JP2012199928A - Management system and information processing system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To estimate the possibility that a network switch is a cause device in an L2 network, and display information on the cause device.SOLUTION: A management system managing a plurality of information processing devices which are managed objects including a plurality of network devices and a computer: determines reachability of on-path network devices which are the network devices on a communication path between the system and the computer; and calculates, based on the reachability, conviction degree on the probability that a predetermined network device included in the on-path network devices is a cause of non-arrival of communication from the management system to the computer. After that, the management system displays: information showing the non-arrival of the communication from the management system to the computer; and the conviction degree as the probability that the predetermined network device is the cause of the non-arrival.

Description

  The technology disclosed in the present specification relates to an information processing system including a server computer, a network device, and a storage device, and a management system that manages the information processing system.

  In recent years, information processing systems have become complex and large-scale by connecting various information processing apparatuses to each other via a computer network (hereinafter simply referred to as a network). A failure occurring in a device has affected various information processing devices via a network. As a root cause analysis technique for identifying the location and cause of the failure, there is an event correlation technology for analyzing the failure location and the cause using event information representing the failure content notified from the information processing apparatus (Patent Document 1). reference).

  Event correlation technology uses the correlation of events raised in the event of a failure to infer the root cause, and has been used for diagnosing network system failures for a long time. As for network failures, most of the analysis is related to IP level communication, which is the third network layer of the OSI reference model. Topology information collection and SNMP using ICMP (Internet Control Message Protocol) and ARP (Address Resolution Protocol) A failure analysis method combining (Simple Network Management Protocol) is the mainstream (see Non-Patent Document 1).

US Pat. No. 6,249,755

IEICE Transactions Vol. J83-B, no. 9, pp. 1258-1266, “Proposal and Evaluation of Network Failure Diagnosis Support System by Integration of Management Information”

  Regarding a network failure, in a computer network that performs communication in the second data link layer (Layer-2: hereinafter abbreviated as L2) in the OSI reference model, a Layer-2 switch (hereinafter referred to as an L2 switch) in a communication path. The network topology detailed information in Layer-2, such as the connection order, may not be obtained by the management protocol (for example, SNMP), and the cause is that a failure has occurred in which communication does not reach with a certain information processing device as the destination device. There was a problem that it was difficult to quickly identify the network switch.

  Therefore, in the present invention, based on the information on the presence / absence of the L2 switch on the path, the possibility that the network switch is a cause device in the failure on the communication path in L2 and the network switch on the path is estimated. Display information about the causal device based on the result.

  In addition, as information display about a cause apparatus, you may display an identifier with a high priority (for example, in an order from a high ratio apparatus) the apparatus estimated by a high ratio as a cause apparatus.

  According to the present invention, it is possible to quickly identify a network switch in which a failure has occurred.

1 schematically shows an overview of the overall configuration of an information processing system. An example of a management LAN is schematically shown. 6 shows a processing flow for creating network interface MAC address information, learning MAC address information, and path information. FIG. 6 schematically shows dynamic CAM information acquired from the L2 switch by the management server. FIG. Fig. 4 shows a detailed processing flow for creating dynamic CAM information in the flow of Fig. 3. FIG. 4 shows a processing flow that details the creation of route information of the flow of FIG. 3. FIG. 5 shows an example of a MAC address acquisition command and its output result for an L2 switch port or VLAN by SNMP. 5 shows an example of a bridge port number acquisition command for the MAC address of an L2 switch by SNMP and an output result thereof. 5 shows an example of a command for obtaining an index number of a network interface with respect to a bridge port number of an L2 switch by SNMP and an output result thereof. An example of an acquisition command of an interface name corresponding to an index number of a network interface of an L2 switch by SNMP and an output result thereof are shown. It shows a process flow for analyzing a cause device of a communication path failure and a process flow for outputting an analysis result to a screen. An example of a screen output layout when displaying an analysis result on a screen is shown typically. An example of the screen output when the analysis result is displayed on the screen is shown. The flow of analogizing the communication path based on the analysis result and outputting the topology display on the screen is shown. 2 shows an example of screen output in which a communication path is topology-displayed in the first embodiment of the present invention. It is the schematic diagram which showed the structure of the management server of this invention. It is the figure which showed network interface MAC address information. It is the figure which showed learning MAC address information. It is the figure which showed route information. It is the figure which showed communication status information. It is the figure which showed analysis result information. It is the figure which showed the calculation formula which calculates | requires failure cause reliability. It is a figure showing the relationship between the formula which calculated the failure cause certainty factor, and the L2 switch when a certain predetermined switch is a failure in the example of FIG. It is a figure showing the relationship between the formula which calculated the failure cause reliability when another predetermined switch is a failure in the example of FIG. 2, and an L2 switch.

The present invention will be described below.
As one embodiment of the present invention, only information related to the existence of a switch on a path that can be grasped based on information within a range that can be collected from MIB-II, Bridge-MIB, and the like, which are standard management models of SNMP, An information processing system that provides an expression for evaluating a failure on a communication path in L2 and a possibility that the network switch is a causal device in a network switch on the path, and outputs the information to the screen in order of devices that are likely to be causal devices. is there.

  According to another embodiment of the present invention, there is provided a management system for managing a plurality of management target information processing devices including a plurality of network devices and computers, wherein the management system receives management information from the computers. An interface; a processor that determines the state of the computer based on the management information; a memory that stores the state of the computer; and a display device that displays the state of the computer; One or more on-route network devices that are network devices on a communication path between the interface and the computer are identified from the plurality of network devices, and the processor is configured to identify the one or more identified on-route network devices and the network. One or more reachability by communicating through an interface The one or more reachability is recorded in the memory, and the processor determines a first route included in the one or more on-route network devices based on the one or more reachability. The upper network device calculates a first certainty factor regarding the certainty that is the cause of non-reach to the computer from the network interface, and the display device is unreachable for communication from the network interface to the computer And a management system that displays the first certainty factor as the certainty that the cause of non-arrival is the network device on the first route.

  The one or more specified on-route network devices include a switch device that transfers the received packet to another network device or computer without changing the destination address of the received packet. The identification may be based on the information of the switch device including the MAC address of the packet transferred by the switch device, the MAC address of the network interface, and the MAC address of the computer.

  Further, the information on the switch device may not include information for identifying an adjacent switch device.

  The processor may cause the second network device on the second path included in the identified one or more network devices on the basis of the at least one reachability to reach the computer from the network interface. A second certainty factor related to certainty is calculated, and the display device displays information indicating that communication from the network interface to the computer is unreachable, and the cause of the non-reach is on the second route As the certainty of being a network device, the second certainty factor may be displayed with a visual priority lower than the first certainty factor. If the second certainty factor is smaller than the first certainty factor, any or all of the following may be performed as the display with the low visual priority.

(A) With reference to the left end or / and the upper end of the screen of the display device as a reference, the second certainty factor or the position on the screen that displays a display object indicating the second network device on the route is selected. One certainty factor closes the position on the screen where the display object indicating the network device on the first route or the first route is displayed.
(B) The size on the screen for displaying the display object indicating the first network device on the route is made larger than the size on the screen of the display object indicating the second network device on the route.
(C) The degree of emphasis on the screen for displaying the display object indicating the first network device on the route is made higher than the degree of emphasis on the screen for the display object indicating the second network device on the route.

  Further, the processor calculates the number of reachable network devices included in the specified one or more on-route network devices and determined reachable by the reachability determination, and the display device calculates the calculation If the number of reachable network devices is two or more, a group display object indicating that two or more display objects indicating the reachable network devices are grouped may be displayed.

  Further, when the first certainty factor is higher than the second certainty factor, the display device displays that the first network device is connected from the two or more grouped display objects. An object and a display object indicating that the second on-route network device is connected via the first on-route network device from the two or more grouped display objects. Good.

  In addition, the display device displays information indicating that the management system has not reached the computer, identification information of the first network device, and the first certainty factor. Information related to reception of information may be displayed.

  As a result, according to the present invention, for a failure of a network switch having a Layer-2 switch function existing on a path between certain information processing apparatuses, even if the connection order of the network switches on the path is unknown, the SNMP By using only the collectable device information that is supported in the standard, the network switch that is considered to be the cause of failure can be easily presented to the user in the suspicious order without the trouble of calculating the connection order. Become. Furthermore, the present invention can also be applied in an environment where some switches can provide the connection order to the management server using a special protocol. However, the above features and merits are merely examples, and other parts are not recognized as having no patentability.

  In the following description, the information of the present invention will be described using expressions such as “xxx table”, “xxx list”, “xxxDB”, or “xxx queue”, but these information are data structures such as a table, list, DB, or queue. It may be expressed in other than. Therefore, the “xxx table”, the “xxx list”, the “xxx DB”, the “xxx queue”, and the like may be referred to as “xxx information” in order to indicate that they do not depend on the data structure.

  In describing the contents of each information, the expressions “identification information”, “identifier”, “name”, “name”, “ID”, and “number” are used. Not only the physical existence but also the logical existence are assigned to be distinguished from each other, so that they can be replaced with each other.

  In the following description, there is a case where “program” is used as the subject. However, since the program performs processing determined by being executed by the processor using the memory and the interface, the description may be given using the processor as the subject. . Further, the processing disclosed with the program as the subject may be processing performed by a computer such as a management server or an information processing apparatus. Further, part or all of the program may be realized by dedicated hardware.

  Various programs may be installed in each computer by a program distribution server or a storage medium.

<1. Configuration of information processing system>
FIG. 1 is an overview diagram showing one configuration of the information processing system according to the first embodiment of the present invention. The information processing system 0 includes a management server 1, a display device 2 for displaying screen output data generated by the management server 1, and a management target device group 4. The management server 1 monitors and manages information processing devices including computers, network switches (NW switches), and storage devices constituting the management target device group 4 as management targets.

  The management server 1 includes a memory 11 that is an area for storing information as electronic data, a processor 10 that performs analysis processing of a failure that has occurred on a computer network using electronic data that exists in the memory 11, and a management target device A network interface 13 for transmitting and receiving electronic data via the computer network of the group 4 and the management LAN 3 (the interface may be abbreviated as I / F), and a screen for outputting data to be displayed on the display device 2 And an output interface 12. The memory 11 may be a semiconductor memory as a main memory, a magnetic disk device as an auxiliary memory, or an external storage device. Further, the management LAN 3 does not have to be a network limited for the local area. The management LAN 3 may be a network different from the network for performing communication between information processing apparatuses, or may be a partially or completely the same network.

  FIG. 16 is a schematic diagram showing information and programs stored in the memory 11 of the management server 1.

  In the memory 11, managed device information including a device name related to the management target device group 4 given in advance to the management server 1 in the information processing system 0, and identification information and authentication information necessary for access on the computer network. 115, network interface MAC (Media Access Control) address information 110 and learning MAC address information 111 created at the time of system startup or configuration change, route information 112 created based on these, and managed device group 4 Communication state information 113 for storing the communication state collected at regular intervals (or repeatedly regardless of the period) of the communication state of the information processing devices constituting the management target device group 4 while monitoring , Analysis result information 1 for storing the result of the analysis processing performed by the processor 10 14, display information 211 created based on the analysis result information, and a management program 120. The information and programs stored in the memory 11 will be described later with reference to flowcharts and information diagrams.

  Returning to FIG. The managed device group 4 includes a computer that is a managed device, an information processing device that includes a storage device, and a network device that exists in the management LAN 3 that connects the information processing device that is the managed device and the management server 1. And is configured. When the management server 1 is started for the first time from a computer, a network device, a storage device, or the like, which is an information processing device that constitutes the management target device group 4, or when the configuration of the management target device group 4 changes, all Network interface information is collected from the managed devices, and for the Layer-2 switch that performs packet transfer under the control of the Layer-2 data link layer in the managed device, dynamic CAM information that is switch information is collected . The network interface information and the dynamic CAM information do not need to be collected again unless the configuration of the management target device group 4 is changed. However, the network interface information and the dynamic CAM information are collected upon confirming whether or not there is a repeated change at a relatively long interval such as once a day. It doesn't matter. On the other hand, from the management server 1 to the management target computer, network device, and storage device, by performing communication for determining the reachability of the network to them, the reachability is determined, and the result is obtained. It is stored in the communication state information 113 in the memory 11. The network device is the above-described Leyer-2 switch. More preferably, the management server 1 collects the dynamic CAM information and the network interface information prior to the communication for determining the network reachability.

  In the following description, a computer, a storage device, or a network device constituting the management target device group 4 may be referred to as a management target device or a management target information processing device.

  As described above, the management server 1 is connected to the display device 2 but may have other input / output devices. Examples of input / output devices include a display, a keyboard, and a pointer device, but other devices may be used. As an alternative to the input / output device, a serial interface or an Ethernet interface is used as the input / output device, a display computer having a display or a keyboard or a pointer device is connected to the interface, and the display information is transmitted to the display computer. By receiving the input information from the display computer, the display computer may perform the display, or the input may be replaced with the input / output device by receiving the input. Of course, the management server 1 may incorporate a display device.

  Hereinafter, a set of one or more computers that manage the information processing system 0 and display the display information of the present invention may be referred to as a management system. When the management server 1 displays the display information, the management server 1 is a management system, and the combination of the management server 1 and the display computer is also a management system. In addition, in order to increase the speed and reliability of management processing, a plurality of computers may realize processing equivalent to that of the management server 1. In this case, the plurality of computers (displays when the display computer performs display) Management computer) is the management system.

<1.1. Definition of terms>
The definitions of terms used in the present invention are described below. Other terms are defined besides this part.
Information processing devices: devices that transmit or receive network communications (for example, server devices, storage devices, printers, scanners, etc.) and devices that relay network communications (routers, proxy servers, switches).
Monitoring target information processing apparatus: An information processing apparatus that is managed by the management server 1.
Confidence: A value that represents the probability that an event has occurred. It is calculated by an expression based on reachability described later.

<2. Information of information processing system or management server>
Before explaining the information held by the management server 1, FIG. 2 shows an example of the management LAN 3 (hereinafter referred to as an example of the management LAN 3) assumed by each information and specific values stored in the list. It explains using.

  In the example of the management LAN 3, the communication path from the management server 1 to the computer 44 is connected in the connection order of SW-42 to SW-40, SW-43 and SW-41 of the L2 switch. In this example, it is assumed that a failure has occurred in SW-43 unless otherwise specified.

Note that the above description does not mean that each information stores only this value, and does not limit the configuration of the management LAN 3.
Next, various information that the management server 1 has will be described.

<2.1. Managed device information>
The managed device information 115 (FIG. 16) is information for storing an identifier of a managed device that is managed by the management server 1. This identifier may be an identifier for communicating with the management target device, for example, an IP address. However, other identifiers may be used as long as they can finally communicate with the management target device.

<2.2. Network interface MAC address information>
FIG. 17 is a diagram showing the network interface MAC address information 110. The network interface MAC address information 110 includes, as contents, a device name C11 that is a column for entering a name for identifying a management target device, and a network interface (which may be referred to as a NIC (Network Interface Card)). The record includes a NIC name C12 that is a column for entering a network interface name and a MAC address C13 that is a column for entering a MAC address assigned to the network interface. Note that the information is not necessarily a table.

<2.3. Learning MAC address information>
FIG. 18 is a diagram showing learning MAC address information 111.
The learning MAC address information 111 includes, as contents, a device C21 that is a column for storing information for identifying a device and a network interface included in the device for a plurality of L2 switches included in the management target device group 4. An interface column C22, which is a column for storing interface names, and a learning MAC address list C23, which is a column for storing a list of MAC addresses included in a passing packet learned by this interface for routing in Layer-2. Including. Note that the information is not necessarily a table.

<2.4. Route information>
FIG. 19 is a diagram showing the route information 112.
The route information 112 includes, as contents, information on a target device C31 that is a column for storing identification information of an information processing device to be managed as a communication destination from the management server 1 and a communication route between the management server 1 and the target device. And a device list C32 on the path which is a column storing the identification information of the processing devices as a list. Note that the information is not necessarily a table.

<2.5. Communication status information>
FIG. 20 is a diagram showing the communication state information 113.
The communication status information 113 includes, as contents, a device name C41 that is a column for storing information for identifying a management target device, an interface name C42 that is a column for storing information for identifying a network interface in the device, The communication state from the management server 1 to the network interface includes a communication state C43 which is a column for storing whether the communication is reachable or not reachable. Note that the information is not necessarily a table.

<2.6. Analysis result information>
FIG. 21 is a diagram showing the analysis result information 114.
The analysis result information 114 is assumed to include an analysis IDC 51 that is a column for storing an identifier uniquely identified for the analysis result, an analysis time C 52 that is a column for storing an analysis time, and a cause apparatus in the analysis. A cause device C53 for storing the device, a cause location C54 which is a column for storing the location of the device assumed to be the cause of the failure, a certainty factor C55 which is a column for storing the certainty factor of the cause assumed in the analysis, A reception event list C56, which is a column for storing related failure notification information used in the analysis.

<2.7. Information for display>
FIG. 12 is a diagram showing the display information 211.
The display information 211 includes at least one analysis result entry corresponding to one record of the analysis result information as a content. The analysis result entry includes a title 211-11 including a character string representing a summary of the analysis result, information indicating certainty indicating the certainty of the analysis result, and root cause details that are detailed messages regarding the root cause. A message 211-12, and a related reception event list 211-13 based on the communication state used to calculate the certainty factor. In addition, although it is more suitable for the display information 211 to reduce the difficulty of an administrator to have all of these, it may have only some contents. Other information may also be stored.

<2.8. Management program>
The management program 120 is a program that manages the state of the monitoring target information processing apparatus. In addition to the processing described so far and the processing described below, the management program 120 determines the status of the information processing apparatus to be monitored (for example, whether or not a failure has occurred, whether or not settings have been changed in the apparatus, and performance status). And the like are displayed on the display device 2. Therefore, for example, the management program 120 performs the following.

(A) Management information (for example, whether or not a failure has occurred, setting information of the device, performance information, etc.) is received from the monitoring target information processing device via the network interface 13.
(B) The state is determined based on the received management information and displayed on the display device 2.

  Note that the management program 120 may receive a setting request to the monitoring target information processing apparatus received by the management server 1 and perform setting to the monitoring target information processing apparatus based on the request.

<3. Information acquired by the management server>
Next, information acquired by the management server 1 will be described.

<3.1. Dynamic CAM information>
FIG. 4 is a diagram showing the dynamic CAM information 401 received by the management server 1. The dynamic CAM information 401 is obtained as VLAN information 4011 which is information regarding the VLAN number for the port provided in the network interface of the L2 switch, and MAC address information 4012 indicating the MAC address of the port belonging to a certain VLAN number. It consists of bridge port number information 4013 indicating the bridge port number corresponding to the MAC address, and bridge port / interface mapping information 4014 which is information relating to the correspondence between the obtained bridge port number and the name of the network interface.

  The dynamic CAM information 401 does not necessarily have to acquire all these pieces of information and contents with a single command. An example of a specific command for acquiring the dynamic CAM information 401 will be described below.

<3.1.1. Acquisition of dynamic CAM information using SNMP>
The MAC address information 4012 can be acquired from the output result of the SNMP command shown in FIG.

  The bridge port number information 4013 can be acquired from the output result of the SNMP command shown in FIG.

  The bridge port / interface mapping information 4014 can be acquired from the output result of the SNMP command shown in FIG. 10 after obtaining the correspondence between the port number and the index value of the interface by the SNMP command shown in FIG.

<3.1.2. Acquisition of dynamic CAM information using other than SNMP>
The dynamic CAM information 401 can be acquired by a “show mac” command in a switch equipped with IOS of CISCO and a “show cam dynamic” command in a switch equipped with CatOS.

<3.2. Network interface information>
The network interface information is information that the management server 1 receives from the management target device. The network interface information includes, as contents, a device name (or identifier) of the management target device, a name (or identifier) of the network interface of the management target device, and a MAC address and / or IP address assigned to the network interface. (Or other communication identifier). Note that the information does not necessarily have to be acquired by one communication.

<4. Management server processing and display>
Next, the management program 120 included in the management server 1 will be described.

<4.1. Information acquisition>
Hereinafter, the management server 1 acquires network interface information from one or more managed information processing devices based on the managed device information 115, and further includes dynamic CAM information for network devices among the managed control information processing devices. A procedure for creating and updating the network interface MAC address information 110, the learning MAC address information 111, and the route information 112 by acquiring

  FIG. 3 shows a preparation process procedure that is executed when the management program 120 starts the information processing system 0 for the first time or when the configuration of the management target device group 4 of the information processing system 0 is changed. . This procedure may be performed at a timing designated by the administrator. The flow will be described below.

  (Step S31) The management program 120 acquires network interface information from one or more information processing devices registered in the management target device information 115 of the management server 1.

  (Step S32) The management program 120 creates or updates the network interface MAC address information 110 based on the acquired network interface information. An example of the creation or update is to register all or part of the contents included in the network interface information in the network interface MAC address information 110.

  (Step S33) The management program 120 receives the dynamic CAM information 401 from one or more L2 switches included in the management target device group 4, and creates or updates the learning MAC address information 111. An example of the creation or update is to register all or part of the contents included in the dynamic CAM information 401 in the learning MAC address information 111.

  (Step S <b> 34) The management program 120 creates route information 112 from the management server 1 (more precisely, the network interface 13 of the management server 1) for a route when the managed information processing apparatus is a communication destination.

  FIG. 5 shows the process of generating the learning MAC address information 111 by the management program in step S33 of FIG. 3 as a more detailed procedure. In the following, description will be given according to the flow of FIG.

  (Step S331) The management program 120 extracts a device that is a management target information processing device and is an L2 switch from the management target device information 115, and adds it to the L2 switch list and the target device list. The target device list is information temporarily created in the memory 11 during this procedure. Also, since the L2 switch list is used in the flow of FIG. 6, it is necessary to temporarily create it in the memory 11 during the procedure of FIG. However, each list may be stored in the memory 11 even after the end of this procedure.

  (Step S332) The management program 120 determines whether the contents of the target device list are empty. If it is determined in step S332 that the target device list is not empty, the process proceeds to step S333. If it is empty, this procedure is terminated, and step S34 in FIG. 3 is processed.

  (Step S333) The management program 120 extracts the L2 switch as the target switch from the target device list.

  (Step S334) The management program 120 acquires the dynamic CAM information of the extracted target switch.

  (Step S335) The management program 120 creates or updates the learning MAC address information 111 from the received dynamic CAM information, and returns to step S332 again.

  FIG. 6 shows the process of generating the route information 112 in step S34 of FIG. 3 as a more detailed procedure. The following description will be made according to the flow of FIG.

  (Step S341) The management program 120 adds information processing devices belonging to the management target device group 4 to the target device list from the management target device information 115. The target device list is information that is temporarily created in the memory 11 during the procedure, but may be stored in the memory 11 even after the procedure is completed.

  (Step S342) The management program 120 registers all L2 switches registered in the L2 switch list created in Step S33 in the target device list.

  (Step S343) The management program 120 checks whether or not the target device list is empty. If it is not empty, the management program 120 ends the process in step S344, and if it is empty, ends the processing.

  (Step S344) The management program 120 extracts one device from the target device list and determines it as the target device.

  (Step S345) The management program 120 checks whether or not the target device list is empty. If it is empty, the management program 120 returns to step S341. If not, the management program 120 advances to step S346.

  (Step S346) The management program 120 extracts one L2 switch from the target device list and determines it as a target switch.

  (Step S347) The management program 120 determines whether the MAC addresses of the network interface of the management server 1 and the network interface of the target device are registered in two or more different interfaces in the learning MAC address information 111 for the target switch. The interface MAC address information 110 is used for investigation, and if registered, the process proceeds to step S348, and if not registered, the process returns to step S345.

  (Step S348) The management program 120 registers the target switch in the path information 112.

  The route information 112 is generated by the procedure described above. In the example of the management LAN 3 shown in FIG. 2, the route information 112 indicates that the SW-42 of the L2 switch exists on the route between the management server 1 and the target device SW-40 as in L31. Similarly, L32 indicates that SW-40, SW-42, and SW-43 of the L2 switch exist on the path between the management server 1 and the target device SW-41. The results of using other L2 switches as target devices are also obtained as shown in FIG.

  Next, this procedure using the commands shown in FIGS. 7 to 10 will be described as an example.

  FIG. 7 shows an example of an acquisition command of the MAC address assigned to the port of the L2 switch by SNMP and an output result thereof, and the IP address representing the switch is “192.168.1.1”. It shows that “00 00 0C 07 BA 04”, “00 01 02 1B 19 91” and the like can be acquired as the MAC address of the device.

  FIG. 8 shows an example of a command for acquiring a bridge port number belonging to VLAN number 1 of the L2 switch by SNMP and an output result thereof. The bridge port number for the MAC address “00 00 0C 07 BA 04” is “11”. ".

  FIG. 9 shows a command for obtaining the interface index number of the network interface with respect to the bridge port number of the L2 switch by SNMP and the output result thereof. The index number of the network interface with respect to the bridge port number 11 is “2”. Indicates that there is.

  FIG. 10 shows an index number of the network interface of the L2 switch by SNMP, a command for obtaining an interface name corresponding to the index number, and an output result thereof. The interface name of the index 11 is “Fa0 / 16”. Is shown.

  From the output results of FIGS. 7, 8, 9, and 10, the MAC address learned at the port where the interface name of the L2 switch indicates “Fa0 / 16” is “00 00 0C 07 BA 04”. I understand that. That is, a packet destined for an information processing apparatus having a network interface having “00 00 0C 07 BA 04” as a MAC address indicates that it has passed through “FA0 / 16” of the port. Based on this information, it is checked which port of the L2 switch has learned the MAC address of the network interface of the information processing device at both ends of a certain communication path, and information processing at both ends is performed at different ports of the same L2 switch. It can be seen that the switch exists in the middle of the path when the device is learned separately.

<4.2. Analysis>
FIG. 11 shows a failure analysis process that is repeatedly performed after the information processing system starts monitoring the management target device group 4 and a procedure until the analysis result is displayed. Note that the analysis result may be displayed at a timing independent of the failure analysis. Further, this procedure may be started or ended at a timing when the management server receives an instruction from the administrator.

  (Step S111) The management program 120 adds all the management target information processing devices registered in the management target device information 115 to the unevaluated device list. The unevaluated device list is information temporarily created in the memory 11 during this procedure. However, this unevaluated device list may be stored in the memory 11 even after the end of this procedure.

  (Step S112) The management program 120 determines whether communication is reachable with respect to the management target information processing apparatus registered in the management target apparatus information 115, and whether the communication is reachable or unreachable. The determination result is stored in the communication status information 113 together with the device name (or device identifier) and interface name (or interface identifier or MAC address of the interface). Examples of the communication status determination method include the following (not all need to be adopted).

(Determination method 1) An information acquisition command by SNMP is issued, and a determination is made from the response.
(Judgment method 2) Judgment is made on the basis of a failure notification such as a link down given by an SNMP trap or the like.
(Determination method 3) Judgment is made based on the presence or absence of a response by the ICMP "ping" command. In addition, in these determination methods, in addition to the L2 switch in which the failure actually occurs, communication for determination is performed via the L2 switch in which the failure has occurred, so that no failure has actually occurred. Nevertheless, there is an L2 switch that is determined to be non-reachable. To that end, there are subsequent steps.

  (Step S <b> 113) The management program 120 determines whether or not there is a management target information processing apparatus that has been determined to have failed to reach at least one management target information processing apparatus registered in the unevaluated apparatus list. If it exists, the process proceeds to step S114, and if not, the process proceeds to step S117. The determination is made based on the communication state information 113. In the example of the management LAN 3 in FIG. 2, since it is determined that SW-41 and SW-43 have not reached, the process proceeds to step S114.

  (Step S114) The management program 120 extracts one or more management target information processing apparatuses determined to have not reached the communication state from the unevaluated apparatus list, and sets each as an evaluation target apparatus. In the example of the management LAN 3 in FIG. 2, SW-41 or SW-43 is taken out from the unevaluated device list and determined as an evaluation target device.

  (Step S115) The management program 120 sets the failure cause certainty factor indicating the possibility that the evaluation target device is a cause device of the network path failure in the formula shown in FIG. Ask. In the example of the management LAN 3 in FIG. 2, the failure cause certainty factor when the evaluation target device is SW-41 is found to be 75% as shown in FIG. When the evaluation target device is SW-43, the failure cause certainty factor is 100% as shown in FIG. 24, and the result is most likely that SW-43 is the cause device.

  (Step S116) The management program 120 updates the analysis result information 114 as follows.

(A) Analysis time: The date or / and time at which this procedure is performed is registered.
(B) Cause device and cause location: The identification information of the evaluation target device extracted in the non-arrival judgment and the interface of the evaluation target device are registered.
(C) Received event list: Registers identification information indicating a communication non-arrival state of one or more managed information processing devices determined to be non-reachable on the route from the management server 1 to the evaluation target device.

  In the example of the management LAN 3 in FIG. 2, the analysis result using the SW-43 whose communication state is unreachable as the cause device is the interface Fa01 / 32 and the failure cause certainty factor is 100 as shown in L51. % And the related received event list are registered as unreachable communication state information in SW-43. Similarly, the SW-41 is registered like the record of L52.

  (Step S117) The management program 120 extracts records for the entries of the analysis result information 114 at a certain analysis time in descending order of the cause of failure certainty. It should be noted that the extraction may extract only entries whose failure cause certainty is equal to or higher than a predetermined value, or may extract only the number determined in descending order. In the example of the management LAN 3 in FIG. 2, L51 and L52 are extracted.

  (Step S118) The management program 120 creates display information 211 (FIG. 16) based on the records of the analysis result information 114 (FIG. 16) extracted in descending order of the cause of failure certainty in step S117, and generates the generated display. The usage information 211 is transmitted to the display device 2 via the screen output interface 12. Then, the display device 2 displays a management screen based on the display information 211. As an example of the generation of the display information 211, the following can be considered.

(A) Title: A message indicating that a failure caused by the cause device and the cause portion described in column C53 and column C54 in FIG. 21 is registered together with the degree of establishment of column C55.
(B) Root cause detailed message: A message indicating that a failure has occurred due to the cause device and cause described in columns C53 and C54 of FIG.
(C) Related reception event list: Association converted from an identifier or name of a management target information processing apparatus (L2 switch is more preferable) registered in the reception event list of column 56 in FIG. A character string that can identify the information processing apparatus to be managed is registered.

  In the example of the management LAN 3 in FIG. 2, by displaying information as shown in FIG. 13, the administrator potentially has a failure in both SW-41 and SW-43, but the SW-43 Can be narrowed down if the certainty factor is higher as a causal device.

<4.3. Display of analysis results>
FIG. 14 shows a flow of processing for performing topology display within a range that can be inferred in the communication path in L2 using the display information 211 in step S118 of the screen display processing described above with reference to FIG. This display may be performed at a timing independent of the analysis processing of FIG. In that case, a request for screen display may be received from the administrator, and the display may be performed in response to the request. Hereinafter, it demonstrates along a flow.

  (Step 1181) From the route information 112 (FIG. 16 and FIG. 19), the management program 120 uses the display information 211 (FIG. 16) to display the cause of the communication failure in the device that is the causal device. If the devices are on the route, they are added to the cause device list in descending order of certainty. The cause device list is information temporarily created in the memory 11 during this procedure. However, this list may be stored in the memory 11 even after the end of this procedure. In the example of the management LAN 3 in FIG. 2, SW-43 and SW-41 are added to the cause device list for the communication path from the management server 1 to the computer 44 as the path where the failure has occurred.

  (Step S 1182) The management program 120 groups devices that are present in the device list on the route of the route information 112 and are not present in the cause device list, and collectively represents them as one box. The display device 2 is notified via the screen output interface 12 so as to be displayed. Upon receiving the notification, the display device 2 groups the devices present in the device list on the route of the route information 112 and not present in the cause device list into a single box, connected to the management server 1 and connected to the management server 1. Stuffed and displayed. In the example of the management LAN 3 in FIG. 2, SW-40 and SW-42 correspond to each other, and these are collected into one box, connected to the management server 1 and displayed from the left end of the screen. It does not have to be at the left edge of the screen, but it is displayed from the edge of the screen.

  (Step S 1183) The management program 120 displays the screen output interface 12 so that the cause device list is displayed in order from the top, connected to the device farthest from the management server 1 of the devices already connected from the management server 1 side. To the display device 2 via Upon receiving the notification, the display device 2 displays the cause device list in order from the top by connecting to the device farthest from the management server 1 among the devices already connected from the management server side. In the example of the management LAN 3 in FIG. 2, since SW-43 has the highest certainty as the causal device, this is connected to a box in which SW-40 and SW-42 previously connected to the management server 1 are combined, SW-41 is connected to the right side of SW-43 and displayed.

  (Step S1184) The management program 120 is connected via the screen output interface 12 so as to connect and display the target device on the route on the farthest side as viewed from the management server 1 of the device farthest from the management server 1 that connected and displayed last. The display device 2 is notified. Upon receiving the notification, the display device 2 connects to and displays the target device on the route on the farthest side as viewed from the management server 1 of the device farthest from the management server 1 that connected and displayed. In the example of the management LAN 3 in FIG. 2, a computer 44 is connected and displayed on the right side of the SW-43.

  Through the above steps S1181 to S1184, the connection order of the L2 switches in the communication path in which the failure shown in FIG. In this way, not only can the switches on the path be selected in the order that is likely to be the causal device, but also the connection order of the faulty communication paths can be clearly shown to some extent based on the information.

<4.4. Screen display>
FIG. 15 shows an example of the screen display.
In this screen, information indicating that communication from the network interface 13 to the computer has not been reached on the screen (for example, a mark “X” indicating that a failure has occurred for a specific switch is displayed) The certainty factor calculated as the certainty that the cause is the network device on the route is displayed. In addition, information based on the display information is displayed on the screen. Then, the identification information and the certainty factor of the network device (more preferably, the switch device) that is the calculation target are displayed on the screen. Note that, as shown in the example of FIG. 15, when considering the case where the certainty factors of a plurality of network devices are calculated and displayed, the certainty factor (first certainty factor) about the first on-route network device is second. In order to increase the visibility when the certainty about the network device on the route (second confidence) is higher, the second certainty is displayed with a visual priority lower than the first certainty. Also good. Examples of visual priorities include the following, but visual priorities may be provided in other ways.

(A) Display information such as information or icons of network devices on the route with a high certainty factor, and display them on the upper or left side.
(B) A display object such as information or an icon of a network device on the route having a high certainty factor is displayed larger.
(C) Display information about a network device on the route having a high certainty factor or a display object such as an icon in a color more easily noticed.

  In addition, as an example of the display object of the network device on the route, an icon, a character, a moving image, or the like can be considered, but other objects may be used as long as they visually indicate the network device on the route.

  In the screen display, the number of reachable network devices included in the identified one or more on-route network devices and determined to be reachable by the reachability determination is calculated, and the calculated reachable network device is calculated. If the number is two or more, a group display object indicating that two or more display objects indicating the reachable network devices are grouped may be displayed. An example of a group display object is a square or a rounded corner or circle that surrounds a display object of a network device on two or more reachable routes, but two or more reachable visually. If it is possible to recognize that network devices on the route are grouped, another display method may be used. Moreover, you may suppress the display of the display object (for example, line) which shows the connection relation between the display objects which mean the network apparatus on a reachable path | route. This is more preferable when the management program 120 calculates and displays the certainty factor without specifying the connection relationship between the switch devices.

  In the screen display, when the first certainty factor is higher than the second certainty factor, a display object (for example, a line) indicating that the first network device is connected from the group display object; A display object (for example, a line) indicating that the group display object is connected to the second network device on the route via the first network device on the route may be displayed. Similarly, a display object (for example, a line) indicating that a display object indicating the management server 1 (or management system) and a group display object are connected may be displayed.

<5. Variation>
In the above description, the management server 1 performs a communication test to determine reachability in step S112 in FIG. 11, and provides a highly accurate determination regarding the communication state from the management server 1 to each information processing apparatus to be managed. As a result, the management server 1 can resume communication for monitoring each managed information processing apparatus again.

  Furthermore, by performing a modification of the following embodiment, the management server 1 can also manage unreachable management target information for paths between management target information processing apparatuses other than the path from the management server 1 to each management target information processing apparatus. The processing device (more preferably, the L2 switch) can be analyzed.

(A) The part for which the registration of the network interface of the management server 1 and the network interface of the target device is determined in step S346, step S347, and step S348 of FIG. Transform into a target. Specifically, instead of the management server 1, a second target device list in which management target information processing devices similar to the target device list are registered is introduced, and the management target information processing device and the second purpose included in the target device list are introduced. The management target information processing device included in the device list is determined based on whether it is registered in the learning MAC address of the target switch.
(B) In step S112 of FIG. 11, the above-described determination method is executed from the management target information processing devices included in the second target device list.
(C) The management server 1 is replaced with the management target information processing device included in the second target device list on the screen of FIG. 15 and the procedure of FIG.

  Further, when a bit pattern to be displayed on the display device 2 as a screen display method is transmitted from the management server 1 (for example, a display that accepts a signal at the DSUB terminal or the HMDI terminal), the display information 211 (FIG. 16) is displayed. Instead of transmitting, a bit pattern corresponding to the display screen may be created and an electrical signal for displaying the bit pattern may be transmitted to the display device 2.

  Note that not all network devices of the management LAN 3 need necessarily be L2 switch devices. Even in the case of an L2 switch device, a vendor-specific request is transmitted from the management server 1, an adjacent L2 switch device is specified by the response content, and the L2 switch on the communication path from the management server 1 to the computer is used using the information. A device (or network device) may be specified.

The present invention can be widely applied to information processing systems including server computers, network devices, and storage devices.

Claims (33)

A management system for managing a plurality of management target information processing devices including a plurality of network devices, a first computer, and a second computer,
The management system includes:
A network interface for receiving management information from the first computer and the second computer;
A processor for determining states of the first computer and the second computer based on the management information;
A memory for storing states of the first computer and the second computer;
A display device for displaying a status of the first computer and the second computer;
Have
The processor specifies one or more network devices on a path that are network devices on a communication path between the first computer and the second computer from the plurality of network devices,
The processor determines one or more reachability by communicating with the one or more specified network devices on the path, the first computer, or the second computer via the network interface, and Record more than one reachability to the memory,
Based on the at least one reachability, the processor causes a first network device on the first path included in the one or more network devices on the specified path from the first computer to the second computer. Calculate the first certainty about the certainty that is the cause of non-delivery,
The display device includes the information indicating that communication from the first computer to the second computer is unreachable, and the cause of the non-reach is the first network device on the route. A management system characterized by displaying a certain degree of certainty. The management system according to claim 1,
The specified one or more on-route network devices include a switching device that transfers the received packet to another network device or another computer without changing the destination address of the packet,
The identification of the one or more on-path network devices includes information on a switch device including a MAC address of a packet transferred by the switch device, a MAC address of the first computer, and a MAC address of the second computer. Management system characterized by The management system according to claim 2,
The information on the switch device does not include information for identifying an adjacent switch device. The management system according to claim 1, wherein:
Based on the at least one reachability, the processor causes a second network device on the path included in the identified one or more network devices on the path from the first computer to the second computer. Calculate the second confidence level for the certainty that is the cause of non-delivery,
The display device includes the information indicating that communication from the first computer to the second computer is unreachable and the certainty that the cause of the non-reach is the network device on the second route. A second certainty factor is displayed with a visual priority lower than the first certainty factor. The management system according to claim 1, wherein:
When the second certainty factor is smaller than the first certainty factor, the display with the low visual priority indicates that the second certainty factor is based on the left end or / and the upper end of the screen of the display device. Or, on the screen that displays the first certainty factor or the display object that indicates the first network device on the route rather than the position on the screen that displays the display object that indicates the second network device on the route. Management system characterized by close location. The management system according to claim 1, wherein:
When the second certainty factor is smaller than the first certainty factor, the display with the low visual priority is larger than the size on the screen of the display object indicating the second network device on the route. The management system is characterized in that a size on the screen for displaying a display object indicating the network device on the first route is large. The management system according to claim 1, wherein:
When the second certainty factor is smaller than the first certainty factor, the display with the low visual priority is more than the emphasis degree on the screen of the display object indicating the second network device on the route. And a high degree of emphasis on the screen for displaying a display object indicating the network device on the first route. The management system according to claim 1, wherein:
The processor calculates the number of reachable network devices included in the identified one or more on-route network devices, and determined reachable by the reachability determination,
When the calculated number of reachable network devices is two or more, the display device displays a group display object indicating that two or more display objects indicating the reachable network devices are grouped. Management system featuring. The management system according to claim 1, wherein
The management system, wherein the first computer, the processor, the memory, and the display device are included in one computer. The management system according to claim 1, wherein
The network interface, the processor, the memory, and the display device are included in one computer.
The display device is an LCD or CRT that displays a screen in accordance with a signal transmitted from the one computer, or a display computer that performs display based on information transmitted from the one computer. Management system. The management system according to claim 1, wherein
When the first certainty factor is higher than the second certainty factor, the display device includes a display object indicating that the first network device is connected from the two or more grouped display objects. A display object indicating that the second on-route network device is connected via the first on-route network device from the grouped two or more display objects. Management system. A program executed by a management system that manages a plurality of management target information processing devices including a plurality of network devices, a first computer, and a second computer,
By executing the program, the management system
Receiving management information from the first computer and the second computer through the network interface of the management system;
Based on the management information, determine the state of the first computer and the second computer,
Storing the states of the first computer and the second computer in a memory of the management system;
Displaying the states of the first computer and the second computer on a display device of the management system;
Identifying one or more network devices on a path that are network devices on a communication path between the first computer and the second computer from the plurality of network devices;
Judging one or more reachability by communicating with the one or more specified network devices on the route, the first computer or the second computer via the network interface, and the one or more arrivals Recorded in the memory,
Cause of non-reach of the first on-route network device included in the one or more on-route network devices identified from the first computer to the second computer based on the at least one reachability Calculate the first certainty about certainty,
Information indicating that communication from the first computer to the second computer is unreachable, and the first certainty factor as the certainty that the cause of the non-reach is the network device on the first route Is displayed on the display device. A program according to claim 12, wherein
The specified one or more on-route network devices include a switching device that transfers the received packet to another network device or another computer without changing the destination address of the packet,
The identification of the one or more on-path network devices includes information on a switch device including a MAC address of a packet transferred by the switch device, a MAC address of the first computer, and a MAC address of the second computer. A program characterized by being based on. 14. The program according to claim 13, wherein
The switch device information does not include information for identifying adjacent switch devices.
A program characterized by that. 14. The program according to claim 12, wherein the program is a program.
Based on the at least one reachability, the processor causes a second network device on the path included in the identified one or more network devices on the path from the first computer to the second computer. Calculate the second confidence level for the certainty that is the cause of non-delivery,
The display device includes the information indicating that communication from the first computer to the second computer is unreachable and the certainty that the cause of the non-reach is the network device on the second route. A second certainty factor is displayed with a visual priority lower than the first certainty factor. A program according to claim 12 to 15, wherein
When the second certainty factor is smaller than the first certainty factor, the display with the low visual priority indicates that the second certainty factor is based on the left end or / and the upper end of the screen of the display device. Or, on the screen that displays the first certainty factor or the display object that indicates the first network device on the route rather than the position on the screen that displays the display object that indicates the second network device on the route. A program characterized by close location. A program according to claim 12 to 15, wherein
When the second certainty factor is smaller than the first certainty factor, the display with the low visual priority is larger than the size on the screen of the display object indicating the second network device on the route. The program for displaying a display object indicating the network device on the first route is large on the screen. A program according to claim 12 to 15, wherein
When the second certainty factor is smaller than the first certainty factor, the display with the low visual priority is more than the emphasis degree on the screen of the display object indicating the second network device on the route. And the degree of emphasis on the screen for displaying a display object indicating the network device on the first route is high. A program according to claim 12 to 15, wherein
The processor calculates the number of reachable network devices included in the identified one or more on-route network devices, and determined reachable by the reachability determination,
When the calculated number of reachable network devices is two or more, the display device displays a group display object indicating that two or more display objects indicating the reachable network devices are grouped. A featured program. A program according to claim 12 to 19, comprising:
The program, wherein the first computer, the processor, the memory, and the display device are included in one computer. A program according to claim 12 to 19, comprising:
The network interface, the processor, the memory, and the display device are included in one computer.
The display device is an LCD or CRT that displays a screen in accordance with a signal transmitted from the one computer, or a display computer that performs display based on information transmitted from the one computer. program. A program according to claims 12 to 21, comprising:
When the first certainty factor is higher than the second certainty factor, the display device includes a display object indicating that the first network device is connected from the two or more grouped display objects. A display object indicating that the second on-route network device is connected via the first on-route network device from the grouped two or more display objects. Program to do. Multiple network devices;
A first calculator;
A second calculator;
A network interface for receiving management information from the first computer and the second computer;
A processor for determining a state of the first computer and the second computer based on the management information;
A memory for storing states of the first computer and the second computer;
A display device for displaying states of the first computer and the second computer;
A management system having
A computer system comprising:
The processor specifies one or more network devices on a path that are network devices on a communication path between the first computer and the second computer from the plurality of network devices,
The processor determines one or more reachability by communicating with the one or more specified network devices on the path, the first computer, or the second computer via the network interface, and Record more than one reachability to the memory,
Based on the at least one reachability, the processor causes a first network device on the first path included in the one or more network devices on the specified path from the first computer to the second computer. Calculate the first certainty about the certainty that is the cause of non-delivery,
The display device includes the information indicating that communication from the first computer to the second computer is unreachable, and the cause of the non-reach is the first network device on the route. A computer system characterized by displaying a certain degree of certainty. The computer system according to claim 23, wherein
The specified one or more on-route network devices include a switching device that transfers the received packet to another network device or another computer without changing the destination address of the packet,
The identification of the one or more on-path network devices includes information on a switch device including a MAC address of a packet transferred by the switch device, a MAC address of the first computer, and a MAC address of the second computer. A computer system characterized by A computer system according to claim 2, wherein
The information on the switch device does not include information for identifying an adjacent switch device. 25. The computer system according to claim 23 to 24, wherein:
Based on the at least one reachability, the processor causes a second network device on the path included in the identified one or more network devices on the path from the first computer to the second computer. Calculate the second confidence level for the certainty that is the cause of non-delivery,
The display device includes the information indicating that communication from the first computer to the second computer is unreachable and the certainty that the cause of the non-reach is the network device on the second route. A computer system characterized by displaying a second certainty factor with a visual priority lower than the first certainty factor. 27. A computer system according to any one of claims 23 to 26, wherein:
When the second certainty factor is smaller than the first certainty factor, the display with the low visual priority indicates that the second certainty factor is based on the left end or / and the upper end of the screen of the display device. Or, on the screen that displays the first certainty factor or the display object that indicates the first network device on the route rather than the position on the screen that displays the display object that indicates the second network device on the route. A computer system characterized by close location. 27. A computer system according to any one of claims 23 to 26, wherein:
When the second certainty factor is smaller than the first certainty factor, the display with the low visual priority is larger than the size on the screen of the display object indicating the second network device on the route. A computer system having a large size on the screen for displaying a display object indicating the network device on the first route. 27. A computer system according to any one of claims 23 to 26, wherein:
When the second certainty factor is smaller than the first certainty factor, the display with the low visual priority is more than the emphasis degree on the screen of the display object indicating the second network device on the route. The computer system is characterized in that the degree of emphasis on the screen for displaying the display object indicating the network device on the first route is high. 27. A computer system according to any one of claims 23 to 26, wherein:
The processor calculates the number of reachable network devices included in the identified one or more on-route network devices, and determined reachable by the reachability determination,
When the calculated number of reachable network devices is two or more, the display device displays a group display object indicating that two or more display objects indicating the reachable network devices are grouped. A featured computer system. A computer system according to claim 23 to 30, wherein
The computer system, wherein the first computer, the processor, the memory, and the display device are included in one computer. A computer system according to claim 23 to 30, wherein
The network interface, the processor, the memory, and the display device are included in one computer.
The display device is an LCD or CRT that displays a screen in accordance with a signal transmitted from the one computer, or a display computer that performs display based on information transmitted from the one computer. Computer system. A computer system according to any one of claims 23 to 32, wherein
When the first certainty factor is higher than the second certainty factor, the display device includes a display object indicating that the first network device is connected from the two or more grouped display objects. A display object indicating that the second on-route network device is connected via the first on-route network device from the grouped two or more display objects. Computer system to do.

Images