JP7473845B2 - TEST SUBJECT EXTRACTION DEVICE, TEST SUBJECT EXTRACTION METHOD, AND TEST SUBJECT EXTRACTION PROGRAM - Google Patents

Description

The present invention relates to a test subject extraction device, a test subject extraction method, and a test subject extraction program.

In large-scale networks, operators perform various operations such as monitoring hundreds of thousands of network devices and monitoring and controlling traffic. In such networks, when a failure occurs in a network device (hereafter abbreviated as "NW device"), it is necessary to isolate the network by extracting the NW device to be tested in order to narrow down the cause of the failure.

Patent Document 1 discloses a method for creating a list of response procedures that records the causes of past failures and the procedures performed at the time, and then referring to this list to perform network isolation work when a new failure occurs and identify the network device that caused the failure.

JP 2019-124988 A

However, although Patent Document 1 discloses a procedure for isolating a network based on past data when a failure occurs in the network, it does not mention how to deal with networks that have a multi-layer structure.

In a network with a multi-layer structure, for example a network with an IP layer and a transmission layer, when a method is adopted to check for faults in network devices using packets for network diagnosis, even if the connection relationships in the IP layer can be recognized, it is difficult to recognize the connection relationships of network devices connected via the transmission layer. In other words, there are differences in the management systems and management systems for the IP layer and the transmission layer, and it is difficult for a user who maintains and manages the IP layer to grasp the configuration information of the transmission layer corresponding to the relevant IP section. For this reason, it is necessary to test for faults in all network devices in the transmission layer, which causes the problem that it takes a long time to identify the cause of the fault.

The present invention has been made in consideration of the above circumstances, and its purpose is to provide a test target extraction device, a test target extraction method, and a test target extraction program that can easily extract network devices to be subject to fault testing in general network systems, including network systems having a multi-layer structure.

A test target extraction device according to one embodiment of the present invention comprises an input unit that acquires log information of a test packet transmitted to a network and load information of a plurality of network devices installed on the network; a time zone setting unit that sets a time zone to be analyzed among the load information of each network device that changes over time based on the log information of the test packet; and a load determination unit that analyzes the load fluctuations of each network device during the time zone set by the time zone setting unit based on the load information of each network device, determines the correlation between the load fluctuations of the network device that is the source of the test packet among the plurality of network devices and the load fluctuations of other network devices, and extracts network devices that are determined to have a correlation with the source network device among the other network devices as network devices to be subject to failure testing.

A test target extraction method according to one embodiment of the present invention includes the steps of acquiring log information of a test packet transmitted to a network and load information of a plurality of network devices installed on the network, setting a time period to be analyzed from the load information of each network device that changes over time based on the log information of the test packet, analyzing the load fluctuations of each network device during the set time period based on the load information of each network device, determining a correlation between the load fluctuations of the network device that is the source of the test packet among the plurality of network devices and the load fluctuations of other network devices, and extracting a network device that is determined to have a correlation with the source network device among the other network devices as a network device to be subjected to a failure test.

One aspect of the present invention is a test subject extraction program for causing a computer to function as the above-mentioned test subject extraction device.

According to the present invention, it becomes possible to easily extract network devices to be subjected to fault testing in general network systems, including network systems having a multi-layer structure.

FIG. 1 is a block diagram showing the configuration of a test object extraction device according to an embodiment of the present invention and its peripheral devices. FIG. 2 is an explanatory diagram showing a network with a multi-layer structure in which a network device to be a target of a failure test is extracted by a test object extraction device according to an embodiment of the present invention. FIG. 3 is a graph showing changes in CPU utilization during time period t1 detected by each network device. FIG. 4 is a flowchart showing a processing procedure performed by the test object extraction device according to the embodiment of the present invention. FIG. 5 is a graph showing the change in CPU utilization rate, the peak value, and the peak time during time period t1 detected by each network device. FIG. 6 is a block diagram showing a hardware configuration of the test object extraction device.

[Configuration of this embodiment]
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will now be described with reference to the accompanying drawings. First, an outline of the embodiment will be described.

The test target extraction device of this embodiment focuses on the correlation of changes in the computational load in each network device (including IP devices R1 to R3 and transmission devices N1 to N20 described below) installed in the network when a test packet, such as an ICMP (Internet Control Message Protocol) packet, is sent.

In other words, since ICMP packets are processed by the CPU installed in the network device, for example, when the source network device sends a network diagnostic program "ping," which is an example of an ICMP packet, the CPU usage rate and other computational loads (hereinafter referred to as "device loads") in this network device increase at almost the same time.

Furthermore, the network device that receives the "ping" generates a reply packet to send response data, which increases the load on the device. Similarly, the load on network devices that exist on the transmission path between the network device that sent the "ping" and the network device that received the "ping" also increases.

Therefore, the test target extraction device transmits an ICMP packet from a source network device (hereinafter referred to as the "source network device") installed in the network to other network devices whose operation status is to be checked, and further detects the equipment load of each network device. The test target extraction device identifies, among multiple network devices, network devices whose equipment load has changed in a manner that correlates with the equipment load of the source network device. For example, network devices whose peak time coincides with the equipment load of the source network device and network devices whose equipment load increase timing coincides with the equipment load of the source network device are identified as correlated network devices. The identified network devices are extracted as network devices to be subject to failure testing.

2, when network 7 has a two-layer multi-layer structure of IP layer 71 and transmission layer 72, which is a layer below IP layer 71, and when it is desired to check the operating status of IP device R3, an ICMP packet is sent from IP device R1 (source network device) to IP device R3. At this time, the ICMP packet is sent to IP device R3 via six transmission devices N1, N3, N4, N5, N7, and N8, as shown by route L1 in transmission layer 72.

Therefore, the device load of transmission devices N1 and N8 fluctuates. The fluctuation in device load is linked to the fluctuation in device load of IP device R1, which is the source of the ICMP packet. In this embodiment, network devices (IP devices, transmission devices) whose device load fluctuates in correlation with the fluctuation in device load of IP device R1, which is the source of the ICMP packet, are identified, and the identified network devices are extracted as network devices on which to perform failure testing.

Below, with reference to Figure 1, we will explain the test target extraction device 100 related to one embodiment of the present invention.

The test target extraction device 100 comprises an input/output unit 1, a processing unit 2, and an information storage unit 3. The test target extraction device 100 is connected to a transmission OpS 4 (transmission operating system), an IPOpS 5 (IP operating system), a monitoring OpS 6 (monitoring operating system), and a network 7.

As shown in Figure 2, network 7 has a two-layer structure consisting of an IP layer 71 and a transmission layer 72. The IP layer 71 has multiple (three in the figure) IP devices R1, R2, and R3. The transmission layer 72 has multiple (20 in the figure) transmission devices N1 to N20. The IP devices and transmission devices are examples of network devices.

In this embodiment, the network 7 has a two-layer structure of an IP layer 71 and a transmission layer 72. However, the present invention is not limited to this and can be applied to a multi-layer structure of three or more layers. Furthermore, the present invention can be applied to a normal network that is not a multi-layer network.

The IPoP5 (IP transmission unit) shown in Figure 1 controls the output of an ICMP packet from IP device R1 provided on network 7 when a test packet output command is output from test object extraction device 100. For example, it controls the output of an ICMP packet from IP device R1 to IP device R3, the target of operational status confirmation. IPoP5 also outputs log information of the ICMP packet sent to network 7 to test object extraction device 100. The log information includes various information related to the ICMP packet, including the time period in which the ICMP packet was sent (time period t1, described below).

The transmission OpS 4 transmits a fault check packet for performing a fault test to the network device that is extracted as a target for the fault test output by the test target extraction device 100, and performs a fault check test on the network device that is the target of the fault test. Details of the fault check test are omitted.

The monitoring OpS 6 acquires device load information (load information) detected by each IP device R1-R3 and transmission device N1-N20 included in the network 7. The device load includes the CPU usage rate of each device and the computational load required for computation. The monitoring OpS 6 outputs the acquired device load information to the test target extraction device 100.

The input/output unit 1 has an input unit 11 and an output unit 12.

The input unit 11 inputs ICMP packets output from the IPOpS 5. The input unit 11 also inputs various information including device load information detected by each IP device R1 to R3 detected by the monitoring OpS 6 and each transmission device N1 to N20. The input unit 11 also inputs various operation signals by the user.

That is, the input unit 11 acquires log information of ICMP packets sent from the IPOpS 5 to the network 7 (e.g., a network having multiple layers), and load information of multiple network devices installed in the network 7.

The output unit 12 outputs a control signal for outputting an ICMP packet to the IPOpS 5 when a command to output a test packet is output from the test packet output command unit 23 described later. The output unit 12 also outputs a control signal for causing the transmission OpS 4 to perform a fault test when a network device to be the target of a fault test is extracted by the load determination unit 22 described later.

The information storage unit 3 includes an apparatus load information storage unit 31 and a test packet log storage unit 32.

The device load information storage unit 31 stores various information, including the device load, of each IP device R1 to R3 and each transmission device N1 to N20 inputted via the input unit 11.

The test packet log storage unit 32 stores log information of ICMP packets sent by the IPOPS 5. As mentioned above, the log information includes information regarding the time period when the ICMP packets were sent.

The processing unit 2 includes a time zone setting unit 21, a load judgment unit 22, and a test packet output command unit 23.

The time zone setting unit 21 sets the time zone to be analyzed from the device load information of each network device (IP device, transmission device) that changes over time based on the log information of the ICMP packet sent by IPOPS5 and the device load information detected by each IP device R1 to R3 and each transmission device N1 to N20.

The load determination unit 22 analyzes the load fluctuations of each network device during the time period set by the time period setting unit 21, based on the load information of each network device stored in the device load information storage unit 31. The load determination unit 22 also determines the correlation between the load fluctuations of the network device that is the source of the ICMP packet (IP device R1 in the example shown in Figure 2) and the load fluctuations of other network devices. The load determination unit 22 also extracts, from among the other network devices, network devices that are determined to have a correlation with the load fluctuations of the source network device, as network devices to be subject to failure testing. The load determination unit 22 also outputs information on the network devices extracted as subjects of failure testing to the output unit 12.

A more detailed explanation will be given below with reference to Figure 3. Figure 3 is a graph showing the fluctuations in CPU usage of each IP device and each transmission device when a network diagnostic program "ping", which is an example of an ICMP packet, is sent from IP device R1 to IP device R3. Note that Figure 3 only shows two IP devices R1 and R2 and two transmission devices N1 and N2.

IP device R1, which is the sender of the "ping", experiences an increase in CPU utilization in conjunction with the transmission of the "ping". Specifically, as shown in FIG. 3, the CPU utilization of IP device R1 increases during time period t1, and returns to normal after time period t1 has elapsed. In the example shown in FIG. 2, the "ping" is transmitted via the route R1 → N1 → N3 → N4 → N5 → N7 → N8 → R3. Therefore, as shown in FIG. 3, the CPU utilization of IP device R2 and transmission device N2 does not fluctuate greatly during time period t1. On the other hand, the CPU utilization of transmission device N1 fluctuates greatly during time period t1.

The load determination unit 22 compares the fluctuations in CPU utilization in each of the IP devices R1 to R3 and each of the transmission devices N1 to N20 during the time period t1 set by the time period setting unit 21. The load determination unit 22 identifies IP devices and transmission devices whose CPU utilization fluctuates in a manner that correlates with the CPU utilization in IP device R1 during the above-mentioned time period t1. "Correlated" means that the characteristics of the load fluctuations, such as the timing at which the CPU utilization rises, the rate at which it rises, the time at which the CPU utilization peaks, and the peak value, are similar.

[Operation of this embodiment]
Next, the operation of the test object extraction device 100 according to this embodiment will be described with reference to the flowchart shown in FIG.

First, in step S11, the test packet output command unit 23 outputs a command to output a test packet. This output command is output from the output unit 12 and input to the IPOpS 5. This process is performed, for example, when a user inputs an operation at the input unit 11. In this embodiment, an example will be described in which an ICMP packet is used as the test packet.

In step S12, IPOPS5 sends an ICMP packet to the IP device (IP device R1 as an example) that is the source of the ICMP packet, among the IP devices R1 to R3 installed in the IP layer 71.

IP device R1 sends an ICMP packet to an IP device (for example, IP device R3) whose operating status is to be checked. As a result, the ICMP packet is sent via path L1 formed in IP layer 71 and transmission layer 72, as shown in FIG.

For example, when a "ping" is sent as an ICMP packet, the device load, such as the CPU usage rate, of IP device R1 increases. On the other hand, the network device that receives the "ping" generates a reply packet to send response data, which increases the device load. Furthermore, the device load of each transmission device on path L1 also increases.

In step S13, the input unit 11 inputs log information of the ICMP packet sent by the IPOPS 5 and stores the input log information in the test packet log storage unit 32.

In step S14, the monitoring OpS 6 acquires device load information detected in each IP device R1 to R3 and each transmission device N1 to N20. As mentioned above, device load is information including CPU usage, computation load, etc.

In step S15, the input unit 11 stores the device load information acquired by the monitoring OpS 6 in the device load information storage unit 31.

In step S16, the time zone setting unit 21 sets the time zone in which the ICMP packet was sent based on the log information of the ICMP packet sent by the IPOPS 5. For example, it sets the time zone t1 shown in Figure 3.

In step S17, the load determination unit 22 compares the load fluctuations of IP device R1 with the load fluctuations of other IP devices and transmission devices during the time period set by the time period setting unit 21, and determines whether there is a correlation. For example, the load determination unit 22 compares the fluctuations in CPU utilization rate of IP device R1 during time period t1 shown in Figure 3 with the fluctuations in CPU utilization rate of IP device R2 during time period t1. In the example shown in Figure 3, the CPU utilization rate of IP device R1 fluctuates greatly, while the CPU utilization rate of IP device R2 is almost constant, so it is determined that there is no correlation.

On the other hand, the CPU utilization rate of transmission device N1 is more similar to the CPU utilization rate of IP device R1 in time period t1 in terms of the upward trend (e.g., the slope of the upward trend). Therefore, it is determined that there is a correlation between IP device R1 and transmission device N1.

In step S18, the load determination unit 22 creates a device list indicating the network devices to be subject to the failure test based on the above determination result. For example, as shown in Figure 2, if the transmission path from IP device R1 to IP device R3 is L1, R1, N1, N3, N4, N5, N7, N8, and R3 installed along this path L1 are extracted as network devices to be subject to the failure test and registered in the device list.

In step S19, the output unit 12 transmits the created device list to the transmission OpS 4.

In step S20, transmission OpS4 receives the device list and performs fault testing on the network devices registered in the device list.

In this way, when a failure occurs in network 7 in which a large number of network devices are arranged across multiple layers, it is possible to easily and reliably extract the network device that is the subject of failure testing to determine the cause of the failure.

[Effects of this embodiment]
Thus, this embodiment comprises an input unit 11 that acquires log information of a test packet transmitted to a network and load information of a plurality of network devices installed in the network; a time zone setting unit 21 that sets a time zone to be analyzed among the load information of each network device that changes over time based on the log information of the test packet; and a load determination unit 22 that analyzes the load fluctuations of each network device during the time zone set by the time zone setting unit based on the load information of each network device, determines the correlation between the load fluctuation of the network device that is the source of the test packet among the plurality of network devices and the load fluctuations of other network devices, and extracts network devices that are determined to have a correlation with the source network device among the other network devices as network devices to be subject to failure testing.

Specifically, when checking the operating status of an arbitrary network device (e.g., IP device R3) installed in network 7 consisting of multiple layers (IP layer 71, transmission layer 72), a test packet such as an ICMP packet is sent from the source network device (e.g., IP device R1) to the arbitrary network device. In addition, a time period t1 is set based on the log information of the ICMP packet, and device load information of each network device during this time period t1 is obtained. Then, the device load fluctuation of the source network device during time period t1 is compared with the device load fluctuation of each network device during time period t1 to determine whether there is a correlation. Network devices determined to have a correlation are extracted as network devices to be subject to failure testing.

Therefore, when a failure occurs in the network 7, it is sufficient to perform failure testing only on the transmission devices selected as targets for failure testing among the transmission devices N1 to N20 included in the transmission layer 72, and to confirm their performance information. This makes it unnecessary to perform failure testing on all of the transmission devices N1 to N20, and makes it possible to perform failure testing on the network 7 easily and in a short time.

In addition, by comparing the increasing trend of device load during time period t1, it is possible to determine correlation, making it easier to extract network devices for which fault testing is to be performed.

[Description of the First Modified Example]
Next, a first modified example of the test object extraction device 100 according to the embodiment of the present invention will be described. In the above-described embodiment, the increasing tendency of the CPU utilization rate in the time period t1 in the network device that is the source of the ICMP packet is compared to determine the presence or absence of correlation.

In contrast, in the first variant, the peak times of CPU usage during the time period t1 are compared to determine whether there is a correlation. For example, as shown in Figure 5, the CPU usage of IP device R1 has a peak value p1 at time T1 during time period t1.

In addition, the CPU utilization rate of transmission device N1 has a peak value p3 at time T3 in time period t1, which is almost the same as time T1. Therefore, it is determined that there is a correlation between the CPU utilization rates of IP device R1 and transmission device N1.

On the other hand, the CPU utilization rate of IP device R2 is almost constant during time period t1 and reaches a maximum value at time T2, which is significantly different from the time T1 mentioned above. Therefore, it is determined that there is no correlation between the CPU utilization rates of IP device R1 and IP device R2. Similarly, the CPU utilization rate of transmission device N2 reaches a maximum value at time T4 during time period t1, which is significantly different from the time T1. Therefore, it is determined that there is no correlation between the CPU utilization rates of IP device R1 and transmission device N2.

In this way, by comparing peak times of device load, such as CPU utilization, and determining whether there is a correlation, it is possible to easily extract network devices to be subject to fault testing, as in the above-described embodiment.

[Description of the second modified example]
Next, a second modified example of the test target extraction device 100 according to the embodiment of the present invention will be described. In the first modified example, the peak times of the CPU utilization in the time period t1 are compared. In contrast, in the second modified example, the peak values of the CPU utilization in the time period t1 are compared to determine whether there is a correlation. For example, as shown in FIG. 5, the CPU utilization of IP device R1 has a peak value p1 in time period t1.

In addition, the CPU utilization rate of transmission device N1 has a peak value p3 in time period t1, and the difference with peak value p1 is small. Therefore, it is determined that there is a correlation between the CPU utilization rates of IP device R1 and transmission device N1.

On the other hand, the CPU utilization rate of IP device R2 reaches a maximum value p2 during time period t1, which is significantly different from the peak value p1 mentioned above. Therefore, it is determined that there is no correlation between the CPU utilization rates of IP device R1 and IP device R2. Similarly, the CPU utilization rate of transmission device N2 reaches a maximum value p4 during time period t1, which is significantly different from the peak value p1. Therefore, it is determined that there is no correlation between the CPU utilization rates of IP device R1 and transmission device N2.

In this way, it is possible to compare the peak values of device load during time period t1 and determine correlation, making it easier to extract network devices for which fault testing is to be performed.

As shown in FIG. 6, the test object extraction device 100 of the present embodiment described above may be a general-purpose computer system including a CPU (Central Processing Unit, processor) 901, a memory 902, a storage 903 (HDD: Hard Disk Drive, SSD: Solid State Drive), a communication device 904, an input device 905, and an output device 906. The memory 902 and the storage 903 are storage devices. In this computer system, the CPU 901 executes a predetermined program loaded onto the memory 902, thereby realizing each function of the test object extraction device 100.

The test target extraction device 100 may be implemented in one computer or in multiple computers. The test target extraction device 100 may also be a virtual machine implemented in a computer.

The program for the test target extraction device 100 can be stored on a computer-readable recording medium such as a HDD, SSD, USB (Universal Serial Bus) memory, CD (Compact Disc), or DVD (Digital Versatile Disc), or can be distributed via a network.

The present invention is not limited to the above-described embodiments, and various modifications are possible within the scope of the invention.

1 Input/Output section 2 Processing section 3 Information storage section 4 Transmission OpS
5. IPOPS
6 Surveillance Operations
7 Network 11 Input section 12 Output section 21 Time period setting section 22 Load judgment section 23 Test packet output command section 31 Device load information storage section 32 Test packet log storage section 71 IP layer 72 Transmission layer 100 Test object extraction device N1 to N20 Transmission device (NW device)
R1 to R3 IP device (network device)

Claims (6)

an input unit for acquiring log information of test packets transmitted to a network and load information of a plurality of network devices installed in the network;
a time period setting unit that sets a time period to be analyzed among load information of each network device that changes over time based on log information of the test packets;
a load determination unit that analyzes load fluctuations of each of the network devices during the time period set by the time period setting unit based on load information of each of the network devices, determines correlations between the load fluctuations of the network device that is the source of the test packets among the plurality of network devices and the load fluctuations of other network devices, and extracts, from among the other network devices, network devices that are determined to have a correlation with the source network device as network devices to be subject to failure testing;
A test subject extraction device comprising: The load determination unit
comparing a load increase trend of a network device that is a source of the test packet among the plurality of network devices during the time period with a load increase trend of the other network devices during the time period;
extracting, from among the other network devices, a network device determined to have an upward correlation with the source network device, as a network device to be subjected to a failure test;
2. The test subject extraction device according to claim 1 . The load determination unit
comparing a peak time of a load in the time period of a network device that is a source of the test packet among the plurality of network devices with a peak time of a load in the time period of the other network devices;
extracting, from among the other network devices, a network device determined to have a correlation at a peak time with the source network device, as a network device to be subjected to a failure test;
3. The test subject extraction device according to claim 1 or 2. The load determination unit
comparing a peak load value in the time period of a network device that is a source of the test packet among the plurality of network devices with a peak load value in the time period of the other network devices;
extracting, from among the other network devices, a network device determined to have a correlation in peak value with the source network device, as a network device to be subjected to a failure test;
The test subject extraction device according to any one of claims 1 to 3, acquiring log information of test packets transmitted to a network and load information of a plurality of network devices installed in the network;
setting a time period to be analyzed from load information of each network device that changes over time based on log information of the test packets;
Based on the load information of each network device, a load fluctuation of each of the network devices during the set time period is analyzed;
determining a correlation between a load change of a network device that is a source of the test packet among the plurality of network devices and a load change of other network devices, and extracting a network device that is determined to have a correlation with the source network device among the other network devices as a network device to be subjected to a failure test;
A test subject extraction method comprising: A test subject extraction program for causing a computer to function as a test subject extraction device described in any one of claims 1 to 4.

Images