JPH04345248A - Event report device - Google Patents

Abstract

PURPOSE:To suppress rapid increase in a load relating to notice processing when a fault event with a huge quantity takes place in a short time in a managed equipment of a network management system. CONSTITUTION:A criterion when number of events being an object of notice processing is deleted is stored in a memory 120 and a comparison section 130 compares a reference value with an alarm level of each event and deletes an unimportant event before it is processed by a filter 60. A reference value setting section 110 retrieves an event list stored in an event queue 50 in response to number of produced events and sets the reference value in the memory 120 to an optimum value.

Description

[Detailed description of the invention]

0001

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an event reporting device for notifying a management node (manager) of an event detected in a managed node (agent) in network management technology based on OSI management.

0002

2. Description of the Related Art In recent years, there has been an urgent need to establish network management technology for integrated management of information communication terminals on a network. Particularly, in order to realize network management in a multi-vendor environment, attempts have been made to construct a network management system based on the international standard OSI (Open Systems Interconnection).

[0003] A conventional event reporting device in a network management system will be explained below. Conventional event reporting devices include, for example, the OSI standard ISO/
There are some things that can be easily imagined from the description in IEC DIS10164-5.

FIG. 6 shows the configuration of an agent having a conventional event reporting device. Agents include information terminals such as workstations and personal computers, and communication devices such as routers and HUBs, and are connected to the network by a communication module 20. Reference numeral 10 denotes a management application processing means, which starts a management program for performing processing corresponding to the management operation instructed by the manager via the network, a management program for autonomously detecting a failure state by the agent, etc. be able to. Reference numeral 30 denotes a management information base that centrally holds management information regarding agents, and the management information therein is accessed by the management application processing means 10. The management information managed by the management information base 30 includes various information such as performance information such as the number of transmitted packets and reception error rate of the agent itself, communication status and communication connection identification information.

Reference numeral 40 denotes an event reporting device, which is composed of an event queue 50 and a discriminator 90. The event queue 50 is a buffer that stores a list of events such as failure states and warning states detected by the management application processing means 10 within its own node. The discriminator 90 sequentially extracts events from the event list registered in the event queue 50 and determines whether to send them to a manager (not shown) based on a determination formula registered from the management application processing means 10. Therefore, there is a filter 60 for making a determination, a memory 70 for holding the address of the manager registered from the management application processing means 10, and a communication module 20 connected to the filter 60 and the memory 70 for requesting an instruction to send an event to the manager. and a communication interface 80 having interface functions.

The operation of the agent having the event reporting device configured as described above will be explained below.

[0007] Typically, the agent includes a communication module 20
A management operation message (for example, a request to read a specific management information value, a request to change a management information value, etc.) received from the manager via the management application processing means 10
Management information base 3 is analyzed as a corresponding operation.
Read or set the management information stored in 0. Then, a response message indicating the operation result is transmitted from the management application processing means 10 to the manager on the network via the communication module 20.

[0008] Furthermore, the management application processing means 10
It not only operates in response to management operation messages from the manager, but also has the function of autonomously accessing the management information base 30 and detecting fault conditions. The operation when the management application processing means 10 detects a failure state is as follows.

First, the type of failure detected (processing error,
Determine the communication failure, confidential abnormality, etc.) and its severity (major, minor, alarm, etc.), create a data structure with detailed information such as the location of occurrence, and use this data structure as an event queue 50. Register. The filter 60 reads the data structure registered in the event queue 50 and determines whether or not to notify the manager of the event. The determination formula at this time is registered in advance in the filter 60 from the management application processing means 10. The determination expression is expressed by a logical expression such as (Formula 1), for example.

0010

[Math 1]

[0011] The above judgment formula is such that the value of objectClass representing the type of management information is protocolEnt.
ity and enti which is the identification name of the management information.
The value of tyID starts with 123, and the value of severity indicating the severity of the event is minor.
Otherwise, this indicates that this event information may be notified to the manager.

[0012] As a result of the determination by the filter 60, the event information to be notified to the manager is converted into a message format for transmission at the communication interface 80, and then passed to the communication module 20 and transmitted to the manager. Note that the above message format for sending includes information regarding the event, as well as the address of the manager to whom the message is sent. This address can be obtained by communication interface 80 referring to memory 70 .

[0013]

[Problems to be Solved by the Invention] However, in the above-mentioned conventional configuration, when one fault that occurs within an agent causes other related faults, a huge number of events occur in a short period of time, and the manager The problem is that the load on the communication module 20 required to report an event to the communication module 20 increases rapidly, and eventually exceeds the processing limit of the communication module 20.

The present invention solves the above-mentioned problem, and provides a mechanism for appropriately notifying a manager of events within the processing capacity of the communication module 20 even if a huge number of failure events occur in a short period of time. The purpose of the present invention is to provide an event reporting device equipped with the following.

[0015]

[Means for Solving the Problems] In order to achieve this object, the event reporting device of the present invention includes means for detecting events such as failures and warnings occurring within a managed node, and an event queue that registers information about events that have been registered; a discriminator that selects event information to be reported to the management node from among the event information registered in the event queue; and a discriminator that manages the event information selected by the discriminator. a communication means for notifying the node; the discriminator retains a standard value that an event to be reported to the management node should satisfy; and a means for storing the standard value for the event registered in the event queue. a means for notifying the management node that the reference value has been changed; a means for comparing the event information registered in the event queue with the reference value; a means for deleting and discarding event information that does not satisfy the above criteria from the event queue; a filter means for selecting an event to be notified to a management node from among the event information that satisfies the above criteria; and an event selected by the filter means. and an address management unit that stores addresses regarding the destination of the notification of change of the reference value and the destination of the notification of change of the reference value.

Furthermore, in the event reporting device of the present invention, in the discriminator, instead of the means for deleting and discarding event information that does not meet the reference value from the event queue, event information that does not meet the reference value is deleted. The configuration includes means for deleting the event from the event queue and storing it as management information within the own node.

[0017]

[Operation] With the above-described configuration, the present invention first deletes events that cannot be processed by the filter from the event list registered in the event queue when a huge number of failure events occur in a short period of time. The event to be deleted is selected by comparing each event information with a reference value set to an appropriate value by searching the event list by the reference value changing means of the discriminator. As a result, the number of events to be filtered is reduced, and the load on the communication means for event notification processing can be kept within its capacity.

Furthermore, the load on the communication means can be reduced by temporarily storing the event information deleted from the event queue as management information within the own node and accessing it from the management node when the processing load on the communication means is low. It can also be dispersed.

[0019]

【Example】

(Embodiment 1) An embodiment of the present invention will be described below based on the drawings.

FIG. 2 schematically shows a network management system to which the present invention is applied. In the figure, 1 is a manager, which is a management device, and 2 and 3 are agents, which are managed devices. Manager 1 sends a message to each of agents 2 and 3 to instruct management operations, while each agent 2 and 3 performs processing according to the received management operation message and sends a response message to manager 1. , and also sends a notification message to the manager 1 to report a failure detected within each agent 2, 3.

[0021] The manager 1 and the agent 2,
3 each have a configuration as shown in FIG.

In FIG. 3, 1a and 10 are management application processing means, 1b and 20 are communication modules, and 30
is a management information base, and 40 is an event reporting device.

The communication modules 1a and 10 perform communication protocol processing, including GET command processing for instructing reading of management information of agent 2, SET command processing for instructing setting of management information, and processing of GET commands for instructing the reading of management information of agent 2. It performs the function of processing REPORT commands for reporting events such as failures to the manager 1.

Network management in this management system is performed as follows. For example, when the manager 1 requests the acquisition of management information of the agent 2 using a GET command, the management application processing means 1a sends the GET command to the command processing function section of the communication module 1b by starting the management application program.
Outputs command management operation instructions. Communication module 1
In step b, a management operation message indicating a GET command is sent to the agent 2 according to the procedure described in the GET process in the communication protocol processing library.

[0025] In the agent 2, the communication module 20
receives the management operation message, and restores the contents of the management operation instructed by the message in the management application processing means 10. Furthermore, the management application processing means 10 accesses the management information base 30 in accordance with the instruction content to obtain necessary management information, embeds it in a response message, and sends it back. This response message is output via the communication module 20,
It is sent to the management application processing means 1a via the communication module 1b of the manager 1.

In addition to operating according to instructions from the manager 1, the management application processing means 10 of the agent 2 also refers to the management information stored in the management information base 30 and autonomously resolves failures, etc. inside the agent 2. It has the ability to detect events. Events such as failures detected by this function are determined by the event reporting device 90 as to whether or not to be reported to the manager 1. For events that are determined to be reported,
Detailed information on the event is embedded in a notification message and reported to the manager 1. This notification message is
It is output via the communication module 20 and notified to the management application processing means 1a via the communication module 1b of the manager 1.

FIG. 1 shows the detailed configuration of the event reporting device 40. Note that components corresponding to those of the conventional event reporting device shown in FIG. 6 are given the same numbers, and detailed explanations are omitted.

The discriminator 100 is a device for selecting an event to be notified to the manager 1 from among the events registered in the event queue 50 of the agents 2 and 3. An event list input section 101 that is an interface for reading a list, a reference value setting section 110 for setting a reference value, and a memory 120 that holds the reference value.
An update notification unit 140 performs processing to notify the manager 1 that the value in the memory 120 has been updated by the reference value setting unit 110, and compares the value of each event information with the reference value stored in the memory 120. a comparison unit 130 for deleting unnecessary events, and a filter 60
, a memory 70 , and a communication interface 80 .

The operation of the event reporting device of the first embodiment configured as described above will be explained with reference to FIGS. 1 and 4.

When the management application processing means 10 accesses the management information base 30 and detects an event such as a failure, the management application processing means 10 detects the type of failure (processing error, communication failure, confidential abnormality, etc.) and its severity. Determine the degree (major, minor, alarm, etc.), create a data structure with detailed information such as the occurrence location, and use this data structure as an event queue.
Register to 0. If a huge number of failures occur in a short period of time, a large number of events will be registered in the event queue. discriminator 100
performs processing on the event list registered in the event queue 50 according to the procedure shown in FIG.

First, the event list input unit 101 reads the event list in the event queue 50 (processing 30
0), the number of events in the list has reached the processing limit (busy state)
A determination is made as to whether this has been reached (process 310). In the busy state, the reference value setting unit 110 searches the alarm level of each event in the event list, extracts the maximum value of the alarm level among them (process 400), and stores the reference value of the alarm level in the memory 120. Update to the maximum value obtained in process 400 (
Process 410). The alarm level of an event is a parameter indicating the severity of the event, and is assigned to each event when the management application processing means 10 registers each event information in the event queue 50. When the reference value setting unit 110 notifies the update notification unit 140 that the value in the memory 120 has been updated, the update notification unit 140 sends an instruction to the communication interface to notify the manager 1 that the reference value has been updated. 80 (process 420).

[0032] Thereafter, individual event information is output to the comparison unit 130 until there are no registered events from the event list held by the event list input unit 101 (process 320). The comparison unit 130 compares the alarm level of each event with the reference value registered in the memory 120, and outputs only events whose alarm level is equal to or greater than the reference value to the filter 60 (processing 330). The filter 60 determines whether or not to report the event to the manager 1 based on a determination formula such as (formula 1) registered in advance by the management application processing means 10 (process 340). The event to be reported is converted into a message format for transmission at the communication interface 80, and then passed to the communication module 20 and transmitted to the manager 1 (process 350). The address of the manager 1 as the destination is registered in advance in the memory 70 by the management application processing means 10, and
The address is obtained by referring to the memory 70.

As described above, according to this embodiment, the reference value setting unit 110 performs the process 4 when the event amount becomes busy.
As shown at 00, the reference value in the memory 120 is dynamically changed so that only the event with the highest alarm level among the events in the event list is selected. therefore,
Even if a huge number of events occur in a short period of time, only the most important event information can be reported to the manager 1, which has the effect of suppressing a sudden increase in communication load required for event reporting.

(Embodiment 2) A second embodiment of the present invention will be described below based on the drawings. The outline of the network management system to which the second embodiment is applied is the same as that shown in FIG. 2, and the overall configuration of the manager and agent is the same as that shown in FIG. 3.

FIG. 5 shows the detailed configuration of the event reporting device in the second embodiment. However, components corresponding to those of the event reporting device of the first embodiment shown in FIG. 1 are given the same numbers, and detailed explanations are omitted.

The discriminator 200 is a device for selecting an event to be notified to the manager 1 from among the events registered in the event queue 50 of the agents 2 and 3, and has an event list input section 101 and a reference value. The setting unit 110 , the memory 120 , the update notification unit 140 , the comparison unit 130 , and the information regarding events that are excluded from being reported to the manager 1 based on the judgment of the comparison unit 130 are converted into files and stored as data in the management information base 30 . a file creation unit 150 that registers as a file generator, a filter 60,
It includes a memory 70 and a communication interface 80.

The operation of the event reporting device of the second embodiment configured as described above will be explained with reference to FIG.

When the management application processing means 10 accesses the management information base 30 and detects an event such as a failure, the management application processing means 10 detects the type of failure (processing error, communication failure, confidential abnormality, etc.) and its severity. The alarm level (major, minor, alarm, etc.) indicating the degree of occurrence is determined, a data structure is created in which detailed information such as the occurrence location is added, and this data structure is registered in the event queue 50. If a huge number of failures occur in a short period of time, a large number of events will be registered in the event queue. The discriminator 200 processes the event list registered in the event queue 50 according to the following procedure.

First, the event list input unit 101 reads the event list in the event queue 50, and determines whether the number of events in the list has reached the processing limit (busy state). If it is busy, the reference value setting unit 110
searches the alarm level of each event in the event list, extracts the maximum alarm level among them, and stores it in the memory 120.
The reference value of the alarm level of is updated to the maximum value. When the reference value setting unit 110 notifies the update notification unit 140 that the value in the memory 120 has been updated, the update notification unit 140 sends an instruction to the communication interface to notify the manager 1 that the reference value has been updated. Published on 80th.

Thereafter, individual event information is sequentially output to the comparison section 130 until there are no registered events in the event list held by the event list input section 101. The comparison unit 130 compares the alarm level of each event and the memory 1
A comparison is made with a reference value registered in 20, and only events whose alarm level is greater than or equal to the reference value are output to the filter 60. The filter 60 determines whether or not to report the event to the manager 1 based on a determination formula such as (formula 1) registered in advance by the management application processing means 10. The event to be reported is converted into a message format for transmission at the communication interface 80 and then passed to the communication module 20 and transmitted to the manager 1. The address of the manager 1 to be sent is registered in advance in the memory 70 by the management application processing means 10, and
0 obtains its address by referring to memory 70.

Furthermore, as a result of comparison between the event alarm level and the reference value registered in the memory 120, the comparison unit 130 determines that events related to events that were not output to the filter 60 because the event alarm level was less than the reference value. The information is output to the file creation unit 150, and the file creation unit 150 adds this event information to the event log file in the management information base 30. The event log file is part of the data managed by the management information base 30, and its storage location is registered in advance in the memory 70 by the management application processing means 10, so the file creation unit 150 accesses the event log file. In this case, the memory 70 is referred to.

As described above, according to the second embodiment, even if a huge number of events occur in a short period of time, only the most important event is reported to the manager 1, thereby reducing the communication load required for event reporting. In addition to suppressing sudden increases, events that do not need to be urgently reported to the manager 1 are managed as log information by the management information base 30, so if the manager 1 wants to refer to or delete these event logs, This can be performed at any time using the same method (GET command or DELETE command) as for normal management operations from the manager 1 to the agents 2 and 3.

Furthermore, by transferring the event log file to the manager 1 by file transfer, these event information can be notified all at once.

Note that in the first and second embodiments, the value of the memory 120 is set to the maximum value of the alarm level in the event list as shown in process 400, but other methods such as deleting the amount of events in the event list (For example, an average value of alarm levels, a value of alarm levels for extracting the top 20% of events, etc.).

[0045]

As described above, the present invention provides a means for holding in a discriminator a standard value that should be met by an event to be reported to a management node, and a means for holding the standard value in a discriminator for events registered in an event queue. The standard value can be set to an appropriate value according to the event occurrence status at the managed node by providing a means to change it according to the number of changes and a means to notify the management node that the above standard value has been changed. By doing so, the number of events to be notified to the management node can be controlled, so even if the number of events increases rapidly, the load on the communication means can be automatically controlled so as not to exceed its limit.

Furthermore, when the reference value is changed, the fact is notified to the management node, so that the management node can estimate the event occurrence status at the managed node.

Furthermore, the present invention is provided with a means for accumulating event information that does not meet the standard value as management information in the managed node, so that the management node can perform management operations on the managed node using normal management operations. Information on these events that have not been reported to the node can be manipulated as needed.

[Brief explanation of the drawing]

FIG. 1 is a diagram showing the configuration of a managed node having an event reporting device in a first embodiment of the present invention.

FIG. 2 is a diagram showing a schematic configuration of a network management system to which the present invention is applied.

FIG. 3 is a diagram showing the overall configuration of managers and agents in a network management system to which the present invention is applied.

FIG. 4 is a diagram showing a flowchart for explaining the operation of the discriminator in the first embodiment.

FIG. 5 is a diagram showing the configuration of a managed node having an event reporting device in a second embodiment of the present invention.

[Figure 6] Diagram showing the configuration of a managed node with a conventional event reporting device

[Explanation of symbols]

1 Manager 2 Agent 3 Agent 10 Management application processing means 20 Communication module 30 Management information base 40 Event reporting device 50 Event queue 60 Filter 70 Memory 80 Communication interface 100 Discriminator 101 Event list input section 110 Reference value setting section 120 Memory 130 Comparison Section 140 Update notification section

Claims (2)

[Claims] Claim 1: In a network management system in which a management node manages a plurality of managed nodes via a network, each managed node, as a component, manages events such as failures and warnings that occur within the managed node. An event detection means to detect, an event queue in which information regarding the event detected by the event detection means is registered, and a discriminator that selects event information to be reported to the management node from among the event information registered in the event queue. and a communication means for notifying a management node of the event information selected by the discriminator, and a means for the discriminator to hold a reference value that should be met by an event to be reported to the management node. , means for changing the reference value according to the number of events registered in the event queue, means for notifying a management node that the reference value has been changed, and event information registered in the event queue. means for comparing the reference value with the reference value; and means for deleting and discarding event information that does not meet the reference value from the event queue;
A filter means for selecting an event to be notified to a management node from among event information that satisfies the above reference value, and address management that stores addresses related to the destination of the event selected by the filter means and the destination of the change notification of the above reference value. An event reporting device having a section. 2. In the discriminator according to claim 1, instead of the means for deleting and discarding event information that does not meet the reference value from the event queue, the event information that does not meet the reference value is removed from the event queue. An event reporting device equipped with means for deleting and storing it as management information within its own node.