JP2005309789A - Network management method and device, and storage medium recording program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To dispense with analysis of an SNMP trap and new mounting of conversion processing function to alarm information in responding to a new SNMP trap or in changing a trap specification. <P>SOLUTION: A management server 200 comprises a means 210 receiving an SNMP trap autonomously reported by a network device 300 and acquiring a generic number, a specific number and an additive information list therefrom; a means 220 converting the acquired generic number and specific number to an alarm name by referring to an alarm dictionary file 250, and converting each element of the additive information list to a failure content by referring to an alarm conversion scenario file 260 or an enumerated type information definition file 270; a means 230 accumulating the conversion result as alarm information in a database 280; and a means 240 receiving an alarm list acquisition request from an operator terminal 100 and returning the alarm information in the database 280 as an alarm list. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a network management system, and more particularly to a network management method and apparatus capable of converting an SNMP trap autonomously notified from a network apparatus into alarm information and notifying an operator terminal, and a recording medium recording the program. is there.

  The network management system includes an operator terminal, a management server, a network device, and the like connected by a communication network. Conventionally, in a network management system having such a configuration, the management server detects a failure of the network device by using an SNMP trap notified from the network device, accumulates the received SNMP trap as failure information, and notifies the operator terminal. The terminal displayed the received failure information (for example, see Non-Patent Document 1).

Two people from Naoto Inawa, “Examination of Java / CORBA-based network monitoring service implementation method” IEICE Technical Report, IEICE Technical Report, Vol. 98, No. 216, issued July 24, 1998, p15-22

The conventional network management system has the following problems.
The first problem is that when dealing with a new SNMP trap, it is necessary to newly implement a process of analyzing the SNMP trap and converting it into alarm information. The reason is that the information notified by the SNMP trap varies depending on the type of device or trap, and processing depending on the type of device or trap is required.

  The second problem is that when the alarm information displayed on the operator terminal is changed or the trap specification is changed for the existing SNMP trap, it is necessary to change the implementation of the program for performing the SNMP trap conversion process. That is. The reason is that since processing depending on the type of device and trap exists in the program, when changing the contents to be displayed on the operator terminal, it is necessary to change the SNMP trap conversion processing.

An object of the present invention is to eliminate the need for new implementation of SNMP trap analysis and conversion to alarm information when dealing with a new SNMP trap or when the trap specification is changed.
Another object of the present invention is that it is not necessary to change the implementation of the program for performing the SNMP trap conversion process when the alarm information displayed on the operator terminal is changed or the trap specification is changed for the existing SNMP trap. It is to be.

  The network management device of the present invention includes a means for receiving an SNMP trap that the network device autonomously notifies, a means for obtaining a generic number, a specific number, and an additional information list from the received SNMP trap, and the obtained generic number and specific. By referring to the alarm dictionary file from the number, the alarm name is converted to the alarm name by referring to the alarm conversion scenario file from each element of the additional information list. In some cases, there is provided means for referring to the enumeration type information definition file to convert to alarm contents and storing the conversion result in the apparatus as alarm information.

  The network management device of the present invention includes a means for receiving an alarm list acquisition request from an operator terminal, a means for acquiring accumulated alarm information based on the alarm list acquisition request, and the acquired alarm information as an alarm list. Means for responding to the operator terminal.

  As described above, in the present invention, in the process of converting an SNMP trap as alarm information, an alarm dictionary file, an alarm conversion scenario file, and an enumerated information definition file that define information depending on the trap specification are prepared, and based on these files And SNMP trap analysis processing.

  According to the present invention, when dealing with a new SNMP trap, there is no need to newly implement a process of analyzing the SNMP trap and converting it into alarm information. This is because in implementing the conversion process depending on the trap specification, information that depends on the trap specification is managed by the alarm conversion definition file, and only the common process for analyzing the trap specification based on the alarm conversion definition file is implemented. is there.

  In addition, according to the present invention, it is necessary to change the implementation of the program for performing the SNMP trap conversion process when the alarm information displayed on the operator terminal is changed or the trap specification is changed for the existing SNMP trap. There is no. This is because when implementing the conversion process depending on the trap specification, information that depends on the trap specification is managed in the alarm conversion definition file, and only the common process for analyzing the trap specification based on the alarm conversion definition file is implemented. This is because it is only necessary to change the alarm conversion definition file when changing the trap specification.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 1 shows an embodiment of the present invention. The network management system includes an operator terminal 100, a management server 200 that is a network management device, and a network device 300. In general, there are a plurality of network devices 300.

  The management server 200 receives an SNMP trap autonomously notified by the network device 300 and acquires a generic number, a specific number, and an additional information list, and an acquired generic number, a specific number, and an additional information list. Alarm dictionary file 250, alarm conversion scenario file 260, enumerated information definition file 270 to alarm interpreter unit 220 for converting alarm information for operator screen display, and writing and reading of alarm information to database 280 A database processing unit 230 to process, an alarm list acquisition request from the operator terminal 100, an alarm information list from the database 280 through the database processing unit 230, and an operator request reception unit 240 responding to the operator terminal; Dictionary Yl 250, alarm converted scenario file 260, a definition file enum definition file 270, and includes a like database 280 for storing alarm information (failure information). The configurations of the alarm dictionary file 250, the alarm conversion scenario file 260, and the enumeration type definition file 270 will be described later.

FIG. 2 is a processing sequence diagram of the network management system, and the overall operation of this embodiment will be described with reference to FIG.
The network device 300 autonomously reports the transition of the abnormal state of the device to the management server 200 using an SNMP trap (step 1). This SNMP trap includes a generic number, a specific number, and an additional information list. In the management server 200, the SNMP trap receiving unit 210 receives the SNMP trap from the network device 300, acquires a generic number, a specific number, and an additional information list, and sends them to the alarm interpreter unit 200 (step 2). The alarm interpreter unit 220 that has received the generic number, specific number, and additional information list from the SNMP trap receiving unit 210 first searches the alarm dictionary file 250 using the combination of the generic number and specific number as a key to derive the alarm name ( Step 3). Next, the alarm interpreter unit 220 searches the alarm conversion scenario file 260 using the combination of the generic number and the specific number as a key, and converts each element of the additional information list into alarm contents based on the corresponding conversion scenario ( Step 4). In addition, when the element of the additional information list is enumerated type information of the tag identifier, the enumerated type information definition file 270 is referred to and converted into alarm contents. Then, the alarm interpreter unit 220 makes an alarm information storage request to the database processing unit 230 using the alarm name and alarm content as alarm information (step 5). The database processing unit 230 stores the alarm information in the database 280 based on the request from the alarm interpreter unit 230 (step 6).

  On the other hand, the operator terminal 100 makes an alarm list acquisition request to the management server 110 (step 7). In the management server 200, the operator request receiving unit 240 receives the alarm list acquisition request from the operator terminal 100, and transfers the request to the database processing unit 230 (step 8). The database processing unit 230 acquires a list of alarm information from the database 280 based on the request from the operator request receiving unit 240 (step 9), and transfers it to the operator request receiving unit 240 (step 10). The operator request reception unit 240 responds to the operator terminal 100 with the alarm information list transferred from the database processing unit 230 (step 11). The operator terminal 100 displays a warning information list based on the received response (step 12).

  Next, the alarm dictionary file 250, the alarm conversion scenario file 260, and the enumeration type information definition file 270 will be described.

  FIG. 3 is a conceptual diagram of the alarm dictionary file 250, which shows that the alarm dictionary file 250 includes items of a generic number, a specific number, an alarm importance, and an alarm name. At the same time, the notation format of each item is also shown. FIG. 4 shows specific contents of the alarm dictionary file 250. For example, the entry of number 1 represents generic number = 0, specific number = 0, alarm importance = Clear (recovery), and alarm name = interface failure detection. The same applies to the numbers 2 to 21. An SNMP trap having a combination of a generic number and a specific number that does not exist in this table is assumed to be Nomal / event occurrence.

  FIG. 5 is a conceptual diagram of the alarm conversion scenario file 260, which shows that the alarm conversion scenario file 260 includes a generic number, a specific number, and a conversion scenario (how to describe an additional information list). A plurality of conversion scenarios can be specified corresponding to the additional information list. Here, it is assumed that an SNMP trap having a combination of a generic number and a specific number that does not exist in this table does not perform scenario conversion. FIG. 6 shows specific contents of the alarm conversion scenario file 260. For example, in the case of an SNMP trap with generic number = 2 and specific number = 0, the entry of number 2 first describes the interface identifier (character string) in the additional information list, and then the first in the list The element number is described, followed by a space of one character, and finally the generation source and detection trigger (character string) are described. The same applies to the other entries.

  FIG. 7 is a conceptual diagram of the enumeration type information definition file 270, which defines a description method in the case of element enumeration type information in the additional information list. FIG. 8 shows specific contents of the enumeration type information definition file 270. FIG. 8 shows an enumeration type information definition file having a file name “Trep — 0003.enum” as an example.

  Next, a specific example of processing will be shown. For example, when the SNMP trap has generic number = 2 and specific number = 0, the alarm name “interface failure detection” is derived from the alarm dictionary file 250 of FIG. 4 (entry number 2). Further, from the alarm conversion scenario file 260 of FIG. 6 (also entry number 2), the additional information list of the trap is “F <interface identifier:> D <1> X <1> F (source: package 2 port 1). , Detection trigger: trap)> ”.

  Further, for example, when the SNMP trap has a generic number = 6 and a specific number = 100, “alarm number threshold excess detection” is derived as the alarm name from the alarm dictionary file 250 of FIG. 4 (entry number 13). From the alarm conversion scenario file 260 of FIG. 6 (also entry number 13), the additional information list of the trap is “F <SType:> D <1> X <1> F <Cugld:> D <2> X. <1> F <Base IP address:> D <3> F <Level:> E <Trap_0002.enum, 4> X <1> F <Action:> E <Trap_0003.enum, 5> X <1> F < The number of routes:> D <6> X <1> F <(source: device, detection trigger: trap)> ”is converted. In this example, “E <Trap_0002.enum, 4” and “E <Trap_0003.enum, 5” are converted with reference to the enumeration type information definition file.

  In this embodiment, when performing conversion processing depending on the trap specification, information that depends on the trap specification is defined in a definition file such as an alarm dictionary file or an alarm conversion scenario file, and the trap specification is analyzed based on the definition file. Since only the common process is implemented, the process for converting the SNMP trap into the alarm information is not newly implemented, and the new SNMP trap can be handled. Furthermore, when the specification of an existing trap is changed, the trap specification can be changed without changing the implementation of the program.

  Note that the present invention can be realized by configuring some or all of the processing functions of each unit in the management server (network management apparatus) shown in FIG. 1 by a computer program and executing the program using the computer. Alternatively, it is needless to say that the processing procedure shown in FIG. 2 can be constituted by a computer program and the program can be executed by the computer. In addition, a computer-readable recording medium such as an FD, MO, ROM, memory card, CD, or the like is stored in the computer. In addition, the program can be recorded and stored on a DVD, a removable disk, etc., and the program can be distributed through a network such as the Internet.

It is a system configuration figure showing an example of an embodiment of the present invention. It is a processing sequence diagram which shows the whole operation | movement of this invention. It is a figure which shows the structure of an alarm dictionary file. It is a figure which shows the specific content of an alarm dictionary file. It is a figure which shows the structure of an alarm conversion scenario file. It is a figure which shows the specific content of an alarm conversion scenario file. It is a figure which shows the structure of an enumeration type information definition file. It is a figure which shows the specific content of an enumeration type information definition file.

Explanation of symbols

100 operator terminal 200 management server (network management device)
210 SNMP Trap Receiving Unit 220 Alarm Interpreter Unit 230 Database Processing Unit 240 Operator Request Accepting Unit 250 Alarm Dictionary File 260 Alarm Conversion Scenario File 270 Enumerated Information Definition File 280 Database 300 Network Device

Claims (7)

In a method of managing a network device by connecting an operator terminal, a management server, and a network device to a communication network,
The management server receives a Simple Network Management Protocol (SNMP) trap that is autonomously notified from the network device, acquires a generic number, a specific number, and an additional information list from the received SNMP trap, and alerts from the generic number and the specific number By referring to the dictionary file, it is converted into an alarm name, and by referring to the alarm conversion scenario file from each element of the additional information list, it is converted into alarm contents, and the conversion result is stored as alarm information in the management server. And a network management method.   2. The network management method according to claim 1, wherein when the element of the additional information list is enumerated type information, the management server refers to the enumerated type information definition file and converts it into alarm contents. . The network management method according to claim 1 or 2,
The management server receives an alarm list acquisition request from the operator terminal, acquires the accumulated alarm information, and responds to the operator terminal as the alarm list with the acquired alarm information,
The operator terminal displays the response from the management server.
And a network management method. Means for receiving SNMP trap autonomously notified by network device, means for obtaining generic number, specific number and additional information list from received SNMP trap, and referring to alarm dictionary file from the obtained generic number and specific number Means for converting to an alarm name, means for converting to fault contents by referring to the alarm conversion scenario file from each element of the additional information list, means for storing the conversion result in the database as alarm information,
A network management device comprising:   5. The network management device according to claim 4, further comprising means for referring to an enumeration type information definition file and converting it to alarm contents when the element of the additional information list is enumeration type information. . The network management device according to claim 4 or 5,
Means for receiving an alarm list acquisition request from an operator terminal; means for acquiring alarm information stored in a database based on the alarm list acquisition request; and means for responding the acquired alarm information to the operator terminal as an alarm list A network management device.   A recording medium on which a program for causing a computer to execute the network management method according to any one of claims 1 to 3 is described.

Images