JP2005295140A - Monitoring system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a monitoring system with high reliability wherein the cost and man-hours at the introduction can be reduced. <P>SOLUTION: The monitoring system 50 for monitoring a web server 120 for providing services via the Internet is provided with: a monitoring unit 210 for monitoring a state of the web server 120; a dedicated line 20 for monitoring purpose provided separately from the Internet; and a firewall 114 that converts a transmission destination address and a transmission source address of packets when the web server 120 transmits the packets to the monitoring unit 210 via the dedicated line 20 and that converts the transmission destination address and the transmission source address of packets when the monitoring unit 210 transmits the packets to the web server 120 via the dedicated line 20. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a monitoring system, and more particularly to a monitoring system for monitoring a service providing apparatus that provides a service via a public communication network having openness.

  With the explosive spread of the Internet, a wide variety of services have been provided via the Internet from service providing devices such as web servers. Due to the nature of the Internet that it is possible to access service providing devices all over the world at any time regardless of time or place, the service providing devices are required to continue to provide services at all times. Inability of the service providing apparatus to be accessed due to a system malfunction or the like is an undesirable situation for both the service user and the service provider.

  When a problem occurs in the service providing apparatus, it is necessary for a technician who is familiar with the network to constantly monitor the service providing apparatus in order to quickly find this and restore it to the original state. However, human resource development has not been able to keep up with the growing demand of network engineers, and there is a chronic labor shortage.

In order to solve such a problem, the present applicant has developed a monitoring system capable of remotely monitoring a service providing apparatus and provides a monitoring service (see Patent Document 1). In the monitoring system described in Patent Document 1, a service providing apparatus that provides a service via the Internet is monitored via a dedicated line instead of the Internet.
JP 2002-101101 A

  From the administrator side of the service providing apparatus, there is a desire to introduce a monitoring system without changing the network settings including the service providing apparatus once constructed. In consideration of such circumstances, the present applicant has come up with a monitoring system that can further reduce the man-hours required for introduction and cost changes.

  The present invention has been made in view of such circumstances, and an object thereof is to provide a highly reliable monitoring technique. Another object of the present invention is to provide a technique for reducing costs and man-hours when introducing a monitoring system.

  One embodiment of the present invention relates to a monitoring system. The monitoring system is a monitoring system for monitoring a service providing apparatus that provides a service via a public communication network having openness, and communicates with the service providing apparatus and monitors a state of the service providing apparatus. A monitoring communication network for transmitting and receiving information between the monitoring device and the service providing device, provided separately from the monitoring device and the public communication network, and the monitoring from the service providing device to the monitoring device When transmitting the first information through the communication network, the transmission destination address and the transmission source address of the first information are converted, and the monitoring device to the service providing device via the monitoring communication network And an address translation device that translates the transmission destination address and the transmission source address of the second information when transmitting the second information.

  The address translation device is virtually assigned to the monitoring device in the network address system including the monitoring device and the real address of the monitoring device assigned to the monitoring device in the network address system including the monitoring device. A virtual address of the monitoring device assigned to the service providing device, and a real address of the service providing device assigned to the service providing device in an address system of a network including the service providing device, and the monitoring device. You may have an address conversion table which matches and stores the virtual address of the said service provision apparatus virtually allocated to the said service provision apparatus in the address system of a network.

  When the service providing apparatus transmits the first information to the monitoring apparatus, the service providing apparatus sets a real address of the service providing apparatus as a transmission source address and a virtual address of the monitoring apparatus as a transmission destination address. When transmitting the second information to the service providing apparatus, the apparatus may set a real address of the monitoring apparatus as a transmission source address and a virtual address of the service providing apparatus as a transmission destination address.

  The address conversion device refers to the address conversion table, converts a transmission destination address of the first information from a virtual address of the monitoring device to a real address of the monitoring device, and transmits the first information. The original address is converted from the real address of the service providing apparatus to the virtual address of the service providing apparatus, and the transmission destination address of the second information is changed from the virtual address of the service providing apparatus to the real address of the service providing apparatus. The source address of the second information may be converted from the real address of the monitoring device to the virtual address of the monitoring device.

  The address translation device may be a firewall device that controls whether information can be transmitted and received between the service providing device and the monitoring communication network.

  According to the present invention, a highly reliable monitoring system can be realized.

  FIG. 1 schematically shows an overall configuration of a monitoring system 50 according to an embodiment. The monitoring system 50 is a system for monitoring, via the dedicated line 20, a service providing apparatus that provides a service via a public communication network having openness.

  The service providing apparatus 140 provides a service via the Internet 10 as an example of a public communication network. The service user can use the service provided by the service providing apparatus 140 by accessing the service providing apparatus 140 from the user terminal 5 via the Internet 10.

  The monitoring device 210 monitors the service providing device 140 via the dedicated line 20 as an example of a monitoring communication network. The person in charge of monitoring can monitor the state of the service providing apparatus 140 by accessing the service providing apparatus 140 from the monitoring apparatus 210 via the dedicated line 20. By performing monitoring via the dedicated line 20 provided separately from the Internet 10, it is possible to avoid an increase in traffic due to transmission / reception of information for monitoring and to minimize the influence on the original service. Moreover, it is possible to avoid the occurrence of a security hole due to access to the service providing apparatus 140 from a publicly available communication network.

  In the present embodiment, the service providing apparatus 140 is provided in the data center 100. The data center 100 is a facility that provides a network environment to a plurality of service providers. In recent years, network engineers have not been able to keep up with the rapid increase in service providers, and there is a chronic shortage of network engineers. For this reason, it has become difficult to perform network management in-house, and there is an increasing number of cases in which a network including a service providing device is constructed in a facility such as the data center 100 and network management is outsourced. The internal network configuration of the data center 100 will be described with reference to FIG.

  In the present embodiment, the monitoring device 210 is provided in the monitoring center 200. As described above, according to the monitoring system 50 of the present embodiment, the service providing devices 140 provided in the plurality of data centers 100 can be centrally monitored in the monitoring center 200. The network configuration inside the monitoring center 200 will be described with reference to FIG.

  FIG. 2 shows a network configuration in the data center 100. In the data center 100, a plurality of service providers construct their own networks (hereinafter referred to as “segments”). Each segment is connected to the Internet 10 via the router 102. A service provider provides a service providing apparatus in each segment and provides various services to the user via the Internet 10.

  For example, in the segment 110, a web server 120, a POP server 122, and an SMTP server 124 are provided as examples of service providing apparatuses. The web server 120 provides a web page and various digital content distribution services. The POP server 122 and the SMTP server 124 provide Internet mail transmission / reception services.

  A firewall 112 is provided between these service providing apparatuses and the router 102. The firewall 112 prevents unauthorized access from the Internet 10 to the inside of the segment 110 and prevents unauthorized access from other segments in the data center 100.

  In the segment 110, a private network is further connected to the Internet 10 via the gateway 126. The terminal 130 may be assigned a private address that is not permitted to transmit and receive information on the Internet 10. Thus, there may be both a device having a global address and a device having a private address among the devices inside the segment 110.

  In the segment 150, an FTP server 160 and an application server 162 are provided as an example of a service providing apparatus. The FTP server 160 provides a file transfer service. The application server 162 provides various applications.

  A firewall 152 is provided between these service providing apparatuses and the router 102. The firewall 152 prevents unauthorized access from the Internet 10 to the inside of the segment 150 and prevents unauthorized access from other segments in the data center 100.

  Each device of the segment 110 is connected to the dedicated line 20 via the firewall 114 and the router 104. Each device in the segment 150 is connected to the dedicated line 20 via the firewall 154 and the router 104. The firewalls 114 and 154 control whether or not information can be transmitted and received between the service providing apparatus and the monitoring communication network, and prevent unauthorized access to the segment. The firewalls 114 and 154 further have a NAT (network address conversion) function. When receiving information addressed to the monitoring device 210 from the service providing device, the firewalls 114 and 154 convert the address information of the information. Further, when receiving information addressed to the service providing apparatus from the monitoring apparatus 210, the address information of the information is converted. Details of the conversion will be described later.

  FIG. 3 shows a network configuration in the monitoring center 200. In the monitoring center 200, a plurality of monitoring devices 210 and terminals 220 are connected to the dedicated line 20 via the router 202.

  FIG. 4 is a diagram for explaining the operation of the monitoring system 50. Taking the case of monitoring the web server 120 of the data center 100 from the monitoring device 210 of the monitoring center 200 as an example, the operation will be described with specific addresses set in the monitoring device 210 and the web server 120.

  The address system of the segment including the web server 120 in the data center 100 is “192.168.x.0 / 16”, and the address system of the segment including the monitoring device 210 in the monitoring center 200 is “10.10.x.0. / 16 ". The address (real address) of the monitoring device 210 in the segment address system in the monitoring center 200 is “10.10.x.10”, and the address (real address) of the web server 120 in the segment address system in the data center 100. ) Is “192.168.x.100”.

  Here, when the monitoring device 210 communicates with the web server 120, in order to make it appear that the web server 120 exists virtually on the same segment, the web server 120 is connected to the monitoring center 200 side. A virtual address “10.10.x.100” belonging to the address system is assigned. Similarly, when the web server 120 communicates with the monitoring device 210, in order to make it appear that the monitoring device 210 exists virtually on the same segment, the monitoring device 210 is connected to the data center 100 side. A virtual address “192.168.x.200” belonging to the address system is assigned. As the virtual address of the monitoring device 210, a vacant address is borrowed from the manager of the segment including the web server 120.

  A firewall 114, which is an example of an address translation device, has an address translation table 30 that stores correspondence between real addresses and virtual addresses of the web server 120 and the monitoring device 210, and addresses between real addresses and virtual addresses. Convert. The connection position of the address translation device is not limited to the example of FIG. 4, and may be the position of the router 104 or the position of the router 202, for example.

  The monitoring device 210 transmits information for inquiring the state of the web server 120 to the web server 120 via the dedicated line 20. The inquiry information at this time may be an SNMP (Network Management Protocol) “GetRequest” message or the like, or an HTTP “GET” message or the like.

  When the monitoring device 210 sends a packet to the web server 120, the virtual address “10.10.x.100” of the web server 120 is set as the destination address, and the real address “10.10.x.10” of the monitoring device 210 is set as the source address. Set and send. This packet is routed to the firewall 114 via the router 202, the dedicated line 20, and the router 104.

  The firewall 114 refers to the address conversion table 30 and changes the destination address of the packet sent from the monitoring device 210 to the web server 120 from the virtual address “10.10.x.100” of the web server 120 to the real address “192.168”. .x.100 ". Thereby, the packet transmitted from the monitoring apparatus 210 can be routed to the web server 120 without changing the address system or communication setting of the segment including the web server 120.

  The firewall 114 further refers to the address conversion table 30 to change the source address of the packet transmitted from the monitoring device 210 to the web server 120 from the real address “10.10.x.10” of the monitoring device 210 to the virtual address “ Convert to “192.168.x.200”. As a result, the web server 120 interprets this packet as a packet that came from a virtual monitoring device on its own segment, so the packet from the monitoring device 210 is not changed without changing settings such as filtering. Can be received.

  The web server 120 transmits response information to the inquiry information to the monitoring device 210 via the dedicated line 20. The response information at this time is determined according to the type of inquiry information transmitted by the monitoring device 210. For example, the response information may be an SNMP “GetResponse” message, a “Trap” message, or an HTTP response message.

  When the web server 120 sends a packet for responding to an inquiry from the monitoring device 210 to the monitoring device 210, the source address of the packet received from the monitoring device 210, that is, the virtual address “192.168.x. Set 200 to the destination address. Further, the real address “192.168.x.100” of the web server 120 is set as the source address.

  In order for the web server 120 to know the transmission destination of this packet, an ARP table for the virtual address of the monitoring device 210 is defined in the network interface on the web server 120 side of the firewall 114, and the web server 120 automatically transmits the ARP packet. The firewall 114 is set to respond when broadcasting to the segment network. Therefore, the packet sent from the web server 120 to the monitoring device 210 is received by the firewall 114.

  Since the firewall 114 holds the correspondence between the real address of the monitoring device 210 and the virtual address, the destination address of the packet is changed from the virtual address “192.168.x.200” of the monitoring device 210 to the real address “10.10.x”. .10 ". Further, since the firewall 114 holds the correspondence between the real address of the web server 120 and the virtual address, the source address of the packet is changed from the real address “192.168.x.100” of the web server 120 to the virtual address “10.10. x.100 ". This packet is sent from the router 104 to the dedicated line 20 and reaches the monitoring device 210 via the router 202.

  As described above, when a packet is transmitted from the monitoring device 210 to the web server 120, the response packet communication is performed by converting the real address of the monitoring device 210 into a virtual address in any device on the communication path. A route can be secured appropriately. Further, since communication can be performed in the same manner as when the partner apparatus is on its own segment, communication can be performed without changing communication settings and the like.

  The monitoring device 210 determines the state of the web server 120 based on the received response information. For example, when a Trap message is received or when an error message for an HTTP GET message is received, it is determined that a change has occurred in the web server 120 and reported to the service provider. In addition, the resource operation rate of the server device and the operation rate of the CPU are graphed and reported to the service provider. The monitoring system 50 can also handle troubles and change settings.

  As described above, the firewall 114 appropriately changes the source address and the destination address of the packet transmitted / received between the monitoring device 210 and the web server 120, thereby almost changing the segment including the web server 120. The monitoring system 50 can be introduced without adding. Thereby, the introduction cost and man-hour of the monitoring system 50 can be reduced. Further, even when a segment including the web server 120 uses a private address, or when a global address and a private address are mixed, packets can be appropriately transmitted and received.

  In the monitoring system 50 of this embodiment, since the monitoring business is centrally performed in the monitoring center 200, it is not necessary for a network engineer to reside in each data center 100. By concentrating network engineers at the monitoring center 200, it is possible to accumulate knowledge about security holes in server software and know-how to deal with problems. Thereby, it is possible to stably provide a high-level monitoring service without depending on the technical level of each network engineer.

  In the monitoring system 50 according to the present embodiment, since the private dedicated line 20 having no openness is used as the monitoring communication network, higher security than that of the monitoring system via the Internet 10 can be ensured. However, it is not essential that the openness is zero, and it may be designed in light of the monitoring purpose and the communication method.

  When the firewall 114 is provided for each segment, the address of the translation destination can be set according to the address system of each segment, so even if the address system is duplicated between the segments, there is a problem. Address conversion can be performed without occurrence, and packets can be transmitted and received appropriately.

  The firewall 114 implements address translation in both directions of a packet sent from the segment including the web server 120 to the dedicated line 20 and a packet sent from the dedicated line 20 to the segment including the web server 120. It is desirable to have a function that can flexibly define the concepts inside and outside the segment. By realizing bi-directional address translation with one address translation device, setting work at the time of introduction and maintenance work at the time of operation can be facilitated as compared with the case where two address translation devices are provided.

  The present invention has been described based on the embodiments. This embodiment is an exemplification, and it will be understood by those skilled in the art that various modifications can be made to combinations of the respective constituent elements and processing processes, and such modifications are also within the scope of the present invention. is there.

  In this embodiment, the service providing apparatus is provided in the data center 100. However, any service providing apparatus in any environment can be monitored by this monitoring system.

1 is a diagram schematically showing an overall configuration of a monitoring system according to an embodiment. It is a figure which shows the structure of the network in a data center. It is a figure which shows the structure of the network in a monitoring center. It is a figure for demonstrating operation | movement of a monitoring system.

Explanation of symbols

  5 User terminal, 10 Internet, 20 Dedicated line, 30 Address conversion table, 50 Monitoring system, 100 Data center, 102, 104 router, 112, 114, 152, 154 Firewall, 140 Service providing device, 200 Monitoring center, 202 router 210 Monitoring device.

Claims (5)

A monitoring system for monitoring a service providing apparatus that provides a service via a public communication network having openness,
A monitoring device that communicates with the service providing device and monitors a state of the service providing device;
A monitoring communication network, which is provided separately from the public communication network, for transmitting and receiving information between the monitoring device and the service providing device;
When transmitting the first information from the service providing apparatus to the monitoring apparatus via the monitoring communication network, the transmission address and the transmission source address of the first information are converted, and the monitoring apparatus An address conversion device that converts a transmission destination address and a transmission source address of the second information when transmitting the second information to the service providing device via the monitoring communication network;
A monitoring system characterized by comprising:   The address translation device is virtually assigned to the monitoring device in the network address system including the monitoring device and the real address of the monitoring device assigned to the monitoring device in the network address system including the monitoring device. A virtual address of the monitoring device assigned to the service providing device, and a real address of the service providing device assigned to the service providing device in an address system of a network including the service providing device, and the monitoring device. The monitoring system according to claim 1, further comprising: an address conversion table that stores a virtual address of the service providing apparatus that is virtually allocated to the service providing apparatus in a network address system. When the service providing device transmits the first information to the monitoring device, the real address of the service providing device is set as a transmission source address, and the virtual address of the monitoring device is set as a transmission destination address.
When transmitting the second information to the service providing apparatus, the monitoring apparatus sets a real address of the monitoring apparatus as a transmission source address and a virtual address of the service providing apparatus as a transmission destination address. The monitoring system according to claim 2. The address conversion device refers to the address conversion table,
Converting the transmission destination address of the first information from the virtual address of the monitoring device to the real address of the monitoring device;
A source address of the first information is converted from a real address of the service providing device to a virtual address of the service providing device;
Converting the destination address of the second information from the virtual address of the service providing device to the real address of the service providing device;
The monitoring system according to claim 3, wherein the transmission source address of the second information is converted from a real address of the monitoring device to a virtual address of the monitoring device.   5. The monitoring according to claim 1, wherein the address translation device is a firewall device that controls whether or not information can be transmitted and received between the service providing device and the monitoring communication network. system.

Images