JP2009151456A - Monitoring system, network monitoring apparatus and service execution environment monitoring method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a monitoring system, a monitoring apparatus and a service execution environment monitoring method that evaluate in the apparatus whether or not monitoring settings are appropriate and prompt an administrator to change them if necessary. <P>SOLUTION: A manager apparatus 100 has a monitoring rule storage part 120 for storing monitoring rules each defined by a plurality of conditions including a main condition and at least one sub condition, an analysis part 110 for determining whether or not the state of a service execution environment 300 matches the main conditions and sub conditions defined in the monitoring rules, a monitoring failure verification part 130 for determining whether or not any sub condition and the main condition of an optional monitoring rule return different results of matching against the state of the service execution environment 300, a monitoring failure display part 150 for requesting an administrator to update a monitoring rule in which any sub condition and the main condition return different matching results, and a monitoring rule update part 160 for storing a revised monitoring rule in the monitoring rule storage part 120. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a monitoring system, a network monitoring apparatus, and a service execution environment monitoring method for monitoring operation conditions of an apparatus that executes an application, and in particular, a monitoring system, a network monitoring apparatus, and a service execution environment that can perform monitoring settings according to an actual environment. It relates to the monitoring method.

  For operational monitoring products, a major issue is how to properly rotate the autonomous loop of monitoring, analysis, and handling.

  Among them, there is no method to verify the correctness of the analysis results, and it is required that the analysis results become appropriate by continuing operation, that is, the monitoring settings are automatically optimized. ing.

  For this purpose, it is necessary for the system itself to evaluate whether or not the monitoring setting is appropriately made and to prompt the administrator to make a change or to automatically correct the monitoring setting.

  However, in order for the system itself to evaluate whether or not the monitoring settings are properly set, the system determines whether a real failure has occurred or whether the monitoring settings are not set properly. It must be distinguishable.

  Regarding the validity check method for the monitoring conditions of the operation monitoring product, a failure has been detected because the monitoring settings are not appropriate even though a failure has actually occurred or no failure has actually occurred The fact was that it was not possible to distinguish between the two. In addition, in order for the administrator to review the monitoring conditions, a large amount of knowledge and experience regarding the execution environment was required.

As a technique related to confirming the validity of the monitoring condition of the operation monitoring product as described above, Patent Document 1 discloses that the second function processing is performed using the control rule at the time of abnormality after the first function processing. A fire alarm device is disclosed that performs and evaluates the validity of the first treatment.
The invention disclosed in Patent Document 1 improves determination accuracy by performing abnormality determination under a plurality of conditions.
Japanese Patent Laid-Open No. 06-318292

  However, Patent Document 1 has no disclosure and suggestion of correcting the processing rule used for the first process when the second function process evaluates that the validity of the first process is low. Not even been done. That is, the invention disclosed in Patent Document 1 cannot automatically optimize the monitoring setting in accordance with the actual environment. Therefore, if the determination result does not match between the first process and the second process in a certain state, the first process result and the second process result do not match even if the determination result is the same after that. Remains.

  The present invention has been made in view of such problems, and a monitoring system, a network monitoring apparatus, and a service execution environment monitoring method that the apparatus itself evaluates whether or not the monitoring setting is appropriately made and prompts the administrator to make a change. The purpose is to provide.

  In order to achieve the above object, the present invention provides, as a first aspect, a system for monitoring a service execution environment to be monitored, an agent device for grasping the state of the service execution environment, and a service execution environment. A manager device for managing the monitoring rules, wherein the agent device obtains status information indicating the status of the service execution environment from the service execution environment, means for transmitting the status information to the manager device, and manager Means for executing a command acquired from the device to change the state of the service execution environment, and the manager device stores the monitoring rule defined by a plurality of conditions of a main condition and at least one sub-condition. Whether the status of the service execution environment indicated by the means and status information meets the main conditions defined in the monitoring rule The means for determining, the means for determining whether the status of the service execution environment matches each of the sub-conditions defined in the monitoring rule, and the status of the service execution environment for the sub-condition in any monitoring rule Stores revised monitoring rules, means for judging whether or not the suitability differs between any of the main conditions, means for requesting the administrator to update monitoring rules that differ in suitability between any of the subconditions and the main conditions It is an object of the present invention to provide a monitoring system comprising means for accumulating in a means and means for issuing a command for solving a failure occurring in a service execution environment to an agent device.

  In order to achieve the above object, as a second aspect, the present invention is a storage means for storing a monitoring rule defined by a plurality of conditions of a main condition and at least one sub-condition, and a monitoring target. Means for determining whether the state of the service execution environment conforms to a main condition defined in any of the monitoring rules stored in the storage means, and any of the states of the service execution environment stored in the storage means Whether or not the means for determining whether or not the sub-conditions defined in each monitoring rule are met and the status of the service execution environment differ between any of the sub-conditions and the main condition in any monitoring rule A monitoring device comprising: means for judging whether or not; means for requesting an administrator to update a monitoring rule whose suitability is different between one of the sub-conditions and the main condition; and means for storing the revised monitoring rule in the storage means It is intended to provide.

  In order to achieve the above object, according to a third aspect of the present invention, the status of the service execution environment to be monitored conforms to the main condition defined in any of the monitoring rules stored in the storage means. Determining whether or not to perform, determining whether or not the status of the service execution environment meets each of the sub-conditions defined in any of the monitoring rules stored in the storage means, and executing the service Manages the process of determining whether the status of an environment differs in suitability between any of the sub-conditions and the main condition in any monitoring rule, and updates of monitoring rules that differ in suitability between any of the sub-conditions and the main condition A service execution environment monitoring method having a process of requesting a user and a process of storing the revised monitoring rule in a storage means.

  According to the present invention, it is possible to provide a monitoring system, a network monitoring device, and a service execution environment monitoring method in which the device itself evaluates whether or not the monitoring setting is appropriately made and prompts the administrator to make a change.

  FIG. 1 shows a configuration of a network monitoring apparatus according to the present invention. The network monitoring apparatus 10 includes a monitoring rule accumulating unit 12 that accumulates monitoring rules defined by a plurality of conditions including a main condition and at least one sub-condition, and the status of a service execution environment to be monitored is a monitoring rule accumulation The analysis unit 11 that determines whether or not the main condition defined in any of the monitoring rules stored in the unit 12 meets each of the sub-conditions and whether or not the service execution environment state is arbitrary. The monitoring failure verification unit 13 that determines whether or not the suitability is different between one of the sub-conditions and the main condition, and updates the monitoring rule that is suitability is different between one of the sub-conditions and the main condition. A monitoring failure display unit 15 to request and a monitoring rule update unit 16 to store the revised monitoring rule in the storage unit.

  The analysis unit 11 receives the status information of the monitoring target and determines whether or not the conditions of the monitoring rules stored in the monitoring rule storage unit 12 are satisfied. The monitoring rule accumulation unit 12 stores and manages monitoring rules for monitoring failures defined by a plurality of conditions. The monitoring failure verification unit 13 receives the failure determination result from the analysis unit 11, and when the determination results of a plurality of conditions do not match, the monitoring failure display unit 15 displays a monitoring failure warning indicating that the monitoring setting is not appropriate. To display. The monitoring rule update unit 16 accepts an input operation from the administrator and changes and updates the monitoring rule stored in the monitoring rule storage unit 12 when a monitoring failure occurs and the monitoring rule needs to be changed. To do.

  Hereinafter, preferred embodiments of the present invention will be described.

  A preferred embodiment of the present invention will be described. FIG. 2 shows the configuration of the network monitoring system according to the present embodiment. This system includes a manager device 100, an agent device 200, and a service execution environment 300. The network monitoring apparatus according to the present invention is applied as a manager apparatus 100 to a network monitoring system.

  The manager device 100 includes an analysis unit 110, a monitoring rule storage unit 120, a monitoring failure verification unit 130, a failure display unit 140, a monitoring failure display unit 150, and a monitoring rule update unit 160. As the manager device 100, an SNMP server or the like is used.

  The analysis unit 110 receives the event 20 from the agent device 200 and determines whether or not the conditions of the monitoring rules stored in the monitoring rule storage unit 120 are satisfied. If the analysis unit 110 determines that the event 20 satisfies the condition, the analysis unit 110 notifies the monitoring failure verification unit 130 of this, displays the screen by the failure display unit 140, and notifies the administrator 10 of the screen display. The monitoring rule accumulating unit 120 stores and manages monitoring rules for monitoring failures defined by a plurality of conditions. The monitoring failure verification unit 130 receives the failure determination result from the analysis unit 110, and if the determination result of a plurality of conditions does not match, the monitoring failure display unit 150 displays a monitoring failure warning indicating that the monitoring setting is not appropriate. To display. When a monitoring failure occurs and the monitoring rule needs to be changed, the monitoring rule update unit 160 receives an input operation from the administrator 10 and changes the monitoring rule stored in the monitoring rule storage unit 120. Update.

  The manager device 100 has a function of issuing an action for solving a failure as a command 30 to the agent device 200 according to an instruction from the administrator 10.

The agent device 200 includes a monitoring unit 210 and a control unit 220.
The monitoring unit 210 extracts performance information from the service execution environment 300, generates an event 20, and notifies the manager device 100 of it. The control unit 220 receives the command 30 as an action for solving the failure from the manager device 100, and issues the command to the service execution environment 300 to solve the failure.

  This system has a configuration in which the manager device 100 presents the result of collecting and analyzing the event 20 (determination of a failure condition) to the administrator, but the monitoring rules stored in the monitoring rule storage unit 120 have different viewpoints. Define multiple conditions to determine the same state. When the monitoring failure detection unit 130 detects a difference in determination under the plurality of conditions, a warning is issued that the monitoring setting is not appropriate, and the condition is corrected by the administrator.

The operation of the monitoring system according to this embodiment will be described.
FIG. 3 shows the data structure of the monitoring rule. The monitoring rule includes a number, a rule name, a main condition, a sub condition, and an action. Here, the maximum number of sub-conditions is set to 3, but the number is not limited to this and is an arbitrary number.

  The monitoring rule of number “1” in FIG. 3 (rule name “Websrv overload”) is an example of a rule for monitoring an overload of a Web server in a three-layer system including a Web server, a database server, and an application server. Yes, a condition for determining a failure when the load of the Web server is 80% or more is defined as a main condition. Furthermore, “sub-condition 1” for determining that a failure has occurred when the application response is 5000 ms or more, “sub-condition 2” for determining that a failure has occurred when the load on the AP server is 70% or higher, and the load on the DB server being 60% or higher Three sub-conditions “sub-condition 3” for determining that a failure has occurred are defined. As described above, the monitoring rule includes a plurality of conditions including a main condition indicating a failure state and at least one sub-condition expressing the state of the main condition from another viewpoint.

FIG. 4 shows the operation flow of the monitoring system. Steps A01 and A02 are the operations of the monitoring unit 210, steps A11 to A16 are the operations of the analysis unit, steps A21 to 24 are the operations of the monitoring condition verification unit, step A31 is the operation of the monitoring failure display unit, and step A41 is the monitoring rule update unit Is the operation.
First, the monitoring unit 210 of the agent device 200 collects performance information from the service execution environment 300 (step A01). When the monitoring unit 210 acquires the performance information, the monitoring unit 210 generates an event 20 based on the performance information, and sends the event 20 to the manager device 100 (step A02).

The analysis unit 110 of the manager device 100 waits for the event 20 to be sent from the agent device 200 (step A11). When the event 20 is sent from the agent device 200, the analysis unit 110 extracts one monitoring rule that has not been determined from the monitoring rule storage unit 120 (step A12).
If there is no undetermined monitoring rule (step A13 / Yes), the process returns to step A11, and the analysis unit 110 waits for the next event to be sent from the agent device 200. When the monitoring rule is extracted (step A13 / No), the analysis unit 110 determines whether or not the main condition of the extracted monitoring rule is satisfied (step A14). If the main condition is satisfied (step A15 / Yes), the analysis unit 110 notifies the failure determination result to the failure display unit 140 and displays that it is in a failure state (step A16). On the other hand, if the main condition is not satisfied, the process proceeds to step A21.

  After the analysis unit 110 finishes determining the main condition, the monitoring failure verification unit 130 is in a “monitoring failure state” in which the monitoring setting is not appropriate when the determination result of the main condition is different from the determination result of the sub condition. The following operations are performed in order to determine. Since a plurality of subconditions may exist, first, the monitoring failure verification unit 130 extracts one subcondition to be determined from the monitoring rule (step A21). If the determination is completed for all the sub-conditions of the monitoring rule (step A22 / Yes), the process returns to step A12 and the next monitoring rule is processed. On the other hand, if an undetermined sub-condition exists (step A22 / No), the process proceeds to step A23.

  When the sub-condition to be determined is extracted in step A21, the monitoring failure verification unit 130 determines whether the determination result of the main condition is different from the determination result of the sub-condition (step A23). If the determination result of the main condition matches the determination result of the sub condition (step A24 / No), the process returns to step A21 and the same processing is performed for the other sub conditions. On the other hand, if the determination result of the main condition and the determination result of the sub condition do not match (step A24 / Yes), the process proceeds to step A31, and the processing of “monitoring failure state” in which the monitoring setting is not appropriate is performed.

  When the monitoring setting is in the “monitoring failure state” where the monitoring setting is not appropriate, the monitoring failure display unit 150 displays the main condition, its determination result, the sub-condition, and its determination result as a monitoring failure warning, thereby displaying the monitoring failure state. To the administrator 10 (step A31). When the administrator 10 corrects the condition of the monitoring rule using the monitoring rule update unit 160 according to the notified monitoring failure warning, the monitoring rule update unit 160 stores the updated monitoring rule in the monitoring rule accumulation unit 120. (Step A41). Thereafter, the process returns to step A21 to process the next subcondition.

  As described above, the network monitoring system according to the present embodiment is configured with two types of monitoring rule conditions, the main condition and the sub condition, and when there is a difference in the determination result between the main condition and the sub condition during monitoring. The administrator is requested to correct the condition because the monitoring setting is not appropriate. For this reason, as the operation continues, the difference between the main and sub conditions becomes smaller and the monitoring setting can be improved.

  In addition, when there is a difference in the judgment result between the main condition and the sub condition, the administrator displays a monitoring failure warning indicating that the monitoring setting is not appropriate, so the administrator can check whether a failure has occurred or whether the monitoring has failed. Can be distinguished.

In addition, the said embodiment is an example of suitable implementation of this invention, and this invention is not limited to this.
For example, in the above embodiment, the process of monitoring a system with a three-layer structure is taken as an example, but it goes without saying that the configuration of the monitoring target is arbitrary.
It is also possible to verify only the monitoring conditions without displaying the occurrence of a failure.
As described above, the present invention can be variously modified.

It is a figure which shows the structure of the network monitoring apparatus which concerns on this invention. It is a figure which shows the structure of the network monitoring system which concerns on suitable embodiment of this invention. It is a figure which shows an example of the monitoring rule. It is a figure which shows the flow of operation | movement of the network monitoring system which concerns on suitable embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Network monitoring apparatus 11,110 Analysis part 12,120 Monitoring rule storage part 13,130 Monitoring result verification part 15,150 Monitoring failure display part 16,160 Monitoring rule update part 100 Manager apparatus 140 Fault display part 200 Agent apparatus 210 Monitoring part 220 Control unit 300 Service execution environment

Claims (9)

A system for monitoring a service execution environment to be monitored,
An agent device for grasping the state of the service execution environment, and a manager device for managing monitoring rules of the service execution environment;
The agent device is:
Means for obtaining status information indicating the status of the service execution environment from the service execution environment;
Means for transmitting the status information to the manager device;
Means for executing a command acquired from the manager device and changing the state of the service execution environment;
The manager device is
Storage means for storing monitoring rules defined by a plurality of conditions of a main condition and at least one sub-condition;
Means for determining whether the state of the service execution environment indicated by the state information conforms to a main condition defined in the monitoring rule;
Means for determining whether the state of the service execution environment meets each of the sub-conditions defined in the monitoring rule;
Means for determining whether the status of the service execution environment is different in suitability between any of the sub-conditions and the main condition in an arbitrary monitoring rule;
Means for requesting the administrator to update a monitoring rule whose suitability is different between one of the sub-conditions and the main condition;
Means for storing the revised monitoring rule in the storage means;
A monitoring system comprising: means for issuing a command for solving a failure occurring in the service execution environment to the agent device.   The monitoring system according to claim 2, wherein when the administrator is requested to update the monitoring rule, resetting of the main condition is requested.   The monitoring system according to claim 1 or 2, wherein the processing content of the command is defined by being included in the monitoring rule.   The monitoring system according to any one of claims 1 to 3, wherein the manager device and the agent device communicate with each other by an SNMP protocol.   The manager device has means for notifying an administrator of the occurrence of a failure when the state of the service execution environment indicated by the state information conforms to a main condition defined in the monitoring rule. The monitoring system according to any one of claims 1 to 4. Storage means for storing monitoring rules defined by a plurality of conditions of a main condition and at least one sub-condition;
Means for determining whether the state of the service execution environment to be monitored is compatible with a main condition defined in any of the monitoring rules stored in the storage means;
Means for determining whether the state of the service execution environment meets each of the sub-conditions defined in any of the monitoring rules stored in the storage means;
Means for determining whether the status of the service execution environment is different in suitability between any of the sub-conditions and the main condition in an arbitrary monitoring rule;
Means for requesting the administrator to update a monitoring rule whose suitability is different between one of the sub-conditions and the main condition;
A monitoring device having means for storing the revised monitoring rule in the storage means.   7. The monitoring apparatus according to claim 6, further comprising means for notifying an administrator of the occurrence of a failure when the state of the service execution environment meets a main condition defined in the monitoring rule. Determining whether the status of the service execution environment to be monitored conforms to the main condition defined in any of the monitoring rules stored in the storage means;
Determining whether the state of the service execution environment meets each of the sub-conditions defined in any of the monitoring rules stored in the storage unit;
Determining whether the status of the service execution environment is different in suitability between any of the sub-conditions and the main condition in an arbitrary monitoring rule;
Requesting the administrator to update a monitoring rule whose suitability is different between one of the sub-conditions and the main condition;
A service execution environment monitoring method comprising the step of storing the revised monitoring rule in the storage means.   9. The service execution environment monitoring method according to claim 8, further comprising a step of notifying an administrator of the occurrence of a failure when the state of the service execution environment meets a main condition defined in the monitoring rule. .

Images