JPH09282253A - Network operation management system and network monitoring system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To change a virtual network corresponding to the change of relation among logical objects. SOLUTION: In the case that the relation among the managed logical objects is changed, a logical manager 100 informs a physical manager of the contents of the change and the physical manager 200 updates the relation among managed physical objects so as to be matched with the relation among the logical objects after the change corresponding to the contents of the change informed from the logical manager 100 and the correspondence of the logical objects and the physical objects and requests agents 300 on the respective physical objects to change the setting of the respective physical objects so as to be matched with the relation among the physical objects after the updating.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a technique for supporting the operation and management of a network system and a technique for monitoring the state of network resources which are constituent elements of the network.

[0002]

2. Description of the Related Art In order to operate and manage a network system in which a plurality of information devices are connected and used, the operation management is performed on the individual devices that make up the network and the physical relationships between the devices on the network. Not only
A logical relationship between physical objects such as information devices connected to a network, and a logical object such as a user and a relationship between logical objects also need to be constructed, operated, and managed. The logical relationship between physical objects is realized by the physical relationship between various devices.

As a technique for operating and managing a logical relationship between physical objects such as information devices connected to a network, a logical relationship between physical objects as a virtual and logical network called a virtual network. There is known a technology for operating and managing. As a technology of such virtual network, you can freely use the switch network as described in "Inrush, Partial LAN" in the November 21, 1994 issue of Nikkei Communication, regardless of the physical configuration.
Virtual LAN technology that can configure LAN is known.

As a technique for operating and managing logical objects such as users and the relationship between the logical objects, a technique called a directory service that supports the operation and management by associating the logical objects with a logical hierarchical structure called a directory. It has been known. For example, the technique disclosed in Japanese Patent Laid-Open No. 6-326706 provides a hierarchical display in which a plurality of network nodes are grouped.

On the other hand, as a technique for monitoring network resources, in a network constructed according to the TCP / IP protocol, a management agent for monitoring information about network resources is mounted on a monitored device, and a manager mounted on the monitoring device. However, each agent and SNMP (A
collects information about network resources from each agent according to the Simple Network Management Protocol,
Techniques for displaying this are known. Regarding such SNMP, MT Rose "The SIMPLE BOOK An introduction
to Management of TCP / IP-based Internets "; Prent
It is described in icc Hall etc.

[0006]

Now, for example, when the organization or the like is changed in a company or the like, in addition to the above-mentioned directory, for example, when the virtual network is configured according to the organization, In many cases, it is necessary to change the above-mentioned virtual network and the physical relationship between various devices. In particular,
In addition to the change of the virtual network, it is necessary to change the setting value of the network address of the device or the routing content of the relay device that routes the packet within the network.

[0007] Then, such a change of the virtual network due to the change of the organization, the movement of the device, the setting value of the network address of the device, and the routing content of the relay device for routing the packet within the network. The work load required for such cases is large.

Next, in the above-mentioned technique for monitoring network resources, the unit to be monitored depends on the physical configuration of the network, and the unit of monitoring can only be the unit of subnetwork or segment. .
On the other hand, there are cases where it is desired to determine the target of network resource monitoring according to a logical configuration rather than the physical configuration of the network. Further, there is a case where it is desired to perform other logical units irrelevant to the physical configuration of the network, for example, a user unit of a network resource such as a user or a user group or a network service unit provided by the network resource.

Therefore, according to the present invention, first, the network operation management capable of automatically changing the setting of each device constituting the network according to the change of the logical objects such as the user and the relationship between the logical objects. The purpose is to provide a system.

Further, according to the present invention, a logical object such as a user and a relationship between the logical objects are changed,
An object of the present invention is to provide a network operation management system capable of automatically changing a logical relationship between physical objects such as information devices connected to a network.

Another object of the present invention is to provide a network resource monitoring system capable of determining network resources to be monitored according to the logical structure of the network system. It is another object of the present invention to provide a network monitoring system capable of monitoring the logical units of a network.

[0012]

In order to achieve the above object, the present invention provides, for example, a logical object which is a logical constituent element of a network system and a physical object which is a physical constituent element of a network system. A network operation management system for managing, a logical manager connecting to a network and managing logical objects and a relationship between logical objects; and a physical object connected to the network and corresponding to the logical objects and physical objects A physical manager that manages a relationship and a plurality of agents that control the setting of the physical object on each physical object, and the logical manager, when a change occurs in the relationship between the managed logical objects, The details of the change are The physical manager has a function of notifying the logical object after the change according to the content of the change notified from the logical manager and the correspondence between the logical object and the physical object. A means for requesting each agent to update the relationship between the managed physical objects so as to match and to change the setting of each physical object so as to match the relationship between the updated physical objects The agent provides a network operation management system characterized by changing the setting of a physical object in response to a request from the physical manager.

According to such a network operation management system, the physical manager and the agent automatically configure the network according to the change of the logical object such as the user managed by the logical manager and the relationship between the logical objects. Change the settings of the physical object that is the device. Therefore, according to the change of logical objects such as users and the relationship between logical objects,
To match this, the settings of the individual devices are automatically set.

In order to achieve the above-mentioned object, the present invention is a network operation management system for managing a logical object which is a logical constituent element of a network system and a physical object which is a physical constituent element of a network system. A logical manager that manages logical objects and relationships between logical objects, and a virtual object associated with the logical objects that represents the physical objects associated with the logical objects and logical relationships between the physical objects. A physical manager for managing the network, the logical manager having means for notifying the physical manager of the contents of the change when the relationship between the managed logical objects changes, Is notified by the logical manager And managing the changed logical objects according to the correspondence between the logical objects and the physical objects and the correspondence between the logical objects and the virtual network so as to match the relationship between the changed logical objects. Provided is a network operation management system having means for updating a virtual network.

According to such a network operation management system, the physical manager associates the contents of the change notified by the logical manager with the logical object and the physical object and the logical object with the virtual network. The virtual network to be managed is updated so as to match the relationship between the logical objects after the change, according to the change of the logical objects such as users and the relationship between the logical objects. It is possible to automatically change the logical relationship between physical objects such as information devices connected to.

Further, the present invention provides a logic on a network system of a plurality of objects including at least an object corresponding to a utilization object of the network system and an object corresponding to a network resource which is a physical resource constituting the network system. A network resource monitoring system including a directory service unit for managing a hierarchical structure and a monitoring unit for monitoring network resources connected to a network, wherein the object has a hierarchical structure between objects managed by the directory service unit. A monitoring condition receiving unit that receives the designation of an object to be monitored from among the objects contained therein and sets the designated object as a monitoring target object, and a network corresponding to the set monitoring target object. It has a monitoring instruction means for instructing the monitoring unit to monitor the network resource, and a monitoring result presenting means for presenting the monitoring result by the monitoring unit of the network resource corresponding to the set monitoring target object. Provide a network resource monitoring system.

According to such a network resource monitoring system, the network resource to be monitored can be determined according to the logical structure of the network system by utilizing the logical hierarchical structure managed by the directory service unit. .

Further, for example, in such a network resource monitoring system, the monitoring condition accepting means has an object which does not correspond to a network resource located in an upper layer in the hierarchical structure of the objects corresponding to the network resource as a monitoring target group. Means for accepting the designation of, and each object corresponding to each network resource existing in the lower layer in the hierarchical structure of the object for which designation is accepted as the monitoring target group,
By providing means for setting as the monitoring target object, it is possible to perform monitoring for each logical structural unit located above the network resource in the logical hierarchical structure of the object corresponding to the network resource. .

[0019]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below.

First, a first embodiment of the present invention, ie, an embodiment of a network management and operation system will be described.

First, the first embodiment will be described.

FIG. 1 shows the configuration of the network operation management system according to the first embodiment.

The network operation management system is shown in FIG.
The network operation management system shown in (b) is constructed on the network system that is the object of operation management.
Specifically, the network operation management system provides a directory service, and a logical manager 100 that constructs, operates, and manages directories and logical objects.
And a physical manager 200 that constructs, operates, and manages physical objects such as a virtual network and information devices and hardware devices that configure the network, and an agent 300 that is included in each physical object that configures the network. It

As shown in FIG. 1 (b), the network system to be operated and managed by this network operation management system includes a WAN and a LAN connected to the WAN. FIG.
FIG. 1A shows the relationship between the network system shown in FIG. 1B and the logical object level. In general, a broader area, a more basic sub-network, as shown in FIG. 1A, corresponds to a higher logical object.

In the following, the first embodiment will be described on the assumption that the network system has a switch-type network (a network that transfers a packet or the like through a limited route according to a destination address) as its backbone.

Next, FIG. 2 shows the configuration of the logic manager 100.

As shown, the logical manager 100
In terms of hardware, an external device such as an input device 107 such as a keyboard or a mouse, an external storage device 108 such as a floppy disk drive or a hard disk device, a display device 109, a printer 110, and these external devices are provided. This is a normal computer system including a main body including controllers 103 to 106 for controlling inputs, an interface circuit 105, a CPU 101, a memory 102, and a communication control device 111 for controlling communication with a network.

In the memory 102, a logical manager module 121 and an operating system module 12 are stored as programs executed by the CPU 101.
2. The communication control module 123 is stored.

As shown in FIG. 3, the logical manager module 121 includes a directory service window module 1211, a directory tree setting / change generating module 1212, a user setting / change generating module 1213, and an information device setting / change generating module. 1
It is composed of 214. Furthermore, modules may be added as needed.

Similarly, FIG. 4 shows the configuration of the physical manager 200.

As shown in the figure, the physical manager 200
In terms of hardware, an external device such as an input device 207 such as a keyboard or a mouse, an external storage device 208 such as a floppy disk drive or a hard disk device, a display device 209, a printer 210, and these external devices. This is a normal computer system including a main body including controllers 203 to 206 that control inputs, an interface circuit 205, a CPU 201, a memory 202, and a communication control device 211 that controls communication with a network.

In the memory 202, a physical manager module 221, an operating system module 222, and a communication control module 223 are stored as programs executed by the CPU 201.

As shown in FIG. 5, the physical manager module 221 includes an information device / window module 2211, a server / client setting / change management module 2212, a switching hub setting / change management module 2213, and a router setting / change management. Module 22
It is composed of 14. Furthermore, modules may be added as needed.

Similarly, FIG. 6 shows the configuration of the agent.

As shown in the figure, the agent 300 is
In terms of hardware, an input device 307 such as a keyboard or a mouse, an external storage device 308 such as a floppy disk drive or a hard disk device, an external device such as a display device 309 or a printer 310, and an input between these external devices are used. This is a normal computer system including a main body including controllers 303 to 306 for controlling, an interface circuit 305, a CPU 301, a memory 302, and a communication control device 311 for controlling communication with a network.
Alternatively, a system made up of a part of the configuration may be used. For example, a display device is not always necessary in a router or the like described later. The hardware of the agent 300 may be shared with the hardware of the physical object provided with the agent 300.

A process agent module 321, an operating system module 322, and a communication control module 323 are stored in the memory 302 as programs executed by the CPU 301.

Further, as shown in FIG.
Module 321 is for changing information device settings / module 3
211, server / client setting / change control module 3212, switching hub setting / change control module 3213, router setting / change control module 3214
It is composed of Furthermore, modules may be added as needed.

Each of the program modules described above is executed by the CPUs 101, 201 and 301,
The corresponding process is embodied on an electronic computer system. For convenience, in the following description, this process will be referred to by the name of the corresponding program module.

The operation of the network operation management system according to the first embodiment will be described below.

First, the outline of the operation will be described.

As described above, since the network to be operated and managed by the network operation management system is a network having a switch type network as a basic part, a logical network configuration, that is, a communication function that can be used inside the network system. It is possible to determine the network segment that serves as the delimiter without depending on the physical arrangement of physical objects. because,
By setting appropriate physical addresses and routing contents based on physical addresses for each physical object that constitutes the network system, packet routing (switch) can be performed so as to match the logical network configuration. Because you can.

The network segment referred to here corresponds to a range or a subnet where broadcasting is performed, assuming that the logical network conforms to the TCP / IP protocol. Such a network segment is called a virtual network.

Now, at present, in a corporate organization or the like, people and equipment are frequently moved due to personnel changes and utilization of projects, and information equipment connected to a network is no exception. In particular, information devices such as personal computers and workstations are owned by users, and often the information devices move as the users move.

In a hierarchized organization such as a company, a unit of a higher hierarchy is composed of a set of units of a lower hierarchy, such as a section, a department, a place of business, and a company.

In the first embodiment, the logical manager 100 operates and manages the hierarchical organization by providing a directory service, and the physical manager 200
Operates and manages the virtual network provided for each unit. FIG. 8 shows such an operation management.

In FIG. 8, 1001 is a logic manager 10.
0 logical manager module 121 directory service window module 1211 display device 109
Directory service window 1001
2001 is the information device window module 22 of the physical manager module 221 of the physical manager 200.
Reference numeral 11 denotes an information device / window displayed on the display device 209.

As shown, the directory service
The window 1001 constitutes a directory tree on a global scale, and Root represents the earth. Below that is Japan, which is a country, and below that is the company's HIT.
There is ACHI. Furthermore, there are business establishments SDL and SDC underneath, and 4Dept. 5 Dept. , 6 Dept.
There is a virtual network composed of these units. 4 Dept. Below is the manager Manager
There are A, a file server FS1 used at the department level, a print server PS1, a printer Printer1, and a section 405U, and users B, C, and D are under 405U. Similarly, 5
Dept. ManagerE who is the manager underneath, file server FS2 used at department level, print server PS2, printer Pr
There are inter2 and 501U, and F and G users are below 501U.

As described above, the directory service window module 1211 of the logical manager module 121 of the logical manager 100 hierarchically manages the logical objects of the network system in the directory tree format, and the directory tree is displayed on the display device 109. Displaying in helps the administrator to grasp and manage the relationship between logical objects.

On the directory service window 1001, the administrator can edit, such as newly create, change, delete each logical object or directory tree. Such editing is performed according to the administrator's designation performed via the input device 207 such as a keyboard, the directory tree setting, changing, generating module 1212, user setting, changing, generating module 12 of the logical manager module 121.
13, the information device setting, changing and generating module 1214. The directory tree setting / changing / generating module 1212 edits the structure of the directory tree, the user setting / changing / generating module 1213 edits a logical object representing a user, and the information equipment setting / changing / generating module 1214 represents information equipment. Responsible for editing logical objects.

Next, the information device / window 2001 is
4 Dept. And 5 Dept. Is displayed as a virtual network. Virtual Network (4Dept.) And Virtu
al Network (5 Dept.) is a logical object 4 Dept. And 5De
pt. Directory service window 1001 in which each physical object, which is an element in the Virtual Network, is associated with
It is associated with the logical object above. Note that, here, the user is represented as having one information device.

Now, such contents are described by the logic manager 1
00, while the physical manager 200 manages, 4Dept. 405U user D1001
Is 5 Dept. Consider the case of moving to 501U.

In this case, the administrator who is using the logical manager 100 makes the directory service window 10
01 using the mouse 207, which is one of the input devices,
Drag user D1001 to the lower 501 of 405U
When dropped on U, the directory tree setting, changing, and generating module 1212 changes the directory tree so that this user D1001 is a lower logical object of 501U. Further, the contents of such a change are notified to the physical manager 200 via the network.

Upon reception of this notification, the physical manager 200 automatically makes a server / client setting / change / management module 22 of the physical manager module 221.
12, switching hub setting, change, management module 2
213, router setting, change, management module 2214
, The change corresponding to the notified change is applied to the related virtual network based on the correspondence between the logical object and the physical object and the correspondence between the virtual network and the logical object. In this case, the server / client setting / changing / managing module 2212 automatically detects the information device 20 of the user D1001.
01 from Virtual Network (4Dept.) To Virtual Netwo
Move to rk (5Dept.) and change the virtual network.

The physical manager module 221 server settings, changes, management module 2212, switching hub settings, changes, management module 2213, router settings, changes, management module 2214 are the physical configuration of the network system under management and Refer to the settings of each physical object that configures the network, determine the physical objects that need to be changed in order to realize the changed virtual network and the settings that need to be changed, and specify the physical settings that need to be changed. The agent 300 on the object is requested to change the setting of the physical object. Here, the physical objects refer to various devices that make up the network, but not all devices that make up the network have to be managed as constituent elements of the virtual network.

Now, the requested agent changes the setting of the physical object.

A specific example of the operation of changing the settings of the virtual network and each physical object in accordance with such a change at the directory level will be described below.

Now, the physical manager 100, the physical manager 200, and the agent 30 as shown in FIG. 9 and FIG.
Take a network system including 0 as an example.

The networks shown in FIGS. 9 and 10 are logical manager 100, physical manager 200, ATM (Asynchronous).
ous Transfer Mode) 3001, switching hub 30
02, a router 3003, a server 3004, a client 3005 and the like.

First, as described above, in the directory service window 1001 of FIG. 8, the user D100 is dragged and dropped by the administrator or the like.
1 is moved from 405U to 501U, the directory tree setting / change generating module 1212 changes the directory tree, and generates changeable information indicating the contents of the change into information receivable by the physical manager 200. 2 operating system modules 1
22 via the communication management module 123 and the communication control device 111 to the physical manager 200 on the directory tree from the user D 1001 to the user D 405U to 501U.
Tell that you have moved to.

In the physical manager 200, the user D10
Since the physical object associated with 01 is the client 2001, the physical manager module 221
Internal server / client setting / change management module 2
At 212, the client 2001 owned by the user D1001 is moved to the virtual network associated with 501U. That is, user D100
1 owns client 2001 is Virtual Network
Change (4Dept.) To become a component of Virtual Network (5Dept.).

Next, as shown in FIG. 10, the physical manager 200 sends the setting change information accompanying the change of the virtual network to the ATM (Async) which is a constituent element of the network.
(hronous Transfer Mode) 3001, switching hub 3002, router 3003, server 3004, client 3005, etc. Specifically, the client 2001 owned by the user D1001 generated by the physical manager module 221 is a virtual network (4Dep).
t. ) To Virtual Network (5 Dept.) as a constituent element of the network, the information on the change of the setting of each constituent element of the network is transmitted via the operating system module 222 to the communication control module 223 and the communication control device 21.
1 through the related ATM (Asynchronous Transfer Mod
e) 3001, switching hub 3002, router 3
003, the server 3004, the client 3005, etc. are notified to the agent 300.

In this way, in the server 3004 client 3005 to which the setting change information is sent from the physical manager 200, the server / client setting / change control module 32 in the agent module 321
12 is a client 20 owned by user D1001
01 is Virtual Network (4Dept.) To Virtual Netwo
Server 3004 as a component of rk (5 Dept.)
The setting of the client 3005 is changed.

Similarly, in the switching hub 3002, the switching hub setting / change control module 32
At 13, the actual configuration of the information device is changed.

Similarly, in the router 3003, the router setting / change control module 3214 changes the actual configuration of the information equipment.

There are various methods for setting each physical object to realize such a virtual network, such as a protocol adopted by a physical network or a protocol adopted by a virtual network. Depending on the level of the protocol layer called OSI to achieve the consistency between the virtual network and the physical network, one example is the configuration of the virtual network by setting the following physical objects. Changes can be realized.

That is, now, in the network system of FIG. 9, it is assumed that the client a exists at the position X0 before the organization is changed. And the router 3003
Is the logical address a0 of client a according to the internal setting
Accordingly, it is assumed that F0 is assigned to the client a as a physical address used for communication with the client a with the router 3003. And from client b,
When the broadcast communication is performed to the virtual network A to which the client a belongs, the ATM0 converts the destination of the packet addressed to the virtual network A into the ATM address AT0 used between ATMs and transfers it to the ATM1 according to the internal setting. Further, according to the internal setting, other clients belonging to the virtual network A are directly and indirectly transferred to the ATM which accommodates them by converting the destination into an appropriate ATM address.
The ATM1 transfers the packet of the destination AT0 to the router 3003 after converting the destination to an appropriate address RT0 used for the transfer between the router and the ATM according to the internal setting. Router 300
3, the packet destination of the destination RT0 is converted into the physical address F0 used for the transfer by the router and the client a according to the internal setting, and then transferred. Client a receives this packet with the previously assigned physical address F0. Similarly, other clients and servers belonging to the virtual network A also receive the packet broadcast by the client b to the virtual network A.

Assuming such a network,
When the client a moves to the virtual network B due to the change of the owner due to the change of the organization and the position of the client a also moves to the subordinate of the switching hub 3002, the physical manager 200 sends each agent via the agent of each physical object. Change the settings of the physical object as follows.

That is, for example, the packet of the destination C which receives the setting of the router 3003 from the ATM 1 is
Change to not relay to. As a result, even if the client a is not physically relocated, the client a is excluded from the virtual network A. Of course, not the router 3003, ATM0
In some cases, it may be desirable to prevent the packet addressed to the virtual network A from being transferred from the router 3003 to the physical address F0 by changing the setting of the ATM1.

On the other hand, the switching hub 2002 sends the client a to the client a in accordance with the logical address a0 of the client a.
The internal setting is changed so that F1 is assigned as the physical address corresponding to the transmission path used for the communication between the switching hub 2002 and the client a. Also, the internal settings of ATM0 can be changed from client b
When the broadcast communication is performed to the virtual network B to which a belongs, the operation of converting the destination of the packet addressed to the virtual network B into the ATM address AT1 and transferring to the ATM1 is also performed. Further, the setting of ATM1 is changed so that the packet of the destination AT1 is transferred to the switching hub 2002 after the destination is converted to the address RT1. The internal setting of the switching hub 2002 is further changed so that the packet of the destination ART1 is converted into the physical address F1 and then transferred to the client a via the transmission path corresponding to the physical address F1. Client a
It receives this packet sent to the transmission path corresponding to the previously assigned physical address F1. Now, the client a receives the packet broadcast to the virtual network B. That is, it means that the user has moved to virtual network B.

As described above, according to the first embodiment,
At the directory service level, if you move a user from one organization (group) to another organization (group),
Along with this change, the physical object representing the information device owned by the user is moved from the virtual network corresponding to the organization before the movement to the virtual network corresponding to the organization after the movement, and the virtual network after such a change. It is possible to automatically change the setting of each physical object to realize the above.

Therefore, it is possible to provide a system for unified construction and management of virtual networks.

In the first embodiment described above, an example of a logical object that moves a user at the directory service level has been described. However, this is not limited to the user, and the directory tree The same applies as long as it becomes an object at the level and is associated with the virtual network and the objects as its constituent elements.

Further, in the above description, a virtual net provided corresponding to an organization such as a company has been described as an example. However, for example, virtual networks can be grouped and managed according to a security level.

Specifically, as shown in FIG. 11, a virtual network is provided with Security Level A 401 and Security Level B 40 according to its security level.
2, Security Level C 403, Security Level D 40
It is managed by dividing it into four parts, and the directory tree components (Pr
oject) is mapped as follows. That is, Project A
The virtual network 405 corresponding to
Level A 401, Security Level B 402, Security
Belonging to Level C 403, Security Level D 404,
Virtual network 406 corresponding to ProjectB
Is Security Level B 402, Security Level C 40
3, belongs to Security Level D 404.

Then, members 460 of Project B 406
When 1 moves from Project B to project A (when the directory tree is changed),
The security level of the information equipment of the member 4061 is Se
curity Level B 402, Security Level C 403, Se
curity Level D 404 to Security Level A 401,
Security Level B 402, Security Level C 40
3. Automatically change the settings of physical objects such as related virtual network and information equipment of the member 4061 so as to belong to Security Level D404.

Furthermore, as shown in FIG. 12, virtual networks may be grouped and managed according to departments. Figure 12 shows Plannig Division 5
01, Marketing Division 502, Development Divis
It shows that virtual networks are grouped for each department of ion 503 and Sales Division 504, and the constituent elements (Project) of the directory tree having various projects as logical objects are associated with each virtual network as follows. That is, Project A
505 is Plannig Division 501, Marketing Divis
ion 502, Development Division 503, Sales Div
belongs to ision 504, Project B 506 is Marketi
ng Division 502, Development Division 503,
Belongs to SalesDivision 504.

Also at this time, the settings of the virtual network and each physical object can be automatically changed according to the movement of the members (change of the directory tree).

As described above, the target to be provided with the virtual network can be arbitrarily selected in addition to security and department, for example, protocol and service.

Further, it is possible to realize a computer environment as shown in FIG. 13 by dynamically changing the connection of the virtual network by the user for such a plurality of virtual networks.

Specifically, Virt which is Security Level A
ual Network A 601, Sales Division Virtual
Network B 602, SNMP Virtual Network C 60
3, the user 604 may be connected to each virtual network as needed.

As a second embodiment of the present invention, an embodiment of a network resource monitoring system will be described below.

FIG. 14 shows the configuration of the network monitoring system according to the second embodiment.

The network resource monitoring system 5101 shown in FIG. 14 is constructed on a network system including network resources to be monitored.

As shown in the figure, the network monitoring system 5101 comprises a monitoring view display section 5102, a monitoring profile setting section 5103, a control section 5104, a network monitoring management database 5105, a network resource monitoring section 5106, and a directory service section 5107. To be done. Monitoring view display unit 5102, monitoring profile setting unit 5103, network resource monitoring unit 510
6. The directory service unit 5107 includes a control unit 510.
Network monitoring management database 5105
Can be accessed.

The network resource monitoring system shown in FIG. 14 is an electronic device equipped with hardware such as an input device 5204, a display device 5205, a CPU 5202, a memory 5203, and a storage device 5206 as shown in FIG. It can be built on a computer. In this case, the monitoring view display unit 5102, the monitoring profile setting unit 5103, the control unit 5104, the network resource monitoring unit 5106, and the directory service unit 55107 are embodied as processes executed on the electronic computer. The network monitoring management database 5105 is composed of data stored in the storage device 5206 and a process for managing this data.

The network resource monitoring unit 5106 is realized by, for example, the network management manager based on the SNMP. In this case, the network resource monitoring unit 5106 communicates with the management agents installed on the network resources when the network resources are installed, and the properties (attributes) of the network resources monitored by each management agent. Information about the type of is acquired and managed. The information about the type of property of each network resource is specifically, for example,
For example, the network address of the device equipped with the SNMP management agent and the management information supported by the management agent.
It is represented by a base (MIB) object identifier.

Further, the network resource monitoring unit 5106
Communicates with the management agent placed on each network resource based on the information about the type of property (attribute) of the network resource monitored by the managing agent and manages each network resource. Collects the status of properties monitored by the management agent. In response to a request from the network resource monitoring unit 5106, the management agent provides the network resource monitoring unit 5106 with information such as the status of the property being monitored.
Send to

Next, the directory service unit 5107
Is the network operation management system according to the first embodiment described above, and other network OS (O).
This can be realized by the directory service provided by S).

Here, the directory service unit 5107
Manages objects that are logical elements that hierarchically use and configure the network as shown in FIG.

In FIG. 16, objects of user groups A branch, B branch, and M factory exist in the hierarchy below the user group (organization) object of center, and the hierarchy below the object of A branch. In department B,
There is a user group object called department C and an object called common area. Here, the object in the common area is a network resource that can be used by all users belonging to the A branch, that is, an object that cannot be managed as a hierarchy below a specific user or user group belonging to the A branch. It is a virtual segment that is provided to belong together.

In FIG. 16, objects corresponding to network resources (computers, storage devices) such as machine A and volume, and a user object called user A exist in the hierarchy below the object of department B. ing. Two objects corresponding to two network resources (servers) Svr0 and Svr1 exist in the hierarchy below the objects in the common area.

Also, the directory service unit 5107
Defines the correspondence between network resources and objects, the hierarchical relationship between such objects, the access rights to each network resource, and the properties (attributes) to be monitored for each network resource as the objects corresponding to the network resource. Corresponding and managing.

Specifically, the directory service unit 51
Reference numeral 07 denotes the correspondence between network resources and objects stored in the network monitoring management database 5105, the hierarchical relationship of objects according to the table format information shown in FIGS. 17 to 19, the access right to each network resource, and each network. It manages the properties (attributes) of resources that should be monitored. Directory service section 5
107 accesses the network monitoring management database 105 via the control unit 5104 as necessary to perform processing.

FIG. 17 shows a directory object configuration table 5800 provided for each object. The directory object configuration table 5800 includes an object identifier 5801, an object position identifier 5802, an object type 5803, a pointer 5804 to an access right table, a pointer 5805 to an object property table, and a pointer 580 to a next directory object configuration table.
It consists of 6.

The object identifier 5801 is an identifier for identifying the corresponding object, and the object position identifier 5802 is the corresponding object in FIG.
Information indicating the position on the hierarchical structure shown in FIG.
The pointer 5804 to the access right table is information indicating the position where the access right table of FIG. 18 showing the content of the access right provided for the corresponding object when the access right is set for the corresponding object is stored. The pointer 5805 to the object property table stores the object property table of FIG. 19 that represents the content of the property to be monitored provided for the corresponding object when the property to be monitored exists in the corresponding object. This is information indicating the position where the user is present. Also, a pointer 58 to the next directory object configuration table
06 is information indicating the position where the directory object configuration table of the next object is stored.
A directory object configuration table corresponding to each object is linked in a chain by a pointer 5806 to the directory object configuration table.

Next, the access right table 59 of FIG.
00 is an object identification name 5901 that holds the right,
The access type 5902 and the access right 5903 are included. The object identification name 9501 that holds the right is information for identifying the object that has the right to access the object corresponding to the access right table 5900, and the access type 5902 is the type of access (object access or property access). ) Indicating access right 590
Reference numeral 3 is information indicating the content of the access right (reference, update, etc. of information stored in the object).

Next, the object property table 6000 of FIG.
002 and a pointer 6003 to the next property table. Such an object property table 6
000, provided for each property to be monitored of the corresponding object.

The property 6001 is information for specifying the property to be monitored, the property value 6002 is the property value obtained as a result of monitoring, and the pointer 6003 to the next / next property table is for monitoring the corresponding object. This is information indicating the position where the property table 6000 corresponding to the next property is stored when there are multiple power properties.

The object property table 6000 is created by the control unit 104 and the network resource monitoring unit 5106 in FIG.

This object property table 60
FIG. 20 shows the processing procedure of the creation processing of 00.

As shown in the figure, in this processing, the control unit 5104 first causes the network resource monitoring unit 5106.
Access information for accessing to (640
1).

Next, the control unit 5104 issues a request to the network resource monitoring unit 106 to collect property information of each network resource that can be monitored by the network resource monitoring unit 5106 (5402). .

Next, the control unit 5104 refers to the network monitoring management database 5105 and searches the directory object configuration table 5800 corresponding to the network resource for which the property information is acquired (5
5403), if the directory object configuration table 5800 exists, the object property table 6000 including the acquired property information is created by linking to the directory object configuration table 5800 (5404). If the corresponding directory object configuration table 5800 does not exist, a new directory object configuration table 5800 is created and linked to this to create the object property table 6000 (54
04). At this point, the property value of the object property table 5800 is not stored, and only the entry for recording the property value is secured.

Now, in this way, the object configuration table 5800, access right table 5900, and object property table 60 shown in FIGS.
After 00 is stored in the network monitoring management database 5105, the monitoring profile setting unit 5103 performs a monitoring profile generation process that defines the target of monitoring and display of the monitoring result in this network monitoring system.

FIG. 21 shows the processing procedure of this monitoring profile generation processing.

In this processing, first, the screen 6101 for setting the monitoring range of FIG. 2 is displayed on the display device 5205 (50
1). In the area 6102 on this screen, the hierarchical structure of each object according to the directory object configuration table 5800 stored in the network monitoring management database 5105 is displayed in a tree structure. The user can select a monitoring range from the displayed objects (5502).

For example, by selecting the “A branch” object and pressing the “add” button 6103, “A branch” is added to the monitoring range, and the monitoring range setting field 6
“A branch” is displayed at 104. By selecting an item in the field and pressing the “delete” button 6105, this item is deleted from the monitoring range and also deleted from the display of the monitoring range setting field 6104.

When the monitoring range is set, next, a screen for setting a monitoring group 6201 in FIG. 23 is displayed.
In the area 6202 of the screen for monitoring group setting, refer to the directory object configuration table 5800,
In the tree that represents the hierarchical structure of objects, the objects that were previously set as the monitoring range and the parts in the lower hierarchy are displayed. Alternatively, by setting the display color of the object that was previously set as the monitoring range and the part in the layer below it to be different from other parts,
The tree is displayed so that this tree portion can be identified by the user. Then, on this screen 6201, the setting of the monitoring group is accepted from the user (5503). For example, by selecting the "B department" object and specifying the "add" button 6203, "B department" is added to the monitoring range.
Is added, and “B department” is displayed in the monitoring group setting field 6205. By selecting an item in the field and designating the “delete” button 6204, this item is deleted from the monitor group and also deleted from the display of the monitor group setting field 6104.

When the monitoring group is set in this way, the monitoring profile setting unit 5103
Next, it judges whether or not the user or the user group is selected as the monitoring group (55504).

If a user or a user group is selected as the monitoring group, FIG.
A screen 6301 for setting a monitoring object shown in FIG. 6 is displayed, and a user selected as a monitoring group or a physical object accessible by the user group is selected in the monitoring object setting area 6301 by referring to the access right table 5900. And display (550
5).

On the other hand, in other cases, when a container object having network resources in the lower layer is set as a monitor group, a monitor object setting screen 6301 shown in FIG. 24 is displayed. In the area 6301 of the monitor object setting screen, all objects below the objects selected as the monitor group are displayed (5505).

Next, an inquiry is made to the user by displaying an appropriate dialog as to whether or not to monitor only the object currently in use or in operation (5506). When only the object currently in use or in operation is monitored, control is performed. Network resource monitoring unit 5 via unit 5104
By inquiring 106, it is checked whether each object displayed on the monitor object setting screen 6301 is in operation, and whether the object is used by another object, and the area 6302 is displayed in accordance with the result. The display of the displayed object (for example, the color of the icon) is changed (5507). When inquiring about the use or operation state of an object, the network resource monitoring unit 5106 accesses the network resource corresponding to the inquired object, collects the state, and returns it to the inquiry source.

Next, on the monitor object setting screen 6301 of FIG. 24, the monitor object (5508), monitor property (5509), monitor property display format,
The display frame setting (55510) is accepted.

The reception of these items can be performed, for example, by the user by the "Svr01" object 6 in the area 6302.
When 302 is selected and the "add" button 6304 is designated, "Svr01" is set as the monitoring object, and Svr01 is displayed in the resource name field 6305. Of course, the monitor object setting screen area 63
It is also possible to unconditionally set all of the objects displayed in 01 or all of the objects in operation or in use among the objects displayed in the area 6301 of the monitoring object setting screen as monitoring objects.

Next, for example, when the monitoring object is set to the "Svr01" object, "Svr0" is set.
1 ”The object property table 6000 corresponding to the object 6302 is searched, and the list 6303 of properties that can be monitored for“ Svr01 ”is displayed.
By selecting an item in the list and designating the “add” button 6304, the setting of the monitoring property is accepted, and the accepted monitoring property is displayed in the field 6306.
In addition, a display field 630 for each set property is set.
Display format field 680 provided for each 6
8. The display format and the display frame are set according to the contents input by the user in the display frame field 6809. In addition, the display format is a setting of how to display the monitoring result of the set monitoring property, and the display frame displays the monitoring result of the set monitoring property in which display frame. It is a setting of whether to do.

To delete each setting, select the item in the field you want to delete and click the "delete" button 6307.
Is accepted from the user by specifying. The settings accepted for deletion are deleted and the display on the screen is also deleted.

In this way, the setting of the monitoring range, the monitoring group, the monitoring object, the monitoring property, the display format, and the display frame received from the user is performed by the control unit using the series of display screens shown in FIGS. 5104
25 to 27, and is stored in the network monitoring management database 5105 as one monitoring profile including the tables shown in FIGS. A unique file name is given to the monitoring profile according to the user's designation.

Now, FIG. 25 shows a monitor group table 6400 provided for each set monitor group.

Object identification name 6 for specifying the monitoring range
Reference numeral 401 is an identifier of an object set as a monitoring range to which the corresponding monitoring group belongs, and object identification name 6402 for designating the monitoring group is an identifier of an object set as the corresponding monitoring group. Further, the pointer 6403 to the table that specifies the monitoring object is a pointer indicating the storage position of the monitoring object table of FIG. 26 that is provided for each set monitoring object, and is a pointer of the monitoring object table of the monitoring object that belongs to the corresponding monitoring group. Shows the beginning. Further, the pointer to the next table is a pointer indicating the storage position of the monitor group table corresponding to the next monitor group when there are a plurality of monitor groups.

Next, FIG. 26 shows a monitoring object table provided for each of the above-mentioned monitoring objects. In the figure, the object identification name 6501 corresponding to monitoring is shown.
Is the identifier of the corresponding monitoring object, and the pointer 6502 to the monitoring property table is a pointer that points to the beginning of the monitoring property table in FIG. 27 provided for each monitoring property set for the corresponding monitoring object. Pointer to table 6503
Is a pointer that indicates the position of the monitoring object table corresponding to the next monitoring object when there are a plurality of monitoring objects belonging to the monitoring group to which the corresponding monitoring object belongs.

Next, the monitoring property table of FIG. 27 is a table provided for each set monitoring property. The property name 6601 to be monitored in the monitor property table is the identifier of the corresponding monitor property, and the display format is 6603 indicating the display format in which the monitor property is competed with, and the display frame name 660.
Reference numeral 4 is a display frame identifier set for the corresponding monitoring object. The display frame information 6604 is information indicating the position and size at which the monitoring result of the corresponding monitoring property is displayed. However, this display frame information 6604 is set later, and at this stage, only the entry for storing the display frame information 6604 is secured. Next, the pointer 6605 to the next table indicates the position of the monitor property table corresponding to the next monitor property when a plurality of monitor properties are set in the monitor object to which the corresponding monitor property is set. It is a pointer.

Hereinafter, the monitoring screen generation processing performed by the monitoring view display unit 5102 after the monitoring profile is stored in the network monitoring management database 5105 in this way will be described. FIG. 28 shows a processing procedure of this monitoring view generation processing.

As shown in the figure, in this process, the monitoring profile is referred to and a monitoring screen for displaying the monitoring result is created. That is, first, referring to the monitoring profile, each monitoring object is arranged in an area 6701 of a predetermined size provided at a predetermined position on the monitor screen (560).
1). For example, as shown in area 6701 in FIG.
The "vr01" object, the "Svr02" object, etc. are displayed in a form in which the relationship between the objects can be recognized (5601). The display form may be in accordance with the tree described above, or may be a physical connection relationship of network resources corresponding to each object managed separately.

Next, in step 5602, FIG.
The portion other than the area 6701 of the monitoring screen of 1 is divided into the same number of areas as the number of different display frame names described in the monitoring profile. For example, 66702 is the area of the frame name "Fram-a", 6703 is the frame name "
In this division, the area and arrangement of each frame name are determined according to the number of monitoring objects corresponding to the frame name, the type of monitoring property, and the display format. For example,
A region 6702 in FIG. 29 includes Svr01, Svr11, S
vr21 has three monitoring objects, CPU load monitoring property, line graph display format,
When a frame name "Frame-a" is set, the area is provided corresponding to the frame name "Frame-a", and is Svr01, Svr11, Sv.
The area size is set so that the CPU load of r21 can be represented by one line graph. Also, FIG.
Area 6703 of Svr01, Svr02, Svr2
Monitoring property called usage rate, display format called pie chart, and "Frame-
When the frame name "b" is set, "Fr
The area size is determined so that the usage rates of Svr01, Svr01, and Svr21 can be displayed in a pie chart for each network resource (server). Information about the size and position of each area thus determined is stored in the frame information of the monitoring property table including the corresponding frame name described above.

Next, in step 5602, display parts determined by the number of monitoring objects, the types of monitoring properties, and the display format in which the frame name is set are arranged in the area corresponding to each frame name. FIG.
In the case of 9, one line graph in the area 6702,
In the area 6703, three pie charts are arranged as display components. In addition, the name of the monitoring property corresponding to each area is displayed in each area.

Then, among the arranged display parts, for the display parts which do not need to display the data for each monitoring group, the information of the display parts, the arrangement information, and the data in the arranged display parts are set as data. Parameter information specifying a set of monitoring objects and monitoring properties to be displayed is stored in the network monitoring management database. For example, when the display format of FIG. 29 is a line graph, the set of the monitor object and the monitor property that should be displayed as data (data specifying the shape of the line) in the line graph is the monitor property of the CPU load of Svr01. It is defined to be three pieces of data corresponding to three values, a value of the monitoring property of the CPU load of Svr11 and a value of the monitoring property of the CPU load of Svr21.

Next, in step 5603, among the arranged display components, display component information and display information of the display components of the display format in which data should be displayed for each monitoring group are displayed. The monitoring object to be displayed as data in the component, the monitoring property, and the parameter information for specifying the monitoring group are stored in the network monitoring management database. For example, in FIG.
If the display format of is a pie chart, the data (data that identifies the fan shape) in the first pie chart from the left is B
It is defined as two pieces of data corresponding to two values of the usage rate of Svr01 of the department and the usage rate of Svr01 of the department A. Similarly for the second pie chart from the left,
Data in the pie chart (data that identifies the fan shape)
The usage rate of Svr02 in department B and Svr02 in department A
It is defined to be two data corresponding to two values of the usage rate of.

At the time when this monitor screen is generated, the monitor based on the monitor profile described later is
Since it has not been performed yet, specific data (line and fan) is not displayed on each display component (line chart, pie chart).

Monitoring based on this monitoring profile and display processing of monitoring results on the monitoring screen will be described below.

FIG. 30 shows the processing procedure of the monitoring and the display processing of the monitoring result.

First, when the user gives an instruction to start monitoring (5701), the control unit 5104 instructs the network resource monitoring unit 5106 to execute the monitoring process based on the monitoring profile.

Next, at step 5703, the network resource monitoring unit 5106 and the monitoring view display unit 5102 perform the following processing.

That is, the network resource monitoring unit 510
Upon receiving the instruction to execute the monitoring start process, the computer 6 accesses the network monitoring management database 5105, reads the monitoring profile, and determines the network resource and property to be monitored specified by the monitoring object and the monitoring property. Then, it determines and communicates with the management agent on each network resource to collect the values of the monitoring properties. The collected monitoring property value of each monitoring object is stored as the property value 6002 of the object property table 6000 of the corresponding object in the network monitoring management database 5105 via the control unit. When the storage of the property values of the monitor properties of all the monitor objects in the property values of the object property table 6000 is completed, the monitor view display unit 5102 is notified of the end of the monitor process via the control unit 5104.

On the other hand, when the monitoring view display unit 5102 receives the notification of the end of monitoring, the directory object configuration table 5800 and the object property table 6000 of the network monitoring management database 5105.
, The content to be displayed as data on each display component of the monitoring screen created for the monitoring profile for which monitoring has been completed is read out, and the property value 6002 of the object property table 6000 is referenced accordingly,
Display data in each display component. For example, in the case of the line graph of FIG. 29, the value of the monitoring property called CPU load of Svr01 in the line graph,
The value of the monitoring property called CPU load of Svr11, S
The three values of the CPU property of vr21, which is the value of the monitoring property, are displayed as data (indicated as a line. Also, in the first pie chart from the left in FIG. 29, the usage rate of Svr01 of department B and the use of Svr01 of department A Two values of the rate value are displayed as data (fan shape).

The network monitoring system according to the second embodiment of the present invention has been described above.

As described above, according to the network monitoring system according to the second embodiment of the present invention, the monitoring result of the network resource is obtained by associating it with the logical object defined in the directory such as user unit or service unit. be able to. Further, it is possible to easily set the monitoring contents for each user or each service.

[0137]

As described above, according to the present invention, the setting of each device constituting the network is automatically changed according to the change of the logical object such as the user and the relation between the logical objects. It is possible to provide a network operation management system capable of performing. We also provide a network operation management system that can automatically change the logical relationship between physical objects such as information devices connected to the network according to changes in logical objects such as users and the relationships between logical objects. can do.

Further, according to the present invention, it is possible to provide a network resource monitoring system capable of determining network resources to be monitored according to the logical structure of the network system. Further, it is possible to provide a network monitoring system capable of monitoring by a logical structural unit of the network.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration of a network operation management system.

FIG. 2 is a diagram showing a configuration of a logical manager.

FIG. 3 is a diagram showing a configuration of a logic manager module.

FIG. 4 is a diagram showing a configuration of a physical manager.

FIG. 5 is a diagram showing a configuration of a physical manager module.

FIG. 6 is a diagram showing a configuration of an agent.

FIG. 7 is a diagram showing a configuration of an agent module.

FIG. 8 is a diagram showing a display example in a directory service window and an information device window.

FIG. 9 is a diagram showing a specific configuration example of a network operation management system.

FIG. 10 is a diagram showing a relationship between a physical manager and an agent.

FIG. 11 is a diagram showing a relationship between a virtual network provided for each security level and a logical project.

FIG. 12 is a diagram showing a relationship between a virtual network provided for each department and a logical project.

FIG. 13 is a diagram showing how one user connects to a plurality of virtual networks.

FIG. 14 is a block diagram showing a configuration of a network resource monitoring system.

FIG. 15 is a block diagram showing a hardware configuration of a network resource monitoring system.

FIG. 16 is a diagram showing a hierarchical structure of objects managed by a directory service unit.

FIG. 17 is a diagram showing a configuration of a directory object configuration table.

FIG. 18 is a diagram showing a configuration of an access right table.

FIG. 19 is a diagram showing the structure of an object property table.

FIG. 20 is a flowchart showing a procedure of an object property table creating process.

FIG. 21 is a flowchart illustrating a processing procedure of a monitoring profile generation process.

FIG. 22 is a diagram showing a monitor range setting screen.

FIG. 23 is a diagram showing a monitor group setting screen.

FIG. 24 is a diagram showing a screen for setting a monitoring object and a monitoring property.

FIG. 25 is a diagram showing the structure of a monitoring group table.

FIG. 26 is a diagram showing the structure of a monitoring object table.

FIG. 27 is a diagram showing the structure of a monitoring property table.

FIG. 28 is a flowchart showing a processing procedure of a monitoring screen generation processing.

FIG. 29 is a diagram showing a monitoring screen.

FIG. 30 is a flowchart showing a processing procedure of monitoring and display processing of monitoring results.

[Explanation of symbols]

100 ... Logical manager 200 ... Physical manager 300 ... Agent 121 ... Logical manager module 221 ... Physical manager 321 ...
Agent manager 1211 ... Directory service window module 1212 ... Directory tree setting / change generation module 1213 ...
User setting / change generation module 1214 ... Information device setting / change generation module 2211 ... Information device / window module 2213 ... Switching hub setting / change management module 2214 ... Router setting / change management module 3211・ ・ ・ Information device setting change module 3212 ・ ・ ・ Server / client setting / change control module 3213 ・ ・ ・ Switching hub setting / change control module 3214 ・ ・ ・ Router setting / change control module 1001 ・ ・ ・ Directory service window , 2001 ... Information device / window, 5101 ... Network resource monitoring system, 5
102 ... Monitoring view display unit, 5103 ... Monitoring profile setting unit, 1504 ... Control unit, 5105.
..Network monitoring management database, 5106 ..
-Network resource monitoring unit, 5107 ... Directory service unit, 5201 ... System device, 5202
... CPU, 5203 ... Memory, 5204 ...
Display device, 5205 ... Input device, 5206 ... Storage device

 ─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor Satoru Tezuka 1099 Ozenji, Aso-ku, Kawasaki-shi, Kanagawa Inside the Hitachi, Ltd. System Development Laboratory (72) Inventor Kenji Kawaguchi 1099, Ozen-ji, Aso-ku, Kawasaki-shi, Kanagawa Company Hitachi, Ltd. System Development Laboratory (72) Inventor Kenji Kawakita 1099, Ozenji, Aso-ku, Kawasaki City, Kanagawa Stock Company, Hitachi Ltd. System Development Laboratory (72) Takashi Kagei, 1099, Ozenji, Aso-ku, Kawasaki, Kanagawa Prefecture Hitachi, Ltd. System Development Laboratory (72) Inventor Akira Mineo 5030 Totsuka-cho, Totsuka-ku, Yokohama, Kanagawa Prefecture Hitachi Ltd. Software Development Division (72) Inventor Keizo Mizuguchi 5030 Totsuka-cho, Totsuka-ku, Yokohama, Kanagawa Established Hitachi Ltd. software The headquarters

Claims (13)

[Claims] 1. A network operation management system for managing a logical object which is a logical constituent element of a network system and a physical object which is a physical constituent element of the network system. A logical manager that manages the relationship between the logical objects, a physical manager that connects to the network and manages the physical objects associated with the logical objects and the relationship between the physical objects, and the physical manager of each physical object A plurality of agents for controlling settings, wherein the logical manager has means for notifying the physical manager of the content of the change when the relationship between the managed logical objects changes, Is the logic Depending on the contents of the change notified from the manager and the correspondence between the logical object and the physical object, the relationship between the physical objects to be managed is updated so as to match the relationship between the logical objects after the change. , Having means for requesting each of the agents to change the setting of each physical object so as to match the relationship between the updated physical objects, wherein the agent is a physical object in response to a request from the physical manager. A network operation management system characterized by changing settings of. 2. The network operation management system according to claim 1, wherein the physical manager manages a virtual network that represents a logical relationship between the physical objects and physical objects, and the logical manager. A means for updating the virtual network to be managed so as to match the relationship between the logical objects after the change according to the contents of the change notified by the manager and the correspondence between the logical object and the physical object. A network operation management system having: 3. A network operation management system for managing a logical object which is a logical constituent element of a network system and a physical object which is a physical constituent element of the network system, wherein the logical object and the relationship between the logical objects. And a physical manager that manages a virtual network associated with the logical object, which represents the physical object associated with the logical object and a logical relationship between the physical objects. When the relationship between the managed logical objects is changed, the logical manager has means for notifying the physical manager of the content of the change, and the physical manager is provided with the change notified by the logical manager. Content and the logical object Means for updating the virtual network to be managed so as to match the changed relationship between the logical objects according to the correspondence between the physical object and the virtual network and the correspondence between the logical object and the virtual network. A network operation management system having: 4. The network operation management system according to claim 1, wherein the logical manager manages the relationship between the logical objects and the logical objects and the relationship between the logical objects and the logical objects. A network operation management system characterized by managing as a hierarchically expressed directory. 5. A network operation management system for managing a physical object that is a physical component of a network system, wherein the network operation management system is associated with the logical object and represents the physical relationship between the physical object and the physical object. A network operation management system having means for grouping and managing virtual networks. 6. A plurality of objects including at least an object corresponding to a utilization object of a network system, which is an element of a logical network, and an object corresponding to a network resource which is a physical resource constituting the network system. A network resource monitoring system comprising: a directory service unit for managing a logical hierarchical structure on a network system; and a monitoring unit for connecting to a network and monitoring network resources, wherein the directory service unit manages the objects. The object to be monitored is specified from among the objects included in the hierarchical structure between the objects to be monitored, and the monitoring condition receiving means for setting the object for which the specification is received as the monitoring target A monitoring instruction unit for instructing the monitoring unit to monitor the network resource corresponding to the object; and a monitoring result presenting unit for presenting the monitoring result of the network resource corresponding to the set monitoring target object by the monitoring unit. A network resource monitoring system characterized by. 7. The network resource monitoring system according to claim 6, wherein the monitoring condition accepting unit sets an attribute of the network resource corresponding to the set monitoring target object that can be monitored by the monitoring unit to the monitoring target object. And a means for accepting the designation of the attribute from the presented attributes and setting the attribute for which the designation has been accepted as a monitoring target attribute for the monitoring target object, wherein the monitoring instruction means is set. A network resource monitoring system for instructing the monitoring unit to monitor a monitoring target attribute set for the monitoring target object, of a network resource associated with the monitoring target object. 8. The network resource monitoring system according to claim 6, wherein the monitoring condition accepting unit corresponds to a network resource located in an upper layer in the hierarchical structure of objects corresponding to the network resource as a monitoring target group. A means for accepting designation of an object not to be monitored, and means for setting an object corresponding to a network resource existing in a lower layer in the hierarchical structure of the object designated as the monitoring target group as the monitoring target object. A characteristic network resource monitoring system. 9. The network resource monitoring system according to claim 6, further comprising: a display device, wherein the monitoring condition setting means hierarchically displays symbols of each object according to the hierarchical structure on the display device. And a means for accepting designation of the object to be monitored according to the hierarchical designation according to the hierarchical structure on the display. 10. The network resource monitoring system according to claim 6, further comprising a display device, wherein the directory service unit provides access rights to objects corresponding to network resources of each user or group of users of the network. The monitoring condition receiving means receives the designation of an object corresponding to a user of the network system or a group of users as a monitoring target group, and the user or user receiving the designation as a monitoring target group. Network resource monitoring system, wherein the display device guides the object corresponding to the network resource accessible according to the access right as a monitoring target object. . 11. The network resource monitoring system according to claim 6, further comprising a display device, wherein the monitoring unit monitors the usage status of each network resource, and the monitoring condition accepting unit, as a monitoring target group, A means for accepting the designation of an object corresponding to a user of the network system or a group of users, and an object corresponding to the network resource used by the user or the group of users who has been designated as a monitoring target group, A network resource monitoring system, comprising means for displaying on the display device a guide for designating an object to be monitored. 12. The network resource monitoring system according to claim 6, further comprising a display device, wherein the monitoring condition accepting unit displays a plurality of display forms prepared in advance to display a monitoring result of the set monitoring target object. And a means for setting the received display form as a monitoring result display form for the monitoring target, wherein the monitoring result presenting means is a network corresponding to the set monitoring target object. A network resource monitoring system, wherein the monitoring result of a resource by the monitoring unit is displayed on the display device in a monitoring result display mode set for the monitoring target object. 13. The network resource monitoring system according to claim 12, wherein the monitoring condition accepting unit accepts and accepts the selection of the display form for each attribute of the object monitored by the monitoring unit for the monitoring target object. The cabinet display form is set as the monitoring result display form for the attribute of the monitoring target, and the monitoring result presentation unit displays the monitoring result by the monitoring unit of each attribute of the network resource corresponding to the set monitoring target object. A network resource monitoring system, wherein the monitoring result is displayed on the display device in a monitoring result display mode set for the attribute of the monitoring target object.