JP2017034403A - Device, program and method for estimating service influence cause - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a service influence cause estimation device which can appropriately prioritize among two or more suspected faulty points when an abnormal flow affecting a service includes two or more suspected faulty points.SOLUTION: A service influence cause device 1 compares, for each suspected faulty point, a most forward position, which is a most forward position among suspected faulty points in an abnormal flow in a preceding test packet, with a present most forward position of suspected faulty points in a new abnormal flow in a present test packet. The service influence cause device 1 then sets a higher suspected fault degree of the suspected faulty point, in which the present most forward position is ahead of the preceding most forward position, as compared to a suspected fault degree of the suspected faulty point in which the present most forward position is either the same as or behind the previous most forward position.SELECTED DRAWING: Figure 3

Description

  The present invention relates to a service influence cause estimation device, a service influence cause estimation program, and a service influence cause estimation method.

  2. Description of the Related Art A technique for estimating a location where a failure or quality degradation occurs in a communication network when providing a service via the communication network is known.

  Patent Document 1 describes a plurality of service components (physical facilities) arranged between a use terminal and an information source (corresponding to a server) in response to a report of a trouble occurrence on a communication network from a user. A communication sequence when all service components are normal and a communication sequence when each service component fails are generated, and these communication sequences are compared with observation information at the time of failure declaration. Thus, a technique for estimating a failed service component is disclosed (details will be described later as “first comparative example”).

  In addition, by capturing packets between devices on the communication network and analyzing the captured packets, various characteristic values (reorder width, traffic flow, RTT (Round-Trip Time), Packet loss, jitter, session establishment rate, window size, server response time), the normality of the characteristic value is determined based on the calculated values, and the cause of communication quality degradation between the devices is determined. An estimation technique is also known (details will be described later as “second comparative example”).

  Furthermore, Non-Patent Document 1 transmits a test packet to each flow using SFC (Service Function Chaining) technology, which is a flexible route control technology that enables selective use of virtualized communication network functions. Then, the transfer function unit (corresponding to a physical / virtual router or physical / virtual switch) through which the test packet has passed and the ID of the application are respectively stored in a list provided in the test packet, and the list in which the ID is stored A technique for estimating a fault location by comparing with set information is disclosed (details will be described later as “third comparative example”).

  However, in the technologies of the first to third comparative examples, it is impossible to detect an abnormality even if a failure or deterioration occurs in software such as virtualization equipment or application software (Patent Document 1), and for equipment that cannot be assigned an ID. Failure diagnosis cannot be performed (Non-Patent Document 1), work is complicated, the scale of the apparatus is large, and the cause cannot be estimated when service quality is deteriorated. There are defects such as.

  On the other hand, in Patent Document 2, in a tree-type network topology composed of branches and terminals, when a failure of all virtual terminals from a certain branch to the tip of the tree is detected, the branch part is A technique for estimating a failure location is disclosed.

Japanese Patent Laid-Open No. 10-200527 JP 2006-229421 A

Y. Jiang et al., "Fault Management in Service Function Chaining", [online], October 27, 2014, The Internet Engineering Task Force, [Search January 27, 2015], Internet <URL: https: // datatracker.ietf.org/doc/draft-jxc-sfc-fm/?include_text=1>

  However, the technique described in Patent Document 2 is not versatile because it depends on the estimation of the fault location being a tree-type network configuration.

In addition, using physical facilities and software that transfer data over a communication network as service components, it was determined whether multiple flows configured using one or more service components are normal flows or abnormal flows In some cases, the abnormal flow may include a plurality of suspected faults that may cause service effects.
However, since it is not known which of the two or more suspected failure locations is more likely to actually fail, the search order is determined based on, for example, the ID order of the service component that is the suspected failure location. The work cannot be made more efficient because of the search and identification of the failure location.

  The present invention was devised in view of the above circumstances, and in the case where a service-affected abnormal flow includes two or more suspected fault locations, prioritization is suitably performed between the two or more suspected fault locations. It is an object of the present invention to provide a service influence cause estimation device, a service influence cause estimation program, and a service influence cause estimation method.

  In order to achieve the above object, the service influence cause estimating apparatus of the present invention is configured using one or more of the service components as physical components and software to which data is transferred over a communication network. Based on the received reply packet, a packet transmitting unit that transmits a test packet for each flow to a plurality of flows, a packet receiving unit that receives a reply packet of the test packet that passes through the flow, and the flow A group configuration unit that determines whether the flow is a normal flow or an abnormal flow, and a suspected failure point estimation unit that estimates a suspected failure point that causes a service effect on the network in the abnormal flow, The failure suspected part estimation unit is configured to perform the abnormal flow for the previous test packet. The common service component is estimated as the suspected failure location, and there are two or more service components estimated as the suspected failure location with respect to the previous test packet. In the flow determined to be an abnormal flow, when the previous test packet includes one or more service components estimated as the suspected failure location, the suspected failure location in the abnormal flow in the previous test packet The previous forefront position, which is the forefront position, and the current forefront position, which is the foremost position of the suspected failure location in the new abnormal flow in the current test packet, for each suspected failure location, Suspicious failure of the suspected failure location where the foremost position this time is ahead of the previous forefront position Is set higher than the suspected failure level of the suspected failure location where the current forward position is the same as the previous forward position or the forward current position is behind the forward forward position. To do.

  According to such a configuration, when there are two or more suspected fault locations in the abnormal flow of the previous test packet and a new abnormal flow including the previous suspected fault location has occurred in the current test packet, Since the failure suspected degree is set according to the forefront position, prioritization between two or more trouble suspected locations, that is, the failure suspected degree can be suitably set.

  The suspected fault location estimation unit may compare the previous forefront position and the current forefront position based on a link length between the service components. Further, it is desirable that the failure suspected place estimation unit compares the previous forefront position and the current forefront position based on a difference in transmission time for each flow in each time of the test packet.

  According to such a configuration, the forefront position of the suspected failure location is extracted in consideration of the difference between the link length of the abnormal flow and / or the transmission time of the test packet, so that the suspected failure rate can be set more suitably.

  The suspected fault location estimation unit includes only one service component that is presumed to be the suspected fault location in the previous test packet in the flow newly determined as an abnormal flow for the current test packet. The failure suspected degree of the suspected failure location is estimated as the suspected failure location in the previous test packet and newly determined as an abnormal flow, the failure of the suspected failure location is not included in the flow. It is desirable to set it higher than the suspicion level.

  According to such a configuration, when there are two or more suspected faults in the abnormal flow of the previous test packet and a new abnormal flow including the previous suspected fault occurs in the current test packet, Since the suspected failure level of the suspected failure included in the new abnormal flow is set higher than the suspected failure rate of the suspected failure not included in the new abnormal flow this time, between two or more suspected failure locations Prioritization, that is, failure suspect level can be suitably set.

  Further, the service influence cause estimation program of the present invention includes a computer, a plurality of flows configured using one or more of the service components as physical components and software for transferring data over a communication network. A packet transmission unit that transmits a test packet for each flow, a packet reception unit that receives a reply packet of the test packet that passes through the flow, and the flow is a normal flow based on the received reply packet Functioning as a group configuration unit that determines whether the flow is an abnormal flow, and a failure suspected location estimation unit that estimates a suspected failure location that causes a service effect on the network in the abnormal flow, and the suspected failure location The estimation unit relates to the previous test packet. The service component common to the flow is estimated as the suspected failure location, and regarding the previous test packet, there are two or more service components estimated as the suspected failure location, and for the current test packet, In the flow that has been newly determined as an abnormal flow, when the previous test packet includes one or more service components estimated as the suspected failure location, the failure in the abnormal flow in the previous test packet The previous forefront position which is the forefront position of the suspected place and the current forefront position which is the forefront position of the suspected place in the new abnormal flow in the current test packet are compared for each of the suspected faults. , Where the suspected failure location is such that the current forefront position is ahead of the previous forefront position. The failure suspect degree is set higher than the failure suspect degree of the suspected failure point where the current forefront position is the same as the previous forefront position or the current forefront position is behind the forefront position of the previous time. It is characterized by.

  Further, the service influence cause estimation method of the present invention uses a physical facility and software for transferring data on a communication network as service components, and a plurality of flows configured using one or more of the service components. A packet transmission step for transmitting a test packet for each flow, a packet reception step for receiving a reply packet of the test packet passing through the flow, and whether the flow is a normal flow based on the received reply packet A suspected failure location estimation step, including: a group configuration step for determining whether the flow is an abnormal flow; and a suspected failure location estimation step for estimating a suspected failure location that causes a service effect on the network in the abnormal flow. In the previous test packet The service component common to the abnormal flow is estimated as the suspected failure location, and there are two or more service components estimated as the suspected failure location with respect to the previous test packet, and the current test packet In the flow newly determined as an abnormal flow, in the previous abnormal flow in the previous test packet when the previous test packet includes one or more service components estimated as the suspected failure location The previous forefront position that is the forefront position of the suspected failure location and the current forefront position that is the forefront position of the suspected failure location in the new abnormal flow in the current test packet for each suspected failure location In comparison, the failure coverage in which the current foremost position is ahead of the previous forefront position is compared. The failure suspected degree of the location is set higher than the suspected failure degree of the suspected failure location in which the current frontmost position is the same position as the previous frontmost position or the current frontmost position is behind the previous frontmost position. It is characterized by doing.

  According to the present invention, when an abnormal flow having a service influence includes two or more suspected fault locations, prioritization between two or more suspected fault locations can be suitably performed.

1 is an overall configuration diagram of a system according to an embodiment of the present invention. It is a block diagram which shows the outline | summary of the hardware constitutions of the service influence cause estimation apparatus concerning one Embodiment of this invention. It is a functional block diagram explaining the function which a central processing unit performs based on the service influence cause estimation program concerning one Embodiment of this invention. It is explanatory drawing of the data structure registered into equipment information DB of the service influence cause estimation apparatus concerning one Embodiment of this invention. It is explanatory drawing of the data structure registered into software information DB of the service influence cause estimation apparatus concerning one Embodiment of this invention. It is explanatory drawing which shows an example of the flow model concerning one Embodiment of this invention. An example of a test packet according to an embodiment of the present invention will be described. It is a flowchart of the process which groups each flow concerning one Embodiment of this invention. FIG. 9 is a state transition diagram illustrating determination in grouping in FIG. 8. It is explanatory drawing explaining the cause estimation process of the service influence in one Embodiment of this invention. It is a flowchart for selecting whether the 1st cause specific part is used in one embodiment of the present invention, or the 2nd cause specific part is used. It is explanatory drawing explaining the modification of the cause estimation process of the service influence in one Embodiment of this invention. It is explanatory drawing explaining the modification of the cause estimation process of the service influence in one Embodiment of this invention. It is explanatory drawing explaining the modification of the cause estimation process of the service influence in one Embodiment of this invention. It is explanatory drawing explaining the example of a setting of failure suspected degree in one Embodiment of this invention. It is explanatory drawing explaining the example of a setting of failure suspected degree in one Embodiment of this invention. It is a flowchart of the process which sets the failure suspect degree in one Embodiment of this invention. It is explanatory drawing explaining the example of a setting of failure suspected degree in one Embodiment of this invention. It is explanatory drawing explaining the example of a setting of failure suspected degree in one Embodiment of this invention. It is explanatory drawing explaining the technical content of a 1st comparative example. It is explanatory drawing explaining the technical content of the 2nd comparative example. It is explanatory drawing explaining the technical content of the 3rd comparative example.

First, before describing the present embodiment, a plurality of comparative examples for the present embodiment will be described.
[Comparative example]
(First comparative example)
In this specification, “degradation” occurs in the service quality when the network administrator has an abnormality in which an alarm indicating the occurrence of the abnormality cannot be confirmed, and “failure” occurs in the service quality. The occurrence of an error occurs when an abnormality that allows the network administrator to confirm the alarm has occurred.

  FIG. 20 is an explanatory diagram for explaining the technical contents of the first comparative example (Patent Document 1). In this network service failure diagnosis method and apparatus, when a user uses a service, a facility information database (DB) that describes roles related to each of a plurality of service components arranged between the terminal and an information source 201 and a design information database (DB) 202 describing operations at the time of normality and failure of each service component. An example of registration information in the facility information DB 201 is indicated by reference numeral 203.

  First, when a user of a communication network (user A) declares a search with the user ID and service name used (S211), the end-to-end equipment model of the user A is determined based on the equipment information DB 201. The service component (physical device) is output as a unit (S212). Then, referring to the design information DB 202, based on the equipment model, a communication sequence when the components of all services are normal is generated (S213). In addition, a communication sequence when a component of each service fails is generated with reference to the design information DB 202 (S214).

Next, the normal communication sequence (S213), the abnormal communication sequence (S214), and the observation information (information input by the maintainer of the communication system) are compared, and the communication includes information common to both. Extract the sequence. And the service component which did not play the original role among each service component is extracted (S215, S216). In this example, in S215, no. Communication sequences at the time of failure of 48 NICs (Network Interface Controllers) are shown as communication sequence numbers 1 to 4. These are examples of communication sequences of various failure patterns. In addition, the information input by the maintenance person in S216 is that the warning “Alarm A” is displayed, the message “Message B” (the message “No response from host” in S214) is displayed, And a declaration from the user A that “XX does not move”.
In this example, the sequence numbers 1 and 3 are matched by the comparison between the normal / abnormal communication sequence and the observation information, and these are extracted. Then, in the communication sequence of sequence numbers 1 and 3, it is determined which service component does not play the original role, and the abnormal part is estimated.

  However, in the first comparative example, it is necessary to comprehensively prepare a communication sequence at the time of failure, so that the work is complicated. In the first comparative example, software such as virtualization equipment and application software is excluded from service components (only physical devices are targeted). When the virtual equipment or application software is set, when converting it to an equipment model, the virtual equipment or application software coexisting with a physical device or a single physical device Therefore, it is not possible to distinguish between the virtual equipment and application software existing in the system, so that it is necessary to check each one manually, and the work is complicated. Furthermore, since the first comparative example determines an abnormality in the communication sequence, there is also a problem in that the service component that is the cause cannot be estimated when the communication sequence is normal but the service quality has deteriorated. .

(Second comparative example)
FIG. 21 is an explanatory diagram for explaining the technical contents of the second comparative example. In this quality degradation cause estimation method, a user terminal 301 and a server 302 are connected via a network 303 as shown in FIG. Then, the quality degradation cause estimation device 304 provided in the network 303 captures the packet P311 between the user terminal 301 and the server 302, and analyzes the captured packet P311. Calculates values (reorder width, traffic flow, RTT (Round-Trip Time), packet loss, jitter, session establishment rate, window size, server response time), and determines the normality of the characteristic value based on the calculated values The cause of communication quality degradation between the user terminal 301 and the server 302 is estimated.

  FIG. 21B is a flowchart of the determination process when the characteristic value is an example of the session establishment rate. When the characteristic value is the session establishment rate, first, the quality degradation cause estimation device 304 determines whether or not the session establishment failure rate is greater than a predetermined threshold (S321). When it is not large (N in S321), the quality degradation cause estimating apparatus 304 determines that the network 303 is normal (S322). When it is larger (Y in S321), the quality degradation cause estimation device 304 determines whether there is a session termination device (S323). If there is a session termination device (Y in S323), there is a possibility that the session termination device has a cause of abnormality, so the quality degradation cause estimation device 304 determines that it is necessary to check the log of the session termination device. (S324). When there is no session termination device (N in S323), the quality degradation cause estimation device 304 determines that there is a cause in the server 302 (S325).

  FIG. 21C is a flowchart of the determination process when the characteristic value is an example of the window size. When the characteristic value is the window size, first, the quality deterioration cause estimating device 304 determines whether or not the window size is smaller than a predetermined threshold (S331). When it is equal to or greater than the threshold (N in S331), the quality degradation cause estimating apparatus 304 determines that the network 303 is normal (S332). When it is smaller than the threshold value (Y in S331), the quality degradation cause estimation device 304 determines whether there is a bandwidth control device (S333). If there is a bandwidth control device (Y in S333), there is a possibility that the bandwidth control device has a cause of abnormality, so the quality degradation cause estimation device 304 determines that it is necessary to check the log of the bandwidth control device. (S334). When there is no bandwidth control device (N in S333), the quality degradation cause estimation device 304 determines that there is a cause in the server 302 (S335).

  However, such a second comparative example is a capture point provided in a device in the network 303 when the cause location including individual devices in the network 303 is estimated end-to-end for each flow. Since the amount of data stored in the captured packet P311 and the load on the determination process increase, the operation becomes complicated and the apparatus scale becomes large. For this reason, it is difficult to apply in a large-scale network such as a communication carrier.

(Third comparative example)
FIG. 22 is an explanatory diagram for explaining the technical contents of the third comparative example. In the failure diagnosis method including this virtualization mechanism, a plurality of servers 402 and a plurality of switches (network switches) 403 are arranged in a network 401 as shown in FIG. The detection node 404 is one of the nodes in the network 401. The server 402 includes a transfer function unit (corresponding to a virtual switch) 411 that performs data transfer, and application software 412. SFF1 to SFF3 are IDs of the transfer function units 411, and SF1 to SF5 are IDs of the application software 412.

  This technology uses SFC (Service Function Chaining), which is a flexible route control technology that enables selective use of virtualized network functions. The detection node 404 transmits one test packet for each flow. This test packet includes a list for storing the IDs of the transfer function unit 411 and the application software 412. Upon receiving the test packet, the server 402 stores the ID of its own transfer function unit 411 in the list of the test packet, copies the stored list, and replies the copied list to the detection node 404 of the transmission source. Thereafter, the test packet having the copy source list is transferred to the application software 412 of the same server 402. Here, as with the transfer function unit 411, the list is copied, and the reply is sent to the detection node 404 that is the transmission source of the copied list. Is done. The same applies when the test packet is transferred to another server 402.

  FIG. 22B shows an example of setting information 421 stored in advance in the detection node 404. The setting information 421 is arranged from the top in the order of passing through the ID of each part of the passage route of the test packet to be transferred for a certain flow. In this example, the test packet is transferred to the server 402 having the transfer function unit 411 with the ID SFF1, and after the test packet sequentially passes through the transfer function unit 411 and the application software 412, the transfer function unit 411 with the ID SFF2. In this example, a test packet is transferred to a server 402 equipped with and the test packet sequentially passes through the transfer function unit 411 and application software 412. Therefore, if the IDs of the respective parts that the test packet is scheduled to pass are indicated in order, “SFF1 → SF1 → SFF1 → SFF2 → SF2 → SFF2 → SF3 → SFF2”.

  FIG. 22C is an example of a list replied to the detection node 404 based on the test packet. List 1 is replied from transfer function unit 411 with ID SFF1, list 2 is replied from application software 412 with ID SF1, list 3 is replied from transfer function unit 411 with ID SFF1, and list 4 has ID SFF2. The transfer function unit 411 is replied.

By comparing these lists with the setting information 421, it is possible to determine which part of each transfer function unit 411 and application software 412 has an abnormality. Compared with the setting information 421, it can be seen that List 1 to List 4 are all correctly replied to the detection node 404. That is, the lowest ID of each of the list 1 to the list 4 exists in the setting information 421, and the ID is a reply source of the list, so that the transfer function unit 411 or application software 412 of the reply source operates normally. Can be determined.
Here, if there is an abnormality in the transfer function unit 411 whose ID is SFF2, the list 4 in which the SFF2 of ID is recorded at the bottom is not replied. It is determined that there is an abnormality in the transfer function unit 411 that is SFF2.

  However, in the third comparative example, since only the transfer function unit 411 and the application software 412 that can be assigned IDs are targeted for abnormality diagnosis, other physical devices or software that cannot be assigned other IDs. There is a problem that abnormality diagnosis cannot be performed for equipment. In addition, there is a problem in that the cause location cannot be estimated when the quality of service is deteriorated only by comparing the setting information 421 with the list in which the IDs of the transfer function unit 411 and the application software 412 are stored. .

[Embodiment]
Next, the technical contents of the present embodiment in which the problems in the first to third comparative examples are solved will be described.
(Overview of system configuration)
FIG. 1 is an overall system configuration diagram of the present embodiment. A plurality of servers 11 are installed on a communication network 10 such as the Internet, and these servers 11 are connected via a switch (network switch) 12 and a link 13. Each server 11 is provided with a virtual switch (vSW) 21 and application software (APL) 22 which are all software. The ID of each component in the communication network 10 is illustrated as “ID: sv01”, for example.

  In this example, the service influence cause estimation device 1 is provided connected to the server 11. However, the present invention is not limited to this, and the service influence cause estimation device 1 may be arranged in the communication network 10 independently of the server 11.

  FIG. 2 is a block diagram showing an outline of the hardware configuration of the service influence cause estimating apparatus 1. The service influence cause estimation device 1 includes a central processing unit (CPU) 31 that performs various calculations and controls, a main storage device 32 that is a work area of the central processing unit 31, and an auxiliary storage device (HDD or the like) that stores various data. 33 and a communication interface (I / F) 34 that communicates with the communication network 10. The auxiliary storage device 33 stores a service influence cause estimation program 45 that is a program for executing the characteristic processing described below in the service influence cause estimation apparatus 1.

FIG. 3 is a functional block diagram for explaining functions executed by the central processing unit 31 based on the service influence cause estimation program 45.
That is, the service influence cause estimation device 1 includes a storage unit 50, a processing unit 60, and a management unit 70.
The storage unit 50 is provided with an equipment information database (DB) 51 and a software information database (DB) 52. Detailed functions of these units will be described later.
The processing unit 60 performs processing related to a flow model described later. The processing unit 60 includes a model generation unit 61, a component element extraction method determination unit 62, a component element extraction unit 63, and an extraction element storage unit 64. The component extraction unit 63 includes a first cause specifying unit 631 and a second cause specifying unit 632. Detailed functions of these units will be described later.

  The management unit 70 performs processing related to management of various data. The management unit 70 includes a setting information management unit 71, a group management unit 72, a threshold management unit 73, a test packet management unit 74, and a recording unit 75. The group management unit 72 is provided with a group configuration unit 721 and a group storage unit 722. The threshold management unit 73 is provided with a response time threshold storage unit 731, a reply count number threshold storage unit 732, a failure flow number threshold storage unit 733, and a performance degradation flow number threshold storage unit 734. The test packet management unit 74 includes a test packet generation unit 741, a list generation unit 742, a packet transmission unit 743, a packet reception unit 744, and a reply storage unit 745. The recording unit 75 includes a response time storage unit 751, a reply count number storage unit 752, a failure flow number storage unit 753, and a performance deterioration flow number storage unit 754. Detailed functions of these units will be described later.

Below, the service influence cause estimation method which is a process which the service influence cause estimation apparatus 1 performs is demonstrated sequentially.
(Outline of service impact cause estimation method)
FIG. 4 is an explanatory diagram of a data configuration registered in the facility information DB 51 (FIG. 3). In the facility information DB 51, a flow ID and a physical facility ID are associated and registered. In the communication network 10, the flow ID is a physical facility such as a transfer device or a communication cable, a virtual facility such as a virtual machine or a virtual switch, and software such as application software (in the example of FIG. 1, the server 11 , The switch 12, the link 13, the virtual switch 21, and the application software 22). The physical facility ID is an identifier for identifying the physical facility (in the example of FIG. 1, the server 11, the switch 12, and the link 13) in each flow in the communication network 10. The physical facility ID indicates the ID of the physical facility through which data flows, connected from left to right in the order in which the data flows.

  FIG. 5 is an explanatory diagram of a data configuration registered in the software information DB 52 (FIG. 3). In the software information DB 52, the flow ID, the server ID, and the software ID are associated and registered. The server ID is an identifier for identifying the server 11. The software ID is a virtual facility such as a virtual machine or virtual switch mounted on the server 11 indicated by each server ID, and software such as application software (in the example of FIG. 1, virtual switch 21 and application software 22). It is an identifier to identify. The software ID indicates the ID of the software through which the data flows, concatenated from left to right in the order in which the data flows. The software ID is associated with the server ID of each server 11 and is indicated only by the software ID in the server 11 indicated by the server ID.

  FIG. 6 is an explanatory diagram illustrating an example of a flow model. In the flow model, the flow ID is an identifier, and FIG. 6 shows an example of the flow model for each flow ID. The flow model is generated by the model generation unit 61. That is, the model generation unit 61 refers to the facility information DB 51 (FIG. 4) and the software information DB 52 (FIG. 5) when creating a flow model of a certain flow ID, and is associated with each target flow ID. The physical equipment indicated by the physical equipment ID and the software indicated by the server ID and the software ID are shown connected from left to right in the order of data flow. That is, the model generation unit 61 is a model that identifies the physical equipment and software ID through which data flows for each flow and the order in which the data flows.

  In the present embodiment, the processing unit 60 and the management unit 70 correspond to an estimation unit, and the processing performed by the processing unit 60 and the management unit 70 compares the flow models with each other and determines the communication network 10 based on the comparison result. It estimates the physical equipment or software that causes the service impact such as deterioration and failure. Below, the detailed process which the service influence cause estimation apparatus 1 performs, especially the specific process which the process part 60 used as an estimation part and the management part 70 perform are demonstrated.

(Test packet)
An example of a test packet used for estimating a physical facility or software that causes a service influence such as deterioration or failure on the communication network 10 will be described.
First, the list generation unit 742 generates a list as shown in FIG. 7A in which the software ID can be stored. In this list, the flow ID and software ID of the target flow model are described when the test packet passes through the software. Then, the test packet generation unit 741 generates a test packet having the list. The header of the test packet stores the physical equipment ID of the physical equipment through which the test packet passes and the software ID of the software with reference to the equipment information DB 51 and software information DB 52 of the corresponding flow.
The packet transmitter 743 transmits a predetermined number of the generated test packets for each flow within a predetermined time. Specifically, a plurality of identical test packets are transmitted per flow.
In addition, the packet transmission unit 743 transmits a test packet to all the flows simultaneously or stepwise in the same time (N−1th and Nth times) test packet transmission.

Thereby, in each flow, the last component of the flow model generates a reply packet and transmits it. The reply packet is attached with a list as shown in FIG. 7B in which the IDs of the software that have passed the corresponding test packet are stored. The reply packet is received by the packet receiving unit 744. Then, the reply storage unit 745 stores the list of reply packets.
The actually measured value of the response time of the test packet is stored in the response time storage unit 751, and the reply packet count number of the test packet is stored in the reply count number storage unit 752.

(Grouping)
Next, the flows are grouped based on the result of transmission of the test packet. The grouping is first classified into a “normal group” that is determined as a flow having no abnormality, and a “performance degradation group” and a “failure group” that are “abnormal groups” that are determined as a flow having an abnormality. The group configuration unit 721 performs grouping of the normal group, the abnormal group, and the performance deterioration group. The group storage unit 722 stores the grouping result. In addition, the setting information management unit 71 takes in the registration information of the facility information DB 51 and the software information DB 52 as setting information.

  FIG. 8 is a flowchart of processing for grouping the flows. In this processing, N1 and N2 (N1 <N2) are used as threshold values of the actual measurement values of the response time of the test packet stored in the response time storage unit 751, and the reply packet of the test packet stored in the reply count number storage unit 752 C1, C2, and C3 (C1> C2> C3) are used as the threshold values of the count number.

  Here, the thresholds N1 and N2 which are predetermined values used for the response time stored in the response time threshold storage unit 731 are average values for the response times for the test packets transmitted by the predetermined value within the predetermined time as described above. Or by using a predetermined statistical method. Similarly, threshold values C1, C2, and C3, which are predetermined values used for the count number of reply packets stored in the reply count number threshold storage unit 732, are the count numbers for the test packets transmitted by the predetermined value within a predetermined time. It is obtained by taking an average value of or using a predetermined statistical method.

  First, the process shown in FIG. 8 is performed for each flow. That is, the group configuration unit 721 determines whether or not the actual response time value stored in the response time storage unit 751 is smaller than the threshold value N1 (S1). When the measured response time value is smaller than the threshold value N1 (Yes in S1), the group configuration unit 721 determines whether the count number of reply packets stored in the reply count number storage unit 752 is greater than or equal to the threshold value C1. (S2). When the count number of reply packets is equal to or greater than the threshold value C1 (Yes in S2), the group configuration unit 721 sets the list of reply packets stored in the reply storage unit 745 stored in the setting information management unit 71. It is determined whether or not the information completely matches (S3). When the list of reply packets and the setting information completely match (Yes in S3), the response is good, a sufficient number of reply packets are returned, and the test packets are all physical equipment and software in the corresponding flow. Since it is normally routed, the group configuration unit 721 classifies the flow into a normal group (S4).

  On the other hand, when the count number of reply packets falls below the threshold value C1 (No in S2), the group configuration unit 721 displays the list of reply packets stored in the reply storage unit 745 as in the case of S3. It is determined whether or not it completely matches the setting information stored in (S5). When the list of reply packets and the setting information completely match (Yes in S5), a sufficient number of reply packets have not been returned, but the test packets are all normal for the physical equipment and software in the corresponding flow. Since it is routed, the group configuration unit 721 classifies the flow into a performance degradation group (S6). If there is a mismatch between the reply packet list and the setting information (Yes in S5), a sufficient number of reply packets have not been returned, and the test packet has been successfully processed by the physical equipment and software in the corresponding flow. Since it is not via, the group configuration unit 721 classifies the flow into a failure group (S7). Even if there is a mismatch between the reply packet list and the setting information in S3 (No in S3), a sufficient number of reply packets are returned, but the test packet is a physical facility in the corresponding flow, Since it is not normally routed by software, the group configuration unit 721 classifies the flow into a failure group (S7).

  When the measured response time value is equal to or greater than the threshold value N1 (No in S1), the group configuration unit 721 determines whether the measured response time value is equal to or greater than the threshold value N1 and less than the threshold value N2 ( S8). When the measured response time is greater than or equal to the threshold value N1 and less than the threshold value N2 (Yes in S8), the group configuration unit 721 indicates that the count number of reply packets stored in the reply count number storage unit 752 is the threshold value. It is determined whether or not C2 or more (S9). When the count number of reply packets is equal to or greater than the threshold C2 (Yes in S9), the group configuration unit 721 sets the list of reply packets stored in the reply storage unit 745 stored in the setting information management unit 71. It is determined whether or not the information (information in the storage unit 50) completely matches (S10). When the list of reply packets and the setting information completely match (Yes in S10), a plurality of reply packets whose responses are not so good are returned, and the test packet is a physical facility or software in the corresponding flow. Since all are normally routed, the group composition unit 721 classifies the flow into a performance degradation group (S6). If there is a mismatch between the reply packet list and the setting information (No in S10), a plurality of reply packets with poor responses are returned, and the test packet is a physical facility in the corresponding flow, Since there is a software that is not normally routed, the group configuration unit 721 classifies the flow into a failure group (S7). When the count number of reply packets is less than the threshold value C2 (No in S9), the group configuration unit 721 groups into normal groups and performance degradation groups based on the determination in S3.

When the measured response time value is not less than the threshold value N1 and not less than the threshold value N2 (No in S8), the group configuration unit 721 determines whether or not the measured response time value is not less than the threshold value N2 ( S11). When the measured value of the response time is equal to or greater than the threshold value N2 (Yes in S11), it is determined whether the count number of reply packets is equal to or greater than the threshold value C3 (S12). When the count number of reply packets is equal to or greater than the threshold C3 (Yes in S12), since the reply packets with poor responses have returned a predetermined number or more, the group configuration unit 721 classifies the flow into a failure group (S7). . When the count number of reply packets is less than the threshold value C3 (Yes in S12), the group configuration unit 721 classifies into a performance degradation group and a failure group based on the determination in S10.
The above grouping results are stored in the group storage unit 722.

  FIG. 9 is a state transition diagram showing the determination in the grouping of FIG. In the items 81 to 89 for determining each group into a normal group, a performance degradation group, and a failure group, (1) is a determination of the response time, (2) is a determination of the count number of the reply packet, (3) Indicates the consistency between the setting information and the list.

(Estimated cause of service impact)
The component extraction unit 63 includes a first cause specifying unit 631 and a second cause specifying unit 632. The component extraction unit 63 compares the flow models with each other and estimates a physical facility or the software that causes a service influence on the communication network 10 from the comparison result. The first cause identifying unit 631 and the second cause identifying unit 632 of the component extraction unit 63 perform the estimation using different methods.
First, the first cause identifying unit 631 compares the flow models for each flow within the performance degradation group or the failure group classified as described above, and extracts physical equipment or software that is a common element, The extracted physical equipment or software is estimated as a cause of service influence.
In the example of FIG. 10A, the flow models with the flow IDs P11 and P12 are compared within the performance degradation group or the failure group, and the switch 12 with the physical equipment ID ps95 as a common element is extracted. Yes.

  The second cause identifying unit 632 compares the flow models of each flow between the performance degradation group or the failure group classified as described above and the normal group, and the common physical equipment or software has a service impact. The physical equipment or software remaining is excluded from the cause candidates, and the extracted physical equipment or software is estimated as a cause of service influence.

In the example of FIG. 10B, the flow model whose performance ID is P21 of the performance degradation group or failure group is compared with the flow model whose flow ID is P22 of the normal group, and the software ID which is a common element is “ The application software 22 of “bk2” and the switch 12 whose physical equipment ID is “ps95” are excluded as common, and the physical equipment or software which is the remaining element is extracted.
In this way, the constituent elements extracted by the first cause identifying unit 631 or the second cause identifying unit 632 are stored in the extracted element storage unit 64.

FIG. 11 is a flowchart for selecting whether to use the first cause specifying unit 631 or the second cause specifying unit 632 of the component extraction unit 63.
That is, the component extraction method determination unit 62 selects whether to use the first cause specifying unit 631 or both the first cause specifying unit 631 and the second cause specifying unit 632 by the processing of FIG. In this case, a threshold value D1 related to the failure flow number described later is stored in the failure flow number threshold storage unit 733, and similarly, a threshold value D2 related to the performance deterioration flow number described later is stored in the performance deterioration flow number threshold storage unit 734. In the present process, each threshold value is used.

  The component extraction method determination unit 62 executes the process of FIG. 11 for each flow. First, when the flow is classified into the performance degradation group (Yes in S21), the component element extraction method determination unit 62 sets the number of performance degradation flows, which is the number of flows classified into the performance degradation group, as a threshold value. It is determined whether or not the threshold value D1 is not less than (S22). When the number of performance degradation flows is equal to or greater than the threshold value D1 (Yes in S22), the component element extraction method determination unit 62 uses the first cause identification unit 631 (S23). When the number of performance degradation flows is less than the threshold value D1 (No in S22), the component extraction method determination unit 62 uses the second cause specifying unit 632 after using the first cause specifying unit 631 (S24). (S25).

On the other hand, when the corresponding flow is classified into the failure group (Yes in S26), the component extraction method determination unit 62 uses the failure flow number that is the number of flows classified into the failure group as the threshold value. It is determined whether or not the threshold value D2 is exceeded (S27). When the number of failure flows is equal to or greater than the threshold value D2 (Yes in S27), the component extraction method determining unit 62 uses the first cause identifying unit 631 (S23). When the number of failure flows is less than the threshold D2 (No in S27), the component extraction method determination unit 62 uses the first cause specifying unit 631 (S24) and then uses the second cause specifying unit 632 ( S25).
As described above, when the first cause specifying unit 631 or the second cause specifying unit 632 is used and the physical equipment or software that is the constituent element is extracted as described above, the extracted constituent element is the cause of the service influence. It is estimated that there is a specific location, that is, a suspected failure location (S28).

(Modification of service cause estimation)
A modified example of the service influence cause estimation process described above will be described with reference to FIGS.

  FIG. 12 is an explanatory diagram for explaining the modification. FIG. 12A shows an example of a flow model of a normal group and a failure group (performance degradation group). In this example, first, the component extraction unit 63 compares the flow models of each flow within the performance degradation group or the failure group, and counts the number of common physical facilities or software, respectively. FIG. 12B shows an example of the count result. For example, the count number is “21” for the application software 22 with the software ID “a1”, and the count number is “17” for the switch 12 with the physical facility ID “vs3”.

  After that, the component extraction unit 63 compares the flow models of each flow between the performance deterioration group or failure group thus compared and the normal group, and for common physical equipment or software, FIG. As exemplified in (c), the number of counts is set to zero. In the example of FIG. 12C, since the application software 22 having the software ID “a1” is common between the performance deterioration group or the failure group and the normal group, the count number is changed from “21” to “0”. The switch 12 whose physical equipment ID is “vs3” is not common between the performance degradation group or the failure group and the normal group, and therefore the count number remains “17”. Examples are shown (both are “total”).

Then, the component extraction unit 63 finally extracts the physical facility or software having the maximum number of counts, and sets the extracted physical facility or software as a suspected failure location that may cause a service effect. presume. In the example of FIG. 12C, the physical facility or software having the largest count is the count number “45” of the switch 12 whose physical facility ID is “s3”, which is the “final result”. Therefore, the component extraction unit 63 estimates that the switch 12 with the physical facility ID “s3” is a suspicious location that may cause a service effect.
In such a process, the physical equipment or software having the maximum number of counts may be finally extracted, and the extracted physical equipment or software may be plural.

In this case, the extracted plurality of physical facilities or software will be described. First, as described above with reference to FIG. 1, IDs (physical facility ID, server ID, and software ID) are assigned to each unit on the communication network 10.
On the other hand, as the physical equipment ID and software ID, the correlation between the physical equipment or software indicated by the ID and the other physical equipment, software, or server that is in a parent-child relationship or connection relationship with the physical equipment or software. Use what is shown.

FIG. 13 is a diagram illustrating an example in which such a correlated ID is used as the physical facility ID and the software ID in the example of FIG. For example, in the link 13 whose physical equipment ID is “l1: sv01: s1”, the part “l1” of the physical equipment ID indicates the link 13 itself, and the part “sv01” subsequent thereto is the switch 12. Similarly, the “s1” portion indicates the ID of the switch 12 that is connected to the switch 12.
By using such physical facility ID and software ID, it is possible to recognize other physical facilities, software, or servers that are in a parent-child relationship or connection relationship with the ID from the ID.

  FIG. 14 is an explanatory diagram of processing executed using the ID of FIG. In this example, the current result obtained by the processing of FIG. 12 is that the physical equipment ID or software ID (only the part corresponding to the example of FIG. 1 is shown in FIG. 14) is “b2”, “vs2”, respectively. “25” is the number of physical equipment or software counts in the case of “12”. That is, this is a case where a plurality of physical facilities or software that cause the service influence are estimated. In this case, the constituent element extraction unit 63 may connect the plurality of physical facilities or software this time, or the physical facility or software estimated in the process performed last time and the physical facility or software estimated in the process performed this time. When there is the above-described parent-child relationship or connection relationship with software, a priority is given to the number of physical facilities or software counts that have been estimated this time.

In the example of FIG. 14, the application software 22 whose software ID is “b2 (“ b2: vs2 ”in FIG. 13)” and the virtual whose software ID is “vs2 (“ vs2: b1: b2 ”in FIG. 13)”. Since there is a parent-child relationship with the switch 21 (the former is a child and the latter is a parent), the priority of the virtual switch 21 whose parent software ID is “vs2 (“ vs2: b1: b2 ”in FIG. 13)” Increase the degree by +1. Further, the previous result of the link 13 whose physical equipment ID is “l2 (in FIG. 13,“ l2: sv02: s1 ”) and the software ID is“ vs2 (in FIG. 13, “vs2: b1: b2”) ”. Since there is a direct connection relationship with the current result of the virtual switch 21, the influence of the link 13 whose physical facility ID is “l2 (“ l2: sv02: s1 ”in FIG. 13)” has spread. And the priority of the current result of the virtual switch 21 whose software ID is “vs2 (in FIG. 13,“ vs2: b1: b2 ”)” is lowered by −0.5.
Since there is no parent-child relationship or connection relationship between the previous result of the switch 12 whose physical facility ID is “s3 (“ s3: l4: l5 ”in FIG. 13)” and the current result, the switch 12 Estimate that is alone and raise the priority by +1.

  As a result, the final result of the application software 22 whose software ID is “b2 (in FIG. 13,“ b2: vs2 ”) is“ 25 ”, and the software ID is“ vs2 ”(in FIG. 13,“ vs2: b1: b2 ”). The final result of the virtual switch 21 of “)” is “25.5”, and the final result of the switch 12 whose physical equipment ID is “s3 (“ s3: l4: l5 ”in FIG. 13)” is “26”.

  With the above processing, the physical equipment and software search order is such that the physical equipment ID having the large final result value is “s3 (in FIG. 13,“ s3: l4: l5 ”)” and the software ID is “vs2 (FIG. 13, the virtual switch 21 is “vs2: b1: b2)” and the application software 22 is “b2” (“b2: vs2” in FIG. 13).

  According to the present embodiment described above, it is possible to detect software failures and deterioration, the work is simple, the apparatus scale is relatively small, and the cause of the service quality deterioration can be estimated. The cause estimation apparatus 1, the service influence cause estimation program 45, and the service influence cause estimation method can be provided.

<Setting the suspected failure>
Next, the setting of the failure suspect level by the service influence cause estimation device 1 will be described. In the following example, until the first time when the abnormal flow is detected, only the first cause identifying unit 631 of the component extraction unit 63 estimates the suspected fault location of the abnormal flow, and in subsequent times, the component extraction unit Both of the first cause specifying unit 631 and the second cause specifying unit 632 of 63 estimate the failure suspected part of the abnormal flow.

The service influence cause estimating apparatus 1 classifies abnormal flows that are abnormally classified with respect to the previous (N-1th (N is an integer of 2 or more)) test packet and new abnormalities with respect to the current (Nth) test packet. The failure suspected degree of the service component estimated as the suspected failure location is set using the abnormal flow.
The failure suspicion level indicates that the higher the failure suspicion level is, the higher the possibility that the corresponding service component is the cause of the service influence.
The service influence cause estimation device 1 can identify the cause of service influence more quickly by preferentially searching for a suspected failure location with a high suspected failure rate.

As shown in FIG. 3, the test packet management unit 74 of the service influence cause estimation device 1 further includes a test packet number storage unit 746.
The test packet number storage unit 746 stores the number of test packets indicating the number of test packets transmitted for a plurality of flows. The number of test packets is provided to other functional units together with the reply packet stored in the reply storage unit 745, so that it is possible to recognize the number of test packets classified as normal or abnormal. Yes.

  Further, the processing unit 60 is a functional unit for setting the failure suspect degree, and includes a forefront position extraction unit 65, a forefront position storage unit 66, a forefront position comparison unit 67, and a failure suspect degree management unit 68. Are further provided.

  The forefront position extraction unit 65 acquires the flow model generated by the model generation unit 61 and the extraction element stored in the extraction element storage unit 64, and is the same based on the acquired flow model and extraction element. The forefront position of the suspected failure location in the number of test packets is extracted.

More specifically, the forefront position extraction unit 65 determines a service configuration estimated as a suspected failure location when there are two or more suspected failure locations in an abnormal flow classified abnormally with respect to a test packet having a certain number of test packets. The frontmost position is extracted for each element.
In addition, the forefront position extraction unit 65, when a new abnormal flow occurs after that, and when the new abnormal flow includes two or more suspected fault locations of the previous abnormal flow, Extract the forefront position of the location.

  The forefront position storage unit 66 stores the forefront position of the suspected failure location extracted by the forefront position extraction unit 65.

  The forefront position comparison unit 67 reads the previous test packet and the forefront position of the current test packet stored in the forefront position storage unit 66, and at the forefront position of the suspected failure point in the abnormal flow in the previous test packet. The previous forefront position is compared with the current forefront position of the suspected failure location in the new abnormal flow in the current test packet for each suspected failure location, and the comparison result is compared with the suspected failure degree management unit 68. Output to.

Based on the comparison result of the forefront position comparison unit 67, the failure suspicion degree management unit 68 sets the failure suspicion level for two or more suspected failure locations in the previous test packet.
More specifically, the failure suspect degree management unit 68 indicates the failure suspect degree of the suspected failure place where the current forward position is ahead of the previous forward position, or the current forward position is the same as the previous forward position or the current position. The forefront position is set higher than the suspected failure level of the suspected failure point that is behind the previous forefront position.
In addition, the failure suspected degree management unit 68, in the flow newly determined as an abnormal flow for the current packet, includes only one service component that is estimated as the suspected failure location in the previous test packet. The failure suspect level of the suspected failure location is set to be higher than the suspected failure rate of the suspected failure location that is not included in the flow that is estimated as the suspected failure location in the previous test packet and is newly determined as an abnormal flow.

<Setting example of failure suspect level 1: Case where two or more failure suspect levels are included in a new abnormal flow>
Subsequently, regarding the example of setting the failure suspect level, each flow is obtained by connecting five service components (circles in the figure) with links of the same length, and the transmission time of the test packet at the same time is A case where the same is applied to all flows will be described as an example.

  As shown in FIG. 15A, in the previous (N-1th (N is an integer of 2 or more)) test packet, the group configuration unit 721 determines that the flows P01 and P02 are abnormal flows. . In addition, the component extraction unit 63 extracts service components A and B included in common in the flows P01 and P02 as suspected failure locations. FIG. 15A also shows a flow P17 that is determined not to be an abnormal flow at the (N-1) th time and is newly determined to be an abnormal flow at the Nth time, for the sake of easy understanding. (The same applies to FIGS. 16A, 18A, and 19A described later). In the flows P01 and P02 and the flow P17 described later, service components other than the service components A and B are different from each other.

The flow P01 includes a service component B that is a suspected failure location third and a service component A that is a suspected failure location fourth.
Further, the flow P02 includes a service component B that is a suspected failure location third and a service component A that is a suspected failure location fifth.
Therefore, the forefront position extraction unit 65 extracts the position of the suspected fault location A in the flow P01 as the forefront position AN _-1 of the suspected fault location A in the previous test packet, and the forefront position of the suspected fault location B As B _N−1 , the position of the suspected failure point B in the flows P01 and P02 is extracted.

  Subsequently, as illustrated in FIG. 15B, in the current (Nth) test packet, the group configuration unit 721 newly determines that the flow P17 is an abnormal flow in addition to the flows P01 and P02.

The flow P17 includes the service component A that is a suspected failure location second and the service component B that is a suspected failure location fourth.
Thus, the forwardmost position detection portion 65, in this test packet, as the most forward position A _N of the failure problem area A in the new abnormal flow, and extracts the position of the fault suspect location A in the flow P17, fault suspect location B as the most forward position B _N of extracting the position of the fault suspected place B in the flow P17.

  The forefront position comparison unit 67 compares the previous and current forefront positions for each of the suspected failure points A and B, and outputs the comparison result to the suspected failure degree management unit 68. When comparing the forefront position of the previous time and the current time, alignment is performed so that the first transmission timing of the previous test packet and the first transmission timing of the current test packet are the same position.

  The failure suspected degree management unit 68 sets a failure suspected degree for the suspected failure points A and B based on the comparison result.

In this example, the current foremost position A _{N of} the suspected failure point A is positioned ahead of the previous forefront position A _N−1 , and the current foremost position B _{N of} the suspected failure point B is the previous forefront position B. Since it is located behind _N-1, the failure suspected degree of the failure suspected place A is set higher than the suspected failure degree of the suspected failure place B.

  This is because the flow P17 in which the second service component A is provided is not classified as an abnormal flow in the previous test packet, so the test packet passes through the second service component and becomes the fourth service configuration. This is because there is a high possibility that a failure has occurred in the service component A before reaching the element.

<Setting example of failure suspect level # 2: When only one type of suspected failure is included in a new abnormal flow>
As shown in FIGS. 16A and 16B, the flow P17 that is newly determined to be an abnormal flow in the Nth test packet includes only the suspected failure point A and does not include the suspected failure point B. In this case, the failure suspected degree management unit 68 sets the failure suspected degree of the failure suspected part A higher than the suspected degree of failure of the suspected part B without comparing the forefront position.

  This is because when the new abnormal flow includes only one suspected failure location A, the current forefront position of the suspected failure location A is positioned ahead of the previous forefront position, and Since the flow P17 in which the second service component A is provided is not classified as an abnormal flow in the previous test packet, the test packet passes through the second service component and becomes the fourth service component. This is because there is a high possibility that a failure has occurred in the service component A before the arrival.

In view of these setting examples, the order of priority (priority) of failure suspect levels is arranged from the higher one as follows.
(1) The previous abnormal flow is included in the new abnormal flow this time, and the suspected failure location where the current frontmost position is ahead of the previous frontmost position (2) This time also in the previous abnormal flow This is also included in the new abnormal flow, and the current forefront position is the same position as the previous forefront position or located at the rear of the suspected failure location (3). Suspected failure that is not included in the abnormal flow

<Operation example>
Next, with reference to FIG. 17, a failure suspect degree setting method by the service influence cause estimating apparatus 1 will be described.

  First, the test packet generation unit 741 generates a test packet, and the packet transmission unit 743 transmits a test packet to each flow (step S31, packet transmission step).

  Subsequently, the packet reception unit 744 receives the reply packet (the packet reception step, the setting information management unit 70 and the processing unit 60 classify each flow into a normal flow and an abnormal flow based on the above-described method, The failure suspected place in the abnormal flow is estimated (step S32, group configuration step, failure suspected place estimating step), and subsequent steps S33 to S46 also correspond to the suspected place of suspected failure of the present invention.

If all flows are classified as normal flows and there is no suspected failure location (No in step S33 and No in step S34), the flow processing returns to step S31.
Further, when one or more flows are classified as abnormal flows and there is one service component estimated to be a suspected failure location (No in step S33 and Yes in step S34). This flow process ends.
In this case, the service influence cause estimation device 1 searches for one service component that is estimated to be a suspected failure point, and identifies whether the service component is a cause of service influence.

  In addition, when one or more flows are classified as abnormal flows and there are a plurality of service components that are estimated to be suspected faults (Yes in step S33), the forefront position extraction unit 24 Then, the forefront position is extracted at each suspected failure location (step S35), and the forefront position of each of the suspected failure locations is stored in the forefront location storage unit 66 in association with the number of packet transmissions.

  If it is the first test result (ie, extraction of the forefront position at the first test packet transmission count) after execution of step S35 (Yes in step S36), the flow processing returns to step S31.

Further, after the execution of step S35, when it is not the first test result, that is, when it is the second test result (that is, extraction of the forefront position at the second test packet transmission number) (No in step S36). The group configuration unit 721 compares the previous test result with the current test result (step S37).
Specifically, in step S37, the group configuration unit 721 compares the abnormal flow in the current test result with the abnormal flow in the previous test result stored in the group storage unit 722, and newly adds an abnormal flow in the current test result. It is determined whether or not there is a flow classified as “1”.

If no affected service has been newly detected, that is, if there is no flow newly classified as an abnormal flow and the number of abnormal flows has not increased (No in step S38), the failure suspect degree management unit 68 does not set the suspected failure level in the suspected failure location of the abnormal flow (step S39) or sets all suspected failure rates of the suspected failure location in the abnormal flow to the same grade, and the flow processing ends.
In this case, the service influence cause estimation device 1 regards the two or more service component elements that are estimated to be a failure suspected place as being equivalent, and regards these two or more service component elements as, for example, service component elements. A search is performed in the order of IDs, etc., and it is specified whether or not the service component is a cause of service influence.

When an affected service is newly detected, that is, when there is a flow newly classified as an abnormal flow and the number of abnormal flows is increased (Yes in step S38), When only one of the suspected failure locations is included in the new abnormal flow (No in step S40), the failure suspected degree management unit 68 detects a failure in the suspected failure location included in the new abnormal flow. The suspect level is set higher than the suspected failure level of the suspected failure location not included in the new abnormal flow (step S41), and this flow processing ends.
The flow of No → Step S41 in Step S40 corresponds to the example described in FIG.

  When an affected service is newly detected, that is, when there is a flow newly classified as an abnormal flow and the number of abnormal flows is increased (Yes in step S38), If two or more of the suspected fault locations are included in the new abnormal flow (Yes in step S40), the forefront position extraction unit 24 extracts the forefront position in each suspected fault location for the new abnormal flow. (Step S42), the forefront position of each extracted suspected failure location is stored in the forefront position storage unit 66 in association with the number of packet transmissions.

Subsequently, the foremost position comparison unit 67 compares the forefront position of the previous time and the forefront position of the current time for each suspected failure part included in the new abnormal flow (step S43).
When all the suspected faults included in the new abnormal flow are located at the same position or the rear as the previous forefront position (No in step S44), the fault suspected degree management unit 68 The suspected failure level is not set for the suspected failure location of the abnormal flow (step S46), or all suspected failure rates of the suspected failure location of the new abnormal flow are set to the same grade, and this flow processing ends.

In addition, regarding the suspected failure location included in the new abnormal flow, if there is one where the current forefront position is located ahead of the previous forefront position (Yes in step S44), the suspected failure degree management unit 68 The failure suspected degree of the suspected failure location where the forefront position this time is positioned ahead of the previous forefront position is set higher than the suspected failure rate of the other suspected failure locations (step S45), and this flow processing ends. .
The flow of Yes → Step S42 → Step S44 → Step S45 in Step S40 corresponds to the example described in FIG.

<Setting example of failure suspicion # 3: Forefront position extraction considering link length>
As illustrated in FIG. 18, the forefront position extraction unit 65 may be configured to extract the forefront position of each suspected failure location in consideration of the link length of the abnormal flow. In this case, the model generation unit 61 generates a model of each flow in consideration of the link length.
In the example of FIG. 18, in the flows P01 and P02, the link length between the second service component and the third service component corresponds to four times the normal length.
In the flow P17, the link length between the fourth service component and the fifth service component corresponds to twice the normal length.
In each setting example, the link length from the service influence cause estimation device 1 to the first service component is also taken into account when extracting the forefront position.

Accordingly, as shown in FIG. 18 (b), the forwardmost position comparison unit 67, while determined to be located further forward than the fault suspected place the forwardmost position A _N is the last forwardmost position A _N-1 current A, It is determined that the current foremost position B _{N of} the suspected failure point B is located ahead of the previous forefront position B _N−1 .
In this case, the failure suspect degree management unit 68 sets the failure suspect degrees of the suspected failure points A and B to the same grade.

<Setting Example of Failure Suspiciousness Part 4: Extraction of Forefront Position Considering Difference in Time of Sending Test Packet (Time Difference)>
As illustrated in FIG. 19, the forefront position extraction unit 65 may be configured to extract the forefront position of each suspected failure location in consideration of the difference in the transmission time of the test packet. The difference between the transmission times of the test packets may be stored in advance, or may be the time when the packet transmission unit 743 actually transmits.
In the example of FIG. 19, the packet transmission unit 743 transmits a test packet in units of 10 flows in one test packet transmission. Therefore, the test packet transmission time of the flow P17 included in the second unit is delayed by the time difference with respect to the test packet transmission times of the flows P01 and P02 included in the first unit.

Accordingly, as shown in FIG. 19 (b), as well as determined that the forwardmost position comparison unit 67, this forwardmost position A _N of the failure suspected place A is the same position as the previous forwardmost position A _N-1, It is determined that the current foremost position B _{N of} the suspected failure point B is located behind the previous forefront position B _N−1 .
In this case, the failure suspect degree management unit 68 sets the failure suspect degrees of the suspected failure points A and B to the same grade.

The service influence cause estimation device 1 according to the embodiment of the present invention includes a new abnormal flow that includes two or more suspected failure locations in the abnormal flow of the previous test packet and includes the previous suspected failure location in the current test packet. When a failure occurs, the failure suspected degree is set according to the forefront position of the suspected failure place. Therefore, prioritization between two or more suspected failure places, that is, the setting of the suspected failure degree can be suitably performed.
Further, the service influence cause estimating apparatus 1 is a case where there are two or more suspected faults in the abnormal flow of the previous test packet and a new abnormal flow including the previous suspected fault occurs in the current test packet. Because the failure suspect level of the suspected failure location included in the new abnormal flow is set higher than the suspected failure rate of the suspected failure location not included in the new abnormal flow, there are two or more failures. Prioritization between suspected places, that is, failure suspected degree can be suitably set.

  Moreover, since the service influence cause estimation device 1 extracts the forefront position of the suspected failure location in consideration of the difference between the link length of the abnormal flow and / or the transmission time of the test packet, the failure suspect level is more preferably set. It can be carried out.

As mentioned above, although embodiment of this invention was described, this invention is not limited to the said embodiment, In the range which does not deviate from the summary of this invention, it can change suitably. For example, in the flowchart of FIG. 17, the configuration may be such that the process of step S35 is not performed between step S33 and step S36 but simultaneously with step S42 (ie, between step S40 and step S44).
In addition, when there are a plurality of suspected failure locations where the current forefront position is before the forefront position of the previous time, the configuration may be such that the suspected failure level is set higher as the forward movement amount is larger.
Moreover, as the setting of the suspected failure level, two levels of “presence / absence of priority” and “high / low”, three levels of “high, medium and low”, and numerical value can be suitably used.
Further, for example, when the number of flows classified as abnormal flows is equal to or greater than a predetermined number at the time when an abnormal flow is detected for the first time, only the first cause identifying unit 631 fails in the subsequent flow. The structure which estimates a suspected location may be sufficient.

DESCRIPTION OF SYMBOLS 1 Service influence cause estimation apparatus 45 Service influence cause estimation program 50 Memory | storage part 60 Processing part (estimation part, failure suspected part estimation part)
70 Management Department (Estimation Department)
721 Group configuration part 743 Packet transmission part 744 Packet reception part 746 Test packet number storage part (failure suspected part estimation part)

Claims (6)

A packet transmission unit that transmits a test packet for each of a plurality of flows configured by using one or more of the service components as physical components and software for transferring data over a communication network. When,
A packet receiver that receives a reply packet of the test packet passing through the flow;
A group configuration unit that determines whether the flow is a normal flow or an abnormal flow based on the received reply packet;
A suspected fault location estimation unit that estimates a suspected fault location that causes a service impact on the network in the abnormal flow;
With
The suspected failure point estimation unit is
With respect to the previous test packet, the service component common to the abnormal flow is estimated as the suspected failure location,
Regarding the previous test packet, there are two or more service components estimated as the suspected failure location, and the previous test packet in the flow newly determined as an abnormal flow for the current test packet. In which one or more of the service components estimated as the suspected failure location are included,
The forefront position of the previous suspected fault location in the abnormal flow in the previous test packet, and the forefront position of the suspected fault location in the new abnormal flow in the current test packet And for each of the suspected failure locations,
The failure suspect level of the suspected failure location where the current forward position is ahead of the previous forward position, the forward current position is the same as the previous forward position, or the forward current position is the previous forward position. A service influence cause estimation device, characterized in that it is set to be higher than the failure suspected degree of the suspected failure location that is behind the front position. 2. The service influence according to claim 1, wherein the suspected failure point estimation unit compares the previous forefront position and the current forefront position based on a link length between the service components. Cause estimation device. The suspected fault location estimation unit compares the previous forefront position and the current forefront position based on a difference in transmission time for each flow at each time of the test packet. The service influence cause estimation device according to claim 2. The suspected failure point estimation unit is
Regarding the test packet of this time, in the flow newly determined as an abnormal flow, when only one service component estimated as the suspected failure location in the previous test packet is included,
The suspected failure level of the suspected failure location is higher than the suspected failure rate of the suspected failure location that is not included in the flow newly estimated as the suspected failure location in the previous test packet. The service influence cause estimation device according to claim 1, wherein the service influence cause estimation device is set. Computer
A packet transmission unit that transmits a test packet for each of a plurality of flows configured by using one or more of the service components as physical components and software for transferring data over a communication network. ,
A packet receiver for receiving a reply packet of the test packet passing through the flow;
A group configuration unit that determines whether the flow is a normal flow or an abnormal flow based on the received reply packet; and
A suspected fault location estimation unit that estimates a suspected fault location that causes a service impact on the network in the abnormal flow;
Function as
The suspected failure point estimation unit is
With respect to the previous test packet, the service component common to the abnormal flow is estimated as the suspected failure location,
Regarding the previous test packet, there are two or more service components estimated as the suspected failure location, and the previous test packet in the flow newly determined as an abnormal flow for the current test packet. In which one or more of the service components estimated as the suspected failure location are included,
The forefront position of the previous suspected fault location in the abnormal flow in the previous test packet, and the forefront position of the suspected fault location in the new abnormal flow in the current test packet And for each of the suspected failure locations,
The failure suspect level of the suspected failure location where the current forward position is ahead of the previous forward position, the forward current position is the same as the previous forward position, or the forward current position is the previous forward position. A service influence cause estimation program characterized in that it is set higher than the suspected failure level of the suspected failure location that is behind the forward position. A packet transmission step of transmitting a test packet for each of a plurality of flows configured by using one or more of the service components as physical components and software for transferring data on a communication network. When,
A packet receiving step of receiving a reply packet of the test packet passing through the flow;
A group configuration step for determining whether the flow is a normal flow or an abnormal flow based on the received reply packet;
In the abnormal flow, a suspected failure location estimating step for estimating a suspected failure location that causes a service effect on the network;
Including
In the suspected failure point estimation step,
With respect to the previous test packet, the service component common to the abnormal flow is estimated as the suspected failure location,
Regarding the previous test packet, there are two or more service components estimated as the suspected failure location, and the previous test packet in the flow newly determined as an abnormal flow for the current test packet. In which one or more of the service components estimated as the suspected failure location are included,
The forefront position of the previous suspected fault location in the abnormal flow in the previous test packet, and the forefront position of the suspected fault location in the new abnormal flow in the current test packet And for each of the suspected failure locations,
The failure suspected degree of the suspected failure location where the current frontmost position is ahead of the previous frontmost position, the current frontmost position is the same as the previous frontmost position, or the current frontmost position is the previous frontmost position. A service influence cause estimation method, characterized in that it is set to be higher than the failure suspected degree of the suspected failure point located behind the forward position.

Images