JP2010041314A - Network monitoring system, program, information storage medium and network monitoring method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a network monitoring and diagnosis result easily understandably to a user at a low cost. <P>SOLUTION: The network monitoring system 10 includes a network monitoring data-gathering part 32 for acquiring network monitoring data at every prescribed interval of time and preserving it in a storage part in relation to the acquisition time, and a monitoring image generation part 34 for generating monitoring images on the basis of the network monitoring data. The network monitoring data-gathering part 32 acquires a response time for a given network configuring apparatus or an application communicable with a user network as network monitoring data. The monitoring image generation part 34 classifies the response time gathered in a given sum-up period into a plurality of ranks corresponding to the length, divides the prescribed sum-up period in each given unit time, obtains the ratio of the response time that belongs to each rank for each given unit time, and generates a ratio-for-each-rank transition graph image for which the transition of the ratio of the response time that belongs to each rank for each given unit time in the given sum-up period is made into a graph. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a network monitoring system, a program, an information storage medium, and a network monitoring method.

  Conventionally, monitoring and diagnosis of a network state of a user's network system such as a LAN or WAN in a company has been performed as, for example, one of the services of an integrator built in a network, or in a system-related department in a user company. It was.

The monitoring and diagnosis of the network status are mostly performed when trouble occurs or as a spot response, and there are few cases where the network status is continuously implemented.
JP 2002-111665 A

  In order to properly operate the user network, it is preferable to continuously monitor and diagnose the user network state. However, there is a problem that continuous monitoring and diagnosis are difficult because it is always necessary to secure personnel with knowledge of network construction, operation, and diagnosis, and the cost is high.

  The present invention has been made paying attention to such points, and its purpose is to provide a network monitoring system, a program, an information storage medium, and a network monitoring method capable of providing network monitoring diagnosis results to a user in an easy-to-understand manner at low cost. It is to be.

(1) The present invention
A network monitoring system connected to a user network and monitoring and diagnosing the state of the user network,
Network monitoring data collecting means for monitoring the state of the user network, acquiring network monitoring data every predetermined time, and storing it in the storage unit in association with the acquisition time;
Including monitoring image generation means for generating a monitoring image based on network monitoring data;
The network monitoring data collection means includes:
As the network monitoring data, obtain a response time for a given network component device or application that can communicate with the user network,
The monitoring image generation means includes
The response times collected during a given aggregation period are classified into multiple ranks according to their length, the given aggregation period is divided into given unit times, and each rank is given for each given unit time. A ratio transition graph image is generated by graphing the transition of the response time ratio belonging to each rank for each given unit time in a given counting period. .
(2) This network monitoring system
The monitoring image generation means includes
The earned response time may be classified into five ranks according to the length.
(3) This network monitoring system
The monitoring image generation means includes
Receive rank range information for designating each rank range of the plurality of ranks, set the plurality of rank ranges based on the received rank range information, and set a plurality of response times according to the set ranges. You may classify them into ranks.
(4) This network monitoring system
The monitoring image generation means includes
Receive unit time information for designating the length of the unit time, set the given unit time length based on the received unit time information, and for each unit time for which a given counting period is set It is possible to divide and obtain the ratio of response times belonging to each rank for each set unit time.
(5) This network monitoring system
The network monitoring data collection means includes:
As the network monitoring data, obtain data indicating the status of the data flowing through the network components and the network connected to the network,
The monitoring image generation means includes
Generate a network monitoring data transition graph image that graphs the transition of data indicating the status of data flowing through network devices and networks in a given period,
The ratio-by-rank ratio transition graph image in the given counting period and the data transition graph image in the period corresponding to the given counting period may be displayed in parallel on the same screen.
(6) This network monitoring system
MIB template information storage means for storing MIB template information in which standard MIB information and vendor-specific private MIB information disclosed for a plurality of network configuration devices that can be monitored are defined in association with monitoring contents of monitoring items;
Monitoring target setting means for receiving monitoring target specifying information for specifying monitoring contents of a network configuration device to be monitored and a monitoring item to be monitored, and generating monitoring target setting information based on the received monitoring target specifying information; Including
The network monitoring data collection means includes:
Based on the MIB template information and the monitoring target setting information, inquiry information may be generated, the network configuration device to be monitored may be inquired, and network monitoring data may be acquired.
(7) The present invention
A network monitoring system connected to a user network and monitoring and diagnosing the state of the user network,
Network monitoring data that shows at least one of the status of network components connected to the network, the status of data flowing through the network, and the response time for a given network component and application that can communicate with the user network is acquired at specified intervals. Network monitoring data collection means to be stored in the storage unit,
MIB template information storage means for storing MIB template information in which standard MIB information and vendor-specific private MIB information disclosed for a plurality of network configuration devices that can be monitored are defined in association with monitoring contents of monitoring items;
Monitoring target setting means for receiving monitoring target specifying information for specifying monitoring contents of a network configuration device to be monitored and a monitoring item to be monitored, and generating monitoring target setting information based on the received monitoring target specifying information; Including
The network monitoring data collection means includes:
Inquiry information is generated based on the MIB template information and the monitoring target setting information, the network configuration device to be monitored is inquired, and network monitoring data is acquired.
(8) The present invention
A program for controlling a network monitoring system connected to a user network and monitoring and diagnosing the state of the user network,
Network monitoring data collecting means for monitoring the state of the user network, acquiring network monitoring data every predetermined time, and storing it in the storage unit in association with the acquisition time;
Causing the computer to function as monitoring image generation means for generating a monitoring image based on network monitoring data;
The network monitoring data collection means includes:
As the network monitoring data, obtain a response time for a given network component device or application that can communicate with the user network,
The monitoring image generation means includes
The response times collected during a given aggregation period are classified into multiple ranks according to their length, the given aggregation period is divided into given unit times, and each rank is given for each given unit time. A ratio transition graph image is generated by graphing the transition of the response time ratio belonging to each rank for each given unit time in a given counting period. .
(9) The present invention
A computer-readable information storage medium in which the program described above is stored.
(10) The present invention
A network monitoring method,
A network monitoring data collecting step of monitoring the state of the user network, acquiring network monitoring data every predetermined time, and storing the network monitoring data in a storage unit in association with the acquisition time;
A monitoring image generation step for generating a monitoring image based on the network monitoring data,
In the network monitoring data collection step,
As the network monitoring data, obtain a response time for a given network component device or application that can communicate with the user network,
In the monitoring image generation step,
The response times collected during a given aggregation period are classified into multiple ranks according to their length, the given aggregation period is divided into given unit times, and each rank is given for each given unit time. A ratio transition graph image is generated by graphing the transition of the response time ratio belonging to each rank for each given unit time in a given counting period. .

1. Configuration FIG. 1 is a diagram for explaining a network monitoring system according to the present embodiment.

  The network monitoring system according to the present embodiment includes a network monitoring device 10. The network monitoring device 10 is connected to the Internet 110 and the user network 100, which are public communication networks, and monitors the state of the user network.

  The user network 100 may be a LAN (local area network), a WAN (wide area network), or the like.

  The network monitoring device 10 is connected to, for example, the switch 140 and the like, and measurement information (traffic, error, CPU operation rate, DRAM remaining capacity, FireWall attack, number of sessions, etc.) relating to the performance of the user network, user network configuration device, or Response time monitoring information for a given port or application connected to the user network (ICMP response monitoring (measurement of response time to target device using ICMP Echo)), TCP response monitoring (TCP application such as HTTP, SMTP, POP3, etc.) 300 response time measurement)), user network connection equipment, I / F, TCP status monitoring information (user network connection equipment Up, Down information, switch Ji, Up port or interface such as a router, Down information, collected HTTP, SMTP, etc. TCP services POP3 Up, Down information), at least one measurement packet information.

  Here, the user network component device is, for example, the switch 140, the firewall 130, the router 150, the server 160, the terminal 170, or the like.

  For example, the network monitoring device 10 may function as a progress monitoring device for the network usage rate, error, and device status (CPU, DRAM, firewall, etc.) of the network configuration device, and may detect Up and Down detection of the network configuration device. It may function as a status monitoring device to perform, or may function as a response time measuring device that measures a response time to a communication target.

  The network monitoring device 10 may be provided as dedicated hardware, or may be provided as software and realized by executing the program of the present embodiment on a general-purpose computer.

The network monitoring apparatus 10 according to the present embodiment functions as a Web server.
A terminal 170 connected to a user network and a computer (for example, a personal computer PC) 200 connected to the Internet include an input unit, a control unit, a display unit, a communication unit, and the like, and a WWW browser is installed and connected to the Internet. And has a function as a client terminal capable of browsing web pages.

  The terminal 170 connected to the user network and the computer (for example, PC) 200 connected to the Internet specify the address (IP address, etc.) of the network monitoring device 10 in the URL field of the Web browser. A Web page to be provided can be referred to. In this Web page, the generated monitoring images as shown in FIGS. 3, 4, 7 to 11 and 13 are provided, the monitoring image generation parameter input screens shown in FIGS. 6A and 6B, and FIGS. A monitoring target setting screen is provided, and input information and setting information can be received.

  FIG. 2 is an example of a functional block diagram of the network monitoring apparatus 10 constituting the network monitoring system of the present embodiment.

  The network monitoring apparatus 10 may include a host computer 220 and a database 250.

  The host computer 20 includes a processing unit 30, a storage unit 22, an information storage medium 26, and a transmission / reception unit 24.

  The transmission / reception unit 24 is configured by a modem, a terminal adapter, a router, or the like, and exchanges data with other network components in the user network and with other system servers, applications, and databases 50 via the Internet. Although both the function and the reception function are provided, the transmission / reception function may be realized by being distributed between the transmission unit and the reception unit.

  The storage unit 22 serves as a work area for the processing unit 30 and the transmission / reception unit 24, and the functions thereof are realized by hardware such as a RAM.

  The processing unit 30 performs various processes necessary for network monitoring and data communication (for example, a process in which a received processing request is transmitted by a terminal or a request for determining a response). The function is realized by a combination of hardware (a processor such as a CPU or DSP or an ASIC such as a gate array) and a program (game program, firmware, or the like). However, all of the functions of the processing unit 100 may be realized by hardware, or all of them may be realized by a program.

  An information storage medium (storage medium usable by a computer) 26 stores information such as programs and data, and functions thereof are an optical disk (CD, DVD), a magneto-optical disk (MO), a magnetic disk, and a hard disk. It can be realized by hardware such as a magnetic tape or a memory (ROM).

  The processing unit 30 performs various processes of the present invention (this embodiment) based on information stored in the information storage medium 26. That is, the information storage medium 26 stores information (program or data) for executing the means of the present invention (this embodiment) (particularly, the blocks included in the processing unit 230).

  The information storage medium 26 stores MIB template information in which standard MIB information and vendor-specific private MIB information set for a plurality of network configuration devices that can be monitored are associated with each network configuration device. It functions as MIB template information storage means. For example, MIB template information may be stored in the information storage medium 26, read as necessary, stored in the storage unit 22, and referred to by the processing unit 30.

  The processing unit 30 includes a network monitoring data collection unit 32, a monitoring image generation unit 34, a Web server processing unit 36, and a monitoring target setting unit 38.

  The network monitoring data collection unit 32 functions as a network monitoring data collection unit that monitors the state of the user network, acquires the network monitoring data every predetermined time, and stores the data in the storage unit in association with the acquisition time.

  The network monitoring data collection unit 32 communicates with a user network connection device connected to the user network, an external server, and an application, collects network information, and stores the information in the information storage unit 60.

  The network monitoring data collection unit 32 repeatedly transmits a response time measurement packet to a response time measurement target (server, terminal, router, application, etc.) every predetermined time (for example, every minute), May be measured.

  The response measurement target may be a network device (server, terminal, router, etc.), or an application that can communicate with the user network (target device using ICMP Echo, TCP application such as HTTP, SMTP, POP3, etc.).

  The monitoring image generation unit 34 functions as monitoring image generation means for generating a monitoring image based on network monitoring data.

  The monitoring image generation unit 34 classifies the response times collected during a given counting period into a plurality of ranks according to the length thereof, divides the given counting period for each given unit time, The ratio transition graph image by rank which graphed the transition of the ratio of response time belonging to each rank for a given unit time in a given counting period. Generate.

  The monitoring image generation unit 34 may classify the earned response time into five ranks according to the length.

  The monitoring image generation unit 34 receives rank range information for designating each rank range of the plurality of ranks, sets the plurality of rank ranges based on the received rank range information, and sets the range to the set range. Accordingly, response times may be classified into a plurality of ranks.

  Providing a rank range information reception screen for receiving rank range information for designating a range of each rank of the plurality of ranks via a network to a given terminal (such as a personal computer) capable of communicating with the network monitoring system; You may make it receive the rank range information input in the rank range information reception screen.

  The range of each rank may be specified by at least one of an upper limit value, a lower limit value, a center value, a representative value, and the like of each rank.

  The monitoring image generation unit 34 receives unit time information for designating the length of the unit time, sets the given unit time length based on the received unit time information, and gives a given total period May be divided for each set unit time, and the ratio of response times belonging to each rank may be obtained for each set unit time.

  Providing a unit time information reception screen for receiving unit time information for designating the length of the unit time via a network to a given terminal (personal computer or the like) capable of communicating with the network monitoring system; You may make it receive the unit time information input in the information reception screen.

  The network monitoring data unit 32 acquires, as the network monitoring data, network configuration devices connected to the network and data indicating the state of data flowing through the network, and the monitoring image generation unit 34 receives the network configuration devices in a given period. A network monitoring data transition graph image that graphs the transition of data indicating the state of data flowing through the network or the network is generated, and the ratio transition graph image by rank in the given aggregation period and the given aggregation period Data transition graph images in a period may be displayed in parallel in the same screen.

  Data indicating the status of network components and data flowing through the network includes, for example, measurement information related to the performance of the user network (traffic, error, CPU operation rate, remaining DRAM capacity, FireWall attack, number of sessions, etc.), user network Status monitoring information of connected devices, I / F, and TCP (Up, Down information of user network connection devices, Up of ports or interfaces such as switches and routers, Down information, Up of TCP services such as HTTP, SMTP, POP3, Down, etc. Information), measurement packet information, and the like.

  The monitoring target setting unit 38 receives monitoring target specifying information for specifying the monitoring target network configuration device and the monitoring contents of the monitoring item to be monitored, and generates monitoring target setting information based on the received monitoring target specifying information. Functions as monitoring target setting means.

  The network monitoring data collection unit 32 may generate inquiry information based on the MIB template information and the monitoring target setting information, make an inquiry to the network configuration device to be monitored, and acquire network monitoring data.

  When receiving a Web page distribution request from a Web client (for example, the terminal 170 or the computer 200 in FIG. 1), the Web server processing unit 36 transmits a Web page stored in the database to the requesting Web client via the network. Function as.

  For example, the monitoring image shown in FIGS. 3, 4, 7 to 11 and 13, the parameter input screen for generating the monitoring image shown in FIGS. 6A and 6B, and the monitoring target setting screen shown in FIGS. You may make it transmit via.

  The database 50 includes a transmission / reception unit 52 that transmits / receives data to / from the host computer 20, and an information storage unit 260 that stores Web page information 62, network monitoring data 64, and monitoring target setting information 66 in a usable state. Composed.

  The Web page information 62 is W Web page information that can be provided by the network monitoring system, such as a monitoring image generation parameter input screen shown in FIGS. 6A and 6B and a monitoring target setting screen shown in FIGS.

  The network monitoring data 64 is network monitoring data (response data or the like) acquired every predetermined time.

  The monitoring target setting information 66 is information related to the set monitoring target (information on the monitoring contents of the network configuration device to be monitored and the monitoring item to be monitored).

The information storage unit 60 is a CPU-readable storage medium such as a magnetic or optical recording medium or a semiconductor memory, and is realized by, for example, a RAM, a hard disk (magnetic disk), a flexible disk, a CD-ROM, or the like.
2. Monitoring Image Generation Processing FIG. 3 is a graph of ICMP response time.

  In the present embodiment, network monitoring data is measured by sending and receiving response time measurement packets to and from a network component device that is a response time measurement target at predetermined time intervals (for example, once per minute). Is stored in the storage unit. For example, information to be monitored may be stored in the information storage unit 60 in FIG. 2 as network monitoring data in association with monitoring target identification information (identification information indicating network configuration devices and monitoring target items) and acquisition time.

  For example, when there is a request for generating an ICMP response time graph image (an example of a monitoring image) from the computer 200 or the user terminal 170, a predetermined period of time is determined based on the response time data of the network monitoring data stored in the storage unit. A graph image 310 (an example of a monitoring image) showing the transition of the ICMP response time is generated. The generated image is transmitted to the requesting computer 200 or the user terminal 170 and displayed on the display unit of the requesting computer 200 or the user terminal 170.

  The response time graph is a line graph of the transition of response time collected during a given period.

  FIG. 4 is a graph showing a rate transition of ICMP response time by rank.

  For example, when the computer 200 or the user terminal 170 requests to generate a graph image (an example of a monitoring image) indicating the response rate ratio change by rank, the response time data of the network monitoring data stored in the storage unit is used. Based on this, a graph image 320 (an example of a monitoring image) showing the rate-dependent ratio transition of ICMP response time in a predetermined period is generated. The generated image is transmitted to the requesting computer 200 or the user terminal 170 and displayed on the display unit of the requesting computer 200 or the user terminal 170.

  The graph showing the percentage transition of response time by rank classifies the response time collected during a given aggregation period into multiple ranks (five levels in Fig. 4) according to the length of the response time. It is divided into given unit times (30 minute intervals in Fig. 4), and the ratio of response times belonging to each rank is obtained for each given unit time, and each given unit time in a given counting period It is a graph showing the transition of the ratio of response times belonging to ranks.

  For example, when the response time indicated by each response time data acquired every predetermined time (for example, once per minute) is less than 0.5 msec, rank A, when the response time is 0.5 msec or more and less than 1 msec, rank B, the response time is If it is 1 msec or more and less than 1.5 msec, it is classified as rank C, if the response time is 1.5 msec or more and less than 3 msec, it is classified as rank D, and if the response time is 3 msec or more, it is classified as rank E.

  Here, given a unit period of 30 minutes, a total of Xa + Xb + Xc + Xd + Xe response times are obtained once a minute during the period, and Xa response ranks belonging to rank A (less than 5 ms in this case), rank B Xb response times belonging to (here 5 ms to less than 10 ms), Xc response times belonging to rank C (here 10 ms to less than 15 ms), and response times belonging to rank D (here 15 ms to less than 20 ms) Xd Assuming that there are Xe response times belonging to the rank E (20 ms or more), the ratio of each rank in a given unit time is as follows.

Ratio of response time of rank A Wa = Xa / Xa + Xb + Xc + Xd + Xe
Ratio of response time of rank B Wb = Xb / Xa + Xb + Xc + Xd + Xe
Ratio of response time of rank C Wc = Xc / Xa + Xb + Xc + Xd + Xe
Ratio of response time of rank D Wd = Xd / Xa + Xb + Xc + Xd + Xe
Ratio E of rank E response time We = Xe / Xa + Xb + Xc + Xd + Xe
For example, as shown in FIG. 5, a bar graph corresponding to a given unit time 320 is converted into an area (A rank area 321, B rank area 322, C rank area) corresponding to each rank according to the response time ratio of each rank. Area 323, D rank area 324, E rank area 325), and the size of each area (in this case, the length in the vertical direction) is set according to the ratio of data belonging to each rank. For example, when the rank ABCDE is 321 ′, 322 ′, 323 ′, 324 ′, and 325 ′, the ratio of the lengths can be set as follows.

321 ′, 322 ′, 323 ′, 324 ′, 325 ′ = Wa: Wb: Wc: Wd: We
Then, by arranging bar graphs corresponding to each unit time in a horizontal direction for a predetermined period, a graph of a rate transition as shown in FIG. 4 can be obtained.

  With this graph, it is possible to display the state of the response during a given unit time in a visually easy-to-understand manner.

  When the rank A is large, it can be said that the service level is in a normal state, and when the rank E is large, it can be said that the service level is lowered.

  In addition to ICMP, it is possible to display a graph of the rate transition from all response monitoring results such as HTTP, FTP, DNS.

  FIGS. 6A and 6B are diagrams for explaining parameter setting when displaying a graph of the ratio transition of response times by rank.

  The network monitoring system according to the present embodiment functions as a Web server, and parameters for generating a monitoring image as shown in FIGS. 6A and 6B via a network for a computer or terminal connected to the network monitoring system. Provide an input screen. On the computer or the terminal, a parameter input screen for generating a monitoring image is displayed by a general-purpose Web browser function.

  FIG. 6A shows an example of an information input screen for the type of analysis, the length of unit time, and the range of the total period, which is one of the parameters for generating the monitoring image. As a type of analysis, a unit time analysis designation 340 or a period analysis designation 342 can be performed. Further, the unit time length setting 341 and the range of the totaling period (start time 343 and end time 344) can be designated by input.

  When the unit time analysis 340 is designated, a graph showing the rate transition for each unit time in the counting period as shown in FIG. 4 is displayed. When the period analysis 342 is designated, a graph showing the data ratio for each rank in the total period as shown in FIG. 7 is displayed.

  FIG. 6B shows an example of a rank range information input screen that is one of the parameters for generating the monitoring image. As shown in FIG. 6 (B), even if the rank range information is input as a rank range information, a value indicating the range of each rank (upper limit value, lower limit value, center value, representative value, etc.) of a plurality of ranks is displayed. good. In FIG. 8B, upper limit values 345, 346, 347, and 348 of each rank can be designated by input. Since the ranges of each rank are continuous, the lower limit value of each rank is set based on the upper limit value of the previous rank.

  FIG. 7 is a diagram illustrating an example of a response time period analysis display.

  For example, in FIG. 6A, when period analysis is selected, as shown in FIG. 7, a graph (here, a pie chart) showing the ratio of response times belonging to each rank within the counting period is displayed. For example, once per minute during the period, the response time belonging to rank A (here, less than 5 ms) is Xa ′, and the response time belonging to rank B (here, from 5 ms to less than 10 ms) is Xb ′. , The response time belonging to rank C (here 10 ms or more and less than 15 ms) is Xc ′, the response time belonging to rank D (here 15 ms or more and less than 20 ms) is Xd ′, and the response time belonging to rank E (20 ms or more) is Assuming that there are Xe ′, the ratio of response time of each rank in the counting period is as follows.

Ratio of response time of rank A Wa ′ = Xa ′ / Xa ′ + Xb ′ + Xc ′ + Xd ′ + Xe ′
Ratio of response time of rank B Wb ′ = Xa ′ / Xa ′ + Xb ′ + Xc ′ + Xd ′ + Xe ′
Ratio of response time of rank C Wc ′ = Xa ′ / Xa ′ + Xb ′ + Xc ′ + Xd ′ + Xe ′
Ratio of response time of rank D Wd ′ = Xa ′ / Xa ′ + Xb ′ + Xc ′ + Xd ′ + Xe ′
Ratio E of response time of rank E We ′ = Xa ′ / Xa ′ + Xb ′ + Xc ′ + Xd ′ + Xe ′
An area indicating the ratio of each rank in the pie chart (an area 351 indicating the ratio of rank A, an area 352 indicating the ratio of rank B, an area 353 indicating the ratio of rank C, an area 354 indicating the ratio of rank D, and the rank E The area ratio or the central angle ratio of the region 355) indicating the ratio can be Wa ′: Wb ′: Wc ′: Wd ′: We ′.

  In performing the unit time analysis, the unit time can be changed by user input as shown in FIG.

  FIG. 9 is an ICMP response time graph 362 in a predetermined period 360. FIG. 8 is a graph 372 showing a rate transition of the ICMP response time in which the unit time 374 is 30 minutes in the counting period 370 corresponding to the predetermined period 360. FIG. 10 is a graph 376 showing a change in the ratio of the ICMP response time in which the unit time 376 is 6 hours in the total period 370 corresponding to the predetermined period 360. FIG. 11 is a graph showing a change in the ratio of the ICMP response time in which the unit time 382 is one day in the total period 370 corresponding to the predetermined period 360.

  In the graph 372 analyzed at intervals of 30 minutes per unit time shown in FIG. It is possible to see if the service level is normal by shortening the unit time and analyzing.

  Further, the degree of change is small in the graph 376 analyzed at intervals of 6 hours per unit time shown in FIG. In the graph 380 analyzed at the unit time interval of 1 day shown in FIG. 11, the change is further flattened. Compared with the graph 380 (see FIG. 11) of the unit time 1-day interval and the graph 372 (see FIG. 8) of the unit time 30 minutes, the graph 372 (see FIG. 8) of the unit time 30 minutes in the 7/30 portion. ), There is no rank A, but it can be seen that there is about 16% in the graph 380 (see FIG. 11) of the unit time 1-day interval. In this way, the tendency of change in service level can be seen by increasing the unit time P.

  FIG. 12 is a diagram for explaining the characteristics of the response time graph and the graph showing the ratio transition of response time by rank.

  410 is a response time graph of a predetermined period, and 420 is a graph showing a change in the ratio of response time of a total period corresponding to the predetermined period. Both are graphs generated based on response data (stored in the storage unit) measured at 1 minute intervals in a predetermined period.

  Since the response time graph 410 of the predetermined period is a line graph, only instantaneous changes in the change are conspicuous as indicated by 430 and 434, and it is difficult to determine the actual response. According to the graph 420 showing the transition of the response time ratio of the sections 432 and 438 corresponding to the predetermined sections 430 and 434 of the response time graph 410, the access time for one time over several hours is large in the section 432. It can be seen that is delayed by as much as 25 msec to 50 msec. Thus, according to the graph showing the response time ratio transition, it is possible to grasp at a glance the tendency of the response in the medium to long term from the graph.

  FIG. 13 is a diagram for describing an example of monitor graph display control according to the present embodiment.

  For example, a graph 450 showing a change in the ratio of response times by rank in a given counting period and a graph corresponding to a monitoring item in a period corresponding to the given counting period (for example, response time graph 452 and traffic graph 454). May be displayed in parallel in the same screen.

  In this way, for example, it can be seen that a delay occurs in the ICMP response time due to an increase in traffic, which is convenient for network analysis and diagnosis.

  FIG. 14 is a flowchart illustrating the flow of response time monitoring control.

For a given network component or application that can communicate with the user network, it repeatedly sends response time measurement packets every predetermined time, measures and obtains response time, and receives network monitoring data (response time data). ) And stored in the storage unit in association with the acquisition time (step S10).
When a request for generation of a rank-specific ratio transition graph image (including the specification of rank range information, unit time information, and total period information of the ratio transition of response time by rank) is received via the network (step S20), the following processing is performed. I do.

  Based on the received total period information, response time data within the total period is extracted from the storage unit (step S30).

  Next, the rank to which the response time indicated by the response time data extracted based on the received rank range information belongs is determined (step S40).

  Next, the response time data extracted based on the received unit time information is divided for each unit time, the number of response time data belonging to each rank is obtained for each unit time, and the ratio of the response time belonging to each rank from the obtained number Is calculated (step S50).

Then, based on the calculated ratio of response times belonging to each rank for each unit time, a graph image of the ratio transition of response times by rank is generated (step S60).
3. Network Monitoring Data Collection Processing Using MIB Template Information FIG. 15 is a diagram for explaining MIB template information.

  MIB (Management Information Base) information is information disclosed by a network component device managed by SNMP in order to inform the outside of its state, and is a predetermined monitoring set for the network component device. This includes object information (OID) necessary for inquiring items.

  SNMP (Simple Network Management Protocol) is a protocol for monitoring and controlling communication devices connected to a network, such as routers, computers, and terminals, in a TCP / IP network. The device to be controlled has a management information database called MIB, and the device to be managed performs appropriate settings based on the MIB of the target device.

  The MIB template information 500 is defined by associating an object ID (OID) 514 disclosed for a plurality of network components that can be monitored with the monitoring contents 512 of the monitoring item 510.

  FIG. 16 is a flowchart showing the flow of network monitoring data collection processing using MIB template information. 17 to 21 are examples of monitoring target setting screens.

  Specific information (IP address or the like) of the network component device to be monitored is received (step S110). For example, a monitoring target network constituent device specifying information input screen as shown in FIG. 17 may be provided to a terminal or a computer via a network to receive the specifying information (IP address or the like) of the network constituent device to be monitored.

Next, based on the received specific information (such as an IP address) of the network component device, an inquiry is made as to whether or not the network component device has private MIB information. (Step S120)
Next, list display information of network configuration devices to be monitored is provided (step S130). For example, network configuration device list information to be monitored as shown in FIG. 18 may be provided to a terminal or a computer via a network. Further, a vendor MIB setting list or a standard MIB setting list as shown in FIG. 19 or FIG. 20 may be provided to a terminal or a computer via a providing network. A device is automatically determined by an inquiry based on specific information (such as an IP address) of a network component device to be monitored, and if private MIB information is included, an appropriate vendor MIB is displayed based on the MIB template information 500.

  Next, the monitoring content information of the monitoring item is received (step S140). For example, it is very good to provide a monitoring item setting screen as shown in FIG. 21 to a terminal or a computer via a network and receive monitoring content information of the monitoring item.

  Next, monitoring target setting information is generated on the basis of the monitoring contents of the network constituent devices to be monitored and the monitoring items to be monitored (step S150).

  Based on the MIB template information and the monitoring target setting information, the monitoring target network configuration device is inquired about the monitoring content of the monitoring item to be monitored, and network monitoring data is acquired (step S160). The OID 514 corresponding to the monitoring content 512 of the monitoring item 510 to be monitored specified by the monitoring target setting information can be obtained by referring to the MIB template information 500. An inquiry about the monitoring contents of the monitoring item to be monitored can be made to the monitoring target network constituent device by the IP address of the monitoring target network constituent device and the obtained OID 514.

  Although the preferred embodiments to which the present invention is applied have been described above, the application of the present invention is not limited to the above-described embodiments.

  The present invention includes configurations that are substantially the same as the configurations described in the embodiments (for example, configurations that have the same functions, methods, and results, or configurations that have the same objects and effects). In addition, the invention includes a configuration in which a non-essential part of the configuration described in the embodiment is replaced. In addition, the present invention includes a configuration that exhibits the same operational effects as the configuration described in the embodiment or a configuration that can achieve the same object. Further, the invention includes a configuration in which a known technique is added to the configuration described in the embodiment.

  In this embodiment, the case where the function of the network monitoring apparatus is realized by a single apparatus has been described as an example, but the present invention is not limited to this. It may be realized by being distributed by a plurality of devices (implemented as a system in which a plurality of devices are connected).

  The network monitoring apparatus of the present invention may be realized by installing dedicated hardware for realizing the functions of the present invention, or a program for realizing the functions of the present invention is installed in a general-purpose computer. May be realized.

The figure for demonstrating the network monitoring system of this Embodiment. 1 is an example of a functional block diagram of a network monitoring device that constitutes a network monitoring system of an embodiment. ICMP response time graph. The graph which shows the ratio transition according to rank of the response time of ICMP. A bar graph corresponding to a given unit time. An example of the parameter input screen for the monitoring image generation shown to FIG. 6 (A) (B). The graph which shows the data ratio according to rank of a total period. The graph which shows the rate transition of the ICMP response time which made unit time 30 minutes. ICMP response time graph. The graph which shows the rate transition of ICMP response time which made unit time 6 hours. The graph which shows the ratio transition of ICMP response time which made unit time 1 day. The figure explaining the characteristic of the graph which shows the ratio transition according to the response time graph and the rank of response time. The figure for demonstrating an example of the display control of the monitoring graph of this Embodiment. The flowchart figure explaining the flow of monitoring control of a response time. The figure for demonstrating MIB template information. The flowchart which shows the flow of the network monitoring data collection process using MIB template information. An example of a monitoring target setting screen. An example of a monitoring target setting screen. An example of a monitoring target setting screen. An example of a monitoring target setting screen. An example of a monitoring target setting screen.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Network monitoring apparatus (network monitoring system), 20 Host computer, 22 Storage part, 24 Transmission / reception part, 30 Processing part, 32 Network monitoring data collection part, 34 Monitoring image generation part, 36 Web server processing part, 38 Monitoring object setting part , 26 information storage medium, 50 database, 60 information storage unit, 62 Web page information, 64 network monitoring data, 66 monitoring target setting information

Claims (10)

A network monitoring system connected to a user network and monitoring and diagnosing the state of the user network,
Network monitoring data collecting means for monitoring the state of the user network, acquiring network monitoring data every predetermined time, and storing it in the storage unit in association with the acquisition time;
Including monitoring image generation means for generating a monitoring image based on network monitoring data;
The network monitoring data collection means includes:
As the network monitoring data, obtain a response time for a given network component device or application that can communicate with the user network,
The monitoring image generation means includes
The response times collected during a given aggregation period are classified into multiple ranks according to their length, the given aggregation period is divided into given unit times, and each rank is given for each given unit time. A ratio transition graph image is generated by graphing the transition of the response time ratio belonging to each rank for each given unit time in a given counting period. Network monitoring system. In claim 1,
The monitoring image generation means includes
A network monitoring system characterized by classifying received response times into five ranks according to their length. In any one of Claims 1 thru | or 2.
The monitoring image generation means includes
Receive rank range information for designating each rank range of the plurality of ranks, set the plurality of rank ranges based on the received rank range information, and set a plurality of response times according to the set ranges. A network monitoring system characterized by being classified into ranks. In any one of Claims 1 thru | or 3,
The monitoring image generation means includes
Receive unit time information for designating the length of the unit time, set the given unit time length based on the received unit time information, and for each unit time for which a given counting period is set A network monitoring system that divides and obtains a ratio of response times belonging to each rank for each set unit time. In any one of Claims 1 thru | or 4,
The network monitoring data collection means includes:
As the network monitoring data, obtain data indicating the status of the data flowing through the network components and the network connected to the network,
The monitoring image generation means includes
Generate a network monitoring data transition graph image that graphs the transition of data indicating the status of data flowing through network devices and networks in a given period,
It includes a display control means for displaying the ratio transition graph image by rank in the given counting period and the data transition graph image in the period corresponding to the given counting period in parallel on the same screen. Network monitoring system. In claim 5,
MIB template information storage means for storing MIB template information in which standard MIB information and vendor-specific private MIB information disclosed for a plurality of network configuration devices that can be monitored are defined in association with monitoring contents of monitoring items;
Monitoring target setting means for receiving monitoring target specifying information for specifying monitoring contents of a network configuration device to be monitored and a monitoring item to be monitored, and generating monitoring target setting information based on the received monitoring target specifying information; Including
The network monitoring data collection means includes:
A network monitoring system that generates inquiry information based on MIB template information and monitoring target setting information, inquires about a network constituent device to be monitored, and acquires network monitoring data. A network monitoring system connected to a user network and monitoring and diagnosing the state of the user network,
Network monitoring data that shows at least one of the status of network components connected to the network, the status of data flowing through the network, and the response time for a given network component and application that can communicate with the user network is acquired at specified intervals. Network monitoring data collection means to be stored in the storage unit,
MIB template information storage means for storing MIB template information in which standard MIB information and vendor-specific private MIB information disclosed for a plurality of network configuration devices that can be monitored are defined in association with monitoring contents of monitoring items;
Monitoring target setting means for receiving monitoring target specifying information for specifying monitoring contents of a network configuration device to be monitored and a monitoring item to be monitored, and generating monitoring target setting information based on the received monitoring target specifying information; Including
The network monitoring data collection means includes:
A network monitoring system that generates inquiry information based on MIB template information and monitoring target setting information, inquires about a network constituent device to be monitored, and acquires network monitoring data. A program for controlling a network monitoring system connected to a user network and monitoring and diagnosing the state of the user network,
Network monitoring data collecting means for monitoring the state of the user network, acquiring network monitoring data every predetermined time, and storing it in the storage unit in association with the acquisition time;
Causing the computer to function as monitoring image generation means for generating a monitoring image based on network monitoring data;
The network monitoring data collection means includes:
As the network monitoring data, obtain a response time for a given network component device or application that can communicate with the user network,
The monitoring image generation means includes
The response times collected during a given aggregation period are classified into multiple ranks according to their length, the given aggregation period is divided into given unit times, and each rank is given for each given unit time. A ratio transition graph image is generated by graphing the transition of the response time ratio belonging to each rank for each given unit time in a given counting period. program.   A computer-readable information storage medium, wherein the program according to claim 8 is stored. A network monitoring method,
A network monitoring data collecting step of monitoring the state of the user network, acquiring network monitoring data every predetermined time, and storing the network monitoring data in a storage unit in association with the acquisition time;
A monitoring image generation step for generating a monitoring image based on the network monitoring data,
In the network monitoring data collection step,
As the network monitoring data, obtain a response time for a given network component device or application that can communicate with the user network,
In the monitoring image generation step,
The response times collected during a given aggregation period are classified into multiple ranks according to their length, the given aggregation period is divided into given unit times, and each rank is given for each given unit time. A ratio transition graph image is generated by graphing the transition of the response time ratio belonging to each rank for each given unit time in a given counting period. Network monitoring method.