KR100543767B1 - Realtime Monitoring Agent and method for monitoring using thereof - Google Patents

Abstract

The present invention relates to a real-time monitoring agent, and more particularly, to a real-time monitoring agent and a monitoring method using the same, which can notify the administrator of the traffic measurement results for each protocol occurring in the sub-network and the connectivity check result of each host in the sub-network. . Such a real-time monitoring agent of the present invention, a traffic monitoring module for measuring the traffic per protocol of the sub-network, and bundles the measured traffic result into a single structure and transmits it to the manager, a traffic monitoring start message from the manager, and traffic A crash receiving unit that separates a monitoring end message and a connection check request message, an I / O completion port for receiving a traffic monitoring start message, a traffic monitoring end message, and a connection check request message from the manager and transmitting the received traffic monitoring end message and the connection checking request message to the crash application unit. IOCP) includes a server frame unit and a connectivity check module for measuring connectivity of a target Internet protocol using an Internet Control Management Protocol (ICMP) when receiving a connectivity check transmission request message from the administrator. Configuration do.

live monitoring

Description

Real-time monitoring agent and method for monitoring using

1 is a view for explaining a real-time monitoring agent according to the present invention

FIG. 2 is a diagram for explaining a message format in the real-time monitoring agent shown in FIG.

3 is a diagram illustrating a traffic monitoring module inside a real-time monitoring agent according to the present invention.

4 is a diagram illustrating a connection check module inside a real-time monitoring agent according to the present invention.

* Description of the symbols for the main parts of the drawings *

10: real-time monitoring interface unit 11: interval / update thread unit

12: traffic monitoring receiving thread unit 13: connectivity check receiving thread unit

14,15,16: Circular queue 20: Real time monitoring agent

30: traffic monitoring module 42: connectivity check module

50: Clashing unit

60: I / O completion port server server frame portion

The present invention relates to a real-time monitoring agent, and more particularly, to a real-time monitoring agent and a monitoring method using the same, which can notify the administrator of the traffic measurement results for each protocol occurring in the sub-network and the connectivity check result of each host in the sub-network. .

Today's networks are rapidly growing in volume and scale over a short period of time.

In this network environment, the expansion of physical bandwidth cannot meet the user's demand. Therefore, it is necessary to guarantee the service quality through the management of network resources.

Currently, many companies are conducting research on network management, and as a result, various network management systems have occurred.

In general, the Simple Network Management Protocol (SNMP) is used to manage the Internet / Intranet. The MIB (Management Information Base) installed in the Simple Network Management Protocol (SNMP) device is a vendor ( Because it varies from vendor to vendor, it has been unreasonable to use in heterogeneous networks consisting of various devices.

In order to solve this problem, an agent function that delivers the information required by the administrator in each subnet (LAN segment) unit is required.

The existing traffic monitoring agent function simply performs a traffic monitoring function at the request of an administrator.

It is necessary to proactively provide the management information necessary for the management of the network as well as the monitoring function by expanding this and various researches are in progress.

The present invention is to solve the problems of the prior art, it is to provide an agent (Agent) function that notifies the administrator of the traffic measurement results for each protocol occurring in the sub-network and the check result of the connectivity of each host in the sub-network. An object of the present invention is to provide a real-time monitoring agent and a monitoring method using the same.

The real-time monitoring agent of the present invention for achieving the above object is a traffic monitoring module for measuring traffic per protocol of the sub-network, bundles the measured traffic result into a single structure and transmits it to the manager, and traffic monitoring from the manager. Receives the traffic monitoring end message and the traffic monitoring end message and the connection check request message, the traffic monitoring start message from the administrator, the traffic monitoring end message and the connection check request message received and sent to the crash application unit When the I / O completion server (IOCP) server frame unit and a connectivity check transmission request message are received from the administrator, the connectivity of the target Internet protocol is measured using the Internet Control Management Protocol (ICMP). Connectivity check It consists of modules.

Preferably, between the real-time monitoring agent and the manager, each time a message transmitted from the real-time monitoring agent is received by a traffic monitoring receiving thread (Recv Thread) and the traffic monitoring receiving thread (Recv Thread) An interval check / update thread that lists received messages at regular time intervals and transmits them to the manager, and a connectivity check receiving thread that reads and transmits values of the message measuring the connectivity of the connectivity check module to the manager. The real-time monitoring interface unit is configured to include.

Preferably the real-time monitoring agent is implemented on a Windows platform and built on a domain name system server in a subnet.

In the monitoring method using the real-time monitoring agent of the present invention for achieving the above object, when the message is transmitted from the manager side to the real-time monitoring agent, the real-time monitoring agent receives the traffic monitoring transmission start request message according to the message type. Occation,

Measuring traffic per service (HTTP, FTP, SMTP, TELNET, Total service) in the real-time monitoring agent, and loading the traffic result for each service in the serialization traffic monitoring transmission message structure and including the result. And sending a traffic monitoring transmission message structure to the manager, and when receiving a connectivity check transmission request message, using a connectivity check module mapped to an internet control management protocol. And measuring the connectivity, and mounting the measured internet protocol connectivity measurement value in the connectivity check transmission response structure and transmitting it to the administrator side.

Preferably, the traffic for each service comprises a packet capture library for measuring the traffic as an object, and configures an instance for each service (HTTP, FTP, SMTP, TELNET, Total service). The object instance per service is composed of threads and measured by parallel processing.

Hereinafter, a real time monitoring agent and a monitoring method using the same will be described with reference to the accompanying drawings.

The real-time monitoring agent (hereinafter, abbreviated as RMAgent) according to the present invention is required for management by one LAN segment (in the concept of TINA) in units of one LAN segment in the intranet. Provide information.

In addition, based on the Telecommunication Management Network (TMN) of the International Telecommunications Union-Telecommunication Standardization Sector (ITU-T), traffic measurement for each protocol occurring in a sub-network using the TINA management system proposed by the TINA-C (Telecommunications Information Networking Architecture Consortium) It provides an agent function that notifies the administrator of the result and the result of checking the connectivity of each host in the subnetwork.

1 is a view for explaining a real-time monitoring agent according to the present invention.

The overall structure of the RMAgent according to the present invention may be divided into a RMAgent 20 as a server and a real-time monitoring interface unit (hereinafter, referred to as RMInterface) 10 as a client.

Here, the RMAgent 20 operates as one process, and the RMInterface 10 may be referred to as a library mounted on another program as an interface for communicating with the RMAgent 20.

In FIG. 1, GetResultTM is Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP), and SMTP (Simple) in the Transmission Control Protocol / Internet Protocol (TCP / IP) measured by the Traffic Monitoring Module 30. GetResultCC is a function that reads the number of packets for Total Service (Mail Transfer Protocol), Telnet, etc. as a result value, and GetResultCC is the response time measured by the Connectivity Check Module 42 for the corresponding IP. Returns a value as a result.

When the interval / update thread 11 of the RMInterface 10 receives a message received by the TM Recv Thread 12 into the circular queue (! 4), It is necessary to list them at regular time intervals, and this is called an update thread, and after each interval time, the values of the messages are read from the lower circular queue 14 and the parent is read. It serves to deliver to the circular cue 15 of.

The receiving thread unit 12 serves to store the message sent from the RMAgent 20 in the circular queue 14 whenever it is received.

The Connectivity Check Recv Thread (CC) 13 also plays a role similar to the TM Recv Thread 12 and receives a message for connectivity check from the RMInterface 10. The connectivity check module (CC) module 42 of the RMAgent 20 reads the values of the messages measuring the connectivity of the target IP using the Internet Control Management Protocol (ICMP), and then uses the upper circular queue (16). To pass).

That is, the circular queues 14, 15, and 16 each act as a buffer.

In addition, the traffic monitoring module 30 in the RMAgent 20 includes a hypertext transfer protocol (HTTP), a file transfer protocol (FTP), a simple postal transfer protocol (SMTP), telnet (TELNET), and a total of the serialization 32. It is individually instantiated in Transmission Control Protocol / Internet Protocol (TCP / IP) such as Total service, and measures the traffic of HTTP, FTP, SMTP, Telnet and total services, and sends them through Send Thread (31). As part of the transmission to the RMInterface (10), since the traffic measurement of the service is performed separately for each HTTP, FTP, SMTP, TELNET, and total service, the serialization 32 uses a single unit suitable for actual use. It binds to a structure.

The Input Output Completion Port (IOCP) Server Frame 60 is a type of asynchronous socket programming selected for stable server implementation and serves as a receiver.

The classifying unit 50 starts the traffic monitoring of received messages transmitted from the input output completion port (IOCP) server frame 60 to operate the RMAgent 20, and monitors the traffic. It consists of three types of end and connection check requests, and it is the part that performs the function operation for each message by classifying them.

Finally, when the connectivity check module 42 of the RMAgent 20 receives the connectivity check transmission request message from the RMInterface 10, the connectivity check module 42 uses the Internet Control Management Protocol (ICMP). Measure connectivity).

Here, the communication between the RMInterface 10 and the RMAgent 20 is preferably connected by Transmission Control Protocol (TCP) using a socket, and an example of a message format for command delivery is shown in FIG. 2.

The RMAgent 20 is largely composed of a traffic monitoring module 30 and a connectivity check module 42.

First, the basic function of the real-time monitoring agent 20 according to the present invention includes a traffic monitoring function, a connectivity check function, and a reporting function following the connectivity check.

In the present invention, some functions that take a lot of load among the manager's functions are sent down to the lower agent to perform some simple functions in the agent and only when an event occurs. Send it to the manager.

First of all, the traffic monitoring function monitors the distribution of traffic by major Internet services, including File Transfer Protocol (FTP), Telnet, Simple Mail Transfer Protocol (SMTP), Hypertext Transfer Protocol (HTTP), There is a service total traffic monitoring function.

In addition, there is a connectivity check function between different sub-networks, and a result of polling to the RMInterface 10 after a connectivity check.

The implementation environment of the RMAgent 20 is based on the window platform.

The Berkley Packet Filter (BPF), currently ported to the window platform, has some extended features not available in the UNIX version.

Among them, there is a static mode.

The static mode is a mode that provides only the packet counted result for the Internet service specified by the filter, not the packet.

The advantage of using this is that it does not function to inspect every packet individually and reduces the monitoring load.

Currently, this feature is not provided in the UNIX version, so this function is implemented in the Microsoft Windows Platform.

In addition, it is assumed that the place where the RMAgent 20 is installed is a domain name system (DNS) in each subnet (one LAN segment).

3 is a view for explaining a traffic monitoring module inside the real-time monitoring agent according to the present invention.

The operation procedure between the RMAgent 20 and the RMInterface 10 for traffic monitoring using the real-time monitoring agent according to the present invention will be described with reference to FIGS. 1 and 3. First, startTM (traffic monitoring) through the RMInterface 10. ) Function.

Next, a TM (Traffic Monitoring) Sending Strat request message is transmitted to the RMAgent 20.

The RMAgent 20 receives a TM transmission start request message and configures a packet capture library as an object to measure traffic for each service (HTTP, FTP, SMTP, TELNET, Total service). Create star (HTTP, FTP, SMTP, TELNET, Total service) instance, and object instance per service is composed of threads to measure traffic by each service through parallel processing.

The measured traffic result of each service is then loaded into the TM transmission message structure as shown in Table 1 through serialization 32.

Subsequently, the TM transmission message structure containing the serialized result is transmitted to the requesting RMInterface 10 side.

In the above procedure, Table 1 shows a data start configured to start and stop traffic monitoring and to transmit measured traffic results to the RMInterface 10.

4 is a view for explaining a connection check module inside the real-time monitoring agent according to the present invention.

In the Intranet, administrators need to check the status of servers providing some important services, so if they can provide the connectivity and accompanying information of the server of interest, The administrator can manage the network more effectively.

Therefore, as one of the functions of the RMAgent 20, a connection check request is received for a main server in an intranet designated by an administrator, and an echo request / response of the ICMP (Internet Control Message Protocol) is received. By using this function, the connectivity to the managed server can be checked.

In addition, because the delay information can be provided, it can provide an opportunity to take corrective action for the management action using the time information.

The procedure for the actual connectivity check is as follows.

first. Call Ping (destination IP) through RMInterface (10).

The RMInterface 10 transmits, for example, a connectivity check transmission request message to the RMAgent 20.

The RMAgent 20 receiving the message measures whether the target IP is connected by using a connectivity check module 42 that maps an ICMP (Internet Control Management Protocol).

Then, the measured IP connectivity status measurement value is loaded in the CC transmission response structure <Table 2>.

The loaded CC transmission response structure is then sent to the requesting RMInterface 10 side.

At this time, the ping module 80 and the send thread 70 are used.

In the real-time monitoring agent according to the present invention has the following effects.

First, based on the Telecommunication Management Network (TMN) of the International Telecommunications Union-Telecommunication Standardization Sector (ITU-T), traffic for each protocol that occurs in a sub-network using the TINA management scheme proposed by the TINA-C (Telecommunications Information Networking Architecture Consortium) The administrator can be notified of the result of the measurement and the result of checking the connectivity of each host in the subnetwork.                     

Second, it deals with the function of the agent that delivers the necessary information to the administrator in the subnetwork (LAN segment) unit of the Internet / Intranet. By reducing the manager's load on tasks such as polling, the overall network traffic and load can be reduced.

Claims (5)

A traffic monitoring module for measuring traffic per protocol of the sub-network, and combining the measured traffic results into a single structure and transmitting the same to a manager; A crashing unit for distinguishing a traffic monitoring start message from the manager, a traffic monitoring end message, and a connection check request message; An input / output completion port (IOCP) server frame unit configured to receive a traffic monitoring start message, a traffic monitoring end message, and a connection check request message from the manager and transmit the received traffic monitoring end message and a connection check request message to the crash-ciphering unit; A connectivity check module configured to receive a connectivity check transmission request message from the administrator and measure connectivity of a target Internet protocol using an Internet Control Management Protocol (ICMP); A real-time monitoring agent, implemented on the Windows platform and built on a domain name system server in a subnet. The method of claim 1, wherein between the real-time monitoring agent and the manager, Each time a message sent from the real-time monitoring agent is received, a traffic monitoring reception thread (Recv Thread) transmitted to a higher level and a message received by the traffic monitoring reception thread (Recv Thread) are listed at a predetermined time interval. And a real time monitoring interface configured to include an interval / update thread for transmitting to the manager and a connectivity check receiving thread for reading the values of the message measuring the connectivity of the connectivity check module and transmitting the value to the manager. Real-time monitoring agent. delete When the message is sent from the manager to the real-time monitoring agent, the real-time monitoring agent according to the message type, If you receive a request to start sending traffic monitoring, Real-time monitoring agent configures packet capture library as an object to measure traffic, and creates an instance for each service (HTTP, FTP, SMTP, TELNET, Total service). Measuring traffic by parallel processing comprising threads; And embedding the traffic result for each service in a serialization traffic monitoring transmission message structure and transmitting a traffic monitoring transmission message structure containing the result to the manager. If you receive a Connectivity Check transfer request message, Measuring connectivity of a target Internet protocol using a connectivity check module mapped with an internet control management protocol, and mounting the measured internet protocol connectivity measurement value in a connectivity check transmission response structure and transmitting the same to the administrator; Monitoring method using a real-time monitoring agent, characterized in that made. delete

Images