JP2010086097A - Network monitoring device, and network monitoring method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a network monitoring device that outputs reliable ones of error information transmitted from network elements constituting a hierarchical network, so as to be easily noticed by a manager. <P>SOLUTION: In hierarchical network element information, identification information on each of the network elements of a communication network configured of a plurality of hierarchical network elements is associated with identification information on the network elements in another layer adjacent to the network elements. The hierarchical network element information is compared with identification information on the network elements of a transmission source of a plurality of error information received from the network elements. The error information transmitted from the network elements at the highest layer among the plurality of networks elements which have transmitted the error information is detected and output. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a network monitoring apparatus and a network monitoring method for monitoring the states of a plurality of network elements constituting a hierarchical communication network.

  2. Description of the Related Art Conventionally, network systems configured to remotely communicate with network elements such as switches, routers, and hosts that constitute an IP (Internet Protocol) network and network devices such as computer devices and monitor the status of the network elements have been used. ing.

  For example, FIG. 11 shows a router 401, a router A 402, a router E 409 connected under the router 401, a router B 403, a router C 404,... Connected under the router 401, and a server A 406 connected under the router A 403, respectively. FIG. 2 is a diagram illustrating a network system that monitors an IP network configured by network elements such as server B407,... For example, the network monitoring apparatus 500 periodically transmits a request for information acquisition to the network element at intervals of 5 minutes based on ICMP (Internet Control Message Protocol) or SNMP (Simple Network Management Protocol). If any abnormality has occurred when such an information acquisition request is received, the network element transmits error information indicating that the abnormality has occurred as a response. The network monitoring apparatus 500 stores and accumulates the received error information as an error list. In addition to error information transmitted as a response to the information acquisition request, the error information acquired by the network monitoring device 500 includes error information when the network element does not respond to the information acquisition request and times out, There is error information called an SNMP trap that an element sends spontaneously and notifies its change when an abnormality occurs in the element. The client terminal 600 connected to the network monitoring apparatus 500 reads out and displays the error list stored in the network monitoring apparatus 500. As a result, the administrator of the network system can know the abnormality that has occurred in the network element that constitutes the network by looking at the error list displayed on the client terminal 600, and can appropriately detect and recover from the failure at an early stage. Treatment can be performed.

In Patent Literature 1, when an error is transmitted to a monitoring device that monitors a plurality of computer devices, the monitoring device that receives the error is monitored by masking and transmitting an error that has occurred artificially during a maintenance test. There has been proposed a technique for preventing a monitoring person from performing a recovery procedure or the like based on an error generated artificially by a maintenance test or the like.
JP-A-4-213246

  However, when monitoring the status of network elements using the communication protocol as described above, especially when the number of network elements to be monitored becomes large, a large amount of error information is accumulated in the network monitoring device when an error occurs, and network element abnormalities are detected. In some cases, it is difficult to efficiently respond to the problem.

  For example, consider a case in FIG. 11 where the network monitoring device 500 polls an ICMP packet with a Ping command for each network element. For example, when the ICMP packet transmitted from the network monitoring device 500 is determined not to have communication reachability by the router A 402 and error information is returned, the router B 403, the router C 404, the router D 405 connected under the router A 402, Error information is also returned to ICMP packets directed to network elements such as server A 406, server B 407, and server C 408. For this reason, even when only the router A 402 has an error, error information is transmitted to the network monitoring device 500 from all the network elements connected to the router A 402, and a large amount of error information is stored. It becomes.

  At this time, error information other than the router A 402 out of a large amount of error information transmitted to the network monitoring device 500 is transmitted regardless of whether or not an error has occurred in the network element. It may be a noise for a person. For this reason, it may not be possible to efficiently identify the network element in which the error occurred, or unnecessary recovery measures may be taken for the network element in which the error has not occurred, and prompt response to the error that has occurred should be performed efficiently. It becomes difficult.

  The present invention has been made in view of such a situation, and error information that is considered to have a high possibility that an error has actually occurred among error information transmitted from network elements constituting a hierarchical network. A network monitoring device that outputs information so that an administrator can easily find it.

  In order to solve the above-described problems, the present invention is a network monitoring apparatus that monitors a network element of a communication network including a plurality of layered network elements and receives error information transmitted from the network element. A network element information storage unit for storing network element information of a hierarchical structure in which identification information of each of a plurality of network elements is associated with identification information of network elements of other layers adjacent to the network element; The network element identification information of the transmission source of the plurality of error information received from the network element is compared with the network element information stored in the network element information storage unit, and a plurality of error information is transmitted. The error information that is the highest in the hierarchy among the original network elements is transmitted from the highest-level network element detection unit that detects the identification information of the source network element and the highest-level network element detected by the highest-level network element detection unit And an error output unit for outputting the error information.

  In addition, the present invention provides a construction network element identification information storage unit that stores identification information of a network element under construction among a plurality of network elements, and an error output unit that is detected by the highest network element information detection unit. It is determined whether or not the identification information of the upper network element is stored in the construction network element storage unit, and if it is determined that it is stored, the error information transmitted from the uppermost network element is not output. Features.

  In the present invention, the highest-order network element detection unit is associated with identification information of a network element that is a transmission source of error information to be processed among a plurality of error information received from a plurality of network elements. The identification information of the network element in the hierarchy is read from the network element information, and the higher-level network element search process is performed to determine whether or not the error information having the transmission source of the network element in the upper hierarchy is received. In this case, the identification information of the network element that is the transmission source of the error information is detected as the identification information of the uppermost network element.

  Further, according to the present invention, when the highest-level network element detection unit determines in the higher-level network element search process that the error information having the network element at the upper layer as the transmission source is received, the error information to be processed is checked. When other error information is processed, it is determined whether the other error information is checked. If it is determined that the other error information is added, the other error information is the highest level network element. It is characterized in that other error information is targeted for processing on the assumption that the error information is not the transmission source.

  In addition, the present invention provides a hierarchy in which each identification information of a network element of a communication network configured by a plurality of layered network elements is associated with identification information of a network element in another hierarchy adjacent to the network element A network monitoring method by a network monitoring device that includes a network element information storage unit that stores network element information of a structure and receives error information transmitted from the network element, the plurality of error information received from a plurality of network elements The identification information of the network element that is the transmission source of the network element is compared with the network element information stored in the network element information storage unit, and the error information is transmitted to the plurality of network elements. Detecting the identification information of the network element to be uppermost in the hierarchy, characterized in that it comprises the steps of outputting the error information transmitted from the network element the uppermost detected.

  As described above, according to the present invention, the identification information of each network element of a communication network constituted by a plurality of layered network elements, and the identification information of network elements in other layers adjacent to the network element, Is compared with the network element information of the hierarchical structure in which the error information is received and the identification information of the network element that is the transmission source of the plurality of error information received from the network element. The error information transmitted from the network element of the layer of the above is detected and output, so the cause of the error that occurred among the multiple pieces of error information transmitted from the network elements that make up the hierarchical communication network Become It is possible to output the error information transmitted from the network element likely uppermost hierarchy are.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram showing an overview of a network system 1 according to the present embodiment. The network system 1 according to the present embodiment is connected to the router 101, the router A102 and the router E109 connected to the router 101, the router B103, the router C104,. Connected to the network monitoring apparatus 200, the network monitoring apparatus 200 that monitors each network element, and the IP network (a) having a hierarchical structure including the server A106, the server B107,. A client terminal 300. Hereinafter, when each of the above-described network elements is not individually specified, it will be described as NE (network element) 100. Here, in the hierarchical structure of the NE 100 in the IP network (a), the router 101 close to the network monitoring device 200 is higher, and the server A 106, server B 107, server C 108, server D 113, server E 114, and server F 115 are lower.

  The plurality of NEs 100 are network elements such as network devices such as switches, routers, and host servers, and computer devices that constitute the IP network (a). The NE 100 receives and responds to an information acquisition request based on SNMP or ICMP transmitted from the network monitoring apparatus 200. Here, if an error has occurred in the NE 100, the NE 100 transmits error information in response to the received information acquisition request. The error information includes information such as identification information of NE 100 itself and error contents. The identification information of the NE 100 is, for example, an IP address. In addition to the error information transmitted as a response to the information acquisition request, the error information acquired by the network monitoring device 200 includes error information when the NE 100 does not respond to the information acquisition request and the response times out. The NE 100 has error information called an SNMP trap that is transmitted spontaneously when an abnormality occurs in the NE 100 and notifies its own change.

  The network monitoring device 200 is a computer device that performs polling of an information acquisition request to the NE 100 determined as a monitoring target and monitors the state of the NE 100. When the network monitoring apparatus 200 receives error information in response to the information acquisition request transmitted to the NE 100 to be monitored, the network monitoring apparatus 200 stores and accumulates the received error information as an error list. FIG. 2 is a diagram illustrating a detailed configuration of the network monitoring apparatus 200. The network monitoring apparatus 200 includes a polling execution unit 210, an error list generation unit 220, an NE information storage unit 230, a construction list storage unit 240, an NG list generation unit 250, and an NG list transmission unit 260. .

  The polling execution unit 210 performs polling by sending an information acquisition request based on ICMP or SNMP to a predetermined NE 100 as its monitoring target at a predetermined time interval, and receives a response to the transmitted information acquisition request To do. Here, the time interval for polling is, for example, a 5-minute cycle.

  When the error execution unit 210 receives error information as a response to the information acquisition request transmitted from the polling execution unit 210 to the NE 100, the error list generation unit 220 accumulates the error information received by the polling execution unit 210 in its own storage area, and stores a plurality of errors. Generate an error list containing information. FIG. 3 is a diagram illustrating a data example of error information included in the error list generated by the error list generation unit 220. The error information included in the error list includes identification information of the NE 100 that is the error transmission source and information such as error contents. In FIG. 3, as a response to the information acquisition request from the polling execution unit 210, error information is detected from the router E109, the router D105, the router C104, the router B103, and the router A102. An example is shown.

  Returning to FIG. 2, the NE information storage unit 230 stores NE information in which the identification information of each NE 100 configuring the IP network (a) is associated with the information of other NEs 100 adjacent to the NE 100. The FIG. 4 is a diagram illustrating a data example of NE information stored in the NE information storage unit 230. The NE information includes information such as an IP address, an IF (interface) list, and neighboring NE information in association with the NE identification information. The NE identification information is information for identifying the NE 100 that is the monitoring target of the network monitoring apparatus 200 and constitutes the IP network (a). The IP address is information indicating the IP address of the corresponding NE 100.

  The IF list included in the NE information is information indicating an IP address for each interface when the corresponding NE 100 is a router or the like and has an interface connected to another NE 100. In the example of FIG. 4, the router A102 has three interfaces IF1, IF2, and IF3, and the IP addresses are “10.1.1.1” and “10.1.1.2”. , “10.1.1.3”. The adjacent NE information is information indicating identification information of other NEs 100 connected to the interface. In the example of FIG. 4, router B (10.1.1.30) is connected to IF1 (10.1.1.1), and router C (10.1.1.1.2) is connected to IF2 (10.1.1.2). 10.1.1.40) is connected, and “END” indicating that another NE 100 is not connected is associated with IF3. FIG. 5 is a diagram showing a concept of a connection state of the router A102 shown in FIG. As shown in FIG. 5, the IP address of the router A102 is “192.168.X.X” and includes three interfaces IF1, IF2, and IF3. The IP address of IF1 is “10.1.1.1” and the router B103 is connected.

  Returning to FIG. 2, the construction list storage unit 240 stores a list of identification information of the NEs 100 under construction among the NEs 100 constituting the IP network (a). FIG. 6 is a diagram illustrating an example of construction list data stored in the construction list storage unit 240. The NE100 of identification information included in the construction list is performing maintenance tests, software updates, etc. and is under construction, so the network is artificially disconnected, or error information for testing is transmitted. There is. For this reason, the error information transmitted from the NE 100 included in the construction list is not generated due to an unexpected error, and it is considered less likely that the client terminal 300 notifies the administrator who monitors the NE 100 of the occurrence of the error. . Here, the construction list stored in the construction list storage unit 240 may be stored in advance, or identification information may be added or deleted according to operation information input from the administrator and stored. Anyway.

  Returning to FIG. 2, the NG list generation unit 250 generates the error list generated by the error list generation unit 220 based on the NE information stored in the NE information storage unit 230 and the construction list stored in the construction list storage unit 240. NG list in which error information that is considered to have a high possibility of an actual error is extracted based on a predetermined condition. For example, the NG list generation unit 250 reads out the error transmission source of the error information included in the error list generated by the error list generation unit 220 and the NE information stored in the NE information storage unit 230 to obtain an error information error. The upper NE 100 of the transmission source is detected.

  Here, when error information is transmitted from a plurality of NEs 100 adjacent to each other and stored in the error list, the highest NE 100 in the hierarchy of the IP network (a) causes an error that causes the plurality of error information. It is thought that. Therefore, the NG list generation unit 250 extracts error information transmitted from the highest NE 100 among a plurality of error information included in the error list, and generates an NG list.

  In addition, the NG list generation unit 250 deletes the error information transmitted from the NE 100 included in the construction list from the extracted error information. The error information transmitted from the NE 100 that is known to be under construction is considered to be unlikely to be promptly handled by an administrator who remotely monitors the NE 100 using the client terminal 300. is there. For example, FIG. 7 is a diagram showing an example of the NG list generated by the NG list generation unit 250 based on the error list shown in FIG. 3, the NE information shown in FIG. 4, and the construction list shown in FIG. It is. Here, from the error list shown in FIG. 3 and the NE information shown in FIG. 4, router A and router E are extracted as the highest NE 100, router E is deleted from the construction list, and an error has occurred. An NG list in which the router A is indicated as the NE 100 having a high possibility is generated.

  The NG list transmission unit 260 transmits the NG list generated by the NG list generation unit 250 in response to a request. In the present embodiment, the NG list transmission unit 260 has a web service function, performs communication with the client terminal 300 using HTTP (HyperText Transfer Protocol) or the like, and responds to a transmission request received from the client terminal 300. The NG list is transmitted to the client terminal 300.

  Returning to FIG. 1, the client terminal 300 is a computer terminal that displays the identification information of the NE 100 to which the error information is transmitted among the monitored NEs 100. For example, the client terminal 300 includes a web browser, communicates with the network monitoring apparatus 200, and outputs an NG list transmitted from the network monitoring apparatus 200 to a display included in the client terminal 300. FIG. 8 is a diagram illustrating an example of an abnormality notification monitoring screen output on the display of the client terminal 300. The abnormality notification monitoring screen displays, for example, the occurrence date and time when an abnormality occurred in the NE 100, the abnormality notification message included in the abnormality notification, the IP address of the NE 100 that transmitted the abnormality notification, and the like. In addition, the NE 100 host name or the like may be displayed.

  Next, an operation example in which the network system 1 generates an NG list will be described with reference to FIG. First, the polling execution unit 210 of the network monitoring apparatus 200 transmits an information acquisition request to each NE 100 configuring the IP network (a). The error list generation unit 220 of the network monitoring apparatus 200 generates an error list including the error information received as a response to the information acquisition request transmitted by the polling execution unit 210 (step S1).

  The NG list generation unit 250 reads one piece of error information to be processed from the error list generated by the error list generation unit 220 (step S2). Here, in the present embodiment, a check is added to error information that has been subjected to the search processing from step S4 to step S6 described below. For example, as shown in FIG. 10, a check flag is assigned to each piece of error information included in the error list, and “0” is set in the initial state. When error information search processing is performed, the check flag given to the error information is set to “1”. As a result, it is possible to prevent redundant search processing for error information that has already been searched, and to reduce processing time.

  Returning to FIG. 9, the NG list generation unit 250 determines whether or not the check flag of the error information read out as the processing target in step S2 is “1” (step S3). If the NG list generation unit 250 determines that the check flag of the error information to be processed is “1” (step S3: YES), the process proceeds to step S10. On the other hand, if the NG list generation unit 250 determines that the check flag of the error information to be processed is “0” (step S3: NO), the NE identification information corresponding to the error transmission source of the error information to be processed is It is determined whether it is included in the construction list stored in the construction list storage unit 240 (step S4).

  When the NG list generation unit 250 determines that the NE identification information corresponding to the error transmission source of the error information to be processed is included in the construction list (step S4: YES), the process proceeds to step S10. On the other hand, if the NG list generation unit 250 determines that the NE identification information corresponding to the error transmission source of the error information to be processed is not included in the construction list (step S4: NO), the NE information storage unit 230 stores the NE identification information. With reference to the NE information, it is determined whether there is a higher order NE of the NE 100 that is the transmission source of the error information to be processed (step S5).

  If the NG list generation unit 250 determines that there is no higher order NE of the NE 100 that is the transmission source of the error information to be processed (step S5: NO), the process proceeds to step S9. On the other hand, when the NG list generation unit 250 determines that there is a higher order NE of the NE 100 that is the transmission source of the error information to be processed (step S5: YES), it determines whether the higher order NE is included in the error list. (Step S6).

  If the NG list generation unit 250 determines that the upper NE of the NE 100 to be processed is not included in the error list (step S6: NO), the process proceeds to step S9. In this case, since it is considered that no error information has occurred in the NE higher than the processing target NE, the NG list generation unit 250 stores and accumulates error information corresponding to the processing target NE as an NG list ( Step S9). Then, the NG list generation unit 250 determines whether or not search processing has been performed for all error information included in the error list (step S10).

  If the NG list generation unit 250 determines that all error information included in the error list has been searched (step S10: YES), the NG list transmission unit 260 uses the NG list generated by the NG list generation unit 250 as a client. It transmits to the terminal 300 (step S11). The client terminal 300 displays the received NG list on the display. The monitor who monitors the IP network (a) by the client terminal 300 is transmitted from the NE 100 that caused the error among the NEs 100 that transmitted the error information by looking at the error list displayed on the client terminal 300. You can know only the error information.

  On the other hand, when the NG list generation unit 250 determines in step S6 that the upper NE of the NE 100 that is the transmission source of the error information to be processed is included in the error list (step S6: YES), the NG list generation unit 250. Sets “1” to the check flag corresponding to the error information of the processing target NE included in the error list (step S7). Then, the NG list generation unit 250 reads out the error information having the NE determined as the processing target upper NE in step S5 as the transmission source from the error list as the processing target error information (step S8), and returns to step S3.

  The work list stored in the work list storage unit 240 of the network monitoring device 200 may be stored in the client terminal 300 in advance and displayed on the client terminal 300 to notify the administrator, or the network monitoring device 200. To the client terminal 300.

  As described above, according to the present embodiment, the network monitoring apparatus 200 only includes error information transmitted from the highest NE 100 that caused an error among error information transmitted from the NE 100 included in the IP network (a). Can be transmitted to the client terminal 300. Accordingly, the client terminal 300 can prevent the error information transmitted from all of the lower NEs from being displayed based on the error of the upper NE. As a result, the administrator who monitors the status of the IP network (a) based on the error information displayed on the client terminal 300 efficiently identifies the NE 100 in which the error has occurred, and an unnecessary recovery procedure for the NE 100 in which no error has occurred. It is possible to efficiently deal with the error that has occurred without performing the error.

  The program for realizing the function of the processing unit in the present invention is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into the computer system and executed to monitor the network. You may go. The “computer system” here includes an OS and hardware such as peripheral devices. The “computer system” includes a WWW system having a homepage providing environment (or display environment). The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.

  The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

It is a figure which shows the structure of the network system by one Embodiment of this invention. It is a block diagram which shows the structure of the network monitoring apparatus by one Embodiment of this invention. It is a figure which shows the example of data of the error list produced | generated by one Embodiment of this invention. It is a figure which shows the data example of NE information memorize | stored in the NE information storage part by one Embodiment of this invention. It is a figure which shows the concept of adjacent NE in one Embodiment of this invention. It is a figure which shows the example of data of the construction list memorize | stored in the construction list memory | storage part by one Embodiment of this invention. It is a figure which shows the example of data of the NG list produced | generated by one Embodiment of this invention. It is a figure which shows the example of the monitoring screen displayed on a client terminal by one Embodiment of this invention. It is a figure which shows the operation example of the network system by one Embodiment of this invention. It is a figure which shows the example of data to which the check flag was provided to the error list produced | generated by one Embodiment of this invention. It is a figure which shows the structure of the network system by a prior art.

Explanation of symbols

1 Network system 100 NE
200 Network Monitoring Device 210 Polling Execution Unit 220 Error List Generation Unit 230 NE Information Storage Unit 240 Construction List Storage Unit 250 NG List Generation Unit 260 NG List Transmission Unit 300 Client Terminal

Claims (5)

A network monitoring device that monitors the network element of a communication network constituted by a plurality of layered network elements and receives error information transmitted from the network element,
A network element information storage unit that stores network element information of a hierarchical structure in which identification information of each of the plurality of network elements is associated with identification information of network elements of other layers adjacent to the network element;
The identification information of the network element that is the source of the plurality of error information received from the plurality of network elements is compared with the network element information stored in the network element information storage unit, and a plurality of the error information A highest-level network element detection unit that detects identification information of the network element that is the transmission source of the error information that is highest in the hierarchy among the transmission-source network elements;
An error output unit that outputs the error information transmitted from the highest-level network element detected by the highest-level network element detection unit;
A network monitoring device comprising: Among the plurality of network elements, a construction network element identification information storage unit in which identification information of the network element under construction is stored;
The error output unit determines whether or not the identification information of the highest-level network element detected by the highest-level network element information detection unit is stored in the construction network element storage unit. The network monitoring device according to claim 1, wherein if it is determined, the error information transmitted from the uppermost network element is not output. The highest-order network element detection unit is configured such that, of the plurality of error information received from the plurality of network elements, the upper layer associated with the identification information of the network element that is the transmission source of the error information to be processed When the network element identification information is read out from the network element information, the higher-level network element search process is performed to determine whether or not the error information having the network element of the upper layer as a transmission source is received, 3. The network monitoring device according to claim 1, wherein when the determination is made, identification information of a network element that is a transmission source of the error information is detected as identification information of the highest-level network element. When the uppermost network element detection unit determines in the upper network element search process that the error information having the higher layer network element as a transmission source has been received, the error information to be processed is checked. When the other error information is to be processed, it is determined whether or not the check is given to the other error information. When it is judged that the other error information is given, the other error information is The network monitoring apparatus according to claim 3, wherein not the error information whose source is the highest-level network element but the other error information is the processing target. A network element having a hierarchical structure in which identification information of each of the network elements of a communication network configured by a plurality of layered network elements is associated with identification information of network elements in other layers adjacent to the network element A network monitoring method by a network monitoring device comprising a network element information storage unit for storing information and receiving error information transmitted from the network element,
The error information is transmitted by comparing the identification information of the network element that is the source of the plurality of error information received from the plurality of network elements with the network element information stored in the network element information storage unit. Detecting the identification information of the highest network element in the hierarchy among the plurality of network elements,
Outputting the error information transmitted from the detected top-level network element;
A network monitoring method comprising:

Images