KR102181625B1 - Real time monitoring system and method for multi cloud - Google Patents

Abstract

Disclosed are a multi-cloud real-time monitoring system and a method thereof. According to one aspect of the present invention, the multi-cloud real-time monitoring system comprises: a cloud service providing device in which a server agent for monitoring each operating virtual machine is installed; a client terminal in which a client agent for monitoring in accordance with the use of the virtual machine is installed; and a monitoring device which periodically acquires monitoring information from the server agent or the client agent, and processes multiple types of monitoring information stored in the ETCD after a certain period of time elapses after storing the information in the ETCD for real-time monitoring and storing the information as a TSDB.

Description

Real time monitoring system and method for multi cloud}

The present invention relates to monitoring, and to a system and method for monitoring a multi-cloud system in real time.

In recent years, the number of users of the cloud service that provides not only application programs but also various platforms as a service method in the server side is increasing by breaking away from the method of directly installing and using various programs at the client side.

In other words, cloud computing is a system that provides IT resources with high level of scalability as a service to a large number of customers using Internet technology, and users can use virtualized resources as a personal desktop environment.

According to the expansion of such cloud services, multi-cloud services in which a large number of cloud service providers (CSPs) are operated are being serviced. Multi-cloud refers to the operation of one service by using two or more clouds by different companies, and in the form of a dual configuration of the cloud system with different companies, avoiding vendor dependency and when a failure occurs in the cloud system of a specific company. It is used for the purpose of not damaging the service.

In such a multi-cloud environment, monitoring of virtual machines (vm) for cloud computing services provided by each CSP is required for the purpose of safe operation.

Republic of Korea Patent Publication No. 10-2013-0083726 (Publication date July 23, 2013) Virtual machine integrated monitoring device and method in a cloud system

Accordingly, the present invention has been devised to solve the above-described problem, and is to provide a system and method for monitoring each VM (virtual machine) operated in a plurality of CSPs in real time.

In addition, the present invention is to provide a monitoring system and method for safely and efficiently collecting real-time monitoring information.

Other objects of the present invention will become more apparent through preferred embodiments described below.

According to an aspect of the present invention, there is provided a cloud service providing apparatus in which a server agent for monitoring each operating virtual machine is installed; A client terminal installed with a client agent for monitoring according to the use of the virtual machine; And a monitoring device that periodically acquires monitoring information from the server agent or the client agent, and processes a plurality of monitoring information stored in the ETCD after a certain time elapses after storing it in ETCD for real-time monitoring and storing it in TSDB. A multi-cloud real-time monitoring system is provided.

Here, when real-time monitoring is requested from the administrator, the monitoring device commands one of the related server agent or client agent to change the monitoring generation period, so that monitoring information at different times is collected from the server agent and the client agent. Save to the ETCD.

Further, the monitoring device verifies the reliability of the monitoring information by collecting monitoring information from the server agent and the client agent, respectively, and comparing them with each other, and processes the change of the real-time monitoring generation period only when verified.

In addition, when the reliability verification fails, all monitoring information of the server agent and the client agent at the same time is stored in the ETCD.

In addition, when performing real-time monitoring, the monitoring device shortly changes the processing period for storing monitoring information in the TSDB.

According to another aspect of the present invention, in a real-time monitoring method in a monitoring device that performs monitoring according to a multi-cloud service, a server agent that monitors a virtual machine operated in a cloud service providing device, and the client terminal Periodically collecting monitoring information from a client agent performing monitoring according to the use of the virtual machine; Storing the collected monitoring information in the ETCD to provide real-time monitoring information to the manager terminal; And processing a plurality of monitoring information stored in the ETCD and storing it in a TSDB when a predetermined time elapses. A multi-cloud real-time monitoring method and a recording medium on which a program executing the method is recorded are provided.

Here, when real-time monitoring is requested from the manager terminal, further comprising the step of instructing to change the monitoring generation period to one of the related server agent or the client agent, wherein monitoring information at different times is collected from the server agent and the client agent. If possible, all are stored in the ETCD.

In addition, the reliability of the monitoring information is verified by collecting and comparing monitoring information from the server agent and the client agent, respectively, and the change of the real-time monitoring generation period is processed only when verified.

In addition, when the reliability verification fails, all monitoring information of the server agent and the client agent at the same time is stored in the ETCD.

According to the present invention, monitoring information for each VM (virtual machine) operated by a plurality of CSPs can be converted into a database, and can be monitored in real time.

In addition, according to the present invention, it is possible to collect detailed real-time monitoring information in time, which is safer and more efficient through a dual method.

1 is a block diagram schematically showing a cloud virtual machine integrated monitoring system according to an embodiment of the present invention.
2 is a block diagram showing the configuration of a monitoring device according to an embodiment of the present invention.
3 is a table illustrating information on a collector to which an agent is assigned according to an embodiment of the present invention.
4 is a flowchart illustrating a process of verifying reliability of monitoring information according to an embodiment of the present invention.
5 is a flowchart illustrating a process for verifying reliability when a failure occurs in another collector paired by a collector according to an embodiment of the present invention.
6 is a flowchart illustrating a process of collecting and storing monitoring information according to an embodiment of the present invention.
7 is a table illustrating information stored in a real-time information storage unit according to an embodiment of the present invention.
8 is a flowchart showing a process of collecting monitoring information according to another embodiment of the present invention.
9 is a table illustrating information stored in a real-time information storage unit according to another embodiment of the present invention.

In the present invention, various modifications may be made and various embodiments may be provided, and specific embodiments will be illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to a specific embodiment, it is to be understood to include all changes, equivalents, or substitutes included in the spirit and scope of the present invention.

When a component is referred to as being "connected" or "connected" to another component, it is understood that it may be directly connected or connected to the other component, but other components may exist in the middle. Should be. On the other hand, when a component is referred to as being "directly connected" or "directly connected" to another component, it should be understood that there is no other component in the middle.

Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. These terms are used only for the purpose of distinguishing one component from another component. For example, terms such as a first threshold value and a second threshold value to be described later may be pre-designated as threshold values that are substantially different or some of the same values, but when expressed in the same word as the threshold value, there is a confusion. There is room, so for the convenience of classification, terms such as first and second will be added together.

The terms used in the present specification are only used to describe specific embodiments, and are not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this specification, terms such as "comprise" or "have" are intended to designate the presence of features, numbers, steps, actions, components, parts, or a combination thereof described in the specification, but one or more other features. It is to be understood that the presence or addition of elements or numbers, steps, actions, components, parts, or combinations thereof, does not preclude in advance.

In addition, components of the embodiments described with reference to each drawing are not limited to the corresponding embodiments, and may be implemented to be included in other embodiments within the scope of maintaining the technical spirit of the present invention. Even if the description is omitted, it is natural that a plurality of embodiments may be implemented again as a unified embodiment.

In addition, in the description with reference to the accompanying drawings, the same or related reference numerals are assigned to the same components regardless of the reference numerals, and redundant descriptions thereof will be omitted. In describing the present invention, when it is determined that a detailed description of related known technologies may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted.

1 is a block diagram schematically illustrating a cloud virtual machine integrated monitoring system according to an embodiment of the present invention, and FIG. 2 is a block diagram showing the configuration of a monitoring device according to an embodiment of the present invention.

Referring to FIG. 1, the integrated monitoring system includes a plurality of client terminals (10-1, 10-2, ..., hereinafter referred to as 10), and a plurality of cloud service providers (cloud service providers, 30-1, 30-). 2, ..., hereinafter collectively referred to as 30) and a monitoring device 50.

The client terminal 10 is a terminal device of a user using a cloud computing service, and may be a computing device having a communication means through a communication network, such as a smartphone or a tablet PC, as well as a personal PC.

The cloud service providing device 30 is a service provider that operates one or more virtual machines that provide cloud computing services.

An agent for generating monitoring information by performing monitoring according to a cloud computing service is installed in the client terminal 10 and the cloud service providing device 30.

The server agent, which is an agent installed in the cloud service providing device 30, is the operating system (OS: Operating System) of a virtual machine (VM) or the operation status of an application operated in a virtual machine (client terminal information used, application usage information). Etc.) or performance information (for example, CPU, memory, disk, network status of the virtual server) to generate information.

The client agent installed in the client terminal 10 monitors the cloud computing service provided from the virtual machine to generate monitoring information such as virtual machine information (eg, serial number, etc.) and application usage information.

The monitoring device 50 collects, stores, and manages monitoring information generated by the server agent and the client agent.

According to an example, by providing an agent program when deploying a virtual machine from a cloud management platform (CMP) operating the monitoring device 50 to each cloud service providing device 30, the monitoring device when the virtual machine is driven. Approach to (50) and be assigned a collector to provide monitoring information.

In a similar manner, the client terminal 10, which wants to access the virtual machine and receive cloud computing service, also acquires and installs a client agent program acquired from the CMP in advance from the virtual machine.

The client agent installed in the client terminal 10 is similarly assigned a collector that accesses the monitoring device and collects monitoring information.

In other words, the monitoring device 50 provides a server agent and a client agent to the CSP to install an agent for monitoring corresponding to each virtual machine and client terminal 10.

Referring to FIG. 2 showing the configuration of the monitoring device 50, the monitoring device 50 includes a plurality of collectors 210-1, 210-2, ..., 210-n or less, collectively referred to as 210, 211, and a collector. It includes a management unit 220, a security processing unit 230, a real-time information storage unit 240, and a database unit 250.

The collector 210 performs a function of collecting monitoring information generated by an agent for monitoring, and a target for which the collector 210 collects monitoring information is assigned by the collector management unit 220. That is, as described above, when the collector management unit 220 receives a request for assignment of collectors from the connected server agent or client agent, it allocates any one in consideration of the load of each collector 210.

And, according to an example, the collector may be divided into a first collector 210 that collects general monitoring information and a second collector 211-1 and 211-2 that collect real-time monitoring information according to another example. The second collector will be described in more detail later with reference to related drawings (FIGS. 8 and 9 ).

3 is a table illustrating information on a collector to which an agent is assigned according to an embodiment of the present invention.

3, the collector management unit 220 includes a group A server agent (for example, server agents installed in a VM operated by CSP1) and a group B client agent (for example, a VM operated by CSP2). It is assigned to collect monitoring information from a client agent installed in a client terminal receiving a cloud computing service from

And according to an example, as shown in the figure, the collector management unit 220 is a group B server agent (for example, server agents installed in a VM operated by CSP2) and group A client agent so that collector 2 is symmetric with collector 1 Assigns to collect monitoring information from (for example, a client agent installed in a client terminal receiving a cloud computing service from a VM operated by CSP1). According to the present embodiment, by allowing two collectors to acquire monitoring information so as to be symmetrical to each other, it is possible to cope with a case of a failure in one collector, which will be described in more detail later with reference to the related drawing (FIG.

Referring back to FIG. 2, monitoring information collected by the collector is stored in the database unit 250.

Here, the monitoring device 50 may store all monitoring information received from the server agent and the client agent, respectively, in the database unit 250, and according to another example, either of the two (for example, monitoring information from the server agent) ) Can also be databaseized.

However, according to an example, the security processing unit 230 verifies reliability by collecting monitoring information from the server agent and the client agent by the collector 210 and comparing them with each other.

4 is a flowchart illustrating a process of verifying reliability of monitoring information according to an embodiment of the present invention.

Referring to FIG. 4, when the collector collects monitoring information from the virtual machine a, the monitoring device 50 extracts the collected and stored monitoring information from the client terminal 10 using the service of the virtual machine a (S420).

For convenience of understanding, as an example, it is assumed that virtual machine a provided a cloud computing service to client terminal 1 and client terminal 2 during the period from 0:00 on May 1, 2018 to 0:00 on May 2, 2018. And, if the monitoring device 50 has collected monitoring information from the virtual machine a for the period (from 0:00 on May 1, 2018 to 0:00 on May 2, 2018), the monitoring device 50 This is to extract monitoring information previously collected from client agents installed in client terminals 1 and 2 that have received cloud computing service from virtual machine a.

Then, reliability verification is performed by comparing the monitoring information collected from the virtual machine a and the extracted monitoring information from the two client agents (S430).

For example, among the monitoring information (hereinafter referred to as client monitoring information) from client terminal 1 and client terminal 2, application information (e.g., usage time, etc.) received, user ID and monitoring information received from virtual machine a (hereinafter, machine monitoring information) (Referred to as information), the reliability can be verified by comparing the client ID provided with the service and the service providing time to match each other. For example, if the user ID according to the client monitoring information and the client ID according to the machine monitoring information are different from each other, it may be determined that the machine monitoring information is not reliable.

According to this embodiment, by comparing and analyzing the monitoring information received from the server-side virtual machine and the client that used the virtual machine, respectively, by performing verification on the collected monitoring information, it is possible to distinguish forged or altered monitoring information. It is possible to perform more secure monitoring.

And, as described above, by assigning two collectors in a pair so that the server side and the client side are symmetrical to each other, the monitoring device can easily extract the client monitoring information to be compared with the machine monitoring information received from the server agent. That is, referring to FIG. 3, when the collector 1 collects machine monitoring information, the client monitoring information collected by the collector 2 can be extracted and used for reliability verification.

5 is a flowchart illustrating a process for verifying reliability when a failure occurs in another collector paired with a collector according to an embodiment of the present invention.

Referring to FIG. 5, when an arbitrary collector (collector 2 of FIG. 3 in this embodiment) collects client monitoring information from a client agent (S510), a paired other collector (collector 1 of FIG. 3 in this embodiment) It is checked whether a failure has occurred (S520).

If there is no failure in the paired collector 1, collector 2 stores client monitoring information to verify machine monitoring information collected by collector 1 (S530). That is, when Collector 1 is normally operated, machine monitoring information of Group A will be collected, and client monitoring information of Group A is stored in the database so that reliability verification of the corresponding machine monitoring information can be performed.

In contrast, when it is determined that a failure has occurred in Collector 1, which is another paired collector, Collector 2 checks the reliability by inquiring with the corresponding server agent (S540). For example, when client monitoring information is obtained from client terminal a, the reliability of the virtual machine a that provided cloud computing service to client terminal a using virtual machine information (identification information, etc.) included in the client monitoring information To inquire. Then, the virtual machine a verifies the reliability by confirming that it has normally provided the service to the client terminal a, such as client monitoring information.

Collector 2 will be able to store client monitoring information along with the reliability verification result. Alternatively, the client monitoring information can be saved only when it is confirmed to be reliable from the server agent.

According to the present embodiment, reliable client monitoring information can be acquired and stored even if a failure occurs in the collector and monitoring information from the server agent installed in the virtual machine cannot be acquired.

Further, although not shown in the drawing, the monitoring device 50 may provide an encryption key to the cloud service providing device 30 in order to obtain more reliable monitoring information from the client agent. The cloud service providing device 30 provides the corresponding encryption key to the connected client terminal 10 so that the client terminal 10 encrypts the client monitoring information with the corresponding encryption key and transmits it to the monitoring device 50. Therefore, the monitoring device 50 authenticates not only the client terminal 10 but also the cloud service providing device 30 by checking whether the client terminal 10 encrypts and provides monitoring information using the encryption key sent by itself. You can even perform. That is, the monitoring device 50 provides an encryption key to the client terminal 10 via the cloud service providing device 30, so that it is possible to check whether or not normal communication between the two devices is performed.

Hereinafter, a method of collecting real-time monitoring information by the monitoring device 50 and providing it to a manager terminal (not shown) will be described.

6 is a flowchart illustrating a process of collecting and storing monitoring information according to an embodiment of the present invention, and FIG. 7 is a table illustrating information stored in a real-time information storage unit according to an embodiment of the present invention.

Referring to FIG. 6 along with FIG. 2, the monitoring information collected by the collector 210 is not immediately stored in the database unit 250, but is first stored in the real-time information storage unit 240. The real-time information storage unit may use an ETCD, which is typically used as a key value storage.

According to an embodiment, an agent for monitoring installed on a server or client generates monitoring information every 2 seconds and transmits it to the collector of the monitoring device 50, and the monitoring device 50 transmits the monitoring information every 10 seconds. It is processed and stored in the database unit 250.

That is, when monitoring information is collected (S610), the monitoring device 50 first stores it in the real-time information storage unit 240 (S620). Therefore, when the real-time monitoring information is requested from the manager terminal, the monitoring device 50 can provide the latest monitoring information by providing the last stored data of the real-time information storage unit 240 so that the manager can monitor in real time. do.

Referring to FIG. 7, as described above, the ETCD, which is the real-time information storage unit 240, is utilized and stored as a key (ie, time)/value (information value) for monitoring information collected in units of 2 seconds. In this embodiment, the monitoring information is collected from the server agent. If the monitoring information is obtained from the client agent, the information of the corresponding client will be stored in the value.

Referring back to FIG. 6, when the processing cycle (i.e., 10 seconds as described above) is reached, data stored in the real-time information storage unit 240 (i.e., 5 monitoring information generated in units of 2 seconds) is processed in chronological order. As stored in the database unit 250.

For example, the database unit 250 may use a time series database (TSDB) in which data is stored and managed in a time series.

As a processing method, min/max/avg/last (i.e., minimum size data, maximum size data, average size data, or processing data for the latest data) can be saved with the original monitoring data for 5 data collected according to statistical criteria. have.

In the present embodiment, it is assumed that the server agent and the client agent generate and transmit monitoring information at the same time (ie, the same time period and the same time period). As described above, a problem occurs in the agent or is for reliability verification.

According to another example, since more detailed observation may be required during real-time monitoring, by allowing the server agent and the client agent to generate monitoring information at different times, more sophisticated information in time can be obtained without increasing the load.

FIG. 8 is a flowchart illustrating a process of collecting monitoring information according to another embodiment of the present invention, and FIG. 9 is a table illustrating information stored in a real-time information storage unit according to another embodiment of the present invention.

First, referring to FIG. 9, the agent generates monitoring information in units of 2 seconds, but the server side and the client side are based on different time points, so that both data are stored in ETCD to generate monitoring information in units of 1 second. You will be able to.

Referring to FIG. 8 showing the process, the real-time collector 211 of the monitoring device 50 identifies a virtual machine for which real-time monitoring is requested from the manager terminal, and checks a client agent to perform real-time monitoring (S810). In this embodiment, the use of the client agent will be mainly described, but it will be more apparent through the following description that the server agent may be used on the contrary.

Then, the real-time collector 211 requests real-time monitoring from the verified client agent 800 (S820), and the client agent 800 receiving the request changes the generation period of monitoring information and generates monitoring information accordingly ( S830, S840). For example, when monitoring information is generated in even-numbered seconds units (i.e. 00 seconds, 02 seconds, 04 seconds in order), when real-time monitoring is requested, monitoring information in odd seconds units (i.e. 01 seconds, 03 seconds, 05 seconds, etc.) Is to create.

Then, the real-time collector 211 directly or a collector assigned to the corresponding client agent 800 collects monitoring information and stores it in the ETCD (S850 and S860).

Therefore, in ETCD, as shown in FIG. 8, different key values (i.e., time points) of monitoring information obtained from the corresponding client agent (that is, the agent that has requested real-time monitoring) and the monitoring information from the server agent that are generally collected ), you can check the information twice as detailed as in FIG. 7.

Thereafter, when stored in the database unit 250, only five pieces of information from the server side may be used, and of course, all or part of them may be used.

According to another embodiment, the monitoring device 50 may process the monitoring information in a 10-second period and store it in the database unit 250 as described above, but when real-time monitoring is being performed, since it is more sophisticated information, a shorter period ( For example, it is possible to perform databaseization at a 5-second interval). For example, 5 pieces of monitoring information per second are processed and stored in TSDB.

And, according to an example, as described above, the monitoring device 50 may verify the reliability of the monitoring information by collecting monitoring information from the server agent and the client agent, respectively, and comparing them with each other, but only when the verification is successful. Real-time monitoring information is acquired as shown in FIG. 9. For example, if there is a problem with reliability, both monitoring information at the same time can be stored in ETCD or converted into a database so that the administrator can check it.

Although the above has been described with reference to preferred embodiments of the present invention, those of ordinary skill in the relevant technical field can variously modify the present invention within the scope not departing from the spirit and scope of the present invention described in the following claims. It will be appreciated that it can be modified and changed.

10-1, 10-2, ...: Client terminal
30-1, 30-2, ...: Cloud service providing device
50: monitoring device

Claims (10)

A cloud service providing device in which a server agent for monitoring each operating virtual machine is installed;
A client terminal in which a client agent for monitoring according to the use of the virtual machine is installed; And
Reliability verification is performed by acquiring monitoring information from the server agent and the client agent at the same period and comparing each other. If the reliability verification is successful, any one of the monitoring information is stored in ETCD for real-time monitoring. Including a monitoring device that processes a plurality of monitoring information stored in ETCD and stores it in TSDB,
When real-time monitoring is requested from the administrator, the monitoring device commands the server agent or the client agent to change the monitoring generation period, thereby collecting monitoring information at different times from the server agent and the client agent. Stored in a multi-cloud real-time monitoring system.
delete The method according to claim 1,
The monitoring device
A multi-cloud real-time monitoring system that processes a change of the real-time monitoring generation period only when the reliability verification is successful.
The method according to claim 1,
When the reliability verification fails, the ETCD stores all of the monitoring information of the server agent and the client agent at the same time point in the multi-cloud real-time monitoring system.
The method according to claim 1,
When the monitoring device performs real-time monitoring, the multi-cloud real-time monitoring system shortly changes a processing period for storing monitoring information in the TSDB.
In a real-time monitoring method in a monitoring device that performs monitoring according to a multi-cloud service,
Collecting monitoring information at the same period from a server agent performing monitoring on a virtual machine operated by a cloud service providing device and a client agent performing monitoring according to the use of the virtual machine in a client terminal;
Performing reliability verification by comparing the collected monitoring information with each other;
Storing any one monitoring information in the ETCD to provide real-time monitoring information to the manager terminal when the reliability verification is successful; And
Including the step of processing a plurality of monitoring information stored in the ETCD and storing it as a TSDB when a predetermined time elapses,
When real-time monitoring is requested from the administrator, by instructing to change the monitoring generation period to one of the related server agent or client agent, monitoring information at different times is collected from the server agent and the client agent, and all are stored in the ETCD. Multi-cloud real-time monitoring method.
delete delete The method of claim 6,
When the reliability verification fails, the ETCD stores all monitoring information of the server agent and the client agent at the same time point.
A computer-readable recording medium containing computer-executable instructions such as an application or program module executed by a computer for performing the method of claim 6.

Images