JP4852486B2 - Traffic monitoring system - Google Patents

Description

  The present invention relates to a traffic monitoring system, and more particularly to a traffic monitoring system that detects a failure of a traffic volume measurement location such as a router device.

Generally, in a traffic monitoring system, an alarm is generated when an alarm from a communication device such as a router device and a collected traffic amount exceed an upper limit threshold. For example, an event in which the value of the traffic volume becomes larger than a threshold value occurs due to access concentration or the like.
In the above method, when a failure that cannot raise an alarm from the device (hereinafter referred to as a silent failure) occurs, there is a possibility that the maintenance will not be recognized by the maintenance personnel, and the service interruption may continue. May cause trouble.

The event that the traffic volume becomes small may occur not only when there is no access, but also when the traffic is blocked by a failure. At that time, an alarm regarding the failure location of the target device may be raised (that is, output), but the alarm may not be raised depending on the device. In such a case, the detection may be delayed, and the influence may spread to the entire network or the entire service.
By the way, Patent Document 1 describes a configuration in which congestion data is monitored by obtaining traffic data for each router included in a network to be monitored.
JP 2002-271384 A

When the above-described silent failure occurs, the user cannot use the corresponding service, but the alarm is not raised in the monitoring system, so that the maintenance person looks normal. Such a problem cannot be solved by the technique described in Patent Document 1.
In the first place, in general, a communication device such as a router has a mechanism for detecting a failure by itself and notifying a monitoring system. However, the failure is a phenomenon that occurs because the communication device itself cannot detect the failure, and it can be said that it is difficult to cope with the communication device. For this reason, it is desired to realize a monitoring system that can complementarily detect information that is periodically collected from the devices to be monitored.

Here, in general, the monitoring system does not perform monitoring when the measured traffic volume decreases. For this reason, when the amount of traffic decreases due to a device failure or the like, a failure inquiry from each system or a report from the user triggers the failure detection. However, at this failure detection opportunity, a significant work delay occurs before failure response starts.
Further, since increasing the number of alarms is equivalent to asking the maintenance person to respond, increasing the number of warnings may cause a decrease in maintainability. Therefore, in order to recognize a new failure while maintaining maintainability, a case of a certain level of erroneous determination is assumed, and in this case, it is necessary to devise not to output as an alarm.

The same idea as described above is necessary for the recovery from the alarm detection state to the normal state. If it is assumed that the alarm is recovered unnecessarily, the occurrence of alarm and the detection of recovery may be repeated. While maintaining such maintainability, it is desirable to realize an advanced failure detection mechanism.
The present invention has been made to solve the above-described problems of the prior art, and an object thereof is to provide a traffic monitoring system for early detection of silent failure.

Traffic monitoring system according to the present onset Ming, a traffic monitoring system for monitoring based on the set lower threshold value for the measurement point traffic volume, periodically acquires traffic information about the traffic volume at the measurement points The traffic information acquisition means (for example, corresponding to the storage unit 23 in FIG. 1) and the ratio of the traffic volume at the measurement location to the predetermined reference traffic volume acquired by the traffic information acquisition means.
Traffic fluctuation rate calculation means for calculating the traffic fluctuation rate (for example, the step in FIG.
And the traffic calculated by the traffic fluctuation rate calculating means.
Determination means regarded as a warning generation condition for the measurement point when the click variation rate becomes lower than the lower threshold (e.g., corresponding to the determination unit 25 in FIG. 1) and only contains the alarm condition der
In the state considered to be, the traffic fluctuation rate calculating means
The traffic fluctuation rate is calculated using the traffic volume before entering the state as the reference traffic volume.
The traffic fluctuation rate calculated by the traffic fluctuation rate calculation means is
The determination means considers that the alarm has been recovered from the alarm occurrence state when the threshold value is exceeded . According to such a configuration, it is possible to increase the possibility of failure detection by notifying from the monitoring system side the silent failure that the maintenance person could not recognize, and shorten the service interruption time. In addition, silent traffic based on the calculated traffic fluctuation rate.
Faults can be detected, and the maintenance system notifies the maintenance personnel of the possibility of fault detection.
Can increase the service interruption time. In addition, it ’s not considered to have recovered unnecessarily.
The occurrence of repeated alarm detection and recovery detection can be prevented.

For silent failures, if the traffic fluctuation rate value calculated based on traffic information falls below the lower threshold, it is assumed that an alarm has occurred, and the silent failure that the maintainer could not recognize is detected on the monitoring system side. By notifying from, it is possible to increase the possibility of failure detection and shorten the service interruption time. Then, by notifying from the monitoring system side of a failure that could not be recognized until now by the maintenance person, the possibility of failure detection can be increased, and the service interruption time can be shortened.
In addition, the traffic fluctuation rate is calculated using the traffic volume before the alarm is generated as the reference traffic volume, and when the traffic fluctuation rate exceeds the lower threshold, it is assumed that the alarm has been recovered, so it recovers unnecessarily. Therefore, it is possible to prevent the occurrence of repeated alarm detection and recovery detection.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the drawings referred to in the following description, the same parts as those in the other drawings are denoted by the same reference numerals.
(Embodiment)
FIG. 1 is a block diagram showing a configuration example of a traffic monitoring system according to an embodiment of the present invention. Referring to the figure, the monitoring target 10 of the traffic monitoring system 20 according to the present embodiment is, for example, a router. The traffic monitoring system 20 receives a state transition request from the traffic management unit 21 that acquires the traffic volume by making a state acquisition request to the monitoring target 10 and the traffic management unit 21, updates the state of the monitoring target 10, and 30 and a state management unit 22 that notifies the state change to 30.

  In addition, referring to the same figure, the traffic management unit 21 is a storage unit 23 that periodically acquires and stores information on traffic at a traffic measurement location such as a router to be monitored, and is stored in the storage unit 23. Whether the reference data holding unit 24 that holds the fluctuation rate calculation reference traffic amount is compared with the reference traffic amount and the latest traffic amount held in the storage unit 23, and an alarm is generated. It is comprised from the determination part 25 to determine. Based on the determination result of the determination unit 25, the state management unit 22 notifies the monitoring terminal 30 of the state change if there is a state change.

The traffic monitoring system 20 may be realized by using a known server device including a CPU (Central Processing Unit), a storage device, a communication interface, and the like. In that case, the function of each unit constituting the traffic monitoring system 20 is realized by the CPU executing software or firmware.
In the above configuration, the traffic volume of the monitoring target 10 monitored by the traffic monitoring system 20 is periodically acquired and held in the storage unit 23.

The reference data holding unit 24 defines a fluctuation rate calculation reference traffic amount necessary for calculating the fluctuation rate, and holds the value.
The traffic fluctuation rate is a fluctuation rate for transmission data and reception data at a traffic volume measurement point. In this example, the traffic fluctuation rate is calculated using the latest traffic volume and the fluctuation rate calculation reference traffic volume. The fluctuation rate calculation reference traffic volume is set to calculate the fluctuation rate. This fluctuation rate calculation reference traffic volume is, in principle, a value before a specified period set by the maintenance person. However, when data is lost or when the alarm is already detected by the previous period, the traffic volume used immediately before the alarm is generated is adopted as the reference traffic volume. By doing in this way, a highly accurate determination can be performed.

On the other hand, with regard to recovery from the alarm detection state to the normal state, the reference traffic amount before the alarm occurrence is used as the reference traffic amount, and if the above fluctuation rate falls within the lower threshold, it is recognized that the alarm has been automatically recovered, thereby eliminating unnecessary alarms. This eliminates the need for accurate monitoring.
The reference data holding unit 24 holds a file containing various setting values necessary for the processing of the present system.
The determination unit 25 calculates a traffic fluctuation rate based on the reference traffic, and makes a state transition request to the state management unit 22 when the calculated traffic fluctuation rate value falls below a preset lower threshold.

(Regular status acquisition)
FIG. 2 is a sequence diagram showing the contents of periodic status acquisition processing by the storage unit 23. In the figure, the storage unit 23 periodically transmits a status acquisition request to the monitoring target 10 based on a period (for example, 5 minutes) preset at the time of registration of the monitoring process (step S201). In this case, for example, a GET by SNMP (Simple Network Management Protocol) is periodically transmitted to the monitoring target 10.
By transmitting the status acquisition request, the storage unit 23 can acquire the traffic volume of the monitoring target 10 as a status acquisition response (that is, RESPONSE), and the traffic volume is stored in the storage unit 23 itself (step S202).

(Calculation of traffic fluctuation rate)
FIG. 3 is a sequence diagram showing the content of the traffic fluctuation rate calculation process by the determination unit 25. In the figure, the fluctuation rate calculation reference traffic necessary for calculating the fluctuation rate is defined, and the value is held in the reference data holding unit 24.
The determination unit 25 transmits the latest data read request to the storage unit 23 (step S301), and acquires the latest traffic amount stored in the storage unit 23 by the latest data read response (step S302).

Further, the determination unit 25 transmits a reference data read request to the reference data holding unit 24 (step S303), and acquires the fluctuation rate calculation reference traffic held in the reference data holding unit 24 by a reference data read response (step S303). S304).
The determination unit 25 calculates a traffic fluctuation rate based on the reference traffic value (step S305). When the calculated traffic fluctuation rate exceeds a preset threshold value, the determination unit 25 transmits a state transition request to the state management unit 22.

Referring to FIG. 4, the state transition request transmitted from the determination unit 25 is sent to the state management unit 22 (step S401). Upon receiving this state transition request, the state management unit 22 recognizes that the monitoring target 10 has transitioned from the normal state to the failure state (that is, the alarm detection state).
In addition, a state change notification is transmitted from the state management unit 22 to the monitoring terminal 30 (step S402). Thereby, the monitoring terminal 30 recognizes that the monitoring target 10 has transitioned from the normal state to the failure state (that is, the alarm detection state).
Through the above process, the monitoring terminal 30 can confirm the occurrence of an alarm.

(Recovery from alarm detection state to normal state)
Next, recovery from the alarm detection state to the normal state will be described.
Normally, when the traffic volume returns to a value within the lower threshold, it can be considered that the alarm detection state has been restored to the normal state. However, when it is determined whether or not the recovery has occurred based on a comparison with a state several cycles before, the following problem occurs. In other words, the monitoring target in this system is in a state where the traffic volume is settled at 0, so it is considered that it has recovered after several cycles regardless of whether or not it is actually recovered when threshold judgment is performed with the same reference traffic. Will be. For example, when the determination is made based on the comparison with the state two cycles before, the traffic volume is settled at 0, so that it is always assumed that the traffic has recovered after two cycles. That is, when the determination is made based on the comparison with the state before M cycles (M is a natural number), if the traffic volume is settled at 0, it is always assumed that the traffic has recovered after M cycles. The value of M is determined by experience based on past data.
For the above reasons, the recovery from the alarm detection state is determined by processing according to another standard. The processing based on this different standard will be described with reference to FIG.

In the figure, a status acquisition request is periodically transmitted from the storage unit 23 to the monitoring target 10 (step S501). Thereby, the storage unit 23 can acquire the traffic volume of the monitoring target 10 as a state acquisition response, and the traffic volume is stored in the storage unit 23 itself (step S502).
The determination unit 25 transmits the latest data read request to the storage unit 23 (step S503), and acquires the latest traffic amount stored in the storage unit 23 by the latest data read response (step S504).
The reference data holding unit 24 holds the fluctuation rate calculation reference traffic value in the failure state (that is, the alarm detection state) separately from the normal state value. The value of the fluctuation rate calculation reference traffic in the failure state is transmitted to the storage unit 23 by the reference data read response to the reference data read request transmitted from the determination unit 25 (steps S505 and S506).

The determination unit 25 calculates the traffic fluctuation rate based on the value of the fluctuation rate calculation reference traffic in the failure state (step S507). When the calculated traffic fluctuation rate settles to a fluctuation rate lower than the threshold value, the determination unit 25 transmits a state transition request from the failure state to the normal state to the state management unit 22 (step S508). In response to this request, the state management unit 22 updates the state of the corresponding alarm and returns it to the normal state.
In addition, a state change notification is transmitted from the state management unit 22 to the monitoring terminal 30 (step S509).
Through the above processing, it is possible to confirm that the monitoring terminal 30 has recovered from the warning detection state to the normal state.

(Calculation of traffic fluctuation rate)
Here, the function of calculating the traffic fluctuation rate will be described. This function is a function for measuring the traffic fluctuation rate according to the equation (1) for each measurement period at the traffic measurement point where the traffic measurement is set. The traffic fluctuation rate is calculated separately for the transmission byte and the reception byte.
Traffic fluctuation rate [%]
= (Latest traffic [byte] / Fluctuation rate calculation reference traffic [byte]) * 100
... (1)

In equation (1), the fluctuation rate calculation reference traffic is determined as follows. That is,
If the traffic fluctuation rate one cycle before is the value corresponding to the alarm detection status (that is, warning or failure)
Fluctuation rate calculation reference traffic = Fluctuation rate calculation reference traffic used for calculating the traffic fluctuation rate when an alarm occurs. And in cases other than the above,
Fluctuation rate calculation reference traffic = traffic before N cycles (N is a value specified in the fluctuation rate calculation cycle of the setting file). The traffic fluctuation rate is an integer, and the numbers after the decimal point are rounded up.

In addition, when the latest traffic volume data is missing, the traffic fluctuation rate is not calculated. When the fluctuation rate calculation reference traffic amount is missing data or 0 [byte], the past data is traced to determine the fluctuation rate calculation reference traffic amount. The upper limit of tracing back past data is the number of cycles set by the maximum fluctuation rate calculation cycle value in the setting file. And even if the retroactive data for the number of cycles set by the maximum value of the fluctuation rate calculation cycle is acquired, if the fluctuation rate calculation reference traffic is missing data or 0, the traffic fluctuation rate is not calculated.
When a state transition is made from a warning to a severe fault, the fluctuation rate calculation reference traffic uses the traffic at the time of warning detection for the fluctuation rate calculation, and the traffic before N cycles when a severe fault is detected is used for the fluctuation rate calculation. do not use.

(Traffic rate calculation example)
An example of calculating the traffic fluctuation rate is shown below.
FIG. 6 is a diagram illustrating a traffic amount transition example for explaining a calculation example of the traffic fluctuation rate after the alarm is generated. In the figure, the horizontal axis represents time, and the vertical axis represents traffic volume [Kbyte]. This figure shows a case where a decrease in traffic occurs when transitioning from time T3 to time T4, and an alarm is detected at time T4.

Each parameter used in the calculation is as follows. That is,
Fluctuation rate calculation cycle = 2 cycles Fluctuation rate calculation cycle maximum value = 3 cycles. In the figure, when calculating the traffic fluctuation rate at time T4,
Traffic fluctuation rate_time T4 = traffic volume at time T4 / traffic volume at time T2 * 100
It becomes. When calculating the traffic fluctuation rate at time T5,
Traffic fluctuation rate_time T5 = traffic volume at time T5 / traffic volume at time T2 * 100
It becomes. In this case, since the alarm is generated at time T4, the calculation is performed using the fluctuation rate calculation reference traffic volume (that is, the traffic volume at time T2) used in the calculation of time T4.

FIG. 7 is a diagram illustrating a traffic amount transition example for explaining an example of calculating a traffic fluctuation rate when a traffic measurement value is missing. In the figure, the horizontal axis represents time, and the vertical axis represents traffic volume [Kbyte]. In the case of the figure, traffic measurement data is missing from time T2 to time T4.
Each parameter used in the calculation is as follows. That is,
Fluctuation rate calculation cycle = 2 cycles Fluctuation rate calculation cycle maximum value = 3 cycles. In the figure, when calculating the traffic fluctuation rate at time T6,
Traffic fluctuation rate_time T6 = traffic volume at time T6 / traffic volume at time T1 * 100 (2)
It becomes. Here, in Expression (2), the traffic volume at time T1 is used as the fluctuation rate calculation reference traffic volume. In equation (2), the traffic volume at time T4 is originally used as the fluctuation rate calculation reference traffic volume, but the traffic measurement data at time T4 is missing in this example. For this reason, a search is made for an effective traffic amount that does not lack traffic measurement data, going back up to three cycles (in this example, from time T3 to time T1). In this example, since the traffic measurement data at time T3 and time T2 are missing, the traffic measurement data at time T1 is used as the fluctuation rate calculation reference traffic amount. It should be noted that the traffic fluctuation rate is not calculated from time T2 to time T4 because data is missing.

(Example of traffic volume transition)
Further, an example of the traffic amount transition will be described with reference to FIGS.
FIG. 8 is a diagram illustrating an example of a change in traffic volume. In the figure, the traffic volume in one cycle from time T1 to time T2 (hereinafter described as “T1⇒T2”) changes from “9” to “10”. Similarly, the traffic volume of T1⇒T2 is “10” to “1”, the traffic volume of T2 → T3 is “10” to “1”, the traffic volume of T3 → T4 is “1” to “1”, and T4⇒. The traffic volume of T5 changes from “1” to “3”, the traffic volume of T5 → T6 changes from “3” to “8”, and the traffic volume of T6 → T7 changes from “8” to “9”. At time T3, the state changes from the normal state to the alarm generation state, and at time T6, the state changes from the alarm generation state to the normal state.

FIG. 9 is a diagram summarizing the changes in traffic volume as described above. In the figure, the fluctuation rate calculation reference traffic amount is determined as follows. That is,
If the traffic fluctuation rate one cycle before is the value corresponding to the alarm detection state,
Fluctuation rate calculation reference traffic amount = Fluctuation rate calculation reference traffic amount used for calculating the traffic fluctuation rate when an alarm occurs. And in cases other than the above,
Fluctuation rate calculation reference traffic amount = traffic amount before one cycle. The traffic fluctuation rate is an integer, and the numbers after the decimal point are rounded up.

In the case of the figure, the fluctuation rate calculation reference traffic volume of T1⇒T2 is “9” which is the traffic volume at time T1, and the fluctuation rate is 10/9 = 111 [%].
Further, the fluctuation rate calculation reference traffic volume from T2 to T3 is “10” which is the traffic volume at time T2, and the fluctuation rate is 1/10 = 10 [%]. Here, a transition is made from the normal state to the alarm generation state.

  The fluctuation rate calculation reference traffic volume from T3 to T4 is “10”, which is the traffic volume at time T2, and the fluctuation rate is 1/10 = 10 [%]. Similarly, the fluctuation rate calculation reference traffic volume from T4 to T5 is “10” which is the traffic volume at time T2, and the fluctuation rate is 3/10 = 30 [%]. Further, the fluctuation rate calculation reference traffic volume from T5 to T6 is “10” which is the traffic volume at time T2, and the fluctuation rate is 8/10 = 80 [%]. Here, it is considered that the normal state has been recovered. For this reason, the fluctuation rate calculation reference traffic volume of T6⇒T7 is “8” which is the traffic volume at time T6 (that is, the traffic volume of the previous cycle), and the fluctuation rate is 9/8 = 113 [%]. Become.

(Summary)
As described above, in this system, it is possible to detect the state of a device that does not raise an alarm (does not output) despite a failure. For this reason, in the present invention, a configuration is adopted in which the state is detected based on the state in which the traffic volume decreases or becomes zero. Even if the traffic amount once becomes zero, if it is not a failure, it may be recovered spontaneously, and even if it has failed, it may be recovered by automatic reboot (restart). Including this case, according to the present invention, it is possible to detect the state of a device that does not raise an alarm.

  The present invention can be used to detect a failure that cannot raise an alarm.

It is a block diagram which shows the structural example of the monitoring system by embodiment of this invention. It is a sequence diagram which shows the content of the periodic status acquisition process by the storage part in FIG. It is a sequence diagram which shows the content of the calculation process of the traffic fluctuation rate by the determination part in FIG. It is a sequence diagram which shows the content of the process regarding the state transition request transmitted from the determination part in FIG. It is a sequence diagram which shows the content of the process by another reference | standard for determining the recovery from an alarm detection state. It is a figure which shows the example of a traffic amount transition for demonstrating the example of calculation of the traffic fluctuation rate after alert generation. It is a figure which shows the example of a traffic amount transition for demonstrating the example of calculation of the traffic fluctuation rate in case the traffic measurement value is missing. It is a figure which shows the example of transition of traffic amount. It is the figure which summarized the transition of the traffic amount of FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Monitoring object 20 Traffic monitoring system 21 Traffic management part 22 State management part 23 Storage part 24 Reference | standard data holding part 25 Judgment part 30 Monitoring terminal

Claims (1)

A traffic monitoring system that performs monitoring based on a lower threshold set for a traffic volume measurement point, a traffic information acquisition unit that periodically acquires traffic information regarding the traffic volume at the measurement point, and the traffic information acquisition The ratio of the traffic volume at the measurement point to the predetermined reference traffic volume acquired by the means
A traffic fluctuation rate calculating means for calculating a traffic fluctuation rate, and the traffic
Look including a determining means regarded as a warning generation condition for the measurement point when the traffic variation rate calculated by the change rate calculating means is lower than the lower threshold, the alarm-like
In the state considered to be the state, the traffic fluctuation rate calculating means
Traffic fluctuations with the traffic volume before the occurrence of a report as the reference traffic volume
The traffic fluctuation rate calculated by the traffic fluctuation rate calculation means is
The traffic monitoring system according to claim 1 , wherein the determination means considers that the alarm has been recovered from the alarm occurrence state when the lower limit threshold is exceeded .

Images