JP2010061226A - Network monitoring system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a network monitoring system which is improved in expandability against increase of TRAP reception traffic. <P>SOLUTION: The network monitoring system includes a load balancer 4, and the address (virtual server address) of the accident warning destination of TRAP from monitored devices 11 to 1n is set in the load balancer 4 so that all TRAP can be captured by the load balancer 4. Also, this network monitoring system includes a plurality of monitoring servers 31 to 3N, and the TRAP is distributed and transferred from the load balancer 4 to the monitoring servers 31 to 3N. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a network monitoring system that monitors a network using SNMP (Simple Network Management Protocol).

  SNMP is known as a protocol for monitoring a network such as an IP (Internet Protocol) network. Since SNMP is relatively easy to implement, it has become a de facto standard as a network monitoring protocol. In SNMP, the monitored device notifies the monitoring device of various management information using a message called SNMP TRAP (hereinafter referred to as TRAP).

  By the way, since TRAP is transferred by UDP (User Datagram Protocol), there is no flow control, and the monitoring apparatus cannot control the TRAP reception flow. Therefore, when TRAP occurs in bursts, the machine performance of the monitoring device may be tight and the provision of monitoring services may be delayed. In recent years, with the expansion of the communication network, the number of monitored devices has increased, and the TRAP reception performance in the monitoring device cannot keep up. If it is bad, it may fail to receive TRAP, which hinders the monitoring function of the network.

  For example, Patent Documents 1 and 2 disclose techniques related to TRAP processing. Patent Document 1 discloses a technique for realizing distributed reception by converting contact information of a device into TRAP and transmitting the information to a monitored server or a different monitoring server for each type. However, in the technique of this document, it is necessary to set addresses of a plurality of servers in each TRAP, which is troublesome. It is desirable that the destination address of TRAP is one as much as possible.

In Patent Document 2, TRAP is complemented by mutual confirmation between two managers when TRAP is lost. However, this technique is expected to ensure that TRAP is received by any manager, and does not attempt to improve TRAP reception performance itself.
In addition, Patent Document 3 discloses a technique of providing a load balancer to perform distributed processing of HTTP requests. However, since HTTP is accompanied by flow control, it cannot be applied to TRAP reception processing as it is.
JP 2004-86522 A JP 2001-67291 A JP 2002-163241 A

As described above, there is room for improvement in TRAP reception performance in a system for monitoring a network based on SNMP. In particular, the recent expansion of communication systems with remarkable expansion is expected to provide a system that can easily cope with an increase in the number of monitored devices and that does not lose TRAP.
The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a network monitoring system with enhanced extensibility against an increase in TRAP reception traffic.

  In order to achieve the above object, according to one aspect of the present invention, in a network monitoring system using SNMP, a plurality of monitored devices that issue a TRAP toward a specific address, the specific address assigned, After capturing the TRAP issued from the monitored device, the distribution device that distributes and transfers the TRAP to any of a plurality of destination addresses, and receives and stores the TRAP that is individually assigned to the destination address and is transferred from the distribution device There is provided a network monitoring system comprising: a plurality of storage means for processing; and a processing terminal that acquires and processes the stored TRAP from the plurality of storage means.

  By taking such means, the TRAP is once captured by the distribution device and then distributed and transferred to one of a plurality of storage means. As a result, even if TRAP exceeding the allowable amount of the storage means (monitoring server) alone occurs in a burst manner, any storage means can always receive TRAP. Therefore, even if the number of monitored devices increases and the TRAP received traffic exceeds the performance of the monitoring server, it is possible to receive TRAP without missing by adding a monitoring server as appropriate, and to ensure the expandability of the monitoring system.

  According to the present invention, it is possible to provide a network monitoring system with enhanced extensibility against an increase in TRAP reception traffic.

FIG. 1 is a system diagram showing an embodiment of a network monitoring system according to the present invention. In FIG. 1, a plurality of monitored devices 11 to 1n belong to a network NW. Each of the monitored devices 11 to 1n autonomously monitors its own state, and appropriately reports TRAP when an event defined in MIB (Management Information Base) occurs. The TRAP is first transmitted from the network NW to the load balancer (distributor) 4 via the router 2 and captured. In a network to which the load balancer 4 belongs (for example, a local area network (LAN)), a plurality of monitoring servers 31 to 3N, an NTP (Network Time Protocol) server (time synchronization server) 100 having a time synchronization function, and a TRAP display A terminal (processing terminal) 200 is connected.
That is, the system of FIG. 1 uses SNMP for network monitoring. The TRAP issued from each monitored device 11 to 1n is once pooled in the load balancer 4 and then immediately transferred to one of the monitoring servers 31 to 3N. The monitoring servers 31 to 3N receive the TRAP transferred from the load balancer 4 and store it in a recording medium (storage means).

  FIG. 2 is a block diagram showing the main part of the system of FIG. The load balancer 4 provides a unique virtual server address (specific address) to the monitored devices 11 to 1n that issue TRAP. That is, all of the monitored devices 11 to 1n issue TRAP toward the virtual server address.

  Each of the monitoring servers 31 to 3N has a unique address, and the load balancer 4 distributes and transfers the captured TRAP to the addresses of the monitoring servers 31 to 3N according to a prescribed load distribution logic (for example, round robin). As a result, all TRAPs are received by any of the monitoring servers 31 to 3N.

  Here, the protocol for transmitting TRAP from the monitored devices 11 to 1n to the load balancer 4 is UDP based on the SNMP specification. However, the protocol for transferring TRAP from the load balancer 4 to the monitoring servers 31 to 3N is not limited to UDP, and can be arbitrarily selected. In particular, it is advantageous to use TCP (Transmission Control Protocol) that includes flow control and can perform retransmission control when data is lost.

  When the monitoring servers 31 to 3N receive the TRAP transferred from the load balancer 4, as shown in FIG. 3, the monitoring server 31 to 3N adds its own server identifier (server identifier) and time stamp to the TRAP. ~ Accumulate in DBN. The time stamp indicates the TRAP reception time in each of the monitoring servers 31 to 3N. The TRAP reception information is composed of the server identifier and the time stamp, and this is combined with the specific contents of TRAP to form a database.

  The databases DB1 to DBN are constructed in a storage area of a recording medium such as a hard disk drive. The recording medium may be an external drive connected to each of the monitoring servers 31 to 3N as shown in FIG. 2, or may be a unit built in the monitoring servers 31 to 3N.

  The time stamp is given based on the time when synchronization is guaranteed by the NTP server 100. This makes it possible to guarantee a time series between the TRAPs. The TRAP display terminal 200 is also supplied with time information from the NTP server 100, and the time at each of the monitoring servers 31 to 3N and the time at the TRAP display terminal 200 are synchronized with each other by the function of the NTP server 100. Accordingly, processing such as sorting and merging of TRAP data in the TRAP display terminal 200 can be performed while maintaining time-series information.

  FIG. 4 is a flowchart showing a processing procedure in the TRAP display terminal 200. The TRAP display terminal 200 is a personal computer in which dedicated software is installed, for example, and includes a monitor. On the monitor, the result of processing (merging or sorting) the received TRAP is visually displayed. The monitor as the display means may be a built-in display or an external display having only a display function.

  The TRAP display terminal 200 performs polling at a prescribed timing and sets its start time as T. The TRAP display terminal 200 polls the monitoring servers 31 to 3N at this polling timing. The identifiers and addresses of the monitoring servers 31 to 3N to be polled are registered in advance in the TRAP display terminal 200.

  When the TRAP display terminal 200 reaches the polling start time T (step B1), the TRAP display terminal 200 broadcasts TRAP data acquisition requests to the monitoring servers 31 to 3N (step B2) and waits for TRAP data reception (step B3). The monitoring servers 31 to 3 </ b> N transmit the difference from the TRAP data transmitted to the TRAP display terminal 200 last time to the TRAP display terminal 200. That is, the monitoring servers 31 to 3N transmit the TRAP received from the load balancer 4 after the TRAP previously transmitted to the TRAP display terminal 200 to the TRAP display terminal. The TRAP display terminal 200 receives TRAPs sent from all the monitoring servers 31 to 3N and stores them in an internal memory (not shown) (step B4). The TRAP display terminal 200 determines whether or not reception of TRAP from all the monitoring servers 31 to 3N has been completed in this polling (step B5), and repeats step B3 to step B5 until reception is completed.

  When the TRAP reception from all the monitoring servers 31 to 3N is completed in this polling, the TRAP display terminal 200 sorts the received TRAPs using the time stamp of the TRAP data as a key, and has already been acquired by the previous polling. It merges with the already completed TRAP (step B6).

  Next, the TRAP display terminal 200 displays the merged TRAP on the monitor together with time information, that is, a time stamp (display means) (step B7). At that time, for the TRAP having a time stamp older than the time (T−Tp−Δt) obtained by subtracting the fixed delay time Δt and the polling interval Tp from the polling start time T, the fact is distinguished and displayed on the monitor screen. For the distinction, methods such as color coding, blinking, or adding a symbol such as an asterisk (*) are conceivable.

  In a monitoring server that has transmitted excessively delayed TRAP (delayed TRAP), an overload is often generated or a warning of some kind of alarm is indicated. Therefore, the TRAP display terminal 200 displays the server information of the monitoring server together with the delayed TRAP, calls the operator's attention, and waits for the next polling start time (step B8). The delay time Δt can be set to a known amount in advance from the result of monitoring the delay or jitter in the network.

  A delayed TRAP given a time stamp older than the time T-Tp-Δt is considered to indicate an indication of a server malfunction or a server failure accompanying an increase in TRAP received traffic. Therefore, the appropriate state of the monitoring server can be maintained by alerting the operator and giving an opportunity to maintain the monitoring server. For maintenance, it is possible to add or replace a monitoring server.

  In order to increase the number of monitoring servers, for example, the following procedure can be considered. First, an additional monitoring server 3N + 1 is newly installed from the state in which the monitoring servers 31 to 3N are in operation, and this monitoring server 3N + 1 is registered in the TRAP display terminal 200 as a polling target. Then, by registering the monitoring server 3N + 1 also in the load balancer 4, TRAP distribution reception is started, and the addition of the server is completed.

  On the other hand, in order to reduce the number of servers due to a decrease in TRAP reception traffic, the order reverse to the addition may be followed. That is, the registration of the monitoring server to be removed from the load balancer 4 is deleted, and the distribution of TRAP is stopped. Then, by deleting the registration of the monitoring server to be removed from the TRAP display terminal 200, the monitoring server is disconnected from the system and the removal is completed. Server replacement is also possible by removing and adding servers. Monitoring servers that are not subject to expansion, reduction, or replacement can continue to operate during maintenance work, so that the TRAP reception display can be continuously performed on the remaining servers.

  As described above, in this embodiment, the load balancer 4 is provided, and the address (virtual server address) of the TRAP notification destination from the monitored devices 11 to 1n is set in the load balancer 4, thereby the load balancer 4. To capture all TRAP. A plurality of monitoring servers 31 to 3N are provided, and the TRAP is distributed and transferred from the load balancer 4 to these monitoring servers 31 to 3N.

  By doing so, even when the number of monitored devices increases and the TRAP received traffic exceeds the performance of the monitoring server alone, it becomes possible to receive TRAP at any of the plurality of monitoring servers. Moreover, since it is possible to increase the number of monitoring servers while continuing the TRAP reception process, it is possible to sufficiently ensure the expandability of the monitoring system. From these facts, it becomes possible to provide a network monitoring system with enhanced extensibility against an increase in TRAP reception traffic.

  Further, the monitored device may issue a TRAP addressed to a single virtual server address. In other words, no matter how many monitoring servers are used, there is only one TRAP transmission destination from the viewpoint of the monitored device. Therefore, the process of rewriting the destination address for each TRAP is not necessary, and the process of the monitored apparatus can be reduced. Since the operator does not need to set a plurality of TRAP destination addresses in the monitored apparatus, setting errors can be prevented and a troublesome operation is not required.

  It should be noted that the present invention can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. In addition, various inventions can be formed by appropriately combining a plurality of components disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment.

1 is a system diagram showing an embodiment of a network monitoring system according to the present invention. The block diagram which shows the principal part of the system of FIG. The schematic diagram which shows an example of the TRAP data accumulate | stored in database DB1-DBN. The flowchart which shows the process sequence in the TRAP display terminal 200.

Explanation of symbols

  NW: Network, 11-1n: Monitored device, 2: Router, 4: Load balancer, 31-3N: Monitoring server, 100: NTP server, 200: TRAP display terminal, DB1-DBN: Database

Claims (4)

In a network monitoring system using SNMP (Simple Network Management Protocol),
A plurality of monitored devices that issue TRAP to a specific address;
A distribution device that is assigned the specific address and that receives the TRAP issued from the plurality of monitored devices and then distributes the TRAP to any one of a plurality of destination addresses; and
A plurality of storage means for receiving and storing the TRAP assigned to the destination address individually and transferred from the distribution device;
A network monitoring system comprising: a processing terminal that acquires and processes the stored TRAP from the plurality of storage means. And a time synchronization server for synchronizing the time at each of the plurality of storage means and the time at the processing terminal,
The plurality of storage means give a time stamp to the received TRAP based on the time synchronized by the time synchronization server,
The network monitoring system according to claim 1, wherein the processing terminal merges the acquired TRAP and the already acquired TRAP based on the time stamp.   The network monitoring system according to claim 2, further comprising display means for displaying the merged TRAP. The processing terminal determines an excessively delayed delay TRAP based on the time stamp,
4. The network monitoring system according to claim 3, wherein the display unit displays the delayed TRAP and other TRAPs while distinguishing them.

Images