JP5597757B1 - Determination apparatus, determination method, and computer program - Google Patents

Abstract

To detect a failure occurring in a network more accurately.
Information relating to communication with a plurality of communication devices connected to the target device is acquired from a target device that relays connection to the network, and the total number of communication devices connected to the target device The occurrence of a failure is determined based on the number of new connections that is the number of communication devices newly connected to the target device within a predetermined time and a predetermined condition.
[Selection] Figure 4

Description

  The present invention relates to a monitoring technique for a communication device connected to a network.

  Conventionally, a monitoring system for monitoring a communication device connected to a network has been proposed (see, for example, Patent Document 1). In such a monitoring system, an alarm is generally output from a communication device in which a failure has occurred, so that a network service provider who is monitoring can grasp the failure of the communication device. Therefore, the network service provider can immediately respond to the failure of the communication device.

JP 2012-074867 A

  However, when an unexpected session disconnection occurs in the Internet communication, the conventional monitoring system has a problem that the failure cannot be detected. For this reason, a failure of the communication device may be left for a long time. As a result, there is a possibility that the network service provider may know that there is a failure by an inquiry from the network service user. When such a problem occurs, there is a possibility that the trust from the user is also lowered.

  In view of the above circumstances, an object of the present invention is to provide a technique for detecting a failure occurring in a network with higher accuracy.

According to one aspect of the present invention, an acquisition unit that acquires information about communication with a plurality of communication devices connected to the target device from a target device that relays connection to a network, and the target device are connected A determination unit that determines the occurrence of a failure based on the total number of connections that is the total number of communication devices, the number of new connections that is the number of communication devices that are newly connected to the target device within a predetermined time, and a predetermined condition; , wherein the determination unit is a the total connections reduces the number of the threshold or more, and wherein when the new number of connections is less than the threshold value, a determination device you determines that a failure has occurred.

According to one aspect of the present invention, an acquisition unit that acquires information about communication with a plurality of communication devices connected to the target device from a target device that relays connection to a network, and the target device are connected A determination unit that determines the occurrence of a failure based on the total number of connections that is the total number of communication devices, the number of new connections that is the number of communication devices that are newly connected to the target device within a predetermined time, and a predetermined condition; , wherein the determination unit, the less than reduction in the number of total connections threshold, and wherein when the new number of connections is not less than the threshold value, a determination device you determines that a failure has occurred.

According to one aspect of the present invention, an acquisition step of acquiring information related to communication with a plurality of communication devices connected to the target device from a target device that relays connection to a network, and connection to the target device A determination step of determining the occurrence of a failure based on a total number of connections that is the total number of communication devices, a new number of connections that is the number of communication devices newly connected to the target device within a predetermined time, and a predetermined condition; , have a, in the determination step, it is the total connections reduces the number of the threshold or more, and wherein when the new number of connections is less than the threshold value, a determination method for determining that a failure has occurred.
According to one aspect of the present invention, an acquisition step of acquiring information related to communication with a plurality of communication devices connected to the target device from a target device that relays connection to a network, and connection to the target device A determination step of determining the occurrence of a failure based on a total number of connections that is the total number of communication devices, a new number of connections that is the number of communication devices newly connected to the target device within a predetermined time, and a predetermined condition; In the determination step, it is determined that a failure has occurred when the decrease in the total number of connections is less than a threshold and the number of new connections is greater than or equal to the threshold.

According to one aspect of the present invention, an acquisition step of acquiring information related to communication with a plurality of communication devices connected to the target device from a target device that relays connection to a network, and connection to the target device A determination step of determining the occurrence of a failure based on a total number of connections that is the total number of communication devices, a new number of connections that is the number of communication devices newly connected to the target device within a predetermined time, and a predetermined condition; , cause the computer to execute, in the determination step, it is the total connections reduces the number of the threshold or more, and wherein when the new number of connections is less than the threshold value, because the computer program is determined that a failure has occurred It is.
According to one aspect of the present invention, an acquisition step of acquiring information related to communication with a plurality of communication devices connected to the target device from a target device that relays connection to a network, and connection to the target device A determination step of determining the occurrence of a failure based on a total number of connections that is the total number of communication devices, a new number of connections that is the number of communication devices newly connected to the target device within a predetermined time, and a predetermined condition; A computer program for causing the computer to determine that a failure has occurred when the decrease in the total number of connections is less than a threshold and the number of new connections is greater than or equal to the threshold in the determination step. is there.

  According to the present invention, it is possible to detect a failure occurring in a network with higher accuracy.

It is a figure which shows the system configuration | structure of the monitoring system 1 in this invention. 3 is a schematic block diagram illustrating a functional configuration of a determination device 20. FIG. It is a figure showing transition of the session information which the determination apparatus 20 acquires. It is a conceptual diagram regarding the judgment criterion of failure occurrence. It is a flowchart which shows the flow of a process of the determination apparatus 20 of this invention.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram showing a system configuration of a monitoring system 1 according to the present invention. The monitoring system 1 of the present invention includes a plurality of target devices 10-1 to 10-N (N is an integer equal to or greater than 1), a determination device 20, and an operator terminal 30. The target devices 10-1 to 10 -N, the determination device 20, and the operator terminal 30 are connected to each other via a network 40 so as to communicate with each other. In the following description, the target devices 10-1 to 10-N will be described as the target device 10 unless otherwise distinguished.

  The target device 10 is a device that manages a session between a relay device (not shown, the same applies hereinafter) connected to the own device (target device 10) and the own device (target device 10). Each target device 10 is connected to a plurality of relay devices (communication devices) (for example, thousands). The relay device is, for example, a broadband router (for example, a home gateway device) used in the home. The target device 10 and the relay device communicate using PPPoE (Point to Point Protocol over Ethernet (registered trademark)).

The determination device 20 periodically acquires information related to communication with a plurality of communication devices connected to the target device from each target device 10, and notifies the operator terminal 30 based on the acquired information.
The operator terminal 30 is configured using an information processing device such as a personal computer. The operator terminal 30 displays the information notified from the determination device 20 on the screen.
The network 40 may be a network configured in any way. For example, the network 40 may be configured using NGN (Next Generation Network).

  FIG. 2 is a schematic block diagram illustrating a functional configuration of the determination device 20. The determination device 20 includes a CPU (Central Processing Unit), a memory, an auxiliary storage device, and the like connected by a bus, and executes a determination program. By executing the determination program, the determination apparatus 20 functions as an apparatus including an acquisition unit 201, a session information storage unit 202, a determination unit 203, and a notification unit 204. Note that all or part of each function of the determination device 20 may be realized by using hardware such as an application specific integrated circuit (ASIC), a programmable logic device (PLD), or a field programmable gate array (FPGA). The determination program may be recorded on a computer-readable recording medium. The computer-readable recording medium is, for example, a portable medium such as a flexible disk, a magneto-optical disk, a ROM, a CD-ROM, or a storage device such as a hard disk built in the computer system. Further, the determination program may be transmitted / received via a telecommunication line.

The acquisition unit 201 acquires information (hereinafter referred to as “session information”) related to a session between the target device 10 and the relay device periodically (for example, every hour). The session information is, for example, the total number of sessions and session time. The total number of sessions is the total number of sessions established for the target device 10 in order for each relay device to connect to the network 40. The session time is a time during which each session is continuously established. The acquisition unit 201 records the acquired session information in the session information storage unit 202.
The session information storage unit 202 is configured using a storage device such as a magnetic hard disk device or a semiconductor storage device. The session information storage unit 202 stores session information acquired by the acquisition unit 201.

  The determination unit 203 determines whether a predetermined condition is satisfied based on the session information stored in the session information storage unit 202. As a specific example of the predetermined condition, for example, the number of sessions (hereinafter referred to as “the number of new sessions”) in which the decrease in the total number of sessions is equal to or greater than a threshold and the session time is within a predetermined time (for example, 1 hour). ) Is less than the threshold value. Another specific example of the predetermined condition is that the total number of sessions is less than the threshold and the number of new sessions is greater than or equal to the threshold. The determination unit 203 determines that a failure (abnormality) has occurred when a predetermined condition is satisfied.

  The notification unit 204 notifies the operator terminal 30 that a failure has occurred according to the determination result of the determination unit 203. For example, when the determination unit 203 determines that a predetermined condition is satisfied, the notification unit 204 notifies the operator terminal 30. On the other hand, when the determination unit 203 determines that the predetermined condition is not satisfied, the notification unit 204 does not perform notification.

FIG. 3 is a diagram illustrating the transition of the session information acquired by the determination device 20.
In FIG. 3, the vertical axis represents the number of sessions, and the horizontal axis represents time t. FIG. 3 shows the transition of session information acquired by the acquisition unit 201 every hour from 0:00 to 23:00. “Ses” represents the total number of sessions. A plurality of line graphs 50 represented by lines corresponding to “Ses” represent the transition of the total number of sessions for each target device 10. “New” represents the number of sessions newly established in the network 40 within one hour (the number of new sessions). A plurality of line graphs 60 represented by lines corresponding to “New” represent the transition of the number of new sessions for each target device 10.

  As shown in FIG. 3, in the line graph 50, although the total number of sessions increases or decreases every hour, a rapid change is not seen. On the other hand, in the line graph 60, it changes abruptly from 3 o'clock to 5 o'clock (inside the circle 70). More specifically, in the line graph 60, the number increases rapidly from 3 o'clock to 4 o'clock and decreases rapidly from 4 o'clock to 5 o'clock. An image 80 in FIG. 3 is an enlarged view around the time at which the line graph 60 changes rapidly. A sudden change in the number of new sessions shown in the image 80 is that many sessions between the target device 10 and the relay device are disconnected due to an instantaneous failure at about 3 o'clock, and the disconnected target device 10 and the relay device are disconnected. This means that many new sessions have been established.

FIG. 4 is a conceptual diagram relating to a criterion for determining the occurrence of a failure. Hereinafter, a determination criterion for determining that a failure has occurred will be described in detail with reference to FIG.
The transition line 90 (90-a, 90-b) represents the transition of the total number of sessions per hour. That is, the transition line 90 corresponds to the line graph 50 in FIG. The transition line 91 (91-a, 91-b) represents the transition of the number of sessions with the session time within one hour (the number of sessions newly established within one hour). That is, the transition line 91 corresponds to the line graph 60 in FIG.

First, FIG. 4A will be described.
When a sudden decrease occurs in the total number of sessions as in the transition line 90-a and a rapid increase does not occur in the number of new sessions as in the transition line 91-a, many sessions are disconnected due to the occurrence of a failure, It is assumed that the relay device could not reestablish the session for a long time. In order to detect such a failure, the determination device 20 determines that a failure has occurred when the decrease in the total number of sessions is equal to or greater than the threshold and the number of new sessions is less than the threshold.

Next, FIG. 4B will be described.
When there is no sudden decrease in the total number of sessions as in the transition line 90-b and there is a rapid increase in the number of new sessions as in the transition line 91-b, many sessions are disconnected due to the occurrence of a failure. It is assumed that the relay apparatus was able to re-establish the session within a short time thereafter. In order to detect such a failure that has occurred in a short time, the determination apparatus determines that a failure has occurred when the decrease in the total number of sessions is less than the threshold and the number of new sessions is greater than or equal to the threshold.

FIG. 5 is a flowchart showing the flow of processing of the determination apparatus 20 of the present invention.
The acquisition unit 201 periodically acquires session information from the target device 10 and records the acquired session information in the session information storage unit 202 (step S101). The determination unit 203 refers to the acquired session information and determines whether or not the total number of sessions (total number of sessions) is equal to or greater than a predetermined value (for example, 100) (step S102). If the total number of sessions is less than the predetermined value (step S102—NO), the determination device 20 ends the process. On the other hand, when the total number of sessions is equal to or greater than a predetermined value (step S102—YES), the determination unit 203 determines whether a predetermined condition is satisfied (step S103).

When the predetermined condition is satisfied (step S103—YES), the determination unit 203 determines that there is an abnormality (step S104). Thereafter, the determination unit 203 outputs the determination result to the notification unit 204. At this time, the determination unit 203 outputs identification information (for example, an IP address, a host name, etc.) for identifying a target device in which a failure has occurred to the notification unit 204. Further, the determination unit 203 may output information indicating which condition among the plurality of conditions is satisfied to the notification unit 204. The notification unit 204 performs notification indicating that a failure has occurred in the operator terminal 30 based on the determination result (step S105). Thereafter, the determination device 20 ends the process.
In the process of step S103, when the predetermined condition is not satisfied (step S103-NO), the determination unit 203 determines that there is no abnormality (step S106). Thereafter, the determination device 20 ends the process. The determination device 20 executes the above processing at a predetermined timing.

  In the monitoring system 1 configured as described above, whether or not a failure has occurred in the session between the target device 10 connected to the network 40 and the relay device based on the session information acquired from the target device 10. Can be determined. Specifically, the determination device 20 repeatedly collects session information from the target device 10 and determines whether or not a predetermined condition is satisfied according to the transition of the number of sessions and the connection time of the session. Thereafter, when the determination device 20 detects the occurrence of a failure, the determination device 20 notifies the operator terminal 30 of a notification to that effect. As a result, the operator who operates the operator terminal 30 can immediately identify the target device 10 in which the failure has occurred and respond to it. Therefore, it becomes possible to detect a failure (abnormality) of a device connected to the network. As a result, it is possible to reduce the influence of the device failure on the user of the network service and to promptly respond after the fact.

  In addition, when an instantaneous failure occurs, there is a case where the occurrence of the failure cannot be detected because the total number of sessions hardly changes. In response to such a problem, the determination device 20 detects the failure based on the condition that the decrease in the total number of sessions is less than the threshold and the number of new sessions is greater than or equal to the threshold. It becomes possible to detect with high accuracy.

<Modification>
The predetermined condition is not necessarily limited to the above-described condition. For example, the predetermined condition may be a condition based on the ratio of the number of Internet communication subscribers to the number of sessions. In this case, the following processing is performed. Each time the determination device 20 acquires session information, the determination device 20 compares the number of Internet communication subscribers with the total number of sessions. As a result of the comparison, the determination device 20 determines that a failure has occurred in the session between the relay device and the target device 10 when the ratio of the total number of sessions to the number of contractors is equal to or less than a preset threshold value. Then, the determination device 20 notifies the operator terminal 30 that a failure has occurred in the session.

The predetermined condition may be that the decrease in the total number of sessions is greater than or equal to a threshold value. Further, the predetermined condition may be that the number of new sessions is equal to or greater than a threshold value.
The determination device 20 may notify the operator terminal 30 that no failure has occurred when it is determined that no failure has occurred.

  The total number of sessions and the number of new sessions may be simply expressed as the number of sessions or may be expressed as a variation rate. The fluctuation rate of the total number of sessions is an index representing the magnitude of fluctuation of the total number of sessions. For example, the variation rate of the total number of sessions may be obtained by dividing the difference between the total number of sessions at time t and the total number of sessions at time t−1 by the total number of sessions at time t. The fluctuation rate of the number of new sessions is an index representing the size of the number of new sessions. For example, the variation rate of the number of new sessions may be obtained by dividing the number of new sessions at time t by the total number of sessions at time t.

  In the present embodiment, a configuration has been described in which the occurrence of a failure is detected based on session information in communication using IPv4 (Internet Protocol Version 4). However, the present invention is not limited to this. For example, the occurrence of a failure may be detected by performing the same processing in communication using IPv6 (Internet Protocol Version 6). Further, the occurrence of a similar failure may be detected by other processing.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes designs and the like that do not depart from the gist of the present invention.

10 (10-1 to 10-N): target device, 20: determination device, 30 ... operator terminal, 40 ... network, 201 ... acquisition unit, 202 ... session information storage unit, 203 ... determination unit, 204 ... notification unit

Claims (6)

An acquisition unit that acquires information related to communication with a plurality of communication devices connected to the target device from a target device that relays connection to the network;
Based on a predetermined condition, the total number of connections that is the total number of communication devices connected to the target device, the number of new connections that are the number of communication devices newly connected to the target device within a predetermined time, and a predetermined condition A determination unit for determining occurrence of
With
The determination unit is a the total connections reduces the number of the threshold or more, and wherein when the new number of connections is less than the threshold value, determine the constant device you determines that a failure has occurred. An acquisition unit that acquires information related to communication with a plurality of communication devices connected to the target device from a target device that relays connection to the network;
Based on a predetermined condition, the total number of connections that is the total number of communication devices connected to the target device, the number of new connections that are the number of communication devices newly connected to the target device within a predetermined time, and a predetermined condition A determination unit for determining occurrence of
With
The determination unit, the less than total connections reduces the number of thresholds, and, wherein when the new number of connections is not less than the threshold value, determine the constant device you determines that a failure has occurred. An acquisition step of acquiring information related to communication with a plurality of communication devices connected to the target device from a target device that relays connection to the network;
Based on a predetermined condition, the total number of connections that is the total number of communication devices connected to the target device, the number of new connections that are the number of communication devices newly connected to the target device within a predetermined time, and a predetermined condition A determination step of determining occurrence of
I have a,
In the determination step, the determination method of reducing the number of the total connections is not less than the threshold value, and wherein when the new number of connections is less than the threshold value, determining that a failure has occurred. An acquisition step of acquiring information related to communication with a plurality of communication devices connected to the target device from a target device that relays connection to the network;
Based on a predetermined condition, the total number of connections that is the total number of communication devices connected to the target device, the number of new connections that are the number of communication devices newly connected to the target device within a predetermined time, and a predetermined condition A determination step of determining occurrence of
I have a,
In the determination step, the determination method of reducing the number of the total connections is less than the threshold value, and wherein when the new number of connections is not less than the threshold value, determining that a failure has occurred. An acquisition step of acquiring information related to communication with a plurality of communication devices connected to the target device from a target device that relays connection to the network;
Based on a predetermined condition, the total number of connections that is the total number of communication devices connected to the target device, the number of new connections that are the number of communication devices newly connected to the target device within a predetermined time, and a predetermined condition A determination step of determining occurrence of
To the computer ,
Wherein in the determination step, it is the total connections reduces the number of the threshold or more, and wherein when the new number of connections is less than the threshold value, because the computer program is determined to have failed. An acquisition step of acquiring information related to communication with a plurality of communication devices connected to the target device from a target device that relays connection to the network;
Based on a predetermined condition, the total number of connections that is the total number of communication devices connected to the target device, the number of new connections that are the number of communication devices newly connected to the target device within a predetermined time, and a predetermined condition A determination step of determining occurrence of
To the computer ,
Wherein in the determination step, the less than reduction in the number of total connections threshold, and wherein when the new number of connections is equal to or more than the threshold, because the computer program is determined to have failed.

Images