JP2006186633A - System, method, and program for fault path diagnosis - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To surely specify faulty equipment by eliminating an omission of fault detection. <P>SOLUTION: A system comprises a fault information database 16 in which a traffic path pattern between a monitor agent 110 and equipment 120 to be monitored and a fault pattern assumed to be on the traffic path are stored while made to correspond to each other, a network monitor section 12 which collates a traffic confirmation result gathered from the monitor agent 110 against traffic path patterns in the fault information database 16, a network monitor section 12 which generates a traffic monitor information table 17 wherein traffic confirmation results and traffic path patterns are made to correspond to each other, and a fault decision section 13 which collates the traffic monitor information table 17 with the fault information database 16 to detect a fault pattern which matches a traffic confirmation result with the same traffic path pattern and designates fault equipment corresponding to the fault pattern as fault-occurring equipment. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a failure path diagnosis system, a failure path diagnosis method, and a failure path diagnosis program, and more particularly to a method for automatically diagnosing a failure path detected on a monitoring network by automatic monitoring.

  In the network automatic monitoring method, one monitoring manager is provided for a plurality of devices to be monitored, a monitoring agent that transmits and receives information to and from the monitoring manager is provided, and the monitoring agent polls the monitoring agent at a certain period. A method of determining the existence by the communication of the polling is common. Here, the monitoring agent is also a monitoring target device and a server that monitors communication with a device that does not have information collection means such as a router and a switch. When polling times out, that is, when a failure occurs, it is necessary to quickly identify the location of the failure. Conventionally, the system administrator or management operator has displayed alarm information on the results of network monitoring displayed on the monitoring screen. After the failure was detected, failure information was collected and the failure location was diagnosed according to the maintenance manual.

As a method for automating the diagnosis of the fault location, for example, in a network monitoring apparatus that monitors a network constituted by a plurality of network devices, means for hierarchically managing each device constituting the network in a physical connection relationship And, based on the hierarchy information, there is a means to discriminate between actual faults and pseudo faults when a certain device fails (failures where lower devices are considered as faults because the host device is faulty) A network monitoring system (see Patent Document 1) characterized by the above has been proposed.
JP 2001-86117 A

  In the prior art, one-to-all route monitoring in which communication confirmation is performed from one monitoring manager to all monitoring agents is premised, and only the route monitoring between the monitoring manager and the monitoring agent is targeted. The routes between each other are not monitored. For this reason, there is a problem that it is difficult to detect when a failure occurs in this route.

  The prior art assumes a failure in which the device is completely down, and assumes that the route monitoring information at the time of the failure is consistent. However, in reality, there is a failure that is inconsistent with the route monitoring information for narrowing down the faulty device, such as a mismatch failure that temporarily disables communication because the device is not down and unstable. Many have occurred, and the conventional technique has a problem that it is difficult to detect them.

  Therefore, the present invention has been made in view of the above problems, and provides a failure path diagnosis system, a failure path diagnosis method, and a failure path diagnosis program that enable the reliable identification of a faulty device without omission of fault detection. The main purpose is to do.

  A failure path diagnosis system of the present invention that solves the above problems is a system that monitors a network composed of a plurality of network devices, and includes a communication route pattern between a monitoring agent and a monitoring target device, and the communication route. The failure information database storing the failure patterns associated with the failure patterns that are expected to occur and the communication confirmation results collected from the monitoring agent with the communication route patterns in the failure information database, and the communication confirmation results and the communication route patterns A path monitoring information table that associates the path monitoring information table with the fault information database, and detects a failure pattern that matches the communication confirmation result in the same communication path pattern; A faulty device corresponding to the fault pattern is referred to as a faulty device. Identifying Te, characterized in that it comprises a fault determining unit, the (first invention).

  According to a second invention, in the first invention, when the failure determination unit cannot detect a failure pattern that matches the communication confirmation result in the same communication route pattern, the degree of coincidence between the failure information database and the route monitoring information table , And a failure pattern in which the degree of coincidence exceeds a predetermined value is detected, and a faulty device corresponding to the fault pattern is identified as a faulty device candidate.

  According to a third invention, in the first or second invention, the network monitoring unit instructs the monitoring agent to execute communication confirmation with the monitoring target device.

According to a fourth invention, in any one of the first to third inventions, a communication confirmation execution unit that performs communication confirmation toward the monitoring target device, a route monitoring information collection unit that performs communication result collection processing,
It is characterized by comprising.

  According to a fifth invention, in any one of the first to fourth inventions, the monitoring agent performs a communication confirmation execution unit for performing communication confirmation toward the monitoring target device, and path monitoring information for performing a communication result collecting process. And a collection unit.

  In a sixth aspect of the present invention, monitoring of a network composed of a plurality of network devices is performed by associating a communication route pattern between a monitoring agent and a monitoring target device with a failure pattern assumed to occur in the communication route. This method is performed by a computer having a stored failure information database. The communication confirmation result collected from the monitoring agent is collated with the communication route pattern in the failure information database, and the communication confirmation result is associated with the communication route pattern. A route monitoring information table is generated, the route monitoring information table is collated with the failure information database, a failure pattern that matches a communication confirmation result is detected in the same communication route pattern, and a faulty device corresponding to the fault pattern is detected. It is characterized as being identified as a faulty device.

  A seventh invention relates to a monitoring method for a network composed of a plurality of network devices by associating a communication route pattern between a monitoring agent and a device to be monitored with a failure pattern assumed to occur in the communication route. The communication confirmation result collected from the monitoring agent is compared with the communication route pattern in the failure information database, and the communication confirmation result corresponds to the communication route pattern. Generating a route monitoring information table, and comparing the route monitoring information table with the failure information database to detect a failure pattern that matches a communication confirmation result in the same communication route pattern and corresponding to the failure pattern Steps to identify the faulty device as the faulty device Characterized in that it comprises a flop, a.

  In addition, the problems disclosed by the present application and the solutions thereof will be clarified by the embodiments of the present invention and the drawings.

  According to the present invention, it is possible to reliably identify a faulty device without omission of fault detection.

--- System configuration ---
Embodiments of the present invention will be described below in detail with reference to the drawings.
FIG. 1 is a network configuration diagram including a failure path diagnosis system in the present embodiment. In the present embodiment, a server device having a function as the failure path diagnosis system 100 is referred to as a monitoring manager. Further, the monitoring target device 120 may include a monitoring agent 110 and switches and routers connecting the monitoring agent 110. In the example of FIG. 1, each device is connected through three switches Sa, Sb, Sc (106 to 108) and one router Ra (109).

  The fault path diagnosis system 100 (hereinafter, system 100) of the present invention reads a program 32 stored in a program database 31 such as a rewritable memory to the memory 33 so as to realize a function for executing the fault path diagnosis method of the present invention. It is executed by the CPU 34 which is an arithmetic unit.

  Further, the system 100 includes an input / output interface 35 such as various keyboards and buttons generally provided in a computer device, and a communication means 36 for transferring data to and from the monitoring agent 110 and the monitoring target device 120. ing.

  The system 100 is connected to the monitoring agent 110 and the monitoring target device 120 and the like via the network 130 such as the Internet, a LAN, and a serial interface communication line by the communication unit 36 and receives communication result information. Send communication confirmation instructions. Between the various function units of the system 100 and the communication means 36, the I / O unit 37 executes data buffering and various mediation processes.

  Next, functional units that are configured and held by the system 100 based on the program 102 will be described. The system 100 includes a failure information database 16 in which a communication route pattern between the monitoring agent 120 and the monitoring target device 130 and a failure pattern expected to occur in the communication route are stored in association with each other. To do. The communication path pattern is preferably all the communication path patterns between the monitoring agent 120 and the monitoring target device 130.

  The system 100 collates the communication confirmation result collected from the monitoring agent with the communication route pattern in the failure information database 16 and generates a route monitoring information table 17 that associates the communication confirmation result with the communication route pattern. The unit 12 is provided.

  It is preferable that the network monitoring unit 12 instructs the monitoring agent 110 to execute communication confirmation with the monitoring target device 120.

  Further, the system 100 compares the route monitoring information table 17 with the failure information database 16 to detect a failure pattern that matches the communication confirmation result in the same communication route pattern, and selects a failure device corresponding to the failure pattern. A failure determination unit 13 is provided that is identified as a failure occurrence device.

  The failure determination unit 13 calculates the degree of coincidence between the failure information database 16 and the route monitoring information table 17 when a failure pattern that matches the communication confirmation result cannot be detected in the same communication route pattern. It is preferable to detect a failure pattern having a value equal to or greater than a predetermined value and specify a faulty device corresponding to the fault pattern as a faulty device candidate.

  In addition, the system 100 can include a communication confirmation execution unit 14 that performs communication confirmation toward the monitoring target device 120 and a route monitoring information collection unit 15 that performs processing for collecting communication results.

  In addition, the system 100 can include an initial setting unit 11 that constructs information necessary when starting network monitoring. The initial setting unit 11 sets initial information necessary for processing for identifying a faulty device and creating the route monitoring information table 17 during network monitoring before starting network monitoring.

  For each device on the network system (including not only the monitoring target device but also a switch, a router, or the like between them), the initial setting unit 11 includes each monitoring agent 110 and the communication target monitoring target device 120 at the time of failure. A failure pattern that summarizes the results of communication confirmation assumed between the devices is created, each assumed failure device is associated with a failure pattern, and a failure information database 16 as shown in FIGS. As a holding process. In addition, initial information of the route monitoring information table 17 that is a total communication route pattern is created.

  In the present embodiment, it is assumed that a failure pattern is created for a single device failure, but a failure pattern for a plurality of device failures may be created. In addition, as the failure pattern format, various formats such as a text format and a table format may be used. In this example, a table format is assumed.

  In addition, the monitoring agent 110 includes a communication confirmation execution unit 21 that performs communication confirmation toward the monitoring target device 120 and a route monitoring information collection unit 22 that performs communication result collection processing. The server B, the server C, the server D, and the server E (102 to 105), which are the monitoring agents 110 in FIG. 1, perform communication confirmation using polling or the like toward the monitoring target device 120 of the communication partner. 21 and a route monitoring information collecting unit 22 for collecting communication results. Although only the functional configuration of the server B (102) is shown in FIG. 1, it is assumed that the server C (103), the server D (104), and the server E (105) have the same configuration.

  In addition, the monitoring manager as the system 100 can include a communication confirmation execution unit and a route monitoring information collection unit similarly to the monitoring agent 110. In the example of FIG. The unit 15 is provided.

  Note that each of the functional units 11 to 15 in the system 100 described so far may be realized as hardware, or may be realized as a program stored in an appropriate storage device such as a memory or an HDD (Hard Disk Drive). Good. In this case, the CPU 34 reads the corresponding program from the storage device to the memory 33 in accordance with the program execution, and executes it.

  The network 130 is not limited to the Internet, LAN, ATM line, dedicated line, WAN (Wide Area Network), power line network, wireless network, public line network, mobile phone network, serial interface communication line, etc. A network can also be adopted. If a virtual private network technology such as VPN (Virtual Private Network) is used, communication with improved security is established when the Internet is adopted. The serial interface is a serial transmission that sends data one bit at a time using a single signal line, and refers to an interface for connecting to external devices. Communication methods include RS-232C, RS-422, IrDA, USB, IEEE1394, fiber channel, etc. can be assumed.

--- Collecting and editing route monitoring information ---
Hereinafter, the actual procedure of the failure path diagnosis method will be described with reference to the drawings. Various operations corresponding to the failure path diagnosis method described below are realized by a program 32 that the system 100 reads into the memory 33 and executes. And this program 32 is comprised from the code | cord | chord for performing the various operation | movement demonstrated below.

  Hereinafter, a procedure for collecting and editing route monitoring information will be described. FIG. 2 is a flowchart showing the procedure of the route monitoring information collection / editing process in this embodiment. First, when the network monitoring unit 12 in the monitoring manager which is the system 100 is activated, the monitoring manager sends a route monitoring information collection signal to each monitoring agent 110 (step 1210). The network monitoring unit 12 may be activated at a predetermined cycle as in the conventional network monitoring method, or may be activated by a user or system administrator by executing a command.

  When the server B (102), the server C (103), the server D (104), and the server E (105), which are the monitoring agents 110, receive the signal, the communication check execution unit 21 functions to monitor the communication partner. Communication confirmation using polling or the like is performed toward the device 120 (step 1220). Here, the processing in the server B (102) will be described, but the processing in the server C (103), the server D (104), and the server E (105) is the same.

  The route monitoring information collection unit 22 in the monitoring agent 110 collects the result of the communication confirmation (step 1230). The processing in step 1220 and step 1230 is repeated until it is executed for all the monitoring target devices 120 of the communication partner. As a result, the communication confirmation result of all communication paths is obtained.

  The communication confirmation result used in the present embodiment can be a communication confirmation when the monitoring target device 120 returns a response to the response to the monitoring target device 120 of the communication partner using polling or the like. It is assumed that communication cannot be confirmed when no response is returned and no response is received or a timeout occurs. In this embodiment, the communication result is symbolized as “0” when the communication is confirmed, and the communication result when the communication is not confirmed as “1”.

  After confirming the completion of collection of the route monitoring information of the server B (102) (step 1240), the monitoring manager server A communicates with the server B (102), and similarly, the server C (103) and the server D (104). The communication result of the server E (105) is collected (step 1250).

  The server A collects the collected communication results and creates the route monitoring information table 17 (step 1260). The route monitoring information table 17 may use not only a table format but also various formats such as a text format. In this embodiment, the route monitoring information table 17 has a table format as shown in FIGS. Through the above processing, the current route monitoring information on the network system can be collected.

--- Processing to determine failure from route monitoring information ---
FIG. 3 is a flowchart showing a processing procedure for determining a failure from the route monitoring information in the present embodiment. Next, a processing procedure for determining a failure from the route monitoring information will be described. After the process in the network monitoring unit 12 of the monitoring manager server A is completed, the failure determination unit 13 is activated.

  The failure determination unit 13 determines the presence / absence of a failure from the route monitoring information collected from each monitoring agent 110, and narrows down failure devices when a failure occurs. First, it is determined from the communication result of the route monitoring information table 17 whether or not a failure has occurred (step 1310). If there is no “1” in the route monitoring information table 17 as a result of the failure to confirm communication (step 1310: NO), it is determined that the system is operating normally (step 1311), and the failure determination unit 13 This process ends.

  On the other hand, if “1” is present in the route monitoring information table 17, it is determined that a failure has occurred in the device on the network system (step 1310: YES), and the processing proceeds next. In this case, the failure determination unit 13 checks the route monitoring information table 17 every time whether there is a match between the failure pattern in the failure information database 16 and the communication result (step 1320).

  In this process, if the failure pattern matches the communication result (step 1330: YES), it is highly likely that a failure has occurred in the assumed failure device associated with the matched failure pattern. A determination is made (step 1331), and the determination result is notified to the system administrator (step 1360). As a notification method, a determination result is displayed on the display screen of the system 100 or a predetermined terminal, or an e-mail is transmitted to the predetermined terminal. On the other hand, if it is determined in the determination that the failure pattern does not match the communication result (step 1330: NO), the process proceeds next.

  In this case, the failure determination unit 13 calculates the degree of coincidence of communication results between the route monitoring information table 17 and each failure pattern in the failure information database 16 (step 1340). This degree of coincidence is calculated for each failure pattern in the failure information database 16. Here, a threshold value is provided for the degree of coincidence. If there is a degree of coincidence obtained for each failure pattern in the failure information database 16 that exceeds the threshold (step 1350: YES), the failure determination unit 13 determines that the device is likely to have a failure. (Step 1352), the determination result is notified to the system administrator (Step 1360).

  On the other hand, if all of the determinations are equal to or less than the threshold (step 1350: NO), it is determined that no trouble has occurred (step 1351), and the process is terminated without notifying the system administrator. .

--- Specific examples of failure determination processing ---
Subsequently, the above-described failure determination process will be specifically described using a failure pattern example.
FIG. 4 is a diagram showing a setting content example 1 of the route monitoring information table 17 in the present embodiment, and is a configuration example of the route monitoring information table 17 when the switch Sb (107) becomes a failure. In this route monitoring information table 17, the horizontal axis indicates each monitoring agent (including server A (101) in this failure example), and the vertical axis indicates the communication target monitoring target device with which the monitoring agent has confirmed communication. Show.

  For example, in the case of the server B (102), the monitoring target devices with which the monitoring agent B communicates are four servers, a server A (101), a server C, a server D, and a server E (103 to 105). Assume that communication with the monitoring target device of the other party has been confirmed.

  When a failure occurs in the switch Sb (107), (1) from the server B (102) to the monitoring agent C (103) and (2) from the server C (103) to the server B (via the switch Sb (107) 102) Cannot confirm communication. In addition, since communication does not pass through Sb (107) on other routes, communication can be confirmed. As described above, in this failure example, it is assumed that the response flag “0” is set for the communication partner whose communication has been confirmed, and the no-response flag “1” is set for the communication partner whose communication has not been confirmed.

  5 and 6 are diagrams showing a failure pattern setting content example 1 in the present embodiment. FIG. 5 shows a failure pattern of the switch Sb (107), and FIG. 6 shows a failure pattern of the switch Sc (108). Using the failure information database 16 shown in FIGS. 5 and 6 and the route monitoring information table 17 shown in FIG. 4, when the mutual communication results are compared, the Sb failure pattern and the route monitoring information shown in FIG. It can be seen that the communication confirmation result in the table 17 matches. Therefore, the failure determination unit 13 determines that a failure has occurred in the switch Sb (107).

  FIG. 7 is a diagram showing a setting example 2 of the route monitoring information table in the present embodiment, and is a configuration example of the route monitoring information table when a mismatch in the route monitoring information occurs in the switch Sc (108). .

  In the case of such a failure, it is possible to temporarily check the communication via the faulty device because the faulty device does not lead to the device being down, and the route information for narrowing down the faulty device can be consistent. Disappear. In this failure example, the communication is temporarily confirmed only from (1) Server D (104) to Server E (105) and (2) Server E (105) to Server D (104) via switch Sc (108). However, it is assumed that communication cannot be confirmed on a route that passes through another switch Sc (108).

  In the failure information database 16 shown in FIGS. 5 and 6, the portion surrounded by a broken line is the route monitoring information table 17 obtained when the route monitoring information inconsistency failure of the switch Sc (108) and the failure pattern communication result flag This is where the settings match. In this example, a numerical value obtained by dividing the number of matching results (the number of cells surrounded by broken lines in FIGS. 5 and 6) by the number of route monitoring combinations is defined as the degree of matching of the failure pattern. Can do. In this case, the degree of coincidence is 30% corresponding to the failure information database 16 in FIG. 5 and 90% corresponding to the failure information database 16 in FIG.

  Accordingly, it can be seen that the route monitoring information table 17 shown in FIG. 7 has the highest degree of coincidence with the failure pattern of the switch Sc (108), which is the failure pattern of FIG. ) Is likely to be a failure, and the determination result is notified to the system administrator.

According to the present invention, it is possible to monitor a network path including a path between monitoring agents that cannot be directly detected by the monitoring manager. Thereby, it is possible to detect a faulty device in the network with almost no leakage.
Further, even in the case of a complicated failure where the consistency of the path information for narrowing down the failure device cannot be obtained, the failure device can be efficiently estimated and detected by comparing the degree of coincidence with the failure pattern. For this reason, it is possible to take preventive measures before the device actually goes down, and the influence range can be minimized.
Accordingly, it is possible to reliably identify the faulty device without missing the fault detection.

  As mentioned above, although embodiment of this invention was described concretely based on the embodiment, it is not limited to this and can be variously changed in the range which does not deviate from the summary.

It is a network block diagram including the failure path | route diagnostic system in this embodiment. It is a flowchart which shows the procedure of collection / edit processing of the route monitoring information in this embodiment. It is a flowchart which shows the process sequence which performs a failure determination from the route monitoring information in this embodiment. It is a figure which shows the example 1 of a setting content of the path | route monitoring information table in this embodiment. It is a figure which shows the setting content example 1 of the failure pattern in this embodiment. It is a figure which shows the setting content example 2 of the failure pattern in this embodiment. It is a figure which shows the setting content example 2 of the path | route monitoring information table in this embodiment.

Explanation of symbols

11 Monitoring Manager Initial Setting Unit 12 Monitoring Manager Network Monitoring Unit 13 Monitoring Manager Fault Determination Unit 14 Monitoring Manager Communication Confirmation Execution Unit 15 Monitoring Manager Route Monitoring Information Collection Unit 16 Fault Information Database 17 Path Monitoring Information Table 21 Monitoring Agent (Server B) Communication Confirmation Execution Unit 22 Route Monitoring Information Collection Unit 31 of Monitoring Agent (Server B) Program Database 32 Program 33 Memory 34 CPU
35 I / O interface 36 Communication means 37 I / O unit 100 Fault path diagnosis system, system, monitoring manager 102 Monitoring agent (server B)
103 Monitoring agent (Server C)
104 Monitoring agent (Server D)
105 Monitoring agent (Server E)
106 Switch Sa
107 Switch Sb
108 Switch Sc
109 Router Ra
110 monitoring agent 120 monitored device 130 network

Claims (7)

A system for monitoring a network composed of a plurality of network devices,
A failure information database in which a communication route pattern between a monitoring agent and a monitoring target device and a failure pattern expected to occur in the communication route are stored in association with each other;
A network monitoring unit that collates the communication confirmation result collected from the monitoring agent with the communication path pattern in the failure information database and generates a path monitoring information table in which the communication confirmation result and the communication path pattern are associated;
A failure that collates the route monitoring information table with the failure information database, detects a failure pattern that matches a communication confirmation result in the same communication route pattern, and identifies a failed device corresponding to the failure pattern as a failed device A determination unit;
A failure path diagnosis system comprising: In claim 1,
When the failure determination unit cannot detect a failure pattern that matches the communication confirmation result in the same communication route pattern, the failure determination unit calculates a matching degree between the failure information database and the route monitoring information table, and the matching degree is equal to or greater than a predetermined value. A fault path diagnosis system that detects a fault pattern that has become a fault and identifies a faulty device corresponding to the fault pattern as a faulty device candidate. In claim 1 or 2,
The fault path diagnosis system, wherein the network monitoring unit instructs the monitoring agent to execute communication confirmation with a monitoring target device. In any one of Claims 1-3,
A communication confirmation execution unit that performs communication confirmation toward the monitoring target device;
A route monitoring information collection unit for collecting communication results;
A failure path diagnosis system comprising: In any one of Claims 1-4,
A failure path diagnosis system, wherein the monitoring agent includes a communication confirmation execution unit that performs communication confirmation toward the monitoring target device, and a path monitoring information collection unit that performs processing for collecting communication results. Network monitoring consisting of multiple network devices
It is a method performed by a computer having a failure information database in which a communication route pattern between a monitoring agent and a monitoring target device and a failure pattern expected to occur in the communication route are stored in association with each other,
The communication confirmation result collected from the monitoring agent is collated with the communication route pattern in the failure information database, and a route monitoring information table in which the communication confirmation result is associated with the communication route pattern is generated.
Collating the route monitoring information table with the failure information database, detecting a failure pattern that matches a communication confirmation result in the same communication route pattern, and identifying a failure device corresponding to the failure pattern as a failure occurrence device; A failure path diagnosis method characterized by A network monitoring method consisting of multiple network devices
A program to be executed by a computer having a failure information database in which a communication route pattern between a monitoring agent and a monitoring target device and a failure pattern expected to occur in the communication route are stored in association with each other,
Collating the communication confirmation result collected from the monitoring agent with the communication route pattern in the failure information database, and generating a route monitoring information table in which the communication confirmation result is associated with the communication route pattern;
Collating the route monitoring information table with the failure information database, detecting a failure pattern that matches a communication confirmation result in the same communication route pattern, and identifying a faulty device corresponding to the fault pattern as a faulty device; And a failure path diagnosis program.

Images