JP2017060074A - Network analysis device, network analysis system, and network analysis method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide information useful for estimation of a cause of a fault in a network which has a flexible configuration and in which communication is made using a variety of protocols.SOLUTION: A network analysis device includes: a packet analysis unit which receives a captured packet, acquires information of a protocol and an identifier included in the received packet as a character string, and classifies the acquired character string according to a prioritized network layer; and a log data analysis unit which receives log data, counts the number of times of detection of a character string of the protocol and the identifier included in a message in the received log data, and on the basis of the character string of the message in the received log data including fault information, prioritizes a network device which has transmitted the log data to prioritize the received log data according to the protocol and the identifier classified according to the network layer and the prioritized network device.SELECTED DRAWING: Figure 11

Description

  The present invention relates to a network analysis device, a network analysis system, and a network analysis method.

  The number of devices connected to the network such as smartphones and sensors is increasing, and the scale of the network is also expanding. As a result, when a failure occurs in the network, the range of influence and economic loss are also increasing. In order to prepare for such a network failure, information is collected from devices connected to the network and the cause of the failure is estimated.

  In Patent Document 1, “a center monitoring device SVc for monitoring the entire network is provided. The center monitoring device SVc determines the link relationship between the groups G1 to Gn from the identification number of each group and the connection information between the groups. In the case where more detailed information is required because a determination has occurred and a failure or a process has occurred, a technique of collecting the detailed information from the monitoring device of the corresponding group as appropriate is disclosed.

  Patent Document 2 discloses that “a first feature extraction unit that extracts, as a first feature, a feature acquired by a protocol related to a wireless data link layer from a packet with which the electronic device communicates wirelessly, and the electronic device wirelessly. A second feature extracting unit that extracts, as a second feature, a feature acquired by a protocol in a layer higher than the data link layer from a packet to be communicated; and the electronic device based on the first feature and the second feature A technique for estimating the cause of a network connection failure is disclosed.

Japanese Patent Laid-Open No. 6-164583 JP 2014-239297 A

  Use of the techniques disclosed in Patent Document 1 and Patent Document 2 is useful for estimating the cause of a failure that has occurred in a fixed network configuration or protocol. However, the configuration of recent networks can be flexibly changed by tunneling by virtualization or encapsulation, and communication is performed using various protocols according to the purpose of communication. No technology has been disclosed that can be handled.

  Accordingly, an object of the present invention is to provide information so as to be useful for estimating the cause of a failure even in a network having a flexible configuration and communicating with various protocols.

  A typical network analysis apparatus according to the present invention receives a captured packet, acquires protocol and identifier information included in the received packet as a character string, and prioritizes the acquired character string. Bucket analysis unit that classifies according to layer, receives log data, detects protocol and identifier character strings included in the message in the received log data, counts the number of detection of each character string, Based on the character string of the message in the received log data including information, the character string classified according to the network layer is searched, the character string of the protocol and identifier related to the failure is extracted, and the extracted character string Prioritize network devices that sent log data based on the counted number of detections, and And classified protocols and identifiers according to the prioritized was network device, and the log data analyzing section prioritizing the received log data, comprising: a response to.

  The present invention is also understood as a network analysis system and a network analysis method.

  ADVANTAGE OF THE INVENTION According to this invention, even if it is a network which has a flexible structure and communicates with various protocols, it becomes possible to provide information so that it may be useful for the estimation of the cause of a failure.

It is a block diagram which shows the example of a structure of a network analysis system. It is a block diagram which shows the example of a structure of a network device. It is a figure which shows the example of log data. It is a block diagram which shows the example of a structure of a network log analyzer. It is a figure which shows the example of the processed log data. It is a figure which shows the example of the output of log data. It is a figure which shows the example of a log data analysis result. It is a figure which shows the example of a packet. It is a figure which shows the example of the encapsulated packet. It is a figure which shows the example of a packet data analysis result. It is a flowchart figure which shows the example of the process which analyzes a failure. It is a figure which shows the example of log data confirmation priority. It is a figure which shows the example of the output of the cause estimation result of a failure.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

(A1) Network Configuration FIG. 1 is a block diagram showing an example of the configuration of a network analysis system. The network 50 is a plurality of network devices 20a, 20b, 20c, 20d, 20e, 20f (hereinafter, a specific network device is not shown among the plurality of network devices, and if any network device may be used, the network 50 is typically a network. The network device 20 is connected, and the network device 20 is also connected. Here, all the network devices 20 may be connected, or not directly as in the network device 20a and the network device 20d, but indirectly through the network device 20b or the like. May be.

  The network device 20 refers to a destination of a packet transmitted from a terminal such as a smartphone or a sensor (not shown) and transfers it to another network device 20 close to the destination. Further, the network device may be a device that relays (routes) wired communication, or may be a computer, and data generated by the computer may be transmitted as a packet to another network device 20 close to the destination. . Then, the network device 20 outputs the operation content as log data and transmits it to the network log analysis device 10.

  The network 50 includes a plurality of packet capture devices 30. The packet capture device 30 may be provided for connection between the network device 20a and the network device 20b like the packet capture device 30a, or may be connected to a capture packet transmission / reception port (not shown) of the network device 20. Good. And it may be provided in the connection of all the network apparatuses 20, and may not be provided like between the network apparatus 20e and the network apparatus 20f.

  The packet capture device 30 monitors a packet flowing in the network 50 and transmits the packet copied by the monitoring to the network log analysis device 10. This packet monitoring may be performed using DPI (Deep Packet Inspection).

  The network log analysis device 10 is connected to the network 50, receives log data output from the plurality of network devices 20, and accumulates the received log data. In addition, it receives packet data output from the plurality of packet capture devices 30 and analyzes the received packet data. When a failure occurs in the network, the cause of the failure is estimated using the analysis results of the accumulated log data and packet data.

  Note that the network log analysis device 10 and the network device 20 or the packet capture device 30 may be connected by the same communication path as a packet transmitted from a terminal such as a smartphone or a sensor that is not shown, and the illustration is omitted. You may connect by the communication path only for management. Further, the configuration of the network 50 and the types and numbers of the network devices 20 are not limited to the example shown in FIG.

(A2) Configuration of Network Device FIG. 2 is a block diagram illustrating an example of the configuration of the network device 20. The network device 20 includes a network interface module 21, a switching module 22, and a control module 23.

  Each of the network interface modules 21 includes a plurality of packet transmission / reception ports 24, a controller 25, and a memory 26. Ethernet (registered trademark) or the like is physically connected to the packet transmission / reception port 24. The network device 20 may include a plurality of network interface modules 21, or may include one network interface module and may not include the switching module 22.

  The controller 25 in the network interface module 21 refers to the packet received at the packet transmission / reception port 24 and identifies the destination of the packet. When the identified destination is addressed to another device, the controller 25 specifies the transfer destination network interface module 21 and the transfer destination packet transmission / reception port 24 for transmission to the destination. If the specified network interface module 21 is the same as the network interface module 21 that received the packet, control is performed so that the packet is transmitted from the specified packet transmission / reception port 24.

  If the identified network interface module 21 is different from the network interface module 21 that received the packet, the received packet is transferred to the switching module 22. The network interface module 21 to which the packet is transferred from the switching module 22 transmits the packet from the packet transmission / reception port 24 directly or indirectly connected to the other device of the destination. When a packet addressed to the network device 20 is received at the packet transmission / reception port 24, the packet is transferred to the control module 23 via the switching module 22, and when a packet addressed to another device is received from the control module 23 via the switching module 22, the packet transmission / reception port 24 Send.

  The memory 26 in the network interface module 21 serves as a buffer for temporarily storing packets transmitted and received through the packet transmission / reception port 24. Information used by the controller 25 such as a relationship between the destination, the network interface module 21 and the packet transmission / reception port 24, conditions for passing or discarding the packet, and the like may be stored.

  When receiving the packet, the switching module 22 transfers the received packet to the network interface module 21 or the control module 23 as the transfer destination in accordance with an instruction from the controller 25 or an instruction from the CPU 27a.

  The control module 23 includes a memory 26c and a CPU (Central Processing Unit) 27a. The memory 26c stores a plurality of programs as the software processing unit 28a, and the CPU 27a executes each program stored in the memory 26c, thereby becoming a processing unit that operates according to each program. For this reason, in the following description, the description with the program as the subject may be replaced with the description with the CPU 27a executing the program as the subject.

  In addition to the software processing unit 28a, the memory 26c may include a program execution environment such as an OS (Operating System) (not shown), or may include data that the CPU 27a temporarily reads and writes. The CPU 27a may be composed of a plurality of CPUs, and may be provided with hardware having the same operation as that of the CPU 27a that executes part or all of each program instead of the program.

  The software processing unit 28a includes a packet transmission / reception program 29a, a log data transmission program 31, and a program 32. The packet transmission / reception program 29a is a program for controlling reception of a packet addressed to the own network device 20 and transmission of a packet addressed to another device created by the software processing unit 28a. The packet transmission / reception program 29a is executed by the CPU 27a to become a packet transmission / reception unit, and exchanges packets to be transmitted / received with the network interface module 21 via the switching module 22.

  The log data transmission program 31 attaches data such as a log output timing (time stamp) to a log message output by the execution of the program 32, and transmits these data (hereinafter referred to as log data). This is a program that designates the network log analyzer 10 as a destination and delivers log data to the packet transmission / reception program 29a. Further, a log message output by the execution of the controller 25 may be included, and the log data will be further described later with reference to FIG. The log data transmission program 31 becomes a log data transmission unit by being executed by the CPU 27a.

  The program 32 is a program for realizing network processing supported by each network device 20. For example, when the network device 20 supports packet filtering, a condition for passing or discarding a packet is received as an access control list by receiving an input device (not shown) or a network administrator input via the network, and creating a controller 25 programs may be registered in the memory 26.

  Further, when the network device 20 supports the routing protocol, the program may be a program for transmitting the route information recognized by the network device to the other network device 20. Furthermore, a packet transmitted from a terminal such as a smartphone or a sensor (not shown) is received, a packet is transmitted to another device using the packet transmission / reception program 29a, or a packet is received from another device. It may be a program that transmits a packet to a terminal.

  FIG. 3 is a diagram illustrating an example of log data. The log data includes a type 61, a priority 62, a time stamp 63, a device name 64, and a message 65. The type 61 is information indicating the type of log data. For example, whether the log data is log data related to an event that has occurred in the operating environment of the network device 20, or occurred in a program unique to each network device 20. Indicates the type of log data related to the event. The operating environment of the network device 20 is a program common to a plurality of network devices 20, and may be an OS, for example. In the example of FIG. 3, “local0” is shown, which indicates log data related to an event that has occurred in a program unique to the own network device 20.

  The priority 62 is information indicating the importance of the log data, and is important whether the log data is log data that requires the network administrator's attention or is simply log data for recording. Showing gender. In the example of FIG. 3, “alert” indicates log data that prompts the network administrator to take some measures. Specific importance may be assigned according to the content of the failure detected by the network device 20. The importance and the content of the message 65 described later may be combined in advance by a network administrator or the like, and the combination may be set in the network device 20. The time stamp 63 is information indicating a time when an event recorded as a log occurs. In the example of FIG. 3, it is “Feb. 2 09:59:00”, indicating that the event occurred at 9:59 on February 2.

  The device name 64 is the name of the network device 20 in which the event has occurred. In the example of FIG. 3, it is “ND20a”, which indicates that an event has occurred in the network device 20a having the device name “ND20a”. In addition to the device name 64, the IP address of the network device 20 may be included. The message 65 is information indicating specific contents of the event. In the example of FIG. 3, “SSH session timed out.” Is shown, indicating that an event that an SSH (Secure Shell) session was disconnected due to a timeout occurred. Note that the log data does not necessarily have the format shown in FIG. A plurality of logs may be transmitted from the network device 20 to the network log analysis device 10 in a file format.

(A3) Configuration of Network Log Analysis Device FIG. 4 is a block diagram illustrating an example of the configuration of the network log analysis device 10. The network log analyzer 10 includes a packet transmission / reception port 24e, a hard disk 32, a memory 26d, and a CPU 27b. The hard disk 32 stores part or all of the software processing unit 28b, and stores a program. When the network log analyzer 10 operates, at least a program necessary for the operation is read into the memory 26d. The CPU 27b executes the process of the network log analysis device 10 according to the program read into the memory 26d.
Because of this operation, for the sake of explanation, the example of FIG. 4 shows a configuration in which all of the software processing unit 28b is stored in the memory 26d. However, the configuration is not limited to this, and the software processing unit 28b May be stored in the hard disk 32 instead of being stored in the memory 26d. Here, the hard disk 32 may be a non-volatile memory such as a flash memory or a semiconductor disk.

  The software processing unit 28b includes a packet transmission / reception program 29b, a log data acquisition program 11, a log data analysis program 12, a packet data acquisition program 13, a packet data analysis program 14, and a user interface program 15. Each program becomes a processing unit by being executed by the CPU 27b. For example, the log data analysis program 12 and the packet data analysis program 14 become a log data analysis unit and a packet data analysis unit, respectively. For this reason, in the following description, the description with the program as the subject may be replaced with the description with the CPU 27b executing the program as the subject.

  The CPU 27b may be composed of a plurality of CPUs, and may be provided with hardware having the same operation as the CPU 27a that executes part or all of the program of the software processing unit 28b instead of the program. The memory 26d may include a program execution environment such as an OS (not shown) in addition to the software processing unit 28b, or may include data that the CPU 27b temporarily reads and writes. The software processing unit 28b includes a log data storage area 16, a packet data analysis result 17, a log data analysis result 18, and a log data confirmation priority 19.

  The packet transmission / reception program 29b is a program that controls transmission / reception of packets with other devices via the packet transmission / reception port 24e. The log data acquisition program 11 is a program that receives log data transmitted by the log data transmission program 31 in the network device 20. The log data acquisition program 11 processes the log data into a format that can be processed by the log data analysis program 12, such as an XML (eXtensible Markup Language) format or a JSON (JavaScript (registered trademark) Object Notation) format. To hand over.

  FIG. 5 is a diagram illustrating an example of log data processed in the JSON format. The JSON format log data 66 indicates that the message is “SSH session timed out.”, The time stamp is “Feb. 2 09:59:00”, and the device name is “ND20a”. The processed log data may include information having the same contents as the information shown in FIG.

  When the log data analysis program 12 receives the log data from the log data acquisition program 11, the log data analysis program 12 stores the contents in the log data storage area 16. Further, the contents of the priority 62 in the log data are referred to and it is determined whether or not a failure has occurred in the network 50. Then, the contents of the log data are output to the display device 33.

  FIG. 6 is a diagram illustrating an example of log data output to the display device 33. The display device 33 displays a log serial number 161, a log priority 162, a log creation date 163, a log creation time 164, a device name 165 that issued the log, and a log message 166. The display contents from the priority 162 to the message 166 may be the contents from the priority 62 to the message 65 of the log data shown in FIG. In the example of FIG. 6, one line of display is one log data. The log serial number 161 may be, for example, a number assigned after the network log analyzer 10 is activated.

  When the log data analysis program 12 refers to the information of the processed log data corresponding to the priority 62 and detects log data having a high priority (importance), it determines that a failure has occurred in the managed network 50. To do. In the example of FIG. 6, the log data whose serial number 161 has the value “6” detects a high priority, displays a high priority icon, and indicates that a failure in the network 50 has been determined. The network administrator who sees this display can recognize the failure. Then, the date 163, the time 164, the device name 165, and the message 166 show that the network device 20a “SSH session timed out” at “9: 59: 0” on “February 2”.

  Further, the log data analysis program 12 refers to the packet data analysis result 17 periodically (for example, at a preset period of 5 minutes), and acquires a character string stored in the packet data analysis result 17. After that, the log data analysis program 12 refers to the log data stored in the log data storage area 16, counts the number of log data including the acquired character string for each network device 20, and performs the log data analysis on the counted result. Store in result 18.

  In addition, the log data analysis program 12 distinguishes log data including a character string acquired from the packet data analysis result 17 from other log data. The distinct log data may be stored separately. As described later with reference to FIG. 13, as the “estimated cause log”, the log data including the character string acquired from the packet data analysis result 17 is displayed. It can be excluded from the processing related to display.

FIG. 7 is a diagram illustrating an example of the log data analysis result 18. The log data analysis result 18 includes the device name 181 of the network device 20 that is the log data transmission source, and the number 182 of log data including the character string for each character string stored in the packet data analysis result 17. In the example of FIG. 7, the character strings are “TCP”, “VLAN”, “10”, “20”, “VXLAN”, and “UDP”. For example, in the entry 1803, the log data transmitted from the network device 20c whose device name 181 is “ND20c” includes four log data including the character string “TCP” and three log data including the character string “UDP”. In other words, it is detected within one period of the cycle (for example, if the cycle is 5 minutes).
The entry 1804 includes one log data including the character string “VLAN 20” in the log data transmitted from the network device 20d whose device name 181 is “ND20d”, within one period of the cycle (for example, 5 minutes). Indicates that it was detected.

  In the example of FIG. 7, “VLAN”, “10”, and “20” are expressed as separate character strings, but “VLAN 10” and “VLAN 20” may be used, and “VLAN” in FIG. The number of “10” is the same as the number of character strings “VLAN 10” included in the log data. Further, what character string the log data analysis result 18 includes may be set in advance from the keyboard 34 or the like.

  When the log data analysis program 12 determines that a failure has occurred in the network 50, the log data analysis program 12 refers to the log data analysis result 18 and creates a log data confirmation priority 19 for shortening the cause estimation of the failure. Based on the information of the confirmation priority 19, output is controlled to the display device 33. The creation of the log data confirmation priority 19 will be described later with reference to FIG.

  The packet data acquisition program 13 in the software processing unit 28b in FIG. 4 acquires, as data, a copy of the packet in the network 50 transmitted by the packet capture device 30 using the packet transmission / reception program 29b. The packet data acquisition program 13 delivers the acquired packet data to the packet data analysis program 14.

  FIG. 8 and FIG. 9 are diagrams illustrating examples of packets flowing in the network 50. The example of FIG. 8 is a TCP protocol packet received from the packet capture device 30a. The packet includes an Ether header 41a, an IP header 42a, a TCP header 43, and SSH data 44. The Ether header 41a includes a destination MAC address 45, a source MAC address 46, a VLAN ID (Virtual Local Area Network identifier) 47 value “10”, and the like.

  When the packet data analysis program 14 receives the packet data shown in FIG. 8 from the packet data acquisition program 13, the packet data analysis program 14 analyzes the protocol and identifier used for transfer for each combination of header information (hereinafter referred to as a flow). . The combination of header information to be a flow may be a so-called five tuple (5-tuple: source IP address, source port number, destination IP address, destination port number, protocol) in the communication field. A tuple may be added with specific information of communication, or may be added with information regarding VLAN or the like.

  In the example of the packet shown in FIG. 8, it is analyzed that the SSH protocol between the transmission source and the destination specified by the header information is transferred using the TCP protocol and VLAN ID 10. The packet data analysis program 14 that has analyzed the packet data stores the analysis result in the packet data analysis result 17 as a character string.

  The example of FIG. 9 is a packet encapsulated by the UDP protocol received from the packet capture device 30b. The packet includes an Ether header 41b, an IP header 42b, a UDP header 48, a VXLAN ID (Virtual eXtensible Local Area Network identifier) 49 value “20”, and the like. Further, the VXLAN data 51 includes the same packet as that shown in FIG. This means that the network device 20b encapsulates the packet shown in FIG. 8 as shown in FIG.

  When the packet data analysis program 14 receives the packet data shown in FIG. 9 from the packet data acquisition program 13, the packet data analysis program 14 analyzes the protocol and identifier used for transfer for each flow. In the packet example shown in FIG. 9, the SSH protocol between the transmission source and the destination specified by the header information uses the TCP protocol, VLAN ID 10, and is further transferred using the VXLAN ID 20, UDP protocol. Is analyzed. The packet data analysis program 14 that has analyzed the packet data adds the analysis result to the packet data analysis result 17 as a character string.

  FIG. 10 is a diagram illustrating an example of the packet data analysis result 17. The packet data analysis result 17 includes an application 171, a transfer protocol 172, an IP address 173, a VLAN identifier 174, and the like, and an entry is created for each flow of a combination of these header information. The application 171 may be, for example, network application information that can be identified from the port number being used.

  For example, in the entry 1702, the SNMP protocol specified from the information of the application 171a between the transmission source and the destination IP address specified from the information of the IP address 173a is transferred by the UDP protocol specified from the information of the transfer protocol 172a. It has been shown. In the entry 1703, the NETCONF protocol specified from the information of the application 171a between the source and destination IP addresses specified from the information of the IP address 173a is the TCP protocol specified from the information of the transfer protocol 172a and the VLAN identifier 174a, It is shown to be transferred with VLAN ID 20.

  In the packet data analysis result 17, in the case of an encapsulated packet as shown in FIG. 9, the encapsulated header information is added to the entry of the flow before being encapsulated. In the entry 1701, the SSH protocol specified from the information of the application 171a between the source and destination IP addresses specified from the information of the IP address 173a is the TCP protocol specified from the information of the transfer protocol 172a and the VLAN identifier 174a, It is transferred by VLAN ID 10, and this flow is encapsulated, and it is shown that it is transferred by VXLAN ID 20 and UDP protocol specified by application 171b and transfer protocol 172b.

  The packet data analysis result 17 is not limited to the configuration of the table shown in FIG. 10 and may be other configurations such as a list, but is preferably configured in the order of the network layers. In the example of the table shown in FIG. 10, the left side of the table is the upper layer transfer protocol and identifier, and the right side is the lower layer transfer protocol and identifier. The configuration of the items of the transfer protocol and the identifier in the packet data analysis result 17 is set in advance, and the analysis result of the packet data analysis program 14 is stored in each item.

  Each transfer protocol and each identifier information may be a character string. That is, in the SSH protocol of the entry 1701, in the packet data analysis result 17, the character string “SSH” may be stored in the application 171a. In the VLAN ID 10 of the entry 1701, a character string “VLAN 10” or a character string “VLAN” and a character string “10” may be stored in the VLAN identifier 174a.

  The user interface program 15 in the software processing unit 28b of FIG. 4 outputs the log data described with reference to FIG. 6 to the display device 33 based on the control of the log data analysis program 12, or the log data analysis program 12 logs This is a program for outputting the result of analyzing the data to the display device 33. In addition, it is a program that accepts, as an input, the contents of the operation of the keyboard 34 and mouse 35 by the network administrator.

(A4) Procedure for creating log data confirmation priority for failure cause estimation short-term FIG. 11 is a flowchart showing an example of the procedure of the network log analysis device 10 that detects a failure in the network 50 and outputs it to the display device 33. FIG. The network log analysis device 10 creates the log data confirmation priority 19 in order to shorten the cause estimation time.

  The packet transmission / reception program 29b of the network log analysis device 10 receives log data from the network device 20, and the log data acquisition program 11 repeatedly processes the log data and passes it to the log data analysis program 12. When the log data analysis program 12 refers to the priority information corresponding to the priority 62 in the processed log data and determines that the priority value is higher than a preset level, a failure in the network 50 Is detected, the process proceeds to the following procedure (step 101).

  The log data analysis program 12 extracts a character string that constitutes a word that appears in the character string of the message corresponding to the message 65 in the processed log data (step 102). For example, in the log data shown in FIG. 6, for log data whose serial number 161 is “6”, it can be determined that the priority value corresponding to the priority 162 is higher than a preset level, and the message corresponding to the message 166 The character strings “SSH”, “session”, “timed”, and “out” forming the word are extracted from the character string.

  Next, the log data analysis program 12 searches the character string in the packet data analysis result 17 using the character string extracted in step 102 as a key, and finds a matching character string. The transfer protocol and identifier of the entry including the matching character string become the transfer protocol and identifier related to the failure. For example, when the packet data analysis result 17 is the example of FIG. 10, when the packet data analysis result 17 is searched using the character string “SSH” as a key, a matching character string is found in the entry 1701. By referring to the entry 1701, “TCP”, “VLAN 10”, “VXLAN 20”, and “UDP” are extracted as related transfer protocols and identifiers.

  Thereby, the log data analysis program 12 can specify “SSH”, “TCP”, “VLAN 10”, “VXLAN 20”, and “UDP” as transfer protocols related to the failure and identifiers. At this time, the log data analysis program 12 identifies the transfer protocol and identifier including the priority when referring to the log data. The packet transfer is characterized in that the lower layer transfer protocol header precedes the upper layer transfer protocol header, and the influence of the lower layer transfer protocol affects the upper layer transfer protocol.

  Therefore, the log data analysis program 12 specifies the transfer protocol and identifier on the right side of the packet data analysis result 17 in the example of FIG. 10 as the transfer protocol and identifier with higher priority when referring to the log data (step). 103). The log data analysis program 12 stores the result specified by prioritizing the transfer protocol and identifier in the log data confirmation priority 19.

  FIG. 12 is a diagram illustrating an example of the log data confirmation priority 19. The log data confirmation priority 19 includes a priority 191, a transfer protocol, and an identifier 192. The value “1” of the priority 191 has the highest priority, and is stored in the transfer protocol and the identifier 192 in the order of “UDP”, “VXLAN 20”, “VLAN 10”, and “TCP” specified by the processing in step 103. Is done.

  Next, the log data analysis program 12 searches the log data analysis result 18 using each of the transfer protocol and identifier specified by the processing of step 103 as a key, and determines the number of log data including a character string matching the key as the network device 20. It is acquired every time (step 104). For example, in the example of the log data analysis result 18 shown in FIG. 7, when the log data analysis result 18 is searched using the character string “UDP” as a key, the number of entries 1803 and 1805 is equal to or greater than “1”. There is.

  Referring to the entry 1803, log data including the character string “UDP” is recorded “3” times in the network device 20c whose device name 181 is “ND20c” within a certain period. Referring to the entry 1805, log data including the character string “UDP” is recorded “1” times in the network device 20e having the device name 181 “ND20e” within a certain period. The network device 20 having a large number is highly likely to be involved in a failure, and therefore has a higher priority.

  In order to give priority to the network device 20, the log data confirmation priority 19 shown in FIG. 12 includes the device name 193 in addition to the transfer protocol and identifier 192, and the log data analysis program was acquired in step 104. Depending on the number, for example, when the transfer protocol identifier 192 is “UDP”, “ND20c” and “ND20e” are recorded in the device name 193 in this order.

  As described above, the higher the priority of log data confirmation priority 19, that is, the information recorded above the transfer protocol, identifier 192, and device name 193 in the example of FIG. It contributes to shortening the estimated time of the network administrator who estimates the cause of failure based on the information.

  Finally, the log data analysis program 12 searches the log data in the log data storage area 16 according to the prioritized result of the log data confirmation priority 19, extracts the log data including the matching character string, and displays it. (Step 105). When extracting log data including a matching character string, the amount of extraction processing may be reduced by using only log data that is distinct and stored separately as a search or extraction target.

  FIG. 13 is a diagram illustrating an example of an output result of analysis and estimation. In step 105, the log data analysis program 12 uses the user interface program 15 to output the analysis and estimation result to the display device 33. In FIG. 13, the same items as those in FIG. 12 are denoted by the same reference numerals, and are the same items as the log data display described with reference to FIG. 12, but the display order of the log data is the order of the serial numbers 161. is not.

  First, log data regarded as a failure from the priority determination is output as an “event log”. In the example of FIG. 13, the message 166 is log data of “SSH session timed out.”. With respect to this log data, the processing described with reference to FIG. 11 as the “estimated cause log” has a higher priority of “UDP” in the log data confirmation priority 19 shown in FIG. 12, and “ND20c” in “UDP”. ”Is high, so“ UDP packet is filtered. ”Is output,“ UD20 ”“ ND20e ”“ Received SNMP packet from UDP. ”Is output, and“ TCP ”“ TCP packet ” is filtered. "is output.

  Thereby, the network administrator can estimate that the UDP packet was discarded in the network device 20c caused the timeout of the SSH session and the communication interruption occurred by referring to the output of the display device 33. It is. Even if UDP packet discard is not the cause, the log data of the "probable cause log" is output in order of priority, so there are few network administrators by referring to the log data from the top. The cause can be reached by referring to the log data.

  Through the processing described above, the protocol that transfers the packet and the identifier in the packet header are constantly analyzed. Further, log data related to the analysis result and other log data are always distinguished. Further, regarding log data related to the result of analyzing a packet, the number of log data occurrences is arranged for each protocol and identifier in a fixed cycle. As a result, when a failure occurs in the network, the log data to be checked is narrowed down.

  The packet capture device 30 may capture all the packets received by the packet capture device 30, or may sample and capture the packets under preset conditions, or may capture all the packets. Only packets sampled under preset conditions may be transmitted to the network log analyzer 10. Further, the network log analysis device 10 may analyze all the packet data received from the packet capture device 30, or may analyze only the packet data sampled under a preset condition from the received packet data. Good.

  As described above, the log data estimated to be related to the failure can be presented to the network administrator according to the priority order, which can contribute to shortening the estimated time of the failure cause of the network administrator. Further, since the analysis is based on the flow, the analysis can be performed in a network tunneled by virtualization or encapsulation without depending on the physical configuration of the network. In addition, since the transfer protocol is handled as a character string and does not depend on the contents of the transfer protocol, it can be analyzed even in a network in which various protocols are mixed.

  The present invention and / or the present embodiment may be configured as a network log analysis method or a computer program executed by the network log analysis apparatus in addition to the configuration by the network apparatus 20 and the network log analysis apparatus 10 described above. Can do. The computer program may be recorded on a computer-readable recording medium. As the recording medium, for example, various media such as a flexible disk, a CD-ROM, a DVD-ROM, a magneto-optical disk, a memory card, and a hard disk can be used.

  Further, the present invention and this embodiment are not limited to the above-described embodiments, and various modifications are included. For example, the above-described embodiments have been described in detail for better understanding of the present invention, and are not necessarily limited to those having all the configurations described. Also, a part of the configuration of the embodiment can be replaced with another configuration, and another configuration can be added to the configuration of the embodiment. Furthermore, it is possible to add, delete, and replace other configurations for a part of the configuration of the embodiment.

  In addition, each of the above-described configurations, functions, processing units, and the like has been described as an example of creating a program that realizes some or all of them. It may be realized by hardware.

DESCRIPTION OF SYMBOLS 10 Network log analyzer 11 Log data acquisition program 12 Log data analysis program 13 Packet data acquisition program 14 Packet data analysis program 15 User interface program 16 Log data storage area 17 Packet data analysis result 18 Log data analysis result 19 Log data confirmation priority 20 Network device 30 Packet capture device

Claims (15)

A network analyzer,
Receive the captured packet, get the protocol and identifier information contained in the received packet as a string,
A packet analysis unit that classifies the acquired character strings according to the prioritized network layers;
Receive log data, detect protocol and identifier character strings included in messages in the received log data, count the number of detection of each character string,
Based on the character string of the message in the received log data including the failure information, search the character string classified according to the network layer, extract the character string of the protocol and identifier related to the failure,
Prioritize the network device that sent the log data based on the counted number of detections of the extracted character string, and receive the log data according to the protocol and identifier classified according to the network layer and the prioritized network device Log data analysis unit that prioritizes
A network analysis apparatus comprising: The network analyzer according to claim 1,
The packet analysis unit
A network analyzer characterized by classifying an acquired character string according to a prioritized network layer for each flow including a five-tuple of received packets. The network analyzer according to claim 2,
The log data analysis unit
A network characterized in that character strings of protocols and identifiers classified according to a network layer are detected from messages in received log data, and the number of detections is counted for each period of a preset period. Analysis equipment. The network analyzer according to claim 3,
The log data analysis unit
A network analyzer characterized by distinguishing log data including a message in which a character string has been detected from other log data and separately storing these log data. The network analyzer according to claim 4,
The packet analysis unit
The first packet that is captured and includes the second packet as data and encapsulated, and the protocol and identifier included in each of the received first packet and second packet are received. Get the information as a string,
For each flow that includes the five tuples of the received first packet and second packet, the acquired string is prioritized for the encapsulated packet and the prioritized packet layer. And a network analysis device characterized by classification according to the network layer. The network analysis device according to claim 5,
The log data analysis unit
A network analyzer characterized by controlling to display log data in order according to the priority assigned to the log data. A network analysis system having a network analysis device, a packet capture device, and a plurality of network devices,
Each of the plurality of network devices is
Sending and receiving packets to and from other network devices of the plurality of network devices;
Send log data related to packet transmission and reception to the network analyzer,
The packet capture device includes:
Capture packets sent and received between the plurality of network devices, and send the captured packets to the network analysis device,
The network analyzer is
Receive the captured packet, get the protocol and identifier information contained in the received packet as a string,
A bucket analysis unit that classifies the acquired strings according to the prioritized network layers;
Receive log data, detect protocol and identifier character strings included in messages in the received log data, count the number of detection of each character string,
Based on the character string of the message in the received log data including the failure information, search the character string classified according to the network layer, extract the character string of the protocol and identifier related to the failure,
Prioritize the network device that sent the log data based on the counted number of detections of the extracted character string, and receive the log data according to the protocol and identifier classified according to the network layer and the prioritized network device Log data analysis unit that prioritizes
A network analysis system comprising: The network analysis system according to claim 7,
The packet analysis unit
A network analysis system characterized by classifying an acquired character string according to a prioritized network layer for each flow including a five-tuple of received packets. The network analysis system according to claim 8,
The log data analysis unit
A network characterized in that character strings of protocols and identifiers classified according to a network layer are detected from messages in received log data, and the number of detections is counted for each period of a preset period. Analysis system. The network analysis system according to claim 9, wherein
The log data analysis unit
A network analysis system characterized by distinguishing log data including a message in which a character string has been detected from other log data and separately storing these log data. The network analysis system according to claim 10,
The capture device includes:
A network analysis system, wherein packets transmitted and received between the plurality of network devices are captured, and the captured packets are transmitted to the network analysis device by DPI (Deep Packet Inspection). The network analysis system according to claim 11, comprising:
The capture device includes:
A network analysis system that captures packets transmitted and received between the plurality of network devices and transmits all the captured packets to the network analysis device. The network analysis system according to claim 11, comprising:
The capture device includes:
A network analysis system that captures packets transmitted and received between the plurality of network devices, samples a portion of the captured packets, and transmits the sampled packets to the network analysis device. The network analysis system according to claim 12, wherein
Each of the plurality of network devices is
Sending and receiving a first packet encapsulating a second packet as data with other network devices of the plurality of network devices;
Transmitting log data relating to transmission / reception of the first packet and the second packet to the network analyzer;
The packet capture device includes:
Capturing a first packet transmitted and received between the plurality of network devices, and transmitting the captured first packet to the network analysis device;
The packet analysis unit
Receiving the first packet, obtaining the protocol and identifier information contained in each of the received first packet and second packet as a character string;
For each flow that includes the five tuples of the received first packet and second packet, the acquired string is prioritized for the encapsulated packet and the prioritized packet layer. And a network analysis system characterized by classification according to the determined network layer. A network analysis method,
Receive the captured packet, get the protocol and identifier information contained in the received packet as a string,
Classify the retrieved strings according to the prioritized network layer,
Receive log data, detect protocol and identifier character strings included in messages in the received log data, count the number of detection of each character string,
Based on the character string of the message in the received log data including the failure information, search the character string classified according to the network layer, extract the character string of the protocol and identifier related to the failure,
Prioritize the network device that sent the log data based on the counted number of detections of the extracted character string, and receive the log data according to the protocol and identifier classified according to the network layer and the prioritized network device A network analysis method characterized by prioritizing the network.

Images