JP5230311B2 - Failure analysis system and failure analysis method - Google Patents

Description

  The present invention relates to a technique for analyzing a failure of a device connected to a network.

With the development of networks and the spread of information communication devices, various devices are connected to the network and exchange information. This situation has gradually spread to ordinary households, and the term “home network” has been created.
Also, devices connected to the home network include not only conventional personal computers but also general home appliances such as televisions and refrigerators, and sensors for detecting the presence of human beings.

However, unlike the Internet and intranets that have been managed by conventional experts, it is not preferable for a network in a general home to allow an external person to access the network without permission, due to problems such as privacy.
Therefore, when a failure occurs in the home network, it is necessary for the user to find out and deal with it. However, it is difficult for a non-expert user to do all of this.

Thus, manufacturers such as personal computers and other communication devices have established support centers and call centers to deal with failures on the home network.
The user calls a call center such as a manufacturer. An operator such as a call center directly listens to the occurrence status from the user, and derives the failure status, cause, and coping method based on past cases and experience and intuition of experts.

  On the other hand, with regard to network fault diagnosis, “in a network fault diagnosis device that identifies faults based on the causal relationship between faults occurring in the network and events indicating fault signs, reducing traffic to and from the managed network. . As a technique aiming at “the causal relationship table 104 stores the causal relationship between the fault and the event, the monitoring event selection unit 105 refers to the causal relationship table 104 and identifies the minimum event necessary for identifying the fault. Is extracted and set as a monitoring event, and the acquisition event selection unit 107 selects an event from the causal relationship table 104 based on the latest failure candidate, and gives priority to the selected event in the order in which the failure can be efficiently identified. The event acquisition unit 102 requests events in the order of the set priority, the event reception unit 103 receives an event responding to the request, and based on the sequentially received events The failure determination unit 108 is configured to narrow down failure candidates. Is proposed (Patent Document 1).

  In addition, with regard to failure prediction, as a technology for the purpose of “providing a failure prediction system that can predict failure occurrence based on the type of event that occurred in the prediction target device and its occurrence order” The prediction system 1 performs data mining on the event log 35 related to the event that has occurred in the prediction target device 10, extracts, for example, a precursor pattern specified by the event occurrence order, and the precursor pattern is detected in the analysis target log. A log analysis unit 39 that predicts that a failure will occur in the prediction target device 10 at the time. Is proposed (Patent Document 2).

JP 2007-96796 A JP 2007-172131 A

  With the techniques described in Patent Document 1 and Patent Document 2, it is possible to detect a device failure on the home network and notify the user, but it is generally difficult for the user to receive the notification and deal with the failure themselves. It is.

  Also, even when a user requests a failure recovery from a call center of a manufacturer, etc., the user generally does not have knowledge of equipment or failure analysis, and accurately conveys information necessary for the operator to determine the failure status and cause. It is difficult. Therefore, it takes time for the operator to grasp the failure status and complete the failure recovery.

On the other hand, it is conceivable that the call center side obtains operation information such as logs from devices installed in the home network and uses it for analysis of failure conditions. It is not preferable to send to.
Furthermore, even if all information is transmitted, there is a concern that the amount of communication for transmission becomes enormous.

  Therefore, there has been a demand for a failure analysis method that can collect and transmit the minimum information necessary for failure analysis to an analysis destination.

  A failure analysis system according to the present invention includes a gateway device connected to a first network and an analysis device connected to a second network different from the first network, and the gateway device includes the first device A failure detection unit that detects a failure of one or more devices on the network, a communication status recording unit that records identification information of each communication partner when communication is performed between the devices, and operation information of the devices An operation information acquisition unit that acquires and transmits the operation information to the analysis device, the analysis device includes a failure analysis unit that performs a failure analysis of the device using the operation information, and the operation information acquisition unit includes: Using the identification information recorded by the communication status recording unit, the device in which the failure detection unit has detected a failure identifies a partner device with which communication has been performed in the past, acquires the operation information of the communication partner, and It is intended to be transmitted to the analysis device.

The fault analysis system according to the present invention transmits the operation information of the counterpart device to the analysis device under the assumption that the counterpart device with which the faulty device has communicated in the past is related to the fault.
That is, since the operation information of all the devices on the network is transmitted to the analysis device, only the operation information of the device that seems to be related to the failure can be transmitted to the analysis device, thereby reducing the amount of communication. .
In addition, since it is not necessary to transmit information that is not necessary for failure analysis and the information to be transmitted can be suppressed to the minimum necessary, it can be suitably used from the viewpoint of information leakage and privacy protection.

Embodiment 1 FIG.
FIG. 1 is a configuration diagram of a failure analysis system according to Embodiment 1 of the present invention.
The failure analysis system according to the first embodiment includes a gateway device 200 and an analysis server 300. Hereinafter, the configuration of each device will be described, and then the operation of the failure analysis system according to the first embodiment will be described.

Gateway device 200 and analysis server 300 are connected via network 600. A local network 100 is laid under the gateway device 200.
In FIG. 1, the network 600 and the analysis server 300 are described as being directly connected from the viewpoint of simplicity of description, but the analysis server 300 may be connected to the intra-organization network as with the local network 100. .

  The local network 100 is a closed network within an organization. For example, a home network (home network) corresponds to this.

The gateway device 200 is installed at a connection point between the local network 100 and the network 600, and devices 401 to 404 are connected under the gateway device 200.
The gateway device 200 has a function as a router that mediates communication between the devices 401 to 404 or between the devices 401 to 404 and the analysis server 300. The gateway device 200 itself also has a function of communicating with the devices 401 to 404 and the analysis server 300.

  The gateway device 200 includes a failure detection unit 201, a communication observation unit 202, a communication recording unit 203, and an operation information acquisition unit 204.

The failure detection unit 201 detects a failure that occurs in the devices 401 to 404 using a technique such as that described in Patent Literatures 1 and 2, for example.
The communication observation unit 202 observes communication between the devices 401 to 404 using a procedure described later with reference to FIG. 4 and stores the situation in the communication recording unit 203.

The communication recording unit 203 records the communication status between the devices 401 to 404. A specific example of the communication record will be described later with reference to FIG.
The operation information acquisition unit 204 acquires the operation information 501 to 504 held by the devices 401 to 404, respectively. The detailed operation of the operation information acquisition unit 204 will be described again with reference to FIG.

  The analysis server 300 is a server device that belongs to a network different from the local network 100 and has a role of analyzing a failure that has occurred in the devices 401 to 404. The analysis server 300 includes a failure analysis unit 301 and an operation information request unit 302.

The failure analysis unit 301 analyzes the operation information 501 to 504 to narrow down the cause of the failure that has occurred in the device.
The operation information requesting unit 302 requests the gateway device 200 to acquire the respective operation information 501 to 504 from the devices 401 to 404 and transmit them to the analysis server 300.

The devices 401 to 404 have a function of communicating with each other. Although FIG. 1 shows an example of a four-unit configuration, the number is not limited to this. Further, the devices 401 to 404 have a function of outputting an internal process log and a function of outputting a process list to the outside of the device.
The operation information 501 to 504 is information representing the operation status of each device, which is recorded or output by the devices 401 to 404, respectively.

  The network 600 is a network such as the Internet that connects the local network 100 and the network to which the analysis server 300 belongs.

  The failure detection unit 201, the communication observation unit 202, the operation information acquisition unit 204, the failure analysis unit 301, and the operation information request unit 302 can be configured by hardware such as a circuit device that realizes these functions, or a microcomputer. And a computing device such as a CPU (Central Processing Unit) and software defining its operation. In addition, necessary communication interfaces and the like are provided as appropriate.

  The communication recording unit 203 can be configured by a storage device such as an HDD (Hard Disk Drive).

  The “communication status recording unit” in the first embodiment corresponds to the communication observation unit 202 and the communication recording unit 203.

The configuration of each device and the like of the failure analysis system according to the first embodiment has been described above.
Next, the operation of the failure analysis system according to the first embodiment will be described.

The failure analysis system according to the first embodiment performs the operation described with reference to FIG. 2 as a whole. Further, the gateway device 200 performs a communication recording operation described in FIG. 4 to be described later in parallel with the overall operation of the failure analysis system.
In the following, first, the overall operation of the failure analysis system will be described with reference to FIG. 2, and individual operations will be described with reference to FIGS.

  FIG. 2 is an operation flow of the failure analysis system according to the first embodiment. Hereinafter, each step of FIG. 2 will be described.

(S201)
Assume that a failure has occurred in the device 401 of FIG.
(S202)
The failure detection unit 201 of the gateway device 200 detects a failure that has occurred in the device 401. As a detection method, for example, a method of analyzing the operation information 501 acquired by the operation information acquisition unit 204 or monitoring the process of the device 401 can be considered. Moreover, you may use the well-known method as described in patent documents 1-2.

(S203)
The failure detection unit 201 transmits information that a failure has occurred in the device 401 to the analysis server 300 via the network 600. Alternatively, the failure detection unit 201 notifies the user that a failure has occurred in the device 401 by an appropriate method, and the user receives the notification and notifies the call center by telephone or e-mail.
Here, it is assumed that the call center operator has a terminal or the like that can give an operation instruction to the analysis server 300.

(S204)
The call center operator instructs the analysis apparatus 300 to acquire operation information necessary for analyzing the cause of the failure based on the failure occurrence notification received in step S203.
Note that, instead of a call center operator, an apparatus that automatically instructs operation information to be acquired based on a failure occurrence notification may be used.
The operation information request unit 302 of the analysis apparatus 300 determines whether the acquisition request is a request for acquiring the operation information 501 of the faulty device (in this case, the device 401) or a device related to the fault (for example, 402, 403, 404). ) Operation information (for example, 502, 503, 504) is determined.
If it is an acquisition request for the faulty device 401, the process proceeds to step S205, and if it is an acquisition request for the related device 402, the process proceeds to step S211.

(S205)
The operation information request unit 302 of the analysis device 300 requests the gateway device 200 to transmit the operation information 501 of the device 401.

(S206)
When the operation information acquisition unit 204 of the gateway device 200 receives the request in step S205, the operation information acquisition unit 204 acquires the operation information 501 of the device 401. When the request in step S211 is received, the operation information of the related device is acquired. Details of this step will be described later with reference to FIG.
In the following description of steps S207 to S210, it is assumed that the request of step S205 has been received in this step.

(S207)
The operation information acquisition unit 204 transmits the operation information 501 acquired in step S206 to the analysis server 300 via the network 600.
At this time, the operation information acquisition unit 204 encrypts transmission data using a common key encryption such as AES (Advanced Encryption Standard), or a public key encryption such as RSA, or uses SSL (Secure Socket Layer) or IPsec. Some security measures are applied to the content to be transmitted, for example, using such a channel encryption technology.

(S208)
The failure analysis unit 301 of the analysis server 300 receives the operation information 501 of the device 401. Next, the failure analysis unit 301 analyzes the operation information 501 and analyzes the cause of the failure.
(S209)
The failure analysis unit 301 determines whether or not operation information other than the operation information 501 (502 to 504 in the example of FIG. 1) is further required in order to perform more detailed analysis. When it is determined that it is necessary, the process returns to step S204, and when it is determined that it is not necessary, the process proceeds to step S210.

(S210)
The failure analysis unit 301 of the analysis server 300 completes the failure analysis and notifies the result to the call center operator. Based on the result, the operator takes measures such as giving advice to the user. These may be performed automatically, but it is preferable to use such a method from the viewpoint of security and the like.
(S211)
On the other hand, in the above step 204, if it is an acquisition request for the related device 402 or the like,
The operation information request unit 302 of the analysis device 300 requests the gateway device 200 to transmit operation information related to the occurrence of the failure of the device 401, and the process proceeds to S206.

The operation flow of the failure analysis system according to the first embodiment has been described above.
Next, the detailed operation of step S206 will be described.

  FIG. 3 is an operation flow for explaining the detailed operation of step S206. Hereinafter, each step of FIG. 3 will be described. In FIG. 3, it is assumed that a failure has occurred in the device 401 as in FIG.

(S301)
The operation information acquisition unit 204 of the gateway device 200 receives a request to acquire operation information of any of the devices 401 to 404 in step S205 or S211 of FIG. Next, it is determined whether or not this acquisition request is an operation information acquisition request for a faulty device (device 401 in the example of FIG. 2).
If it is an operation information acquisition request for a faulty device, the process proceeds to step S304. Otherwise, the process proceeds to step S302.

(S302)
The operation information acquisition unit 204 searches for the communication record of the device 401 from the communication records stored in the communication recording unit 203. Next, devices that have communicated with the device 401 in the past (for example, 402, 403, and 404) are extracted based on the search results. A specific example of the communication record is shown in FIG.
This step has the significance of searching for the devices in the communication record under the assumption that the devices that have communicated with the device 401 in the past will be related to the occurrence of the failure of the device 401.

(S303)
The operation information acquisition unit 204 acquires operation information (for example, 502, 503, 504) of the device (for example, 402, 403, 404) searched in step S302. At this time, information that enables individual identification of the device, such as the IP address of the device, may be acquired together and included in the operation information. The same applies to step S304.
(S304)
The operation information acquisition unit 204 acquires operation information 501 of the device 401.

The detailed operation of step S206 in FIG. 2 has been described above.
Next, an operation in which the gateway device 200 records the communication status of the devices 401 to 404 in the communication recording unit 203 will be described.

FIG. 4 is a flowchart of an operation of recording the communication status of the devices 401 to 404, which is always performed by the gateway device 200. The gateway device 200 performs the operation of FIG. 4 at predetermined time intervals, for example, and regularly records the communication status of the devices 401 to 404.
Hereinafter, each step of FIG. 4 will be described. An example of the recording format of the communication record will be described again with reference to FIG.

(S400)
The communication observation unit 202 of the gateway device 200 constantly observes communication between the devices 401 to 404 in parallel with the operation of each unit described with reference to FIGS.
(S401)
When communication is performed between the devices 401 to 404, the communication observation unit 202 captures the communication packet.

(S402)
The communication observation unit 202 extracts a source address / destination address pair from the packet captured in step S401. Here, it is assumed that the IP address is extracted.
(S403)
The communication observation unit 202 determines whether or not the pair of the transmission source address and the transmission destination address extracted in step S 401 has already been recorded in the communication recording unit 203. If already recorded, the process proceeds to step S405, and if not recorded, the process proceeds to step S404.

(S404)
The communication observation unit 202 stores the pair of the transmission source address and the transmission destination address extracted in step S402 in the communication recording unit 203 together with the extraction time.
(S405)
The communication observation unit 202 updates only the time of the communication record in the communication recording unit 203 corresponding to the transmission source address and the transmission destination address extracted in step S402 at the extraction time of step S402.

(S406)
The communication observation unit 202 deletes the communication record recorded in the communication recording unit 203 a predetermined time or more before the current time. Specifically, the current time is compared with the recording time of the communication record recorded in the communication recording unit 203, and the communication record more than a predetermined time is deleted. As a result, only the latest communication status remains in the communication recording unit 203, information on only the device related to the failure can be left, and an increase in the storage area of the communication recording unit 203 can be prevented.

  The operation of the communication observation unit 202 has been described above. By repeatedly executing this operation flow, the communication record between the devices 401 to 404 is additionally updated in the communication recording unit 203.

  FIG. 5 shows a format example of the communication record stored in the communication recording unit 203. Although an example of recording in the table format is shown here, the recording format is not limited to this.

The communication record has an “IP address” column and a “recording time” column.
In the “IP address” column, a pair of a transmission source IP address and a transmission destination IP address of a communication packet captured by the communication observation unit 202 is stored. The “identification information” in the first embodiment corresponds to the value in this column.
The “recording time” column stores the latest time when the communication of the address pair in the “IP address” column is recorded.

  Hereinafter, in the data example of FIG. 5, assuming that the IP address of the device 401 is “192.168.0.5”, an operation example in steps S302 to S303 of FIG. 3 will be described.

(S302_1)
In step S302 of FIG. 3, the operation information acquisition unit 204 searches for a communication record of the device 401 using the IP address “192.168.0.5” as a key. In the data example of FIG. 5, the data in the first and second rows hits the search.

(S302_2)
In step S302 in FIG. 3, the operation information acquisition unit 204 acquires the address of the counterpart device in each row acquired in the above step. In the data example of FIG. 5, “192.168.0.7” and “192.168.0.9” are acquired.
By this step, it is possible to specify the address of the device that has been linked and operated in the past as the communication partner of the device 401.

(S303)
In step S303 of FIG. 3, the operation information acquisition unit 204 acquires the operation information of each device having the addresses “192.168.0.7” and “192.168.0.9” acquired in step (S302_2). .

The operation of the failure analysis system and each device according to the first embodiment has been described above.
Note that in step S204 in FIG. 2, whether to request the operation information for the same device is determined depending on whether the operation information for the same device has already been requested, but the procedure for distinguishing is limited to this. It is not a thing.

For example, whether or not the analysis server 300 always requests operation information about a faulty device (the device 401 in the first embodiment) and the gateway device 200 has already transmitted the operation information 501 of the device 401. Based on the above, it may be determined which device to request the operation information.
Specifically, the following methods can be considered.

(Example of method for determining whether transmission has been completed on the gateway device 200 side)
The operation information acquisition unit 204 of the gateway device 200 holds a list of devices that have transmitted the operation information for a certain period of time. When the operation information is requested for the same device again within the predetermined time, it is determined that the operation information for the device has already been transmitted.
When the operation information acquisition unit 204 determines that the operation information about the device has already been transmitted, the operation information acquisition unit 204 searches the communication record of the communication recording unit 203 for the address of the device related to the device, and operates the device. Send information instead.

As described above, the failure analysis system according to the first embodiment stores the communication record between the devices 401 to 404 in the communication recording unit 203 for a certain period of time.
Further, for example, when a failure occurs in the device 401, the operation information acquisition unit 204 uses the communication record to identify the device that has been in communication with the device 401 most recently, thereby assuming that the device is related to the failure. And the operation information of the related device is transmitted to the analysis server 300.

  As a result, the analysis server 300 can analyze not only the device 401 in which the failure has occurred but also the operation information of the device that seems to be related to the failure, so that the failure can be analyzed in more detail.

In addition, according to the first embodiment, the operation information is not transmitted from all the devices on the local network 100 to the analysis server 300, but only the operation information of the device that seems to be related to the failure is transmitted. The amount can be reduced.
At the same time, operation information not related to failure analysis can be prevented from flowing outside the local network 100, which is preferable from the viewpoint of privacy.

  Further, according to the first embodiment, the amount of operation information to be analyzed by the analysis server 300 can be similarly reduced, so that the analysis time performed by the failure analysis unit 301 can be shortened.

Embodiment 2. FIG.
In the first embodiment, the communication observation unit 202 of the gateway device 200 observes all the packets on the local network 100 and extracts the address of the communication partner device. An extraction method can be considered.

(Address extraction method 1)
The communication observation unit 202 samples a packet on the local network 100 as appropriate, and extracts a transmission source address and a transmission destination address from the sampled packet.

(Address extraction method 2)
The communication observation unit 202 captures a packet that flows on the local network 100 when communication is started between the devices 401 to 404, such as a SIP (Session Initiation Protocol), and determines a source address and a destination address from the packet. Extract.

(Address extraction method 3)
The communication observation unit 202 captures a packet for finding a device in the network, which is defined by a communication standard for a home network such as DLNA (Digital Living Network Alliance) or Echonet, and uses the local network from the packet. The addresses of the devices 401 to 404 on the 100 are acquired.

Embodiment 3 FIG.
FIG. 6 is a configuration diagram of a failure analysis system according to Embodiment 3 of the present invention.
In the third embodiment, the gateway device 200 newly includes a filtering unit 205 and a filter rule storage unit 206 in addition to the configuration described in FIG. 1 of the first embodiment. Configurations of other devices and the like are the same as those in the first and second embodiments.

The filtering unit 205 filters the operation information acquired by the operation information acquisition unit 204 in accordance with the filter rules stored in the filter rule storage unit 206, and extracts only items with high importance.
The filter rule storage unit 206 stores rules for the filtering unit 205 to perform filtering. A specific example will be described later with reference to FIG.

  The filtering unit 205 can be configured by hardware such as a circuit device that implements the function, or can be configured by an arithmetic device such as a microcomputer or CPU and software that defines the operation thereof.

  The filter rule storage unit 206 can be configured by a storage device such as an HDD.

  The filtering unit 205 may be configured integrally with the operation information acquisition unit 204. The filter rule storage unit 206 may be configured integrally with the communication recording unit 203.

  FIG. 7 is an operation flow of the failure analysis system according to the third embodiment. Hereinafter, each step of FIG. 7 will be described. It is assumed that a failure has occurred in the device 401 as in FIG.

(S701) to (S706)
This is the same as steps S201 to S206 in FIG.
(S707)
The filtering unit 205 filters the operation information acquired by the operation information acquisition unit 204 in step S706, and extracts items with high importance. Details of this step will be described later with reference to FIG.
(S708) to (S712)
This is the same as steps S207 to S211 in FIG.

The operation flow of the failure analysis system according to the third embodiment has been described above.
Next, details regarding filtering will be described.

  FIG. 8 shows an example of the filter rules stored in the filter rule storage unit 206. Here, an example of storing in a table format is shown, but the format of the filter rule is not limited to this.

The filter rule has an “extraction rule” column and an “importance” column.
The “extraction rule” column stores a rule for extracting an item from the operation information.
In the “importance” column, the importance of the operation information item extracted in the “extraction rule” column is designated. In FIG. 8, the importance “1” is the most important, and the importance decreases as the numerical value increases.
The importance is generally synonymous with the severity of the operation information item. That is, it is highly possible that an operation information item having a high degree of importance indicates a serious failure or a precursor thereof.

  In FIG. 8, for convenience of explanation, the value of each column is described in Japanese. However, in actuality, it is more convenient in processing to represent each column in a machine-readable format such as a regular expression.

FIG. 9 is a data example of the operation information 501. Here, an example in which the internal process log of the device 401 is the operation information 501 is shown.
The operation information 501 represents one log item per line. In one log item, a character string representing the importance of the log item (INFO, ERROR, etc. in FIG. 9) and a character string representing the contents of the log are described.

  FIG. 10 is a flow of filtering processing performed by the filtering unit 205. Hereinafter, each step of FIG. 10 will be described. In the description, the data example of FIG. 8 is used for the filter rule and the data example of FIG. 9 is used for the operation information 501.

(S1001)
The filtering unit 205 selects filter rules from the filter rule storage unit 206 in descending order of importance. In the filter rule example of FIG. 8, when this step is executed for the first time, the filter rules for the first and fourth lines are selected, and when this step is executed for the second time, the filter rule for the second line is selected. .
(S1002)
The filtering unit 205 applies the filter rule selected in step S1001 to the operation information 501 in FIG.

(S1003)
The filtering unit 205 extracts items that match the filter rule selected in step S1001 from among the operation information items described in each row of the operation information 501 in FIG.
(S1004)
The filtering unit 205 confirms whether or not the above steps have been executed for all the filter rules in FIG. If unprocessed filter rules remain, the process returns to step S1001 to execute the same process. If all the process rules have been processed, the operation flow ends.

FIG. 11 shows the filtered operation information 501 obtained as a result of the operation flow shown in FIG.
When the filter rule of FIG. 8 is applied to the operation information 501 of FIG. 9, three types of log items whose “importance” is “FATAL”, “ERROR”, and “WARN” are extracted, and the three rows of FIG. 11 finally remain. It will be.

  8 to 11, the example in which all the filter rules are applied has been described. However, only a part of the filter rules stored in the filter rule storage unit 206 may be applied to the operation information. .

As described above, according to the third embodiment, the filtering unit 205 uses the filter rule stored in the filter rule storage unit 206 and has a high importance from the operation information acquired by the operation information acquisition unit 204. After extracting a thing, it transmits to the analysis server 300.
Thereby, the gateway apparatus 200 can narrow down only the operation information useful for the analysis server 300 to perform the failure analysis, that is, the operation information having high importance, and transmit it to the analysis server 300, so that the communication amount can be further suppressed. it can.
In addition, information transmitted outside the local network 100 can be minimized, which is preferable from the viewpoint of privacy.

Embodiment 4 FIG.
In the third embodiment, it is assumed that the filter rule storage unit 206 has stored the filter rule in advance, but the filter rule can also be generated by the method described below.
In any method, the filter rule is generated so that a high importance is assigned to an item that is useful when performing a failure analysis.

(Filter rule generation method 1)
Call center operators, engineers, and the like extract common operation information patterns that have been useful for failure analysis based on past failure analysis experience. The extracted pattern is shaped into a filter rule format and transmitted from the analysis server 300 to the filter rule storage unit 206 of the gateway device 200.

(Filter rule generation method 2)
The failure analysis unit 301 of the analysis server 300 assigns importance values to the items of operation information that are useful for failure analysis based on the failure analysis results. Next, the failure analysis unit 301 generates a filter rule using the items of importance and operation information, and transmits the filter rule to the filter rule storage unit 206 of the gateway device 200.

(Filter rule generation method 3)
An important information instructing unit for adding a mark to an item of operation information that has been useful for failure analysis is provided in the analysis server 300. Specifically, for example, while checking the operation information and failure analysis result on the screen, the operator selects important items from the operation information items by visual confirmation, and clicks on the important items on the screen. Mark.
The failure analysis unit 301 of the analysis server 300 collects the statistics of the mark instructed by the operator, assigns a high importance to the operation information item with many marks, and creates a filter rule. Further, the created filter rule is transmitted to the filter rule storage unit 206 of the gateway device 200.

(Filter rule generation method 4)
When the failure detection unit 201 of the gateway device 200 detects a failure of the devices 401 to 404, the failure detection unit 201 notifies the failure analysis unit 301 of the analysis server 300 of the time.
The failure analysis unit 301 generates a filter rule later using the operation information. At this time, the filter rule is generated so that the importance is lower as the operation information item is separated in time from the failure occurrence time.

(Filter rule generation method 5)
The filter rule may be configured such that the importance is lower as the operation information is separated from the failure occurrence time.
In this case, the filter rule can be generated by the analysis server 300 by notifying the analysis server 300 of the failure occurrence time from the gateway device 200, or can be generated by the gateway device 200.

  The above (filter rule generation method 1) to (filter rule generation method 5) can be used in appropriate combination.

Embodiment 5 FIG.
In the first to fourth embodiments, it has been described that the operation information request unit 302 of the analysis server 300 requests the gateway device 200 to transmit operation information regarding a device related to the faulty device. This suggests that the operation information transmitted earlier is insufficient for failure analysis.

  However, as described in the third to fourth embodiments, when only the highly important operation information is filtered and sent to the analysis server in the first place, the operation information excluded by the filtering is newly analyzed. Sending to 300 may be sufficient.

Therefore, when the operation information acquisition unit 204 of the gateway device 200 is requested to transmit more operation information from the operation information request unit 302 of the analysis server 300, the operation information excluded by the filtering unit 205 by the filtering process is used as the analysis server. You may make it send to 300.
In addition, when it is requested to transmit further operation information, the operation information of the related device may be acquired and transmitted to the analysis server 300 as described in the first embodiment.

Embodiment 6 FIG.
The analysis server 300 described in the first to fifth embodiments can be provided with a recovery request unit 303 (not shown) that requests the gateway device 200 to attempt recovery of the devices 401 to 404 that have detected a failure. .

  The recovery request unit 303 can be configured by hardware such as a circuit device that implements the function, or can be configured by an arithmetic device such as a microcomputer or CPU and software that defines the operation thereof. In addition, necessary communication interfaces and the like are provided as appropriate.

When the gateway device 200 receives a recovery request for a failed device from the recovery request unit 303, the gateway device 200 tries to recover the device by restarting the device. Thereafter, the operation information acquisition unit 204 acquires the operation information of the device again and transmits it to the analysis server 300.
The analysis server 300 can receive the operation information and know whether the recovery is successful. The operator takes the following measures based on the result.

1 is a configuration diagram of a failure analysis system according to Embodiment 1. FIG. 3 is an operation flow of the failure analysis system according to the first embodiment. It is an operation | movement flow explaining the detailed operation | movement of step S206. It is a flowchart of the operation | movement which the gateway apparatus 200 records the operation information 501-504 of the apparatuses 401-404. It is an example of a format of the communication record which the communication recording part 203 stores. 6 is a configuration diagram of a failure analysis system according to Embodiment 3. FIG. 10 is an operation flow of the failure analysis system according to the third embodiment. It is an example of a filter rule stored in the filter rule storage unit 206. It is an example of data of operation information 501. It is the flow of the filtering process which the filtering part 205 performs. 11 shows filtered operation information 501 obtained as a result of the operation flow processing of FIG. 10.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 Local network, 200 Gateway apparatus, 201 Failure detection part, 202 Communication observation part, 203 Communication recording part, 204 Operation | movement information acquisition part, 205 Filtering part, 206 Filter rule storage part, 300 Analysis server, 301 Failure analysis part, 302 Operation | movement Information request unit, 303 recovery request unit, 401-404 device, 501-504 operation information, 600 network.

Claims (28)

A gateway device connected to the first network;
An analysis device connected to a second network different from the first network;
Have
The gateway device is
A failure detection unit that detects a failure of one or more devices on the first network;
A communication status recording unit that records identification information of each communication partner when communication is performed between the devices;
An operation information acquisition unit that acquires operation information of the device and transmits the operation information to the analysis device;
With
The analysis device includes:
A failure analysis unit that performs a failure analysis of the device using the operation information,
The operation information acquisition unit
Using the identification information recorded by the communication status recording unit,
The device in which the failure detection unit has detected a failure identifies a partner device with which communication has been performed in the past,
A failure analysis system characterized in that the operation information of the communication partner is acquired and transmitted to the analysis device. The communication status recording unit
The failure analysis system according to claim 1, wherein the identification information is created and recorded by extracting a transmission source address and a transmission destination address from packets of all communications performed between the devices. The communication status recording unit
Sampling packets for communication between the devices,
The failure analysis system according to claim 1, wherein the identification information is created and recorded by extracting a transmission source address and a transmission destination address from the sampled packet. The communication status recording unit
Capture a session start packet for communication between the devices,
The failure analysis system according to claim 1, wherein the identification information is created and recorded by acquiring the address of the device from the session start packet. The communication status recording unit
Capturing a device discovery packet flowing on the first network;
The failure analysis system according to claim 1, wherein the identification information is created and recorded by extracting a source address and a destination address using the device discovery packet. The operation information acquisition unit
The failure according to any one of claims 1 to 5, wherein the acquired operation information having high importance is narrowed down according to a predetermined importance and then transmitted to the analysis device. Analysis system. The failure analysis unit
Corresponding rule information that associates the content of the operation information with its importance is transmitted to the gateway device in advance,
The operation information acquisition unit
Acquired failure analysis system according to claim 6 Symbol mounting and transmits to the analysis apparatus having high importance in terms of narrowed down according to the corresponding rule information of the operation information. The failure analysis unit
Giving importance to the operation information based on the failure analysis result of the device,
The failure analysis system according to claim 7, wherein the correspondence rule information is created using the importance and transmitted to the gateway device. The analysis device includes:
An important information instruction unit that gives a mark to the operation information that is significant when the failure analysis unit performs the failure analysis,
The failure analysis unit
9. The failure analysis according to claim 8 , wherein the correspondence rule information is created and transmitted to the gateway device so that the importance of the operation information with a high frequency of adding a mark by the important information instruction unit is higher. system. The correspondence rule information is
The failure analysis system according to any one of claims 6 to 9 , wherein the operation information having a time farther from the failure occurrence time is configured to have a lower importance. The analysis device includes:
An operation information requesting unit for requesting the operation information to the gateway device;
The operation information acquisition unit
In accordance with the request of the operation information request unit, after narrowing down the high importance of the operation information and transmitted to the analysis device,
When the operation information has already been transmitted,
The failure analysis system according to any one of claims 6 to 10 , wherein operation information having lower importance than the previously transmitted operation information is transmitted. The analysis device includes:
A recovery request unit that requests the gateway device to try to recover a failed device;
The operation information acquisition unit
After attempting to recover the device requested by the recovery request unit,
The failure analysis system according to any one of claims 1 to 11 , wherein operation information of the device is acquired and transmitted to the analysis device. The operation information acquisition unit
The failure analysis system according to any one of claims 1 to 12 , wherein a list of processes operating in the device, a log of the processes, or both are acquired as the operation information. The operation information acquisition unit
The failure analysis system according to any one of claims 1 to 13 , wherein when the operation information is acquired, individual identification information of the device is acquired and included in the operation information. A method for analyzing a failure of one or more devices connected to a first network, comprising:
An analyzer is connected to a second network different from the first network;
A communication status recording step for recording identification information of each communication partner when communication is performed between the devices;
A failure detection step of detecting a failure of the device;
An operation information acquisition step of acquiring operation information of the device and transmitting it to the analysis device;
Have
The analysis device includes:
Performing a failure analysis step of performing a failure analysis of the device using the operation information;
In the operation information acquisition step,
Using the identification information recorded in the communication status recording step,
Identify the counterpart device with which the device that detected the failure in the failure detection step communicated in the past,
A failure analysis method characterized in that the operation information of the communication partner is acquired and transmitted to the analysis device. In the communication status recording step,
The failure analysis method according to claim 15, wherein the identification information is created and recorded by extracting a transmission source address and a transmission destination address from packets of all communications performed between the devices. In the communication status recording step,
Sampling packets for communication between the devices,
The failure analysis method according to claim 15, wherein the identification information is created and recorded by extracting a transmission source address and a transmission destination address from the sampled packet. In the communication status recording step,
Capture a session start packet for communication between the devices,
The failure analysis method according to claim 15, wherein the identification information is created and recorded by acquiring the address of the device from the session start packet. In the communication status recording step,
Capturing a device discovery packet flowing on the first network;
The failure analysis method according to claim 15, wherein the identification information is created and recorded by extracting a source address and a destination address using the device discovery packet. In the operation information acquisition step,
The failure according to any one of claims 15 to 19 , wherein the acquired operation information having high importance is narrowed down according to a predetermined importance and then transmitted to the analysis device. Analysis method. In the failure analysis step,
Corresponding rule information that associates the content of the operation information with its importance is transmitted to the gateway device in advance,
In the operation information acquisition step,
Acquired failure analysis method according to claim 20 Symbol mounting and transmits to the analysis apparatus having high importance in terms of narrowed down according to the corresponding rule information of the operation information. In the failure analysis step,
Giving importance to the operation information based on the failure analysis result of the device,
The failure analysis method according to claim 21, wherein the correspondence rule information is created using the importance and transmitted to the gateway device. The analysis device includes:
Performing an important information instruction step of adding a mark to what was significant when performing the failure analysis in the failure analysis step in the operation information;
In the failure analysis step,
23. The failure analysis according to claim 22 , wherein the correspondence rule information is generated and transmitted to the gateway device so that the higher the degree of importance of the operation information that is given the mark in the important information instruction step, the higher the importance. Method. The correspondence rule information is
The failure analysis method according to any one of claims 20 to 23 , wherein the degree of importance is lower as the operation information is separated from the failure occurrence time. The analysis device includes:
Executing an operation information requesting step for requesting the operation information to the gateway device;
In the operation information acquisition step,
In accordance with the request of the operation information request step, after narrowing down the high importance of the operation information and transmitted to the analysis device,
When the operation information has already been transmitted,
The failure analysis method according to any one of claims 20 to 24 , wherein operation information having a lower importance than the previously transmitted operation information is transmitted. The analysis device includes:
Performing a recovery request step for requesting the gateway device to attempt to recover the failed device;
In the operation information acquisition step,
After attempting to recover the device requested in the recovery request step,
The failure analysis method according to any one of claims 15 to 25 , wherein operation information of the device is acquired and transmitted to the analysis device. In the operation information acquisition step,
The failure analysis method according to any one of claims 15 to 26 , wherein a list of processes operating in the device, a log of the processes, or both of them is acquired as the operation information. In the operation information acquisition step,
The failure analysis method according to any one of claims 15 to 27 , wherein when the operation information is acquired, individual identification information of the device is acquired and included in the operation information.

Images