JP4857300B2 - Monitoring device, monitoring system and monitoring program - Google Patents

Description

  The present invention relates to a monitoring device, a monitoring system, and a monitoring program for monitoring a system including a server and a terminal device that exchange signaling messages.

  2. Description of the Related Art In recent years, VoIP (Voice over Internet Protocol) services using IP (Internet Protocol) have been actively provided in communication carrier networks by replacing telephone services provided by exchanges. In the VoIP service, a communication carrier manages a call from a user and an incoming call to the user using a protocol called SIP (Session Initiation Protocol) (see Non-Patent Document 1). Since the SIP server plays an important role in providing the VoIP service, it is very important to confirm the normality of the SIP server and the normality of SIP signaling propagation. Yes.

  With regard to failure monitoring of SIP servers that are distributed over a wide area on a network that develops VoIP services such as communication carriers, the loss of signaling messages due to SIP server failures or network failures on intermediate paths is detected, and the SIP server operator is detected. Operation support technology that raises alerts is known. With this technology, an operator of a SIP server can detect a loss of a signaling message due to a SIP server failure or a network failure on the network.

  As a system for detecting the loss of signaling messages due to SIP server failures or network failures, the sequence and normality between each SIP server can be detected by capturing all signaling message packets flowing into and out of the SIP server. A tool system for confirmation is known (for example, see Non-Patent Document 2).

Note that many SIP signaling messages may be lost due to a physical network failure. In a system such as that shown in Non-Patent Document 2, events that occur when a signaling message between a plurality of bases is lost due to a failure of a certain physical network cannot be collectively presented to the administrator. In order to grasp the relationship between a physical network failure and a signaling message loss, it is necessary to separately use a system related to another physical network.
RFC3261 “SIP: Session Initiation Protocol”. [Online]. [Retrieved on 2008-02-28]. Retrieved from Internet: <URL: http://www.faqs.org/rfcs/rfc3261.html> NetCall Monitor. [Online]. Softfront. [Retrieved on 2008-02-28]. Retrieved from Internet: <URL: http://www.softfront.co.jp/products/applience/netcall/netcall_monitor.html>

  In a system such as that shown in Non-Patent Document 2, it is necessary to capture all of the signaling messages. When the number of signaling messages has increased or the number of SIP servers has increased, a large capacity is required at many sites. There is a problem in that it is necessary to acquire and analyze data, which increases the monitoring load.

  The present invention has been made in order to solve the above-described problems. Signaling messages can be transmitted without acquiring and analyzing a large amount of data (all signaling messages exchanged between servers and between a server and a terminal device). It is an object of the present invention to provide a monitoring device, a monitoring system, and a monitoring program capable of monitoring a system including a server and a terminal device that communicate with each other.

  The present invention relates to a monitoring device for monitoring a communication state of a system composed of a server and a terminal device that exchange signaling messages, between monitoring information including the number of messages transmitted and received by the server, and between devices included in the system And a route between the server and the server and the terminal device based on the number of transmissions and receptions of the message included in the monitoring information A determination unit that determines whether or not a failure has occurred in a route between the plurality of routes and determines the route in which the failure has occurred based on the determination result of the plurality of routes and the route information. It is the monitoring apparatus characterized by this.

  Further, the present invention provides a monitoring system for monitoring a communication state of a system composed of a server and a terminal device that exchange signaling messages, and an acquisition device storage unit that stores the number of messages transmitted and received by the server as monitoring information; A message number acquisition device comprising: a transmission unit that transmits the monitoring information stored in the acquisition device storage unit; a reception unit that receives the monitoring information transmitted from the message number acquisition device; and the reception unit that receives the message. Based on the monitoring information, a storage unit that stores route information of a network that connects devices included in the system, and the number of transmissions and receptions of the messages included in the monitoring information, It is determined whether a failure has occurred in a route between servers and a route between the server and the terminal device, and a plurality of the routes And the determination result, based on said route information, a monitoring system characterized by comprising a determination unit that determines the path failure has occurred, the monitoring apparatus having a a.

  The present invention also provides a monitoring program for causing a computer to function as a monitoring device for monitoring a communication state of a system including a server and a terminal device that exchange signaling messages, including the number of messages transmitted and received by the server. Based on the storage unit that stores the monitoring information, the route information of the network connecting the devices included in the system, and the number of transmissions and receptions of the messages included in the monitoring information Whether or not a failure has occurred in the route between the server and the terminal device, and the route in which the failure has occurred based on the determination result of the plurality of routes and the route information And a monitoring program for causing the computer to function as a determination unit.

  According to the present invention, it is possible to monitor a system including a server and a terminal device that exchange signaling messages without acquiring and analyzing a large amount of data.

  Hereinafter, an embodiment of the present invention will be described. FIG. 1 is a diagram showing a logical configuration of a network in the present embodiment. In the illustrated example, the logical configuration of the network includes SIP servers S1 to S4, user terminals U1 to U4 (SIP clients), and the monitoring device 1. The SIP servers S1 to S4 are devices that control outgoing calls from the user terminals U1 to U4 and incoming calls to the user terminals U1 to U4. In the present embodiment, the SIP servers S1 to S4 store the number of SIP signaling messages transmitted / received / retransmitted / rereceived in the storage unit included in the SIP servers S1 to S4.

  Note that a separate message number acquisition device is provided for acquiring the number of SIP signaling messages transmitted / received / retransmitted / rereceived by the SIP servers S1 to S4, and the SIP servers S1 to S4 transmitted / received / retransmitted / rereceived. The number of SIP signaling messages may be acquired by the message number acquisition device. The user terminals U1 to U4 are devices that make calls to other user terminals U1 to U4 and communicate with each other after being connected by the SIP servers S1 to S4. For example, the user terminals U1 to U4 are telephones. The monitoring device 1 is a device that monitors the SIP servers S1 to S4.

  In the illustrated example, the network includes four SIP servers S1 to S4, which are connected so as to communicate with the other three SIP servers S1 to S4. The SIP server S1 is connected to the user terminal U1, the SIP server S2 is connected to the user terminal U2, the SIP server S3 is connected to the user terminal U3, and the SIP server S4 is connected to the user terminal U4. Has been. Moreover, the monitoring apparatus 1 is connected so that it can communicate with each SIP server S1-S4.

  FIG. 2 is a diagram showing a physical configuration of the network in the present embodiment. In the illustrated example, the physical configuration of the network includes physical networks A1, A2, B1, B2, R1, and R2, SIP servers S1 to S4, and user terminals U1 to U4. The physical networks A1, A2, B1, B2, R1, and R2 can communicate with other connected physical networks A1, A2, B1, B2, R1, and R2. The SIP servers S1 to S4 and the user terminals U1 to U4 are the same as in FIG.

  The physical network B1 is connected to the physical networks B2, R1, R2, A1. The physical network B2 is connected to the physical networks B1, R3, R4, A2. The SIP server S1 is connected to the physical network R1. The SIP server S2 is connected to the physical network R2. The SIP server S3 is connected to the physical network R3. The SIP server S4 is connected to the physical network R4. The user terminal U1 and the user terminal U2 are connected to the physical network A1. The user terminal U3 and the user terminal U4 are connected to the physical network A2. The monitoring device 1 stores the connection state in advance in its own storage unit 33 described later.

  With the above connection, the SIP servers S1 to S4 and the user terminals U1 to U4 communicate with the other SIP servers S1 to S4 and the user terminals U1 to U4 via the physical networks A1, A2, B1, B2, R1, and R2. It can be performed. For example, the SIP server S1 and the SIP server S2 can communicate with each other via the physical networks R1, B1, and R2.

  FIG. 3 is a configuration diagram showing the configuration of the monitoring device 1 in the present embodiment. In the illustrated example, the monitoring device 1 includes a communication unit 31, a control unit 32, and a storage unit 33. The communication unit 31 receives monitoring information from the SIP servers S1 to S4. The monitoring information is the number of “SIP signaling messages” transmitted and received by the SIP servers S1 to S4 and the number of “SIP signaling messages” retransmitted and retransmitted by the SIP servers S1 to S4. The control unit 32 controls the monitoring device 1. The storage unit 33 stores information used by the monitoring device 1.

  Next, SIP signaling messages transmitted and received by the SIP servers S1 to S4 will be described. FIG. 4 is a sequence diagram showing the transmission order of SIP signaling messages when the SIP server S1 and the SIP server S2 perform SIP control in the present embodiment. Further, as described above, the user terminal U1 is connected to the SIP server S1, and the user terminal U2 is connected to the SIP server S2.

(Step S401) The user terminal U1 transmits an “INVITE” message to the SIP server S1.
(Step S402) The SIP server S1 that has received the “INVITE” message transmits an “AUTH” message to the user terminal U1.
(Step S403) Upon receiving the “AUTH” message, the user terminal U1 transmits an “ACK” message to the SIP server S1.
Note that the sequence from step S401 to step S403 is a type A sequence.

(Step S404) Upon receiving the “AUTH” message, the user terminal U1 transmits an “INVITE” message to the SIP server S1.
(Step S405) Upon receiving the “INVITE” message, the SIP server S1 transmits an “INVITE” message to the SIP server S2.
(Step S406) The SIP server S1, which has received the “INVITE” message, transmits a “Trying” message to the user terminal U1.

(Step S407) The SIP server S2, which has received the “INVITE” message, transmits an “INVITE” message to the user terminal U2.
(Step S408) Upon receiving the “INVITE” message, the SIP server S2 transmits a “Trying” message to the SIP server S1.
(Step S409) The user terminal U2 that has received the “INVITE” message transmits a “Trying” message to the SIP server S2.

(Step S410) The user terminal U2 that has received the “INVITE” message transmits a “Ringing” message to the SIP server S2.
(Step S411) The SIP server S2 that has received the “Ringing” message transmits a “Ringing” message to the SIP server S1.
(Step S412) The SIP server S1 that has received the “Ringing” message transmits the “Ringing” message to the user terminal U1.
Note that the sequence from step S404 to step S412 is a type B2 sequence.

(Step S413) Upon receiving the “Ringing” message, the user terminal U1 transmits a “PRACK” message to the SIP server S1.
(Step S414) The SIP server S1 that has received the “PRACK” message transmits a “PRACK” message to the SIP server S2.
(Step S415) The SIP server S2 that has received the “PRACK” message transmits a “PRACK” message to the user terminal U2.
Note that the sequence from step S410 to step S415 is a type C2 sequence.

(Step S416) The user terminal U1 transmits a “200 OK” message to the SIP server S1.
(Step S417) The SIP server S1, which has received the “200 OK” message, transmits the “200 OK” message to the SIP server S2.
(Step S418) The SIP server S2 that has received the “200 OK” message transmits the “200 OK” message to the user terminal U2.

(Step S419) Upon receiving the “200 OK” message, the user terminal U2 transmits an “ACK” message to the SIP server S2.
(Step S420) The SIP server S2 that has received the “ACK” message transmits an “ACK” message to the SIP server S1.
(Step S421) The SIP server S1, which has received the “ACK” message, transmits an “ACK” message to the user terminal U1.
Note that the sequence from step S416 to step S421 is a type C2 sequence.

  In steps S416 to S421, a “BYE” message may be used instead of a “200 OK” message, and a “200 OK” message may be used instead of an “ACK” message. In steps S416 to S421, the sequence starts from the user terminal U1, but the sequence may start from the user terminal U2.

  Next, a monitoring method for the SIP servers S1 to S4 in this embodiment will be described. The monitoring method in this embodiment includes three detection methods: detection of a server failure, detection of a failure on the “user side” and “non-user side”, and detection of a logical failure between servers. Note that each of the SIP servers S1 to S4 transmits monitoring information to the monitoring device 1 before the monitoring device 1 performs each detection method. In addition, the communication unit 31 of the monitoring device 1 receives the monitoring information transmitted from the SIP servers S1 to S4, and the control unit 32 stores the received monitoring information in the storage unit 33.

  As described above, a message number acquisition device may be provided separately. In this case, before the monitoring apparatus 1 performs each detection method, the message number acquisition apparatus transmits monitoring information to the monitoring apparatus 1. Further, the communication unit 31 of the monitoring device 1 receives the monitoring information transmitted from the message number acquisition device, and the control unit 32 stores the received monitoring information in the storage unit 33.

  The definitions of “user side” and “non-user side” will be described with reference to FIG. The definitions of “user side” and “non-user side” are defined according to the SIP servers S1 to S4 to be focused (monitored). In the illustrated example, SIP servers S1 and S2 and user terminals U1 and U2 are included. The SIP server S1 and the user terminal U1 are connected. Further, the SIP server S2 and the user terminal U2 are connected. Further, the SIP server S1 and the SIP server S2 are connected.

  In the illustrated example, the SIP server S1 is the target of attention. Note that the SIP server S2 that is not the target of attention is defined as a non-target server. A failure on the user terminal U1 side connected to the target SIP server S1 is defined as a “user side failure”. Further, a failure on the side of the SIP server S2 connected to the target SIP server S1 is defined as a “non-user side failure”.

(Detect server failure)
Detection of a server failure in the present embodiment is performed based on the number of transmissions and receptions of SIP signaling messages measured for each of the SIP servers S1 to S4. The SIP signaling messages used for detecting a server failure are “PRACK”, “200 OK”, “BYE”, “ACK”, and “AUTH” shown in FIG.

  When the SIP servers S1 to S4 are operating normally, when the SIP servers S1 to S4 receive a signaling message from another device, the SIP servers S1 to S4 transmit a signaling message corresponding to the received signaling message to the other device. That is, when no failure has occurred in the SIP servers S1 to S4, the number of signaling messages transmitted by the SIP servers S1 to S4 is the same as the number of received signaling messages.

  When a failure occurs in the SIP servers S1 to S4, the SIP servers S1 to S4 do not transmit a signaling message corresponding to the received signaling message to the other device even when receiving the signaling message from the other device. Or, although the signaling message is not received, the SIP servers S1 to S4 transmit the signaling message to other devices. That is, when a failure occurs in the SIP servers S1 to S4, the number of signaling messages transmitted by the SIP servers S1 to S4 is different from the number of received signaling messages.

Hereinafter, a failure detection method in the SIP servers S1 to S4 will be described.
(Step S11) The communication unit 31 of the monitoring device 1 receives monitoring information from the SIP servers S1 to S4. Thereafter, the process proceeds to step S12. The monitoring information is the number of “PRACK”, “200 OK”, “BYE”, “ACK”, and “AUTH” messages transmitted and transmitted by the SIP servers S1 to S4.

  (Step S12) Based on the monitoring information received by the communication unit 31, the control unit 32 calculates the sum of the number of “PRACK”, “200 OK”, “BYE”, “ACK”, and “AUTH” messages transmitted from the SIP servers S1 to S4. calculate. Further, the control unit 32 calculates the sum of the number of “PRACK”, “200 OK”, “BYE”, “ACK”, and “AUTH” messages received by the SIP servers S1 to S4 based on the monitoring information received by the communication unit 31. . Thereafter, the process proceeds to step S13.

(Step S13) The control unit 32 calculates the absolute value of the difference between the calculated sum of transmission messages and the sum of reception messages. Thereafter, the process proceeds to step S14.
(Step S14) The control unit 32 compares a predetermined threshold value with the value calculated in step S13. If the value calculated in step S13 is larger than the predetermined threshold value, the control unit 32 determines that a failure has occurred in the SIP servers S1 to S4.

The server failure determination method described in steps S11 to S14 is expressed as follows. E is a threshold value. When the following expression is satisfied (when the threshold value E is exceeded), it is determined that a failure has occurred in the SIP servers S1 to S4.
E <| (total number of messages received by SIP servers S1-S4) − (total number of messages transmitted by SIP servers S1-S4) |

  Note that the system user sets the threshold value E. In addition, the system user determines the threshold E based on the error due to the timing of counting the signaling message.

  As described above, the failure occurrence of the SIP servers S1 to S4 can be determined based on the monitoring information received from the SIP servers S1 to S4.

(Fault detection on the "user side" and "non-user side")
The failure detection on the “user side” and “non-user side” in the present embodiment is performed based on the number of retransmissions and the number of re-receptions of SIP signaling messages measured for each of the SIP servers S1 to S4. SIP signaling messages exchanged between the SIP servers S1 to S4 have a relationship between a request and a corresponding response. For example, in the example shown in FIG. 4, when a RINGING message is received, a PRACK message is transmitted.

  In this embodiment, paying attention to the relationship between reception and transmission of a SIP signaling message, as shown in FIG. 4, when two SIP servers S1 to S4 perform SIP control, the type of the sequence of the SIP signaling message is typed. A, type B2, and type C2 are classified.

  A method for detecting a failure on the “user side” and “non-user side” according to the sequence type will be described below. The definitions of “user side” and “non-user side” are the same as the definitions described with reference to FIG.

  (Step S21) The communication unit 31 of the monitoring device 1 receives monitoring information from the SIP servers S1 to S4. Thereafter, the process proceeds to step S22. The monitoring information includes the number of received messages, the number of re-received messages, the number of transmitted messages, and the number of re-transmitted messages for “AUTH”, “RINGING”, “PRACK”, and “ACK” messages.

  Note that the SIP servers S1 to S4 are connected to the user terminals U1 to U4 (all user terminals U1 to U1 connected to the SIP servers S1 to S4) with regard to the number of received SIP signaling messages, the number of re-receptions, the number of transmissions, and the number of retransmissions. The number of transmission / reception and re-transmission / reception with respect to U4) and the number of transmission / reception and re-transmission / reception with respect to other SIP servers S1 to S4 are distinguished and counted.

  Here, a case where a plurality of non-target servers are connected to the target server, that is, a case where a plurality of SIP servers S1 to S4 are connected to the non-user side will be described. When determining a failure for each non-target server, the number of SIP signaling messages transmitted by the target server for each non-target server, the number received, the number retransmitted, and the number received again are counted (counting method 1). When it is determined that a failure has occurred on any of the non-user side, the number of SIP signaling messages sent to all non-target servers by the target server, the number received, the number retransmitted, and the number received again Is counted (counting method 2). In this embodiment, the counting method 2 is used.

(Step S <b> 22) The control unit 32 determines a failure based on the monitoring information received by the communication unit 31. The determination method is as follows.
When the “Auth” message is retransmitted to the user side, it is determined that there is a failure on the user side. (SIP signaling message sequence type is type A)
When the “RINGING” message is retransmitted to the user side, it is determined that there is a failure on the user side. (SIP signaling message sequence type is type B)

If the “PRACK” message or “ACK” message is retransmitted to the user side, it is determined that there is a failure on the user side. (SIP signaling message sequence type is type C2)
-When the "PRACK" message or the "ACK" message is re-received from the user side, it is determined that there is a failure on the non-user side. (SIP signaling message sequence type is type C2)

  Hereinafter, as an example, the basis for failure determination when the sequence type of the SIP signaling message is type A and type B2 will be described.

(Type A)
FIG. 6 is a sequence diagram showing the transmission order of messages when the SIP signaling message sequence type in this embodiment is type A and messages are normally transmitted and received. In the illustrated example, messages are transmitted and received between the user terminal U1 and the SIP server S1 in the following procedure.

(Step S601) The user terminal U1 transmits an “INVITE” message to the SIP server S1.
(Step S602) Upon receiving the “INVITE” message, the SIP server S1 transmits an “AUTH” message to the user terminal U1.
(Step S603) Upon receiving the “AUTH” message, the user terminal U1 transmits an “ACK” message to the SIP server S1.

  Next, a case where the SIP signaling message sequence type is type A and the “AUTH” message is lost will be described. FIG. 7 is a sequence diagram showing the transmission order of messages when the SIP signaling message sequence type in this embodiment is type A and the “AUTH” message is lost. In the illustrated example, messages are transmitted and received between the user terminal U1 and the SIP server S1 in the following procedure.

(Step S701) The user terminal U1 transmits an “INVITE” message to the SIP server S1.
(Step S702) The SIP server S1 that has received the “INVITE” message transmits an “AUTH” message to the user terminal U1. However, the transmitted “AUTH” message does not reach the user terminal U1.
(Step S703) Since the “ACK” message that is the reply message of the “INVITE” message transmitted in Step S702 does not arrive, the SIP server S1 retransmits the “AUTH” message to the user terminal U1.
(Step S704) The user terminal U1 that has received the “AUTH” message transmits an “ACK” message to the SIP server S1.

  As described above, when the “AUTH” message transmitted by the SIP server S1 in step S702 does not reach the user terminal U1, the SIP server S1 transmits again to the “AUTH” message user terminal U1. As a result, when a failure occurs in the network between the user terminal U1 and the SIP server S1, and the “AUTH” message does not reach the user terminal U1, the SIP server S1 transmits the “AUTH” message again. . Therefore, when the SIP server S1 retransmits the “AUTH” message, the monitoring device 1 determines that a failure has occurred in the network (user side network) between the user terminal U1 and the SIP server S1.

  Next, a case where the sequence type of the SIP signaling message is type A and the “ACK” message is lost will be described. FIG. 8 is a sequence diagram showing the transmission order of messages when the SIP signaling message sequence type in this embodiment is type A and the “ACK” message is lost. In the illustrated example, messages are transmitted and received between the user terminal U1 and the SIP server S1 in the following procedure.

(Step S801) The user terminal U1 transmits an “INVITE” message to the SIP server S1.
(Step S802) Upon receiving the “INVITE” message, the SIP server S1 transmits an “AUTH” message to the user terminal U1.
(Step S803) Upon receiving the “AUTH” message, the user terminal U1 transmits an “ACK” message to the SIP server S1. However, the transmitted “ACK” message does not reach the SIP server S1.

(Step S804) Since the “ACK” message that is the response message of the “INVITE” message transmitted in Step S802 does not arrive, the SIP server S1 retransmits the “AUTH” message to the user terminal U1.
(Step S805) Upon receiving the “AUTH” message, the user terminal U1 transmits an “ACK” message to the SIP server S1.

  As described above, when the “ACK” message transmitted from the user terminal U1 in step S803 does not reach the SIP server S1, the SIP server S1 transmits again to the “AUTH” message user terminal U1. As a result, when a failure has occurred in the network between the user terminal U1 and the SIP server S1 and the “ACK” message has not arrived at the SIP server S1, the SIP server S1 transmits the “AUTH” message again. . Therefore, when the SIP server S1 retransmits the “AUTH” message, the monitoring device 1 determines that a failure has occurred in the network (user side network) between the user terminal U1 and the SIP server S1.

(In the case of type B2)
FIG. 9 is a sequence diagram showing the transmission order of messages when the SIP signaling message sequence type in this embodiment is type B2 and messages are normally transmitted and received. In the illustrated example, messages are transmitted and received between the user terminals U1 and U2 and the SIP servers S1 and S2 in the following procedure.

(Step S901) The user terminal U1 transmits an “INVITE” message to the SIP server S1.
(Step S902) Upon receiving the “INVITE” message, the SIP server S1 transmits an “INVITE” message to the SIP server S2.
(Step S903) The SIP server S1 that has received the “INVITE” message transmits a “Trying” message to the user terminal U1.

(Step S904) Upon receiving the “INVITE” message, the SIP server S2 transmits an “INVITE” message to the user terminal U2.
(Step S905) The SIP server S2, which has received the “INVITE” message, transmits a “Trying” message to the SIP server S1.
(Step S906) The user terminal U2 that has received the “INVITE” message transmits a “Trying” message to the SIP server S2.

(Step S907) The user terminal U2 that has received the “INVITE” message transmits a “Ringing” message to the SIP server S2.
(Step S908) The SIP server S2 that has received the “Ringing” message transmits a “Ringing” message to the SIP server S1.
(Step S909) The SIP server S1, which has received the “Ringing” message, transmits a “Ringing” message to the user terminal U1.

  As described above, when a message is normally transmitted and received, the message is not retransmitted. However, in Type B2, when any message is lost (packet loss), the SIP server S1 always retransmits either “INVITE” or “RINGING” to the user terminal U1 (user side). . Here, since it is difficult to count the “INVITE” message separately from the “INVITE” message of type A, in this embodiment, focusing on the “RINGING” message, the monitoring device 1 uses the SIP server S1. Retransmits the “RINGING” message to the user terminal U1, it is determined that a failure has occurred in the network (network on the user side) between the SIP server S1 and the user terminal U1.

(Detection of logical failure between SIP servers)
A method for detecting a failure of a logical link between servers will be described below. In the present embodiment, the failure of the inter-server logical link in the network composed of the four SIP servers S1 to S4 shown in FIG. 1 is detected.

  The detection of a logical failure between SIP servers (failure of a logical link between servers) in this embodiment is performed based on the monitoring information counted using the counting method 2 described above, and the “user side” “non-user side” failure. Based on the result obtained by detection. Thereby, the monitoring apparatus 1 can determine whether a failure has occurred on either the target server side or the non-user side.

  (Step S <b> 31) When the target server is the SIP server S <b> 1 to S <b> 4, the control unit 32 of the monitoring device 1 acquires the respective “user side” and “non-user side” failure detection results and stores them in the storage unit 33. Thereafter, the process proceeds to step S32.

  FIG. 10 is a diagram showing a “user side” “non-user side” failure detection result in the present embodiment. In the illustrated example, the “user side” and “non-user side” failure detection results are shown in a matrix format. The row indicates the name of the server of interest, and the column indicates the name of the non-target server. Note that the definitions of the target server and the non-target server are the same as those described with reference to FIG. If there is a possibility that there is a failure on the “non-user side” between the target server and the non-target server, the value is “?”. The value is set to “1” in the case of a failure on the “user side” between the target server and the non-target server. In addition, when no failure occurs between the target server and the non-target server, the value is set to “0”. Further, when the target server and the non-target server are the same, the failure detection result of the server itself is shown. If the SIP server itself has a fault, the value is “1”, and if no fault has occurred, the value is “0”.

  In the example shown in the figure, the value of the row is S1 and the value of the column is S2 is “?”. This indicates that there may be a failure on the “non-user side” between the target server S1 and the non-target server S2. Further, the value of the row is S2, and the value of the column is S1 is “0”. This indicates that no failure has occurred between the target server S2 and the non-target server S1. The value of the row is S1 and the value of the column is S1 is “0”. This indicates that no failure has occurred in the SIP server S1. The value of the row value is S2 and the value of the column is S2 is “1”. This indicates that a failure has occurred in the SIP server S2. Other values are as illustrated.

  (Step S32) The control unit 32 of the monitoring device 1 is the same when the target server and the non-target server are switched based on the “user side” and “non-user side” failure detection results stored in the storage unit 33 in step S31. The network information between the paired SIP servers is updated. In the example shown in the figure, items on a symmetric matrix (for example, a combination of row S1, column S2 and row S2, column S1) are updated.

  In updating, when one value is “0” and the other value is “?”, Both values are set to “0”. If both values are “0”, it is set to “0” as it is. If both are “?”, It is left as “?”. This is because the network state between the two devices is the same regardless of the direction of communication. In addition, since one value cannot be “0” and the other value is “1”, in this case, the user is notified that there is a problem with the algorithm itself.

  Specifically, in the example of FIG. 10, there may be a failure on the “non-user side” between the target server S1 and the non-target server S2, and a failure occurs between the target server S2 and the non-target server S1. Not. In this case, the control unit 32 determines that no failure has occurred in the logical link between the SIP server S1 and the SIP server S2. Therefore, the control unit 32 updates the value of the row value S1 and the column value S2 to “0”. The other values are updated in the same manner. The updated “user side” and “non-user side” failure detection results are as shown in FIG.

  In the example shown in the figure, the value of the row is S1 and the value of the column S2 is updated to “0”, the value of the row is S3 and the value of the column is S2 is updated to “0”. The value of the row value S4 and the column value S2 is updated to “0”.

  (Step S33) The control unit 32 of the monitoring device 1 identifies the value of “?” Based on the “user side” and “non-user side” failure detection results updated in step S32. If there is only one “?” In each row or column, the “?” Is updated to “1”. Thereafter, the process proceeds to step S34. In the example of FIG. 11, since there is no row or column in which only one “?” Exists, no update is performed.

  (Step S34) The control unit 32 of the monitoring device 1 determines the logic between the devices based on the “user side” and “non-user side” failure detection results updated in step S33 and the physical link information stored in advance. The network failure information and the path information of the physical link between the devices are stored together in the storage unit 33. Thereafter, the process proceeds to step S35.

  FIG. 12 is a table showing the failure information of the logical network between the devices and the path information of the physical link between the devices in this embodiment in a table format. In the illustrated example, the failure information of the logical network between the devices and the path information of the physical link between the devices are shown in association with each other.

  In the first line, “S1-S3 (?)” Is associated with “S1-R1, R1-B1, B1-B2, B2-R3, R3-S3”. This is because there is a possibility that there is a failure in the logical network between the SIP server S1 and the SIP server S3, and that the SIP server S1 and the SIP server S3 are connected via R1-B1-B2-R3. Show.

  In the second row, “S1-S2 (1)” and “S1-R1, R1-B1, B1-R2, R2-S2” are stored in association with each other. This indicates that there is no failure in the logical network between the SIP server S1 and the SIP server S2, and the SIP server S1 and the SIP server S2 are connected via R1-B1-R2. The other rows are as illustrated.

  (Step S35) The control unit 32 of the monitoring device 1 is normal based on the failure information of the logical network between the devices and the path information of the physical link between the devices stored in the storage unit 33 in Step S34. Determine physical nodes and physical links. afterwards. Proceed to step S36. Specifically, it is determined that no failure has occurred in the physical node and the physical link that constitute the logical network without the loss of the SIP signaling message.

  In the example shown in FIG. 12, it can be seen from the value in the second row that there is no loss of the SIP signaling message in the logical network between the SIP server S1 and the SIP server S2. Further, since the physical link between the SIP server S1 and the SIP server S2 is “S1-R1, R1-B1, B1-R2, R2-S2”, the physical node “R1, B1, R2” has a failure. It can be determined that no failure has occurred, and no failure has occurred in the physical links “S1-R1, R1-B1, B1-R2, R2-S2”.

  From the diagram shown in FIG. 12, the normal physical nodes are “A1, A2, B1, B2, R1, R2, R3”, and the normal physical links are “S1-R1, R1-B1, B1-R2, R2”. -S2, B1-B2, B2-R3, R3-S3, R3-S4, B1-A1, A1-U1, S3-R3, R3-B2, B2-A2, A2-U3, B2-A2, A2-U4 Is.

  (Step S36) Based on the normal physical node and physical link determined in Step S35, the control unit 32 of the monitoring device 1 includes the path information of the physical links between the devices stored in the storage unit in Step S34. Delete route information that has not failed. Thereby, it is possible to determine a physical link in which a failure has occurred. Thereafter, the process proceeds to step S37.

  FIG. 13 is a diagram showing, in a table format, information obtained by deleting path information in which no failure has occurred among path information of physical links between devices in the present embodiment. In the illustrated example, route information other than A1-U2 associated with the S2-U2 (1) row of the eighth row is deleted. Thereby, it is understood that the physical link in which the failure has occurred is A1-U2.

  (Step S37) The control unit 32 of the monitoring device 1 determines the failure between the devices among the information stored in the storage unit 33 in Step S36 based on the information of the physical link in which the failure has been determined in Step S36. Update information. Thereby, it is possible to determine a logical network in which a failure has occurred among the logical networks between the devices. Thereafter, the process ends.

  FIG. 14 is a table showing the failure information of the logical network between the devices and the path information of the physical link between the devices in the present embodiment in a table format. In the illustrated example, the failure information of the logical network between the SIP server S1 and the SIP server S3 is updated to “0”, and the failure information of the logical network between the SIP server S1 and the SIP server S4 is “0”. The fault information of the logical network between the SIP server S3 and the SIP server S4 is updated to “0”. In other words, if the physical node, link, and SIP server are normal with respect to the logical network failure determination with “?”, The logical failure determination result is changed from “?” To “0”.

  As described above, according to the present embodiment, the SIP server can be monitored without acquiring and analyzing a large amount of data. Further, the physical network in which a failure has occurred is identified based on the physical network configuration information stored in advance and the result obtained by detecting the “user side” and “non-user side” failures monitored by the monitoring device 1. be able to.

  Further, in the present embodiment, the physical network cannot be detected until a detailed physical network failure is detected, but the correlation between the physical network failure and the SIP signaling message loss is determined based on the SIP server information. Can be presented to the administrator.

  Note that the whole or a part of the functions of the monitoring device in the above-described embodiment is recorded on a computer-readable recording medium, and the program recorded on the recording medium is stored in a computer system. It may be realized by reading and executing. Here, the “computer system” includes an OS and hardware such as peripheral devices.

  The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Further, the “computer-readable recording medium” dynamically holds a program for a short time, like a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line. It is also possible to include those that hold a program for a certain time, such as a volatile memory inside a computer system serving as a server or client in that case. The program may be a program for realizing a part of the functions described above, and may be a program capable of realizing the functions described above in combination with a program already recorded in a computer system.

  Although the embodiment of the present invention has been described in detail with reference to the drawings, the specific configuration is not limited to this embodiment, and includes a design and the like within a scope not departing from the gist of the present invention.

  For example, in the present embodiment, the SIP system using the SIP protocol has been described as an example. However, in a system for exchanging other signaling messages in which a message exchange procedure is determined between the nodes regardless of the SIP protocol. The present invention can also be applied.

It is the figure which showed the structure of the network provided with the SIP server in one Embodiment of this invention. It is the figure which showed the physical structure of the network in this embodiment. It is the block diagram which showed the structure of the monitoring apparatus in this embodiment. It is the sequence diagram which showed the transmission order of the SIP signaling message in this embodiment. It is the figure which showed the connection state of the SIP server and user terminal in this embodiment. It is the sequence diagram which showed the transmission order of the SIP signaling message in this embodiment. It is the sequence diagram which showed the transmission order of the SIP signaling message in this embodiment. It is the sequence diagram which showed the transmission order of the SIP signaling message in this embodiment. It is the sequence diagram which showed the transmission order of the SIP signaling message in this embodiment. It is the figure which showed the "user side" "non-user side" failure detection result in this embodiment. It is the figure which showed the "user side" "non-user side" failure detection result in this embodiment. It is the figure which showed the failure information of the logical network between each apparatus in this embodiment, and the path | route information of the physical link between each apparatus in tabular form. It is the figure which showed the failure information of the logical network between each apparatus in this embodiment, and the path | route information of the physical link between each apparatus in tabular form. It is the figure which showed the failure information of the logical network between each apparatus in this embodiment, and the path | route information of the physical link between each apparatus in tabular form.

Explanation of symbols

S1 to S4 ... SIP server, U1 to U4 ... user terminal, 1 ... monitoring device, 31 ... communication unit, 32 ... control unit, 33 ... storage unit

Claims (3)

In a monitoring device that monitors the communication state of a system consisting of a server and a terminal device that exchange signaling messages,
A storage unit for storing monitoring information including the number of messages transmitted and received by the server, and route information of a network connecting devices included in the system;
Based on the number of transmissions and receptions of the messages included in the monitoring information, it is determined whether or not a failure has occurred in the path between the servers and the path between the server and the terminal device. A determination unit for determining the route in which a failure has occurred based on the determination result of the route and the route information;
A monitoring device comprising: In a monitoring system for monitoring a communication state of a system including a server and a terminal device that exchange signaling messages,
A message number acquisition device comprising: an acquisition device storage unit that stores the number of messages transmitted and received by the server as monitoring information; and a transmission unit that transmits the monitoring information stored in the acquisition device storage unit;
A receiving unit that receives the monitoring information transmitted from the message number acquisition device, a storage unit that stores the monitoring information received by the receiving unit, and route information of a network connecting devices included in the system And determining whether a failure has occurred in the route between the servers and the route between the server and the terminal device based on the number of transmissions and receptions of the messages included in the monitoring information. A monitoring unit comprising: a determination unit that determines the path in which a failure has occurred based on the determination results of the plurality of paths and the path information;
A monitoring system characterized by comprising: In a monitoring program for causing a computer to function as a monitoring device that monitors a communication state of a system including a server and a terminal device that exchange signaling messages,
A storage unit for storing monitoring information including the number of messages transmitted and received by the server, and route information of a network connecting devices included in the system;
Based on the number of transmissions and receptions of the messages included in the monitoring information, it is determined whether or not a failure has occurred in the path between the servers and the path between the server and the terminal device. A determination unit for determining the route in which a failure has occurred based on the determination result of the route and the route information;
As a monitoring program to make the computer function.

Images