JP2012003651A - Virtualized environment motoring device, and monitoring method and program for the same - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce wrong detection of troubles in monitoring a virtualized environment and to efficiently conduct a process of monitoring in a virtualized computer system.SOLUTION: In a monitoring process, a monitoring control/information scrutiny unit 111 collects operating state information at prescribed intervals from a host machine and a virtual machine constituting a virtualized system, and stores the collected information if any of the machines is found normal or, if any is found abnormal, information on the machine determined by an unnecessary information DB 115 as needing no action into a scrutiny information DB 116; an action executing/additional operation executing unit 112 executes a trouble remedy for the machine found in need of remedy, and stores the result of execution, augmented with the pertinent abnormal state information, into the scrutiny information DB 116; and a report preparation unit 113, when preparing a monitoring result report on the pertinent machine by using the scrutiny information stored in the scrutiny information DB 116, references vulnerability information DB 119, checks the application status of batch processing on each machine, and adds the findings to the report.

Description

  The present invention relates to a technique for monitoring the operation of a computer system, and more particularly to efficiently monitor a pseudo server environment using a virtualization technique and an operating state of a server computer main body that provides the pseudo server environment. It relates to a suitable technique.

  Computer virtualization technology is a technology that makes a single physical resource look like multiple logical resources, or makes multiple physical resources look like a single logical resource. There are server virtualization that makes it look like a server, or storage virtualization that handles multiple storage like a single storage.

  As a conventional technique for monitoring such a virtual environment and performing vulnerability detection, for example, there is a technique described in Patent Document 1.

  In the technology described in Patent Document 1, a hardware environment independent of the operating environment of the main OS (Operating System) and AP (Application) is created only by software technology without requiring special hardware. Operating the OS and AP with the monitoring function in the hardware environment, monitoring and restarting, and utilizing the real-time property of the independent hardware environment, storing the fault information and information to the outside through lines etc. Realize monitoring and restart by contact or external instructions to improve computer system reliability and provide system management functions.

  Specifically, an OS 2 that uses a multi-OS configuration function implemented by software in which multiple OSs operate in an environment in which hardware resources are independent on one CPU (Central Processing Unit) monitors the OS 1. By providing the means, the means by which the OS 2 restarts the OS 1, and the system management function for controlling them, the OS is monitored and restarted, and the reliability of the apparatus and the system is improved.

  However, in recent virtualization technologies, there are cases where two or more virtual machines are mounted on one host, and it is necessary to take into account the monitoring technology and load status accompanying the increase in the number of hosts. In addition, it is necessary to consider the failure of the device (host machine) that hosts the virtual machine. Therefore, the conventional technique has the following problems.

  For example, in the technique described in Patent Document 1, a plurality of OSs on one host are configured to monitor each other's host (OS), and it is necessary to consider a monitoring method when three or more OSs are installed. Become. In addition, with the increase in the number of units, the configuration in which the monitoring program is executed on the host and the monitoring status of another host is always maintained increases the load on hardware resources due to the balance between the workload and normal business operations. May be affected.

  In addition, when a hardware failure that executes multiple OSs occurs, there is a possibility that all installed OSs may be affected by errors, etc., and information scrutiny is required on the monitoring system, and the time required for scrutiny of information each time. May not be able to respond quickly.

JP 2001-101034 A

  The problem to be solved is that in the conventional monitoring processing technology in a computer virtualization environment, when three or more virtual machines are mounted on one host, the load on hardware resources due to the monitoring processing increases. Efforts to build a monitoring system and set monitoring items, including the fact that the impact on normal general work cannot be avoided and the installation of servers and agents used for monitoring processing and the separation of detection contents of the monitoring system In other words, it is not possible to minimize the error, and it is impossible to promptly respond to a failure that occurs in the hardware (host) that executes the virtual machine.

  It is an object of the present invention to solve these problems of the prior art by incorporating an operation unique to virtualization as a response operation at the time of failure, to reduce erroneous detection of failure in monitoring of a virtual environment, and to a virtualized computer It is possible to efficiently perform the monitoring process in the system.

  In order to achieve the above object, in the present invention, the detection contents of the detection contents are conventionally considered in consideration of the fact that it takes a lot of man-hours including the separation of the detection contents of the monitoring system in daily operation work and the installation of agents. Focusing on monitoring and agent installation-less monitoring environments, searching for solutions to these issues and adopting a unique countermeasure in virtual environments, , Unnecessary elimination of monitoring information in virtual host / virtual machine, advance operation based on monitoring result (automatic backup / restore / move between hosts), vulnerability information check of monitored machine after monitoring operation, and monitoring It is characterized by having a function to report the results and vulnerability check results. Specifically, along with the operating status of the pseudo server environment that uses virtualization technology, the operating status of the server itself that provides the pseudo server environment is monitored, detected if there is a problem, automatically recovered, and then In order to collect vulnerability information, the virtualization environment monitoring apparatus of the present invention includes first to third processing means as means for executing programmed computer processing, and includes first processing means (monitoring control). / Information review unit 111) collects information indicating the operating state of the machine at predetermined intervals from the host machine constituting the virtualization system and the virtual machine formed by the host machine. Is information indicating the normal state of the machine, the normal state information is stored as scrutiny information in the storage device (scrutiny information DB 116), and the collected information is stored in the machine. If it is information indicating an abnormal state of the machine, refer to unnecessary information that is defined in advance for each machine and stored in the storage device (unnecessary information DB 115) and indicates whether or not a countermeasure for the failure of the machine is necessary. The abnormal state information of the machine that has been made unnecessary is stored as scrutinization information in the storage device (scrutiny information DB 116), and the second processing means (countermeasure execution / additional operation execution unit 112) requires countermeasures in the unnecessary information. A failure process including automatic backup / restoration and migration between hosts prepared in advance corresponding to the abnormal state is executed for the machine, and the execution result is added to the abnormal state information as a scrutinizing information storage device ( Scrutinizing information DB 116), and in the third processing means (report creation unit 113), the first processing means (monitoring control / information scrutinizing part 111) and the second processing means. With scrutiny information stored in the storage device (examination information DB 116) by measures run / adding operation execution unit 112), to create a monitoring report regarding the machine. Note that the third processing means (report creating unit 113) is information defined for software executed on each machine in advance and stored in the storage device (vulnerability information DB 119) indicating information on the vulnerability of the software ( Vulnerability information) to obtain vulnerability check result information indicating the application status of patch processing to the vulnerability information on each machine, obtain vulnerability check result information on each machine, and scrutiny information on the machine Create a report consisting of

  ADVANTAGE OF THE INVENTION According to this invention, the automatic response | compatibility of a virtual environment (invisible server) can be easily performed by the monitoring process incorporating the countermeasures peculiar to virtualization in a virtual environment. In addition, with the monitoring function, it is possible to minimize the number of man-hours for construction and monitoring, including server / agent installation and separation of detection contents of the monitoring system. Furthermore, because the cause of detection may be due to vulnerability, it is possible to easily investigate the relationship between the failure content and the vulnerability using the monitoring result.

It is a block diagram which shows the structural example of the virtual environment monitoring system which concerns on this invention. It is a flowchart which shows the processing operation example of the supervisory control / information examination part in FIG. 2 is a flowchart showing an example of processing operation of a countermeasure execution / addition operation execution unit in FIG. It is a flowchart which shows the processing operation example of the report preparation part in FIG. It is explanatory drawing which shows the detailed example of the monitoring script in FIG. It is explanatory drawing which shows the detailed example of the countermeasure script in FIG. It is explanatory drawing which shows the 1st detailed example of the additional countermeasure script in FIG. It is explanatory drawing which shows the 2nd detailed example of the additional countermeasure script in FIG. It is explanatory drawing which shows the 3rd detailed example of the additional countermeasure script in FIG. It is explanatory drawing which shows the detailed structural example of unnecessary information DB in FIG. It is explanatory drawing which shows the detailed structural example of scrutiny information DB in FIG. It is explanatory drawing which shows the detailed structural example of vulnerability information DB in FIG.

  Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings. In FIG. 1, 101 is a management terminal, 103 and 107 are host machines, 110 is a virtual environment monitoring server as a virtual environment monitoring apparatus according to the present invention, 121 is an SMTP server, and each includes a CPU and a main memory. , A computer device composed of a display device, an input device, an external storage device, etc., after installing a program or data recorded in a storage medium such as a CD-ROM into the external storage device via an optical disk drive device, etc. The programmed computer processing is executed by reading from the external storage device into the main memory and processing by the CPU.

  For example, the host machines 103 and 107 have Power Shells 104 and 108 and WMI 105 and 109 as functions for executing programmed computer processing, and use Hyper-V (registered trademark) which is a Microsoft (registered trademark) program. The virtual machines 102 and 106 are configured.

  The virtual environment monitoring server 110 includes a virtual environment monitoring system 120 as a function for executing programmed computer processing. The virtual environment monitoring system 120 includes a monitoring control information review unit 111, countermeasure execution / An additional operation execution unit 112 and a report creation unit 113 are provided, and these processing functions store the monitoring script 114, unnecessary information DB 115, scrutiny information DB 116, countermeasure script 117, additional countermeasure script 118, vulnerability information DB 119, and the like. The monitoring process as the virtual environment monitoring apparatus according to the present invention is executed.

  That is, the virtual environment monitoring server 110 includes the host machines 103 and 107 constituting the virtual system and the virtual machine 102 formed by the host machines 103 and 107 by the monitoring control information review unit 111 in the virtual environment monitoring system 120. , 106 at a predetermined interval, information indicating the operating status of the machines 102, 103, 106, 107 is collected, and the collected information is information indicating the normal status of the machines 102, 103, 106, 107. If there is, the normal state information is stored in the scrutiny information DB 116 as scrutiny information, and if the collected information is information indicating the abnormal state of the machines 102, 103, 106, 107, each machine 102, 103, The machine defined in 106 and 107 and stored in the unnecessary information DB 115 Referring to unnecessary information indicating the necessity of countermeasures for failures 02, 103, 106, and 107, the abnormal state information of the machines 102, 103, 106, and 107 for which countermeasures are unnecessary is stored in the scrutiny information DB 116 as scrutiny information. .

  For a machine in an abnormal state that is not defined in the unnecessary information DB 115, that is, a machine that requires countermeasures, the virtual environment monitoring server 110 uses the countermeasure execution / additional operation execution unit 112 in the virtual environment monitoring system 120. Then, failure processing including automatic backup / restoration and migration between hosts prepared in advance corresponding to the abnormal state is executed, and the execution result is added to the abnormal state information and stored in the inspection information DB 116 as inspection information.

  Thus, in this example, monitoring without agent installation and unnecessary failure processing for the host machines 103 and 107 and the virtual machines 102 and 106 are eliminated in advance, and only necessary failure processing is executed.

  Further, the virtual environment monitoring server 110 uses the scrutiny information stored in the scrutiny information DB 116 by the monitoring control information scrutinizing unit 111 and the countermeasure execution / additional operation executing unit 112 by the report creating unit 113 in the virtual environment monitoring system 120. Thus, a monitoring result report regarding the machines (host machines 103 and 107 and virtual machines 102 and 106) is created. At this time, the report creating unit 113 preliminarily defines the software executed on each machine (102, 103, 106, 107) and stores information (vulnerability) of the software stored in the vulnerability information DB 119. Property information) to obtain vulnerability check result information indicating the application status of patch processing to the vulnerability information on each machine, and obtain vulnerability check result information on each machine, scrutiny information on the machine, Create a report consisting of

  As described above, in this example, the vulnerability of the managed machine defined in advance is checked, and the vulnerability information is added to the monitoring result to generate the monitoring result report.

  The report created in the virtual environment monitoring server 110 in this way is transmitted to the management terminal 101, displayed on the management terminal 101, and notified to the administrator. Alternatively, the report is transmitted to a predetermined mail address via the SMTP server 121.

  The unnecessary information that is stored in the unnecessary information DB 115 and indicates the necessity of countermeasures against the failure of each machine includes an error source, an event ID, an item ID 115a, and a data example 115b in FIG. It consists of items such as error contents, host name, virtual host name, etc. The error source name (event log, application system, etc.) is recorded in the error source item, and "status code" when recording the virtual machine status In the event ID field, the event ID is recorded. When the virtual machine state is recorded, the output status code is recorded. In the error content item, the error output content is recorded, and the host name is recorded. Record the host name of the error target host recorded in the item, and item 4 (host name) is the virtual machine name in the virtual host name item. In the case of, to record the virtual host name that is installed.

  Further, as the scrutinization information stored in the scrutiny information DB 116 and indicating the operating state of each machine, as shown in the item description 116a and the data example 116b in FIG. 11, virtual hosts (host machines 103 and 107), The host name and IP address information set on the OS of the virtual machine (102, 106), the host name of the virtual host on which the virtual machine is operating, the number of CPU cores mounted on the virtual host or virtual machine, virtual Physical memory capacity (MB) installed in the host or virtual machine, total disk capacity (GB / MB) installed in the virtual host or virtual machine, CPU usage rate used by the virtual host or virtual machine, Memory usage rate used by virtual hosts and virtual machines, disk usage rate used by virtual hosts and virtual machines, and error occurrence status Error flag (ON / OFF), error information that records the error outline that was detected when the error occurred (flag ON), countermeasure information that describes the countermeasures taken when the error occurred (flag ON), virtual host and virtual machine Status information (records status such as normal operation, error countermeasure completed, error present, and stopped), and whether to use the SMTP notification function for monitored virtual hosts and virtual machines Flags (set to ON when using SMTP, set to OFF otherwise), and the like.

  In addition, vulnerability information that is defined in advance for software executed on each machine (102, 103, 106, 107) and stored in the vulnerability information DB 119 and that indicates the vulnerability of the software, As shown in the item description 119a and the data examples 119b and 119c in FIG. 12, it includes items such as a KB number, vulnerability information, a target OS (version), a target application, a download URL, and the like. The patch number provided by the registered trademark is registered, the vulnerability information item is registered with an outline of the vulnerability, and the target OS (version) item is the version of the OS to be patched. The information (number) is registered, and the target application item contains the application to be patched. Registered in the process name, the item of the download URL, download the original URL of the patches that have been published (Uniform Resource Locator) is registered.

  Hereinafter, the monitoring processing operation according to the present invention will be described more specifically with reference to FIGS.

  In FIG. 1, Hyper-V using Windows PowerShell (registered trademark) and WMI (registered trademark, Windows Management Instrumentation) installed as standard functions in the Hyper-V (registered trademark) host OS of Microsoft (registered trademark). 2 shows the overall configuration of a (registered trademark) monitoring system, a virtual environment monitoring server 110 that executes monitoring processing according to the present invention, an SMTP (Simple Mail Transfer Protocol) server 121 when using a notification function, and a host machine (Described as “Hyper-V (registered trademark) host machine” in the figure) 103 and 107, virtual machines 102 and 106, and a management terminal 101.

  The virtual environment monitoring server 110 is provided with a virtual environment monitoring system 120 that executes programmed computer processing. The virtual environment monitoring system 120 monitors the virtual host machines 103 and 107 and the virtual machines 102 and 106. Monitoring control / information scrutinizing unit 111, countermeasure execution / additional operation executing unit 112 for taking countermeasures based on the monitoring result by the monitoring control / information scrutinizing unit 111, and report creating unit for reporting the final operation result 113.

  In addition, the virtualization environment monitoring system 120 is a simple script that can be easily executed by omitting the conversion to machine language (Performance script is a Perl language as a scripting language). (Registered Trademark), VBScript (Registered Trademark), JavaScript (Registered Trademark), etc.) are collected in the monitoring script 114, the countermeasure script 117, the additional countermeasure script 118, and the information acquired as the monitoring item as a database. Use unnecessary information DB 115 that collects information that can be determined to be, scrutiny information DB 116 that collects information collected by monitored system 120, and vulnerability information DB 119 that collects vulnerability information published by Microsoft (registered trademark) To do.

  The Power Shells 104 and 108 are command line tools, which are shells that operate on Windows (registered trademark) (part of operating system functions, interpret programs in response to user instructions, and start and control programs) ) (Windows PowerShell: registered trademark), an application that interprets the contents of commands (shell commands) that are input by the user's operation of an input device such as a keyboard and displays the results on the screen It is.

  The WMIs 105 and 109 are interfaces (Windows Management Instrumentation) for managing the Windows (registered trademark) system, and are managed from the Windows (registered trademark) script by calling from a WSH (Windows Script Host: registered trademark) script or the like. Etc. can be executed. WSH is for executing a script in a Windows (registered trademark) environment. In addition, scripts that run on WSH can be described using script languages such as VBScript (registered trademark) and JScript (registered trademark) described above, and scripts can be described in the Windows (registered trademark) environment. As an environment for executing, there is the above-mentioned Windows PowerShell (registered trademark).

  The Power Shells 104 and 108 and the WMIs 105 and 109 operate as OS standard functions on the monitored host machines 103 and 107, and the virtual machines 102 and 106 that operate on the host machines 103 and 107 and the host machines 103 and 107, respectively. Collect monitoring information.

  The management terminal 101 performs remote connection via the network to the virtual environment monitoring system 120 based on the operation from the operator, and the monitoring setting for the virtual environment monitoring system 120 and the report creation unit 113 View the created report.

  Hereinafter, the processing operation content of the monitoring control / information review unit 111 in the virtual environment monitoring system 120 of the virtual environment monitoring server 110 will be described with reference to FIG.

  The monitoring control / information scrutinizing unit 111 checks the WMI activation status and Power Shell installation status with the command: [WMIC / NODE: “managed host”...] For the monitored host 202 (step 201).

  After that, error determination is performed (step 212). If WMI is not activated or PowerShell is not installed, an error message is generated and displayed via the management terminal 101 or the like (step 213). Exit.

  If there is no problem in the confirmation result of the WMI / PowerShell operation status and installation status in the error determination in step 212, a task or the like is used and monitoring is performed at regular intervals, for example, monitoring script sample: VMinfo.ps114a in FIG. The script 114 is executed (step 203) and status determination is performed (step 204).

  In this determination, if there is no status other than executing (status ID) or error output (event ID), the current status information is collected with the command: [WMIC / NODE: "Managed Host" ...] Information is stored in the scrutiny information DB 116 shown in detail as the scrutiny information DB 209 in FIG. 11 (step 208), and then the process proceeds to the processing of the report creation unit 113 (step 211).

  However, if it is determined in step 204 that there is a status other than the execution status (status ID) or an error output (event ID), an event defined as unnecessary in the unnecessary information DB 115 whose details are shown in FIG. An ID / status code is acquired (step 205).

  The information acquired in the process of step 205 is compared with the status ID / event ID acquired in the process of step 204 to determine whether countermeasures are necessary (step 207).

  If the status ID / event ID acquired in the process of step 204 is defined as unnecessary in the unnecessary information DB 115, and it can be determined that no countermeasure is required, the current status information is changed to the command: [WMIC / NODE: "management. The information is collected at the target host “...”, And the information is stored in the scrutiny information DB 116, which is shown in detail as the scrutiny information DB 209 in FIG.

  Thereby, in monitoring of a virtual host (Windows (registered trademark) OS machine) in a virtual environment (Hyper-V virtual system), unnecessary information of monitoring information in the virtual host / virtual machine can be eliminated in advance.

  If it is determined that the operation is not normal (abnormal) as a result of the determination process in step 204, and it is determined that a countermeasure is required as a result of the determination process in step 207, the countermeasure execution unit of FIG. / Transition to the process shown in FIG. 3 by the additional operation executing unit 112 (step 210).

  The processing operation of the countermeasure execution / addition operation execution unit 112 in FIG. 3 will be described below.

  In the processing at steps 204 to 207 shown in FIG. 2 by the monitoring control / information review unit 111 in FIG. 6, the countermeasure script 117 shown as the countermeasure script sample: StartVM.vbs 117a is executed (step 301).

  Next, the monitoring script 114 shown as monitoring script sample: VMinfo.ps 114a in FIG. 5 is executed (step 311), and status determination is performed (step 302).

  In this determination, if the status is in execution (Yes), state information is collected, a notification flag is added, and the information is stored in the scrutinization information DBs 116, 116a, and 309 shown in detail in FIG. 11 (step 308).

  Further, in the determination process in step 302, when there is a status other than the execution status (status ID) or an error output (event ID) (No), for example, in FIG. 7, additional countermeasure script sample: TakeSnapShot.vbs118a and added in FIG. The countermeasure script sample: exportVM.ps 118b and the additional countermeasure script 118 shown in FIG. 9 as the additional countermeasure script sample: importVM.ps 118c are executed (step 303).

  The monitoring target that has executed the processing in step 303 then executes the above-described monitoring script (VMinfo.ps114a) (step 304), and determines whether or not a host migration has occurred based on the result (step 305). .

  If a host move has occurred due to additional measures (if the host name before the measure and the host name after the measure are different), execute the command: [WMIC / NODE: “Managed Host”…] on the host after the move. The status information is collected by using it, added with a notification flag, and stored in the scrutinization information DBs 116, 116a and 307 shown in detail in FIG. 11 (step 306). Thereafter, the process proceeds to the process of the report creation unit 113 (step 310).

  If it is determined in step 305 that the host name before the countermeasure = the host name after the countermeasure and the host name has been recovered without moving the host, the status information after the recovery is displayed in the command: [WMIC / NODE in the processing in step 308. : "Managed Host" ...] is collected, a notification flag is added, and it is stored in the scrutiny information DBs 116, 116a, and 309 shown in detail in FIG. 11, and then the report creation unit 113 shown in FIG. A transition is made to processing (step 310).

  Hereinafter, the processing operation of the report creation unit 113 in FIG. 4 will be described.

  First, vulnerability information (KB number) is obtained by referring to vulnerability information DBs 119 and 402 which are shown in detail as vulnerability information DBs 119a and 119b in FIG. 12 (step 401), and then the monitored host machine 103 , 107 and the installed patch information (KB number) is acquired with the command: [gwmi Win32_QuickFixEngineering |? {$ _. HotFixID-eq *** (KB number)] (step 403) ), It is determined whether or not a necessary patch has been applied (step 405).

  If the required patch has been applied, create a report using the command: ["monitored host", "virtual machine" | Get-WmiInventory ...] (step 408), and the required patch has not been applied In this case, the patch information is acquired from the vulnerability information DBs 119 and 407 showing the details as the above-described vulnerability information DBs 119a and 119b based on the KB number that has not been applied (step 406), and a report is created (step 408). ).

  After the report is created, notification flags are collected for the scrutiny information DBs 116 and 410, which are shown in detail as the scrutiny information DBs 116a and 116b in FIG. 11 (step 409), and flag determination is performed (step 411).

  If the flag is on, the mail transmission command: [$ mail = New-Object System.Net.Mail.MailMessage ("destination address", "source address") ...] is executed, and the SMTP server 121, A notification mail is transmitted to 413 (step 412), and the process ends.

  If the flag is off in the determination process in step 411, the process ends as it is.

  As described above with reference to FIGS. 1 to 12, the virtual environment monitoring system 120 of the present example as the virtual environment monitoring apparatus of the present invention has a monitoring control / control function as means for executing programmed computer processing. An information review unit 111, a countermeasure execution / addition operation execution unit 112, and a report creation unit 113 are provided.

  Then, in the monitoring control / information review unit 111, the host machines 103 and 107 constituting the virtualization system and the virtual machines 102 and 106 formed by the host machines 103 and 107 are set at predetermined intervals. If the information indicating the operating state is collected and the collected information is information indicating the normal state of the machine, the normal state information is stored in the scrutiny information DB 116 as scrutiny information, and the collected information indicates the abnormal state of the machine. If it is the information to be displayed, the abnormal state information of the machine that is determined to need no countermeasure by referring to the unnecessary information that is defined in advance for each machine and stored in the unnecessary information DB 115 and that indicates the necessity of the countermeasure for the failure of the machine. Is stored in the scrutiny information DB 116 as scrutiny information.

  Then, the countermeasure execution / additional operation execution unit 112 performs failure processing including automatic backup / restoration and movement between hosts prepared in advance corresponding to the abnormal state for a machine that requires countermeasures in unnecessary information. The execution result is added to the abnormal state information and stored in the scrutiny information DB 116 as scrutiny information.

  Further, the report creation unit 113 creates a monitoring result report for the machine using the scrutinization information stored in the scrutiny information DB 116 by the monitoring control / information scrutinizing unit 111 and the countermeasure execution / additional operation executing unit 112. The report creating unit 113 refers to information (vulnerability information) indicating the vulnerability of the software, which is previously defined for the software executed on each machine and stored in the vulnerability information DB 119. Vulnerability check result information indicating the application status of patch processing to the vulnerability information on the machine is acquired, and a report including the acquired vulnerability check result information of each machine and scrutiny information of the machine is created.

  In this way, in this example, the operating status of the server body that provides the pseudo server environment is monitored together with the operating status of the pseudo server environment that uses the virtualization technology. And then collect vulnerability information. In other words, in the past, it was necessary to examine the detection contents in consideration of the large amount of man-hours required, including the separation of the detection contents of the monitoring system and the installation of agents in daily operations, and the agent installation. By focusing on a less monitoring environment, searching for solutions to these issues and adopting a unique response method in a virtual environment, an agent installation-less monitoring environment and monitoring information in a virtual host / virtual machine Unnecessary information in advance, additional operations based on monitoring results (automatic backup / restore / move between hosts), vulnerability information check of managed machines after monitoring operations, and reporting of monitoring results / vulnerability check results Execute.

  As described above, with the technology of this example, automatic processing of a virtual environment (invisible server) can be easily performed by a monitoring process that incorporates a countermeasure specific to virtualization in a virtual environment. In addition, with the monitoring function, it is possible to minimize the number of man-hours for construction and monitoring, including server / agent installation and separation of detection contents of the monitoring system. Furthermore, because the cause of detection may be due to vulnerability, it is possible to easily investigate the relationship between the failure content and the vulnerability using the monitoring result.

  As a result, in the conventional monitoring processing technology in a computer virtualization environment, when three or more virtual machines are mounted on one host, the load on the hardware resources due to the monitoring processing increases, and normal business operations are performed. Including the installation of servers and agents used for monitoring processing and the separation of the detection contents of the monitoring system, etc. to minimize the man-hours required for the construction of the monitoring system and the setting of monitoring items, etc. Problems of the prior art, such as failure to respond to failures that occur in the hardware (host) that executes the virtual machine, and failure to perform operations specific to virtualization As a result, it is possible to solve the problem by reducing the number of false detections of faults in the monitoring of the virtual environment. It is possible to perform monitoring processing in of computers systems efficiently.

  In addition, this invention is not limited to the example demonstrated using FIGS. 1-12, A various change is possible in the range which does not deviate from the summary. For example, in this example, each of the management terminal 101, the virtual environment monitoring server 110, and the SMTP server 121 is configured by different computers, but each of the management terminal 101, the virtual environment monitoring server 110, and the SMTP server 121 is provided. May be configured by one computer.

  In this example, a virtual system that operates on Windows (registered trademark) of Microsoft (registered trademark) is described as an example, but similar processing is also performed in a virtual system that operates on another operating system (OS). It can be performed.

  The computer configuration in this example may be a computer configuration without a keyboard or optical disk drive. In this example, an optical disk is used as a recording medium. However, an FD (Flexible Disk) or the like may be used as a recording medium. As for the program installation, the program may be downloaded and installed via a network via a communication device.

  101: Management terminal, 102, 106: Virtual machine, 103, 107: Host machine, 104, 108: Power Shell, 105, 109: WMI, 110: Virtualization environment monitoring server, 111: Monitoring control / information review section, 112 : Countermeasure execution / addition operation execution unit, 113: Report creation unit, 114: Monitoring script, 115, 115a, 115b, 206: Unnecessary information DB, 116, 116a, 116b, 116c, 209, 307, 309, 410: Scrutiny information DB, 117: countermeasure script, 118: additional countermeasure script, 119, 119a, 119b, 119c, 402, 407: vulnerability information DB, 120: virtualization environment monitoring system, 121, 413: SMTP server, 202, 404: monitoring Target host.

Claims (5)

A virtualization environment monitoring device for monitoring a computer virtualization system,
Collecting information indicating the operating state of the machine at predetermined intervals from the host machine constituting the virtualization system and the virtual machine formed by the host machine,
If the collected information is information indicating the normal state of the machine, the normal state information is stored in the storage device as scrutiny information,
If the collected information is information indicating the abnormal state of the machine, refer to unnecessary information that is defined in advance for each machine and stored in the storage device and indicates whether or not countermeasures for the machine are necessary. First processing means for storing in the storage device the abnormal state information of the machine that has been made unnecessary as scrutinization information;
Execute the failure processing including automatic backup / restoration and migration between hosts prepared in advance corresponding to the abnormal state for the machine for which countermeasures are required in the above unnecessary information, and the execution result is converted into the abnormal state information. A second processing means for additionally storing the information as the scrutiny information in a storage device;
And third processing means for creating a monitoring result report for the machine using the scrutiny information stored in the storage device by the first processing means and the second processing means. Virtualization environment monitoring device. The virtual environment monitoring device according to claim 1,
The third processing means includes
Refer to information (vulnerability information) indicating the vulnerability of the software defined in advance for the software executed on each machine and stored in the storage device.
Vulnerability check result information indicating the patch application status for the vulnerability information on each machine is acquired, and a report is created consisting of the acquired vulnerability check result information for each machine and the scrutiny information for the machine A virtual environment monitoring apparatus characterized by that.   The program for functioning a computer as each means in the virtual environment monitoring apparatus in any one of Claim 1 or Claim 2. A method for monitoring a virtual environment monitoring apparatus for monitoring a computer virtualization system, comprising:
The virtual environment monitoring apparatus includes first to third processing means as means for executing programmed computer processing,
The first processing means includes
Collecting information indicating the operating state of the machine at predetermined intervals from the host machine constituting the virtualization system and the virtual machine formed by the host machine,
If the collected information is information indicating the normal state of the machine, the normal state information is stored in the storage device as scrutiny information,
If the collected information is information indicating the abnormal state of the machine, refer to unnecessary information that is defined in advance for each machine and stored in the storage device and indicates whether or not countermeasures for the machine are necessary. Store unnecessary machine abnormal state information as scrutinization information in the storage device,
The second processing means includes
Execute the failure processing including automatic backup / restoration and migration between hosts prepared in advance corresponding to the abnormal state for the machine for which countermeasures are required in the above unnecessary information, and the execution result is converted into the abnormal state information. In addition, store it in the storage device as the above-mentioned scrutiny information,
The third processing means includes
A monitoring method for a virtual environment monitoring apparatus, wherein a monitoring result report for the machine is created using the scrutiny information stored in the storage device by the first processing means and the second processing means. . A method for monitoring a virtual environment monitoring apparatus according to claim 4,
The third processing means includes
Refer to information (vulnerability information) indicating the vulnerability of the software defined in advance for the software executed on each machine and stored in the storage device.
Vulnerability check result information indicating the patch application status for the vulnerability information on each machine is acquired, and a report is created consisting of the acquired vulnerability check result information for each machine and the scrutiny information for the machine A virtual environment monitoring apparatus monitoring method characterized by the above.

Images