JP2014078774A - Monitoring system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To appropriately set a threshold value set in the case of warning abnormality in a network according to the capability of an apparatus and the amount of packets to be relayed.SOLUTION: A server 0107 obtains and stores communication information on a primary-system terminal 0104 and a secondary-system terminal 0105 in a database 0106, sets a threshold value from the communication information for a prescribed period read out from the database, compares the threshold value with information obtained from either the primary-system terminal or the secondary-system terminal, and issues warning if the obtained information exceeds the threshold value.

Description

  The present invention relates to a system for monitoring communication failures.

  As a conventional method for monitoring the amount of traffic on a network, for example, Patent Document 1 describes analyzing network traffic and analyzing the cause of an alert.

  Note that when setting a threshold for the traffic amount of the network device in the server, a warning may be issued if the threshold is exceeded. There is a way. The outline is as follows. In this case, for example, a threshold value for the amount of traffic passing through each port / VLAN of the network device is set by the server. The threshold value is a usage rate for the logical band, and is mainly an upper limit value. The server periodically obtains the MIB of the network device and monitors the bandwidth usage rate. Alternatively, if the network device can set the threshold, it can be monitored on the server side by sending a trap or syslog to the server. The server can monitor the amount of traffic on the network by alerting the user when the threshold is exceeded based on the acquired information.

JP 2009-231876

  The threshold value that is set when a network abnormality is warned is generally a fixed value. However, depending on the performance of an operating device, the installed system, and the like, the capability of the device originally used by the device and the amount of packets to be relayed differ, so setting an appropriate threshold value becomes a problem. Further, in the case of a system that can take a redundant configuration, the primary system is switched to the secondary system when a failure occurs. However, when the system is switched, monitoring under the same conditions as the primary system cannot be performed. Further, fixing the threshold value has the following problems. The role of network equipment varies greatly depending on the relaying system. The devices that handle the period work of a company differ greatly from the devices that are connected to each PC in the office in terms of the amount of traffic that is required for relaying, so even if these devices are the same device, the same threshold It is not appropriate to monitor equipment with Moreover, there are the following problems in individually setting the thresholds. When setting a monitoring threshold for each device, the device can be monitored more than when the threshold value is fixed, but monitoring is possible only when an abnormality occurs in the device, and the device status for traffic flowing through the network Grasping is not ensured. The redundant configuration has the following problems. In the case of a system having a redundant configuration, traffic mainly flows in the main system, and there is a difference in traffic flowing from the sub system. If a failure occurs in the primary system, the traffic that was communicating in the primary system flows to the secondary system, but the primary communication is not always normal according to the monitoring conditions of the secondary system, and correct monitoring cannot be performed.

  As an example, the system according to the present invention includes a primary system terminal and a secondary system terminal for communicating with a service providing system and a user terminal, a server communicating with the primary system terminal and the secondary system terminal, and the primary system. A database stored by the server for communication information of the system terminal and the secondary system terminal, the server acquiring the communication information of the primary system terminal and the secondary system terminal to obtain the data burst The threshold is set from the communication information for a predetermined period that is stored in the database and read from the database, and the acquisition information from either the primary system terminal or the secondary system terminal is compared with the threshold to obtain the acquisition information. When the value exceeds the threshold, a warning is transmitted.

  When it is detected that the threshold is exceeded at the connection port with the user side, it is possible to obtain information as to whether the abnormality has occurred and whether it is temporary. Also. By configuring the secondary system so that the primary system threshold can be shared, communication in the same environment as that of the primary system can be started even in the event of a primary system failure, and operation can be reduced.

Equipment monitoring system Device monitoring system (Overview of threshold setting) Device monitoring system (threshold setting flow) Equipment monitoring system (outline of normal processing flow) Equipment monitoring system (report processing flow) Device monitoring system (database storage data) Device monitoring system (Overview of threshold takeover processing flow) Device monitoring system (Threshold takeover processing flow)

  In this embodiment, a threshold value for determining alarm transmission is provided in two stages as a result of monitoring. That is, first, a fixed threshold is set for each device, and second, a threshold is calculated and automatically set for each device from a predetermined period (for example, one week before the data observed immediately before).

The automatic threshold calculation method periodically acquires communication information (such as MIB) from network devices and accumulates statistical data on the server. Based on the acquired data, the bandwidth usage of the traffic is extracted, and the upper and lower thresholds for automatically monitoring the traffic volume are set by, for example, calculating the average and standard deviation.
Also, when the network environment is a redundant configuration, the threshold set for the secondary system is taken over by the secondary system in the event of a primary system failure by managing the threshold information with the server. Hereinafter, the embodiment will be described in detail.

  An overall outline of the device monitoring system will be described with reference to FIG. As shown in FIG. 1, there is a network configuration in which a user (0101) and a service providing system (0108) communicate. Here, the server (0107) is connected to the system terminal A (0104) / system terminal B (0105), and the amount of traffic passing through the system terminal A (0104) / system terminal B (0105) at the server / system terminal A ( [0104] The CPU usage rate and the memory usage rate of the system terminal B (0105) are monitored. The monitoring result information is stored in the traffic monitoring DB 0106.

  Next, an outline of threshold setting in the device monitoring system will be described with reference to FIG. As shown in FIG. 2, the server (0107) has the traffic volume observed at each of the system terminal A (0104) and the system terminal B (0105) for the traffic transmitted from the user terminal (0102) shown in FIG.・ Obtain the CPU usage rate and memory usage rate of the device. The acquired data is stored in the traffic monitoring DB (0106). The server (0107) uses 95 minutes of data from the average and standard deviation of each of the system terminal A (0104) and system terminal B (0105) using the past predetermined period (for example, 7 days) of the stored data. And the upper and lower limit values are set as threshold values. An actual processing example will be described in detail with reference to FIG. The list of acquired data and threshold values is stored in the database shown in FIG. The data is automatically updated every minute, for example. The threshold is set once a day.

  Next, a threshold setting flow in the device monitoring system will be described with reference to FIG. The server (0107) determines the traffic volume observed by the system terminal A (0104) / system terminal B (0105) and the traffic volume of the system terminal A (0104) / system terminal B (0105) for the traffic transmitted from the user terminal (0102). CPU usage rate and memory usage rate are acquired using MIB, trap, and syslog (0301,0302). The acquisition interval is once per minute, and the acquired data is stored in the traffic monitoring DB (0106) (0303). The server calculates the threshold from the stored data for one week. Although there is a difference between inside and outside the service provision time, it is considered that the data is somewhat constant in each time zone, so the data distribution is a normal distribution. Therefore, the threshold value is calculated by calculating the average and standard deviation from the data in the past predetermined period (for example, for one week), obtaining a range of 95% of the reach of the data, and setting the upper and lower limit values as the threshold value (0305). If a fixed threshold value is set, compare the fixed threshold value with the calculated threshold value and use the smaller value if it is the upper limit value (0306,0308,0309). The one with the larger value (0306,0311,3012) is adopted.

  Next, a normal processing flow in the device monitoring system will be described with reference to FIG. The server (0107) acquires the traffic volume, CPU usage rate, and memory usage rate observed by the system terminal A (0104) and the system terminal B (0105), and compares them with the set threshold values. The information acquisition method is the same as in FIG. If any of the acquired data exceeds the threshold, the server will sound an alarm. An actual processing example is performed according to the flow of FIG. 0301 and 0302 are the same as those in FIG. In 0501, the set threshold value is compared with the acquired information. When it is determined that the acquired information exceeds the threshold, a warning is transmitted to the system terminal (0504). When it is judged that it does not exceed, a warning is not sent (0503).

  Next, a threshold handover process flow in the device monitoring system will be described with reference to FIG. In the system illustrated here, when a device failure occurs in the system terminal A (0104) and the network is switched from the primary system terminal A (0104) to the secondary system terminal B (0105), normal traffic Assume that the amount of the network of the system terminal B (0105) is smaller than that of the system terminal A (0104). In this case, more traffic than usual flows to the system terminal B (0105), and the threshold value is exceeded. Therefore, when the system terminal A (0104) becomes a failure, the threshold of the system terminal A (0104) stored in the traffic monitoring DB is applied to the system terminal B (0105) to monitor the threshold. As a result, threshold monitoring corresponding to the traffic volume can be realized immediately after the network is switched.

  An actual processing example is performed according to the flow shown in FIG. A failure occurs in the system terminal (0901). Subsequently, the server acquires threshold information of the system terminal A from the traffic monitoring DB (0902). Subsequently, the threshold information of the system terminal A is applied to the system terminal B (0903). Then, the same processing flow as in FIG. 5 is executed (0904-0906).

Claims (4)

A primary system terminal and a secondary system terminal for communicating with a service providing system and a user terminal;
A server that communicates with the primary system terminal and the secondary system terminal;
For communication information of the primary system terminal and the secondary system terminal, the database stored by the server,
The server acquires the communication information of the primary system terminal and the secondary system terminal, stores the communication information in the data verse, sets a threshold value from the communication information for a predetermined period to be read from the database, and the primary system terminal A monitoring system, characterized in that information obtained from either a terminal or a sub-system terminal is compared with the threshold value, and a warning is issued if the acquired information exceeds the threshold value.   The monitoring system according to claim 1, wherein the acquired information includes a traffic amount, a CPU usage rate, and a memory usage rate of any one of the primary system terminal and the secondary system terminal.   The server stores an initial threshold value in advance for the threshold value, compares the initial threshold value with the threshold value to be set, and selects either the initial threshold value or the threshold value to be set so as to tighten the upper and lower limits. The monitoring system according to claim 1.   The server, when the primary system terminal is switched to the secondary system terminal, acquires a threshold value for the primary system terminal from the database and applies the threshold to the secondary system terminal. The monitoring system according to 1

Images