JP2013046372A - Fault detection device, network configuration estimation device and fault detection method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To obtain a fault detection device which can detect a fault in a short time while tracking a configuration change at low cost.SOLUTION: A fault detection device comprises: a trap acquisition unit 11 which acquires a configuration change notification indicating a change in a network configuration; a configuration acquisition unit 13 which finds information on the network configuration on the basis of information indicating a network configuration and the configuration change notification; a configuration prediction unit 14 which finds a predicted configuration of the network on the basis of a redundancy configuration acquired from the apparatuses constituting the network; and a fault probability table management unit 12 which, after estimating a corresponding fault spot on the basis of a fault occurrence notification and configuration information indicating the contents of faults and a fault probability table indicating the probability of source spots per content of fault, finds a fault probability table per content of configuration change in the predicted configuration beforehand as a predicted fault probability table and, when a configuration change notification is received, replaces fault probability information used in estimating fault spots with the predicted fault probability table corresponding to the content of a configuration change based on the notification.

Description

  The present invention relates to a failure detection device, a network configuration estimation device, and a failure detection method.

  With the development of virtualization technology, it is considered to construct a shared information system by consolidating information systems that have been individually owned and managed by organizations such as companies and organizations. In order to smoothly operate the shared information system, it is important to reduce the network management cost, and in particular, it is important to efficiently deal with a failure that occupies a large percentage in the current network management.

  In a shared information system, the amount of failure information increases with the expansion of management targets, and the range of failure impacts associated with server and switch virtualization increases, resulting in the detection of the cause from failure information. It takes more time than an individual information system. The operator will need more time to process one trouble, resulting in an increase in network management costs.

  As a method for dealing with such a situation, for example, in Patent Document 1, a table called a failure probability table is used, and the failure location that caused the failure is obtained probabilistically from the failure information. Attempts to shorten the time by automating the process up to the identification of the above have been disclosed.

JP 2007-124057 A

  However, according to the network failure monitoring method using the failure probability table described above, the causal relationship with the notification content also changes when the network configuration changes, so the probability table is updated and used. For this reason, this network failure monitoring method cannot be used until a probability table based on a new configuration is generated, or even if it can be used, the estimation accuracy is lowered and the operation by the operator is involved. Accordingly, there is a problem that it takes time to detect a failure occurring during that time, and an average failure handling time increases. In a shared information system in which configuration changes frequently occur, it is required to achieve further time reduction while maintaining estimation accuracy.

  On the other hand, many network devices have redundant power supplies and lines. Therefore, by generating in advance the failure probability table of the configuration set as the standby configuration in the redundancy configuration in the current configuration, failure detection is prevented by preventing a decrease in estimation accuracy when a configuration change to the standby configuration occurs Time can be shortened. However, there are a large number of devices constituting the network, and it is not practical to generate a failure probability table corresponding to all redundant switching patterns from the beginning.

  The present invention has been made in view of the above, and provides a failure detection device, a network configuration estimation device, and a failure detection method capable of detecting a failure in a short time while following a configuration change at a low cost. Objective.

  In order to solve the above-described problems and achieve the object, the present invention provides a network information acquisition unit that acquires a configuration change notification that indicates a change in the configuration of the network, and information that indicates a predetermined configuration of the network. A configuration acquisition unit that obtains configuration information of the network based on the configuration change notification, a redundant configuration set in the device from the devices that configure the network, and a prediction of the network based on the redundant configuration The failure occurrence based on a configuration prediction unit for obtaining a predicted configuration that is a configuration to be configured, a failure occurrence notification indicating the content of the failure, the configuration information and failure probability information indicating a probability that is a cause location for each failure content A fault location detection unit that estimates a fault location corresponding to the notification, and each content of configuration change in the prediction configuration based on the prediction configuration When the failure probability information is obtained as predicted failure probability information and the configuration change notification is received, the failure probability information used in the failure location detection unit corresponds to the content of the configuration change based on the notification. And a failure probability management unit to be replaced with information.

  According to the present invention, there is an effect that failure detection can be performed in a short time while following a configuration change at a low cost.

FIG. 1 is a diagram showing a configuration example of a communication system including a failure detection apparatus according to the present invention. FIG. 2 is a diagram illustrating a configuration example of the failure detection apparatus. FIG. 3 is a diagram illustrating an example of the failure probability table. FIG. 4 is a diagram illustrating an example of a table for managing device information. FIG. 5 is a diagram illustrating an example of a table for managing adjacency information. FIG. 6 is a flowchart illustrating an example of the configuration prediction procedure. FIG. 7 is a diagram illustrating an example of a table for managing a relationship between a predicted configuration and a failure probability table generated correspondingly. FIG. 8 is a flowchart illustrating an example of an operation procedure when the failure probability table management unit receives a configuration change notification.

  Embodiments of a failure detection apparatus and method according to the present invention will be described below in detail with reference to the drawings. Note that the present invention is not limited to the embodiments.

Embodiment.
FIG. 1 is a diagram showing a configuration example of a communication system including a failure detection apparatus according to the present invention. As shown in FIG. 1, the communication system according to the present embodiment includes communication devices 1-1 to 1-6, network devices 2-1 to 2-3, and a failure detection device 3. The configuration of FIG. 1 is an example, and the number of communication devices and network devices is not limited to the example of FIG.

  The communication devices 1-1 to 1-6 are devices having a communication function based on IP (Internet Protocol), and specifically correspond to personal computers, servers, and the like. The network devices 2-1 to 2-3 are devices that provide a function of connecting a plurality of communication devices 1 to each other and communicating with each other, and these devices may be physical devices including specific hardware, Alternatively, it may be a software virtual appliance. In the present embodiment, the failure detection device 3 is connected to a network constituted by these devices. Although the failure detection apparatus 3 is connected to the network device 2-3 in the drawing, it may be connected to another network device (network device 2-1 or network device 2-3).

  FIG. 2 is a diagram illustrating a configuration example of the failure detection apparatus 3 according to the present embodiment. The failure detection device 3 includes a trap acquisition unit (network information acquisition unit) 11, a failure probability table management unit (failure probability management unit) 12, a configuration acquisition unit 13, and a configuration prediction unit 14. The failure detection apparatus 3 sets a network including the communication devices 1-1 to 1-6 and the network devices 2-1 to 2-3 as a failure monitoring target. In FIG. 2, one of the network devices 2-1 to 2-3 to which the failure detection device 3 is connected is shown as a network device 2 as a representative.

  The trap acquisition unit 11 acquires a message from a device connected to the network, and distributes and notifies the failure probability table management unit 12 or the configuration acquisition unit 13 according to the content. Specifically, for example, when the message is information (status information) related to the current network status, the configuration prediction unit 14 is notified, and the message is information indicating that the network configuration has changed. In this case, a configuration change notification is output to both the failure probability table management unit 12 and the configuration acquisition unit 13, and when the message is a failure occurrence notification, the failure probability table management unit 12 is notified.

  The failure detection device 3 estimates a failure location in the network and outputs a failure location estimation result 15. Further, the failure detection device 3 can use a network configuration database (DB) 16 as an external input. The configuration acquisition unit 13 holds and manages the configuration information acquired from the network configuration database 16, and when receiving the configuration change notification from the trap acquisition unit 11, updates the configuration information based on the configuration change notification and updates the configuration prediction unit 14 is notified.

  The configuration prediction unit 14 performs configuration prediction based on the configuration information managed by the configuration acquisition unit 13 and the state information indicating the state of the network, and notifies the failure probability table management unit 12 of the prediction result as predicted configuration information.

  The failure probability table management unit 12 holds and manages the failure probability table, and updates the failure probability table with the state information indicating the change in the state information of the network configuration from the trap acquisition unit 11 based on the notification. Further, when the failure probability table management unit 12 receives a failure occurrence notification, the failure probability table management unit 12 estimates a failure location based on the notification and the failure probability table, and outputs the estimated result as a failure location estimation result 15. Here, the description will be made assuming that the failure location estimation method based on the failure occurrence notification and the failure probability table is used, but any method may be used as long as the failure location is estimated probabilistically based on the failure occurrence notification. In this embodiment, the failure probability table management unit 12 shows an example in which both the failure probability table is stored and managed and the failure location detection is performed. However, a failure location detection unit that performs failure location detection is additionally provided. It is good also as a structure.

  FIG. 3 is a diagram illustrating an example of a failure probability table held by the failure probability table management unit 12. The columns of FIG. 3 show types of faults that can be detected, and the rows show components such as devices and lines that can cause faults. In the table of FIG. 3, the probability that the own device is the cause for each failure is shown for each device. The shaded cells in the figure indicate that, for example, when “failure # 3” is detected, the probability that the cause is “device C” is 0.8. Failure # 1, failure # 2, etc. are failure identifiers, and it is assumed that the correspondence between the failure content and the identifier is defined. It is assumed that the content of the failure is defined so that the failure can be identified (failure # 1, failure # 2, etc.) based on the content of the failure occurrence notification. There is no particular limitation on the method for generating the failure probability table, and a general method can be used.

  FIG. 4 is a diagram illustrating an example of a table for managing device information among the configuration information held by the configuration acquisition unit 13. In FIG. 4, management is performed by assigning unique identification numbers to the communication devices 1-1 to 1-6 and the network devices 2-1 to 2-3 constituting the network to be managed. An example including a type, a name, and an address is shown.

  FIG. 5 is a diagram illustrating an example of a table for managing adjacent information among the configuration information held by the configuration acquisition unit 13. In the adjacent information, the communication devices 1-1 to 1-6 and the network devices 2-1 to 2-3 configuring the network to be managed manage the relationship with the devices directly connected to the devices. When one device is connected to a plurality of devices, the same device identification number has a plurality of entries, and a plurality of adjacent device identification numbers are associated with the same device identification number.

  Note that the tables or tables indicating each piece of information shown in FIGS. 3 to 5 are examples, and are not limited to the configurations shown in FIGS. 3 to 5 as long as similar information can be managed.

  FIG. 6 is a flowchart illustrating an example of a configuration prediction procedure according to the present embodiment. First, the configuration prediction unit 14 acquires information about the current network state (state information) from the trap acquisition unit 11 directly or via the configuration acquisition unit 13 (step S1). Specific examples of the status information include an increase in device operation error notifications, deterioration of responses to survival confirmation (ICMP Echo), continuous operation time, and notification of occurrence of switching due to one-system failure.

  Next, the configuration prediction unit 14 compares the content of the acquired state information with a preset threshold value, and determines whether a configuration change can occur (step S2). For example, in the case of device operation error notification, it is determined that there is a possibility of configuration change when the number of error notifications reported within a certain time exceeds a preset value. When it is determined that there is no configuration change (No in step S2), the process returns to step S1 without performing the subsequent prediction process.

  If it is determined that there is a configuration change (Yes in step S2), the configuration prediction unit 14 acquires a list of devices adjacent to the target device using the adjacent information managed by the configuration acquisition unit 13 (step S3). Next, the configuration prediction unit 14 makes an inquiry to the device corresponding to each entry of the acquired device list via the trap acquisition unit 11, and acquires information on the redundant configuration set for the device (redundancy setting information). (Step S4), it is determined whether or not redundant setting information of all devices has been acquired (Step S5). If information has been acquired from all devices (Yes in Step S5), the process proceeds to Step S6. If there is an unacquired device (No in step S5), the process returns to step S4.

  Then, the configuration predicting unit 14 obtains a predicted network configuration based on the redundancy setting information that can be taken by the adjacent device of the target device when it is assumed that the target device has detached (step S6). For example, when there is a device in which the target device is set as the first connection destination and another device is set as the second connection destination, the connection destination is changed from the target device that is the first connection destination to the second connection destination device. The network configuration is determined as having been changed. Since the predicted configuration is generated based on the redundant setting information that each device has individually, after obtaining the predicted configuration, the configuration prediction unit 14 confirms that there is no loop or division in the predicted configuration as a validity evaluation of the configuration of the entire network. Confirm (step S7). When it is determined that it is not appropriate (No in step S7), the process returns to step S6, and the generation of the predicted configuration is performed again. If it is determined to be valid (Yes in step S7), the failure probability table management unit 12 is notified of the obtained predicted configuration as predicted configuration information, and the failure probability table management unit 12 determines a failure probability table (predicted failure probability) based on the predicted configuration information. Table) is generated (step S8), and the process is terminated. At this time, when a failure occurrence notification is received, the failure probability table used for estimating the failure location is not replaced.

  As described above, the failure detection device 3 has a function as a network configuration prediction device that predicts a network configuration.

  FIG. 7 is an example of a table (failure probability table acquisition table) that manages the relationship between a predicted configuration and a failure probability table (predicted failure probability table) that is generated corresponding to the predicted configuration held by the failure probability table management unit 12. FIG. FIG. 7 shows an example of a table when there are a plurality of predicted configurations (a plurality of configuration change locations are predicted). When a plurality of configuration change locations are predicted, a failure probability table (predicted failure probability table) is created for each configuration change location, and an identification number is assigned to each failure probability table (predicted failure probability table). The configuration change location in FIG. 7 indicates the device using the device identification number used in the tables of FIGS. 4 and 5, and the failure probability table number indicates that the configuration change has occurred at that location (the device). The identification number of the failure probability table (predicted failure probability table) is shown.

  FIG. 8 is a flowchart illustrating an example of an operation procedure when the failure probability table management unit 12 receives a configuration change notification from the trap acquisition unit 11. When receiving the configuration change notification from the trap acquisition unit 11, the failure probability table management unit 12 searches the failure probability table acquisition table (step S11) and determines whether there is an entry corresponding to the notified content ( Step S12). If there is a corresponding entry (Yes in step S12), the failure probability table used for estimation of the failure location is immediately replaced with the failure probability table indicated by the identifier of the entry (step S15), and the process ends.

  When there is no corresponding entry (No in step S12), the failure probability table management unit 12 notifies the configuration acquisition unit 13 of an instruction to reacquire the current configuration information, and the configuration acquisition unit 13 re-reads the current configuration information. Acquisition is performed (step S13). Then, after re-acquisition of the configuration information, a failure probability table is obtained by recalculation based on the configuration information (step S14), the process proceeds to step S15, and the failure probability table used to estimate the failure location is obtained. Replace (step S15).

  In the present embodiment, the failure detection device 3 is connected to a network to be monitored for failure detection, and the failure detection device 3 directly acquires various information such as a failure detection notification by communication. The present invention is not limited to this, and the failure detection device 3 may be connected to the monitoring target network, and necessary information acquired from the network may be input to the failure detection device 3 offline.

  Thus, in this embodiment, a predicted configuration is obtained, a failure probability table corresponding to the predicted configuration is generated and stored (predicted failure probability table), and when a configuration change occurs, The failure probability table used for estimation of failure location is replaced with the predicted failure probability table corresponding to the configuration change. For this reason, it is possible to replace the failure probability table without leaving a gap from the occurrence of a failure, and to prevent a decrease in estimation accuracy when a configuration change occurs.

  As described above, the failure detection device, the network configuration estimation device, and the failure detection method according to the present invention are useful for a failure detection device that detects a network failure. It is suitable for a failure detection device to detect.

1-1 to 1-6 Communication device 2-1 to 2-3 Network device 3 Failure detection device 11 Trap acquisition unit 12 Failure probability table management unit 13 Configuration acquisition unit 14 Configuration prediction unit 15 Failure location estimation result 16 Network configuration database ( DB)

Claims (6)

A network information acquisition unit for acquiring a configuration change notification indicating a change in the configuration of the network;
A configuration acquisition unit for obtaining configuration information of the network based on information indicating the configuration of the network determined in advance and the configuration change notification;
A configuration prediction unit that obtains a redundant configuration set in the device from the devices configuring the network and obtains a predicted configuration that is a predicted configuration of the network based on the redundant configuration;
A failure location detection unit that estimates a failure location corresponding to the failure occurrence notification based on the failure occurrence notification indicating the failure content, the configuration information, and failure probability information that indicates a probability that is a cause location for each failure content; ,
Based on the predicted configuration, the failure probability information for each content of the configuration change in the predicted configuration is obtained as predicted failure probability information, and when the configuration change notification is received, the failure probability used in the failure location detection unit A failure probability management unit that replaces the information with the predicted failure probability information corresponding to the content of the configuration change based on the notification;
A failure detection apparatus comprising: The network information acquisition unit further acquires status information that is information related to a status change of devices constituting the network from the network,
The configuration information includes neighboring information that is information related to neighboring devices of the devices in the network,
The configuration prediction unit performs a process for obtaining the predicted configuration when it is determined that the configuration of the network may change based on the state information, and is subject to change using the adjacent information as the redundant configuration The fault detection apparatus according to claim 1, wherein an adjacent device adjacent to the device is obtained, and a redundant configuration set for the adjacent device is acquired from the adjacent device.   The failure detection apparatus according to claim 1, wherein the failure detection apparatus is connected to the network and acquires the failure notification from the network through communication. A network information acquisition unit for acquiring a configuration change notification indicating a change in the configuration of the network;
A configuration acquisition unit for obtaining configuration information of the network based on information indicating the configuration of the network determined in advance and the configuration change notification;
A configuration prediction unit that obtains a redundant configuration set in the device from the devices configuring the network and obtains a predicted configuration that is a predicted configuration of the network based on the redundant configuration;
A network configuration estimation apparatus comprising: The network information acquisition unit further acquires state information that is information related to a state change of devices constituting the network,
The configuration information includes neighboring information that is information related to neighboring devices of the devices in the network,
The configuration prediction unit performs a process for obtaining the predicted configuration when it is determined that the configuration of the network may change based on the state information, and is subject to change using the adjacent information as the redundant configuration The network configuration estimation apparatus according to claim 4, wherein an adjacent device adjacent to the device is obtained, and a redundant configuration set for the adjacent device is acquired from the adjacent device. A network information acquisition step for acquiring a configuration change notification indicating a change in the configuration of the network;
A configuration acquisition step for obtaining configuration information of the network based on information indicating a predetermined configuration of the network and the configuration change notification;
A configuration prediction step of obtaining a redundant configuration set in the device from the devices constituting the network and obtaining a predicted configuration that is a predicted configuration of the network based on the redundant configuration;
A failure location detecting step for estimating a failure location corresponding to the failure occurrence notification based on the failure occurrence notification indicating the failure content, the configuration information, and failure probability information indicating the probability of being the cause location for each failure content; ,
Based on the predicted configuration, the failure probability information for each content of the configuration change in the predicted configuration is obtained as predicted failure probability information, and when the configuration change notification is received, the failure probability used in the failure location detection unit A failure probability management step of replacing information with the predicted failure probability information corresponding to the content of the configuration change based on the notification;
A failure detection method comprising:

Images