JP2015185968A - Failure message aggregation device and failure message aggregation program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make it possible to easily learn a situation when a failure occurred even if there is no network configuration information.SOLUTION: An alarm classification unit 230 classifies a plurality of alarms included in an alarm file 291 into failure source alarms which are alarms for a concentration apparatus with which a communication apparatus is connected and concomitant alarms which are alarms for the communication apparatus connected with the concentration apparatus. A concomitant alarm search unit 250 searches for a concomitant alarm for the communication apparatus connected with the concentration apparatus related to the failure source alarm. An aggregation file generating unit 260 generates an aggregation file 296 including a failure source alarm and a concomitant alarm related to its failure source alarm as an alarm group. An aggregation file output unit 270 displays contents of the aggregation file 296.

Description

  The present invention relates to a technique for collecting failure messages.

Conventionally, network devices are monitored by polling or SNMP. SNMP is an abbreviation for Simple Network Management Protocol.
However, when a large number of network devices are connected to the network device in which a failure has occurred, a large number of alarms are generated.
And it takes experience and time to determine the network device that has caused a large number of alarms.

Patent Documents 1 to 3 disclose techniques for monitoring and managing a network.
In these techniques, network configuration information representing a connection relationship between network devices is prepared in advance, and the network device in which a failure has occurred is displayed using the network configuration information.
Therefore, in these techniques, it is difficult to determine the cause network device without the network configuration information.
In addition, when a network device recovers from a failure, the network device in which the failure has occurred is not displayed, so it is difficult to grasp the failure that occurred before the recovery.

JP 2002-244939 A JP-A-5-225104 JP-A-6-103200

  An object of the present invention is to make it possible to easily grasp the situation when a failure occurs even if there is no network configuration information.

The fault message aggregating apparatus of the present invention
A failure message storage unit for storing a plurality of failure messages including a device classification indicating a type of a failure device in which a communication failure has occurred, and network determination information for determining a network to which the failure device is connected;
A failure source message selecting unit that selects, from the plurality of failure messages, a failure message including a device classification indicating a concentrator connected to a communication device as the type of the failed device, as a failure source message;
A failure message including network determination information that determines the same network as the network determined by the network determination information included in the failure source message is selected as an accompanying message from the remaining failure messages excluding the failure source message. An accompanying message selection section;
An aggregate file generation unit that generates an aggregate file including a fault message group in which the fault source message and the accompanying message are collected;

  According to the present invention, even when there is no network configuration information, it is possible to easily grasp the situation when a failure occurs.

1 is a configuration diagram of a device monitoring system 100 according to Embodiment 1. FIG. 1 is a configuration diagram of a device monitoring system 100 according to Embodiment 1. FIG. 2 is a functional configuration diagram of a device monitoring apparatus 200 according to Embodiment 1. FIG. 3 is a flowchart showing device monitoring processing of the device monitoring apparatus 200 according to Embodiment 1. 6 is a diagram illustrating an example of a device management file 299 according to Embodiment 1. FIG. 2 is a diagram illustrating a specific example of a network configuration in Embodiment 1. FIG. 6 is a diagram illustrating an example of an alarm file 291 according to Embodiment 1. FIG. 4 is a flowchart of alarm classification processing (S130) in the first embodiment. 6 is a diagram illustrating an example of a failure source file 292 according to Embodiment 1. FIG. 6 is a diagram illustrating an example of an accompanying file 293 according to Embodiment 1. FIG. 5 is a flowchart of alarm pair search processing (S140) in the first embodiment. 6 is a diagram illustrating an example of a failure source pair file 294 according to Embodiment 1. FIG. 6 is a diagram illustrating an example of an accompanying pair file 295 according to Embodiment 1. FIG. 6 is a flowchart of an accompanying alarm search process (S150) in the first embodiment. FIG. 10 is a diagram illustrating an example of an aggregate file 296 according to the first embodiment. 2 is a hardware configuration diagram of a device monitoring apparatus 200 according to Embodiment 1. FIG.

Embodiment 1 FIG.
A description will be given of a mode for easily grasping the situation when a failure occurs.

1 and 2 are configuration diagrams of the device monitoring system 100 according to the first embodiment.
A configuration of the device monitoring system 100 according to the first embodiment will be described with reference to FIGS. 1 and 2. However, the configuration of the device monitoring system 100 may be different from that shown in FIG.

In FIG. 1, the device monitoring system 100 includes a device monitoring device 200 (an example of a failure message aggregation device), a switch device 110, and a plurality of switch devices 120 connected to the switch device 110.
The layer 3 switch and the layer 2 switch are examples of the switch device 110 and the plurality of switch devices 120.

The switch device 110 includes a plurality of ports 111 to which communication cables connected to any one of the switch devices 120 are connected. However, a communication cable connected to the terminal device instead of the switch device 120 may be connected to the port 111 of the switch device 110.
The switch device 120 includes a port 121 to which a communication cable connected to the switch device 110 is connected. In addition, the switch device 120 includes a plurality of ports 121 for connecting to a terminal device or a lower switch device.
The switch device and the terminal device are examples of communication devices.
The ports 111 and 121 are communication interfaces implemented by hardware or software. An IP address is assigned to the ports 111 and 121.
An IP address is an abbreviation for an Internet protocol address.

The device monitoring device 200 is a device that monitors the switch device 110 and the plurality of switch devices 120 by periodically performing polling or SNMP.
The device monitoring apparatus 200 is communicatively connected to the switch device 110 and the plurality of switch devices 120 via the network 109.
SNMP is an abbreviation for Simple Network Management Protocol.

In FIG. 2, it is assumed that the switch device 110 has failed.
In this case, a communication failure occurs in the switch device 110 and the plurality of switch devices 120 connected to the switch device 110.
The device monitoring apparatus 200 detects the occurrence of a communication failure between the switch device 110 and the plurality of switch devices 120 by polling or SNMP, and generates a failure message indicating the occurrence of the communication failure.
In addition, the device monitoring apparatus 200 detects recovery from a communication failure of the switch device 110 and the plurality of switch devices 120 by polling or SNMP, and generates a failure message indicating recovery from the communication failure.
Hereinafter, the failure message is referred to as an alarm.

As shown in FIG. 2, when the switch device 110 fails, a large number of alarms are generated (see cross marks in the figure).
In general, a large number of alarms are output in the order in which they occurred, but it is difficult to grasp the state of communication failure from the large number of alarms output in the order in which they occurred.
Therefore, the device monitoring apparatus 200 aggregates and outputs a large number of alarms for each communication failure group so that the administrator can easily grasp the communication failure status.

Hereinafter, a communication device such as the switch device 110 to which a plurality of switch devices 120 are connected is referred to as a communication device or a line concentrator.
In addition, communication devices such as the plurality of switch devices 120 connected to the switch device 110 are referred to as communication devices or connection devices.

FIG. 3 is a functional configuration diagram of the device monitoring apparatus 200 according to the first embodiment.
A functional configuration of the device monitoring apparatus 200 according to Embodiment 1 will be described with reference to FIG. However, the functional configuration of the device monitoring apparatus 200 may be different from that shown in FIG.

The device monitoring apparatus 200 (an example of a failure message aggregating apparatus) includes a device monitoring unit 210, an alarm file generation unit 220, and a device storage unit 290.
The device monitoring apparatus 200 includes an alarm classification unit 230 (an example of a failure source message selection unit), an alarm pair search unit 240, an accompanying alarm search unit 250 (an example of an accompanying message selection unit), an aggregate file generation unit 260, A consolidated file output unit 270;

  The device monitoring unit 210 detects a communication failure that has occurred in the communication device and recovery of the communication device from the communication failure by executing polling or SNMP.

  The alarm file generation unit 220 generates an alarm file 291 by generating an alarm indicating the occurrence of a communication failure and an alarm indicating recovery from the communication failure. The alarm file 291 is a file including an alarm indicating the occurrence of a communication failure and an alarm indicating recovery from the communication failure. An alarm is also called a failure message.

The alarm classification unit 230 classifies a plurality of alarms included in the alarm file 291 into a failure source alarm and an accompanying alarm, and generates a failure source file 292 and an accompanying file 293.
The failure source alarm is an alarm related to the line concentrator connected by the connected device, and the accompanying alarm is an alarm related to the connected device connected to the line concentrator.
The failure source file 292 is a file including a failure source alarm.
The accompanying file 293 is a file including an accompanying alarm.

The alarm pair search unit 240 searches the failure source file 292 for a pair of a failure source alarm indicating the occurrence of a communication failure and a failure source alarm indicating a recovery from the communication failure, and generates a failure source pair file 294.
The alarm pair search unit 240 searches the accompanying file 293 for a pair of the accompanying alarm indicating the occurrence of the communication failure and the accompanying alarm indicating the recovery from the communication failure, and generates the accompanying pair file 295.
The failure source pair file 294 is a file including a pair of failure source alarms.
The accompanying pair file 295 is a file including a pair of accompanying alarms.

  The accompanying alarm search unit 250 searches the accompanying pair file 295 for an accompanying alarm pair related to the failure source alarm pair included in the failure source pair file 294.

  The aggregate file generation unit 260 generates an aggregate file 296 that includes a failure source alarm pair and an accompanying alarm pair associated with the failure source alarm pair as an alarm group (an example of a failure message group).

  The aggregate file output unit 270 outputs the aggregate file 296.

The device storage unit 290 stores data used, generated or input / output by the device monitoring apparatus 200.
For example, the device storage unit 290 stores an alarm file 291, a failure source file 292, an accompanying file 293, a failure source pair file 294, an accompanying pair file 295, an aggregate file 296, and a device management file 299. .
The device management file 299 is a file including information (for example, IP address) of communication devices.

FIG. 4 is a flowchart showing device monitoring processing of the device monitoring apparatus 200 according to the first embodiment.
Device monitoring processing of the device monitoring apparatus 200 according to Embodiment 1 will be described with reference to FIG. However, the device monitoring process may be a process different from FIG.

  In S110, the device monitoring unit 210 monitors communication devices by executing polling or SNMP. The monitoring method is the same as that of the conventional device monitoring apparatus.

For example, the device monitoring unit 210 monitors communication devices as follows.
The device monitoring unit 210 periodically acquires the IP address of the communication device from the device management file 299 (see FIG. 5), and transmits a response request packet including the acquired IP address as a destination address to the communication device. The response request packet is a communication packet that requests a response packet.
If the response packet is not received from the communication device even after the response waiting time has elapsed, the device monitoring unit 210 determines that a communication failure has occurred in the communication device. That is, the device monitoring unit 210 detects the occurrence of a communication failure.
When the response packet is received from the communication device after detecting the occurrence of the communication failure, the device monitoring unit 210 determines that the communication device has recovered from the communication failure. That is, the device monitoring unit 210 detects recovery from a communication failure.
After S110, the process proceeds to S120.

FIG. 5 is a diagram illustrating an example of the device management file 299 according to the first embodiment.
The device management file 299 in the first embodiment will be described with reference to FIG. However, the configuration of the device management file 299 may be different from that shown in FIG.

The device management file 299 includes a plurality of device management records. One device management record corresponds to one line in the figure.
The device management record includes a device name, a VLAN name, an IP address, a description, and the like.
The device name is an identifier for identifying a communication device.
The VLAN name is an identifier for identifying the VLAN set in the line concentrator. The VLAN name is also a name for identifying the port to which the VLAN is set. VLAN is an abbreviation for virtual local area network.
The IP address is an IP address assigned to the communication device. The IP address includes a network address and a host address. The network address identifies the network to which the communication device is connected, and the host address identifies the communication device. In FIG. 5, the upper three numerical values (1922.7.132) are network addresses, and the lower one numerical value (2xx) is a host address.
The description is a description of the communication device.
Returning to FIG. 4, the description will be continued from S120.

In S120, the alarm file generation unit 220 generates an alarm indicating the occurrence of the communication failure detected in S110.
Further, the alarm file generation unit 220 generates an alarm indicating recovery from the communication failure detected in S110.
Then, the alarm file generation unit 220 generates an alarm file 291 including an alarm indicating the occurrence of a communication failure and an alarm indicating a recovery from the communication failure.
The generation method of the alarm and alarm file 291 is the same as that of the conventional device monitoring apparatus.
After S120, the process proceeds to S130.

FIG. 6 is a diagram illustrating a specific example of the network configuration according to the first embodiment.
A specific example of the network configuration in the first embodiment will be described with reference to FIG.

The device name of the switch device 110 is L3SW02. The switch device 110 is a line concentrator to which a plurality of switch devices 120 are connected.
A VLAN and an IP address are assigned to the physical port of the switch device 110. VL132 and VL144 are VLAN names.
The IP address of the VL132 is 192.7.132.254, and the IP address of the VL144 is 192.7.144.254.

The VL 132 includes three logical ports.
The first logical port is connected to the physical port of L2SWv64, the second logical port is connected to the physical port of L2SWv65, and the third logical port is connected to the physical port of L2SWxFQ. L2SWv64, L2SWv65, and V2SWxFQ are device names of the switch device 120. The switch device 120 is a connection device connected to the switch device 110.
An IP address is assigned to the physical port of the switch device 120.
The IP address of L2SWv64 is 192.7132.240, the IP address of L2SWv65 is 192.7132.239, and the IP address of L2SWxFQ is 192.7132.241.

When the switch device 110 fails, a communication failure occurs in the physical port of the switch device 110, and a communication failure occurs in the physical port of the switch device 120 connected to the switch device 110.
When the switch device 110 recovers, the physical port of the switch device 110 recovers from the communication failure, and the physical port of the switch device 120 connected to the switch device 110 recovers from the communication failure.

FIG. 7 is a diagram illustrating an example of the alarm file 291 according to the first embodiment.
An example of the alarm file 291 according to Embodiment 1 will be described with reference to FIG.

The alarm file 291 includes a plurality of alarms. One alarm corresponds to one line in the figure.
The alarm includes date and time, device name (example of network determination information), details of communication failure that occurred (example of device classification and failure status), recovered communication failure content (example of device classification and failure status), VLAN name and An IP address (an example of network determination information) is included.
“Interface down” means the occurrence of a communication failure of the line concentrator, and “interface recovery” means the recovery of the line concentrator from the communication failure.
“Session down” means the occurrence of communication failure of the connected device, and “session recovery” means recovery of the connected device from the communication failure.
The brackets appended after “Interface Down” and “Interface Recovery” indicate the VLAN name and IP address.
For example, the alarm file generation unit 220 generates an alarm file 291 as shown in FIG.
Returning to FIG. 4, the description will be continued from S130.

In S <b> 130, the alarm classification unit 230 generates a failure source file 292 and an accompanying file 293 based on the alarm file 291.
After S130, the process proceeds to S140.

FIG. 8 is a flowchart of the alarm classification process (S130) in the first embodiment.
The alarm classification process (S130) in the first embodiment will be described with reference to FIG. However, the alarm classification process (S130) may be a process different from FIG.

In S131, the alarm classification unit 230 selects an unselected alarm from the alarm file 291.
After S131, the process proceeds to S132.

In S132, the alarm classification unit 230 determines whether the alarm selected in S131 is a failure source alarm or an accompanying alarm.
For example, an alarm including “interface down” or “interface recovery” is a failure source alarm. An alarm including “session down” or “session recovery” is an accompanying alarm.
If the alarm is a failure source alarm, the process proceeds to S133.
If the alarm is an accompanying alarm, the process proceeds to S134.

In S133, the alarm classification unit 230 registers the alarm selected in S131 in the failure source file 292.
After S133, the process proceeds to S135.

In S134, the alarm classification unit 230 registers the alarm selected in S131 in the accompanying file 293.
After S134, the process proceeds to S135.

In S135, the alarm classification unit 230 determines whether there is an unselected alarm that has not been selected in S131.
If there is an unselected alarm (YES), the process returns to S131.
If there is no unselected alarm (NO), the alarm classification process (S130) ends.

FIG. 9 is a diagram illustrating an example of the failure source file 292 according to the first embodiment.
For example, the alarm classification unit 230 generates a failure source file 292 (see FIG. 9) based on the alarm file 291 (see FIG. 7).
The failure source file 292 includes a failure source alarm including “interface down” or “interface recovery”, but does not include an accompanying alarm including “session down” or “session recovery”.

FIG. 10 is a diagram illustrating an example of the accompanying file 293 according to the first embodiment.
For example, the alarm classification unit 230 generates an accompanying file 293 (see FIG. 10) based on the alarm file 291 (see FIG. 7).
The accompanying file 293 includes an accompanying alarm including “session down” or “session recovery”, but does not include a failure source alarm including “interface down” or “interface recovery”.
Returning to FIG. 4, the description will be continued from S140.

In S <b> 140, the alarm pair search unit 240 generates a failure source pair file 294 based on the failure source file 292 and generates an accompanying pair file 295 based on the accompanying file 293.
After S140, the process proceeds to S150.

FIG. 11 is a flowchart of the alarm pair search process (S140) in the first embodiment.
The alarm pair search process (S140) in the first embodiment will be described with reference to FIG. However, the alarm pair search process (S140) may be a process different from FIG.

In S141, the alarm pair search unit 240 selects an unselected failure source alarm from the failure source file 292 as the first failure source alarm.
After S141, the process proceeds to S142.

In S142, the alarm pair search unit 240 selects a failure source alarm including the same device name as the device name included in the first failure source alarm from the failure source file 292 as the second failure source alarm.
After S142, the process proceeds to S143.

In S143, the alarm pair search unit 240 registers the first failure source alarm and the second failure source alarm in the failure source pair file 294 as a failure source alarm pair.
After S143, the process proceeds to S144.

In S144, the alarm pair search unit 240 determines whether there is an unselected failure source alarm that has not been selected in S141.
If there is an unselected failure source alarm (YES), the process returns to S141.
If there is no unselected failure source alarm (NO), the process proceeds to S145.

In S145, the alarm pair search unit 240 selects an unselected accompanying alarm from the accompanying file 293 as the first accompanying alarm.
After S145, the process proceeds to S146.

In S145, the alarm pair search unit 240 selects, from the accompanying file 293, an accompanying alarm that includes the same device name as the device name included in the first accompanying alarm as the second accompanying alarm.
After S145, the process proceeds to S146.

In S146, the alarm pair search unit 240 registers the first accompanying alarm and the second accompanying alarm in the accompanying pair file 295 as a pair of accompanying alarms.
After S146, the process proceeds to S147.

In S147, the alarm pair search unit 240 determines whether there is an unselected accompanying alarm that has not been selected in S145.
If there is an unselected accompanying alarm (YES), the process returns to S145.
When there is no unselected accompanying alarm (NO), the alarm pair search process (S140) ends.

FIG. 12 is a diagram illustrating an example of the failure source pair file 294 according to the first embodiment.
For example, the alarm pair search unit 240 generates a failure source pair file 294 (see FIG. 12) based on the failure source file 292 (see FIG. 9).
The failure source pair file 294 includes a failure source alarm pair for each of the VL 132 and the VL 144.
The first failure source alarm (an example of a failure source message that has occurred) of the failure source alarm pair is a failure source alarm including “interface down”.
The second failure source alarm (an example of the recovery failure source message) in the failure source alarm pair is a failure source alarm including “interface recovery”.

FIG. 13 is a diagram illustrating an example of the accompanying pair file 295 according to the first embodiment.
For example, the alarm pair search unit 240 generates an accompanying pair file 295 (see FIG. 13) based on the accompanying file 293 (see FIG. 10).
The accompanying pair file 295 includes an accompanying alarm pair for each of L2SWv64, L2SWv65, and L2SWxFQ.
The first accompanying alarm (an example of an accompanying message of occurrence) of the accompanying alarm pair is an accompanying alarm including “session down”.
The second incidental alarm (an example of the incidental message for recovery) of the incidental alarm pair is an incidental alarm including “session recovery”.
Returning to FIG. 4, the description will be continued from S150.

In S150, the accompanying alarm search unit 250 and the aggregated file generation unit 260 generate an aggregated file 296 based on the failure source pair file 294 and the accompanying pair file 295.
After S150, the process proceeds to S170.

FIG. 14 is a flowchart of the accompanying alarm search process (S150) in the first embodiment.
The accompanying alarm search process (S150) in the first embodiment will be described with reference to FIG. However, the accompanying alarm search process (S150) may be a process different from FIG.

In S151, the accompanying alarm search unit 250 selects an unselected pair of failure source alarms from the failure source pair file 294.
After S151, the process proceeds to S152.

In S152, the accompanying alarm search unit 250 acquires the network address of the failure source alarm pair selected in S151.
For example, when an IP address is included in a pair of failure source alarms, the accompanying alarm search unit 250 acquires a network address from the IP address.
For example, if the IP address is not included in the failure source alarm pair, the accompanying alarm search unit 250 assigns the IP address associated with the same VLAN name as the VLAN name included in the failure source alarm pair to the device management file 299. Select from. Then, the accompanying alarm search unit 250 acquires a network address from the selected IP address.
After S152, the process proceeds to S153.

In S153, the aggregated file generation unit 260 registers the contents of the failure source alarm pair selected in S151 in the aggregated file 296.
When no IP address is included in the pair of failure source alarms, the aggregate file generation unit 260 also registers the IP address selected in S152 in the aggregate file 296.
After S153, the process proceeds to S154.

  S154 to S158 are executed for each pair of failure source alarms selected in S151.

In S154, the accompanying alarm search unit 250 selects an unselected pair of accompanying alarms from the accompanying pair file 295.
After S154, the process proceeds to S155.

In S155, the accompanying alarm search unit 250 acquires the network address of the accompanying alarm pair selected in S154.
For example, when an IP address is included in a pair of accompanying alarms, the accompanying alarm search unit 250 acquires a network address from the IP address.
For example, if the IP address is not included in the accompanying alarm pair, the accompanying alarm search unit 250 selects from the device management file 299 an IP address associated with the same device name as the device name included in the accompanying alarm pair. To do. Then, the accompanying alarm search unit 250 acquires a network address from the selected IP address.
After S155, the process proceeds to S156.

In S156, the accompanying alarm search unit 250 determines whether the network address of the accompanying alarm pair acquired in S154 is the same as the network address of the failure source alarm pair acquired in S152.
If the network address of the accompanying alarm pair is the same as the network address of the failure source alarm pair (YES), the process proceeds to S157.
If the network address of the accompanying alarm pair is different from the network address of the failure source alarm pair (NO), the process proceeds to S158.

In step S157, the aggregate file generation unit 260 registers the contents of the accompanying alarm pair selected in step S154 in the aggregate file 296.
When the IP address is not included in the accompanying alarm pair, the aggregate file generation unit 260 also registers the IP address selected in S155 in the aggregate file 296.
The accompanying alarm pair belongs to the same alarm group as the failure source alarm pair registered in S153.
After S157, the process proceeds to S158.

In S158, the accompanying alarm search unit 250 determines whether there is an unselected pair of accompanying alarms not selected in S154.
If there is an unselected pair of accompanying alarms (YES), the process returns to S154.
If there is no unselected pair of accompanying alarms (NO), the process proceeds to S159.

In S159, the accompanying alarm search unit 250 determines whether there is an unselected pair of failure source alarms not selected in S151.
If there is an unselected pair of failure source alarms (YES), the process returns to S151.
If there is no unselected pair of failure source alarms (NO), the accompanying alarm search process (S150) ends.

FIG. 15 is a diagram illustrating an example of the consolidated file 296 according to the first embodiment.
For example, the accompanying alarm search unit 250 and the aggregate file generation unit 260 generate the aggregate file 296 (see FIG. 15) based on the failure source pair file 294 (see FIG. 12) and the accompanying pair file 295 (see FIG. 13). To do.
The consolidated file 296 includes an alarm group for each line concentrator. Further, the aggregate file 296 includes an alarm group for each VLAN.

A block starting from “L3SW02” (a portion surrounded by a broken line) indicates an alarm group of the line concentrator identified by L3SW02.
A block starting with “VL132” (four lines starting with “VL132”) indicates a VLAN alarm group identified by VL132.
The line beginning with “VL132” includes the contents of the failure source alarm pair. For example, the line beginning with “VL132” includes the IP address of the VL132, the date and time of occurrence of interface down (communication failure), the date and time of recovery from interface down, and the like.
The line beginning with “L2SW” contains the contents of the accompanying alarm pair. For example, the line starting with “L2SWv64” includes the IP address of L2SWv64, the date and time of occurrence of equipment down (communication failure), the date and time of recovery from equipment down, and the like.
Returning to FIG. 4, the description will be continued from S170.

In S <b> 170, the aggregate file output unit 270 outputs the contents of the aggregate file 296.
For example, the aggregate file output unit 270 displays the contents of the aggregate file 296 on the display.

By referring to the aggregate file 296, the administrator can easily grasp the state of communication failure.
For example, the administrator can grasp the following communication failure status by referring to the aggregated file 296 (see FIG. 15).
The administrator can grasp that a communication failure has occurred in the L2SWv64, L2SWv65, and L2SWxFQ connected to the VL132 due to the occurrence of the communication failure in the VL132 of the L3SW02.
The administrator can grasp that the L2SWv64, L2SWv65, and L2SWxFQ connected to the VL132 have recovered from the communication failure due to the recovery of the VL132 of the L3SW02 from the communication failure.
After S170, the device monitoring process ends.

FIG. 16 is a hardware configuration diagram of the device monitoring apparatus 200 according to the first embodiment.
The hardware configuration of the device monitoring apparatus 200 according to Embodiment 1 will be described with reference to FIG. However, the hardware configuration of the device monitoring apparatus 200 may be different from the configuration illustrated in FIG.

The device monitoring apparatus 200 is a computer including an arithmetic device 901, an auxiliary storage device 902, a main storage device 903, a communication device 904, and an input / output device 905.
The arithmetic device 901, auxiliary storage device 902, main storage device 903, communication device 904, and input / output device 905 are connected to the bus 909.

The arithmetic device 901 is a CPU (Central Processing Unit) that executes a program.
The auxiliary storage device 902 is, for example, a ROM (Read Only Memory), a flash memory, or a hard disk device.
The main storage device 903 is, for example, a RAM (Random Access Memory).
The communication device 904 performs communication via the Internet, a LAN (local area network), a telephone line network, or other networks in a wired or wireless manner.
The input / output device 905 is, for example, a mouse, a keyboard, or a display device.

The program is stored in the auxiliary storage device 902.
For example, an operating system (OS) is stored in the auxiliary storage device 902. In addition, a program that realizes the function described as “˜unit” is stored in the auxiliary storage device 902.
The program is stored in the auxiliary storage device 902, loaded into the main storage device 903, read into the arithmetic device 901, and executed by the arithmetic device 901.

  “Determining”, “determining”, “extracting”, “detecting”, “setting”, “registering”, “selecting”, “generating”, “to” Information, data, file, signal value or variable value indicating the result of processing such as “input”, “output of”, etc.

  According to the first embodiment, it is possible to easily grasp the situation when a communication failure occurs and the situation when the communication device recovers from the communication failure even if there is no network configuration information indicating the connection relationship in the communication device.

The first embodiment is an example of the device monitoring apparatus 200.
That is, the device monitoring apparatus 200 may not include some of the components described in the first embodiment. In addition, the device monitoring apparatus 200 may include components that are not described in the first embodiment.
For example, the device monitoring apparatus 200 may not include the device monitoring unit 210 and the alarm file generation unit 220. In that case, the alarm file 291 is generated by a conventional device monitoring apparatus.

  The processing procedure described in the first embodiment using a flowchart or the like is an example of the processing procedure of the method and program according to the first embodiment. The method and program according to the first embodiment may be realized by a processing procedure that is partially different from the processing procedure described in the first embodiment.

  The “˜unit” in the first embodiment can be read as “˜processing”, “˜process”, “˜program”, and “˜device”.

  100 device monitoring system, 109 network, 110 switch device, 111 port, 120 switch device, 121 port, 200 device monitoring device, 210 device monitoring unit, 220 alarm file generation unit, 230 alarm classification unit, 240 alarm pair search unit, 250 Accompanying alarm search unit, 260 Aggregated file generation unit, 270 Aggregated file output unit, 290 Device storage unit, 291 Alarm file, 292 Failure source file, 293 Associated file, 294 Failure source pair file, 295 Associated file, 296 Consolidated file, 299 Device management file, 901 arithmetic device, 902 auxiliary storage device, 903 main storage device, 904 communication device, 905 input / output device, 909 bus.

Claims (4)

A failure message storage unit for storing a plurality of failure messages including a device classification indicating a type of a failure device in which a communication failure has occurred, and network determination information for determining a network to which the failure device is connected;
A failure source message selecting unit that selects, from the plurality of failure messages, a failure message including a device classification indicating a concentrator connected to a communication device as the type of the failed device, as a failure source message;
A failure message including network determination information that determines the same network as the network determined by the network determination information included in the failure source message is selected as an accompanying message from the remaining failure messages excluding the failure source message. An accompanying message selection section;
A failure message aggregating apparatus comprising: an aggregate file generation unit that generates an aggregate file including a failure message group in which the failure source message and the accompanying message are collected. The failure source message includes, as the network determination information, a network address that identifies a network to which the failed device is connected,
The remaining failure message includes, as the network determination information, a device name that identifies a communication device,
The accompanying message selection unit is configured to use the same network address as the network address included in the failure source message based on a device management file including a network address identifying a network to which the communication device is connected in association with a device name of the communication device. The failure message aggregating apparatus according to claim 1, wherein a failure message including a device name associated with is selected as the accompanying message. The failure message included in the plurality of failure messages includes a failure state indicating either failure occurrence or failure recovery,
The failure source message selection unit is a failure source message that is a failure message that includes a failure state that indicates the occurrence of the failure and a recovery message that is a failure message that includes a failure state that indicates the failure recovery. Select the original failure message and
The accompanying message selection unit includes, as the accompanying message, an accompanying message that is a failure message including a failure state indicating the occurrence of the failure, and a recovery accompanying message that is a failure message including a failure state indicating the failure recovery. The failure message aggregating apparatus according to claim 1 or 2, wherein the failure message aggregating apparatus is selected. A failure message aggregation program using a plurality of failure messages,
The plurality of failure messages are data including a device classification indicating a type of a failed device in which a communication failure has occurred, and network determination information for determining a network to which the failed device is connected,
A failure source message selection process for selecting, from the plurality of failure messages, a failure message including a device classification indicating a concentrator connected to a communication device as a type of the failed device, as a failure source message;
A failure message including network determination information that determines the same network as the network determined by the network determination information included in the failure source message is selected as an accompanying message from the remaining failure messages excluding the failure source message. Accompanying message selection processing;
A failure message aggregation program for causing a computer to execute an aggregate file generation process for generating an aggregate file including a failure message group in which the failure source message and the accompanying message are collected.

Images