JP2012249250A - Monitoring device and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a monitoring device for monitoring a plurality of devices to be monitored, which, when scheduled work occurs for part of the devices to be monitored, easily prevents an alarm associated with the scheduled work.SOLUTION: A monitoring device for monitoring a plurality of devices to be monitored, comprises: alarm information generation means for generating alarm information based on a monitoring result for each of the devices to be monitored; alarm output means for outputting the alarm information generated by the alarm information generation means to a user of the monitoring devices; work information storage means for storing information about the devices to be monitored as work objects planned to be worked among the devices to be monitored; output determination means for determining whether output of the alarm information by the alarm output means should be prevented or not, on the basis of information controlled by the work information storage means; and alarm output prevention means for controlling the output of the alarm information by the alarm output means on the basis of the determination result by the output determination means.

Description

  The present invention relates to a monitoring device and a program, and can be applied to, for example, a system (EMS: Element Management System) for monitoring a computer, a network device, or the like.

  In a conventional EMS, a failure notification (alarm notification) is received from a monitored device, and a notification (for example, voice display, screen display on a display, lamp display, etc.) is performed to a user such as a maintenance person. Further, in the conventional EMS, when the monitored device periodically polls the monitored device, and an abnormality is detected in the monitored device based on the result of the polling processing and information collected by the polling processing. And notify the maintenance person to that effect.

  As a prior art regarding EMS (monitoring device), there are technologies described in Patent Documents 1 to 3.

  In the technique described in Patent Literature 1, when a large number of alarms are generated from the monitored device in the monitoring device, the monitored device side voluntarily moves to the monitoring device side so that the congestion state does not continue on the monitoring device side. To stop and accumulate alarm transmissions.

  The technology described in Patent Document 2 describes a system in which a plurality of lower-level monitoring devices are arranged under a higher-level monitoring device. In the upper monitoring apparatus described in Patent Document 3, when a plurality of alarms notified from a plurality of lower monitoring apparatuses can be evaluated as a failure of one monitored apparatus, the alarm is displayed as one alarm. Has been.

  In the technique described in Patent Document 3, processing is performed on the monitoring device side so that only alarms registered by the user are displayed.

JP 2001-223722 A Japanese Patent Laid-Open No. 10-327216 JP 05-257755 A

  By the way, in the conventional EMS, for example, when the monitored device is restarted due to maintenance, even if the monitored device is not out of order, the monitoring device reports the restart from the monitored device. In some cases, a failure may be detected and an alarm may be generated due to a polling failure or the like. In such a case, for the maintenance person who uses the monitoring device, it is necessary to check the alarm by distinguishing between the monitored device that is performing the maintenance and the monitored device in which the failure has occurred. Could occur.

  However, when the technology described in Patent Document 1 is used for EMS, alarms are accumulated on the monitored device side and are not notified to the EMS side, which may interfere with the monitoring function of the EMS. It cannot be solved.

  In addition, when the technique described in Patent Document 2 is used by EMS, the number of alarms that can be generated can be suppressed. However, for example, the occurrence of an alarm related to a monitored device that is performing maintenance cannot be suppressed. After all, the above problems cannot be solved.

  Furthermore, even when the technology described in Patent Document 3 is used for EMS, when maintenance is performed on a part of the monitored device as described above, fine definition changes and the like are necessary. It was big.

  Therefore, in a monitoring device (for example, EMS or the like) that monitors a plurality of monitored devices, when a scheduled operation (for example, maintenance or the like) occurs for some of the monitored devices, it easily accompanies the scheduled operation. A monitoring device and a program for suppressing an alarm are desired.

  According to a first aspect of the present invention, there is provided a monitoring device for monitoring a plurality of monitored devices, (1) alarm information generating means for generating alarm information based on a monitoring result for each monitored device, and (2) the alarm information Alarm output means for outputting alarm information generated by the generation means to a user of the monitoring apparatus; and (3) work information storage means for storing information on a work target monitored apparatus for which work is scheduled among the monitored apparatuses; (4) Output determination means for determining whether or not to suppress the output by the alarm output means for each of the alarm information generated by the alarm information generation means based on information managed by the work information storage means And (5) the suppression target alarm information determined to be suppressed by the output determination means is output to the alarm output means. And having an alarm output suppression means for controlling so as not to.

  According to a second aspect of the present invention, there is provided a monitoring program comprising: (1) an alarm information generating unit configured to generate alarm information based on a monitoring result for each monitored device; And (2) alarm output means for outputting alarm information generated by the alarm information generation means to the user of the monitoring apparatus, and (3) information on the work target monitored apparatus scheduled for work among the monitored apparatuses. (4) based on the information managed by the work information storage means, the alarm output means suppresses the output of the alarm information generated by the alarm information generation means. Output determination means for determining whether or not to suppress, (5) alarm information to be suppressed determined to suppress output by the output determination means For it, characterized in that to function as an alarm output suppression means for controlling so as not to output to said alarm output means.

  According to the present invention, in a monitoring device that monitors a plurality of monitored devices, when scheduled work occurs for some of the monitored devices, an alarm associated with the scheduled work can be easily suppressed.

It is the block diagram shown about the functional structure of EMS (monitoring apparatus) which concerns on embodiment. It is the block diagram shown about the connection structure of the EMS (monitoring device) which concerns on embodiment, and a to-be-monitored apparatus. It is explanatory drawing shown about the information contained in the alarm notification notified from the to-be-monitored apparatus which concerns on embodiment. It is explanatory drawing shown about the example of the content memorize | stored in the alarm log storage part which concerns on embodiment. It is explanatory drawing shown about the example of the content of the alarm suppression table which concerns on embodiment. It is explanatory drawing shown about the example of the content of the work object apparatus management table which concerns on embodiment. It is explanatory drawing shown about the outline | summary of operation | movement of EMS (monitoring apparatus) which concerns on embodiment. It is explanatory drawing shown about operation | movement when the EMS (monitoring apparatus) which concerns on embodiment operate | moves in alarm suppression mode.

(A) Main Embodiment Hereinafter, an embodiment of a monitoring device and a program according to the present invention will be described in detail with reference to the drawings. Note that the monitoring device of this embodiment is an EMS.

(A-1) Configuration of Embodiment FIG. 2 is a block diagram illustrating the EMS 10 and monitored devices 31 to 34 according to the embodiment.

  The EMS 10 is a monitoring device that communicates with four monitored devices 31 to 34 via a network and monitors the monitored devices 31 to 34. Here, the specific network configuration between the maintenance terminal 20 and the monitored devices 31 to 34 is not limited, but here, communication is possible via an IP network configured by a switch, a router, or the like. Suppose that In FIG. 2, it is assumed that a dotted line between apparatuses indicates a logical connection configuration (connection path), and a solid line indicates a physical connection configuration.

  Each of the monitored devices 31 to 34 includes a database for managing the state of the own device, and to the EMS 10 depending on the contents of the database and other events (for example, when restarted) generated in the own device. It is assumed that notification to that effect (hereinafter referred to as “alarm notification”) is configured. Details of the contents of the alarm notification will be described later.

  In FIG. 2, the monitored device 34 is shown as a switching hub, and the monitored devices 31 to 33 are shown as computers (for example, server computers) connected and accommodated in the monitored device 34 (switching hub). . That is, the monitored devices 31 to 33 are directly connected to the monitored device 34 that is a switching hub via an Ethernet (registered trademark) cable or the like.

  As illustrated in FIG. 2, the monitored device 34 includes a communication control unit 341, a device management unit 342, and three ports 343 (343-1 to 333-3).

  The ports 343-1 to 343-3 are physical ports for connecting to the monitored devices 31 to 33 using Ethernet cables. The connectors to which the ports 343-1 to 343-3 are not limited, but may be ports corresponding to, for example, RJ-45 connectors of STP (Shielded Twist Pair) cables.

  In the monitored device 34, it is assumed that an identifier (source identifier) is defined for each port 343. Here, as an example, it is assumed that identifiers 1 to 3 are assigned to the ports 343-1 to 333-3, respectively. In the following description, the port 343-1 is also referred to as “port 1”, the port 343-2 as “port 2”, and the port 343-1 as “port 3”.

  The communication control unit 341 has a function of controlling each port (for example, monitoring a link state for each port and updating an ARP table) in the device. For example, the communication control unit 341 may implement part or all of the functions by installing communication software in an implementation configuration of a program (software) configured by a processor, a memory, and the like.

  The device management unit 342 manages the state of the monitored device 34 and assumes a function of communicating with the EMS 10 in the device.

  Note that each monitored device 31 to 34 has a configuration other than the processing related to the monitoring function of the EMS 10 such as processing to generate an alarm notification and transmit it to the EMS 10 or data transmission processing in response to polling from the EMS 10 (that is, The configuration related to the original function of the apparatus can be the same as that of an existing server computer or switching hub, and thus detailed description thereof is omitted.

  Next, an example of the contents of the alarm notification transmitted from the monitored devices 31 to 34 will be described.

  FIG. 3 is an explanatory diagram showing a data configuration of an alarm notification transmitted from each monitored device 31 to 34 to the EMS 10. FIG. 3 shows only a part of the data to be inserted into the data part of the IP packet.

  For example, each monitored device 31 to 34, when a predetermined event (for example, when restarted) occurs in its own device, an identifier (hereinafter referred to as “occurrence source identifier”) indicating the generation source of the alarm notification. ), An identifier indicating the content of the alarm notification (hereinafter referred to as “alarm identifier”), and a message corresponding to the event is generated and transmitted to the EMS 10 as an alarm notification And

  Next, the contents of the alarm notification that each monitored apparatus 31 to 34 transmits to the EMS 10 will be described.

  The format of the source identifier included in the alarm notification is not limited. For example, the host name of each monitored device 31 to 34, a name that can be easily identified by the user, and the like can be applied. Here, as an example, the source identifier of the monitored device 31 is “device A”, the source identifier of the monitored device 32 is “device B”, the source identifier of the monitored device 32 is “device C”, Assume that the source identifier of the device 33 is defined as “device D”. Note that an IP address or the like may be used as the generation source identifier, and in that case, the transmission source address of the IP packet for alarm notification may also be used as the above-described generation source identifier.

  The method of identifying the alarm identifier packet on the EMS 10 side is not limited. For example, the header information such as the type value of the packet and the destination port number (TCP or UDP port number) is included. You may make it identify using a part.

  The alarm identifier included in the alarm notification is an identifier corresponding to the event content defined in common between the EMS 10 and each of the monitored devices 31 to 34. Here, it is assumed that the alarm identifier is “0” when the monitored device is restarted. Further, in the monitored device 34 functioning as a switching hub, it is assumed that the alarm identifier is “1” when an abnormality such as a link down occurs in any of the ports. Furthermore, in the monitored device 34 functioning as a switching hub, an event (hereinafter referred to as “communication software function degradation”) occurs in which the operation of one of the ports stops and the processing related to the port stops (degeneration). In this case, the alarm identifier is “2”.

  Here, only three of 0, 1, and 2 will be used as alarm identifiers for simplifying the explanation, but other cases such as when there is a temperature abnormality or login in the administrator mode. The alarm identifier may be defined in detail. Further, the alarm identifier may be expressed by using a trap number (a value of the Trap Type field) used in an existing Simple Network Management Protocol (SNMP).

  The contents of the message included in the alarm notification are contents describing details of the alarm contents indicated by the alarm identifier. The specific description format of the message item is not limited, but the monitored device 31 to 34 has a message description format defined in advance according to the content of the alarm, and generates an alarm notification. It is assumed that a message according to the definition is generated.

  Here, as an example, in the monitored devices 31 to 34, it is assumed that the message “restart occurrence” is uniformly applied to an alarm notification (alarm identifier: 0) when a restart occurs. Further, in the monitored device 34 functioning as a switching hub, the alarm notification (alarm identifier: 1) when the port link down occurs is “port x failure occurrence” (x indicates the port where the failure occurred). Message is applied). Further, the monitored device 34 functioning as a switching hub generates a message “communication software function degradation” for the alarm notification (alarm identifier: 2) when the communication software function degradation occurs (function degradation). If you do, the port is not specified.)

  Next, processing when the monitored devices 31 to 34 receive information collection from the EMS 10 by polling will be described.

  The monitored devices 31 to 34 are provided with a database for managing the state of the device itself, and correspond to a function of responding to information on items according to a request (polling) from the EMS 10. That is, each of the monitored devices 31 to 34 is assumed to support an existing SNMP agent function (monitored function) with respect to a polling response. Specifically, the monitored devices 31 to 34 are assumed to include a MIB (Management Information Base) as a database for managing the state of the device itself. Then, the monitored devices 31 to 34 respond to SNMP and return a MIB value (GetResponse) corresponding to polling (GetRequest or the like) from the EMS 10.

  Next, the internal configuration of the EMS 10 will be described with reference to FIG.

  The EMS 10 includes an alarm management unit 11, a polling processing unit 12, a notification receiving unit 13, an alarm log storage unit 14, an alarm output unit 15 for maintenance personnel, an alarm suppression data storage unit 16, and an alarm log storage unit 17 for maintenance personnel. ing. In addition, it is assumed that a maintenance terminal 20 having an interface function with a maintenance person is connected to the EMS 10. Although the EMS 10 and the maintenance terminal 20 may be constructed as the same device, it is assumed here that they are constructed using different devices (computers).

  Note that the EMS 10 is an information processing device such as a PC (not limited to one, but may be configured to be able to perform distributed processing on a plurality of devices), and the monitoring program (including fixed data) of the embodiment. ) Is installed, but can be functionally expressed as shown in FIG.

  When the notification receiving unit 13 receives the alarm notification packet transmitted from each monitored device 31 to 34, the notification receiving unit 13 is information including the alarm information (source identifier, alarm identifier, and message content). The information is called “information”) to the alarm management unit 11.

  The polling processing unit 12 performs monitoring processing by polling for each monitored device 31 to 34. The contents of polling processing performed by the polling processing unit 12 are not limited. For example, in one polling, MIB value collection processing of preset items and network communication confirmation (for example, Ping (ICMP)) are performed. (Communication confirmation) etc. When the polling processing unit 12 collects an abnormal value in the polling process for each monitored device 31 to 34 (for example, link down of a network port, etc.), alarm information corresponding to the content of the abnormality is alarm-managed. Notification to the unit 11. For example, the polling processing unit 12 may perform polling processing on the monitored devices 31 to 34 at a preset cycle timing or at a timing according to the operation of the maintenance person. In addition, about the polling process which the polling process part 12 performs with respect to each to-be-monitored apparatuses 31-34, the process similar to the polling process performed with respect to an SNMP agent by the existing EMS etc. is applicable, for example.

  The alarm management unit 11 performs processing for supplying the alarm information supplied from the polling processing unit 12 or the notification receiving unit 13 to the alarm log storage unit 14 and the alarm output unit 15 for maintenance personnel.

  The maintenance person alarm output unit 15 determines whether to output (present) the alarm information supplied from the alarm management unit 11 to the maintenance person based on the contents of the alarm suppression data storage unit 16. Hereinafter, alarm information to be suppressed without outputting to the maintenance person is referred to as “suppression target alarm information”. When the maintenance person alarm output unit 15 determines that the alarm information does not correspond to the suppression target alarm information (presents to the maintenance person), the alarm information is sent to the maintenance person via the maintenance terminal 20. While outputting, it supplies to the alarm log storage part 17 for maintenance personnel. On the other hand, if the alarm output unit 15 for maintenance personnel determines that the alarm information is the alarm information to be suppressed (not output to the maintenance personnel), the alarm information is filtered (for example, output to the maintenance personnel). Waste). Note that a method for determining whether or not each alarm information corresponds to the suppression target alarm information in the maintenance person alarm output unit 15 will be described later.

  Also, the alarm output unit 15 for maintenance personnel determines whether the alarm information supplied from the alarm management unit 11 is suppression target alarm information, and performs an operation mode (hereinafter referred to as “alarm suppression mode”) for performing filter processing. And an operation mode (hereinafter referred to as “normal operation mode”) in which all alarm information supplied from the alarm management unit 11 is output to a maintenance person (maintenance terminal 20) without performing any filtering process. It shall be. Here, it is assumed that the operation mode of the maintenance person alarm output unit 15 is controlled by an operation performed on the maintenance terminal 20 by a maintenance person or the like.

  The maintenance person alarm log accumulating unit 17 has a function of accumulating alarm information supplied from the maintenance person alarm output unit 15 (alarm information determined not to be suppression target alarm information). In the EMS 10, the alarm information may be managed separately by the alarm log storage unit 14 and the alarm log storage unit 17 for maintenance personnel, but may be integrated and managed in one database. For example, for each alarm information in the database of the alarm log storage unit 14 accumulated for all alarm information, information corresponding to the suppression target alarm information or information not corresponding to the suppression target alarm information can be identified (for example, It may be constructed in a format that can be categorized such as a field of a mark indicating that.

  Next, an example of information stored in the alarm log storage unit 14 will be described. The alarm information items to be managed for the maintenance person alarm log storage unit 17 are the same, and thus detailed description thereof is omitted.

  FIG. 4 is an explanatory diagram showing the alarm information stored in the alarm log storage unit 14 in a table format.

  In FIG. 4, one alarm information is represented by one line, and each alarm information includes information of a management number, an alarm name, an alarm identifier, an alarm generation device, and a message item.

  The item of the management number indicates an identifier for identifying the alarm information on the database.

  The item “alarm identifier” indicates an alarm identifier included in the alarm information.

  The “alarm generation source device” indicates the generation source identifier of the monitored device that is the generation source of the alarm information.

  The item “message” indicates the content of the message included in the alarm information. If no message is included in the alarm information, nothing is displayed.

  The “alarm name” indicates an alarm name (content in a format easy to understand for the user) corresponding to the alarm identifier of the alarm information. In FIG. 4, the alarm names are displayed as “alarm a” and “alarm b” for simplicity of explanation, but in actuality, they are replaced with other contents that are easily understood by the user. Shall. The EMS 10 stores an alarm name corresponding to the alarm identifier, and each alarm information is given an alarm name corresponding to the alarm identifier.

  The maintenance person alarm output unit 15 uses the contents of the alarm suppression data storage unit 16 to determine whether to output alarm information to the maintenance person. The alarm suppression data storage unit 16 stores two pieces of information (tables): an alarm suppression table 161 and a work target device management table 162. Details of the alarm suppression table 161 and the work target device management table 162 will be described later.

  Next, the configuration of the maintenance terminal 20 will be described.

  The maintenance terminal 20 includes an output unit 21 and an input unit 22 that function as an interface with a maintenance person.

  The output unit 21 outputs alarm information to the maintenance person. The output configuration of the alarm information by the output unit 21 is not limited. For example, the alarm information may be output by a display, or may be configured to notify a maintenance person by lighting a lamp or sounding an alarm sound. In addition, the display format for displaying alarm information on the display is not limited. For example, the alarm information is displayed in a table format as shown in FIG. It may be added).

The input unit 22 functions as an interface (for example, a GUI environment or the like) that accepts an operation from a maintenance person. The input unit 22 may be configured using, for example, a mouse or a keyboard.
Next, the contents stored in the alarm suppression data storage unit 16 and the method of determining suppression target alarm information by the maintenance person alarm output unit 15 will be described.

  FIG. 6 is an explanatory diagram showing an example of the contents of the work target device management table 162.

  The work target device management table 162 is a table for managing a list of monitored devices (hereinafter referred to as “work target devices”) scheduled to perform maintenance work and the like.

  In the work target device management table 162, the work target device is represented by the generation source identifier for each management number. In FIG. 6, the work target apparatus is identified by the generation source identifier, but other formats (for example, an IP address, a host name, etc.) may be used. FIG. 6 shows an example in which apparatus A (monitored apparatus 31) is registered as a work target apparatus. Here, it is assumed that some or all of the devices A, B, and C are selected as work target devices and can be set from the maintenance terminal 20. That is, the content of the alarm suppression table 161 shown in FIG. 6 corresponds to the case where some or all of the devices A, B, and C are designated as work target devices.

  FIG. 5 is an explanatory diagram showing an example of the contents of the alarm suppression table 161.

  The alarm suppression table 161 shows a list of conditions (hereinafter referred to as “alarm suppression conditions”) for each alarm information to correspond to the suppression target alarm information. In the alarm suppression table 161, one line indicates one alarm suppression condition. The alarm output unit 15 for maintenance personnel compares the supplied alarm information with each alarm suppression condition of the alarm suppression table 161, and if any of the alarm suppression conditions is met, the alarm information is set as the suppression target alarm information. Is determined. On the other hand, when none of the alarm suppression conditions is satisfied, the maintenance person alarm output unit 15 determines that the alarm information does not correspond to the suppression target alarm information.

  In the alarm suppression table 161, information on items of a management number, an alarm identifier, an alarm cause device, a keyword, and an alarm source device is registered for each condition corresponding to the suppression target alarm information.

  The item “management number” indicates a number for identifying an alarm suppression condition.

  The item “alarm identifier” indicates a list of alarm identifiers corresponding to the alarm suppression condition. For example, in the alarm suppression condition of management number 1, the content of the alarm identifier is “0, 1, 2,..., N”. This shows a list of identifiers from 0 to n (here, the same meaning as a wild card specifying all alarm identifiers), and the conditions of other items regardless of the content of the alarm identifier of the alarm information. Indicates that the alarm suppression condition is met. Further, in the alarm suppression condition of management number 4, the content of the alarm identifier is “1”. This indicates that the alarm information with the alarm identifier “1” corresponds to the alarm suppression condition if other conditions match.

  The “keyword” item indicates a keyword (character string) included in the alarm information message corresponding to the alarm suppression condition. For example, in FIG. 5, the keyword with management number 5 is “port 0”. This indicates that the alarm information including the keyword “port 0” in the message corresponds to the alarm suppression condition if the conditions of other items match. Further, for example, in FIG. 5, the keyword with the management number 1 is “−” indicating no designation (wild card). This indicates that the alarm suppression condition is met if the conditions of other items match regardless of the content of the message.

  The item of “alarm cause device” is an alarm that is not a work target device but is a source of a monitored device (hereinafter referred to as “work influence device”) that is affected by the work (rebooting, etc.) of the work target device. It is an item used for information-related definitions. The item “alarm cause device” is an item related to the validity or invalidity of the alarm suppression condition, and is related to the work target device registered in the work target device management table 162. For example, when the source identifier of the monitored device described in the alarm cause device matches the work target device registered in the work target device management table 162, the alarm suppression condition is valid, and the conditions of other items are The matching alarm information is subject to alarm suppression.

  For example, in FIG. 5, in the alarm suppression condition of management number 4, the item “alarm causing device” is “device A”. As shown in FIG. 6, in the work target device management table 162, device A is designated as the work target device. Therefore, the alarm suppression condition of management number 4 is valid, and alarm information that matches the conditions of the other items is subject to alarm suppression.

  Further, in FIG. 5, in the alarm suppression condition of management number 7, the item “alarm causing device” is “device A, device B, device C”. Therefore, the alarm suppression condition of management number 7 is valid because “device A”, which is a work target device, is included in the item “alarm causing device”.

  Further, in FIG. 5, in the alarm suppression condition of management number 5, the item “alarm causing device” is “device B”. However, in the work target device management table 162, the device B is not designated as the work target device. Therefore, the alarm suppression condition of management number 5 is invalid, and even alarm information that matches the conditions of other items is not subject to alarm suppression.

  Furthermore, in FIG. 5, the keyword with the management number 1 is “−” indicating no designation (wild card). This indicates that the alarm suppression condition is valid regardless of the contents of the work target device management table 162.

  The item of “alarm generation source device” indicates the transmission source of the alarm information corresponding to the alarm suppression condition (generation source identifier of the monitored device). However, for the alarm suppression condition in which the alarm cause device item is not specified (-), the generation source identifier of the monitored device described in the alarm generation source device is registered in the work target device management table 162. It is valid only when it matches the work target device.

  For example, in FIG. 5, the alarm generation source device with the management number 1 is “device A”, and the alarm cause device item is not specified (−). Further, as shown in FIG. 6, in the work target device management table 162, since the device A is designated as the work target device, the alarm suppression condition with the management number 1 is valid. Therefore, the alarm information whose transmission source is the device A (monitored device 31) corresponds to the alarm suppression condition of the management number 1 if other conditions match.

  In FIG. 5, the alarm generation source device with the management number 2 is “device B”, and the item of the alarm cause device is not specified (−). However, as shown in FIG. 6, in the work target device management table 162, the device B is not designated as the work target device, so the alarm suppression condition of management number 2 is invalid.

  Further, in FIG. 5, in the alarm suppression condition of management number 4, the alarm generation source device is “device D”, and “device A” is specified in the item of the alarm cause device. Therefore, the alarm suppression condition of management number 4 is valid.

  As described above, in the alarm suppression table 161 shown in FIG. 5, the alarm suppressions of management numbers 1 to 3 are set as alarm suppression conditions for suppressing an alarm generated from the work target device itself specified in the work target device management table 162. Conditions are set. Further, in the alarm suppression table 161 illustrated in FIG. 5, the device D is set as a work-influencing device that affects when work (restarting or the like) is performed on the work target devices (device A to device C). Specifically, management numbers 4 to 4 are used as alarm suppression conditions for suppressing output of alarm information generated by the work D (device A to device C) from the device D that is the work influence device. 7 alarm information is set.

(A-2) Operation | movement of embodiment Next, operation | movement of EMS10 of this embodiment which has the above structures is demonstrated.

  First, an outline of the operation of the EMS 10 in the case where maintenance work involving restart is performed in the monitored apparatus 31 (apparatus A) will be described with reference to FIG. Here, the alarm output unit 15 for maintenance personnel will be described as operating in the normal operation mode as an initial state.

  First, it is assumed that prior setting (setting of the alarm suppression table 161 and the work target device management table 162) for the EMS 10 is performed by the maintenance person or the like via the maintenance terminal 20 (S101).

  Here, in step S101, the contents of the alarm suppression table 161 are set to the contents shown in FIG. The contents of the work target device management table 162 are set to the contents shown in FIG. In other words, it is assumed that the monitored device 31 (device A) is set as a maintenance target with restart according to the contents of the work target device management table 162. Note that the alarm suppression table 161 may be fixedly set, and only the contents of the work target device management table 162 may be changed each time maintenance work is performed.

  Next, it is assumed that the maintenance person or the like has operated the maintenance person alarm output unit 15 to operate in the alarm suppression mode via the maintenance terminal. Then, in the maintenance person alarm output unit 15, the operation mode is switched from the normal operation mode to the alarm suppression mode in accordance with the operation (S102).

  Thereafter, it is assumed that maintenance work is performed on the monitored apparatus 31 (apparatus A) by the operator, and accordingly, a restart process is performed on the monitored apparatus 31 (apparatus A) (S103).

  Then, with the restart of the monitored device 31 (device A), the monitored device 31 (device A), which is the work target device, and the monitored device 34 (device D), which is the work influence device, transfer to the EMS 10. An alarm notification is sent. However, the alarm information based on the alarm notification is not output to the maintenance person due to the alarm suppression processing of the maintenance person alarm output unit 15 (S104).

  Here, in step S104, alarm information of management numbers 1 to 3 shown in FIG. 4 is supplied from the alarm management unit 11 to the alarm output unit 15 for maintenance personnel. However, all the alarm information is determined as the alarm information to be suppressed by the maintenance person alarm output unit 15 and is not output to the maintenance person. As shown in FIG. 4, when device A (monitored device 31) restarts, not only device A but also device D (monitored device 34), which is a switching hub that accommodates device A, is affected. . Specifically, as shown in FIG. 4, the device D generates alarm information for link down and communication software function degradation.

  After the maintenance work on the monitored device 31 (device A) is completed, the maintenance person or the like operates the maintenance person alarm output unit 15 to operate in the normal operation mode via the maintenance terminal. Suppose that it was done. Then, the alarm output unit 15 for maintenance personnel cancels the alarm suppression mode and returns to the normal operation mode in accordance with the operation (S105).

  In the EMS 10, immediately after the alarm output unit 15 for maintenance personnel returns to the normal operation mode, the polling processing unit 12 is controlled to perform the polling process for the work target device registered in the work target device management table 162. You may make it check automatically the normality after work (there is no residual alarm). In addition to the work target device, among the alarm suppression conditions valid in the alarm suppression table 161, a monitored device other than the work target device set as the alarm generation source device (for example, device D in the example of FIG. 5). Similarly, polling processing may be performed to check normality.

  Next, in step S104 described above, the alarm suppression processing by the alarm output unit 15 for maintenance personnel of the EMS 10 will be described with reference to the flowchart of FIG.

  First, it is assumed that alarm information is supplied from the alarm management unit 11 to the alarm output unit 15 for maintenance personnel operating in the alarm suppression mode (S201).

  Then, the maintenance person alarm output unit 15 determines whether or not the supplied alarm information corresponds to the suppression target alarm information based on the content of the alarm suppression data storage unit 16 (S202).

  If it is determined in step S202 described above that the alarm information corresponds to the suppression target alarm information, the alarm output unit 15 for maintenance personnel discards the alarm information and does not output it to the maintenance terminal 20 ( S205).

  On the other hand, if it is determined in step S202 that the alarm information does not correspond to the suppression target alarm information, the alarm information for the maintenance person 15 outputs the alarm information to the maintenance person via the maintenance terminal 20. This is output (S203) and further stored in the alarm log storage unit 17 for maintenance personnel (S204).

  Next, specific alarm information generated in response to the restart process of the monitored apparatus 31 (apparatus A) and a process for determining the alarm information as suppression target alarm information by the alarm output unit 15 for maintenance personnel will be described. To do.

  First, of the alarm suppression conditions registered in the alarm suppression table 161, those that become invalid in the alarm output unit 15 for maintenance personnel will be described.

  Here, as shown in FIG. 6, apparatus A is registered as a work target apparatus. Therefore, among the alarm suppression conditions of management numbers 4 to 7 in which the item of the alarm cause device is described, management numbers 5 and 6 that do not match the work target device are invalid. In addition, among the alarm suppression conditions of management numbers 1 to 3 which are described as “−” in the item of the alarm cause device, the management numbers 2 and 3 in which the item of the alarm generation source device does not match the work target device. Is invalid. Therefore, only the alarm suppression conditions with management numbers 1, 4, and 7 are valid here.

  In this case, the alarm information of the management numbers 1 to 3 shown in FIG. 4 is supplied to the maintenance person alarm output unit 15 in accordance with the restart process of the monitored device 31 (device A). Become.

  In the alarm information of management number 1, the alarm identifier is “0”, the alarm source device is “device A”, and the message is “restart occurrence”. Therefore, the alarm information of management number 1 described above corresponds to the alarm suppression condition of management number 1 among the valid alarm suppression conditions.

  In the alarm information of management number 2, the alarm identifier is “1”, the alarm source device is “device D”, and the message is “port 0 failure occurrence”. Therefore, the alarm information with the management number 2 described above corresponds to the alarm suppression condition with the management number 4 among the valid alarm suppression conditions.

  In the alarm information of management number 3, the alarm identifier is “2”, the alarm source device is “device D”, and the message is “communication software function degeneration”. Therefore, the alarm information with the management number 3 described above corresponds to the alarm suppression condition with the management number 7 among the valid alarm suppression conditions.

(A-3) Effects of Embodiment According to this embodiment, the following effects can be achieved.

  According to this embodiment, by operating the alarm output unit 15 for maintenance personnel in the alarm suppression mode in the EMS 10, not only the work target device (device A) but also the alarm information from the work influence device (device D) can be obtained. Output to maintenance personnel can be suppressed. On the other hand, when alarm information that does not correspond to a valid alarm suppression condition is supplied to the alarm output unit 15 for maintenance personnel while the alarm output unit 15 for maintenance personnel is operating in the alarm suppression mode, Output to maintenance personnel. Therefore, only the alarm information related to the fault that has actually occurred is output to the maintenance person, so that the burden on the maintenance person can be reduced and the work efficiency can be improved.

  Furthermore, even if the alarm suppression table 161 is set to “no” (−) and the alarm suppression for the work influence device is set to a wide range, the polling process is performed when the alarm suppression mode is canceled. To check for any remaining alarms. Thereby, in EMS10, even when there is alarm information which should be output to a maintenance person originally by alarm suppression mode, the omission can be prevented.

(B) Other Embodiments The present invention is not limited to the above-described embodiments, and may include modified embodiments as exemplified below.

(B-1) In the above embodiment, the example of FIG. 3 described above has been described with respect to the format of the alarm notification sent from the monitored device, but the same alarm notification is realized using the SNMP trap notification. You may make it do. For example, the trap number (for example, Trap Type field) of the trap notification may be used as the alarm identifier in FIG. Also, a value (numerical value) added to the Trap notification may be used as the message in FIG. For example, a message corresponding to each value added to the trap notification may be held in the EMS 10, and the message may be reproduced and used based on the value added to the received trap notification.

(B-2) In the above embodiment, the alarm suppression table and the work target device management table are held only one by one. However, a plurality of alarm suppression tables and work target device management tables are held in combination according to the operation of the maintenance person or the like. You may make it operate the alarm suppression mode of the alarm output part 15 for maintainers.

  Further, in the above-described embodiment, for the alarm output unit for maintenance personnel, the processing for operating in the alarm suppression mode and the processing for canceling the alarm suppression mode are performed manually by the maintenance personnel, The alarm suppression mode may be started and canceled according to a preset schedule. Furthermore, when there are a plurality of alarm suppression tables and work target device management tables, when setting a schedule of alarm suppression mode for the alarm output unit for maintenance personnel, the alarm suppression table and work target device management table The combinations may be configured so that they can be specified together.

(B-3) In the above-described embodiment, the example in which the monitoring device of the present invention is applied to EMS has been described. However, the monitoring device may be applied to other monitoring devices such as NMS (Network Management System).

  DESCRIPTION OF SYMBOLS 10 ... EMS (monitoring apparatus), 11 ... Alarm management part, 12 ... Polling process part, 13 ... Notification receiving part, 14 ... Alarm log storage part, 15 ... Alarm output part for maintenance personnel, 16 ... Alarm suppression data storage part, 161 ... Alarm suppression table, 162 ... Work target device management table, 17 ... Alarm log storage unit for maintenance personnel, 20 ... Maintenance terminal, 21 ... Output unit, 22 ... Input unit, 31-34 ... Monitored device.

Claims (4)

In a monitoring device that monitors a plurality of monitored devices,
Alarm information generating means for generating alarm information based on monitoring results for each monitored device;
Alarm output means for outputting alarm information generated by the alarm information generating means to a user of the monitoring device;
Work information storage means for storing information related to a work target monitored device for which work is scheduled among the monitored devices;
Based on information managed by the work information storage means, output determination means for determining whether or not to suppress the output by the alarm output means for each of the alarm information generated by the alarm information generating means;
An alarm output suppression unit that controls the alarm output unit not to output the alarm information to be suppressed that is determined to suppress output by the output determination unit.   2. The information stored in the work information storage means includes at least information on a condition for extracting alarm information generated with the work target monitored device itself as a generation source. Monitoring device.   The information stored by the work information storage means further includes information on conditions for extracting alarm information generated from a work-affected monitored device that is affected by work on the work-target monitored device. The monitoring apparatus according to claim 2, wherein: A computer mounted on a monitoring device that monitors a plurality of monitored devices.
Alarm information generating means for generating alarm information based on monitoring results for each monitored device;
Alarm output means for outputting alarm information generated by the alarm information generating means to a user of the monitoring device;
Work information storage means for storing information related to a work target monitored device for which work is scheduled among the monitored devices;
Based on information managed by the work information storage means, output determination means for determining whether or not to suppress the output by the alarm output means for each of the alarm information generated by the alarm information generating means;
A monitoring program that functions as alarm output suppression means for controlling the alarm output means not to output the alarm target alarm information determined to suppress output by the output determination means.

Images