KR20180005098A - Method, apparatus and computer program for managing client network in managed service - Google Patents

Abstract

The present invention relates to a method, an apparatus, and a computer program for managing a customer network in a managed service, and more specifically, to a method which calculates a customer network list having a high possibility of an occurrence of a failure among a plurality of customer networks through customer network analysis in various domains to stably provide a managed service for the customer networks, and preemptively manages the same to effectively suppress the occurrence of the failure. According to the present invention, the customer network list having a high possibility of occurrence of a failure is selected through quality analysis, performance analysis, and failure analysis for the customer networks to preemptively correspond thereto. As a result, a failure prediction and quality management can be effectively performed for the customer networks in the managed service. The method for managing a customer network comprises: a data collection step; a customer network analysis step of calculating occurrence details of failure event; and a preferential management customer network selecting step of selecting a customer network requiring a preferential management among a plurality of customer networks.

Description

METHOD, APPARATUS, AND COMPUTER PROGRAM FOR MANAGED SERVICES IN A CUSTOMER NETWORK

The present invention relates to a method, apparatus, and computer program for managing a customer network in a managed service, and more particularly, to a method and apparatus for managing a customer network in various domains in order to stably provide a managed service to a plurality of customer networks A device and a computer program for managing a customer network in a managed service that can effectively prevent a failure in a customer network by calculating and preemptively managing customer networks with high probability of failure among a plurality of customer networks .

In recent years, managed services for managing and managing clients' networks and servers have been spreading.

Unlike operation management for a typical individual business network in which a single network is managed, the operation management of the managed service is worthy of a structure in which a plurality of independent customer networks are linked to the end of the managed service network, Which are difficult to manage at the same time.

More specifically, various service profiles exist for each of the plurality of customer networks, and the service profile includes a subscriber ID, used line information (eg, player, bandwidth, line type, etc.) Band, subscription service (transmission, IP, VoIP, wireless, power, security, etc.). Accordingly, each customer can connect a customer network of the head office and a branch office via a managed service network, receive a network / communication service, or provide a predetermined service to the outside using a server provided in the customer network And the managed service provider manages the management of the customer network in order to provide stable service to the customer.

In such an environment, it is not easy for managed service providers to manage various performance and failure problems occurring in a large number of customer networks at the same time. More specifically, managed service providers often encounter the following difficulties in their operational management:

Firstly, unlike the operation management for a typical individual business network, which is a single network, a managed service provider must manage a plurality of customer networks at once, and it is difficult to simultaneously manage a plurality of customer networks with limited manpower, It is also difficult to judge which customer network should be managed first.

Also, unlike the operation management for a single individual business network, which is a single network, it is difficult for a managed service provider to immediately grasp various events occurring in many equipment of a plurality of customer networks remotely, There is a limit to the operation and management.

In addition, it is difficult to establish a uniform standard for operation and management due to various operating environments and sizes for each customer network. In the case of a large-scale customer network, Network, it is more difficult to identify the cause of the failure.

In particular, once an obstacle occurs in a customer network, a variety of problems such as complaints of customers are followed, and the response time and manpower are also insufficient, and it is also difficult to appropriately take the cause analysis and measures.

Accordingly, in providing managed services, it is appropriate to preemptively respond to a plurality of customer networks having various operating environments through quality control and prediction of failure occurrence, and it is evaluated as preferable from the viewpoint of operating efficiency have.

Accordingly, there is a continuing need for a managed service provider to effectively manage a plurality of customer networks in a managed service by calculating and preemptively managing a list of customer networks with a high possibility of failure among a plurality of customer networks However, there is still no adequate solution to this problem.

Korean Patent Publication No. 10-2009-0040350

Disclosure of Invention Technical Problem [8] Accordingly, the present invention has been made keeping in mind the above problems occurring in the prior art, and it is an object of the present invention to provide a managed service providing system for a plurality of customer networks, And to provide a management method, apparatus, and computer program for a customer network in a managed service capable of responding to customer requests.

According to an aspect of the present invention, there is provided a method for managing a plurality of customer networks in a managed service, the method comprising: A data collecting step of collecting management management data for evaluating a fault; A generation history of a quality problem event for each customer network satisfying a first predetermined reference value is calculated using the operation management data and a generation history of a performance problem event for each customer network satisfying a predetermined second reference value A customer network analyzing step of calculating an occurrence history of failure trouble events for each customer network satisfying a predetermined third reference value; And a priority management customer network selection step of selecting a customer network requiring priority management among the plurality of customer networks considering a history of quality problem events, performance problem events and failure problem events for each customer network .

At this time, in the customer network analysis step, the first customer network group is selected based on the quality problem event occurrence history of the plurality of customer networks, the performance problem event occurrence details are calculated for the first customer network group, Next, the second customer network group may be selected based on the performance problem event occurrence history among the first customer network groups, and the performance problem event occurrence details may be calculated for the second customer network group.

In the customer network analysis step, the frequency of occurrence of the quality problem event, the performance problem event, and the failure problem event may be calculated for each customer network.

In addition, in the step of selecting the preferred management customer network, a customer network requiring priority management among the plurality of customer networks is selected in consideration of the case where each of the quality problem event, the performance problem event, can do.

Also, in the step of selecting the preferred management customer network, a customer network requiring priority management among the plurality of customer networks can be selected in consideration of the size of each customer network.

In addition, in the selection of the priority management customer network, a customer network requiring priority management among the plurality of customer networks can be selected in consideration of the types of events mainly occurring among the quality problem event, the performance problem event, and the trouble problem event.

In the data collection step, the management management data for the plurality of customer networks may be collected and then converted into the management management data of the predetermined common standard.

The computer program according to another aspect of the present invention is characterized in that the computer program is stored in a readable recording medium so that each step of the management method for the customer network can be executed in the computer.

According to another aspect of the present invention, there is provided a server for managing a plurality of customer networks in a managed service, the server comprising: a data collection unit for collecting operational management data for evaluating quality, part; A generation history of a quality problem event for each customer network satisfying a first predetermined reference value is calculated using the operation management data and a generation history of a performance problem event for each customer network satisfying a predetermined second reference value A customer network analysis unit for calculating the occurrence history of a failure problem event for each customer network satisfying a predetermined third reference value; And a priority management customer network selection unit for selecting a customer network requiring priority management among the plurality of customer networks in consideration of a quality problem event, a performance problem event, and a failure problem event for each customer network .

The management method, apparatus, and computer program for a customer network in a managed service according to an exemplary embodiment of the present invention includes a quality analysis, a performance analysis, and a failure analysis for a plurality of customer networks, It is possible to effectively perform failure prediction and quality control on a large number of customer networks in the managed service.

Further, in order to efficiently manage a large number of customer networks, the present invention can effectively prevent the occurrence of faults by blocking pre-failure factors of the customer network through preemptive failure prediction and quality control, The service quality can be effectively improved, and further, the manpower and cost can be greatly reduced.

1 is an explanatory diagram of a conventional managed service providing environment.
2 is a flowchart of a method for managing a customer network in a managed service according to an exemplary embodiment of the present invention.
3 is a functional block diagram of a management system for a customer network in a managed service according to an exemplary embodiment of the present invention.
FIG. 4 is a diagram for explaining the selection of an analysis area and an important analysis field in a management system for a customer network in a managed service according to an embodiment of the present invention.
5 is a configuration diagram of a server for managing a customer network in a managed service according to an embodiment of the present invention.
6 is a flowchart illustrating a process of selecting a preferred management customer network in a server for managing a customer network in a managed service according to an exemplary embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The present invention is capable of various modifications and various embodiments, and specific embodiments will be described in detail below with reference to the accompanying drawings.

The following examples are provided to aid in a comprehensive understanding of the methods, apparatus, and / or systems described herein. However, this is merely an example and the present invention is not limited thereto.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. The following terms are defined in consideration of the functions of the present invention, and may be changed according to the intention or custom of the user, the operator, and the like. Therefore, the definition should be based on the contents throughout this specification. The terms used in the detailed description are intended only to describe embodiments of the invention and should in no way be limiting. Unless specifically stated otherwise, the singular form of a term includes plural forms of meaning. In this description, the expressions "comprising" or "comprising" are intended to indicate certain features, numbers, steps, operations, elements, parts or combinations thereof, Should not be construed to preclude the presence or possibility of other features, numbers, steps, operations, elements, portions or combinations thereof.

It is also to be understood that the terms first, second, etc. may be used to describe various components, but the components are not limited by the terms, and the terms may be used to distinguish one component from another .

Hereinafter, exemplary embodiments of a management method, apparatus, and computer program for a customer network in a managed service according to an exemplary embodiment of the present invention will be described in detail with reference to the accompanying drawings.

First, the managed service will be briefly described with reference to the present invention, and then the present invention will be specifically discussed.

First, managed service refers to a service that allows third parties to operate and manage IT resources and services. Managed service providers continuously monitor the customer's network and system, And to solve problems and manage the customer network systematically to maintain or maintenance services.

In other words, managed service is a service that manages various systems such as hardware and network such as servers used by companies, and telecommunication service providers often provide managed services with communication services. In other words, since the managed service is a service for managing the operation of the network and the system, the managed service provides the service including the functions of the network operation management (NMS) and the system operation management (SMS).

For example, as shown in FIG. 1, the managed service providing environment may have a structure in which a plurality of independent customer networks 300 are linked to a managed service network 200 of a managed service provider.

More specifically, the managed service system may include devices that implement various functions such as transmission, IP, security, exchange, wireless, server, etc., and the managed service provider may be connected to the customer network 300 The managed service system 100 may be provided with a server 100 for managed services and the managed service system may be interworked with the network operation management systems operating the entire network including the managed service network 200.

Conventionally, in managing the customer network 300, there is a problem in that efficiency is deteriorated because it is divided into individual managed services such as network management, server management, and security management, and is operated as an individual system.

For example, a managed service is a network-based service that requires E2E failure and performance management of a customer network-provider network-customer network based on network information of a managed service provider. Conventionally, in order to realize this, a redundant interworking between a network operation management system (NMS) for a communication network and a separate server for providing a managed service is required, which causes waste of resources and makes it difficult to diagnose a fault accurately Problems also followed.

In recent years, attempts have been made to integrate various domains such as network, server, and security to improve efficiency by changing the service environment and reducing the operating cost. However, in such environments, Correlation analysis for events such as failure is required.

In other words, conventionally, individual network operation management system (NMS) and server operation management system (SMS) individually processed events such as failures in each domain. On the other hand, in the integrated environment, It is desirable to identify and process (one) source events through correlation analysis.

In addition, in the managed service, it is important to quickly deal with a failure occurring in the customer network 300. When a customer recognizes the occurrence of a failure due to a service failure or the like, and requests the solution, the managed service provider promptly Analyze and provide countermeasures to the customer. To this end, the managed service provider needs a means for promptly detecting the occurrence of a failure in the case of a failure occurring in the customer network 300, and in order to quickly identify the cause of the failure and to take measures for the failure, It is more preferable to regularly collect operation data such as operation logs of the mobile terminal 300.

On the other hand, in the management method, apparatus, and computer program for the customer network in the managed service according to the embodiment of the present invention, the managed service provider performs the quality management and the failure prediction for the customer network 300, It is possible to effectively manage the customer network.

More specifically, FIG. 2 illustrates a flowchart of a method for managing a customer network in a managed service according to an exemplary embodiment of the present invention. 2, a method for managing a customer network in a managed service according to an exemplary embodiment of the present invention is a method in which a server 100 evaluates quality, performance, and a failure for each of the customer networks 300 (S110) for collecting operation management data for the customer network (300), and using the operation management data, a history of occurrence of a quality problem event for each customer network (300) satisfying a predetermined first reference value is calculated, The occurrence history of the performance problem event for each customer network 300 satisfying the determined second reference value is calculated and the occurrence history of the failure problem event for each customer network 300 satisfying the predetermined third reference value is calculated The customer network analysis step S120 and the priority management of the plurality of customer networks 300 considering the history of the quality problem event, the performance problem event and the failure problem event for each customer network 300, And a priority management customer network selection step (S130) for selecting a customer network 300 that requires a service.

In addition, in the customer network analysis step (S120), a first customer network group is selected based on the quality problem event occurrence history of the plurality of customer networks (300), and a performance problem And then selects a second customer network group based on the performance problem event occurrence history among the first customer network groups and then calculates a performance problem event occurrence history for the second customer network group A customer network 300 requiring priority management among the plurality of customer networks 300 may be selected.

In the customer network analysis step S120, each customer network 300 may be configured to calculate the frequency at which the quality problem event, the performance problem event, and the trouble problem event occur per predetermined unit time, ), Thereby collecting events according to each domain (for example, quality, performance, failure, etc.) and quantitatively calculating statistics and processing them more accurately.

In addition, in the step S150 of selecting the preferred management customer network, considering the case where each of the quality problem event, the performance problem event, and the failure problem event is duplicated due to the same cause, It is also possible to select a customer network 300 that requires a service. In other words, conventionally, when individual management is performed for each domain (for example, quality, performance, failure, etc.), the event for each domain is processed redundantly by one cause. In the present invention, (One) source events through correlation analysis between the plurality of events, and processes the events more accurately and efficiently.

In the priority management customer network selection step S150, the size of each customer network 300 may be considered, or the plurality of customer networks 300 (300, 300, 300, 300, ), It is possible to select a customer network requiring priority management.

More specifically, FIG. 3 is a functional block diagram of a management system for a customer network in a managed service according to an exemplary embodiment of the present invention. The management system for the customer network in the managed service may be implemented by one server 100, but the present invention is not limited thereto and may be implemented by various methods including a plurality of servers and devices .

As shown in FIG. 3, the management system for the customer network in the managed service according to the embodiment of the present invention monitors the devices of the plurality of customer networks 300 in real time, A customer network analysis unit 120 for processing the operation management data and calculating the quality, performance, and occurrence history of failure related events for each customer network 300; A priority management customer network selection unit 130 for selecting a customer network 300 requiring priority management among the plurality of customer networks 300 considering an event occurrence history for each customer network 300, and the like .

Hereinafter, the configuration and operation of the management system 100 for the customer network in the managed service according to the embodiment of the present invention will be described in detail for each constituent element.

First, the data collecting unit 110 periodically monitors resources of servers, processes, and network equipment of each customer network 300 to perform management for evaluating quality, performance, and failure of each customer network 300 Data can be collected. Various methods such as SNMP (Simple Network Management Protocol) polling, Syslog data collection, and CLI (Command Line Interface) data collection can be used as the collection method.

3, the configuration collection / control module 111 of the data collection unit 110 collects data on configuration information for each resource, such as each server, process, and network equipment, or changes settings for each resource Can be performed.

In addition, the fault collection module 112 of the data collection unit 110 collects information related to faults such as various error information generated in operation for each equipment.

For example, you can collect error information in the following cases:

(1) Ping test: (3 consecutive times) When the request time expires without response after ping test

(2) SNMP Trap collection: Collecting overload / down information of network equipment, server, and process

(3) System log (Syslog) Remote collection: Overload / down information collection of network equipment, server, and process

In addition, the log and security collection module 113 of the data collection unit 110 may collect SNMP traps, system logs, log files, security events, and the like generated in operation for each device , And also collects contents corresponding to log pattern values related to failure and security of a predetermined server in advance.

The performance / quality acquisition module 114 of the data collection unit 110 periodically collects performance information such as usage information and traffic information of a storage device such as a CPU, a memory, and a disk on the operation of each device Can be collected.

For example, you can collect performance information in the following ways:

(1) When the response time of the ping test is equal to or more than the threshold value

(2) Collect information about CPU and memory usage for network equipment

(3) Collect information about CPU, Memory, Disk usage for server

In addition, the performance / quality acquisition module 114 may periodically collect quality information such as delay time, jitter, loss, and response time of each device.

For example, you can collect quality information in the following ways:

(1) Measuring download time (or bps) of test file (test file)

(2) Measurement of delay, jitter, and loss in the ping test

(3) Measuring response time of WAS (Web application server) and DB in case of server

(4) Measuring the response time of a specific process in the case of a process

In addition, the failure and log data normalization module 115 and the performance and quality data normalization module 116 of the data collection unit 110 are a function module for primarily processing the collected raw data, And converts it into an event format of a standard format and delivers it.

Next, the customer network analysis unit 120 processes the operation management data for each customer network 300 collected by the data collection unit 110 to analyze quality, performance, and failure related events for each customer network 300 And the occurrence history is calculated.

More specifically, the quality data processing module 121 of the customer network analyzer 120 stores operation management information including quality information related to a network, a server, and a process collected by the data collecting unit 110 at a predetermined time . At this time, the predetermined time unit can be set by the administrator, for example, can be set in units of 5 minutes.

More specifically, the quality data processing module 121 calculates a quality problem event occurrence history in each customer network 300 satisfying a predetermined first reference value. For example, in the quality data processing module 121, when a delay time of a service request of a user is equal to or greater than a predetermined time (for example, one second), the quality data processing module 121 calculates a quality problem event, . Furthermore, various items related to the quality of the customer network 300 such as download time, jitter, and packet loss may be used in addition to the time delay.

Then, the performance data processing module 122 processes operation management information including performance information related to the network, server, process, and the like collected by the data collection unit 110 in a predetermined time unit.

More specifically, the performance data processing module 122 calculates a performance problem event occurrence history in each customer network 300 satisfying a predetermined second reference value. For example, in the performance data processing module 122, when the CPU usage percentage (%) in a server or network equipment used in the customer network 300 is equal to or greater than a predetermined reference value (for example, 50% And records the occurrence of the occurrence. In addition, various items reflecting the performance of the customer network 300 such as the memory utilization rate and the disk margin rate may be used in addition to the CPU utilization rate.

In addition, the failure data processing module 123 processes operation management information including failure information related to a network, a server, a process, and the like collected by the data collecting unit 110 in a predetermined time unit.

More specifically, the failure data processing module 123 calculates a failure occurrence event occurrence history in each customer network 300 satisfying a predetermined third reference value. For example, when the SNMP Trap event occurring in the server or the network equipment used in the customer network 300 is equal to or greater than a predetermined reference value (for example, five or more times in ten minutes) It is calculated as a performance problem event and the occurrence history is recorded. In addition to the SNMP Trap event, various items reflecting a failure state of the customer network 300 such as a Syslog event registered in advance may be used.

 Accordingly, the control service module (not shown) notifies the user and the manager of the failure alarm through the user interface screen, and can process and provide data in real time so that details of the alarm can be confirmed. At this time, failure handling of the network, server, and process can be handled separately.

In addition, the statistical module (not shown) is a statistical data generation module, and it can generate and provide analysis results using statistical data in the field of failure / performance / quality / security for each customer.

Next, the priority management customer network selection unit 130 analyzes the quality and performance of each customer network 300 based on operation management information on quality / performance / faults generated on the managed service operation, The customer network 300 is selected.

In a case where a device such as a server is stopped or a port is shut down, the service service module (not shown) promptly notifies the customer of the failure alarm as an emergency situation in which the service is stopped. However, If a failure occurs in a customer who uses the service without special circumstances such as the expansion of the network 300, the equipment of the customer network 300 may be overloaded or the performance may be degraded. do.

In the present invention, systematic detection of the occurrence of the above-mentioned failure, and analysis and provision of information related to the occurrence of the failure, . In addition, the present invention may include a function of presenting an upper-level customer network 300 having a high risk by arranging a predetermined period of time and sorting on the basis of the risk of failure occurrence.

 More specifically, in the preferred management customer network selection unit 130, the customer network 300 requiring priority management can be selected in consideration of quality analysis, performance analysis, and failure analysis. That is, when the quality of the service used by the customer (for example, the response speed of the equipment such as the server running in the customer network 300) decreases, (For example, CPU, memory, etc. of the server), and if such a performance problem persists, an event related to the failure (for example, an SNMP Trap event) Same serious problems can result.

On the other hand, in the present invention, the quality of each customer network 300 can be preemptively improved by predicting the probability of failure occurrence for each customer network 300 through the following series of processes, do.

(Step 1) First, the quality analysis module 132 of the preferred management customer network selection unit 130 selects the customer networks 300 whose quality has deteriorated and generates the list. For this purpose, the quality analysis module 132 can read the quality-related information for each customer network 300 from a database or the like. At this time, the quality related information may be information corresponding to a preset predetermined period. (For example, 1 day / week / month)

Accordingly, the quality analysis module 132 selects the top N customer network list by sorting the customer network 300 based on the number of quality problem events occurring during the predetermined period. At this time, the following events can be considered.

(1) A customer site whose download time is above a predetermined threshold (NN seconds)

(2) a customer site whose delay time is equal to or greater than a predetermined threshold value (NN seconds)

(3) A customer site whose jitter time is equal to or greater than a predetermined threshold value (NN seconds)

(4) Loss (loss) The number of packets is lower than a predetermined threshold.

(5) The customer site whose response time of the WAS and DB is equal to or greater than the predetermined threshold value (MM seconds)

(6) A customer site whose response time of a specific registered server is equal to or greater than a predetermined threshold value (MM seconds)

(Step 2) The performance analysis module 133 of the preferred management customer network selection unit 130 selects the customer networks 300 whose performance has deteriorated and generates the list.

That is, if the performance deterioration continues, the likelihood of a failure may increase. At this time, based on the number of performance problem events in which performance related information of a resource such as a network / server generated during a predetermined period is not less than a threshold value, (Top N) of the upper customer network 300 by sorting the list 300 of the upper customer network 300. At this time, the following items can be considered.

(1) CPU average utilization rate: a predetermined threshold value (N%) or more,

(2) Memory average utilization rate: a predetermined threshold value (M%) or more

(3) Disk margin rate: Not more than a predetermined threshold value (K%)

In addition, the list (Top N) of the upper customer network 300 may be selected based on the maximum value and duration of performance measurement information of resources such as a network / server during the predetermined period. At this time, the following items can be considered.

(1) When the state in which the CPU maximum utilization rate is equal to or greater than the predetermined threshold value (AA) is equal to or longer than the predetermined duration time (BB)

(2) When the state in which the maximum memory utilization rate of the memory is equal to or greater than the predetermined threshold value (AA)

Also, it is possible to select the top N customer network list based on the deviation of the performance measurement information on the equipment during the predetermined period. At this time, the following items can be considered.

(1) When the state in which the CPU maximum utilization rate is equal to or greater than the predetermined threshold value (AA) is equal to or longer than the predetermined duration time (BB)

(2) When the state in which the maximum memory utilization rate of the memory is equal to or greater than the predetermined threshold value (AA)

Also, a list (Top N) of the superior customer network 300 may be selected based on the deviation of the average performance measurement information on the equipment during the predetermined period. At this time, the following items can be considered.

(1) A customer whose load distribution is wrong or idle equipment exists

(2) When an event whose CPU utilization rate deviation value is equal to or greater than a predetermined threshold value (AA) exceeds a predetermined threshold value (BB)

(3) If the event in which the memory utilization rate deviation value is equal to or greater than the predetermined threshold value (AA) exceeds the predetermined threshold value (BB)

(4) If an event whose deviation rate utilization rate value exceeds a predetermined threshold value (CC) exceeds a predetermined reference value (DD) number of times

In addition, the list (Top N) of the upper customer network 300 can be selected based on the bandwidth utilization rate of the network and the server during the predetermined period. At this time, the following items can be considered.

(1) A customer network having a high network load with an average utilization rate (for example, bps)

(2) a customer network having a high network load with an average utilization rate (e.g., pps)

(3) Bps (bytes per second) change exceeds threshold

(4) Pps (packets per second) change exceeds threshold

(5) A client network having a high network load with a state in which the maximum value of Bps in terms of bandwidth is equal to or greater than a predetermined threshold value (AA)

(6) A customer network having a high network load with a state in which the maximum value of the pps in bandwidth is equal to or greater than a predetermined threshold value (AA)

(7) A customer network that causes a sudden increase in traffic on the network port of a specific server

(Step 3) The failure analysis module 134 of the priority management customer network selection unit 130 generates a list of the customer networks 300 having a high probability of failure occurrence based on the collected failure problem events.

If the failure trouble event is continued, it can cause a serious problem such as a system shutdown. Therefore, the list of the top customer network 300 (Top N ) Can be selected. At this time, the following items can be considered.

(1) An SNMP Trap event corresponding to the registered profile exceeds a predetermined threshold value

(2) Syslog event corresponding to the registered profile exceeds a predetermined threshold value

(3) A direct collection log event corresponding to the registered server failure profile exceeds a predetermined threshold value (DB, WAS)

(4) The direct acquisition log event corresponding to the registered process failure profile exceeds a predetermined threshold value

Also, as a customer network 300 using a failed address (IP) in a service server (DNS, DHCP, AAA, etc.) of a managed service provider, a customer network 300 having many mis- It can also be selected.

In addition, the customer network 300, which is suspected of being a target of security breach, may be selected. At this time, the following items can be considered.

(1) A customer using an address (IP) where a security breach event occurred in a managed service provider's security management system → Possibility of a serious security incident

(2) The customer network whose number of failure events occurring in the internal firewall (Firewall) exceeds the threshold of the threshold (different thresholds can be set for each site size)

(3) In the log of the operation server, when the number of security events in the customer network (the access attempt or failure rapidly increases at a specific address (IP) or unspecified address (IP), etc.)

The threshold and setting management module 131 of the preferred management customer network selection unit 130 manages various thresholds used for analysis and controls the analysis operation. That is, you can set, change, or delete thresholds for quality, performance, and fault analysis.

Also, the threshold and setting management module 131 can perform analysis profile management and setting as follows.

(1) List 1 of quality analysis result list N

(2) List M of 2nd step performance analysis result

(3) List of three stages failure analysis result list

(4) The list N in the first step is set so that a proper pool can be secured

(5) If the M selected in Step 2 is not more than twice the N,

(6) O in step 3 is smaller than the predetermined threshold (AA)

(7) Finally, the AA list and related information are transmitted to the report module 135 to generate and store an analysis result report for each customer

The report module 135 of the preferred management customer network selection unit 130 stores analysis results of the customer for the top AA set by the threshold and setting management module 131 in the database DB , And generates a report.

FIG. 4 illustrates the correlation and critical analysis field selection in the management system for the customer network in the managed service according to an exemplary embodiment of the present invention.

As described above, in the management system for the customer network in the managed service according to the embodiment of the present invention, the degree of correlation between the quality problem event, the performance problem event, In the case where management is separately performed for each domain (for example, quality, performance, failure, and the like) by estimating the probability of occurrence, a single problem is duplicated in a plurality of domains as a separate event, According to the present invention, a plurality of events detected in each domain are identified and processed as (one) source events through mutual correlation analysis, thereby enabling to process events more accurately and efficiently.

Accordingly, in the present invention, it is possible to calculate the degree of correlation between the quality problem event, the performance problem event, and the failure problem event, and to reflect the probability of occurrence of the fault occurrence for each customer network 300. At this time, the degree of correlation between the quality event, the performance event, and the failure event can be calculated without any particular limitations as long as the degree of correlation between the quality problem event, the performance problem event, and the failure problem event can be appropriately calculated.

However, in the present invention, a large amount of event information must be processed, and a large amount of computing resources may be required to calculate the degree of correlation.

On the other hand, when each quality problem event, performance problem event, and failure problem event are duplicatedly detected for each unit time according to an embodiment of the present invention, each of the quality problem event, performance problem event, and failure problem event has a correlation It can be judged and processed.

More specifically, as shown in FIG. 4, when a quality problem event and a performance problem event occur at a unit time of 10:10, a correlation coefficient can be calculated to be 2, and at 10:15 unit time, , A performance problem event and a failure problem event are generated, and the correlation coefficient can be calculated to be 3. Accordingly, in the case of FIG. 4, the correlation may be 5 as the sum of the correlation coefficients.

In FIG. 4, the quality problem event occurred three times in total, the performance problem event occurred nine times in total, and the trouble problem event occurred twice in total, and the number of times of occurrence of each event was compared with a predetermined threshold, , And may even select the dominant critical areas of analysis (for example, the performance field in Figure 4).

5 is a block diagram of a server 100 for managing a customer network 300 in a managed service according to an embodiment of the present invention. 5, the server 100 for managing the customer network 300 in the managed service according to an embodiment of the present invention includes a data collecting unit 110, a customer network analysis unit 120, And a preferred management customer network selection unit 130. [

The server 300 for managing the customer network 300 in the managed service according to an embodiment of the present invention can refer to a description of a method of managing the customer network 300 in the managed service that has been described above In the following, we give a somewhat brief explanation.

First, the data collection unit 110 collects and provides operational management data for evaluating quality, performance, and faults of each of the plurality of customer networks.

In addition, the customer network analyzer 120 calculates the occurrence history of quality problem events for each customer network 300 meeting the predetermined first reference value using the operation management data, and calculates a predetermined second reference value The occurrence history of the performance problem event for each of the customer networks 300 satisfying the predetermined condition is calculated and further the occurrence history of the failure problem event for each customer network 300 satisfying the predetermined third reference value is calculated.

The priority management customer network selection unit 130 selects priority management of the plurality of customer networks 300 considering the occurrence of quality problem events, performance problem events and failure problem events for each customer network 300 The customer network 300 is selected.

FIG. 6 is a flowchart illustrating a process of selecting a preferred management customer network in the server 100 for managing the customer network 300 in the managed service according to an embodiment of the present invention.

Referring to FIGS. 5 and 6, a process of selecting a preferred management customer network by the server 100 for managing the customer network 300 in the managed service according to an exemplary embodiment of the present invention will be described.

First, the manager of the manager service sets a profile for various thresholds that can be used for managing the customer network 300 and sets a domain (IP / transmission / server / power / BCN (Broadband convergence network) Can be selected. The data collection unit 110 of the server 100 collects operation management data for performing quality, performance, and fault evaluation for each customer network 300, The statistical data is stored in the database. In addition, the data collecting unit 110 may detect an urgent reason such as a line failure or stopping the operation of the equipment in each customer network 300, and may notify the administrator and the customer in real time.

When the administrator requests the analysis of the possibility of failure or the like of one or more customer networks 300 at step S210, the quality data processing module 121 analyzes the collected quality of the network, server, process, etc. of the customer network 300 After analyzing the data (S220), the customer network 300 whose quality has deteriorated is calculated, the analysis result is stored (S222), and the performance data processing module 122 is requested to analyze the performance data (S224).

Accordingly, the performance data processing module 122 analyzes the performance data collected for the network, server, process, etc. of the customer network 300 (S230) to calculate the customer network 300 whose performance has deteriorated, (S232), the fault data processing module 123 requests the fault data analysis (S234).

In addition, the failure data processing module 123 analyzes the failure data collected in the network, server, and process of the customer network 300 (S240) to calculate the customer network 300 in which a plurality of failure problem events have occurred, After the storage (S242), the management client network selection unit 130 is requested to select the customer network 300 requiring priority management (S244).

Accordingly, the priority management customer network selection unit 150 selects the priority management customer network based on the analysis results calculated by the quality data processing module 121, the performance data processing module 122, and the failure data processing module 123 At this time, the priority management customer network is selected in consideration of the correlation between the quality problem event, the performance problem event, and the failure problem event, or the priority management customer network is selected in consideration of the types of events mainly occurring in the quality problem event, performance problem event, The failure type of the customer network 300 may be calculated (S250).

Then, the analysis result and the report calculated through the series of processes described above may be provided to an administrator or a customer (S260).

The computer program according to another aspect of the present invention is characterized by being a computer program recorded on a computer-readable recording medium for executing each step of the management method for the customer network 300 in the managed service described above in the computer .

The medium on which the computer-readable program is recorded may include program commands, data files, data structures, and the like, alone or in combination. The program instructions recorded on the computer readable medium may be those specially designed and constructed for the present invention or may be known and used by those of ordinary skill in the computer software arts. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CD-ROM and DVD, magneto-optical media such as floptical disks, medium, and a hardware device specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like, and may be recorded in a storage device such as a terminal or a server such as a PC. Examples of program instructions include high-level language code that can be executed by a computer using an interpreter, as well as machine accords such as those produced by a compiler. The hardware device may be modified into one or more software modules for performing the processing according to the present invention, and vice versa.

The foregoing description is merely illustrative of the technical idea of the present invention, and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments described in the present invention are not intended to limit the technical spirit of the present invention but to illustrate the present invention. The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents thereof should be construed as being included in the scope of the present invention.

100: Server
110: Data collecting unit
111: Configuration acquisition / control module
112: Fault collection module
113: Log and security collection module
114: Performance / quality acquisition module
115: Fault and Log Data Normalization Module
116: Performance and Quality Data Normalization Module
120: Customer Network Analysis Department
121: Quality data processing module
122: performance data processing module
123: Fault data processing module
130: Preferred management customer network selection unit
131: threshold and setting management module
132: Quality analysis module
133: Performance Analysis Module
134: Fault analysis module
135: Report module
200: Managed Services Network
300: customer network

Claims (9)

A method for managing a plurality of customer networks in a managed service,
A data collecting step of collecting operational management data for evaluating quality, performance, and faults of each customer network;
A generation history of quality problem events for each customer network satisfying a first predetermined reference value is calculated using the operation management data,
Calculating a history of occurrence of a performance problem event for each customer network satisfying a predetermined second reference value,
A customer network analyzing step of calculating an occurrence history of failure trouble events for each customer network satisfying a predetermined third reference value; And
A priority management customer network selection step of selecting a customer network requiring priority management among the plurality of customer networks considering a history of a quality problem event, a performance problem event and a failure problem event for each customer network;
The method comprising the steps of: The method according to claim 1,
In the customer network analysis step,
Selecting a first customer network group based on a quality problem event occurrence history of the plurality of customer networks, calculating a performance problem event occurrence history for the first customer network group,
And selecting a second customer network group based on the performance problem event occurrence history among the first customer network groups and calculating a performance problem event occurrence history for the second customer network group. How to manage. The method according to claim 1,
In the customer network analysis step,
Wherein the frequency of occurrence of the quality problem event, the performance problem event, and the failure problem event per predetermined unit time is calculated for each customer network. The method according to claim 1,
In the priority management customer network selection step,
And selects a customer network that requires priority management among the plurality of customer networks considering a case where each of the quality problem event, the performance problem event, and the trouble problem event is duplicated due to the same cause . The method according to claim 1,
In the priority management customer network selection step,
And selecting a customer network requiring priority management among the plurality of customer networks in consideration of the size of each customer network. The method according to claim 1,
In the priority management customer network selection step,
And selecting a customer network that requires priority management among the plurality of customer networks in consideration of the types of events mainly occurring among the quality problem event, the performance problem event, and the trouble problem event. The method according to claim 1,
In the data collection step,
Collecting operational management data for the plurality of customer networks,
And converting the data into a format of operation management data of the predetermined common standard. A computer program recorded on a computer readable recording medium for causing a computer to execute the steps of any one of claims 1 to 7. 1. A server for managing a plurality of customer networks in a managed service,
A data collection unit for collecting operational management data for evaluating quality, performance, and faults of each customer network;
A generation history of quality problem events for each customer network satisfying a first predetermined reference value is calculated using the operation management data,
Calculating a history of occurrence of a performance problem event for each customer network satisfying a predetermined second reference value,
A customer network analysis unit for calculating the occurrence history of the failure problem event for each customer network satisfying a predetermined third reference value; And
A priority management customer network selecting unit for selecting a customer network requiring priority management among the plurality of customer networks considering a history of quality problem events, performance problem events and failure problem events for each customer network;
Lt; / RTI >

Images