JP4867908B2 - Monitoring system, network monitoring apparatus, and service execution environment monitoring method - Google Patents

Description

  The present invention relates to a monitoring system, a network monitoring apparatus, and a service execution environment monitoring method for monitoring operation conditions of an apparatus that executes an application, and in particular, a monitoring system, a network monitoring apparatus, and a service execution environment that can perform monitoring settings according to an actual environment. It relates to the monitoring method.

  For operational monitoring products, a major issue is how to properly rotate the autonomous loop of monitoring, analysis, and handling.

  Among them, there is no method to verify the correctness of the analysis results, and it is required that the analysis results become appropriate by continuing operation, that is, the monitoring settings are automatically optimized. ing.

  For this purpose, it is necessary for the system itself to evaluate whether or not the monitoring setting is appropriately made and to prompt the administrator to make a change or to automatically correct the monitoring setting.

  However, in order for the system itself to evaluate whether or not the monitoring settings are properly set, the system determines whether a real failure has occurred or whether the monitoring settings are not set properly. It must be distinguishable.

  Regarding the validity check method for the monitoring conditions of the operation monitoring product, a failure has been detected because the monitoring settings are not appropriate even though a failure has actually occurred or no failure has actually occurred The fact was that it was not possible to distinguish between the two. In addition, in order for the administrator to review the monitoring conditions, a large amount of knowledge and experience regarding the execution environment was required.

As a technique related to confirming the validity of the monitoring condition of the operation monitoring product as described above, Patent Document 1 discloses that the second function processing is performed using the control rule at the time of abnormality after the first function processing. A fire alarm device is disclosed that performs and evaluates the validity of the first treatment.
The invention disclosed in Patent Document 1 improves determination accuracy by performing abnormality determination under a plurality of conditions.
Japanese Patent Laid-Open No. 06-318292

  However, Patent Document 1 has no disclosure and suggestion of correcting the processing rule used for the first process when the second function process evaluates that the validity of the first process is low. Not even been done. That is, the invention disclosed in Patent Document 1 cannot automatically optimize the monitoring setting in accordance with the actual environment. Therefore, if the determination result does not match between the first process and the second process in a certain state, the first process result and the second process result do not match even if the determination result is the same after that. Remains.

  The present invention has been made in view of such problems, and a monitoring system, a network monitoring apparatus, and a service execution environment monitoring method that the apparatus itself evaluates whether or not the monitoring setting is appropriately made and prompts the administrator to make a change. The purpose is to provide.

In order to achieve the above object, the present invention provides, as a first aspect, a monitoring system for monitoring a service execution environment to be monitored, an agent device for grasping the state of the service execution environment, and the service execution environment The agent device has a manager device for managing the monitoring rules, and the agent device has generated from the manager device, means for generating status information indicating the status of the service execution environment, means for transmitting the status information to the manager device, and Means for changing the state of the service execution environment by executing a command, and the manager device represents the main condition for determining that a failure has occurred in the service execution environment and the state of the main condition from a different viewpoint The storage means for storing the monitoring rules defined by the sub-conditions and the service indicated by the status information received from the agent device Means for determining whether the state of the execution environment satisfies the main condition defined in the monitoring rule as a first determination, and the state of the service execution environment indicated by the state information received from the agent device are monitored. Means for determining whether or not a sub-condition defined in the rule is satisfied as a second determination; means for determining whether or not a result of the first determination is different from a result of the second determination; Means for notifying the administrator of the main condition and the result of the first determination, and the sub-condition and the result of the second determination when the result of the first determination and the result of the second determination are different; There is provided a monitoring system characterized by comprising:

In order to achieve the above object, according to a second aspect of the present invention, there is provided a network monitoring device that communicates with an agent device for grasping a state of a service execution environment that is a monitoring target. A storage means for storing monitoring rules defined by a main condition for determining that a failure has occurred and a sub-condition that represents the state of the main condition from another viewpoint, and a service execution environment notified from the agent device Means for determining whether the state satisfies the main condition defined in the monitoring rule as a first determination, and the status of the service execution environment notified from the agent device are sub-conditions defined in the monitoring rule The result of the first determination, the means for determining whether or not the second determination is satisfied, the means for determining whether the result of the first determination is different from the result of the second determination, and the result of the first determination. When, if the result of the second determination is different, the main conditions and the first determination result, and characterized by having means for notifying the result of sub-condition and the second determination administrator, the A network monitoring apparatus is provided.

In order to achieve the above object, according to a third aspect of the present invention, there is provided a service execution environment monitoring method performed by a monitoring apparatus that communicates with an agent apparatus for grasping a state of a service execution environment to be monitored. The monitoring conditions defined by the main condition for determining that a failure has occurred in the service execution environment and the sub-conditions representing the state of the main condition from a different viewpoint, and the agent device The process for determining whether or not the state of the service execution environment that has been satisfied satisfies the main condition defined in the monitoring rule is the first determination, and the state of the service execution environment notified from the agent device is the monitoring rule. Determining whether the defined sub-conditions are satisfied as a second determination, determining whether the result of the first determination is different from the result of the second determination; Having one of the result of the determination, if the result of the second determination is different, the main conditions and the first determination result, and a step of notifying the result of sub-condition and the second determination administrator, the A service execution environment monitoring method is provided.

  According to the present invention, it is possible to provide a monitoring system, a network monitoring device, and a service execution environment monitoring method in which the device itself evaluates whether or not the monitoring setting is appropriately made and prompts the administrator to make a change.

  FIG. 1 shows a configuration of a network monitoring apparatus according to the present invention. The network monitoring apparatus 10 includes a monitoring rule accumulating unit 12 that accumulates monitoring rules defined by a plurality of conditions including a main condition and at least one sub-condition, and the status of a service execution environment to be monitored is a monitoring rule accumulation. The analysis unit 11 that determines whether or not the main condition defined in any of the monitoring rules stored in the unit 12 meets each of the sub-conditions and whether or not the service execution environment state is arbitrary. The monitoring failure verification unit 13 that determines whether or not the suitability is different between one of the sub-conditions and the main condition, and updates the monitoring rule that is suitability is different between one of the sub-conditions and the main condition. A monitoring failure display unit 15 to request and a monitoring rule update unit 16 to store the revised monitoring rule in the storage unit.

  The analysis unit 11 receives the status information of the monitoring target and determines whether or not the conditions of the monitoring rules stored in the monitoring rule storage unit 12 are satisfied. The monitoring rule accumulation unit 12 stores and manages monitoring rules for monitoring failures defined by a plurality of conditions. The monitoring failure verification unit 13 receives the failure determination result from the analysis unit 11, and when the determination results of a plurality of conditions do not match, the monitoring failure display unit 15 displays a monitoring failure warning indicating that the monitoring setting is not appropriate. To display. The monitoring rule update unit 16 accepts an input operation from the administrator and changes and updates the monitoring rule stored in the monitoring rule storage unit 12 when a monitoring failure occurs and the monitoring rule needs to be changed. To do.

  Hereinafter, preferred embodiments of the present invention will be described.

  A preferred embodiment of the present invention will be described. FIG. 2 shows the configuration of the network monitoring system according to the present embodiment. This system includes a manager device 100, an agent device 200, and a service execution environment 300. The network monitoring apparatus according to the present invention is applied as a manager apparatus 100 to a network monitoring system.

  The manager device 100 includes an analysis unit 110, a monitoring rule storage unit 120, a monitoring failure verification unit 130, a failure display unit 140, a monitoring failure display unit 150, and a monitoring rule update unit 160. As the manager device 100, an SNMP server or the like is used.

  The analysis unit 110 receives the event 20 from the agent device 200 and determines whether or not the conditions of the monitoring rules stored in the monitoring rule storage unit 120 are satisfied. If the analysis unit 110 determines that the event 20 satisfies the condition, the analysis unit 110 notifies the monitoring failure verification unit 130 of this, displays the screen by the failure display unit 140, and notifies the administrator 10 of the screen display. The monitoring rule accumulating unit 120 stores and manages monitoring rules for monitoring failures defined by a plurality of conditions. The monitoring failure verification unit 130 receives the failure determination result from the analysis unit 110, and if the determination result of a plurality of conditions does not match, the monitoring failure display unit 150 displays a monitoring failure warning indicating that the monitoring setting is not appropriate. To display. When a monitoring failure occurs and the monitoring rule needs to be changed, the monitoring rule update unit 160 receives an input operation from the administrator 10 and changes the monitoring rule stored in the monitoring rule storage unit 120. Update.

  The manager device 100 has a function of issuing an action for solving a failure as a command 30 to the agent device 200 according to an instruction from the administrator 10.

The agent device 200 includes a monitoring unit 210 and a control unit 220.
The monitoring unit 210 extracts performance information from the service execution environment 300, generates an event 20, and notifies the manager device 100 of it. The control unit 220 receives the command 30 as an action for solving the failure from the manager device 100, and issues the command to the service execution environment 300 to solve the failure.

  This system has a configuration in which the manager device 100 presents the result of collecting and analyzing the event 20 (determination of a failure condition) to the administrator, but the monitoring rules stored in the monitoring rule storage unit 120 have different viewpoints. Define multiple conditions to determine the same state. When the monitoring failure detection unit 130 detects a difference in determination under the plurality of conditions, a warning is issued that the monitoring setting is not appropriate, and the condition is corrected by the administrator.

The operation of the monitoring system according to this embodiment will be described.
FIG. 3 shows the data structure of the monitoring rule. The monitoring rule includes a number, a rule name, a main condition, a sub condition, and an action. Here, the maximum number of sub-conditions is set to 3, but the number is not limited to this and is an arbitrary number.

  The monitoring rule of number “1” in FIG. 3 (rule name “Websrv overload”) is an example of a rule for monitoring an overload of a Web server in a three-layer system including a Web server, a database server, and an application server. Yes, a condition for determining a failure when the load of the Web server is 80% or more is defined as a main condition. Furthermore, “sub-condition 1” for determining that a failure has occurred when the application response is 5000 ms or more, “sub-condition 2” for determining that a failure has occurred when the load on the AP server is 70% or higher, and the load on the DB server being 60% or higher Three sub-conditions “sub-condition 3” for determining that a failure has occurred are defined. As described above, the monitoring rule includes a plurality of conditions including a main condition indicating a failure state and at least one sub-condition expressing the state of the main condition from another viewpoint.

FIG. 4 shows the operation flow of the monitoring system. Steps A01 and A02 are operations of the monitoring unit 210, steps A11 to A16 are operations of the analysis unit 110 , steps A21 to 24 are operations of the monitoring failure verification unit 130 , step A31 is operations of the monitoring failure display unit 150 , and step A41 is monitoring. This is the operation of the rule update unit 160 .
First, the monitoring unit 210 of the agent device 200 collects performance information from the service execution environment 300 (step A01). When the monitoring unit 210 acquires the performance information, the monitoring unit 210 generates an event 20 based on the performance information, and sends the event 20 to the manager device 100 (step A02).

The analysis unit 110 of the manager device 100 waits for the event 20 to be sent from the agent device 200 (step A11). When the event 20 is sent from the agent device 200, the analysis unit 110 extracts one monitoring rule that has not been determined from the monitoring rule storage unit 120 (step A12).
If there is no undetermined monitoring rule (step A13 / Yes), the process returns to step A11, and the analysis unit 110 waits for the next event to be sent from the agent device 200. When the monitoring rule is extracted (step A13 / No), the analysis unit 110 determines whether or not the main condition of the extracted monitoring rule is satisfied (step A14). If the main condition is satisfied (step A15 / Yes), the analysis unit 110 notifies the failure determination result to the failure display unit 140 and displays that it is in a failure state (step A16). On the other hand, if the main condition is not satisfied, the process proceeds to step A21.

  After the analysis unit 110 finishes determining the main condition, the monitoring failure verification unit 130 is in a “monitoring failure state” in which the monitoring setting is not appropriate when the determination result of the main condition is different from the determination result of the sub condition. The following operations are performed in order to determine. Since a plurality of subconditions may exist, first, the monitoring failure verification unit 130 extracts one subcondition to be determined from the monitoring rule (step A21). If the determination is completed for all the sub-conditions of the monitoring rule (step A22 / Yes), the process returns to step A12 and the next monitoring rule is processed. On the other hand, if an undetermined sub-condition exists (step A22 / No), the process proceeds to step A23.

  When the sub-condition to be determined is extracted in step A21, the monitoring failure verification unit 130 determines whether the determination result of the main condition is different from the determination result of the sub-condition (step A23). If the determination result of the main condition matches the determination result of the sub condition (step A24 / No), the process returns to step A21 and the same processing is performed for the other sub conditions. On the other hand, if the determination result of the main condition and the determination result of the sub condition do not match (step A24 / Yes), the process proceeds to step A31, and the processing of “monitoring failure state” in which the monitoring setting is not appropriate is performed.

  When the monitoring setting is in the “monitoring failure state” where the monitoring setting is not appropriate, the monitoring failure display unit 150 displays the main condition, its determination result, the sub-condition, and its determination result as a monitoring failure warning, thereby displaying the monitoring failure state. To the administrator 10 (step A31). When the administrator 10 corrects the condition of the monitoring rule using the monitoring rule update unit 160 according to the notified monitoring failure warning, the monitoring rule update unit 160 stores the updated monitoring rule in the monitoring rule accumulation unit 120. (Step A41). Thereafter, the process returns to step A21 to process the next subcondition.

Thus, the network monitoring system according to the present embodiment displays a monitoring failure warning indicating that the monitoring setting is not appropriate when there is a difference in the determination result between the main condition and the sub condition. It is possible to distinguish whether a failure has occurred or whether monitoring has failed.

In addition, the said embodiment is an example of suitable implementation of this invention, and this invention is not limited to this.
For example, in the above embodiment, the process of monitoring a system with a three-layer structure is taken as an example, but it goes without saying that the configuration of the monitoring target is arbitrary.
It is also possible to verify only the monitoring conditions without displaying the occurrence of a failure.
As described above, the present invention can be variously modified.

It is a figure which shows the structure of the network monitoring apparatus which concerns on this invention. It is a figure which shows the structure of the network monitoring system which concerns on suitable embodiment of this invention. It is a figure which shows an example of the monitoring rule. It is a figure which shows the flow of operation | movement of the network monitoring system which concerns on suitable embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Network monitoring apparatus 11,110 Analysis part 12,120 Monitoring rule storage part 13,130 Monitoring result verification part 15,150 Monitoring failure display part 16,160 Monitoring rule update part 100 Manager apparatus 140 Fault display part 200 Agent apparatus 210 Monitoring part 220 Control unit 300 Service execution environment

Claims (9)

A monitoring system for monitoring a service execution environment to be monitored,
An agent device for grasping the state of the service execution environment, and a manager device for managing monitoring rules of the service execution environment;
The agent device is:
Means for generating status information indicating the status of the service execution environment;
Means for transmitting the status information to the manager device;
Means for executing a command acquired from the manager device and changing the state of the service execution environment;
The manager device is
Storage means for storing monitoring rules, defined by a main condition for determining that a failure has occurred in the service execution environment, and a sub-condition representing the state of the main condition from another viewpoint;
Means for determining, as a first determination, whether or not the status of the service execution environment indicated by the status information received from the agent device satisfies a main condition defined in the monitoring rule;
Means for determining, as a second determination, whether the status of the service execution environment indicated by the status information received from the agent device satisfies a sub-condition defined in the monitoring rule;
Means for determining whether the result of the first determination is different from the result of the second determination;
If the result of the first determination is different from the result of the second determination, the main condition and the result of the first determination, and the sub-condition and the result of the second determination are sent to the administrator. A means of notification;
A monitoring system comprising:   The monitoring system according to claim 1, wherein the main condition is requested to be reset when notifying the administrator that the setting of the monitoring rule is not appropriate.   The monitoring system according to claim 1 or 2, wherein the processing content of the command is defined by being included in the monitoring rule.   The monitoring system according to any one of claims 1 to 3, wherein the manager device and the agent device communicate with each other by an SNMP protocol.   The manager device, when the status of the service execution environment indicated by the status information received from the agent device satisfies the main condition defined in the monitoring rule, reports the occurrence of a failure in the service execution environment. The monitoring system according to any one of claims 1 to 4, further comprising a means for notifying the user. A network monitoring device that communicates with an agent device to understand the status of the service execution environment being monitored,
Storage means for storing monitoring rules, defined by a main condition for determining that a failure has occurred in the service execution environment, and a sub-condition representing the state of the main condition from another viewpoint;
Means for determining, as a first determination, whether or not the state of the service execution environment notified from the agent device satisfies a main condition defined in the monitoring rule;
Means for determining, as a second determination, whether or not the status of the service execution environment notified from the agent device satisfies a sub-condition defined in the monitoring rule;
Means for determining whether the result of the first determination is different from the result of the second determination;
If the result of the first determination is different from the result of the second determination, the main condition and the result of the first determination, and the sub-condition and the result of the second determination are sent to the administrator. A means of notification;
A network monitoring apparatus comprising:   7. The network according to claim 6, further comprising means for notifying an administrator of the occurrence of a failure in the service execution environment when the state of the service execution environment satisfies a main condition defined in the monitoring rule. Monitoring device. A service execution environment monitoring method performed by a monitoring device that communicates with an agent device for grasping a status of a service execution environment to be monitored,
Storing a monitoring rule defined by a main condition for determining that a failure has occurred in the service execution environment and a sub-condition representing the state of the main condition from another viewpoint;
Determining whether the status of the service execution environment notified from the agent device satisfies a main condition defined in the monitoring rule as a first determination;
Determining whether the status of the service execution environment notified from the agent device satisfies a sub-condition defined in the monitoring rule as a second determination;
Determining whether the result of the first determination is different from the result of the second determination;
If the result of the first determination is different from the result of the second determination, the main condition and the result of the first determination, and the sub-condition and the result of the second determination are sent to the administrator. A notification step;
A service execution environment monitoring method comprising:   9. The service according to claim 8, further comprising a step of notifying an administrator of the occurrence of a failure in the service execution environment when the state of the service execution environment satisfies a main condition defined in the monitoring rule. Execution environment monitoring method.

Images