JP7007998B2 - Setting information management device, setting information management method, and program - Google Patents

Description

The present invention relates to a technique for determining whether or not the settings of a device connected to a network are correct.

In recent years, various network services such as cloud services have been provided. In order to provide such a service, the service provider installs a large number of devices at a plurality of bases and implements various settings.

For these devices, for example, in order to add functions or improve security, setting changes such as software version upgrades are carried out at any time. When the settings for the device are changed, it is necessary to confirm whether the changed settings are correct.

As one of the methods for confirming the correctness of the setting, there is a method in which the administrator visually confirms the setting applied to the device from a management terminal or the like.

Japanese Unexamined Patent Publication No. 2014-7552

For example, the administrator visually compares the setting contents changed by the software version upgrade with the setting contents before the version upgrade to determine whether the changed settings are the correct settings. However, when changing settings such as software version upgrades, there are dozens of changes, and it is not easy to accurately judge the correctness of these.

The present invention has been made in view of the above points, and an object of the present invention is to provide a technique capable of efficiently determining whether or not a device setting is correct in a system composed of a plurality of devices. And.

According to the disclosed technology, a setting information acquisition unit that acquires setting information from one or more devices in a system composed of a plurality of devices, and a setting information acquisition unit.
Comparison execution that compares the first setting information, which is the setting information of a certain device, with the second setting information, which is the setting information of another device whose purpose, base, and collection time are different from that of the device. Department and
A determination unit for determining whether or not the difference information obtained by the comparison of the comparison execution unit is correct difference information according to a predetermined rule is provided.
The predetermined rule is a rule for a certain parameter in the first setting information and the second setting information, and another parameter having a correlation with the parameter.
A setting information management device characterized by this is provided.

According to the disclosed technique, there is provided a technique capable of efficiently determining whether or not a device setting is correct in a system composed of a plurality of devices.

It is an overall block diagram of the system in embodiment of this invention. It is a functional block diagram of the setting management apparatus 100. It is a figure which shows the hardware configuration example of the setting management apparatus 100. It is a flowchart which shows the procedure of the process of a setting management apparatus 100. It is a figure which shows the example of the data structure stored in the setting information storage part 106. It is a figure for demonstrating the outline of the difference obtained by the time series and the comparison between bases. It is a figure which shows the image of the comparison which is realized.

Hereinafter, embodiments of the present invention (the present embodiments) will be described with reference to the drawings. The embodiments described below are merely examples, and the embodiments to which the present invention is applied are not limited to the following embodiments. For example, in the following embodiment, an example of determining the correctness of the setting of the device constituting the system for providing the network service is described, but the application destination of the present invention is not limited to this. The present invention can be applied to any device as long as it can acquire setting information.

(Overall system configuration)
In recent years, technology for constructing a network using virtual network technology has become widespread, and in such an environment, it is possible to construct a network without physically constructing equipment, and provisioning using an automatic configuration script is possible. Is possible. The system in this embodiment is, for example, a system in such a network. However, the present invention is not limited to this, and the system in the present embodiment may be a system in a network for constructing physical equipment. FIG. 1 shows the overall configuration of the system according to the present embodiment. As shown in FIG. 1, the whole system in the present embodiment has a target environment 10, a setting management device 100, and a terminal 200.

The target environment 10 is a target of setting management by the setting management device 100, and includes one or a plurality of servers (computers) and communication devices. Normally, a plurality of target environments 10 exist, and the plurality of target environments 10 constitute a system for providing a certain network service. The server, communication device, and the like constituting each target environment 10 may be a physical device or a virtual machine.

Multiple target environments form a group. For example, a group may be formed for each geographical base, a group may be formed for each provided service, a group may be formed for each organization, or a group may be formed for each purpose. Alternatively, a group may be formed based on other viewpoints.

Further, as an example, in the present embodiment, one or more target environments at one site have one or more of a development environment, a staging environment, and a commercial environment. Hereinafter, the development environment may be referred to as dev, the staging environment may be referred to as stage, and the commercial environment may be referred to as prod.

Development environment, staging environment, commercial environment, etc. are classified according to the difference in the purpose of the environment. The development environment is an environment for development. The commercial environment is an environment for providing actual services. The staging environment is, for example, an environment in which reproduction confirmation when a failure occurs in a commercial environment, behavior confirmation before release, and the like are performed.

The setting management device 100 acquires setting information from each target environment in the system, and stores the setting information as text data that can be compared between the target environments. For example, after upgrading the version in a certain target environment, the setting management device 100 compares the setting information of the target environment with the setting information of another target environment, and outputs the comparison result. The details of the comparison will be described later.

The terminal 200 is a terminal used by a user who manages the target environment 10 and the like. The terminal 200 may be any device as long as it can communicate with the setting management device 100 via a network and output a comparison result or a determination result, and is, for example, a PC, a smartphone, a tablet, or the like. The setting management device 100 itself may be the user's terminal. In this case, the user can confirm the comparison result and the determination result by confirming the screen of the setting management device 100.

(Functional configuration of setting management device 100)
FIG. 2 shows an example of the functional configuration of the setting management device 100. As shown in FIG. 2, the setting management device 100 includes a setting information acquisition unit 101, a comparison execution unit 102, a learning unit 103, a determination unit 104, an input / output unit 105, a setting information storage unit 106, a teacher data storage unit 107, and a teacher data storage unit 107. A rule storage unit 108 is provided. The learning unit 103 and the teacher data storage unit 107 may be provided outside the setting management device 100. The outline of the functions of each part is as follows.

The setting information acquisition unit 101 acquires setting information from the target environment 10, and stores the acquired setting information in the setting information storage unit 105.

The comparison execution unit 102 compares the setting information between two different target environments and outputs the comparison result (difference, etc.). The two different target environments are two target environments in which at least one of the base, the purpose, and the setting information acquisition time is different.

In the learning phase, the difference information output from the comparison execution unit 102 is output from the input / output unit 105, and whether or not the difference is correct (may be paraphrased as "acceptable or not") is determined by a person. To. The difference information and the determination result are stored in the teacher data storage unit 107. The data stored in the teacher data storage unit 107 is not limited to the data judged by a person, but the data automatically judged by using a rule or the data automatically judged by using a rule is corrected by a person. The data is also stored in the teacher data storage unit 107.

The learning unit 103 performs machine learning using the teacher data stored in the teacher data storage unit 107, and creates a rule (may be referred to as a "model"). The rule is stored in the rule storage unit 108. It should be noted that using machine learning is an example, and rules may be created by a method other than machine learning.

In the comparison determination phase, the determination unit 104 determines whether or not the difference is correct based on the difference obtained by the comparison executed by the comparison execution unit 102 and the rule stored in the rule storage unit 108.

The input / output unit 105 outputs a comparison result, a determination result, and the like. The output comparison result, determination result, etc. are displayed on the terminal 200.

(Hardware configuration example)
The setting management device 100 can be realized, for example, by causing a computer to execute a program describing the processing contents described in the present embodiment. That is, the function of the setting management device 100 is to execute a program corresponding to the processing performed by the setting management device 100 by using the hardware resources such as the CPU, memory, and hard disk built in the computer. It is possible to achieve it. The above program can be recorded on a computer-readable recording medium (portable memory, etc.), stored, and distributed. It is also possible to provide the above program through a network such as the Internet or e-mail.

FIG. 3 is a diagram showing a hardware configuration example when the setting management device 100 is realized by a computer. The setting management device 100 shown in FIG. 3 has a drive device 150, an auxiliary storage device 152, a memory device 153, a CPU 154, an interface device 155, a display device 156, an input device 157, and the like, which are connected to each other by a bus B, respectively. ..

The program that realizes the processing in the setting management device 100 is provided by, for example, a recording medium 151 such as a CD-ROM or a memory card. When the recording medium 151 in which the program is stored is set in the drive device 150, the program is installed in the auxiliary storage device 152 from the recording medium 151 via the drive device 150. However, the program does not necessarily have to be installed from the recording medium 151, and may be downloaded from another computer via the network. The auxiliary storage device 152 stores the installed program and also stores necessary files, data, and the like.

The memory device 153 reads and stores the program from the auxiliary storage device 152 when the program is instructed to start. The CPU 154 (processor) realizes the function related to the setting management device 100 according to the program stored in the memory device 153. The interface device 155 is used as an interface for connecting to a network. The display device 156 displays a programmatic GUI (Graphical User Interface) or the like. The input device 157 is composed of a keyboard, a mouse, buttons, a touch panel, or the like, and is used for inputting various operation instructions.

When the setting management device 100 is operated only remotely or the display is performed only remotely, the display device 156 and the input device 157 may not be provided.

(Operation example)
Next, the operation of the setting management device 100 will be described according to the procedure of the flowchart of FIG. As shown in FIG. 4, the operation of the setting management device 100 includes a learning phase in which rules are learned and a comparison determination phase in which a determination is made for a comparison result using the rules. However, once the rule is created, the rule may be updated at any time by learning using the result obtained in the comparison judgment phase as teacher data while the comparison judgment phase also serves as the learning phase. ..

Further, the setting management device 100 may not have a learning function and a function of performing a determination using a rule. This is because it is possible for a person to efficiently and accurately determine whether or not the setting is correct by outputting the comparison result of the setting information between the target environments in the present embodiment. However, by providing a learning function and a function for making a judgment using a rule, it is possible to make a more efficient and accurate judgment.

<S101: Collection of setting information>
In S101, the setting information acquisition unit 101 collects setting information from each target environment in the system, and stores the obtained setting information in the setting information storage unit 106. The setting information acquisition unit 101 may collect the setting information of all the target environments at predetermined time intervals, for example, or the setting has been changed in a certain target environment (for example, the software version has been upgraded). ) May be used as a trigger to collect the setting information of the target environment and other target environments. The setting information of the target environment is the setting information of each device constituting the target environment.

The collected setting information is stored in the setting information storage unit 105 for each purpose, base, and time of collection, for example.

FIG. 5 shows an example of a data structure stored in the setting information storage unit 105. FIG. 5 shows an example of data collected at a certain time T. Data as shown in FIG. 5 is stored for each time. As shown in FIG. 5, the storage is performed in the form of the setting information of the target environment of the dev of the base 1, the setting information of the target environment of the dev of the base 2, and so on.

The data of the setting information of each target environment includes various information that can be acquired as setting information, such as a device name, an IP address, a port number, and a software version of the device. Further, the data stored as the setting information is, for example, text data that can be compared with each other.

<S102: Comparison>
Next, the comparison execution unit 102 compares the setting information between the target environments. In this embodiment, various comparisons such as time-series comparison, comparison between bases, and comparison between purposes are carried out. An example of this comparison process will be described with reference to FIGS. 6 and 7.

In the example of FIG. 6, a comparison between the staging environment (stage) after the version upgrade at the base 1 and the commercial environment (before the version upgrade) at the base 1, the staging environment (stage) after the version upgrade at the base 1 and the base 3 Comparison with the commercial environment (upgraded) of. Further, in the comparison of the setting information between the target environments, it is shown that the comparison is performed between the same type of devices.

For example, if there is a difference between the staging environment (stage) after the version upgrade of base 1 and the commercial environment (before version upgrade) of base 1 indicated by A and B, if there is a difference, there is a difference between the staging environment and the commercial environment. You can see what has changed. The settings after the version upgrade should be the same except for the contents changed by the version upgrade, but in the commercial environment, the settings may have changed due to troubleshooting. By this comparison, such a difference can be grasped. You can also check whether the changes made by the version upgrade are the expected changes. Further, in the determination step described later, a person (user of the setting management device 100) can determine whether or not the difference is correct (whether or not it is acceptable).

In addition, if there is a difference between the staging environment (stage) after the version upgrade of base 1 and the commercial environment (version upgraded) of base 3 indicated by C and D, if there is a difference, it is between base 1 and base 3. You can check if the change occurs only in, and if there are other changes, it is in base 3 (the environment after the version upgrade that is operating normally) and to base 1 (the unconfirmed version upgrade environment). You can see the settings that are not available or that have been added improperly. In other words, by comparing between the bases, it is possible to confirm whether the difference is as expected, and it is possible to efficiently judge whether the setting is correct or incorrect.

For example, the comparison execution unit 102 may make a comparison between the target environment and another target environment in which at least one of the purpose, the base, and the collection time is different for each target environment. Further, the comparison execution unit 102 may perform comparison with another target environment in which at least one of the target environment, the purpose, the base, and the software version is different for each target environment.

By making such a comparison, as illustrated in FIG. 7, it is possible to make a comparison across bases, purposes, and times. In other words, in a three-dimensional space having three axes of base, purpose, and time, it is possible to compare setting information between any two target environments existing in the three-dimensional space. It is also possible to compare the setting information between any three or more target environments, but this is realized by the combination of the processing of comparing the setting information between the two target environments. be.

In the learning phase, the comparison result by the comparison execution unit 102 is output by the input / output unit 105, and the user who makes the determination visually checks the comparison result from the terminal 200. For example, as a result of comparison between the setting information of a certain device (example: Web server) in a certain target environment and the setting information of the same type of device (Web server) in another target environment, the difference that the second octet of the IP address is different. Is detected, information indicating the difference is displayed on the terminal 200.

<S103: Judgment>
In S103 of the learning phase, the user determines whether the comparison result is correct or incorrect (acceptable or unacceptable) for each set of the target environment for which the comparison is performed, and inputs the determination result to the terminal 200. As a result, the determination result is stored in the teacher data storage unit 107 together with the comparison result information via the input / output unit 105. For example, "As a result of comparing the setting information of a certain device (example: Web server) in a certain target environment and the setting information of the same type of device (Web server) in another target environment, the second octet of the IP address is different. The information of the comparison result that "one is 3 and the other is 5" and the determination result (eg, the difference is correct) are stored in the teacher data storage unit 107.

<S104: Learning>
In S104, the learning unit 103 executes learning based on the teacher data stored in the teacher data storage unit 107, creates a rule (may be referred to as a model), and transfers the created rule to the rule storage unit 107. Store. The learning here may be performed by using a machine learning method such as a neural network or SVM (support vector machine), or may be performed by using a method other than machine learning. Further, the user may create a rule and store the created rule in the rule storage unit 107.

The above rule is, for example, "as a result of comparison between the setting information of a certain device (example: Web server) in a certain target environment and the setting information of the same type of device (Web server) in another target environment, the IP address is the first. Two octets are different, one is 3 and the other is 5. ”The information of the comparison result is input, and whether or not this comparison result is correct (whether or not it is acceptable) is output.

Rule examples 1 to 3 which are examples of rules obtained by learning will be described below.

Rule example 1:
Difference: "Regarding the difference in IP address between the target environment of base A and the target environment of base B, the second octet of the IP address of the target environment of base A is 3, and the IP address of the target environment of base B is There is a difference that the second octet is 5, "-> Judgment result:" Correct ".

This rule is generated by accumulating the difference confirmed by comparing the IP addresses between the target environment of the base A and the target environment of the base B and the determination result that the difference is OK.

The following shows an example of a comparison between IP addresses and a determination result determined to be OK.

10.3.0.1 vs 10.5.0.1 ⇒ OK
10.3.100.2 vs 10.5.100.2 ⇒ OK
10.3.0.81 vs 10.5.0.81 ⇒ OK
In such a case, it is possible to generate a rule that it is correct that the difference between the IP addresses of the base A and the base B is the numbers 3 and 5 of the second octet. The example of such an IP address is just one example.

for example,
kw1nv-cigw0001n vs lo8nv-cigw0001n
By comparing character strings such as device names, it is possible to create a rule that the difference between "kw1" and "lo8" is correct.

Rule example 2:
Difference: "When the software version in a certain target environment changes from version 1 to version 2, the DB type changes from DB-X to DB-Y"-> Judgment result: "Correct".

The above "DB-X" and "DB-Y" are product names of the database system, respectively.

The above rule correlates with a certain parameter in a time series comparison comparing the target environment at one time with the target environment at another time (base, purpose may be the same or different). Here is an example of a rule generated by detecting another parameter. More specifically, by comparing the setting information in chronological order, it is detected that a certain parameter changes and another parameter changes at a certain point in time, and a rule is generated.

The above rule is an example when the two parameters for which the correlation is detected are the "version" and the "DB" used.

For example, the version of the software obtained from the setting information collected at a certain time T1 from the target environment of the base A is 1, the DB obtained from the setting information is DB-X, and the DB is from the target environment of the base A. The comparison result shows that the software version obtained from the setting information collected at a certain time T2 (time after T1) is 2, and the DB obtained from the setting information is DB-Y. Be done. Similar correlation information can be obtained at other bases (for example, base B). This information can be expressed as follows.

Base A: when ver = 1 the db = DB-X, when ver = 2 the db = DB-Y
Base B: when ver = 1 the db = DB-X, when ver = 2 the db = DB-Y
The learning unit 103 detects that there is a correlation between the version and the DB by comparing the setting information in the time series at a plurality of bases, and "changes the software version in the target environment from version 1 to version 2." In that case, it is correct that the type of DB changes from DB-X to DB-Y. "

Regarding the correlation, if it is detected that one of the parameters has been changed at a certain point in time by comparing the setting information in chronological order, it is determined that the parameter that has been changed at the same time has a high correlation. be able to. It is doubtful if this is only one base, but if it occurs at all bases, or if it occurs at many bases (number of bases above a certain threshold), make rules as described above. Can be done.

The correlation may be detected by machine learning, statistically, or by using a method such as brute force comparison of data.

Rule example 3: "Keep the values defined by two or more rules as system eigenvalues."
At each site, the value of the second octet (for example, 3) of the IP address of the target environment is often used as an identifier. For example, in order to uniquely identify a user at a certain site, "user {{second octet}}", which is a connection between the user's name (user) and the second octet of the IP address, is used as the user name at the site. Will be done.

In such a case, the identifier can be extracted from the setting information data as a value frequently used for the site, instead of defining a value unique to the site. In addition to the second octet of the IP address, the host name, host name prefix, postfix, etc. can also be used as identifiers.

The learning phase is executed as described above. Next, the comparison execution phase shown in S106 to S108 of FIG. 4 will be described. In the comparison execution phase, it is automatically determined whether or not the comparison result of the setting information is correct based on the rules obtained in the learning phase.

<S105: Collection of setting information>
In S105, setting information is collected in the same manner as in S101. That is, the setting information acquisition unit 101 collects setting information from each target environment in the system, and stores the obtained setting information in the setting information storage unit 106. The setting information acquisition unit 101 may collect the setting information of all the target environments at predetermined time intervals, for example, or triggers that there is a change (for example, a version upgrade) in a certain target environment. Then, the setting information of the target environment and other target environments may be collected.

<S106: Comparison>
Next, the comparison execution unit 102 compares the setting information between the target environments. The comparison process is the same as the comparison process in the learning phase, and various comparisons such as time-series comparison, comparison between bases, and comparison between purposes can be performed.

However, in the comparison judgment phase, for example, the setting of the specific target environment (referred to as the target environment S for convenience) is normal, triggered by a version upgrade in a target environment (for example, a commercial environment) of a specific base. It is assumed that you want to know whether or not.

In such a case, for example, the latest setting information of the target environment S (referred to as setting information S for convenience) and the setting information of one or more other target environments (setting information S, time, purpose, and base). At least one of them is different).

By the above comparison, for example, a difference indicating that the difference between the setting information S and the setting information of another base is only the second octet of the IP address is obtained, and the difference is correct by the following determination. If it is determined, the setting information S can be determined to be correct.

<S107: Judgment>
In S107, the determination unit 104 reads the rule from the rule storage unit 108 and inputs the difference information obtained by the comparison execution unit 102 into the rule (model) to see if the difference is correct (acceptable). Whether or not) is determined.

For example, the difference regarding the IP address is input to a rule like the rule example 1 described above, and based on the rule, it is automatically determined whether or not this difference is correct.

Further, if the difference has a correlation with the version change, it is input to a rule like the rule example 2 described above, and based on the rule, it is automatically determined whether or not this difference is correct.

It should be noted that learning may automatically determine which rule to use according to the type of difference (difference regarding IP address, difference correlated with version change, etc.).

<S108: Output>
Finally, the input / output unit 108 outputs the comparison result and the determination result (correct / incorrect). The output comparison result and determination result are displayed on the terminal 200.

(Effect of embodiment)
With the technique described above, it is possible to list and compare comparison targets without omission. In addition, by comparing the time series, the difference between the comparison points and the past can be clearly grasped, and "what has been changed" can be confirmed. In addition, for example, by comparing with other bases, it is possible to identify the omission of the setting. In addition, by learning the difference and the judgment result, it is possible to automatically perform the correctness judgment of the setting when the difference is given.

That is, it is possible to efficiently determine whether or not the device settings in a system composed of a plurality of devices are correct.

(Summary of embodiments)
As described above, according to the present embodiment, a comparison between a setting information acquisition unit that acquires setting information from one or a plurality of devices in a system composed of a plurality of devices and a comparison between the two setting information. Provided is a setting information management device including an execution unit and an output unit that outputs difference information obtained by comparing the comparison execution unit.

The setting information management device may further include a determination unit for determining whether or not the difference information is correct difference information according to a predetermined rule.

The predetermined rule is, for example, a rule regarding a predetermined octet value between IP addresses in the two setting information. The predetermined rule is, for example, a rule for a certain parameter in the two setting information and another parameter having a correlation with the parameter.

The setting information management device is a learning unit that generates the predetermined rule from the difference information obtained by the comparison of the comparison execution unit and the correct answer data indicating whether or not the difference information is the correct difference information. May be further provided.

At least one of the acquisition time, the base of the acquisition source device, and the purpose of use of the acquisition source device may be different between the two setting information.

Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes can be made within the scope of the gist of the present invention described in the claims. It is possible.

100 Setting management device 101 Setting information acquisition unit 102 Comparison execution unit 103 Learning unit 104 Judgment unit 105 Input / output unit 106 Setting information storage unit 107 Teacher data storage unit 108 Rule storage unit 150 Drive device 151 Recording medium 152 Auxiliary storage device 153 Memory device 154 CPU
155 Interface device 156 Display device 157 Input device 200 Terminal

Claims (6)

A setting information acquisition unit that acquires setting information from one or more devices in a system composed of a plurality of devices.
Comparison execution that compares the first setting information, which is the setting information of a certain device, with the second setting information, which is the setting information of another device whose purpose, base, and collection time are different from that of the device. Department and
A determination unit for determining whether or not the difference information obtained by the comparison of the comparison execution unit is correct difference information according to a predetermined rule is provided.
The predetermined rule is a rule for a certain parameter in the first setting information and the second setting information, and another parameter having a correlation with the parameter.
A setting information management device characterized by this. It is characterized by further including a learning unit that generates the predetermined rule from the difference information obtained by the comparison of the comparison execution unit and the correct answer data indicating whether or not the difference information is the correct difference information. The setting information management device according to claim 1. Claim 1 or claim 1, wherein at least one of the acquisition time, the base of the acquisition source device, and the purpose of use of the acquisition source device is different between the first setting information and the second setting information. The setting information management device according to 2 . The predetermined rule is a rule generated by comparing setting information in chronological order to detect that a certain parameter changes at a certain point in time and another parameter also changes.
The setting information management device according to any one of claims 1 to 3. It is a setting information management method executed by the setting information management device.
A setting information acquisition step for acquiring setting information from one or more devices in a system composed of a plurality of devices,
Comparison execution that compares the first setting information, which is the setting information of a certain device, with the second setting information, which is the setting information of another device whose purpose, base, and collection time are different from that of the device. Steps and
A determination step for determining whether or not the difference information obtained by the comparison in the comparison execution step is the correct difference information according to a predetermined rule is provided.
The predetermined rule is a rule for a certain parameter in the first setting information and the second setting information, and another parameter having a correlation with the parameter.
A setting information management method characterized by this. A program for making a computer function as each part in the setting information management device according to any one of claims 1 to 4 .

Images