet or a communication line such as a telephone line, and a server or client in that case. Such a volatile memory inside a computer system that holds a program for a certain period of time is also included. Further, the above program may be one for realizing some of the functions described above, and may be one that can realize the above functions in combination with a program already recorded in the computer system. The embodiment of the present invention has been described in detail above with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes design changes and the like without departing from the scope of the present invention.

[0051]

As described above, according to the monitoring method, system, monitoring terminal, program and recording medium of the present invention, the following effects can be obtained. The monitoring terminal that monitors the network device or the network operator who operates the monitoring terminal must add or
It is possible to collect alarms from network devices that match the monitoring target conditions of the monitoring terminal without being aware of the reduction.
Further, the network operator (administrator) does not need to manage the connection of the network device with the monitoring terminal or the monitoring center. In this way, efficient monitoring without a central management mechanism (brokerless) can be realized.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration of a monitoring system in an embodiment of the present invention.

FIG. 2 is a configuration diagram of a monitoring center in the monitoring system in the embodiment.

FIG. 3 is a definition example of alarm event type data stored in advance in a storage unit in the embodiment.

FIG. 4 is a configuration diagram of a monitoring terminal in the monitoring system in the embodiment.

FIG. 5 is a configuration diagram of a network device in the monitoring system in the embodiment.

FIG. 6 is a diagram illustrating an operation of the monitoring system in the same embodiment.

FIG. 7 is an example of a monitoring event type setting signal set in the semantic information network from the monitoring center in the embodiment.

FIG. 8 is a diagram illustrating an example of setting an event place in the embodiment.

FIG. 9 is an example of a monitor screen on the monitor terminal in the embodiment.

FIG. 10 is an example of a monitoring filter condition setting signal set in the semantic information network from the monitoring terminal in the embodiment.

FIG. 11 is an example of an alarm event signal transmitted from the network device to the semantic information network in the embodiment.

FIG. 12 is a diagram showing a configuration of a monitoring system of another embodiment.

FIG. 13 is an example of a monitoring filter condition.

FIG. 14 is a diagram illustrating a semantic information network.

FIG. 15 is a diagram illustrating a semantic information network.

FIG. 16 is a diagram illustrating a semantic information network.

FIG. 17 is a diagram illustrating a semantic information network.

FIG. 18 is a diagram illustrating a semantic information network.

FIG. 19 is a diagram illustrating a semantic information network.

FIG. 20 is a diagram illustrating a semantic information network.

[Explanation of symbols]

1: monitoring center, 2: monitoring terminal, 3: network device, 4: network entity, 5 (a, b, c,
d, e, f): monitoring device, 6: semantic information network,
7: terminal, 11: alarm event type data storage unit, 12:
Semantic information network control unit, 21: alarm event data storage unit, 22: input unit, 23: screen display unit, 24:
Transmission / reception unit, 31: alarm event type data storage unit, 32:
Failure detection unit, 33: Warning event notification unit, 34: Transmission / reception unit

   ─────────────────────────────────────────────────── ─── Continued front page    F term (reference) 5B089 GA11 GA21 GB02 HA10 JB16                       KA12                 5K030 MA01 MA03 MB01

Claims (6)

[Claims] 1. A monitoring method for monitoring a network device that transmits and receives data on a network, wherein an event comprises data and semantic information of the data, and a monitoring terminal is a condition for receiving an alarm event. And a step of transmitting the created monitor filter to a network entity that controls transmission and reception of events to and from the monitor terminal based on the filter, and the network device is configured to detect an abnormality of the network device. And a step of creating and notifying an alarm event for notifying the abnormality when detecting an abnormality in the step, and if the notified alarm event matches the conditions shown in the monitoring filter, Check the monitoring terminal for abnormalities in the network device based on the alarm event. Monitoring method characterized by and a process that presents. 2. The monitoring center further comprises a step of creating a monitoring event indicating a transmission range of the alarm event, and a step of transmitting the created monitoring event to the network entity. The monitoring method described in 1. 3. A monitoring system for monitoring a network device transmitting and receiving data on a network, wherein an event comprises data and semantic information of the data, wherein the network device is an abnormality of the network device. The monitoring terminal creates a monitoring filter that indicates a condition for receiving the alarm event. The monitoring terminal creates a monitoring filter that indicates a condition to receive the alarm event. Creating means, a sending and receiving means for sending the created monitoring filter to a network entity that controls the sending and receiving of events to and from the monitoring terminal based on the filter, and an alarm event that meets the conditions shown in the monitoring filter is received. If the network is based on the notified alert event, Monitoring system characterized in that it comprises display means for displaying an abnormality of the apparatus. 4. A monitoring terminal for monitoring a network device for transmitting and receiving data on a network, wherein an event is composed of data and semantic information of the data, and a monitoring filter indicating a condition for receiving an alarm event. And a transmitting / receiving unit configured to transmit the generated monitor filter to a network entity that controls transmission / reception of an event to / from the monitor terminal based on the filter, and an alarm event that matches a condition shown in the monitor filter. When the network device receives an alarm event created for notifying an abnormality, the display device displays an abnormality of the network device based on the notified alarm event. Terminal. 5. A monitoring program for a monitoring terminal for monitoring a network device transmitting and receiving data on a network, wherein an event is composed of data and semantic information of the data, and a condition for receiving an alarm event. A step of creating a monitoring filter indicating the above, a step of transmitting the created monitoring filter to a network entity that controls transmission / reception of events to / from the monitoring terminal based on the filter, and an alarm that matches the conditions indicated in the monitoring filter When an alarm event, which is an event created by the network device to notify an abnormality, is received, a step of displaying the abnormality of the network device based on the notified alarm event; . 6. A monitoring program for a monitoring terminal for monitoring a network device transmitting and receiving data on a network, wherein an event is composed of data and semantic information of the data, and a condition for receiving an alarm event. A step of creating a monitoring filter indicating the above, a step of transmitting the created monitoring filter to a network entity that controls transmission / reception of events to / from the monitoring terminal based on the filter, and an alarm that matches the conditions indicated in the monitoring filter When an alarm event, which is an event created by the network device to notify an abnormality, is received, a step of displaying the abnormality of the network device based on the notified alarm event; Computer readable recording Do recording medium.