JPWO2017122366A1 - Monitoring device, monitoring method and monitoring program - Google Patents

Abstract

  The network management device (10) is a monitoring device that displays on the display unit an alert that can be terminated in response to a confirmation operation in response to detection of the occurrence of a failure related to a communication device in the monitored system. When the network management device (10) receives an instruction to shift to a mode in which the alert is not displayed even when the occurrence of a specific failure relating to the communication device in the monitored system is detected, For specific faults that are detected during the transition, the display ends according to the confirmation operation, depending on whether the specific fault has been resolved or the fault has not been resolved before returning from the mode. A control unit is provided for controlling whether or not possible alerts are displayed after returning from the mode.

Description

  The present invention relates to a monitoring device, a monitoring method, and a monitoring program.

  As an example of a technique for monitoring a network, the following work management alarm event suppression method has been proposed.

  In this work management alarm event suppression method, the work management unit monitors the time, and when the scheduled work start time is reached, the failure management unit reflects the alarm event of the lower-level device, which is the planned construction device, to the higher-level device. Give instructions not to do so. Furthermore, the work management unit instructs the failure management unit to reflect the construction schedule apparatus at a higher level when the scheduled work end time is reached. In this way, it is aimed to suppress the confusion in the network monitoring work of the operator by suppressing the notification of the alarm event accompanying the construction work to the operator.

JP 2008-97346 A JP-A-9-168010

  However, in the above technique, an unnecessary alert may still be output.

  In other words, in the above work management alarm event suppression method, when the scheduled work end time is reached, the alarm event of the lower apparatus that is the construction scheduled apparatus is reflected to the upper apparatus. Therefore, it occurs due to construction, etc., but the operator is notified of the failure that was recovered at the end of the construction. As a result, it is unnecessary other than the alarm event that occurs due to an accident or failure. The alarm event will be output.

  In one aspect, an object of the present invention is to provide a monitoring device, a monitoring method, and a monitoring program that can prevent unnecessary alerts from being output.

  In one aspect, in the monitoring apparatus, the monitoring target system displays an alert that can be terminated in response to a confirmation operation on the display unit in response to detection of the occurrence of a failure related to the communication apparatus in the monitoring target system. Even if the occurrence of a specific failure relating to the communication device is detected, upon receipt of an instruction to shift to a mode that restricts the display of the alert, the specific that has been detected during the transition to the mode is received. An alert that can be terminated in response to the confirmation operation according to whether the occurrence of the specific failure has been resolved or the failure has not been resolved before returning from the mode. A control unit for controlling whether or not to display after returning from.

  Unnecessary alerts can be prevented from being output.

FIG. 1 is a diagram illustrating a configuration example of a network monitoring system according to the first embodiment. FIG. 2 is a block diagram illustrating a functional configuration of the network management apparatus according to the first embodiment. FIG. 3 is a diagram illustrating an example of the NW monitoring screen. FIG. 4 is a diagram illustrating an example of the NW monitoring screen. FIG. 5 is a diagram illustrating an example of a loop detection / recovery confirmation screen. FIG. 6 is a diagram illustrating an example of the NW monitoring screen. FIG. 7 is a diagram illustrating an example of a loop detection / recovery confirmation screen. FIG. 8A is a diagram illustrating an example of an overlapping pattern of the application period of the alert suppression mode and the loop generation period. FIG. 8B is a diagram showing transition of alert display. FIG. 9A is a diagram illustrating an example of an overlapping pattern of the application period of the alert suppression mode and the loop generation period. FIG. 9B is a diagram showing transition of alert display. FIG. 10A is a diagram illustrating an example of an overlapping pattern of the application period of the alert suppression mode and the loop generation period. FIG. 10B is a diagram showing transition of alert display. FIG. 11A is a diagram illustrating an example of an overlapping pattern of the application period of the alert suppression mode and the loop generation period. FIG. 11B is a diagram showing transition of alert display. FIG. 12 is a flowchart illustrating the procedure of the first monitoring process according to the first embodiment. FIG. 13 is a flowchart illustrating the procedure of the second monitoring process according to the first embodiment. FIG. 14 is a flowchart illustrating the procedure of the third monitoring process according to the first embodiment. FIG. 15 is a diagram illustrating a hardware configuration example of a computer that executes the monitoring program according to the first embodiment and the second embodiment.

  Hereinafter, a monitoring device, a monitoring method, and a monitoring program according to the present application will be described with reference to the accompanying drawings. Note that this embodiment does not limit the disclosed technology. Each embodiment can be appropriately combined within a range in which processing contents are not contradictory.

[System configuration]
FIG. 1 is a diagram illustrating a configuration example of a network monitoring system according to the first embodiment. A network monitoring system 1 shown in FIG. 1 provides a network monitoring service for monitoring network devices 30A to 30C that construct a network NW. As one aspect of such a network monitoring service, the network monitoring system 1 has an excellent point in controlling output of an alert regarding a failure that occurs on the network NW.

  The “alert” here is not always terminated immediately after the failure is resolved. Here, as an example, an operation is adopted in which the alert output is canceled only when a confirmation operation is accepted. Further, in addition to the above confirmation operation, an operation of inputting a failure and recovery report as a trail may be used. The reason why the operation with strict termination conditions for alert output is adopted in this way is that it is required to be cautiously dealt with, for example, pointing and checking, etc., for a serious failure that extends to a network outage, such as a loop. It is.

  Under such a situation where an alert is output, the network monitoring system 1 does not immediately output an alert just because a failure event has occurred in the network devices 30A to 30C. This is because the maintenance operation such as construction, for example, a failure that occurred temporarily due to a mistake in inserting a port or forgetting to set a blocking port, etc., asked for confirmation operation and eventually input of a failure and recovery report. This is because the work load of the network manager or the like increases, and there is a possibility that the countermeasures for failures that occur due to accidents or breakdowns may be neglected.

  Therefore, the network monitoring system 1 controls whether or not an alert is output after the mode is canceled depending on whether or not a failure detected in the network NW during the mode for restricting the alert output is resolved before the mode is canceled. To do. Thus, as one aspect, while alerts related to faults that occur due to accidents or breakdowns are output, alerts related to temporary faults that occur during mode due to maintenance work such as construction The output can be suppressed.

  As illustrated in FIG. 1, the network monitoring system 1 includes a network management device 10, network devices 30 </ b> A to 30 </ b> C, and a client terminal 50. Hereinafter, the network devices 30A to 30C may be collectively referred to as “network device 30”. Although FIG. 1 illustrates the case where the three network devices 30A, 30B, and 30C are accommodated in the network management device 10, the present invention is not limited to this. That is, the number of network devices accommodated by the network management device 10 may be arbitrary.

  The network management apparatus 10 is a computer that provides the network monitoring service.

  As an embodiment, the network management apparatus 10 can be implemented as an SDN (Software-Defined Networking) controller by installing package software and online software for realizing the network monitoring service on a desired computer. This network management device 10 executes management including monitoring, setting and control of Carrier Ethernet (registered trademark) such as IP-VPN (Internet Protocol Virtual Private Network) and wide area Ethernet (registered trademark) as an example of the network NW. can do. As described above, the network NW managed by the network management apparatus 10 is not limited to a physical network, and may be a virtual network virtualized by a technique such as SDN or NFV (Network Function Virtualization).

  The network device 30 is a device that constructs a network NW, and can employ, for example, a data transfer device such as a router or a switch, a firewall, a load balancer, and the like.

  The client terminal 50 is a computer that receives the above-described network monitoring service, and is used, for example, by a related person such as a network administrator who manages the network NW.

[Configuration of Network Management Device 10]
FIG. 2 is a block diagram illustrating a functional configuration of the network management apparatus 10 according to the first embodiment. As illustrated in FIG. 2, the network management apparatus 10 includes a communication I / F (interface) unit 11, a storage unit 13, and a control unit 15. The network management apparatus 10 may include various functional units included in known computers, for example, functional units such as various input devices and audio output devices, in addition to the functional units illustrated in FIG.

  The communication I / F unit 11 is an interface that performs communication control with other devices such as the network device 30 and the client terminal 50.

  As an embodiment, the communication I / F unit 11 can employ a network interface card such as a LAN card. For example, the communication I / F unit 11 transmits a command related to network settings to the network device 30 and receives a failure event from the network device 30. Further, the communication I / F unit 11 outputs an alert regarding a failure event occurring on the network NW to the client terminal 50 or accepts an alert confirmation operation from the client terminal 50.

  The storage unit 13 is a storage device that stores data used in various programs such as an OS (Operating System) executed by the control unit 15 and a network monitoring program that implements the network monitoring service.

  As an embodiment, the storage unit 13 can be implemented as an auxiliary storage device in the network management device 10. For example, the storage unit 13 can employ an HDD (Hard Disk Drive), an optical disk, an SSD (Solid State Drive), or the like. Note that the storage unit 13 does not necessarily have to be mounted as an auxiliary storage device, and can also be mounted as a main storage device in the network management device 10. In this case, various semiconductor memory elements, for example, RAM (Random Access Memory) and flash memory can be employed for the storage unit 13.

  The storage unit 13 stores schedule data 13a, stay mode data 13b, and event log data 13c as an example of data used in a program executed by the control unit 15. Thus, in addition to the schedule data 13a, the stay mode data 13b, and the event log data 13c shown in FIG. 2, other electronic data can be stored together.

  For example, in order to manage the topology of the network NW, the storage unit 13 can also store device data related to the network device 30, link data related to the link formed by the network device 30, and the like. In addition, the storage unit 13 stores user authority data in which a network device 30 or a group of network devices 30 that permit network settings for each user is defined in order to manage the authority of a user such as a network administrator. can do. In addition, the storage unit 13 compares the configuration files stored between the network management device 10 and each network device 30, for example, “running-config” and “startup-config”. In order to detect a setting change, a copy of the setting file stored in each network device 30 can be stored.

  Here, with respect to the description of the schedule data 13a, the stay mode data 13b, and the event log data 13c, the stage where the schedule data 13a, the stay mode data 13b, and the event log data 13c are referred to or registered is described. Will be described together.

  The control unit 15 has an internal memory for storing various programs and control data, and executes various processes using these.

  As an embodiment, the control unit 15 is implemented as a central processing unit, a so-called CPU (Central Processing Unit). Note that the control unit 15 is not necessarily implemented as a central processing unit, and may be implemented as an MPU (Micro Processing Unit). The control unit 15 can also be realized by a hard wired logic such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

  The control unit 15 expands a network monitoring program stored in the storage unit 13 on a work area of a RAM such as a DRAM (Dynamic Random Access Memory) or an SRAM (Static Random Access Memory) mounted as a main storage device (not shown). Thus, the following processing unit is virtually realized. For example, as shown in FIG. 2, the control unit 15 includes a mode control unit 15a, a failure detection unit 15b, an alert control unit 15c, and a confirmation receiving unit 15d.

  The mode control unit 15a is a processing unit that controls mode transition related to alert output. Here, as an example, a case is assumed in which transition is made between two modes of an “alert output mode” in which an alert output is not regulated and an “alert suppression mode” in which an alert output is regulated.

  As one embodiment, the mode control unit 15a selects one of two modes of “alert output mode” and “alert suppression mode” according to the schedule data 13a stored in the storage unit 13. In the schedule data 13a, as an example, a schedule for applying the alert suppression mode is defined. For example, the schedule data 13a can employ data including items such as the start date and time and the end date and time of the alert suppression mode. In addition to these items, the schedule data 13a can further include a network device 30 or a group of network devices 30 that perform maintenance such as construction as an alert restriction target. In addition, although the case where the period for applying the alert suppression mode is defined by the start date and time and the end date and time of the alert suppression mode is illustrated here, the time to continue the alert suppression mode starting from the start date and time and the start date and time of the alert suppression mode It may be defined by the length.

  That is, the mode control unit 15a acquires the system time as the current time from basic software such as an OS. Then, the mode control unit 15a determines whether or not the current time is within the application period of the alert suppression mode included in the schedule data 13a. For example, the mode control unit 15a determines whether or not the current time is after the start date / time of the alert suppression mode and the current time is before the end date / time of the alert suppression mode. At this time, when the current time is outside the application period of the alert suppression mode, the mode control unit 15a selects the “alert output mode” from the two modes of “alert output mode” and “alert suppression mode”. In this case, the mode control unit 15 a sets “alert output mode” in the stay mode data 13 b stored in the storage unit 13. Further, when the current time is within the application period of the alert suppression mode, the mode control unit 15a selects the “alert suppression mode” from the two modes of “alert output mode” and “alert suppression mode”. In this case, the mode control unit 15 a sets “alert suppression mode” in the stay mode data 13 b stored in the storage unit 13.

  Here, an example has been described in which the mode control unit 15a automatically sets the stay mode with reference to the schedule data 13a, but the stay mode setting method is not limited thereto. In addition to this, for example, when an instruction to shift to the alert suppression mode is received from the client terminal 50, the mode control unit 15 a sets the stay mode to “alert suppression mode” or the alert suppression mode from the client terminal 50. When the release instruction is accepted, the mode control unit 15a can set the stay mode to “alert output mode”. In this way, the start and end of the “alert suppression mode” may be instructed by a related person such as a network administrator.

  The failure detection unit 15b is a processing unit that detects a failure that occurs on the network NW.

  As an embodiment, the failure detection unit 15b detects a failure on the network NW by notifying the failure event from the network device 30 in which the failure has occurred. Here, a case where a loop is detected is illustrated as an example of a failure in which the output of the alert is performed. For example, the network device 30 periodically or regularly transmits monitoring frame data from each port of the network device 30. Thereafter, the network device 30 determines whether or not the monitoring frame data is received at any port of the network device 30 that has transmitted the monitoring frame data. As a result, when the monitoring frame data is received, the network device 30 detects the occurrence of a loop. In this case, the identification information of the network device 30 in which the occurrence of the loop is detected, the identification information of the port in which the occurrence of the loop is detected, and information such as the date and time when the occurrence of the loop is detected as a failure event from the network device 30 to the network management device 10. Be notified. Here, although a loop is illustrated as an example of failure detection, a failure related to other abnormal traffic, such as a broadcast storm or a multicast storm, may be detected by the network device 30.

  When the failure event is notified in this way, the failure detection unit 15b additionally registers the failure event notified from the network device 30 in the event log data 13c stored in the storage unit 13. For example, the event log data 13c may include data including items such as an event type, an event occurrence date, a device name, and an event content. For example, when a failure event is registered, “err (error)” is registered in the “event type” field, and the occurrence date and time of the failure event is registered in the “event occurrence date” field. . Further, the identification information of the network device 30 in which the failure event is detected is registered in the “device name” field, and the identification information of the port in which the failure event is detected is registered in the “event content” field. The

  Note that here, as an example, an example in which a failure event is registered as an event log has been described, but an event registered as event log data 13c is not limited to a failure event. In addition to this, when a resolution from a failure is detected and a confirmation operation is performed or when a network is set, the “event type” field is set to “info (information)” and recovery is performed. Events and setting events are registered.

  The alert control unit 15c is a processing unit that performs alert output control.

  As one embodiment, when a failure event is notified from the network device 30, the alert control unit 15 c has the stay mode stored as the stay mode data 13 b in the storage unit 13 being “alert output mode” or “alert suppression mode”. Depending on which one is set, an alert related to the failure event is output, or an alert output related to the failure event is suppressed. For example, when the stay mode is set to “alert output mode”, the alert control unit 15 c outputs an alert regarding the failure event to the client terminal 50. The failure event for which an alert is output in this way is stored and managed as a “failure event during alert output” by being saved in a work area of an internal memory (not shown). On the other hand, when the stay mode is set to “alert suppression mode”, the alert control unit 15c suppresses the output of the alert regarding the failure event. Thus, the failure event in which the output of the alert is suppressed is stored and managed as a “failure event during the suppression of the alert output” by being saved in the work area of the internal memory (not shown).

  In addition, the alert control unit 15c performs the following alert output control even when the stay mode data 13b stored in the storage unit 13 is changed, that is, when there is a transition between modes.

  For example, when the stay mode transitions from “alert output mode” to “alert suppression mode”, the alert control unit 15c refers to the work area of the internal memory and determines whether there is a failure event for which an alert is being output. Determine whether. At this time, if there is a failure event for which an alert is being output, the alert control unit 15c changes the alert relating to the failure event to a non-display state. This suppresses alert output. Thus, the failure event in which the output of the alert is suppressed is stored and managed as a “failure event during the suppression of the alert output” by being saved in the work area of the internal memory (not shown).

  Also, the alert control unit 15c refers to the work area of the internal memory when the stay mode transitions from the “alert suppression mode” to the “alert output mode”, in other words, a failure event whose output of the alert is being suppressed, in other words It is determined whether or not there is a failure event that has occurred before the stay mode transitions from the “alert suppression mode” to the “alert output mode”. At this time, if there is a failure event whose alert output is being suppressed, the alert control unit 15c selects one failure event from the failure events. Then, the alert control unit 15c determines whether or not the failure corresponding to the previously selected failure event has been resolved. For example, in the case of the occurrence of a loop, the alert control unit 15c detects whether or not the failure of the port where the occurrence of the loop is detected among the ports of the network device 30 where the occurrence of the loop is detected is detected by the failure detection unit 15b. Let At this time, when the failure corresponding to the failure event has been resolved, the alert control unit 15c further determines whether or not the occurrence date and time of the failure event is during the application period of the alert suppression mode.

  Here, when the failure corresponding to the failure event has been resolved and the occurrence date and time of the failure event is within the application period of the alert suppression mode, the following can be estimated. In other words, the occurrence of a loop was temporarily detected due to maintenance work such as construction, for example, a mistake in inserting a port or forgetting to set a blocking port, but the trouble disappeared as the maintenance work ended. It is highly probable that the failure was caused by maintenance work. In this case, the alert is not output even if the stay mode is changed from the “alert suppression mode” to the “alert output mode”.

  On the other hand, if the failure corresponding to the failure event has not been resolved, maintenance work such as construction work, for example, the port It is unlikely that a loop has been temporarily detected due to a mistake in insertion or forgetting to set a blocking port, etc., and it can be assumed that the fault is caused by an accident or failure. In this case, the alert control unit 15c changes the alert of the failure event to the output state as the stay mode transitions from the “alert suppression mode” to the “alert output mode”. As a result, an alert is output to the client terminal 50.

  Also, if the date and time of the failure event is earlier than the start time of alert suppression mode, it is clear that the cause of the failure is not in the maintenance work even if the failure corresponding to the failure event has been resolved. I know that there is. Also in this case, the alert control unit 15c changes the alert of the failure event to the output state as the stay mode transitions from the “alert suppression mode” to the “alert output mode”. As a result, an alert is output to the client terminal 50.

  The confirmation receiving unit 15d is a processing unit that receives a confirmation operation for an alert that is being output.

  As one embodiment, the confirmation accepting unit 15 d accepts a confirmation operation for an alert that is being output via a GUI displayed on the client terminal 50. When the confirmation operation is accepted in this way, the alert control unit 15c releases the alert on condition that the failure event of the alert has been eliminated. “Release” here refers to the end of alert output rather than temporarily adopting the non-output state as in the above-described suppression. In this case, the failure control unit 15c deletes the failure event from the “failure event during alert output” saved in the work area of the internal memory (not shown). Thereafter, the confirmation accepting unit 15 d additionally registers a recovery event corresponding to the failure event in the event log data 13 c stored in the storage unit 13. For example, “info” is registered in the “event type” field, and the date and time when the confirmation operation is performed is registered in the “event occurrence date” field. Further, identification information of the network device 30 recovered from the failure is registered in the “device name” field, and identification information of the port recovered from the failure is registered in the “event content” field. Here, the case where the alert is canceled when the confirmation operation is accepted is illustrated, but the alert may be canceled by further inputting a failure and recovery report as a trail.

[Example of alert and confirmation operation]
Next, an example of an alert output by the alert control unit 15c and a confirmation operation received by the confirmation receiving unit 15d will be described. 3, 4 and 6 are diagrams illustrating an example of the NW monitoring screen. These three screens shown in FIGS. 3, 4 and 6 are displayed on the client terminal 50 in the order of the NW monitoring screen 300, the NW monitoring screen 400, and the NW monitoring screen 600. That is, FIG. 3 shows an NW monitoring screen in a state where no failure has occurred in each network device 30 included in the network NW. FIG. 4 shows an NW monitoring screen on which an alert relating to the occurrence of a loop is output when the occurrence of the loop is detected in the network device 30 corresponding to the device name “C-2”. Further, FIG. 6 shows an NW monitoring screen after the loop occurrence recovery confirmation is performed by performing the loop occurrence confirmation operation detected by the network device 30 corresponding to the device name “C-2”. It is shown.

  As shown in FIG. 3, the NW monitoring screen 300 includes two display areas, a physical map display area 310 and an event list display area 320. Among these, the display area 310 displays a physical map in which the topology of the physical network related to the network NW is visualized in units of ports. On the physical map, together with icons corresponding to the external network, router, L3 switch, and L2 switch, identification information of the network device 30, for example, a device name set by a network administrator or the like is displayed below the icon. The display area 320 displays an event list in which events that occur on the network NW are listed. In this event list, events other than fault events are also listed. For convenience of explanation, fault events and recovery events related to alert display will be extracted and shown below.

  When an alert regarding the occurrence of a loop detected by the network device 30 corresponding to the device name “C-2” is output under the situation where the NW monitoring screen 300 shown in FIG. 3 is displayed, the screen display of the client terminal 50 is , Transition from the NW monitoring screen 300 to the NW monitoring screen 400. For example, as shown in the display area 410 of the physical map, the alert for the failure event is displayed in association with the display symbol of the port corresponding to the failure in the network device 30 in which the failure has occurred. That is, in the example of the display area 410 of the physical map, the port number “10” where the loop occurrence is detected among the ports of the network device 30 corresponding to the device name “C-2” where the loop occurrence is detected. A black circle alert 411 is displayed in association therewith. Here, as an example, the case where the alert is displayed as a black circle is illustrated as an example, but other display colors can be adopted, and the alert can be displayed in other shapes and sizes. For example, at least one of display color, shape, and size can be distinguished depending on the type of failure. Further, as shown in the event list display area 420, an alert is realized by adding a record corresponding to the failure event to the event list. That is, in the example of the event list display area 420, the event type “err”, the event occurrence date “August 27, 2015 1:46:26”, the device name “C-2”, and the event A record including the content “loop detection (port number“ 10 ”)” or the like, that is, a record in which hatching is performed in the figure is displayed as an alert.

  In the situation where the NW monitoring screen 400 shown in FIG. 4 is displayed, when an operation for a GUI (Graphical User Interface) of the alert 411 indicated by a black circle, for example, a mouse operation such as a click or a double click is accepted, A loop detection / recovery confirmation screen 500 shown in FIG. FIG. 5 is a diagram illustrating an example of a loop detection / recovery confirmation screen. The loop detection / recovery confirmation screen 500 shown in FIG. 5 is a screen for accepting a confirmation operation for a loop detection alert, and further, a report on a failure and recovery, and a record regarding the occurrence of a loop among failure event records being output as an alert. Is extracted and displayed in the list. In this loop detection / recovery confirmation screen 500, an input form, for example, a text box, capable of inputting a report on failure and recovery is called up by accepting a pressing operation of the memo input button 510. Furthermore, in the loop detection / recovery confirmation screen 500, when a selection operation of the loop recovery confirmation button 520, that is, a confirmation operation is accepted in a state where selection of any record among the records related to the occurrence of the loop is accepted, the selection is accepted. The alert related to the loop is canceled on the condition that the loop has been resolved. Here, as an example, the case where the loop detection / recovery confirmation screen is called through an operation on the alert 411 indicated by the black circle is illustrated, but the present invention is not limited to this. For example, the loop detection / recovery confirmation screen may be called through another GUI component such as a tab or pull-down menu provided on the NW monitoring screen 400. Further, the confirmation operation may be accepted via a screen other than the loop detection / recovery confirmation screen. When the close button 530 is pressed, the confirmation operation is not performed and the loop detection / recovery confirmation screen 500 is closed.

  When the alert is canceled in this way, the screen display of the client terminal 50 transitions from the NW monitoring screen 400 to the NW monitoring screen 600. That is, as shown in the display area 610 of the physical map shown in FIG. 6, as the loop occurrence alert for the port number “10” of the network device 30 with the device name “C-2” is canceled, The display of the black circle alert 411 displayed in the physical map display area 410 shown in FIG. In addition, as shown in the event list display area 620 shown in FIG. 6, the alert display can be canceled by adding a record corresponding to the recovery event that occurs along with the cancellation of the alert to the event list. That is, in the event list display area 620, the event type “info”, the event occurrence date “August 27, 2015 1:50:27”, the device name “C-2”, and the event name A record including the content “recovery confirmation of loop detection (port number“ 10 ”)” or the like, that is, a hatched record in the figure is displayed as an alert.

  By tightening the termination condition regarding the output of the alert in this way, it is possible to implement a careful response such as a pointing check, for example, for a serious failure that extends to the network stop, such as a loop.

  In the loop detection / recovery confirmation screen 500 illustrated in FIG. 5, the case where the above-described confirmation operation and, in turn, the input of the report regarding the failure and the recovery is illustrated, but other operations can be accepted. For example, at the stage of accepting a recovery operation for loop detection, the state of the port where the occurrence of the loop is detected is also checked. If the port is in the shutdown state, the alert regarding the loop can be canceled and the port can be set to be valid. That is, depending on the model of the network device 30, there is one that automatically closes (links down) the physical port where the occurrence of the loop is detected. FIG. 7 is a diagram illustrating an example of a loop detection / recovery confirmation screen. In the loop detection / recovery confirmation screen 700 shown in FIG. 7, compared to the loop detection / recovery confirmation screen 500 shown in FIG. 5, a record of a loop occurrence in which a port is autonomously shut down by the network device 30, An additional record is shown. That is, in the loop detection / recovery confirmation screen 700 shown in FIG. The “status” field included in the record “00n” indicates that the port has been shut down. In such a case, when a pressing operation of the loop recovery confirmation button 520 is accepted in a state where selection of the record in which the loop has occurred is accepted, the shutdown state of the port can be automatically released. In addition, a button for accepting the effective setting of the port that has been shut down can be provided on the loop detection / recovery confirmation screen 700, and the shutdown state of the port can be released in response to an operation on the button.

[Alert output control]
Next, alert output control by the alert control unit 15c will be described with reference to FIGS. Here, the overlap between the period in which the alert suppression mode is applied and the period in which a loop actually occurs is divided into four patterns 1 to 4, and transitions related to alert output are described for each of the four patterns.

(1) Pattern 1
FIG. 8A is a diagram illustrating an example of an overlapping pattern of the application period of the alert suppression mode and the loop generation period. In FIG. 8A, a band indicating the application period of the alert suppression mode in association with the time axis is indicated by white filling, and a band indicating the loop occurrence period is indicated by dot filling. In the example shown in FIG. 8A, a case is shown in which occurrence of a loop is detected during the application period of the alert suppression mode and the loop is eliminated. FIG. 8B is a diagram showing transition of alert display. In FIG. 8B, a loop is generated over the loop generation period shown in FIG. 8A at the port number “10” of the network device 30 with the device name “C-2” among the network devices 30 included in the physical map shown in FIG. Transition of alert display when doing is shown.

  As shown in FIG. 8A, no loop has occurred in the first place at the time t1 when the application of the alert suppression mode is started. Therefore, as shown in FIG. 8B, no alert is displayed on the symbol of the network device 30 with the device name “C-2”. Subsequently, application of the alert suppression mode is already started at time t2 when occurrence of a loop is detected at the port number “10” of the network device 30 with the device name “C-2”. In this case, as a result of the display of the alert being suppressed, the alert is not displayed as shown in FIG. 8B. Thereafter, the application of the alert suppression mode is not completed at the time point t3 when the cancellation of the loop is detected at the port number “10” of the network device 30 with the device name “C-2”. Therefore, as shown in FIG. 8B, no alert is displayed on the symbol of the network device 30 with the device name “C-2”. Thereafter, as shown in FIG. 8A, even at the time t4 when the application of the alert suppression mode ends, no alert is displayed on the symbol of the network device 30 with the device name “C-2” as shown in FIG. 8B.

  In this way, when the occurrence of a loop is detected during the period in which the alert suppression mode is applied and the loop is resolved, the occurrence of the loop was temporarily detected due to maintenance work such as construction. It is highly probable that the failure has been resolved with the completion of the work, and it can be estimated that the failure is caused by the maintenance work. In this case, no alert is displayed at any point in time from t1 to t4.

(2) Pattern 2
FIG. 9A is a diagram illustrating an example of an overlapping pattern of the application period of the alert suppression mode and the loop generation period. In FIG. 9A, a band indicating the application period of the alert suppression mode in association with the time axis is indicated by white filling, and a band indicating the loop occurrence period is indicated by dot filling. In the example shown in FIG. 9A, the alert suppression mode is applied after the occurrence of the loop is detected, and the loop is eliminated during the application of the alert suppression mode. Further, in the example shown in FIG. 9A, the loop detection / recovery confirmation screen 500 shown in FIG. 5 shows an arrow 910 indicating a period in which a record related to the occurrence of a loop is listed in the list, in association with the time axis, An arrow 920 indicating a period in which an alert is displayed in association with a symbol is shown in association with a time axis. FIG. 9B is a diagram showing transition of alert display. In FIG. 9B, a loop is generated over the loop generation period shown in FIG. 9A at the port number “10” of the network device 30 with the device name “C-2” among the network devices 30 included in the physical map shown in FIG. Transition of alert display when doing is shown.

  As shown in FIG. 9A, the alert suppression mode is not applied at the time point t1 when the occurrence of the loop is detected. Therefore, as shown in FIG. 9B, a black circle alert is displayed in association with the display symbol of the port number “10” of the network device 30 with the device name “C-2”. Thereafter, at the time t2 when the application of the alert suppression mode is started, the output of the alert is suppressed. As a result, the alert is hidden as shown in FIG. 9B. Subsequently, the application of the alert suppression mode is not completed at the time point t3 when the cancellation of the loop is detected at the port number “10” of the network device 30 with the device name “C-2”. For this reason, as shown in FIG. 9B, no alert is displayed on the symbol of the network device 30 with the device name “C-2”. Thereafter, as shown in FIG. 9A, at the time t4 when the application of the alert suppression mode is finished, as shown in FIG. 9B, an alert is displayed in association with the display symbol of the network device 30 with the device name “C-2”. The Even if the loop has been eliminated, it is clear that the cause of the failure is not the maintenance work, so an alert is displayed again. Subsequently, the alert display is terminated only at time t5 when a confirmation operation for the record relating to the occurrence of the loop is accepted on the loop detection / recovery confirmation screen.

  As described above, when the alert suppression mode is applied after the occurrence of the loop is detected and the loop is resolved during the application period of the alert suppression mode, it is clear that the cause of the failure is not the maintenance work. . Therefore, if it is outside the application period of the alert suppression mode, the alert is displayed until a confirmation operation is accepted.

(3) Pattern 3
FIG. 10A is a diagram illustrating an example of an overlapping pattern of the application period of the alert suppression mode and the loop generation period. In FIG. 10A, a band indicating the application period of the alert suppression mode in association with the time axis is indicated by white filling, and a band indicating the loop occurrence period is indicated by dot filling. In the example shown in FIG. 10A, a case is shown in which the occurrence of a loop is detected after the application of the alert suppression mode is started, and the loop is canceled after the application of the alert suppression mode is ended. Further, in the example shown in FIG. 10A, the loop detection / recovery confirmation screen 500 shown in FIG. 5 shows an arrow 1010 indicating a period in which a record related to the occurrence of a loop is listed in the list in association with the time axis, and displays the port An arrow 1020 indicating a period in which an alert is displayed in association with a symbol is shown in association with a time axis. FIG. 10B is a diagram showing transition of alert display. In FIG. 10B, a loop occurs over the loop generation period shown in FIG. 10A at the port number “10” of the network device 30 with the device name “C-2” among the network devices 30 included in the physical map shown in FIG. Transition of alert display when doing is shown.

  As shown in FIG. 10A, at the time t1 when the application of the alert suppression mode is started, no loop has occurred in the first place. Therefore, as shown in FIG. 10B, no alert is displayed on the symbol of the network device 30 with the device name “C-2”. Subsequently, application of the alert suppression mode is already started at time t2 when occurrence of a loop is detected at the port number “10” of the network device 30 with the device name “C-2”. In this case, as a result of the display of the alert being suppressed, the alert is not displayed as shown in FIG. 10B. Thereafter, as shown in FIG. 10A, at the time t3 when the application of the alert suppression mode is terminated, the loop is not solved. Therefore, as shown in FIG. 10B, the alert is displayed in association with the display symbol of the network device 30 with the device name “C-2”. Furthermore, the confirmation operation is not performed at the time point t4 when the cancellation of the loop is detected at the port number “10” of the network device 30 with the device name “C-2”. Therefore, as shown in FIG. 10B, the display of the alert is maintained in association with the display symbol of the network device 30 with the device name “C-2”. Thereafter, the alert display is terminated only at time t5 when a confirmation operation for the record relating to the occurrence of the loop is accepted on the loop detection / recovery confirmation screen.

  In this way, when the occurrence of a loop is detected after the application of the alert suppression mode is started, and the loop is resolved after the application of the alert suppression mode is terminated, the application of the alert suppression mode is terminated. Since the loop has not been eliminated, it is clear that the cause of the failure is not in the maintenance work. Therefore, after the application of the alert suppression mode is terminated, the alert is displayed until a confirmation operation is accepted.

(4) Pattern 4
FIG. 11A is a diagram illustrating an example of an overlapping pattern of the application period of the alert suppression mode and the loop generation period. In FIG. 11A, a band indicating the application period of the alert suppression mode in association with the time axis is indicated by white filling, and a band indicating the loop occurrence period is indicated by dot filling. In the example illustrated in FIG. 11A, the case where the application of the alert suppression mode is started and the application of the alert suppression mode is ended during a period in which a loop is occurring is illustrated. Further, in the example shown in FIG. 11A, the loop detection / recovery confirmation screen 500 shown in FIG. An arrow 1120 indicating a period in which an alert is displayed in association with a symbol is shown in association with a time axis. FIG. 11B is a diagram showing transition of alert display. In FIG. 11B, a loop is generated over the loop generation period shown in FIG. 11A at the port number “10” of the network device 30 with the device name “C-2” among the network devices 30 included in the physical map shown in FIG. Transition of alert display when doing is shown.

  As shown in FIG. 11A, the alert suppression mode is not applied at the time point t1 when the occurrence of the loop is detected. Therefore, as shown in FIG. 11B, a black circle alert is displayed in association with the display symbol of the port number “10” of the network device 30 having the device name “C-2”. Thereafter, at the time t2 when the application of the alert suppression mode is started, the output of the alert is suppressed. As a result, the alert is hidden as shown in FIG. 11B. Thereafter, as shown in FIG. 11A, at the time t3 when the application of the alert suppression mode is finished, the loop is not solved. Therefore, as shown in FIG. 11B, the alert that was not displayed is displayed again in association with the display symbol of the network device 30 with the device name “C-2”. Furthermore, the confirmation operation is not performed at the time point t4 when the cancellation of the loop is detected at the port number “10” of the network device 30 with the device name “C-2”. Therefore, as shown in FIG. 11B, the display of the alert is maintained in association with the display symbol of the network device 30 with the device name “C-2”. Thereafter, the alert display is terminated only at time t5 when a confirmation operation for the record relating to the occurrence of the loop is accepted on the loop detection / recovery confirmation screen.

  In this way, when the application of the alert suppression mode is started and the application of the alert suppression mode is terminated during the period when the loop is occurring, the loop has occurred before the alert suppression mode is applied. So it is clear that the cause of failure is not in the maintenance work. Therefore, the alert is displayed until the confirmation operation is accepted except during the period in which the alert suppression mode is applied.

[Process flow]
Next, a processing flow of the network management apparatus 10 according to the present embodiment will be described. Here, (1) first monitoring process, (2) second monitoring process, and (3) third monitoring process executed by the network management apparatus 10 will be described in this order.

(1) First Monitoring Processing FIG. 12 is a flowchart illustrating a procedure of first monitoring processing according to the first embodiment. This process is repeatedly executed as long as the network monitoring program operates on the network management device 10.

  As illustrated in FIG. 12, the failure detection unit 15b monitors a failure on the network NW by waiting for notification of a failure event from the network device 30 (step S101). At this time, when a failure event is notified from the network device 30 (Yes in step S102), the alert control unit 15c indicates that the stay mode stored as the stay mode data 13b in the storage unit 13 is “alert output mode” or “alert suppression”. It is determined which mode is set (step S103).

  At this time, when the stay mode is set to “alert output mode” (No in step S103), the alert control unit 15c displays an alert regarding the failure event on the physical map of the NW monitoring screen displayed on the client terminal 50. Together with (step S104). A record corresponding to the failure event is added and displayed on the event list of the NW monitoring screen displayed on the client terminal 50 (step S105), and the process proceeds to step S101.

  In addition, when the failure event from the network device 30 is not notified (No at Step S102), or when the stay mode is set to “alert suppression mode” (Step S103 Yes), the processing of Step S104 and Step S105 is not executed. The process proceeds to step S101.

(2) Second Monitoring Process FIG. 13 is a flowchart illustrating the procedure of the second monitoring process according to the first embodiment. This process is executed when the stay mode transitions from the “alert output mode” to the “alert suppression mode”.

  As shown in FIG. 13, when the stay mode transitions from the “alert output mode” to the “alert suppression mode” (step S201), the alert control unit 15c refers to the work area of the internal memory, and an alert is being output. It is determined whether or not a certain failure event exists (step S202).

  At this time, when there is a failure event in which an alert is being output (Yes in step S202), the alert control unit 15c suppresses the output of the alert by changing the alert related to the failure event to a non-display state (step S203). The process is terminated.

  On the other hand, when there is no failure event for which an alert is being output (No in step S202), the alert control unit 15c ends the process as it is without executing the process in step S203.

(3) Third Monitoring Process FIG. 14 is a flowchart illustrating the procedure of the third monitoring process according to the first embodiment. This process is executed when the stay mode transitions from the “alert suppression mode” to the “alert output mode”.

  As shown in FIG. 14, when the stay mode transitions from the “alert suppression mode” to the “alert output mode” (step S301), the alert control unit 15c refers to the work area of the internal memory and suppresses the output of the alert. It is determined whether or not there is a fault event that has occurred before the transition of the stay mode from “alert suppression mode” to “alert output mode” (step S302).

  At this time, if there is a failure event for which the alert output is being suppressed (Yes in step S302), the alert control unit 15c selects one failure event from the failure events (step S303).

  Then, the alert control unit 15c determines whether or not the failure corresponding to the failure event selected in step S303 has been resolved (step S304). At this time, when the failure corresponding to the failure event has been resolved (step S304 Yes), the alert control unit 15c further determines whether or not the occurrence date and time of the failure event is in the application period of the alert suppression mode ( Step S305).

  Here, when the failure corresponding to the failure event has been resolved (step S304 Yes) and the occurrence date and time of the failure event is in the application period of the alert suppression mode (step S305 Yes), the following can be estimated. In other words, the occurrence of a loop was temporarily detected due to maintenance work such as construction, but it was highly likely that the failure was resolved as the maintenance work was completed, and the trouble caused by the maintenance work Can be estimated. In this case, just because the stay mode is changed from the “alert suppression mode” to the “alert output mode”, the process proceeds to step S307 without outputting an alert regarding the failure event.

  On the other hand, if the failure corresponding to the failure event has not been resolved (No in step S304), in addition to the fact that the countermeasures against the loop such as reinsertion of the cable and setting of the blocking point have not been completed, the maintenance work such as construction For example, it is unlikely that the occurrence of a loop is temporarily detected due to a mistake in inserting a port or forgetting to set a blocking port, and it can be estimated that the fault is caused by an accident or failure. In this case, the alert control unit 15c changes the alert of the failure event to the output state as the stay mode transitions from the “alert suppression mode” to the “alert output mode”, thereby sending an alert regarding the failure event to the client. It outputs to the terminal 50 (step S306).

  In addition, when the occurrence date and time of the failure event is earlier than the start time of the alert suppression mode (No in step S305), even if the failure corresponding to the failure event has been eliminated, the cause of the failure is not in the maintenance work. It turns out that it is clear. Also in this case, the alert control unit 15c changes the alert of the failure event to the output state as the stay mode changes from the “alert suppression mode” to the “alert output mode”, thereby alerting the failure event. Is output to the client terminal 50 (step S306).

  Thereafter, the processes corresponding to steps S303 to S306 are repeatedly executed until all the failure events whose output of the alert is being suppressed are selected (No in step S307). If all failure events whose alert output is being suppressed are selected (Yes in step S307), the process ends.

[One aspect of effect]
As described above, the network management apparatus 10 according to the present embodiment cancels the alert mode depending on whether or not the failure detected in the network NW during the mode for restricting the output of the alert is resolved before the mode is canceled. Controls whether to output later. Thus, as one aspect, while alerts related to faults that occur due to accidents or breakdowns are output, alerts related to temporary faults that occur during mode due to maintenance work such as construction The output can be suppressed. Therefore, according to the network management apparatus 10 according to the present embodiment, it is possible to suppress unnecessary alerts from being output.

  Although the embodiments related to the disclosed apparatus have been described above, the present invention may be implemented in various different forms other than the above-described embodiments. Therefore, another embodiment included in the present invention will be described below.

[Alert output format]
In the first embodiment, the case where an alert corresponding to a failure event is displayed has been illustrated, but the output form of the alert is not limited to display. For example, the network management apparatus 10 can output an alert by outputting an alert message corresponding to the failure event as a voice.

[Distribution and integration]
In addition, each component of each illustrated apparatus does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. For example, the mode control unit 15a, the failure detection unit 15b, the alert control unit 15c, or the confirmation reception unit 15d may be connected as an external device of the network management device 10 via a network. In addition, the functions of the network management device 10 described above are realized by having different devices each having the mode control unit 15a, the failure detection unit 15b, the alert control unit 15c, or the confirmation receiving unit 15d and being connected to each other through a network. You may make it do.

[Monitoring program]
The various processes described in the above embodiments can be realized by executing a prepared program on a computer such as a personal computer or a workstation. In the following, an example of a computer that executes a monitoring program having the same function as that of the above embodiment will be described with reference to FIG.

  FIG. 15 is a diagram illustrating a hardware configuration example of a computer that executes the monitoring program according to the first embodiment and the second embodiment. As illustrated in FIG. 15, the computer 100 includes an operation unit 110 a, a speaker 110 b, a camera 110 c, a display 120, and a communication unit 130. Further, the computer 100 includes a CPU 150, a ROM 160, an HDD 170, and a RAM 180. These units 110 to 180 are connected via a bus 140.

  As shown in FIG. 15, the HDD 170 stores a monitoring program 170a that exhibits the same functions as the mode control unit 15a, the failure detection unit 15b, the alert control unit 15c, and the confirmation reception unit 15d described in the first embodiment. Is done. This monitoring program 170a may be integrated or separated as with the constituent elements of the mode control unit 15a, the failure detection unit 15b, the alert control unit 15c, and the confirmation receiving unit 15d shown in FIG. That is, the HDD 170 does not necessarily have to store all the data shown in the first embodiment, and data used for processing may be stored in the HDD 170.

  Under such an environment, the CPU 150 reads the monitoring program 170 a from the HDD 170 and expands it in the RAM 180. As a result, the monitoring program 170a functions as a monitoring process 180a as shown in FIG. The monitoring process 180a expands various data read from the HDD 170 in an area allocated to the monitoring process 180a in the storage area of the RAM 180, and executes various processes using the expanded various data. For example, as an example of processing executed by the monitoring process 180a, the processing shown in FIGS. Note that the CPU 150 does not necessarily operate all the processing units described in the first embodiment, and the processing unit corresponding to the process to be executed may be virtually realized.

  Note that the monitoring program 170a does not necessarily have to be stored in the HDD 170 or the ROM 160 from the beginning. For example, each program is stored in a “portable physical medium” such as a flexible disk inserted into the computer 100, so-called FD, CD-ROM, DVD disk, magneto-optical disk, or IC card. Then, the computer 100 may acquire and execute each program from these portable physical media. In addition, each program is stored in another computer or server device connected to the computer 100 via a public line, the Internet, a LAN, a WAN, etc., and the computer 100 acquires and executes each program from these. It may be.

DESCRIPTION OF SYMBOLS 1 Network monitoring system 10 Network management apparatus 11 Communication I / F part 13 Memory | storage part 13a Schedule data 13b Stay mode data 13c Event log data 15 Control part 15a Mode control part 15b Failure detection part 15c Alert control part 15d Confirmation reception part 30A, 30B , 30C Network equipment

Claims (12)

In the monitoring device that displays on the display unit an alert that can be terminated according to the confirmation operation in response to detection of the occurrence of a failure related to the communication device in the monitored system.
Even if the occurrence of a specific failure relating to a communication device in the monitored system is detected, if an instruction to shift to a mode for restricting the alert from being displayed is received, the occurrence is detected during the transition to the mode. Display of the specific failure can be terminated in accordance with the confirmation operation depending on whether the occurrence of the specific failure has been resolved or the failure has not been resolved before returning from the mode. A control unit for controlling whether to display an alert after returning from the mode;
A monitoring device comprising:   The monitoring device according to claim 1, wherein the alert is a communication device in which a failure has occurred, and is displayed on the display unit in association with a display symbol of a port corresponding to the failure.   3. The alert according to claim 2, wherein the alert is displayed on the display unit in association with a display symbol of a port corresponding to a loop failure of data communicated in the monitored system. Monitoring device.   The monitoring apparatus according to claim 1, wherein the confirmation operation is a click operation on the alert displayed on the display unit. In a monitoring method used for a monitoring device that displays an alert that can be terminated in response to a confirmation operation on a display unit in response to detection of the occurrence of a failure related to a communication device in a monitored system,
Even if the occurrence of a specific failure relating to a communication device in the monitored system is detected, if an instruction to shift to a mode for restricting the alert from being displayed is received, the occurrence is detected during the transition to the mode. Display of the specific failure can be terminated in accordance with the confirmation operation depending on whether the occurrence of the specific failure has been resolved or the failure has not been resolved before returning from the mode. A process for controlling whether to display an alert after returning from the mode;
Is executed by a monitoring device.   The monitoring method according to claim 5, wherein the alert is a communication device in which a failure has occurred, and is displayed on the display unit in association with a display symbol of a port corresponding to the failure.   7. The alert according to claim 6, wherein the alert is displayed on the display unit in association with a display symbol of a port corresponding to a loop failure of data communicated in the monitored system. Monitoring method.   The monitoring method according to claim 5, wherein the confirmation operation is a click operation on the alert displayed on the display unit. In the monitoring program used for the monitoring device that displays an alert that can be terminated according to the confirmation operation on the display unit in response to the detection of the occurrence of the failure related to the communication device in the monitored system,
Even if the occurrence of a specific failure relating to a communication device in the monitored system is detected, if an instruction to shift to a mode for restricting the alert from being displayed is received, the occurrence is detected during the transition to the mode. Display of the specific failure can be terminated in accordance with the confirmation operation depending on whether the occurrence of the specific failure has been resolved or the failure has not been resolved before returning from the mode. A process for controlling whether to display an alert after returning from the mode;
A monitoring program for causing a monitoring device to execute.   The monitoring program according to claim 9, wherein the alert is a communication device in which a failure has occurred, and is displayed on the display unit in association with a display symbol of a port corresponding to the failure.   11. The alert according to claim 10, wherein the alert is displayed on the display unit in association with a display symbol of a port corresponding to a loop failure of data communicated in the monitored system. Monitoring program.   The monitoring program according to claim 9, wherein the confirmation operation is a click operation on the alert displayed on the display unit.

Images