JP4572211B2 - Network system, network relay device - Google Patents

Description

  The present invention relates to a network system and a network relay device.

  As systems for monitoring a network, those having a function called Simple Network Management Protocol (SNMP) or Remote Network Monitoring (RMON) are known. In these systems, network-related information is collected to monitor the network. In SNMP, an information ID called MIB (Management Information Base) is defined, information on the own device is stored according to this definition, and a stored value is returned in response to a request from another device. RMON has a mechanism for automatically acquiring specific information and storing it in the apparatus, and also has a mechanism for distributing data without responding to a request. In addition, both technologies have a function called a trap, and a dedicated manager device that is not a network relay device receives the information and only uses the information.

  When analyzing a network-related failure, it is mainly to infer the cause and the cause device based on the log information collected by the log collection function provided in the network device or terminal device. However, regarding the failure in the network, it is necessary to consider the information held by the connection partner, and the log information of the failure occurrence device alone is often insufficient for analysis. In addition, the information collection function of the device does not always take the desired data, but it is almost always collected by the administrator inputting a desired data acquisition command. For this reason, it is difficult to record time zone information before and after the occurrence of a failure in synchronization with devices in the network.

  Japanese Patent Laid-Open No. 2002-252614 (see Patent Document 1) describes the invention of “recording medium”. The present invention is a computer-readable recording medium that records a program that causes a computer to function to monitor a network state. A program for causing the computer to function as the following means is recorded. The monitoring content setting means sets the monitoring content. The monitoring means monitors the network with the monitoring content set by the monitoring content setting means. The monitoring content changing unit changes the monitoring content set by the monitoring content setting unit according to the monitoring result of the monitoring unit.

  Japanese Patent Laying-Open No. 2005-167347 (see Patent Document 2) describes the invention of a “network monitoring program”. The present invention is a network monitoring program for detecting a fault occurrence location on a network. The computer is caused to function as the following means. The storage means stores in advance a failure location determination table in which elements that may cause failures on the network are classified in advance, and events indicating an abnormality in communication via the network are associated with the classified elements. To do. The communication status monitoring means monitors the communication status with other devices on the network. The abnormality detection unit detects an event indicating an abnormality from the communication content detected by the communication status monitoring unit. The failure location determination unit refers to the failure location determination table and determines an element that causes the occurrence of the event detected by the abnormality detection unit. The failure information output means outputs failure information indicating the determination result by the failure location determination means.

  Japanese Patent Laying-Open No. 2005-286684 (see Patent Document 3) describes an invention of a “measurement system”. The measurement system is a measurement server that collects traffic information from a network device that outputs traffic information that flows through the network and an arbitrary network device to grasp traffic information in the network that consists of multiple network devices, and grasps the network performance It consists of. In the measurement server, the calculating means calculates statistical information of a flow that is an aggregate of packets output from an arbitrary network device based on traffic information collected from the network device. The identifying means identifies another network device through which a packet constituting the flow passes when the statistical information of the flow satisfies a condition that requires further monitoring. Requesting means requests traffic monitoring from the identified network device to monitor flow information requesting further monitoring.

JP 2002-252614 A JP 2005-167347 A JP 2005-286684 A

  An object of the present invention is to request monitoring enhancement from another network relay device when one network relay device detects a failure sign. Another object of the present invention is to perform monitoring strengthening in one network relay device when the one network relay device is requested to strengthen monitoring from another network relay device.

  [Means for Solving the Problems] will be described below using the numbers and symbols used in [Best Mode for Carrying Out the Invention]. These numbers and symbols are added in parentheses in order to clarify the correspondence between the description of [Claims] and [Best Mode for Carrying Out the Invention]. However, these numbers and symbols should not be used for the interpretation of the technical scope of the invention described in [Claims].

  The network system according to the present invention includes n network relay apparatuses (101 to 104) that relay network data. One network relay device (101) includes an in-device information collecting unit (204) that collects monitoring information in the own device, an information recording unit (205) that accumulates the monitoring information, and the monitoring information includes a failure indication. , A sign notification processing unit (203) for notifying the other [n−1] network relay apparatuses (102 to 104) that the trouble sign has been detected. Each of the other [n−1] network relay devices (102 to 104) collects monitoring information within the device itself, and a failure sign is detected from the one network relay device (101). An in-device information collection unit that collects additional monitoring information when notified to the effect, and an information recording unit that accumulates the monitoring information and the additional monitoring information.

  In the network relay device (101) according to the present invention, the in-device information collection unit (204) collects monitoring information within the own device. The information recording unit (205) stores the monitoring information. When the monitoring information indicates a failure sign, the sign notification processing unit (203) notifies the other network relay devices (102 to 104) that the failure sign has been detected.

  In the network relay device (101) according to the present invention, the list (105) is shared with other network relay devices (102 to 104), and the type of failure sign is defined. The sign detection condition table (206) defines fault sign detection conditions for each type. Based on the sign detection condition table (206), the sign notification processing unit (203) sends the type to the other network relay devices (102 to 104) when any kind of fault sign is detected. Notify that a failure sign has been detected.

  In the network relay device (101) according to the present invention, the sign detection condition table (206) defines a failure sign convergence condition for each type. After the notification of the detection, the sign notification processing unit (203), based on the sign detection condition table (206), when the failure sign of the type has converged, other network relay devices (102 to 102). 104) that the failure indication of the type has converged.

  In the network relay device (101) according to the present invention, the monitoring strengthening information table (207), when any type of failure sign is detected based on the sign detection condition table (206), Referenced to index additional monitoring information related to failure signs. The in-device information collection unit (204) collects additional monitoring information based on the enhanced monitoring information table (207) when any type of failure sign is detected.

  In the network relay device (101) according to the present invention, the sign detection condition table (206) defines a failure sign convergence condition for each type. The in-device information collection unit (204), when any type of failure sign has been detected and when the type of failure sign has converged based on the indication detection condition table (206), Collecting additional monitoring information is stopped based on the table (207).

  In the network relay device (101) according to the present invention, the in-device information collection unit (204) collects monitoring information within the own device. The information recording unit (205) stores the monitoring information. The in-device information collection unit (204) collects additional monitoring information when notified from other network relay devices (102 to 104) that a failure sign has been detected.

  In the network relay device (101) according to the present invention, the list (105) is shared with other network relay devices (102 to 104), and the type of failure sign is defined. When the enhanced network information table (207) is notified from the other network relay devices (102 to 104) that a failure sign of any type has been detected, an additional information related to the failure sign of that type is added. Referenced to index monitoring information. When the in-device information collecting unit (204) is notified from the other network relay devices (102 to 104) that any type of failure sign has been detected, the in-device information collecting unit (204) stores the in-monitoring information table (207). Based on that, collect additional monitoring information related to that type of failure indication.

  In the network relay device (101) according to the present invention, the in-device information collection unit (204) is notified from the other network relay devices (102 to 104) that any type of failure sign has been detected. In this case, after that, when the other network relay device is notified that the failure sign of the type has converged, the additional monitoring information is collected based on the enhanced monitoring information table (207). Stop.

  According to the present invention, when one network relay device detects a failure sign, it is possible to request another network relay device to enhance monitoring. Further, when one network relay device is requested to enhance monitoring from another network relay device, the one network relay device can perform the monitoring enhancement.

  In the present embodiment, a mechanism for detecting a failure occurrence sign in a network with a plurality of relay apparatuses connected to the network and expanding the information collection range inside the relay apparatus in response to the detection is provided. First, a plurality of relay devices connected to the network have a function of collecting monitoring information of the own relay device in each relay device. Secondly, each relay device has a function of detecting a failure sign. Each relay apparatus can detect a failure sign under an arbitrary condition. Third, the relay device that has detected the failure sign has a function of notifying the other relay device of the failure sign. At this time, in the network, detailed monitoring information before and after the occurrence of the failure is collected by extending the information collection range in synchronization with a plurality of relay devices.

  In this embodiment, a failure occurrence pattern in a network is defined in common by a plurality of relay apparatuses. Further, in association with a common failure symptom pattern in the network, each relay apparatus defines a condition (referred to as an assert condition) in which the monitoring information and its threshold value are mapped. When the assert condition is satisfied, it is determined that the occurrence of the failure sign is detected. On the other hand, a threshold value for determining that the failure sign has converged is also defined, and similarly, a deassertion condition is defined. If this deassertion condition is met, it is determined that the failure sign has converged. As will be described later, the mapping between the failure sign pattern and the monitoring information does not have to be one-to-one, and a plurality of pieces of monitoring information may be mapped for one failure sign. In this case, in order to judge a plurality of conditions in a composite manner, individual condition judgment formulas are computed, and the computation results are used for sign detection / convergence judgment.

  When the monitoring information satisfies the assert condition in a certain relay device, the relay device generates a “sign indication packet” that means failure sign detection and distributes it to the network. At this time, other relay apparatuses that receive the “indication notification packet” shift to the monitoring enhancement mode and expand the collection range of the monitoring information. After that, when the monitoring information matches the deassertion condition, the relay device generates a “signature convergence packet” that means convergence of the failure sign and distributes it to the network, assuming that the sign of the failure has converged. . At this time, other relay apparatuses that receive the “sign indication convergence packet” return to the normal monitoring mode and cancel the expansion of the monitoring information collection range.

  When the own relay device satisfies the assert condition or receives a “sign indication packet” from another relay device, the information collection target of the own relay device is added according to the failure symptom type to enhance monitoring. The information collection target can be common to all network relay apparatuses, but can be defined individually. If the assertion condition is met at the own relay apparatus, the operation for enhancing the information collection is continued until the deassertion condition is met at the own relay apparatus. In addition, when a “sign indication packet” is received from another relay device, it is continued until a “sign indication packet” is received from the other relay device. From the occurrence of a failure sign to convergence, the acquired and enhanced monitoring information is individually stored in each of the plurality of relay apparatuses. The accumulated monitoring information can be used in the investigation of the cause of the failure.

  Next, embodiments of the present invention will be described in detail with reference to the drawings. Referring to FIG. 1, the embodiment of the present invention has a network configuration in which one network relay device 101 is connected to other network relay devices 102 to 104. As illustrated, the network relay device 101 shares the failure symptom common definition list 105 with the other network relay devices 102 to 104. The network relay devices 101 to 104 are devices that relay network data, and relay network data based on information for identifying a transmission destination / transmission source recorded in received data. The failure sign definition list 105 is a list of failure events that can occur in the network relay devices 101 to 104.

  FIG. 2 is an explanatory diagram of the failure sign common definition list 105. The failure sign common definition list 105 shown is a list in which a unique identifier is assigned to a failure event, and is shared by the network relay devices 101 to 104. In FIG. 2, a failure sign identifier “1” is assigned to [indication 1], a failure sign identifier “2” is assigned to [sign 2], and a failure sign is assigned to [sign 3]. The identifier “3” is assigned with the failure sign identifier “4” for [sign 4].

  FIG. 3 shows a block explanatory diagram of the network relay device 101. Here, only the network relay device 101 is illustrated among the four network relay devices 101 to 104 illustrated in FIG. 1, but the other three network relay devices 102 to 104 are configured in the same block configuration as the network relay device 101. have. However, the performance of the packet switch processing unit, the number of ports, and the like are not exactly the same between the network relay apparatuses 101 to 104. As illustrated in FIG. 3, the network relay device 101 includes a packet switch processing unit 202, a sign notification detection / issue processing unit 203, an in-device information collection unit 204, and an information recording unit 205.

  The in-device information collection unit 204 collects statistical information and device information stored in the information register 209 of the packet switch processing unit 202. Then, the monitoring information is recorded in the information recording unit 205. Further, the monitoring information can be read from the information recording unit 205. The monitoring information that can be collected is defined in the monitoring information definition table 208, and the identification number of the monitoring information that is constantly monitored is also defined in the table 208. Further, if the in-device information collection unit 204 matches the assert condition defined in the sign detection condition table 206, the in-device information collection unit 204 notifies the sign notification detection / issuance processing unit 203 that a sign of failure has been detected. Issue. Thereafter, when the deassertion condition defined in the sign detection condition table 206 is met, the in-device information collection unit 204 determines that the sign has converged to the sign notification detection / issue processing unit 203 as “sign sign convergence notification”. Is issued.

  When receiving the “sign indication detection notification” from the in-device information collection unit 204, the indication notification detection / issue processing unit 203 generates an “indication notification packet” and transmits the “indication notification packet” to the packet switch processing unit 202. To send. At this time, the packet switch processing unit 202 distributes the “sign indication packet” to the other relay apparatuses 102 to 104. On the other hand, when receiving the “signature convergence notification” from the in-device information collection unit 204, the sign notification detection / issuance processing unit 203 generates a “signature convergence packet” and performs packet switch processing on the “signature convergence packet”. To the unit 202. At this time, the packet switch processing unit 202 distributes the “signature convergence packet” to the other relay apparatuses 102 to 104.

  The packet switch processing unit 202 analyzes the network data input from the port 210 of the network relay apparatus 101, specifies the destination port 210, and outputs the network data to the port 210. The packet switch processing unit 202 also analyzes whether the network data input from the port 210 is a “sign indication packet”. When the packet switch processing unit 202 finds network data corresponding to the “sign indication packet”, the packet switch processing unit 202 sends the “sign indication packet” to the indication notification detection / issue processing unit 203. The sign notification detection / issuance processing unit 203 passes the sign ID described in the “sign sign notification packet” and the identification information indicating the transmission source to the in-device information collection unit 204. The in-device information collection unit 204 refers to the monitoring enhancement information table 207 and the monitoring information definition table 208 to expand the monitoring information collection range.

  Thereafter, when the “signature convergence packet” is delivered from the network relay device that delivered the “signature notification packet”, the “signature convergence packet” is found by the packet switch processing unit 202. This “signature convergence packet” is sent to the sign notification detection / issue processor 203. The sign notification detection / issue processing unit 203 passes the sign ID described in the “sign sign convergence packet” and the identification information indicating the transmission source to the in-device information collection unit 204. The in-device information collection unit 204 refers to the monitoring enhancement information table 207 and stops the acquisition processing of the monitoring enhancement information corresponding to the corresponding sign identifier.

  Referring to FIG. 4, a detailed explanatory diagram of the sign detection condition table 206 included in the network relay device 101 is shown. In FIG. 4, the sign detection condition table 206 holds information defining conditions for detecting a failure sign by the network relay device 101 (assertion condition) and conditions for determining that the fault sign has converged (deassertion condition). Yes. In the figure, the sign ID column indicates the fault sign identifier defined in the common fault sign definition list 105. The column of the monitoring information ID indicates an identifier of monitoring information related to the failure sign. The determination threshold value column indicates a threshold value that the monitoring information applies to the assertion condition and a threshold value that applies to the deassertion condition. The column of the detection determination arithmetic expression indicates a logical expression in the case of determining the assert condition and the deassert condition using a plurality of types of monitoring information.

  Referring to FIG. 5, a detailed explanatory diagram of the monitoring enhancement information table 207 included in the network relay apparatus 101 is shown. In FIG. 5, the monitoring enhancement information table 207 holds information related to monitoring information that is additionally acquired when the assert condition is satisfied. In the figure, the sign ID column indicates the fault sign identifier defined in the common fault sign definition list 105. The column of the monitoring information ID is a field for monitoring information to be additionally acquired when a failure symptom is detected by the network relay device 101 or when a “sign indication packet” is received from another network relay device 102 to 104. Indicates an identifier.

  Referring to FIG. 6, a detailed explanatory diagram of the monitoring information definition table 208 included in the network relay device 101 is shown. In FIG. 6, a monitoring information definition table 208 defines monitoring information groups that can be collected by the in-device information collection unit 204 of the network relay device 101. In the figure, the monitoring information ID column indicates identifiers of monitoring information that can be collected. The monitoring information column shows the contents of monitoring information that can be collected. The column of the steady monitoring flag indicates whether the monitoring information is collected during steady operation or collected during monitoring enhancement. Referring to the monitoring information definition table 208 in FIG. 6, in [monitoring information 1] to [monitoring information 5] indicated by the monitoring information ID = “1” to “5”, the steady monitoring flag is “V (Valid)”. Is displayed. Therefore, such monitoring information is always collected. On the other hand, in [monitoring information 6] to [monitoring information 9] indicated by the monitoring information ID = “6” to “9”, the steady monitoring flag is displayed as “OFF”. Therefore, these pieces of monitoring information can be collected only in the monitoring enhancement mode.

  Next, the operation of the network relay device 101 in the present embodiment will be described in detail with reference to the flowcharts of FIGS. First, the initial setting process of FIG. 7 will be described. In the initial setting in FIG. 7, first, the monitoring information definition table 208 is set (step A1). Here, a list of monitoring information that can be collected by the network relay apparatus 101 is generated, and a unique identifier is assigned to each monitoring information. In addition, a steady monitoring flag is set for monitoring information that is to be constantly monitored. The monitoring information in which the steady monitoring flag is set can be used to detect the signs defined in the failure sign common definition list 105.

  Next, the sign detection condition table 206 is set (step A2). A determination threshold value and an arithmetic expression are created in association with the signs defined in the failure sign common definition list 105. In the determination threshold value, information related to the failure event is linked from the monitoring information in which the steady monitoring flag is set in the monitoring information definition table 208, and the threshold value of the assertion condition / deassertion condition of the monitoring information is set. In the sign detection condition table 206 of FIG. 4, [monitoring information 1] and [monitoring information 3] are used in combination for detecting the fault sign of the sign ID “1”. As for [monitoring information 1], the assertion condition is satisfied when [monitoring information 1] is 20 times / second or more, and the deassertion condition is satisfied when [monitoring information 1] is 10 times / second or less. As for [monitoring information 3], the assert condition is satisfied when [monitor information 3] is 40 or more, and the deassert condition is satisfied when [monitor information 3] is 25 or less. [Monitoring information 2] and [Monitoring information 3] are used in combination for detection of a fault sign of the sign ID “2”. As for [monitoring information 2], the assertion condition is satisfied when [monitoring information 2] is 8K packets or more, and the deassertion condition is satisfied when [monitoring information 2] is 6K packets or less. As for [monitoring information 3], the assert condition is satisfied when [monitor information 3] is 1000 or more, and the deassert condition is satisfied when [monitor information 3] is 400 or less. [Monitoring information 1] and [Monitoring information 4] are used in combination for the detection of the fault sign of the sign ID “3”. As for [monitoring information 1], the assertion condition is satisfied when [monitoring information 1] is 50 times / second or more, and the deassertion condition is satisfied when [monitoring information 1] is 20 times / second or less. As for [monitoring information 4], when [monitoring information 4] becomes “true”, the assertion condition is satisfied, and when [monitoring information 4] becomes “false”, the deassertion condition is satisfied. Only the [monitoring information 5] is used for detecting the failure sign of the sign ID “4”. The assert condition is satisfied when [monitor information 5] is 1000 frames / second or more, and the deassert condition is satisfied when [monitor information 5] is 500 frames / second or less.

  In the setting of the sign detection condition table 206, when a plurality of pieces of monitoring information are linked to one failure event, a determination calculation formula is defined in order to make a composite determination. In the sign detection condition table 206 of FIG. 4, the assertion condition of the sign ID “1” is set when the assertion condition of [monitoring information 1] is satisfied and the assertion condition of [monitoring information 3] is satisfied. The assertion condition of the sign ID “2” is set when either the assertion condition of [monitoring information 2] or the assertion condition of [monitoring information 3] is satisfied. The assertion condition of the sign ID “3” is set when the assertion condition of [monitoring information 1] is satisfied and the assertion condition of [monitoring information 4] is satisfied. No logical expression is defined for the sign ID “4”. This is because there is a one-to-one mapping between the failure sign pattern and the monitoring information.

  Finally, the monitoring information strengthening table 207 is set (step A3). Here, monitoring information to be additionally collected when a failure sign is detected is set. From the information group of the monitoring information definition table 208, monitoring information to be additionally collected is selected from the monitoring information other than the monitoring information having the identifier for which the steady monitoring flag is set. Set the selected monitoring information for each symptom event. In the monitoring information strengthening table 207 of FIG. 5, [monitoring information 6] is set for the sign ID “1”. For the sign ID “2”, the “monitoring information 7” is for the sign ID “3”, and for the sign ID “3”, the “monitoring information 8” and the “monitoring information 9” are for the sign ID “4”. In this case, [monitoring information 6] and [monitoring information 9] are set.

  The network relay device 101 is configured to communicate with the other network relay devices 102 to 104 about the occurrence and convergence of the failure sign using the sign ID. Therefore, the contents of the tables 206 to 208 included in the network relay apparatus 101 are the same as the contents of the sign detection condition table, the monitoring enhancement information table, and the monitoring information definition table included in the other network relay apparatuses 102 to 104. Not necessarily. For example, when the contents of the sign detection condition table 206 included in the network relay apparatus 101 and the contents of the sign detection condition table included in the other network relay apparatuses 102 to 104 are compared, the signs ID column matches, but other monitoring The information ID column, the determination threshold value column, and the detection determination calculation formula column do not necessarily match. Similarly, when the contents of the enhanced monitoring information table 207 of the network relay apparatus 101 and the contents of the enhanced monitoring information tables of the other network relay apparatuses 102 to 104 are compared, the signs ID column matches, but the monitoring information The ID column does not necessarily match. Furthermore, since the contents of the monitoring information definition table depend on the model, performance, etc. of the network relay device, there may be a great difference between the network relay devices.

  Next, the steady monitoring process of FIG. 8 will be described. First, the type of monitoring information for which the regular monitoring flag is set in the monitoring information definition table 208 is acquired (step B1). Then, it is calculated whether this monitoring information matches the assertion condition of the sign detection condition table 206 (step B2). If the assert condition is not met, the process returns to step B1, and the steady monitoring information is continuously acquired. When the assert condition is met, notification processing is performed in order to deliver a notification indicating that a failure sign has occurred in the own relay apparatus to the entire network (step B3). Then, the process passes to the notification process flow.

  FIG. 9 shows a flowchart of the notification process. In the notification process, packet data is first generated (step C1). The packet data includes the identification information of the own relay device and the failure symptom identifier defined in the failure symptom common definition list 105. Then, the generated packet data is distributed toward the network (step C2). The transmission destination may be broadcast or individual notification. In the case of individual notification, a transmission destination list may be separately generated and transmitted based on this list. After completing the notification process or in parallel with the notification process, the network relay apparatus 101 starts the monitoring enhancement process (step B5).

  FIG. 10 shows a flowchart of the monitoring enhancement process. In the monitoring enhancement process, in addition to the steady monitoring information defined in the monitoring information definition table 208, additional acquisition monitoring information defined in the monitoring enhancement information table 207 is obtained and stored in the information recording unit 205 (step D1). . Then, it is determined whether or not the deassertion condition defined in the sign detection condition table 206 is met (step D2). If they do not coincide with each other, it is assumed that the failure sign has not converged, and the monitoring is continued to be enhanced, and the process returns to step D1. If the deasserting condition is met, the notification process is performed assuming that the failure sign in the own relay apparatus has converged (step D3). This notification process is the same as the process of steps C1 and C2 shown in FIG. 9, and signs convergence information is embedded and distributed. At the same time as performing the notification process, the network relay apparatus 101 stops acquiring the additional acquisition monitoring information.

  In FIG. 8, after exiting the monitoring enhancement process (step B4), it is accepted whether or not the regular monitoring is terminated (step B5). If the monitoring is to be continued, the process returns to step B1 to continue the steady monitoring. If the steady monitoring process is to be terminated, the steady monitoring process is stopped.

  When the other relay apparatuses 102 to 104 detect the occurrence / convergence of the failure sign, the other relay apparatuses 102 to 104 issue a sign notification and a convergence notification. At this time, the network relay device 101 executes a symptom notification reception process. FIG. 11 shows a flowchart of the sign notification receiving process. The flowchart of FIG. 11 is started upon reception of a sign notification (step E1). Subsequently, the received sign notification is analyzed. With reference to the monitoring enhancement information table 207, the “ID” of the monitoring information to be additionally acquired is searched from the “ID” of the indication included in the indication of the indication. When the “ID” of the monitoring information is searched, the monitoring information definition table 208 is referred to and the contents of the monitoring information to be additionally acquired are searched from the “ID” of the monitoring information. When the contents of the additionally acquired monitoring information are found, the network relay apparatus 101 additionally acquires and accumulates the monitoring information (step E2). Thereafter, it is checked whether or not a convergence notification is delivered from the relay device that has issued the sign notification (step E3). If the convergence notification has not been received, the process returns to step E2 and continues to acquire additional monitoring information. When the convergence notification is received, the monitoring information additional acquisition / accumulation process performed in step E2 is terminated (step E4).

  A setup terminal for writing the contents thereof can be centrally connected to the sign detection condition table, the monitoring enhancement information table, and the monitoring information definition table included in each of the network relay devices 101 to 104. In this case, the failure symptom common definition list 105 can be omitted from the components of the network relay devices 101 to 104 by holding the failure symptom common definition list 105 only in the setup terminal.

  As described above, according to the present embodiment, since a common failure sign is defined in the network relay device, collection of monitoring information according to the characteristics of the network relay device in relation to the sign pattern Is possible. In addition, since a failure sign detected by some network relay devices can be reported to the entire network, a large number of network relay devices can simultaneously synchronize and expand the collection range of monitoring information.

FIG. 1 is a diagram showing a network configuration in the embodiment of the present invention. FIG. 2 is an explanatory diagram of the failure sign common definition list 105. FIG. 3 is a block explanatory diagram of the network relay apparatus 101. FIG. 4 is a detailed explanatory diagram of the sign detection condition table 206. FIG. 5 is a detailed explanatory diagram of the monitoring enhancement information table 207. FIG. 6 is a detailed explanatory diagram of the monitoring information definition table 208. FIG. 7 is a flowchart of the initial setting process. FIG. 8 is a flowchart of the steady monitoring process. FIG. 9 is a flowchart of the notification process. FIG. 10 is a flowchart of the monitoring enhancement process. FIG. 11 is a flowchart of the sign notification receiving process.

Explanation of symbols

101-104 Network relay device 105 Fault indication common definition list 202 Packet switch processing unit 203 Indication notification detection / issue processing unit 204 In-device information collection unit 205 Information recording unit 206 Indication detection condition table 207 Monitoring enhancement information table 208 Monitoring information definition table 209 Information register 210 port

Claims (9)

A network system having n network relay devices for relaying network data,
One network relay device
In-device information collection unit that collects monitoring information in its own device;
An information recording unit for storing the monitoring information;
When the monitoring information indicates a failure sign, a sign notification processing unit for notifying that the failure sign is detected to the other [n−1] network relay devices,
Each of the other [n−1] network relay devices is
In-device information collection unit that collects monitoring information in the device itself, and collects additional monitoring information when notified from the one network relay device that a failure sign is detected;
A network system comprising: an information recording unit for storing the monitoring information and the additional monitoring information. In-device information collection unit that collects monitoring information in its own device;
An information recording unit for storing the monitoring information;
When the monitoring information indicates a failure sign, a sign notification processing unit that notifies other network relay devices that the failure sign is detected ;
A monitoring enhancement information table in which additional monitoring information related to the failure sign is defined, and
The in-device information collection unit
A network relay device that collects additional monitoring information based on the monitoring strengthening information table when the failure sign is detected . A list that is shared with other network relay devices and that defines the type of failure indication;
A sign detection condition table that defines detection conditions for fault signs for each type, and
The sign notification processing unit
3. The network relay according to claim 2, wherein when any type of failure sign is detected based on the sign detection condition table, the other network relay apparatus is notified that the type of failure sign is detected. apparatus. The sign detection condition table defines a failure sign convergence condition for each type,
The sign notification processing unit
After notifying that it has been detected, based on the indication detection condition table, when the failure indication of the type has converged, it notifies other network relay devices that the failure indication of the type has converged. 3. The network relay device according to 3. The enhanced monitoring information table is defined such that additional monitoring information related to the failure indication can be indexed by the type of the failure indication,
The in-device information collection unit
The network relay device according to claim 3, wherein when any type of failure sign is detected, additional monitoring information is collected based on the monitoring strengthening information table. The sign detection condition table defines a failure sign convergence condition for each type,
The in-device information collection unit
After any type of failure sign is detected, based on the sign detection condition table,
The network relay device according to claim 5, wherein when the failure sign of the type converges, the collection of additional monitoring information is stopped based on the monitoring enhancement information table. In-device information collection unit that collects monitoring information in its own device;
An information recording unit for storing the monitoring information;
The in-device information collection unit
A network relay device that collects additional monitoring information when notified by another network relay device that a failure sign has been detected. A list that is shared with other network relay devices and that defines the type of failure indication;
A monitoring enhancement information table for indexing additional monitoring information related to a failure sign of that type when notified by another network relay device that a failure sign of any type has been detected;
The in-device information collection unit
When it is notified from another network relay device that a failure sign of any type has been detected, additional monitoring information related to the failure sign of that type is collected based on the enhanced monitoring information table. Item 8. The network relay device according to Item 7. The in-device information collection unit
When another network relay device is notified that a failure sign of any type has been detected, and after that, the other network relay device is notified that the failure sign of the type has converged. The network relay device according to claim 8, wherein collection of additional monitoring information is stopped based on the monitoring enhancement information table.

Images