JP5327454B2 - Recording system, recording apparatus, recording method, and program - Google Patents

Description

  The present invention relates to a recording system, a recording apparatus, a recording method, and a program for recording the operation status of the apparatus.

  In general, an operator or an engineer analyzes a failure that has occurred on an apparatus or a network based on a simple log output result (for example, Patent Document 1). However, it takes a certain amount of knowledge and experience to know how the problem has actually occurred for operators and engineers. Therefore, a technique for visualizing and displaying the recorded log has been proposed in order to make it easier to grasp the problem even a little (for example, Patent Document 2).

Japanese Patent Laid-Open No. 5-314040 Japanese Patent Laid-Open No. 10-133916

  With the technique described above, it is possible to display recorded logs and generated events on the terminal in time series. However, the log to be recorded is a record of the overall status of the apparatus or the entire network. Therefore, in order to analyze why and how the failure and the event occurred, an expert who had a certain level of knowledge and experience had to check the contents and order of the event and make a judgment. .

  Therefore, a problem to be solved by the present invention is to provide a technique that makes it easy to confirm a failure occurring in an apparatus or a network.

The present invention for solving the above-mentioned problems is a recording system, which records normal operation means for recording the operation status of a monitoring target device and operation contents related to a predetermined event occurring in the monitoring target device. A detailed recording means for recording, a transition recording means for recording a transition of control information used by the monitored device for communication, a transition of the control information, the recorded operation status and an operation content of a predetermined event. Output means for outputting in series, traffic storage means for storing traffic data exchanged by the monitoring target device with other devices, operation contents of a predetermined event recorded by the detailed recording means, and the transition recording means The event that occurred is reproduced using the transition of the control information recorded by the traffic and the traffic data stored by the traffic storage means. And a reproducing means .

The present invention for solving the above-mentioned problems is a recording apparatus, which records normal operation means for recording the operation status of the monitored apparatus, and operation contents related to a predetermined event occurring in the monitored apparatus. A detailed recording means for recording, a transition recording means for recording a transition of control information used by the monitored device for communication, a transition of the control information, the recorded operation status and an operation content of a predetermined event. Output means for outputting in series, traffic storage means for storing traffic data exchanged by the monitoring target device with other devices, operation contents of a predetermined event recorded by the detailed recording means, and the transition recording means The event that occurred is reproduced using the transition of the control information recorded by the traffic data and the traffic data stored by the traffic storage means. And reproduction means .

The present invention for solving the above-described problems is a recording method, which records a normal recording step for recording an operation status of a monitoring target device, and an operation content related to a predetermined event occurring in the monitoring target device. A detailed recording step for recording, a transition recording step for recording a transition of control information used by the monitoring target device for communication, a transition of the control information, the recorded operation status and an operation content of a predetermined event. An output step for outputting in series, a traffic storage step for storing traffic data exchanged by the monitored device with other devices, an operation content of a predetermined event recorded by the detailed recording means, and the transition recording means Using the transition of the control information recorded by the traffic data and the traffic data stored by the traffic storage means. And having a reproduction unit step for reproducing the event.

The present invention for solving the above-described problem is a program, which records a normal recording process for recording an operation status of a monitoring target device and an operation content related to a predetermined event occurring in the monitoring target device. Detailed recording processing, transition recording means for recording a transition of control information used by the monitoring target device for communication, transition of the control information , time series of the recorded operation status and operation contents of a predetermined event Output processing to output , traffic storage processing for storing traffic data exchanged by the monitored device with other devices, operation contents of a predetermined event recorded by the detailed recording means, and the transition recording means The event that occurred is reproduced using the transition of the recorded control information and the traffic data stored by the traffic storage means. Characterized in that to execute the reproduction processing in the information processing apparatus.

  According to the present invention, since the log contents can be recorded in detail, when an event occurs, it is possible to confirm not only the result of the event but also what happened in the process. It becomes possible.

It is a block diagram which shows an example of 1st Embodiment. It is a block diagram which shows an example of 2nd Embodiment.

  A first embodiment of the present invention will be described.

  FIG. 1 is a block diagram of a recording system according to the first embodiment.

  As shown in FIG. 1, the apparatus 100 and a maintenance terminal 200 are included.

  First, the configuration of the apparatus 100 will be described. The device 100 is a device to be monitored, and is a transfer device that transfers traffic data, represented by a router or a switch. The apparatus 100 includes an apparatus state transition information recording unit 1, a specific detailed event log extracting unit 2, a detailed event log selecting unit 3, a log storage time setting unit 4, a setting detailed event log recording unit 5, and a normal log recording. Unit 6, log output unit 7, transfer unit 8, and traffic storage unit 9.

  The apparatus state transition information recording unit 1 accumulates path control information necessary for communication with other apparatuses by transmitting management packets and control packets exchanged between apparatuses and receiving these packets. Based on this accumulated route control information, how is the communication setting and operation state of the own device, such as transmission / reception of route control information, change of route information, and operation contents of each component when these are performed? All state transitions such as whether or not an error has occurred or whether an error has occurred are recorded in detail along with the time of occurrence.

  When the event selected by the specific detail log event selection unit 3 occurs, the specific detailed event log extraction unit 2 extracts a detailed log related to the event. For example, when the selected event is a routing error, a log of lower-level operation contents such as the destination of the routing control information, the subnet mask, the IP address of the adjacent router, the metric value of the routing control information, and the operation contents of each component, Cut out from the log recorded by the device state transition information recording unit 1. Note that the specific detailed event log extraction unit 2 may cut out the detailed log of the selected event at all times, or cut out the log for the time set by the log storage time setting unit 4.

  The specific detailed log event selection unit 3 selects and sets what kind of event is handled as an event for recording the detailed log. It is possible to select the recording of events related to the protocol operated by the apparatus 100 and the recording according to the importance level divided in advance. Further, an event set by the administrator of the apparatus 100 may be selected.

  The log storage time setting unit 4 sets how much time the log is transferred to the maintenance terminal when a specific event selected by the specific detailed log event selection unit 3 occurs.

  The specific detailed event log recording unit 5 records the event log cut out by the specific detailed event log extracting unit 2.

  The normal log recording unit 6 records the operation status of higher-level contents such as the types of events that have occurred, such as errors and warnings, together with the time of occurrence, in time series. The event to be recorded is an event for which detailed log extraction setting is not set.

  The log output unit 7 merges the data recorded by the normal log recording unit 6 and the specific detailed event recording unit 5 and outputs them in chronological order.

  The transfer unit 8 transfers the copy of the state transition recorded by the device state transition information recording unit 1 and the traffic recorded by the traffic recording unit 9 to the maintenance terminal 200.

  The traffic recording unit 9 records information on traffic such as the type, content, and size of traffic exchanged with other devices by the device 100 and transmits a copy to the maintenance terminal. The main traffic may be stored as it is, for example, the traffic storage unit 9 stores the necessary data out of the traffic data transmitted / received between the own device and the adjacent device. Port mirroring or the like may be used to store all traffic data.

  Next, the configuration of the maintenance terminal 200 will be described. The maintenance terminal 200 includes a data storage unit 201 and a display output unit 202. The data storage unit 201 stores state transition information and traffic transmitted from the device 100. The maintenance terminal 200 displays the log output from the apparatus 100 and the transferred data on the display screen. The administrator checks the displayed log and performs maintenance.

  Next, the operation of the present embodiment will be described.

  The device state transition information storage / recording unit 1 records the state transition in the own device in detail, and refers to the data to determine what state the device is in and forward traffic to other devices such as neighboring devices. Or what state it is in when it is received.

  The specific detailed log event selection unit 3 selects an event to be recorded as a detailed log event. In addition, the log storage time setting unit 4 sets how much time the log is transferred to the maintenance terminal.

  With this selection, when the selected specific event occurs, the specific detailed event log extracting unit 2 cuts out a log related to the event from the log recorded by the device state transition information storage recording unit 1. And the specific detailed event log recording part 5 records.

  On the other hand, the normal log recording unit 6 records the minimum necessary information related to the operation status of an unselected event.

  The log output unit 7 merges the log data recorded by the normal log recording unit 6 and the specific detailed event log recording unit 6 and outputs the merged data in time series. When no event is selected as the specific detailed event, the minimum necessary log information is output.

  Further, the transfer unit 8 transfers a copy of the log data recorded by the device state transition information recording unit 1 to the maintenance terminal 20.

  By referring to the log data and traffic from the device 100, the administrator of the device 100 can confirm how and how the traffic is being transferred.

  According to the present invention, a log of a predetermined event can be recorded in detail. Further, since a log of a predetermined event is recorded, there is no need to search for a log of a desired event from among a large number of logs. Therefore, when an event occurs, in addition to the result of the occurrence of the event, it is possible to check a log based on the event such as a process until the event occurs. As a result, data necessary for failure analysis can be confirmed without depending on the knowledge and experience of the administrator.

  Next, a second embodiment will be described. The second embodiment is characterized in that the state at the time of event occurrence is reproduced using the data and log recorded in the first embodiment. In addition, about the structure similar to the said embodiment, the same number is attached | subjected and detailed description is abbreviate | omitted.

  FIG. 2 is a block diagram of the recording system of the present embodiment.

  The reproduction apparatus state transition information storage area 10 is based on the path control information recorded by the apparatus state transition recording unit 1 and the path control information in order to realize a reproduction function for reproducing an event that has occurred in the apparatus 100. A copy of the recorded state transition information is stored. The information stored in the reproduction apparatus state transition information storage area 10 is information transferred by the transfer unit 8. Of the copied data, the data of the event to be reproduced may be stored.

  The reproduction traffic data storage area 11 stores a copy of the traffic data stored by the traffic recording unit 9. The information stored in the reproduction traffic data storage area 11 is information transferred by the transfer unit 8.

  The reproduction processing unit 12 reproduces a situation equivalent to the event occurrence by using the log stored in the reproduction device state transition information storage area 10 and the traffic stored in the reproduction traffic data storage area 11. To do.

  Subsequently, the operation of the present embodiment will be described.

  The reproduction unit state transition information storage area 10 is transferred by the transfer unit 8 with the path control information recorded by the device state transition recording unit 1 and a copy of the state transition information recorded based on the route control information. The

  On the other hand, a copy of the traffic data stored in the traffic recording unit is transferred to the reproduction traffic data storage area 11 by the transfer unit 8.

  The reproduction processing unit 12 reproduces a situation equivalent to the event occurrence by using the log stored in the reproduction device state transition information storage area 10 and the traffic stored in the reproduction traffic data storage area 11. To do.

  In the above embodiment, the case where the playback device state transition information storage area 10, the playback traffic data storage area 11, and the playback processing unit 12 are configured in the maintenance terminal 200 has been described. You may comprise. In that case, the log and traffic stored in the reproduction device state transition information storage area 10 and the reproduction traffic data storage area 11 may be copied from the data stored in the data storage 201 of the maintenance terminal 200. Good.

  According to the present embodiment described above, it is possible to reproduce an event that has occurred in the apparatus. The playback function can re-create the same situation as the event that occurred. Therefore, when any failure occurs, it is possible to reproduce and consider the failure. As a result, the failure can be analyzed by checking the actually reproduced event without depending on the knowledge and experience of the administrator.

  The apparatus and maintenance terminal of the present invention described above can be configured by hardware, as is apparent from the above description, but can also be realized by a computer program. In this case, functions and operations similar to those of the above-described embodiment are realized by a processor that operates according to a program stored in the program memory. Note that some functions of the above-described configuration can be realized by a computer program.

100 device 200 maintenance terminal 1 device state transition information recording unit 2 specific detailed event log extracting unit 3 detailed event log selecting unit 4 log storage time setting unit 5 setting detailed event log recording unit 6 normal log recording unit 7 log output unit 8 transfer unit 9 traffic storage unit 10 playback device state transition information storage area 11 playback traffic data storage area 12 playback processing unit

Claims (7)

Normal recording means for recording the operating status of the device to be monitored;
Detailed recording means for recording operation contents related to a predetermined event occurring in the monitored device;
Transition recording means for recording a transition of control information used by the monitoring target device for communication;
An output means for outputting the transition of the control information in time series with the recorded operation status and the operation content of a predetermined event ;
Traffic storage means for storing traffic data exchanged between the monitored device and other devices;
The generated event is reproduced using the operation content of the predetermined event recorded by the detailed recording unit, the transition of the control information recorded by the transition recording unit, and the traffic data stored by the traffic storage unit. A recording system comprising: a reproducing means for performing the recording. Having a transition recording means for recording a transition of control information used by the monitored device for communication;
The recording system according to claim 1, wherein the output unit outputs the transition of the control information together with the recorded operation status and the operation content of a predetermined event. Normal recording means for recording the operating status of the device to be monitored;
Detailed recording means for recording operation contents related to a predetermined event occurring in the monitored device;
Transition recording means for recording a transition of control information used by the monitoring target device for communication;
An output means for outputting the transition of the control information in time series with the recorded operation status and the operation content of a predetermined event;
Traffic storage means for storing traffic data exchanged between the monitored device and other devices;
The generated event is reproduced using the operation content of the predetermined event recorded by the detailed recording unit, the transition of the control information recorded by the transition recording unit, and the traffic data stored by the traffic storage unit. Reproduction means to
A recording apparatus comprising: Having a transition recording means for recording a transition of control information used by the monitored device for communication;
The output means outputs the transition of the control information together with the recorded operation status and the operation content of a predetermined event.
The recording apparatus according to claim 3. A normal recording step for recording the operating status of the monitored device;
A detailed recording step of recording operation contents related to a predetermined event occurring in the monitored device;
A transition recording step for recording a transition of control information used by the monitoring target device for communication;
An output step for outputting the transition of the control information in time series with the recorded operation status and the operation content of a predetermined event;
A traffic storing step for storing traffic data exchanged between the monitored device and other devices;
The generated event is reproduced using the operation content of the predetermined event recorded by the detailed recording unit, the transition of the control information recorded by the transition recording unit, and the traffic data stored by the traffic storage unit. Reproducible steps to
A recording method characterized by comprising: A transition recording step for recording a transition of control information used by the device to be monitored for communication;
The output step outputs the transition of the control information together with the recorded operation status and the operation content of a predetermined event.
The recording method according to claim 5. A normal recording process that records the operating status of the monitored device;
A detailed recording process for recording operation contents related to a predetermined event occurring in the monitored device;
Transition recording means for recording a transition of control information used by the monitoring target device for communication;
An output process for outputting the transition of the control information in time series with the recorded operation status and the operation content of a predetermined event;
A traffic storage process for storing traffic data exchanged between the monitored device and other devices;
The generated event is reproduced using the operation content of the predetermined event recorded by the detailed recording unit, the transition of the control information recorded by the transition recording unit, and the traffic data stored by the traffic storage unit. Reproduction process and
A program characterized by causing an information processing apparatus to execute.

Images