JP6310405B2 - Service impact cause estimation apparatus, service impact cause estimation program, and service impact cause estimation method - Google Patents

Description

  The present invention relates to a service influence cause estimation device, a service influence cause estimation program, and a service influence cause estimation method.

  2. Description of the Related Art A technique for estimating a location where a failure or quality degradation occurs in a communication network when providing a service via the communication network is known.

  Patent Document 1 describes a plurality of service components (physical facilities) arranged between a use terminal and an information source (corresponding to a server) in response to a report of a trouble occurrence on a communication network from a user. A communication sequence when all service components are normal and a communication sequence when each service component fails are generated, and these communication sequences are compared with observation information at the time of failure declaration. Thus, a technique for estimating a failed service component is disclosed (details will be described later as “first comparative example”).

  In addition, by capturing packets between devices on the communication network and analyzing the captured packets, various characteristic values (reorder width, traffic flow, RTT (Round-Trip Time), Packet loss, jitter, session establishment rate, window size, server response time), the normality of the characteristic value is determined based on the calculated values, and the cause of communication quality degradation between the devices is determined. An estimation technique is also known (details will be described later as “second comparative example”).

  Furthermore, Non-Patent Document 1 transmits a test packet to each flow using SFC (Service Function Chaining) technology, which is a flexible route control technology that enables selective use of virtualized communication network functions. Then, the transfer function unit (corresponding to a physical / virtual router or physical / virtual switch) through which the test packet has passed and the ID of the application are respectively stored in a list provided in the test packet, and the list in which the ID is stored in advance A technique for estimating a fault location by comparing with set information is disclosed (details will be described later as “third comparative example”).

Japanese Patent Laid-Open No. 10-200527

Y. Jiang et al., "Fault Management in Service Function Chaining", [online], October 27, 2014, The Internet Engineering Task Force, [Search January 27, 2015], Internet <URL: https: // datatracker.ietf.org/doc/draft-jxc-sfc-fm/?include_text=1>

However, in the technologies of the first to third comparative examples, it is impossible to detect an abnormality even if a failure or deterioration occurs in software such as virtualization equipment or application software (Patent Document 1), and for equipment that cannot be assigned an ID. Failure diagnosis cannot be performed (Non-Patent Document 1), work is complicated, the scale of the apparatus is large, and the cause cannot be estimated when service quality is deteriorated. There are defects such as.
Therefore, the present invention is a service influence cause estimation device that can detect software failures and deterioration, is simple in work, has a relatively small apparatus scale, and can estimate the cause of the deterioration of service quality, It is an object to provide a service influence cause estimation program and a service influence cause estimation method.

The present invention relates to a flow ID for identifying a flow and a physical facility ID for identifying the physical facility with respect to a flow configured by using at least one of physical facilities and software for transferring data on a communication network. A storage unit that associates and stores a server ID that identifies a server that is the physical facility, and a software ID that identifies the software used in each of the servers, and refers to the storage unit and stores data for each flow A model generation unit that generates a flow model that is a model for specifying the flow of the physical equipment and software through which the data flows and the data flows, and the flow models are compared with each other on the communication network. Estimate the physical equipment or the software that causes service impact Includes an estimation unit, wherein the estimation unit, wherein the list generating unit to generate a list that can store software ID, the test packet generator for generating a test packet with the list, the test packet by the flow A packet transmission unit that transmits a predetermined number of packets within a predetermined time, a packet reception unit that receives a reply packet of the test packet in which the ID of the software that the test packet has passed is stored in the list, and the received reply packet A reply storage unit for storing, and a group configuration unit for classifying each flow into a normal group and an abnormal group based on a measurement result of reception of the reply packet stored in the reply storage unit, The group configuration unit includes a response time as the measurement result and the measurement. As a result, the number of reply counts is within the range of each predetermined value, and the software ID acquired from the storage unit is compared with the software ID stored in the list of reply packets. When the matched flows are classified into a normal group, the other flows are classified as an abnormal group, and the measured response time and the count number are within a predetermined value range for the abnormal group, respectively. Or, compare the software ID acquired from the storage unit with the software ID stored in the list of reply packets, classify the flows that do not match at least one software ID into a failure group, and The flow is classified into a performance degradation group, and the estimation unit First, the flow models of the respective flows are compared with each other in the generalization group or the failure group, the common physical facility or software is extracted, and the extracted physical facility or software is estimated as the cause of the service influence Comparing the flow models of each flow between the cause identifying unit, the performance degradation group or the failure group, and the normal group, the common physical equipment or the software is the cause of the service impact. A second cause identifying unit that excludes the physical equipment or software remaining from the candidate and extracts the physical equipment or software that has been extracted and estimates the extracted physical equipment or software as a cause of the service influence. Is a service influence cause estimation device. According to the present invention, software failure and deterioration can be detected, the work is simple, the apparatus scale is relatively small, and the cause of the deterioration of service quality can be estimated.
In addition, because it only sends a test packet and receives a reply packet, it can detect software failures and deterioration, simplify the work, have a relatively small scale of equipment, and cause the service quality deterioration. It can also be estimated.
Furthermore, it can be classified into a normal flow and an abnormal flow.
In addition, it can be easily classified into a normal flow and an abnormal flow according to the response time and the number of replies.
Also, abnormal flows can be classified into those with failure and those with deterioration.
Furthermore, the cause of the service influence can be estimated by an appropriate means.

In this case, the predetermined value used for the response time in the group configuration unit is obtained by taking an average value for the response time for the test packet transmitted by a predetermined value within a predetermined time or using a statistical method. The predetermined value used for the count number is obtained by taking an average value of the count numbers for the test packet transmitted by a predetermined value within a predetermined time or using a statistical method. This may be a feature.
According to the present invention, it is possible to appropriately determine the predetermined values used for the response time and the reply count.

In this case, when the number of flows allocated to the failure or performance degradation group is equal to or greater than a predetermined threshold value for the same group, the estimation unit uses the first cause identifying unit and is less than the predetermined threshold value. In this case, after using the first cause identifying unit, the cause of the service influence may be estimated using the second cause identifying unit.
According to the present invention, the first cause specifying unit or the second cause specifying unit can be accurately selected.

In the above case, the estimation unit compares the flow models of the flows in the performance degradation group or the failure group, counts the number of the common physical equipment or the software, and then The flow models of each flow are compared between the performance degradation group or the failure group and the normal group that have been compared, and the number of counts is set to 0 for the common physical equipment or the software, and finally The physical equipment or the software having the largest number of counts may be extracted, and the extracted physical equipment or the software may be estimated as the cause of the service influence.
According to the present invention, it is possible to accurately estimate the cause of service influence.

In this case, the storage unit may use the physical equipment or software indicated by the ID as the physical equipment ID and the software ID, and other physical equipment or software that is in a parent-child relationship or connection relationship with the physical equipment or software, or A correlation with a server, and when the estimation unit estimates a plurality of the physical facilities or software that are the cause of the service influence, When there is a parent-child relationship or a connection relationship between the physical facility or software estimated in the estimation and the physical facility or software estimated in the estimation performed this time, a plurality of estimations performed this time Prioritize the number of counts of the physical equipment or software It may be.
According to the present invention, the number of counts can be prioritized by a parent-child relationship or a connection relationship.

According to another aspect of the present invention, for a flow configured using at least one of physical equipment and software for transferring data on a communication network, a flow ID for identifying the flow and a physical for identifying the physical equipment are provided. The data flows for each flow with reference to a storage unit that stores an equipment ID, a server ID that identifies the server that is the physical equipment, and a software ID that identifies the software used in each server. A model generation process for generating a flow model, which is a model for specifying the ID of the physical equipment and software and the order in which the data flows, and comparing the flow models with each other to determine the service influence on the communication network. An estimation process for estimating the physical equipment or the software causing the problem When, cause the computer to execute, the estimation process, a list generation process to generate a list that can store the software ID, the test packet generation processing that generates a test packet with the list, the flow of the test packet A packet transmission process for transmitting a predetermined number of times within a predetermined time, a packet reception process for receiving a reply packet of the test packet in which the ID of the software that the test packet has passed is stored in the list, and the received reply packet And a reply storing process for storing the reply, and a group configuration for classifying the flows into a normal group and an abnormal group based on a measurement result of reception of the reply packet stored in the reply storing process. Allow the computer to execute the process and In the loop configuration process, the response time as the measurement result and the number of replies as the measurement result are each within a range of each predetermined value, and the list of the software ID and the reply packet acquired from the storage unit Are compared with the software IDs stored in, and the flows with all matching software IDs are classified into normal groups, the other flows are classified into abnormal groups, and the response times are measured for the abnormal groups. When the value and the count number are each within the range of each predetermined value, or comparing the software ID acquired from the storage unit with the software ID stored in the list of reply packets, at least one software Classify the flows whose IDs do not match into failure groups, The outside flow is classified into a performance degradation group, and the estimation process compares the flow models of the flows in the performance degradation group or the failure group, and extracts the common physical equipment or the software. The first physical identification process for estimating the extracted physical equipment or software as the cause of the service influence, and the flow models of the flows between the performance degradation group or the failure group and the normal group. In comparison, the common physical equipment or the software is excluded from the cause of the service influence, the remaining physical equipment or the software is extracted, and the extracted physical equipment or the software is used as the service influence. Causing the computer to execute a second cause identification process to be estimated as the cause of the problem This is a service influence cause estimation program readable by a computer.
According to the present invention, software failure and deterioration can be detected, the work is simple, the apparatus scale is relatively small, and the cause of the deterioration of service quality can be estimated.
In addition, because it only sends a test packet and receives a reply packet, it can detect software failures and deterioration, simplify the work, have a relatively small scale of equipment, and cause the service quality deterioration. It can also be estimated.
Furthermore, it can be classified into a normal flow and an abnormal flow.
In addition, it can be easily classified into a normal flow and an abnormal flow according to the response time and the number of replies.
Also, abnormal flows can be classified into those with failure and those with deterioration.
Furthermore, the cause of the service influence can be estimated by an appropriate means.

According to another aspect of the present invention, for a flow configured using at least one of physical equipment and software for transferring data on a communication network, a flow ID for identifying the flow and a physical for identifying the physical equipment are provided. The data flows for each flow with reference to a storage unit that stores an equipment ID, a server ID that identifies the server that is the physical equipment, and a software ID that identifies the software used in each server. A model generation step for generating a flow model, which is a model for specifying the ID of the physical equipment and software and the order in which the data flows, and comparing the flow models with each other to determine the service impact on the communication network. Estimator to estimate the physical equipment or software When, wherein the estimation step is given a list generation step of generating a list that can store the software ID, the test packet generation step of generating test packets with the list, the test packet to each of the flow A packet transmission step of transmitting a predetermined number in time, a packet reception step of receiving a reply packet of the test packet storing the ID of the software that the test packet has passed in the list, and storing the received reply packet A group storing step for classifying each flow into a normal group and an abnormal group based on a measurement result of reception of the reply packet stored in the reply storing step. The configuration process is the response time as the measurement result And the counts of replies as the measurement results are within a range of each predetermined value, and the software ID acquired from the storage unit is compared with the software IDs stored in the list of reply packets. The flows with the same software ID are classified into normal groups, the other flows are classified into abnormal groups, and the measured values of the response time and the counts are within the respective predetermined ranges for the abnormal groups. Or the software ID acquired from the storage unit and the software ID stored in the reply packet list, and classify the flows that do not match at least one software ID into a failure group, The other flows are classified into performance degradation groups, and the estimation process is performed. Compares the flow models of each flow within the performance degradation group or the failure group, extracts the common physical equipment or software, and uses the extracted physical equipment or software as the cause of the service impact The first physical identification process to be estimated, the performance degradation group or the failure group, and the normal model are compared with each other in the flow model of each flow, and the common physical equipment or the software is the service A second cause identifying step of extracting the remaining physical equipment or software as a cause of the service influence by extracting the remaining physical equipment or the software from the candidate of the cause of the influence and extracting the extracted physical equipment or the software as the cause of the service influence. This is a service influence cause estimation method characterized by
According to the present invention, software failure and deterioration can be detected, the work is simple, the apparatus scale is relatively small, and the cause of the deterioration of service quality can be estimated.
In addition, because it only sends a test packet and receives a reply packet, it can detect software failures and deterioration, simplify the work, have a relatively small scale of equipment, and cause the service quality deterioration. It can also be estimated.
Furthermore, it can be classified into a normal flow and an abnormal flow.
In addition, it can be easily classified into a normal flow and an abnormal flow according to the response time and the number of replies.
Also, abnormal flows can be classified into those with failure and those with deterioration.
Furthermore, the cause of the service influence can be estimated by an appropriate means.

  According to the present invention, software failure and deterioration can be detected, the work is simple, the apparatus scale is relatively small, and the cause of the deterioration of service quality can be estimated.

1 is an overall configuration diagram of a system according to an embodiment of the present invention. It is a block diagram which shows the outline | summary of the hardware constitutions of the service influence cause estimation apparatus concerning one Embodiment of this invention. It is a functional block diagram explaining the function which a central processing unit performs based on the service influence cause estimation program concerning one Embodiment of this invention. It is explanatory drawing of the data structure registered into equipment information DB of the service influence cause estimation apparatus concerning one Embodiment of this invention. It is explanatory drawing of the data structure registered into software information DB of the service influence cause estimation apparatus concerning one Embodiment of this invention. It is explanatory drawing which shows an example of the flow model concerning one Embodiment of this invention. An example of a test packet according to an embodiment of the present invention will be described. It is a flowchart of the process which groups each flow concerning one Embodiment of this invention. FIG. 9 is a state transition diagram illustrating determination in grouping in FIG. 8. It is explanatory drawing explaining the cause estimation process of the service influence in one Embodiment of this invention. It is a flowchart for selecting whether the 1st cause specific part is used in one embodiment of the present invention, or the 2nd cause specific part is used. It is explanatory drawing explaining the modification of the cause estimation process of the service influence in one Embodiment of this invention. It is explanatory drawing explaining the modification of the cause estimation process of the service influence in one Embodiment of this invention. It is explanatory drawing explaining the modification of the cause estimation process of the service influence in one Embodiment of this invention. It is explanatory drawing explaining the technical content of a 1st comparative example. It is explanatory drawing explaining the technical content of the 2nd comparative example. It is explanatory drawing explaining the technical content of the 3rd comparative example.

First, before describing the present embodiment, a plurality of comparative examples for the present embodiment will be described.
[Comparative example]
(First comparative example)
In this specification, “degradation” occurs in the service quality when the network administrator has an abnormality in which an alarm indicating the occurrence of the abnormality cannot be confirmed, and “failure” occurs in the service quality. The occurrence of an error occurs when an abnormality that allows the network administrator to confirm the alarm has occurred.

  FIG. 15 is an explanatory diagram for explaining the technical contents of the first comparative example (Patent Document 1). In this network service failure diagnosis method and apparatus, when a user uses a service, a facility information database (DB) that describes roles related to each of a plurality of service components arranged between the terminal and an information source 201 and a design information database (DB) 202 describing operations at the time of normality and failure of each service component. An example of registration information in the facility information DB 201 is indicated by reference numeral 203.

  First, when a user of a communication network (user A) declares a search with the user ID and service name used (S211), the end-to-end equipment model of the user A is determined based on the equipment information DB 201. The service component (physical device) is output as a unit (S212). Then, referring to the design information DB 202, based on the equipment model, a communication sequence when the components of all services are normal is generated (S213). In addition, a communication sequence when a component of each service fails is generated with reference to the design information DB 202 (S214).

Next, the normal communication sequence (S213), the abnormal communication sequence (S214), and the observation information (information input by the maintainer of the communication system) are compared, and the communication includes information common to both. Extract the sequence. And the service component which did not play the original role among each service component is extracted (S215, S216). In this example, in S215, no. Communication sequences at the time of failure of 48 NICs (Network Interface Controllers) are shown as communication sequence numbers 1 to 4. These are examples of communication sequences of various failure patterns. In addition, the information input by the maintenance person in S216 is that the warning “Alarm A” is displayed, the message “Message B” (the message “No response from host” in S214) is displayed, And a declaration from the user A that “XX does not move”.
In this example, the sequence numbers 1 and 3 are matched by the comparison between the normal / abnormal communication sequence and the observation information, and these are extracted. Then, in the communication sequence of sequence numbers 1 and 3, it is determined which service component does not play the original role, and the abnormal part is estimated.

  However, in the first comparative example, it is necessary to comprehensively prepare a communication sequence at the time of failure, so that the work is complicated. In the first comparative example, software such as virtualization equipment and application software is excluded from service components (only physical devices are targeted). When the virtual equipment or application software is set, when converting it to an equipment model, the virtual equipment or application software coexisting with a physical device or a single physical device Therefore, it is not possible to distinguish between the virtual equipment and application software existing in the system, so that it is necessary to check each one manually, and the work is complicated. Furthermore, since the first comparative example determines an abnormality in the communication sequence, there is also a problem in that the service component that is the cause cannot be estimated when the communication sequence is normal but the service quality has deteriorated. .

(Second comparative example)
FIG. 16 is an explanatory diagram for explaining the technical contents of the second comparative example. In this quality degradation cause estimation method, a user terminal 301 and a server 302 are connected via a network 303 as shown in FIG. Then, the quality degradation cause estimation device 304 provided in the network 303 captures the packet P311 between the user terminal 301 and the server 302, and analyzes the captured packet P311. Calculates values (reorder width, traffic flow, RTT (Round-Trip Time), packet loss, jitter, session establishment rate, window size, server response time), and determines the normality of the characteristic value based on the calculated values The cause of communication quality degradation between the user terminal 301 and the server 302 is estimated.

  FIG. 16B is a flowchart of the determination process when the characteristic value is an example of the session establishment rate. When the characteristic value is the session establishment rate, first, the quality degradation cause estimation device 304 determines whether or not the session establishment failure rate is greater than a predetermined threshold (S321). When it is not large (N in S321), the quality degradation cause estimating apparatus 304 determines that the network 303 is normal (S322). When it is larger (Y in S321), the quality degradation cause estimation device 304 determines whether there is a session termination device (S323). If there is a session termination device (Y in S323), there is a possibility that the session termination device has a cause of abnormality, so the quality degradation cause estimation device 304 determines that it is necessary to check the log of the session termination device. (S324). When there is no session termination device (N in S323), the quality degradation cause estimation device 304 determines that there is a cause in the server 302 (S325).

  FIG. 16C is a flowchart of the determination process when the characteristic value is an example of the window size. When the characteristic value is the window size, first, the quality deterioration cause estimating device 304 determines whether or not the window size is smaller than a predetermined threshold (S331). When it is equal to or greater than the threshold (N in S331), the quality degradation cause estimating apparatus 304 determines that the network 303 is normal (S332). When it is smaller than the threshold value (Y in S331), the quality degradation cause estimation device 304 determines whether there is a bandwidth control device (S333). If there is a bandwidth control device (Y in S333), there is a possibility that the bandwidth control device has a cause of abnormality, so the quality degradation cause estimation device 304 determines that it is necessary to check the log of the bandwidth control device. (S334). When there is no bandwidth control device (N in S333), the quality degradation cause estimation device 304 determines that there is a cause in the server 302 (S335).

  However, such a second comparative example is a capture point provided in a device in the network 303 when the cause location including individual devices in the network 303 is estimated end-to-end for each flow. Since the amount of data stored in the captured packet P311 and the load on the determination process increase, the operation becomes complicated and the apparatus scale becomes large. For this reason, it is difficult to apply in a large-scale network such as a communication carrier.

(Third comparative example)
FIG. 17 is an explanatory diagram for explaining the technical contents of the third comparative example. In the failure diagnosis method including this virtualization mechanism, a plurality of servers 402 and a plurality of switches (network switches) 403 are arranged in a network 401 as shown in FIG. The detection node 404 is one of the nodes in the network 401. The server 402 includes a transfer function unit (corresponding to a virtual switch) 411 that performs data transfer, and application software 412. SFF1 to SFF3 are IDs of the transfer function units 411, and SF1 to SF5 are IDs of the application software 412.

  This technology uses SFC (Service Function Chaining), which is a flexible route control technology that enables selective use of virtualized network functions. The detection node 404 transmits one test packet for each flow. This test packet includes a list for storing the IDs of the transfer function unit 411 and the application software 412. Upon receiving the test packet, the server 402 stores the ID of its own transfer function unit 411 in the list of the test packet, copies the stored list, and replies the copied list to the detection node 404 of the transmission source. Thereafter, the test packet having the copy source list is transferred to the application software 412 of the same server 402. Here, as with the transfer function unit 411, the list is copied, and the reply is sent to the detection node 404 that is the transmission source of the copied list. Is done. The same applies when the test packet is transferred to another server 402.

  FIG. 17B shows an example of setting information 421 stored in advance in the detection node 404. The setting information 421 is arranged from the top in the order of passing through the ID of each part of the passage route of the test packet to be transferred for a certain flow. In this example, the test packet is transferred to the server 402 having the transfer function unit 411 with the ID SFF1, and after the test packet sequentially passes through the transfer function unit 411 and the application software 412, the transfer function unit 411 with the ID SFF2. In this example, a test packet is transferred to a server 402 equipped with and the test packet sequentially passes through the transfer function unit 411 and application software 412. Therefore, if the IDs of the respective parts that the test packet is scheduled to pass are indicated in order, “SFF1 → SF1 → SFF1 → SFF2 → SF2 → SFF2 → SF3 → SFF2”.

  FIG. 17C is an example of a list replied to the detection node 404 based on the test packet. List 1 is replied from transfer function unit 411 with ID SFF1, list 2 is replied from application software 412 with ID SF1, list 3 is replied from transfer function unit 411 with ID SFF1, and list 4 has ID SFF2. The transfer function unit 411 is replied.

By comparing these lists with the setting information 421, it is possible to determine which part of each transfer function unit 411 and application software 412 has an abnormality. Compared with the setting information 421, it can be seen that List 1 to List 4 are all correctly replied to the detection node 404. That is, the lowest ID of each of the list 1 to the list 4 exists in the setting information 421, and the ID is a reply source of the list, so that the transfer function unit 411 or application software 412 of the reply source operates normally. Can be determined.
Here, if there is an abnormality in the transfer function unit 411 whose ID is SFF2, the list 4 in which the SFF2 of ID is recorded at the bottom is not replied. It is determined that there is an abnormality in the transfer function unit 411 that is SFF2.

  However, in the third comparative example, since only the transfer function unit 411 and the application software 412 that can be assigned IDs are targeted for abnormality diagnosis, other physical devices or software that cannot be assigned other IDs. There is a problem that abnormality diagnosis cannot be performed for equipment. In addition, there is a problem in that the cause location cannot be estimated when the quality of service is deteriorated only by comparing the setting information 421 with the list in which the IDs of the transfer function unit 411 and the application software 412 are stored. .

[Embodiment]
Next, the technical contents of the present embodiment in which the problems in the first to third comparative examples are solved will be described.
(Overview of system configuration)
FIG. 1 is an overall system configuration diagram of the present embodiment. A plurality of servers 11 are installed on a communication network 10 such as the Internet, and these servers 11 are connected via a switch (network switch) 12 and a link 13. Each server 11 is provided with a virtual switch (vSW) 21 and application software (APL) 22 which are all software. The ID of each component in the communication network 10 is illustrated as “ID: sv01”, for example.

  In this example, the service influence cause estimation device 1 is provided connected to the server 11. However, the present invention is not limited to this, and the service influence cause estimation device 1 may be arranged in the communication network 10 independently of the server 11.

  FIG. 2 is a block diagram showing an outline of the hardware configuration of the service influence cause estimating apparatus 1. The service influence cause estimation device 1 includes a central processing unit (CPU) 31 that performs various calculations and controls, a main storage device 32 that is a work area of the central processing unit 31, and an auxiliary storage device (HDD or the like) that stores various data. 33 and a communication interface (I / F) 34 that communicates with the communication network 10. The auxiliary storage device 33 stores a service influence cause estimation program 45 that is a program for executing the characteristic processing described below in the service influence cause estimation apparatus 1.

FIG. 3 is a functional block diagram for explaining functions executed by the central processing unit 31 based on the service influence cause estimation program 45.
That is, the service influence cause estimation device 1 includes a storage unit 50, a processing unit 60, and a management unit 70.
The storage unit 50 is provided with an equipment information database (DB) 51 and a software information database (DB) 52. Detailed functions of these units will be described later.
The processing unit 60 performs processing related to a flow model described later. The processing unit 60 includes a model generation unit 61, a component element method determination unit 62, a component element extraction unit 63, and an extraction element storage unit 64. The component extraction unit 63 includes a first cause specifying unit 631 and a second cause specifying unit 632. Detailed functions of these units will be described later.

  The management unit 70 performs processing related to management of various data. The management unit 70 includes a setting information management unit 71, a group management unit 72, a threshold management unit 73, a test packet management unit 74, and a recording unit 75. The group management unit 72 is provided with a group configuration unit 721 and a group storage unit 722. The threshold management unit 73 is provided with a response time threshold storage unit 731, a reply count number threshold storage unit 732, a failure flow number threshold storage unit 733, and a performance degradation flow number threshold storage unit 734. The test packet management unit 74 includes a test packet generation unit 741, a list generation unit 742, a packet transmission unit 743, a packet reception unit 744, and a reply storage unit 745. The recording unit 75 includes a response time storage unit 751, a reply count number storage unit 752, a failure flow number storage unit 753, and a performance deterioration flow number storage unit 754. Detailed functions of these units will be described later.

Below, the service influence cause estimation method which is a process which the service influence cause estimation apparatus 1 performs is demonstrated sequentially.
(Outline of service impact cause estimation method)
FIG. 4 is an explanatory diagram of a data configuration registered in the facility information DB 51 (FIG. 3). In the facility information DB 51, a flow ID and a physical facility ID are associated and registered. In the communication network 10, the flow ID is a physical facility such as a transfer device or a communication cable, a virtual facility such as a virtual machine or a virtual switch, and software such as application software (in the example of FIG. 1, the server 11 , The switch 12, the link 13, the virtual switch 21, and the application software 22). The physical facility ID is an identifier for identifying the physical facility (in the example of FIG. 1, the server 11, the switch 12, and the link 13) in each flow in the communication network 10. The physical facility ID indicates the ID of the physical facility through which data flows, connected from left to right in the order in which the data flows.

  FIG. 5 is an explanatory diagram of a data configuration registered in the software information DB 52 (FIG. 3). In the facility information DB 51, the flow ID, the server ID, and the software ID are associated and registered. The server ID is an identifier for identifying the server 11. The software ID is a virtual facility such as a virtual machine or virtual switch mounted on the server 11 indicated by each server ID, and software such as application software (in the example of FIG. 1, virtual switch 21 and application software 22). It is an identifier to identify. The software ID indicates the ID of the software through which the data flows, concatenated from left to right in the order in which the data flows. The software ID is associated with the server ID of each server 11 and is indicated only by the software ID in the server 11 indicated by the server ID.

  FIG. 6 is an explanatory diagram illustrating an example of a flow model. In the flow model, the flow ID is an identifier, and FIG. 6 shows an example of the flow model for each flow ID. The flow model is generated by the model generation unit 61. That is, the model generation unit 61 refers to the facility information DB 51 (FIG. 4) and the software information DB 52 (FIG. 5) when creating a flow model of a certain flow ID, and is associated with each target flow ID. The physical equipment indicated by the physical equipment ID and the software indicated by the server ID and the software ID are shown connected from left to right in the order of data flow. That is, the model generation unit 61 is a model that identifies the physical equipment and software ID through which data flows for each flow and the order in which the data flows.

  In the present embodiment, the processing unit 60 and the management unit 70 correspond to an estimation unit, and the processing performed by the processing unit 60 and the management unit 70 compares the flow models with each other and determines the communication network 10 based on the comparison result. It estimates the physical equipment or software that causes the service impact such as deterioration and failure. Below, the detailed process which the service influence cause estimation apparatus 1 performs, especially the specific process which the process part 60 used as an estimation part and the management part 70 perform are demonstrated.

(Test packet)
An example of a test packet used for estimating a physical facility or software that causes a service influence such as deterioration or failure on the communication network 10 will be described.
First, the list generation unit 742 generates a list as shown in FIG. 7A in which the software ID can be stored. In this list, the flow ID and software ID of the target flow model are described when the test packet passes through the software. Then, the test packet generation unit 741 generates a test packet having the list. The header of the test packet stores the physical equipment ID of the physical equipment through which the test packet passes and the software ID of the software with reference to the equipment information DB 51 and software information DB 52 of the corresponding flow.
The packet transmitter 743 transmits a predetermined number of the generated test packets for each flow within a predetermined time. Specifically, a plurality of identical test packets are transmitted per flow.

Thereby, in each flow, the last component of the flow model generates a reply packet and transmits it. The reply packet is attached with a list as shown in FIG. 7B in which the IDs of the software that have passed the corresponding test packet are stored. The reply packet is received by the packet receiving unit 744. Then, the reply storage unit 745 stores the list of reply packets.
The actually measured value of the response time of the test packet is stored in the response time storage unit 751, and the reply packet count number of the test packet is stored in the reply count number storage unit 752.

(Grouping)
Next, the flows are grouped based on the result of transmission of the test packet. The grouping is first classified into a “normal group” that is determined as a flow having no abnormality, and a “performance degradation group” and a “failure group” that are “abnormal groups” that are determined as a flow having an abnormality. The group configuration unit 721 performs grouping of the normal group, the abnormal group, and the performance deterioration group. The group storage unit 722 stores the grouping result. In addition, the setting information management unit 71 takes in the registration information of the facility information DB 51 and the software information DB 52 as setting information.

  FIG. 8 is a flowchart of processing for grouping the flows. In this processing, N1 and N2 (N1 <N2) are used as threshold values of the actual measurement values of the response time of the test packet stored in the response time storage unit 751, and the reply packet of the test packet stored in the reply count number storage unit 752 C1, C2, and C3 (C1> C2> C3) are used as the threshold values of the count number.

  Here, the thresholds N1 and N2 which are predetermined values used for the response time stored in the response time threshold storage unit 731 are average values for the response times for the test packets transmitted by the predetermined value within the predetermined time as described above. Or by using a predetermined statistical method. Similarly, threshold values C1, C2, and C3, which are predetermined values used for the count number of reply packets stored in the reply count number threshold storage unit 732, are the count numbers for the test packets transmitted by the predetermined value within a predetermined time. It is obtained by taking an average value of or using a predetermined statistical method.

  First, the process shown in FIG. 8 is performed for each flow. That is, the group configuration unit 721 determines whether or not the actual response time value stored in the response time storage unit 751 is smaller than the threshold value N1 (S1). When the measured response time value is smaller than the threshold value N1 (Yes in S1), the group configuration unit 721 determines whether the count number of reply packets stored in the reply count number storage unit 752 is greater than or equal to the threshold value C1. (S2). When the count number of reply packets is equal to or greater than the threshold value C1 (Yes in S2), the group configuration unit 721 sets the list of reply packets stored in the reply storage unit 745 stored in the setting information management unit 71. It is determined whether or not the information completely matches (S3). When the list of reply packets and the setting information completely match (Yes in S3), the response is good, a sufficient number of reply packets are returned, and the test packets are all physical equipment and software in the corresponding flow. Since it is normally routed, the group configuration unit 721 classifies the flow into a normal group (S4).

  On the other hand, when the count number of reply packets falls below the threshold value C1 (No in S2), the group configuration unit 721 displays the list of reply packets stored in the reply storage unit 745 as in the case of S3. It is determined whether or not it completely matches the setting information stored in (S5). When the list of reply packets and the setting information completely match (Yes in S5), a sufficient number of reply packets have not been returned, but the test packets are all normal for the physical equipment and software in the corresponding flow. Since it is routed, the group configuration unit 721 classifies the flow into a performance degradation group (S6). If there is a mismatch between the reply packet list and the setting information (Yes in S5), a sufficient number of reply packets have not been returned, and the test packet has been successfully processed by the physical equipment and software in the corresponding flow. Since it is not via, the group configuration unit 721 classifies the flow into a failure group (S7). Even if there is a mismatch between the reply packet list and the setting information in S3 (No in S3), a sufficient number of reply packets are returned, but the test packet is a physical facility in the corresponding flow, Since it is not normally routed by software, the group configuration unit 721 classifies the flow into a failure group (S7).

  When the measured response time value is equal to or greater than the threshold value N1 (No in S1), the group configuration unit 721 determines whether the measured response time value is equal to or greater than the threshold value N1 and less than the threshold value N2 ( S8). When the measured response time is greater than or equal to the threshold value N1 and less than the threshold value N2 (Yes in S8), the group configuration unit 721 indicates that the count number of reply packets stored in the reply count number storage unit 752 is the threshold value. It is determined whether or not C2 or more (S9). When the count number of reply packets is equal to or greater than the threshold C2 (Yes in S9), the group configuration unit 721 sets the list of reply packets stored in the reply storage unit 745 stored in the setting information management unit 71. It is determined whether or not the information (information in the storage unit 50) completely matches (S10). When the list of reply packets and the setting information completely match (Yes in S10), a plurality of reply packets whose responses are not so good are returned, and the test packet is a physical facility or software in the corresponding flow. Since all are normally routed, the group composition unit 721 classifies the flow into a performance degradation group (S6). If there is a mismatch between the reply packet list and the setting information (No in S10), a plurality of reply packets with poor responses are returned, and the test packet is a physical facility in the corresponding flow, Since there is a software that is not normally routed, the group configuration unit 721 classifies the flow into a failure group (S7). When the count number of reply packets is less than the threshold value C2 (No in S9), the group configuration unit 721 groups into normal groups and performance degradation groups based on the determination in S3.

When the measured response time value is not less than the threshold value N1 and not less than the threshold value N2 (No in S8), the group configuration unit 721 determines whether or not the measured response time value is not less than the threshold value N2 ( S11). When the measured value of the response time is equal to or greater than the threshold value N2 (Yes in S11), it is determined whether the count number of reply packets is equal to or greater than the threshold value C3 (S12). When the count number of reply packets is equal to or greater than the threshold C3 (Yes in S12), since the reply packets with poor responses have returned a predetermined number or more, the group configuration unit 721 classifies the flow into a failure group (S7). . When the count number of reply packets is less than the threshold value C3 (Yes in S12), the group configuration unit 721 classifies into a performance degradation group and a failure group based on the determination in S10.
The above grouping results are stored in the group storage unit 722.

  FIG. 9 is a state transition diagram showing the determination in the grouping of FIG. In the items 81 to 89 for determining each group into a normal group, a performance degradation group, and a failure group, (1) is a determination of the response time, (2) is a determination of the count number of the reply packet, (3) Indicates the consistency between the setting information and the list.

(Estimated cause of service impact)
The component extraction unit 63 includes a first cause specifying unit 631 and a second cause specifying unit 632. The component extraction unit 63 compares the flow models with each other and estimates a physical facility or the software that causes a service influence on the communication network 10 from the comparison result. The first cause identifying unit 631 and the second cause identifying unit 632 of the component extraction unit 63 perform the estimation using different methods.
First, the first cause identifying unit 631 compares the flow models for each flow within the performance degradation group or the failure group classified as described above, and extracts physical equipment or software that is a common element, The extracted physical equipment or software is estimated as a cause of service influence.
In the example of FIG. 10A, the flow models with the flow IDs P11 and P12 are compared within the performance degradation group or the failure group, and the switch 12 with the physical equipment ID ps95 as a common element is extracted. Yes.

  The second cause identifying unit 632 compares the flow models of each flow between the performance degradation group or the failure group classified as described above and the normal group, and the common physical equipment or software has a service impact. The physical equipment or software remaining is excluded from the cause candidates, and the extracted physical equipment or software is estimated as a cause of service influence.

In the example of FIG. 10B, the flow model whose performance ID is P21 of the performance degradation group or failure group is compared with the flow model whose flow ID is P22 of the normal group, and the software ID which is a common element is “ The application software 22 of “bk2” and the switch 12 whose physical equipment ID is “ps95” are excluded as common, and the physical equipment or software which is the remaining element is extracted.
In this way, the constituent elements extracted by the first cause identifying unit 631 or the second cause identifying unit 632 are stored in the extracted element storage unit 64.

FIG. 11 is a flowchart for selecting whether to use the first cause specifying unit 631 or the second cause specifying unit 632 of the component extraction unit 63.
That is, the component extraction method determination unit 62 selects whether to use the first cause specifying unit 631 or both the first cause specifying unit 631 and the second cause specifying unit 632 by the processing of FIG. In this case, a threshold value D1 related to the failure flow number described later is stored in the failure flow number threshold storage unit 733, and similarly, a threshold value D2 related to the performance deterioration flow number described later is stored in the performance deterioration flow number threshold storage unit 734. In the present process, each threshold value is used.

  The component extraction method determination unit 62 executes the process of FIG. 11 for each flow. First, when the flow is classified into the performance degradation group (Yes in S21), the component element extraction method determination unit 62 sets the number of performance degradation flows, which is the number of flows classified into the performance degradation group, as a threshold value. It is determined whether or not the threshold value D1 is greater than or equal to (S22). When the number of performance degradation flows is equal to or greater than the threshold value D1 (Yes in S22), the component element extraction method determination unit 62 uses the first cause identification unit 631 (S23). When the number of performance degradation flows is less than the threshold value D1 (No in S22), the component extraction method determination unit 62 uses the second cause specifying unit 632 after using the first cause specifying unit 631 (S24). (S25).

On the other hand, when the corresponding flow is classified into the failure group (Yes in S26), the component extraction method determination unit 62 uses the failure flow number that is the number of flows classified into the failure group as the threshold value. It is determined whether or not the threshold value D2 is exceeded (S27). When the number of failure flows is equal to or greater than the threshold value D2 (Yes in S27), the component extraction method determining unit 62 uses the first cause identifying unit 631 (S23). When the number of failure flows is less than the threshold D2 (No in S27), the component extraction method determination unit 62 uses the first cause specifying unit 631 (S24) and then uses the second cause specifying unit 632 ( S25).
As described above, when the first cause specifying unit 631 or the second cause specifying unit 632 is used and the physical equipment or software that is the constituent element is extracted as described above, the extracted constituent element is the cause of the service influence. (S28).

(Modification of service cause estimation)
A modified example of the service influence cause estimation process described above will be described with reference to FIGS.

  FIG. 12 is an explanatory diagram for explaining the modification. FIG. 12A shows an example of a flow model of a normal group and a failure group (performance degradation group). In this example, first, the component extraction unit 63 compares the flow models of each flow within the performance degradation group or the failure group, and counts the number of common physical facilities or software, respectively. FIG. 12B shows an example of the count result. For example, the count number is “21” for the application software 22 with the software ID “a1”, and the count number is “17” for the switch 12 with the physical facility ID “vs3”.

  After that, the component extraction unit 63 compares the flow models of each flow between the performance deterioration group or failure group thus compared and the normal group, and for common physical equipment or software, FIG. As exemplified in (c), the number of counts is set to zero. In the example of FIG. 12C, since the application software 22 having the software ID “a1” is common between the performance deterioration group or the failure group and the normal group, the count number is changed from “21” to “0”. The switch 12 whose physical equipment ID is “vs3” is not common between the performance degradation group or the failure group and the normal group, and therefore the count number remains “17”. Examples are shown (both are “total”).

Then, the component extraction unit 63 finally extracts the physical facility or software having the maximum number of counts, and estimates the extracted physical facility or software as the cause of the service influence. In the example of FIG. 12C, the physical facility or software having the largest count is the count number “45” of the switch 12 whose physical facility ID is “s3”, which is the “final result”. Therefore, the component extraction unit 63 estimates that the switch 12 having the physical facility ID “s3” is the cause of the service influence.
In such a process, the physical equipment or software having the maximum number of counts may be finally extracted, and the extracted physical equipment or software may be plural.

In this case, the extracted plurality of physical facilities or software will be described. First, as described above with reference to FIG. 1, IDs (physical facility ID, server ID, and software ID) are assigned to each unit on the communication network 10.
On the other hand, as the physical equipment ID and software ID, the correlation between the physical equipment or software indicated by the ID and the other physical equipment, software, or server that is in a parent-child relationship or connection relationship with the physical equipment or software. Use what is shown.

FIG. 13 is a diagram illustrating an example in which such a correlated ID is used as the physical facility ID and the software ID in the example of FIG. For example, in the link 13 whose physical equipment ID is “l1: sv01: s1”, the part “l1” of the physical equipment ID indicates the link 13 itself, and the part “sv01” subsequent thereto is the switch 12. Similarly, the “s1” portion indicates the ID of the switch 12 that is connected to the switch 12.
By using such physical facility ID and software ID, it is possible to recognize other physical facilities, software, or servers that are in a parent-child relationship or connection relationship with the ID from the ID.

  FIG. 14 is an explanatory diagram of processing executed using the ID of FIG. In this example, the current result obtained by the processing of FIG. 12 is that the physical equipment ID or software ID (only the part corresponding to the example of FIG. 1 is shown in FIG. 14) is “b2”, “vs2”, respectively. “25” is the number of physical equipment or software counts in the case of “12”. That is, this is a case where a plurality of physical facilities or software that cause the service influence are estimated. In this case, the constituent element extraction unit 63 may connect the plurality of physical facilities or software this time, or the physical facility or software estimated in the process performed last time and the physical facility or software estimated in the process performed this time. When there is the above-described parent-child relationship or connection relationship with software, a priority is given to the number of physical facilities or software counts that have been estimated this time.

In the example of FIG. 14, the application software 22 whose software ID is “b2 (“ b2: vs2 ”in FIG. 13)” and the virtual whose software ID is “vs2 (“ vs2: b1: b2 ”in FIG. 13)”. Since there is a parent-child relationship with the switch 21 (the former is a child and the latter is a parent), the priority of the virtual switch 21 whose parent software ID is “vs2 (“ vs2: b1: b2 ”in FIG. 13)” Increase the degree by +1. Further, the previous result of the link 13 whose physical equipment ID is “l2 (in FIG. 13,“ l2: sv02: s1 ”) and the software ID is“ vs2 (in FIG. 13, “vs2: b1: b2”) ”. Since there is a direct connection relationship with the current result of the virtual switch 21, the influence of the link 13 whose physical facility ID is “l2 (“ l2: sv02: s1 ”in FIG. 13)” has spread. And the priority of the current result of the virtual switch 21 whose software ID is “vs2 (in FIG. 13,“ vs2: b1: b2 ”)” is lowered by −0.5.
Since there is no parent-child relationship or connection relationship between the previous result of the switch 12 whose physical facility ID is “s3 (“ s3: l4: l5 ”in FIG. 13)” and the current result, the switch 12 Estimate that is alone and raise the priority by +1.

  As a result, the final result of the application software 22 whose software ID is “b2 (in FIG. 13,“ b2: vs2 ”) is“ 25 ”, and the software ID is“ vs2 ”(in FIG. 13,“ vs2: b1: b2 ”). The final result of the virtual switch 21 of “)” is “25.5”, and the final result of the switch 12 whose physical equipment ID is “s3 (“ s3: l4: l5 ”in FIG. 13)” is “26”.

  With the above processing, the physical equipment and software search order is such that the physical equipment ID having the large final result value is “s3 (in FIG. 13,“ s3: l4: l5 ”)” and the software ID is “vs2 (FIG. 13, the virtual switch 21 is “vs2: b1: b2)” and the application software 22 is “b2” (“b2: vs2” in FIG. 13).

  According to the present embodiment described above, it is possible to detect software failures and deterioration, the work is simple, the apparatus scale is relatively small, and the cause of the service quality deterioration can be estimated. The cause estimation apparatus 1, the service influence cause estimation program 45, and the service influence cause estimation method can be provided.

1 Service Effect Cause Estimation Device 45 Service Effect Cause Estimation Program 50 Storage Unit 60 Processing Unit (Estimation Unit)
61 Model generation unit 70 Management unit (estimation unit)
631 First cause identifying unit 632 Second cause identifying unit 721 Group configuration unit 741 Test packet generation unit 742 List generation unit 743 Packet transmission unit 744 Packet reception unit 745 Reply storage unit

Claims (7)

For a flow configured using at least one or more of physical equipment and software for transferring data on a communication network, a flow ID for identifying the flow, a physical equipment ID for identifying the physical equipment, and the physical equipment A storage unit that associates and stores a server ID that identifies the server and a software ID that identifies the software used in each server;
With reference to the storage unit, a model generation unit that generates a flow model that is a model for specifying the ID of the physical facility and software through which data flows for each flow and the order in which the data flows;
An estimation unit that compares the flow models and estimates the physical equipment or the software that causes a service influence on the communication network from the comparison result , and
The estimation unit includes
A list generation unit for generating a list capable of storing the software ID;
A test packet generator for generating a test packet having the list;
A packet transmitter that transmits a predetermined number of the test packets within a predetermined time for each flow;
A packet receiving unit that receives a reply packet of the test packet in which the ID of the software that the test packet has passed is stored in the list;
A reply storage unit for storing the received reply packet;
With
A group configuration unit that classifies each flow into a normal group and an abnormal group based on a measurement result of reception of the reply packet stored in the reply storage unit;
The group component is
The response time as the measurement result and the count number of replies as the measurement result are within the respective predetermined values, respectively, and the software ID acquired from the storage unit and the software ID stored in the reply packet list , And classify the flows having the same software ID as a normal group, classify the other flows as an abnormal group, and the measured value of the response time and the count number for the abnormal group. The flow in which at least one software ID does not match when each is within the range of each predetermined value or when the software ID acquired from the storage unit is compared with the software ID stored in the list of reply packets Are classified into failure groups, and the other flows are Classify into performance degradation groups,
The estimation unit includes
Compare the flow models of each flow within the performance degradation group or within the failure group, extract the common physical equipment or software, and estimate the extracted physical equipment or software as the cause of the service impact A first cause identifying unit;
The flow model of each flow is compared between the performance degradation group or the failure group and the normal group, and the common physical equipment or the software is excluded from candidates for the cause of the service influence and remains. Extracting the physical equipment or the software, and estimating the extracted physical equipment or the software as a cause of the service influence;
A service influence cause estimation device characterized by comprising: The predetermined value used for the response time in the group configuration unit is obtained by taking an average value or using a statistical method for the response time for the test packet transmitted by a predetermined value within a predetermined time. The predetermined value used for the count number is obtained by taking an average value of the count numbers for the test packet transmitted by a predetermined value within a predetermined time or using a statistical method. The service influence cause estimation device according to claim 1 . The estimation unit uses the first cause identifying unit when the number of flows allocated to the failure or performance degradation group is equal to or greater than a predetermined threshold for the same group, and when the number is less than the predetermined threshold, 3. The service influence cause estimation device according to claim 1, wherein after the first cause specifying unit is used, the cause of the service influence is estimated using the second cause specifying unit. . The estimation unit compares the flow models of the flows in the performance deterioration group or the failure group, counts the number of the common physical equipment or the software, and then performs the comparison. The flow models of the respective flows are compared between the deterioration group or the failure group and the normal group, the number of the count is set to 0 for the common physical equipment or the software, and finally the number of the count 4. The physical equipment or the software having the largest value is extracted, and the extracted physical equipment or the software is estimated as a cause of the service influence . The service influence cause estimation device according to one item . The storage unit correlates the physical equipment or software indicated by the ID as the physical equipment ID and the software ID, and other physical equipment, software, or server that is in a parent-child relationship or connection relationship with the physical equipment or software. Showing the relationship,
The estimation unit, when a plurality of the physical equipment or software that is a cause of the service influence is estimated, the physical equipment or software, or the physical equipment estimated by the previous estimation. Or, when there is a parent-child relationship or a connection relationship between the software and the physical facility or the software estimated by the estimation performed this time, the count of the physical facility or the software estimated a plurality of times performed this time The service influence cause estimation device according to claim 4 , wherein a priority is given to the number of the service influences. For a flow configured using at least one or more of physical equipment and software for transferring data on a communication network, a flow ID for identifying the flow, a physical equipment ID for identifying the physical equipment, and the physical equipment The physical facility and the software in which data flows for each flow with reference to a storage unit that associates and stores a server ID that identifies the server and a software ID that identifies the software used in each server A model generation process for generating a flow model which is a model for specifying the ID and the order in which the data flows;
An estimation process for comparing the flow models and estimating the physical equipment or the software that causes a service influence on the communication network from the comparison result;
To the computer,
The estimation process includes
A list generation process for generating a list capable of storing the software ID;
A test packet generation process for generating a test packet with the list;
Packet transmission processing for transmitting a predetermined number of the test packets within a predetermined time for each flow;
A packet reception process for receiving a reply packet of the test packet in which the ID of the software that the test packet has passed is stored in the list;
A reply storing process for storing the received reply packet;
To the computer,
Causing a computer to execute a group configuration process for classifying each flow into a normal group and an abnormal group based on a measurement result of reception of the reply packet stored in the reply storage process;
The group configuration process includes:
The response time as the measurement result and the count number of replies as the measurement result are within the respective predetermined values, respectively, and the software ID acquired from the storage unit and the software ID stored in the reply packet list , And classify the flows having the same software ID as a normal group, classify the other flows as an abnormal group, and the measured value of the response time and the count number for the abnormal group. The flow in which at least one software ID does not match when each is within the range of each predetermined value or when the software ID acquired from the storage unit is compared with the software ID stored in the list of reply packets Are classified into failure groups, and the other flows are Classify into performance degradation groups,
The estimation process includes
Compare the flow models of each flow within the performance degradation group or within the failure group, extract the common physical equipment or software, and estimate the extracted physical equipment or software as the cause of the service impact A first cause identification process;
The flow model of each flow is compared between the performance degradation group or the failure group and the normal group, and the common physical equipment or the software is excluded from candidates for the cause of the service influence and remains. Extracting the physical equipment or the software, and estimating the extracted physical equipment or the software as a cause of the service influence;
A computer-readable service influence cause estimation program characterized by causing a computer to execute. For a flow configured using at least one or more of physical equipment and software for transferring data on a communication network, a flow ID for identifying the flow, a physical equipment ID for identifying the physical equipment, and the physical equipment The physical facility and the software in which data flows for each flow with reference to a storage unit that associates and stores a server ID that identifies the server and a software ID that identifies the software used in each server A model generation step for generating a flow model, which is a model for specifying the ID and the order in which the data flows;
An estimation step of comparing the flow models and estimating the physical equipment or the software that causes a service influence on the communication network from the comparison result;
With
The estimation step includes
A list generation step of generating a list capable of storing the software ID;
A test packet generating step for generating a test packet with the list;
A packet transmission step of transmitting a predetermined number of the test packets for each flow within a predetermined time;
A packet receiving step of receiving a reply packet of the test packet in which the ID of the software that the test packet has passed is stored in the list;
A reply storing step for storing the received reply packet;
With
A group configuration step of classifying each flow into a normal group and an abnormal group based on a measurement result of reception of the reply packet stored in the reply storage step;
The group configuration process includes:
The response time as the measurement result and the count number of replies as the measurement result are within the respective predetermined values, respectively, and the software ID acquired from the storage unit and the software ID stored in the reply packet list , And classify the flows having the same software ID as a normal group, classify the other flows as an abnormal group, and the measured value of the response time and the count number for the abnormal group. The flow in which at least one software ID does not match when each is within the range of each predetermined value or when the software ID acquired from the storage unit is compared with the software ID stored in the list of reply packets Are classified into failure groups, and the other flows are Classify into performance degradation groups,
The estimation step includes
Compare the flow models of each flow within the performance degradation group or within the failure group, extract the common physical equipment or software, and estimate the extracted physical equipment or software as the cause of the service impact A first cause identification step;
The flow model of each flow is compared between the performance degradation group or the failure group and the normal group, and the common physical equipment or the software is excluded from candidates for the cause of the service influence and remains. Extracting the physical equipment or the software, and estimating the extracted physical equipment or the software as a cause of the service influence;
A service influence cause estimation method characterized by comprising:

Images