JP6167867B2 - Load balancing apparatus, method and system - Google Patents

Description

  The present invention relates to a technique for managing events that occur in a network.

  SNMP (Simple Network Management Protocol) is a protocol for monitoring and controlling a device connected to a network (hereinafter referred to as a network device) via the network. In a system using SNMP, a network device transmits a notification called an SNMP trap to a management server that manages the network when the state of the network device changes. The management server can specify what kind of event (for example, a failure) has occurred in the network device based on the data included in the SNMP trap.

  However, as the network becomes larger and the number of network devices increases, the number of SNMP traps received by the management server also increases. As a result, processing of the management server is delayed, and it may be delayed to notify the administrator that an event has occurred. In addition, a part of the SNMP trap may be lost due to an overflow of resources of the management server, and it may not be possible to notify the administrator of the exact state of the network device.

  If a plurality of management servers are provided, the load on the management server can be distributed. However, when a situation occurs in which multiple management servers process multiple SNMP traps that contain the same time stamp, the order in which the events occurred can be accurately identified due to different processing speeds of the management servers. Can not be.

  In the conventional technique, the order in which events occur is managed by the following method. Specifically, history information including time information of the event and a counter value that is incremented when the event occurs is stored. Then, by using the time information and the counter value included in the stored history information, the history information is rearranged in the order of event occurrence.

JP 2002-116929 A

  However, the above technique is based on the premise that a mechanism for managing the counter is prepared. Further, in the above technique, it is not considered to distribute a load such as processing for managing a counter value.

  Accordingly, an object of the present invention, in one aspect, is to provide a technique for processing event data in the order in which the events occurred in a system provided with a plurality of devices for processing event data. .

  The load distribution device according to the present invention includes a receiving unit that receives a notification including a time stamp, and a transmission destination of the received notification from a plurality of information processing devices that store the notifications in a common storage device in the order of reception. A data storage unit that stores a time stamp included in the last received notification, and identification information of the information processing device that is the transmission destination of the last received notification; Have Then, when the time stamp included in the newly received first notification is the same as the time stamp stored in the data storage unit, the determination unit described above determines the transmission destination of the first notification. The information processing device indicated by the identification information stored in the data storage unit is determined.

  In one aspect, in a system provided with a plurality of devices for processing event data, the event data can be processed in the order in which the events occurred.

FIG. 1 is a diagram showing an overview of a system in the present embodiment. FIG. 2 is a functional block diagram of the load distribution apparatus. FIG. 3 is a diagram illustrating an example of data stored in the data storage unit. FIG. 4 is a diagram illustrating an example of data stored in the log DB. FIG. 5 is a diagram illustrating an example of data stored in the failure DB. FIG. 6 is a diagram for explaining processing executed by the monitoring processing unit. FIG. 7 is a diagram for explaining processing executed by the monitoring processing unit. FIG. 8 is a diagram illustrating an example of the SNMP trap. FIG. 9 is a diagram showing a main processing flow. FIG. 10 is a diagram for explaining the determination of the transmission destination of the SNMP trap. FIG. 11 is a functional block diagram of a computer. FIG. 12 is a functional block diagram of the network device.

  FIG. 1 shows an overview of a system in the present embodiment. Network devices 31 to 33 such as network switches or routers are connected to the load distribution device 1 that executes the main processing of the present embodiment. The load balancer 1 is connected to management servers 51 and 52. The management servers 51 and 52 are connected to a log DB (DataBase) 7. The log DB 7 is connected to a monitoring server 9 including a failure DB 91 and a monitoring processing unit 92. The monitoring server 9 is connected to the monitoring terminal 11.

  The network devices 31 to 33 are objects to be monitored by a monitor who operates the monitoring terminal 11. When an event occurs (for example, when a failure occurs or when a failure is recovered), the network devices 31 to 33 transmit an SNMP trap including information on the event that has occurred to the load distribution device 1.

  The load balancer 1 determines the transmission destination of the SNMP trap received from the network devices 31 to 33, and transmits the SNMP trap to the determined transmission destination. The process for determining the SNMP trap transmission destination will be described in detail later.

  The management servers 51 and 52 store the data included in the SNMP trap received from the load balancer 1 in the log DB 7 in the order received. When the management servers 51 and 52 store the data included in the SNMP trap in the log DB 7, the management servers 51 and 52 assign a log ID to the data. The log ID is identification information for specifying a log.

  When a new log is stored in the log DB 7, the monitoring processing unit 92 in the monitoring server 9 sorts (that is, rearranges) the log stored in the log DB 7 with the time stamp and the log ID. Here, the time stamp is set as the first sort key, and the log ID is set as the second sort key. Then, the monitoring processing unit 92 updates the data stored in the failure DB 91 based on the log stored in the log DB 7.

  For example, the monitoring terminal 11 periodically reads data stored in the failure DB 91 and displays the data on a monitor of the monitoring terminal 11 or the like. A supervisor who operates the monitoring terminal 11 confirms the contents displayed on the monitor. For example, when a failure that has occurred in any of the network devices 31 to 33 has not been recovered, a countermeasure for recovering the failure is taken.

  FIG. 2 shows a functional block diagram of the load distribution apparatus 1. The load distribution apparatus 1 includes a reception unit 11, a determination unit 12, a data storage unit 13, and a transmission unit 14.

  The reception unit 11 receives SNMP traps from the network devices 31 to 33 and outputs them to the determination unit 12. The determination unit 12 determines the transmission destination of the SNMP trap using the data stored in the data storage unit 13. Then, the determination unit 12 outputs the determined transmission destination identification information and the SNMP trap to the transmission unit 14. The transmission unit 14 transmits an SNMP trap to the transmission destination management server indicated by the received identification information.

  FIG. 3 shows an example of data stored in the data storage unit 13. In the example of FIG. 3, a node ID, a time stamp, and identification information of a transmission destination management server are stored. The node ID is identification information of the network device. The time stamp is information indicating the time when the event occurred. The data storage unit 13 stores, for each network device, the time stamp included in the last received SNMP trap and the identification information of the management server that is the destination of the last received SNMP trap. Therefore, when a new SNMP trap is received, data is updated for the network device that is the source of the SNMP trap.

  FIG. 4 shows an example of data stored in the log DB 7. In the example of FIG. 4, a log ID, a failure code, information on a state, a time stamp, and a node ID are stored. The smaller the log ID number, the earlier the time point when it is stored in the log DB 7. When the status is “occurrence”, a failure has occurred in the network device, and the failure has not yet been recovered. If the status is “Recovered”, the failure that has occurred in the network device has already been recovered.

  FIG. 5 shows an example of data stored in the failure DB 91. In the example of FIG. 5, the node ID, the failure code, and the information regarding the state are stored. The failure code represents the type of failure.

  Processing executed by the monitoring processing unit 92 will be described with reference to FIGS. 6 and 7. For example, it is assumed that a new log is added to the log DB 7 and the log DB 7 changes from the state 601 illustrated in FIG. 6 to the state 602. The added log with the log ID 4 indicates that the failure A occurring in the network device 31 has been recovered at time “24”. As described above, when it is detected that a new log is added to the log DB 7, the monitoring processing unit 92 updates the data stored in the failure DB 91 based on the added log. For example, when the failure DB 91 is in the state 701 in FIG. 7, the state is updated to the state 702 by the added log. Here, the state of the network device 31 is updated from “occurrence” to “recovery”.

  As described above, the monitoring processing unit 92 manages the state of the network device by associating the log indicating “occurrence” with the log indicating “recovery” for a certain failure that has occurred in a certain network device.

  FIG. 8 shows an example of the SNMP trap. In the example of FIG. 8, the SNMP trap includes information indicating a PDU (Protocol Data Unit) type, a vendor identifier, an agent address, a trap number, an extended trap number, a time stamp, and data. . The information representing the PDU type represents an SNMP trap. The vendor identifier is information for identifying the vendor. The agent address is, for example, the IP address of the network device in which the event has occurred. The trap number is a number that defines the nature of the event. The extended trap number is a number that more specifically defines the nature of the event. The data portion includes additional information related to the event.

  Next, the operation of the load distribution apparatus 1 will be described with reference to FIGS. 9 and 10.

  First, the receiving unit 11 of the load balancer 1 receives an SNMP trap from any one of the network devices 31 to 33 (FIG. 9: Step S1). The reception unit 11 outputs the received SNMP trap to the determination unit 12.

  The determination unit 12 specifies the node ID of the SNMP trap transmission source by the agent address included in the SNMP trap (step S3). For example, the node ID is specified using data in which the agent address and the node ID are associated with each other.

  The determination unit 12 specifies the time stamp corresponding to the node ID specified in step S3 from the data storage unit 13 (step S5).

  The determination unit 12 determines whether or not the time stamp specified in step S5 is the same as the time stamp included in the received SNMP trap (step S7).

  When they are the same (step S7: Yes route), the determination unit 12 specifies the identification information of the transmission destination management server corresponding to the specified node ID from the data storage unit 13 (step S9). The determination unit 12 outputs the identified identification information and the received SNMP trap to the transmission unit 14.

  If they are not the same (step S7: No route), the determination unit 12 specifies the identification information of the management server of the transmission destination by a predetermined load distribution algorithm (for example, round robin) (step S11). Then, the determination unit 12 specifies the time stamp corresponding to the node ID specified in step S3 and the transmission destination identification information in the data storage unit 13 in the time stamp included in the received SNMP trap and in step S11. Update with identification information (step S13). The determination unit 12 outputs the identification information specified in step S11 and the received SNMP trap to the transmission unit 14.

  The transmission unit 14 transmits the received SNMP trap to the transmission destination management server indicated by the identification information received from the determination unit 12 (step S15). Then, the process ends.

  If the above processing is executed, a plurality of SNMP traps having the same time stamp received from a certain network device are transmitted to the same management server. Since the management server assigns log IDs to the logs in the order received and stores them in the log DB 7, the order of a plurality of SNMP traps having the same time stamp can be specified by the log IDs.

  Further, when the SNMP trap from the same network device is transmitted to the same management server, the load on the management server is biased depending on the event occurrence state. However, such a problem does not occur with the method of the present embodiment.

  Also, a method of dealing with an increase in SNMP traps by providing one high-performance management server without providing a plurality of management servers is also conceivable. However, there is a problem that the initial introduction cost is high and the operation is stopped because the server is replaced when the number of network devices further increases.

  In addition, since there are a plurality of management servers, a log stored in the log DB 7 may occur first even though the time indicated by the time stamp is later because the processing speed is different for each management server. There is sex. However, since the monitoring processing unit 92 rearranges the logs using the time stamp as the first sort key and further rearranges the logs using the log ID as the second sort key, finally, the order in which events occurred in the log DB 7 Logs are stored as expected.

  The determination of the transmission destination by the load balancer 1 will be specifically described with reference to FIG. For example, assume that eight SNMP traps have been received for a certain network device. That is, an SNMP trap indicating that the failure A has occurred at time 11, an SNMP trap indicating that the failure A has been recovered at time 12, an SNMP trap indicating that the failure B has occurred at time 13, and a failure B An SNMP trap indicating recovery at time 14, an SNMP trap indicating failure C at time 15, an SNMP trap indicating failure C recovered at time 15, and a failure D occurred at time 16 It is assumed that an SNMP trap indicating this and an SNMP trap indicating that the failure D has been recovered at time 17 are received in this order.

  When the algorithm for determining the transmission destination is round robin, the transmission destination is as indicated by 1001 in FIG. That is, an SNMP trap indicating that the failure A occurred at time 11 is transmitted to the management server 51, an SNMP trap indicating that the failure A has been recovered at time 12 is transmitted to the management server 52, and the failure B is transmitted at time 13. An SNMP trap indicating that the failure has occurred is transmitted to the management server 51, an SNMP trap indicating that the failure B has been recovered at time 14 is transmitted to the management server 52, and an SNMP trap indicating that the failure C has occurred at time 15 ( Here, a fifth SNMP trap) is transmitted to the management server 51, and an SNMP trap indicating that the failure C has been recovered at time 15 (herein referred to as a sixth SNMP trap) is transmitted to the management server 51. An SNMP trap indicating that the failure D occurred at time 16 is transmitted to the management server 52, and the failure D SNMP trap indicating that it has recovered to 7 are transmitted to the management server 51.

  Thus, except for the sixth SNMP trap, the transmission destination is determined by round robin. Since the sixth SNMP trap has the same time stamp as the fifth SNMP trap, the sixth SNMP trap is transmitted to the same destination as the destination of the fifth SNMP trap.

  Although one embodiment of the present invention has been described above, the present invention is not limited to this. For example, the functional block configurations of the load distribution device 1 and the monitoring server 9 described above may not match the actual program module configuration.

  Further, the configuration of each table described above is an example, and the configuration as described above is not necessarily required. Further, in the processing flow, the processing order can be changed if the processing result does not change. Further, it may be executed in parallel.

  In the example described above, the number of management servers is two, but may be three or more.

  In the example described above, the management server is a physical server and the log DB 7 is provided separately from the management server. However, a plurality of management servers that are virtual machines are executed in one information processing apparatus. The log DB 7 may be provided in the information processing apparatus.

  Note that the load distribution device 1, management servers 51 and 52, monitoring server 9 and monitoring terminal 11 described above are computer devices, and as shown in FIG. 11, a memory 2501 and a CPU (Central Processing Unit) 2503, A hard disk drive (HDD) 2505, a display control unit 2507 connected to the display device 2509, a drive device 2513 for the removable disk 2511, an input device 2515, and a communication control unit 2517 for connecting to a network. They are connected by a bus 2519. An operating system (OS) and an application program for executing the processing in this embodiment are stored in the HDD 2505, and are read from the HDD 2505 to the memory 2501 when executed by the CPU 2503. The CPU 2503 controls the display control unit 2507, the communication control unit 2517, and the drive device 2513 according to the processing content of the application program, and performs a predetermined operation. Further, data in the middle of processing is mainly stored in the memory 2501, but may be stored in the HDD 2505. In the embodiment of the present invention, an application program for performing the above-described processing is stored in a computer-readable removable disk 2511 and distributed, and installed in the HDD 2505 from the drive device 2513. In some cases, the HDD 2505 may be installed via a network such as the Internet and the communication control unit 2517. Such a computer apparatus realizes various functions as described above by organically cooperating hardware such as the CPU 2503 and the memory 2501 described above and programs such as the OS and application programs. .

  The network devices 31 to 33 described above are for a memory 2601, a CPU 2603, a hard disk drive (HDD) 2605, a display control unit 2607 connected to a display device 2609, and a removable disk 2611, as shown in FIG. In some cases, the drive device 2613, the input device 2615, and a communication unit 2617 (2617a to 2617c in FIG. 12) for connecting to a network are connected by a bus 2619. In some cases, the display control unit 2607, the display device 2609, the drive device 2613, and the input device 2615 may not be included. An operating system (OS: Operating System) and an application program for performing processing in the present embodiment are stored in the HDD 2605, and are read from the HDD 2605 to the memory 2601 when executed by the CPU 2603. If necessary, the CPU 2603 controls the display control unit 2607, the communication unit 2617, and the drive device 2613 to perform necessary operations. Note that data input via any of the communication units 2617 is output via another communication unit 2617. The CPU 2603 controls the communication unit 2617 to appropriately switch the output destination. Further, data in the middle of processing is stored in the memory 2601 and stored in the HDD 2605 if necessary. In the embodiment of the present invention, an application program for performing the above-described processing is stored in a computer-readable removable disk 2611 and distributed, and installed in the HDD 2605 from the drive device 2613. In some cases, the HDD 2605 may be installed via a network such as the Internet and the communication unit 2617. Such a computer apparatus realizes various functions as described above by organically cooperating the hardware such as the CPU 2603 and the memory 2601 described above with the OS and necessary application programs.

  The embodiment of the present invention described above is summarized as follows.

  The load distribution apparatus according to the first aspect of the present embodiment includes (A) a reception unit that receives a notification including a time stamp, and (B) a plurality of notifications that are stored in a common storage device in the order of reception. A determination unit that determines one information processing apparatus that is a transmission destination of the received notification from among the information processing apparatuses, (C) a time stamp included in the last received notification, and transmission of the last received notification And a data storage unit for storing identification information of the previous information processing apparatus. Then, the determination unit described above (b1) when the time stamp included in the newly received first notification is the same as the time stamp stored in the data storage unit, The transmission destination is determined to be the information processing device indicated by the identification information stored in the data storage unit.

  In this way, even if the time stamps are the same, they can be stored in a common storage device in the order in which the notifications are received. As a result, notifications can be processed in the order of event occurrence.

  In addition, the determination unit described above (b2) when the time stamp included in the first notification and the time stamp stored in the data storage unit are not the same, the transmission destination of the first notification, The time stamp and identification information stored in the data storage unit are updated with the time stamp included in the first notification and the determined identification information of the information processing apparatus of the transmission destination determined by the algorithm for load distribution. May be. In this way, when the time stamps are not the same, it is possible to prevent the load from being concentrated on a specific information processing apparatus.

  In addition, the data storage unit described above may further store identification information of a device that is the transmission source of the last received notification. In this way, it is possible to cope with a case where there are a plurality of transmission source devices.

  The load distribution method according to the second aspect of the present embodiment receives (D) a notification including a time stamp, and (E) transmits a time stamp included in the last received notification and the last received notification. The time stamp included in the last received notification is specified from the data storage unit that stores the identification information of the previous information processing apparatus, and (F) the time stamp included in the received notification and the last received are extracted. If the time stamp included in the notification is the same, the destination of the received notification is stored in the data storage unit among the plurality of information processing devices that store the notification in the common storage device in the order of reception. Including the process of determining the information processing device indicated by the identification information.

  A program for causing a computer to perform the processing according to the above method can be created. The program can be a computer-readable storage medium such as a flexible disk, a CD-ROM, a magneto-optical disk, a semiconductor memory, a hard disk, or the like. It is stored in a storage device. The intermediate processing result is temporarily stored in a storage device such as a main memory.

  The following supplementary notes are further disclosed with respect to the embodiments including the above examples.

(Appendix 1)
A receiver for receiving a notification including a time stamp;
A determination unit that determines one information processing device that is a transmission destination of the received notification from among a plurality of information processing devices that store notifications in a common storage device in the order of reception;
A data storage unit that stores a time stamp included in the last received notification, and identification information of an information processing apparatus that is a transmission destination of the last received notification;
Have
The determination unit
When the time stamp included in the newly received first notification is the same as the time stamp stored in the data storage unit, the transmission destination of the first notification is stored in the data storage unit. A load balancer that determines the information processing device indicated by the identification information.

(Appendix 2)
The determination unit
When the time stamp included in the first notification and the time stamp stored in the data storage unit are not the same, the transmission destination of the first notification is determined by an algorithm for load distribution, The load balancing apparatus according to claim 1, wherein the time stamp and identification information stored in the data storage unit are updated with the time stamp included in the first notification and the determined identification information of the information processing apparatus of the transmission destination. .

(Appendix 3)
In the data storage unit,
The load distribution apparatus according to appendix 1 or 2, further storing identification information of a transmission source apparatus of the last received notification.

(Appendix 4)
Receive a notification containing a timestamp,
The time stamp included in the last received notification is identified from the data storage unit that stores the time stamp included in the last received notification and the identification information of the information processing apparatus that is the transmission destination of the last received notification. ,
When the time stamp included in the received notification is the same as the time stamp included in the extracted last received notification, the destination of the received notification is shared in the order received. Of the plurality of information processing devices stored in the storage device, determine the information processing device indicated by the identification information stored in the data storage unit,
A load balancing method in which processing is executed by a computer.

(Appendix 5)
A storage device;
A plurality of information processing devices for storing notifications in the storage device in the order received,
A load distribution device that transmits a notification to the plurality of information processing devices;
Have
The load balancer is:
A receiver for receiving a notification including a time stamp;
A determination unit that determines one information processing apparatus that is a transmission destination of the received notification from the plurality of information processing apparatuses;
A data storage unit that stores a time stamp included in the last received notification, and identification information of an information processing apparatus that is a transmission destination of the last received notification;
Have
The determination unit
When the time stamp included in the newly received first notification is the same as the time stamp stored in the data storage unit, the transmission destination of the first notification is stored in the data storage unit. The load distribution system determines the information processing device indicated by the identification information.

DESCRIPTION OF SYMBOLS 1 Load distribution apparatus 11 Reception part 12 Determination part 13 Data storage part 14 Transmission part 31,32,33 Network apparatus 51,52 Management server 7 Log DB
9 Monitoring server 91 Failure DB
92 Monitoring processing unit 11 Monitoring terminal

Claims (4)

A receiver for receiving a notification including a time stamp;
A determination unit that determines one information processing device that is a transmission destination of the received notification from among a plurality of information processing devices that store notifications in a common storage device in the order of reception;
A data storage unit that stores a time stamp included in the last received notification, and identification information of an information processing apparatus that is a transmission destination of the last received notification;
Have
The determination unit
When the time stamp included in the newly received first notification is the same as the time stamp stored in the data storage unit, the transmission destination of the first notification is stored in the data storage unit. A load balancer that determines the information processing device indicated by the identification information. The determination unit
When the time stamp included in the first notification and the time stamp stored in the data storage unit are not the same, the transmission destination of the first notification is determined by an algorithm for load distribution, The load distribution according to claim 1, wherein the time stamp and the identification information stored in the data storage unit are updated with the time stamp included in the first notification and the determined identification information of the information processing apparatus of the transmission destination. apparatus. Receive a notification containing a timestamp,
The time stamp included in the last received notification is identified from the data storage unit that stores the time stamp included in the last received notification and the identification information of the information processing apparatus that is the transmission destination of the last received notification. ,
When the time stamp included in the received notification is the same as the time stamp included in the extracted last received notification, the destination of the received notification is shared in the order received. Of the plurality of information processing devices stored in the storage device, determine the information processing device indicated by the identification information stored in the data storage unit,
A load balancing method in which processing is executed by a computer. A storage device;
A plurality of information processing devices for storing notifications in the storage device in the order received,
A load distribution device that transmits a notification to the plurality of information processing devices;
Have
The load balancer is:
A receiver for receiving a notification including a time stamp;
A determination unit that determines one information processing apparatus that is a transmission destination of the received notification from the plurality of information processing apparatuses;
A data storage unit that stores a time stamp included in the last received notification, and identification information of an information processing apparatus that is a transmission destination of the last received notification;
Have
The determination unit
When the time stamp included in the newly received first notification is the same as the time stamp stored in the data storage unit, the transmission destination of the first notification is stored in the data storage unit. The load distribution system determines the information processing device indicated by the identification information.

Images