JPH09282252A - Network managing system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To suppress the load increase of a network caused by management and to prevent influence upon other online processing by monitoring the network load through a network monitoring device and reporting the state of the load to a managing station. SOLUTION: The network monitoring device 4 is arranged on a network 3 and while using TRAP, network load conditions are reported to the managing station 1. The managing station 1, which receives the report, suppresses an SNMP request corresponding to the load conditions of the network, reports the suppression to a manager and controls the execution of state monitor at nodes 2a and 2b to be managed by using the SNMP request in the suppressing state. Besides, at the nodes 2a and 2b to be managed, the state monitor is periodically executed according to an instruction from the managing station 1 and when the state exceeds a defined threshold value or gets different from the last monitored value, such a state is reported to the managing station 1 by using the TRAP. Thus, countermeasures are speedily taken.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to network management using SNMP or system management, and more particularly to a system capable of continuing management without increasing network load.

[0002]

2. Description of the Related Art First, SNMP, which is a standard management protocol for TCP / IP networks, will be described.
Then, a conventional network management method using SNMP will be described.

[0003] SNMP is a network management protocol defined for collecting management information from nodes in a network, setting processing, and notification processing of events that occur in nodes, and is a manager in a management station. It is realized by sending and receiving messages between the program and the agent program in the managed node. In SNMP, management information is MIB (Ma
management-Information-Bas
e) and the event is called TRAP.

More specifically, the manager program in the management station requests the agent program in the managed node to collect / set MIB (message route information, traffic information such as the number of transmitted / received messages, fault information, etc.). Send the request message. The agent program collects / sets the requested information, sets the result in a response message, and sends it to the manager program. Further, the managed node can voluntarily send TRAP to the management station to notify the occurrence of an event.
It is the network management of SNMP that realizes management by these requests / responses and TRAP.

Regarding the conventional network management AP,
As described in "Chapter 7: Management Tools and Application Development by Soft Research Center Co., Ltd., written by Hisao Ohgane, TCP / IP and OSI network management", the MIB information requested by the administrator is requested at the requested timing. Are collected and displayed on a window, or MIB information is collected at a specified cycle and the result is displayed on a graph. Further, the collected information is checked for a threshold value, and if it exceeds the threshold value, TRAP is locally generated in the management station to notify the administrator of the abnormality. In this way, the request timing and
Requests are unconditionally transmitted to each managed node at set cycle intervals, and no consideration is given to an increase in network load due to management.

[0006]

In a management system using SNMP, management is generally performed by polling monitoring from a management station to a managed node. However, in polling monitoring, request / response messages flow on the network each time monitoring is performed, so network load may increase when the number of managed nodes increases or when the monitoring cycle is shortened to detect failures earlier. There is a problem of increase.

It is an object of the present invention to suppress an increase in network load due to management and realize management so as not to affect other online processing. Moreover, it is to notify the administrator who has requested the load status so that countermeasures can be taken early.

Another object is to enable state monitoring according to the status value of the management information.
The purpose is to make it a method with a wide range of application by implementing it using standard management of SNMP.

[0009]

In order to achieve the above object, the present invention has a network monitoring device arranged on a network and is provided with a means for notifying a management station of a network load condition by using TRAP. Suppresses SNMP requests and notifies the administrator according to the network load status.
The NMP request is used to provide a means for controlling the execution of the status monitoring in the managed node, and the managed node periodically executes the status monitoring according to the instruction from the management station, and the defined threshold is exceeded. When, or when the state is different from the previous monitoring value, means for notifying the management station using TRAP is provided.

[0010]

BEST MODE FOR CARRYING OUT THE INVENTION In this embodiment, it is assumed that network management or system management is realized using SNMP.

FIG. 2 shows a block diagram of a system to which the present invention is applied. Management station 1 and managed node 2a
2b, the network monitoring device 4 is connected to the LAN 3, and communication is performed on this LAN using TCP / IP.

First, a process of monitoring the network load in the network monitoring device 4 and notifying the management station of the load state will be described.

As shown in FIG. 3, the network monitoring device 4 includes an SNMP-API 5 for realizing SNMP, an agent 6 for processing an SNMP request from a management station, a segment monitoring process 8 for monitoring statistical information on a segment, It comprises a statistics table 31 and a request suppression control table 32.

A processing flowchart of the segment monitoring process 8 will be described with reference to FIG.

The packet transmitted on the segment is constantly analyzed for the fetched packet (process 41). Then, the statistical table is updated based on the analysis result (process 42).

The structure of the statistical table 31 is shown in FIG. Packet count, packet total byte count, broadcast count,
It consists of an area for setting the number of collisions, and is composed of multiple entries for holding the history for a certain period of time.

Using the statistical table 31, the statistical information is counted at a constant interval, and the total packet byte count at that time is divided by the segment transmission rate (total packet byte number / transmission rate). The load factor is calculated (processes 43 and 44). In this embodiment, 10
The statistical information is acquired every second cycle and the network load factor is calculated.

Next, referring to the request suppression control table 32, it is confirmed whether or not the notification to the management station is necessary.

The request suppression control table has the structure shown in FIG. It consists of areas for setting alarm values, steady values, and notification status. When the alarm value exceeds that value, it indicates that the network is in a high load state and suppresses the SNMP request from the management station, and the steady value falls below the steady value once the alarm value is exceeded. This is a numerical value indicating that the transmission of the SNMP request is not permitted unless there is any. The notification status is status information for preventing the same notification from being continuously sent to the management station. When 1 is set, the request suppression notification has been issued, and when 0, the request suppression cancellation notification has been sent, and the initial value is set to 0.

As shown in FIG. 4, when the calculated load factor exceeds the alarm value (process 45) and the notification status is 0 (process 46), the request suppression TRAP is transmitted to the management station and the notification status is sent. Is set to 1 (process 47, 401). If the load factor is lower than the steady value (process 45) and the notification status is 1 (process 48), the request suppression release TRAP is transmitted and the notification status is set to 0 (process 49, 40).
2).

In this embodiment, the alarm value is 80% and the steady value is 40%. This makes the segment monitoring process 1
When the network load is monitored at 0 second intervals and exceeds 80%, a request suppression TRAP is sent to the management station, and when it falls below 40%, the request suppression release TRA
Send P. The TRAP information transmitted last time is held according to the notification status, and the same TRAP is not continuously transmitted.

The format of the TRAP message is shown in FIG.
Shown in Enterprise ID, agent address, generic-trap and specific-t
Areas 71 to 76 for setting rap, time stamp, and variable list.

The enterprise ID is an ID for identifying a device, and a different number is given to each model of the network monitoring device and the managed node. The agent address is the IP address of the node that generated the TRAP, g
energy-trap and specific-trap
The number is a number indicating the content of this TRAP, that is, the factor that has occurred. A number is predetermined for this generic-trap, and 6 must be used for a unique TRAP.
The number of rap can be freely determined.
Information regarding TRAP is specified in the variable list.
It is composed of e (area 77) and value (area 78). The ID of the management information to be set is set in name, and the value indicated by the ID is set in value. The number of names and values match the number of information to be set, and this field is omitted unless otherwise specified.

In this embodiment, the request suppression TRAP,
The specific numbers of the request inhibition release TRAP are set to 1 and 2, respectively, and the network load factor is set in the variable list.

The request suppression control table is MIB
SNMP from the management station
Can be changed by request.

The process of the agent 6 is the same as that of the agent in the managed node and will be described later in detail.
The above is the description of the network monitoring device.

Next, the processing of the management station 1 will be described.

The management station, as shown in FIG.
It is composed of an NMP-API 5, a TRAP receiving process 9 for receiving a TRAP from a managed node, management APs 7a and 7b, a request inhibition flag 81, and a message queue 82 for exchanging TRAP information between the TRAP receiving process and the management AP. It

First, the reception process of the TRAP transmitted from the network monitoring device 4 will be described, and then the management A
The processing of P7a and P7b will be described.

The processing flow of the TRAP receiving process 9 will be described with reference to FIG.

TRA is always waiting for reception, and TRA
When P is received, the enterprise ID is checked to identify whether it is a TRAP from the network monitoring station (processes 91 and 92). If TRAP from the network monitoring station, TRAP specific
Check the number, request suppression TRAP (= 1),
Alternatively, it is checked whether or not the request inhibition cancellation TRAP (= 2) (process 93).

If the specific number is 1, a SET request for setting the daemon status MIB value in the managed node to 1 (process 94).
If the ic number is 2, a SET request to be set to 0 is transmitted by broadcasting (process 96).

Here, when the value of the daemon status is 1, it represents the start of status monitoring in the managed node, and when it is 0, it represents the stop of status monitoring. Note that all the GET / SET processing described in this embodiment complies with the conventions of SNMP, and thus the details thereof will be omitted.

After transmitting the SET request, the request suppression flag is turned on / off to identify whether the request can be transmitted. When the request suppression TRAP is received, the flag is turned on (process 95), and the request suppression release TR
When the AP is received, the flag is set off (process 97).

Then, all the received TARPs are transmitted to the management AP via the message queue (process 9).
8). The message queue is for realizing inter-process communication and will not be described in detail.

Next, the processing of the management APs 7a and 7b will be described. This AP is composed of a main routine for performing management by receiving TRAP and an alarm routine for periodically collecting and managing management information, and the respective processing flows are shown in FIG. 10 and FIG.

In the main routine, first, a monitoring request is set by a SET request in order to have the managed node locally execute status monitoring (process 1).
01). The monitoring information is a monitoring information table in the managed node, which will be described later in detail.

After the monitoring information setting process in the managed node is executed, an alarm is set and a TRAP reception waiting state is set (processes 102 and 103). When TRAP is received, the enterprise ID and the specific number are checked, and it is checked whether or not the event is related to the monitoring information defined in the process 101 (process 104). If related, management is performed according to the content of TRAP (processing 105), and if not related, TRAP information is discarded (processing 106). Then, the TRAP is repeatedly received and the management is continued.

When an alarm occurs and the alarm routine is activated, the request suppression flag is checked to see if the request can be transmitted (process 11). If the request suppression flag is off, GET
The request is sent and managed (processes 12 and 13),
If the request suppression flag is on, the GET request is not sent, and after the suppression status is notified to the administrator (Process 1
4) Wait until the next monitoring cycle time (Process 1
4). Then, the alarm is reset (process 15) and the process ends.

By the processing of the TRAP receiving process and the management AP described above, the request inhibition flag is turned on / off by the TRAP from the network monitoring device. When the request suppression flag is on, the management AP does not send a request and the TRAP from the managed node
Since the management is continuously executed only by, the increase in network load can be suppressed.

Finally, the processing of the managed nodes 2a and 2b will be described.

The managed node is an SN as shown in FIG.
MP-API 5, agent 6, status monitoring daemon 111 that monitors the status on the local node, monitoring information table 112, and daemon status flag 113
Consists of

All requests from the management station are processed by the agent 6, and the flow shown in FIG. 12 is executed. It is always in the waiting state for receiving an SNMP request (process 121), and when a request is received, the request type (SET / GET) and the name and value
Check e, collect / set the management information specified by name, and send the result as a response to the management station (processes 122 to 12).
4).

In the management information collecting / setting process of process 122,
When a GET / SET request for the daemon status MIB is received, the processing shown in FIG. 13 is executed.

In the case of a SET request, the set value designated by value is acquired (process 131, 132).
If the value is 1, the state monitoring daemon is activated and the value for the MIB is set to 1 (process 133).
134). If the value is 0, stop the daemon startup,
The value for MIB is set to 0 (processing 135, 13).
6). Then, a response is created and transmitted (process 13).
7). In the case of a GET request, a daemon status value is acquired, a response is created and transmitted (process 13).
8, 137).

By these processes, the start and stop processes of the status monitoring daemon can be controlled by the SET request of the daemon status MIB from the management station.

The status monitoring daemon is activated periodically, as shown in FIG.
The processing flow shown in 4 is executed. Management AP when activated
State monitoring is performed based on the monitoring information table defined by.

The monitoring information table has the structure shown in FIG.

The MIB value to be monitored, the specific number of the TRAP to be generated, the type of status monitoring, the status value at the time of previous monitoring, the threshold value, the rearm value, and the area for setting the transmission flag are included. There are two types of monitoring: threshold monitoring and status monitoring. In threshold monitoring, TRAP is generated according to the threshold and rearm value. In status monitoring, the status changes from the previous state. This is the TRAP that is generated in some cases. If the monitor type is threshold monitoring, the previous status is invalid, and if it is status monitoring, the threshold, rearm value,
The status flag is invalid. The rearm value is a value determined so that, once the rearm value is exceeded, if it does not drop below the rearm value, TRAP transmission will not be performed even if the threshold value is exceeded in the next monitoring. The transmission flag is a flag for checking whether or not the MIB value is lower than the rearm value from the time when the TRAP was transmitted last time to the present time when the threshold value is exceeded. ON indicates a state where the value is lower than the rearm value, and OFF indicates a state where the value is not lower than the rearm value. The specific number is the other management A
It must be assigned uniquely in the system so that it will not be duplicated with the number used in P.

As shown in FIG. 14, data is sequentially taken out from the first entry of the monitoring information table and the state is monitored (process 1401). Information on the designated MIB value is taken out and it is checked whether the monitoring type is threshold value monitoring or status monitoring (processing 1402, 1403). In the case of threshold value monitoring, the acquired MIB value, rearm value, and threshold value are compared. If it is smaller than the rearm value, the transmission flag is turned on (processing 1404, 140).
9). If the threshold is exceeded and the transmission flag is on, TRAP transmission is performed and the status flag is turned off (processes 1405 to 1408). In the case of status monitoring, a TRAP transmission process is performed only when the values are different from the previous status value, and the acquired MIB value is set as the previous status value in the monitoring information table (processes 1410 to 1412). Note that TRAP is the acquired MI
The B value is set to a variable and the specified specific number is generated.

By the processing of the network monitoring station, the management station and the managed node, the management AP on the management station is controlled until the network load drops below the alarm value (80%) to the steady load state (40%). Do not send SNMP requests. Then, in the request inhibition state, state monitoring is executed locally in the managed node, and TRAP is transmitted to the management station only when an abnormality occurs.

[0052]

According to the present invention, it is possible to suppress the increase of the network load due to the management and realize the management without affecting other online processing. Also, when the network load is not so high, polling monitoring can be performed at the cycle requested by the administrator, and network resources can be used effectively.

[Brief description of drawings]

FIG. 1 is a processing flowchart of management information collection that represents a feature of the present invention.

FIG. 2 is a block diagram of a system suitable for applying the present invention.

FIG. 3 is a block diagram of software of a network monitoring station.

FIG. 4 is a processing flowchart of a segment monitoring process.

FIG. 5 is an explanatory diagram of a statistical table.

FIG. 6 is an explanatory diagram of a request suppression control table.

FIG. 7 is an explanatory diagram of a format of a TRAP message.

FIG. 8 is an explanatory diagram of software of a management station.

FIG. 9 is a processing flowchart of a TRAP receiving process.

FIG. 10 is a main processing flowchart of a management AP.

FIG. 11 is a block diagram of software of a managed node.

FIG. 12 is a processing flowchart of an agent.

FIG. 13 is a request processing flowchart for a daemon status MIB.

FIG. 14 is a processing flowchart of a status monitoring daemon.

FIG. 15 is an explanatory diagram of a monitoring information table.

[Explanation of symbols]

 name ... ID of management information, value ... Value of management information.

 ─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor Hiroshi Wataya 5-2-1 Omika-cho, Hitachi-shi, Ibaraki Hitachi Ltd. Omika factory

Claims (6)

[Claims] 1. A network management system using SNMP, means for monitoring a load condition on the network, and means for suppressing an SNMP request from a management station according to a load condition on the network, Means for realizing status monitoring locally on the managed node when the SNMP request is suppressed at the management station, and transmitting TRAP for notifying the abnormality to the management station when an abnormality is detected at the managed node. A characteristic network management method. 2. A means for arranging a network monitoring device for monitoring a network load on a network segment, and when the network load of the network monitoring device exceeds a certain threshold value, or A means for notifying the management station by using TRAP when the load has dropped to a steady load state after exceeding the threshold value, and the management station is provided with the TR
A network management method in which an SNMP request is suppressed during the period from when an AP is received and the network load exceeds a certain threshold until it is reduced to a steady load state. 3. The network management system according to claim 1, having a man-machine interface for notifying an administrator when the SNMP request is suppressed. 4. A means for arranging a status monitoring daemon for periodically performing status monitoring on a managed node, and start / stop of status monitoring in the status monitoring daemon from an administration station according to claim 1. -Network management method controlled by SET request. 5. The condition monitoring daemon according to claim 4,
A network management method that periodically executes status monitoring and sends a TARP to a management station when the status exceeds a defined threshold value or when the status is different from the previous monitoring value. 6. A network management method for switching between polling monitoring from a management station and local status monitoring at a managed node in network management using SNMP in accordance with the load status of the network.