JP5458644B2 - Large-scale network monitoring method - Google Patents

Description

  The present invention relates to a large-scale network monitoring method, and is particularly suitable for monitoring the state of a logical line of a private network constructed on a network provided by a communication carrier such as wide area Ethernet (registered trademark).

  In conventional network monitoring, it is assumed that the user himself / herself configures the network and monitors the configuration of the network, and therefore each router in the network is monitored by a network monitoring device (NMS: Network Management System). By monitoring the life and death of (R: Router), we were able to grasp the communication status between each node.

FIG. 12 is a connection configuration diagram of a normal network monitoring model. Here, the NMS 1, the network 2, and each node 1 (3 ₁ ) to node N (3 _N ) are all in the carrier network, and the user himself / herself uses the NMS 1 to be a router that is a monitored device in the network 2. (R1 to R9) are monitored. For example, if R4 in the network provided by the carrier is down when viewed from NMS1, it can be determined that communication between node 2 (3 ₂ ) and node 3 (3 ₃ ) is not possible.

  The network model targeted by the present invention is that the network is provided by a carrier, and the user does not know the equipment and connection configuration inside the network (carrier network). Between each node of a user, a secure communication between nodes is performed by setting a logical line such as a virtual private network (VPN) technology through a carrier network.

  FIG. 13 is a connection configuration diagram of a state monitoring model of a network logical line targeted by the present invention.

As the NMS 1, the communication between the node 1 (3 ₁ ) and the node N (3 _N ), for example, the node 1 (3 ₁ ), as well as the life and death monitoring of each node 1 (3 ₁ ) to the node N (3 _N ) of the user. And the communication between the node 2 (3 ₂ ) and the like) must be monitored.

However, since the NMS 1 on the user side does not know the configuration in the network as in normal network monitoring, the conventional method (node 1 (3 ₁ ) is determined by checking which network device in the network is faulty. (How to determine which communication between nodes N (3 _N ) is affected) cannot be used.

Therefore, node 1 (3 ₁₎ for _~ node N (3 _N) of communication between the monitoring monitors the state of the logical line, node 1 (3 ₁ a logical line is connected by the logical lines After down ) To node N (3 _N ) must be determined to be down. Even in this case, if the logical line between the NMS 1 and the node 1 (3 ₁ ) to the node N (3 _N ) is alive, ping monitoring from the node 1 (3 ₁ ) to the node N (3 _N ), etc. Since this becomes normal, it cannot be substituted for the life / death monitoring of the node 1 (3 ₁ ) to the node N (3 _N ).

In consideration of the above, since it is necessary to set the logical line one-to-one, in order to communicate between all the nodes 1 (3 ₁ ) to N (3 _N ) of the user, It is necessary to set up a logical line between nodes.

For this reason, in the case of a nationwide large-scale user network, the number of logical lines becomes very large. In order to monitor this by the NMS 1, it is necessary to access all the node 1 (3 ₁ ) to node N (3 _N ) and acquire the state of all the logical lines. For this reason, a very large amount of data and a large amount of traffic are required for monitoring.

  FIG. 14 is an explanatory diagram showing a monitoring state of the logical line in FIG. As shown in the figure, in order to monitor the state of a logical line, it is necessary to access tens of thousands of nodes and collect data in the state of tens of thousands × tens of thousands. However, network device life / death monitoring can be handled by grouping according to the actual physical network configuration and monitoring only the parent node or only one device. However, since monitoring of logical lines depends on configuration information in a carrier network that is not generally disclosed, grouping and setting of a parent node according to a physical network configuration cannot be performed.

  FIG. 15 is a relay connection diagram showing a communication state between terminal nodes in a carrier network that is not disclosed. As shown in FIG. 15, the configuration information in the carrier network is not disclosed, and the configuration in the carrier network is in a temporary state due to a trace route command or the like and is changed for convenience on the carrier side. Network device configuration is not guaranteed.

  As a status monitoring method for hierarchical data processing devices, for example, there is a monitoring unit that performs hierarchical monitoring of the monitoring target unit for each priority order, and the monitoring content is monitored by increasing the monitoring priority of the monitoring target unit Is disclosed. (For example, refer to Patent Document 1).

  As a network management system for displaying and managing a network component map, contents for grouping component elements, generating a hierarchical map, and automatically laying out are disclosed by determining the identity of parameter types. (For example, refer to Patent Document 2).

Japanese Patent Laid-Open No. 08-265395 Japanese Unexamined Patent Publication No. 07-312596

  In a large-scale private network constructed using a technology such as a virtual private network (VPN) on a network provided by a communication carrier such as a wide area Internet, the network monitoring system (NMS) can monitor the life and death of network devices, In order to monitor the line, since the network is provided by the carrier, the user (NMS) is in a state where neither the equipment inside the network nor the connection configuration is known and cannot be solved by the technology on the extension line of the prior art.

  In Patent Document 1, a state monitoring method for a data processing apparatus including a plurality of monitoring target units provided in a hierarchy from the upper level to the lower level, the priority order of the monitoring target units is simply provided. It is not an invention for dealing with a failure at the time.

  Patent Document 2 is a monitoring network map that is customized by grouping components in a network management system, and is not an invention for dealing with priorities when a failure occurs.

The purpose of the present invention is to
(1). Large-scale network that enables monitoring of the status of all logical circuits by accessing some nodes without accessing all nodes based on information independent of physical network configuration (number of occurrence alarms) Provide a monitoring method.
(2) To provide a large-scale private network monitoring method capable of dynamically changing a logical line monitoring configuration.

A first invention for solving the above-described problem is to divide a plurality of nodes that perform communication by setting a logical line of a network through a carrier network into a plurality of group units, and one node per group unit. A first step of setting a representative node; a second step of accessing each of the representative nodes from a network monitoring device to acquire a logical line state of the logical line from all the opposed nodes from the representative node; Whether or not the logical line state abnormality and normality are mixed depending on whether or not the communication with the opposite node can be performed by checking all the logical line states acquired by each representative node to determine, when a normal are mixed with the logic circuit status is abnormal, the direct access to the node that has become abnormal from the network monitoring device If the logical line state with all the opposing nodes is acquired from the normal node and the abnormal node cannot be directly accessed from the network monitoring device, the abnormal state is obtained via another node. said third step that Tokusu preparative logic circuit status of nodes, wherein a case where the logic normal line conditions and abnormal are not mixed in the case of the logic circuit status of all abnormal, the opposing node itself abnormal A fifth step for determining that the logical line state is not abnormal and normal, and a fifth step for determining that the opposing node itself is normal when the logical line states are all normal; sequentially for all the opposing node, the third step to be performed repeatedly the fifth step of the node in the carrier network And a step of determining the state of the logical line Te.

  According to the first aspect of the present invention, it is possible to monitor the status of all logical lines by accessing some nodes without accessing all nodes for status monitoring of a large-scale private network.

According to a second aspect of the present invention, a plurality of nodes that perform communication by setting a logical line of a network through a carrier network are divided into a plurality of group units, and one of the nodes is set as a node of priority 1 in the group unit And a second step of accessing each of the priority level 1 nodes from the network monitoring device and acquiring the logical line failure frequency value of the logical line with all the opposing nodes from the priority level 1 node. And a third step of regrouping a group unit of quality level from a small unit to a large unit according to the magnitude of the logical line failure frequency value acquired in the second step, and a plurality of the nodes A fourth step of setting one of the nodes in the new group recombined from the small unit to the large unit to a new priority of 1, and the network; Get the logic circuit status with all of the opposing node by accessing the new priority 1 node than click monitoring device from the new priority 1 nodes, ready to do state that can not communicate with the opposite node Therefore, if the logical line state acquired in the fifth step is mixed with abnormality and normality, the network monitoring is performed. direct access to the node that has become the abnormality device acquires the logical line state, if not directly accessible to the node that has become the abnormality from the network monitoring device had the abnormality via another node node der If the sixth step that Tokusu preparative logic circuit status, normal and said logic circuit status obtained in the fifth step is abnormal are not mixed The case logic line conditions of all abnormal, a case where the opposing node itself abnormal and seventh determining, the fifth said logic circuit status acquired in step normal and abnormal not mixed, When the logical line states are all normal, the eighth step for determining that the opposing node itself is normal and the sixth step to the eighth step are sequentially repeated for all the opposing nodes. And a ninth step of determining the status of all logical lines of the node in the carrier network .

  According to the second aspect of the present invention, a logical line failure between nodes in the past is detected at a long interval such as once per hour for detecting a failure in a logical line between nodes that have not been accessed due to the priority setting method. The number of times can be collected from all nodes, and the priority can be set according to the quality level.

  As described above, according to the disclosed technology, it is possible to monitor the status of all logical lines by accessing a part of the nodes without accessing the nodes for monitoring the status of a large-scale network. In addition, it is possible to determine whether the network device is alive or dead.

It is explanatory drawing (the 1) which shows the monitoring method of the network in one Embodiment of this invention. It is explanatory drawing (the 2) which shows the monitoring method of the network in one Embodiment of this invention. It is explanatory drawing (the 3) which shows the monitoring method of the network in one Embodiment of this invention. It is explanatory drawing (the 4) which shows the monitoring method of the network in one Embodiment of this invention. It is a flowchart of the state monitoring of the logical line in one Embodiment of this invention. It is explanatory drawing (the 1) which shows the priority setting method of the logical line in one Embodiment of this invention. It is explanatory drawing (the 2) which shows the priority setting method of the logical line in one Embodiment of this invention. It is explanatory drawing (the 3) which shows the priority setting method of the logical line in one Embodiment of this invention. It is explanatory drawing (the 4) which shows the priority setting method of the logical line in one Embodiment of this invention. It is explanatory drawing (the 5) which shows the priority setting method of the logical line in one Embodiment of this invention. It is a flowchart of the priority setting method of the logical line in one Embodiment of this invention. It is a connection block diagram of a normal network monitoring model. It is a connection block diagram of the state monitoring model of the network logical line targeted by the present invention. It is explanatory drawing which shows the data collection of the logical line in FIG. It is a relay connection diagram showing the communication status between terminal nodes in a carrier network that is not disclosed.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is an explanatory diagram (part 1) illustrating a network monitoring method according to an embodiment of the present invention, and shows information contents collected from a node by a network monitoring device (NMS).

  Hereinafter, a router owned by a carrier is referred to as a network element (NE), and a router connecting a base and others is referred to as a node (router) to distinguish them from others. In this example, the NMS accesses the node with priority 1 (representative) and acquires the logical line state with all the opposing nodes. As a result, node 1, node 6 and node 11 are selected, and the monitoring result of the logical line with the opposite node (node 1 to node N) is shown. ○ indicates normal, x indicates abnormal.

  FIG. 2 is an explanatory diagram (part 2) illustrating the network monitoring method according to the embodiment of the present invention, and is a diagram illustrating evaluation by the evaluation logic 1 on the state of the logical line connected to the node 12.

  The evaluation logic 1 is the logical circuit information of the opposite node collected at the priority 1 node. When normality and abnormality are mixed (in the example of FIG. 2, in the case of the node 12), the NMS directly collects the status of the node. To collect the logical line status.

If the NMS and the logical line of the node are disconnected and communication is impossible, the logical line state of the corresponding node is collected via another node. (In the example of FIG. 2, status collection is performed via node 1 or the like in which the logical line status with the node 12 is normal.)
As a result, a state in which an abnormality has been found by monitoring the logical lines from the node 12 to the opposite node 6, the node 7, and the node 8 is shown.

  FIG. 3 is an explanatory diagram (part 3) illustrating the network monitoring method according to the embodiment of the present invention, in which the evaluation logic 2 evaluates the state of the logical line connected to the node 7. The evaluation logic 2 is the logical circuit information of the opposite node collected by the priority level 1 node. If all of them are abnormal (disconnected) (in the case of the node 7 in FIG. 3), a failure has occurred in that node or access line. Therefore, all the logical lines to be connected are also judged to be abnormal (disconnected). In the example of FIG. 3, the node 7 is abnormal (disconnected) in the information collection of the nodes 1, 6, and 11, and therefore all logical lines connected to the node 7 are determined to be abnormal (disconnected).

  FIG. 4 is an explanatory diagram (part 4) illustrating the network monitoring method according to the embodiment of the present invention, and is a diagram illustrating evaluation by the evaluation logic 3 on the state of the logical line connected to another node.

  The evaluation logic 3 is the logical circuit information of the opposite node collected by the priority level 1 node, and when all are normal (in the case other than the nodes 7 and 12 in FIG. 4), all the logical lines connected to the opposite node are normal. Judge. In the example of FIG. 4, all the nodes other than the nodes 7 and 12 are normal in the information collection of the nodes 1, 6, and 11. Therefore, it is determined that all the logical lines to be connected are normal.

  Using the evaluation logic 1 to the evaluation logic 3 described above, the state of the logical lines is evaluated in the order of the evaluation logic 1 → the evaluation logic 2 → the evaluation logic 3 to determine the states of all the logical lines.

  FIG. 5 is a flowchart of logical line status monitoring according to an embodiment of the present invention, which is an implementation means for displaying a result in a portion that repeatedly operates for a short period (for example, every 10 seconds).

  The operation for monitoring the state of the logical line will be described below with reference to FIGS.

  S1. Prioritization is performed logically (priority setting method according to the quality level of a logical line described later) based on information (number of occurrence alarms) independent of the physical network configuration.

  Since there is no prioritization for the first time, a group is grouped at a quality level of 3 (in units of 5), and one of them is set as priority 1. As a result, node 1, node 6, and node 11 have a priority of 1.

  When the status of the logical lines is monitored in order within the group, the first time is a group of 5 units, but a review is made in a long cycle, and if there are no faults, the number of units in one group is large. If it becomes long and there is a failure, the number of one group is small and the cycle becomes short.

  S2. The logical line states of all the opposing nodes are acquired from all the nodes with priority 1. As a result, the information shown in FIG. 1 was obtained. That is, when the node 1, the node 6 and the node 11 are accessed and the logical line of the opposite node is monitored, the logical line state with the node 7 is all bad, and the logical line state with the node 12 is partly. It indicates that it is defective.

  Thereafter, the following processing is performed for all nodes. That is, the state for each node is determined from the logical line monitoring (vertical axis) of the corresponding node shown in FIG. 1, and the result is determined.

S3. It is determined whether normality and abnormality are mixed in the information collected in S2 described above. (Logic logic 1)
S4. If normal and abnormal are not mixed in S3 described above (except for node 12), it is determined whether or not all the states collected in S2 are abnormal. (Logic logic 2)
S5. In S4 described above, when all are not abnormal (except for nodes 7 and 12), it is determined that all logical lines connected to the corresponding node are normal. (Logic logic 3)
S6. In S4 described above, if all are abnormal (node 7 corresponds), all logical lines connected to the corresponding node are determined to be abnormal.

  S7. In S3 described above, when normal and abnormal are mixed (corresponding to node 12), it is determined whether or not the logical line with the corresponding device is disconnected.

  S8. In S7 described above, if it is not a disconnection, the logical line states of the corresponding node are directly collected.

  S9. In the case of disconnection at S7 described above, the logical line status of the corresponding node is collected via another node.

  Hereinafter, when the processing for all the nodes is completed, the above-described S6 and S7 are displayed as failures.

  As described above, as a problem in the logical line state monitoring method described above, it is difficult to detect a failure in a logical line between nodes that is not an access target due to the way of assigning priorities. As a response to this case, the number of logical line failures between past nodes is collected from all nodes at a long interval such as once an hour, and the priority is set according to the quality level.

  FIG. 6 is an explanatory diagram (part 1) of the logical line priority setting method according to the embodiment of the present invention, and shows the monitoring of the logical line state at the initial stage.

  As an initial setting, priorities are assigned to randomly extracted nodes. In this example, similarly to FIG. 1, node 1, node 6, and node 11 are selected, and the monitoring result of the logical line with the opposite node (node 1 to node N) is shown. ○ indicates normal, x indicates abnormal.

  FIG. 7 is an explanatory diagram (part 2) illustrating the logical line priority setting method according to the embodiment of the present invention, and illustrates the first logical line failure frequency collection result.

  In addition to collecting the status of logical lines with limited access targets at short intervals, NMS is the number of logical line failures between all nodes per node at long intervals (once every hour). And set the following quality levels.

  Quality level 1 is the lowest number of logical line failures between the nodes in the current cycle, and there is no problem, and priority 1 is assigned to one of the nodes in a large scale (for example, 100 units). Set.

  For quality level 2, the number of logical line failures between the nodes in the current cycle is less than the threshold, and the number of logical line failures between the nodes in the current cycle is reduced compared to the number of logical line failures between the nodes in the previous cycle. The priority level 1 is set for one of the nodes that are being improved and are in the middle scale (for example, 50). Note that the threshold is determined by the network level.

  In quality level 3, the number of logical line failures between nodes in the current cycle is equal to or less than a threshold value. The number of logical line failures between the nodes in the previous cycle is increasing, and the number of logical line failures between the nodes in the current cycle is increasing. Priority 1 is set for one node. Note that the threshold is determined by the network level.

  In the quality level 4, the number of logical line failures between the nodes in the current cycle is equal to or greater than a threshold value, and priority 1 is set. Note that the threshold is determined by the network level.

  As a result, node 7 is set to quality level 4, nodes 4, 12 and 14 are set to quality level 3, and other nodes are set to quality level 1, and node 1, node 4 and node 7 are set as access points according to the new priority. Determine ...

  FIG. 8 is an explanatory diagram (part 3) illustrating the logical line priority setting method according to the embodiment of the present invention, and shows the setting after the collection is performed once.

  Based on the determination of the access location based on the new priority, the status monitoring of the new logical line is performed by setting priority 1 for each unit in each quality level based on the first logical line failure count collection result. Monitor the line status.

  FIG. 9 is an explanatory diagram (part 4) illustrating the logical line priority setting method according to the embodiment of the present invention, and shows the second logical line failure count totalization result.

  In monitoring the state of a new logical line, node 7, node 4, node 404, node 505, node 3,... Are determined as access locations with further new priorities based on the settings once collected.

  FIG. 10 is an explanatory view (No. 5) showing the logical line priority setting method according to the embodiment of the present invention, and shows the setting after performing the collection twice.

  The status of the new logical line is monitored based on the determination of the access location with further new priority.

  FIG. 11 is a flowchart of a logical line priority setting method according to an embodiment of the present invention, which is a realization means for displaying a result in a portion that repeatedly operates for a long period of time (for example, every hour).

  The operation for monitoring the state of the logical line will be described below with reference to FIGS.

  S10. At the first time, since there is no prioritization, a group of groups is assigned a priority level 1 with a quality level 3 (in units of 5). As a result, node 1, node 6, and node 11 have a priority of 1.

  S11. The number of logical line failures of all opposing nodes is acquired from all the nodes with priority 1. As a result, the number of failures shown in FIG. 7 was obtained.

  Thereafter, the following processing is performed for all nodes. That is, the failure frequency of each node collected from the corresponding node in FIG. 7 is collected for each node, the failure frequency is determined, and the result is determined.

  S12. The one with the lowest number of failures (for example, 10 times or less) is selected.

  S13. It is determined that the quality level is 1, and a group is reorganized on a large scale (for example, in units of 100) by a node of quality level 1.

  S14. Although the number of failures this time is equal to or less than a threshold value (for example, 100 times), a number that is decreasing compared to the previous number of failures (under improvement) is selected.

  S15. It is determined that the quality level is 2, and the group is reorganized in a medium scale (for example, in units of 50) by a node of quality level 2.

  S16. The number of failures this time is equal to or less than a threshold value (for example, 100 times) and increases compared to the previous number of failures (being deteriorated) is selected.

  S17. It is determined that the quality level is 3, and the group is reorganized on a small scale (for example, in units of 5) by the node of quality level 3.

  S18. A fault is selected that has a failure count greater than or equal to a threshold (eg, 100).

  S19. It is determined that the quality level is 4, and the groups are reassembled in units of, for example, one unit according to the quality level 4 node.

  S20. Based on the above results, state monitoring is performed by collecting information in a short cycle in a new group.

  Since the present invention can monitor the state of all logical lines without accessing all nodes, the state of logical lines in a private carrier network can be normally communicated between nodes via a large-scale private network. Can be used for maintenance work.

1 Network monitoring system (NMS)
2 Network (carrier network)
3 _{1 to} 3 _N node 1 to node N

Claims (5)

A first step of dividing a plurality of nodes that perform communication by setting a logical line of a network through a carrier network into a plurality of group units, and setting one of the nodes as a representative node for each group unit;
A second step of accessing each of the representative nodes from a network monitoring device and acquiring the logical line states of the logical lines from all the opposing nodes from the representative node;
For each of the opposing nodes, whether all the logical line states acquired at each representative node are examined and whether communication with the opposite node is disabled or not, whether the logical line state abnormality and normality are mixed If the logical line state is both abnormal and normal, the network monitoring device directly accesses the abnormal node and the abnormal node communicates with all the opposing nodes. Gets the logical line state, a third step wherein when not directly accessible from the network monitoring device to the node that has become the abnormality is that Tokusu preparative said logic circuit status of the node that becomes the abnormality via other nodes When,
A fourth step of determining that the opposite node itself is abnormal when the logical line state is not abnormal and normal, and when the logical line states are all abnormal;
A case in which the logical line state is not abnormal and normal, and if all the logical line states are normal, a fifth step of determining that the opposing node itself is normal;
A step of repeatedly performing the third step to the fifth step sequentially for all the opposing nodes to determine the states of all the logical lines of the nodes in the carrier network ;
A large-scale network monitoring method characterized by comprising: The large-scale network monitoring method according to claim 1,
In the third step, when the logical line state is mixed with the abnormality and the normal state, the network monitoring apparatus acquires the logical line state by directly accessing the abnormal node from the network monitoring apparatus. If it is not possible to directly access the abnormal node from the above, it is set as the representative node, and after that, all the logical circuit states are determined to be normal in the fifth step, and the abnormal state is obtained via the node. A large-scale network monitoring method characterized by acquiring the logical line state of a node. A first step of dividing a plurality of nodes that perform communication by setting a logical line of a network through a carrier network into a plurality of groups, and setting one of the nodes as a node of priority 1 in the group;
A second step of accessing each of the priority 1 nodes from a network monitoring device and acquiring the logical line failure frequency value of the logical line with all the opposing nodes from the priority 1 node;
A third step of regrouping a group unit of quality level from a small unit to a large unit according to the magnitude of the logical line failure frequency value acquired in the second step;
A fourth step of setting one of the nodes in a new group in which a plurality of the nodes are recombined from the small unit to the large unit to a new priority of 1;
It is possible to access the new priority 1 node from the network monitoring device, acquire the logical line state with all the opposite nodes from the new priority 1 node, and make it impossible to communicate with the opposite node. A fifth step of determining whether the abnormality and normality of the logical line state are mixed depending on the state ;
When said fifth the logic circuit status acquired in step normally are mixed abnormal, direct access to the node that has become the abnormality from the network monitoring apparatus obtains the logical line state, from the network monitoring device If you do not have direct access to the abnormal became node, a sixth step that Tokusu preparative said logic circuit status of the node that becomes the abnormality via other nodes,
A seventh step of determining that the opposite node itself is abnormal when the logical line state acquired in the fifth step does not include both abnormal and normal, and when the logical line states are all abnormal;
An eighth step of determining that the opposite node itself is normal when the logical line state acquired in the fifth step does not include both abnormal and normal, and when the logical line states are all normal;
A ninth step of repeatedly performing the sixth step to the eighth step sequentially for all of the opposing nodes to determine the state of all the logical lines of the node in the carrier network ;
A large-scale network monitoring method characterized by comprising: The large-scale network monitoring method according to claim 3,
In the sixth step, when the abnormality and normality coexist, the logical monitoring state is obtained by directly accessing the abnormal node from the network monitoring device, and the abnormal node is obtained from the network monitoring device. If the node is not directly accessible, the node is set to the priority level 1 node, and the logic state of the abnormal node is later passed through the node determined to be normal in the eighth step. A large-scale network monitoring method characterized by acquiring a line state. The large-scale network monitoring method according to claim 3,
The quality level of the third step is set by setting a certain threshold value for the logical line failure frequency value, and the obtained logical line failure frequency value is determined by comparison with the threshold value. A large-scale network monitoring method characterized by distributing the scale from a large scale to a small scale.

Images