KR20230032336A - Apparatus of operating system's process network connection visualization and method thereof - Google Patents

Abstract

The present invention discloses an operating system process network connection relationship visualization device and a method thereof. That is, the present invention collects process connection relationship information on connection relationships between servers and/or connection relationships between processes. By providing process connection relationship information which visualizes and provides the collected process connection relationship information, a visualized dashboard to intuitively identify and analyze server/process connection relationships is provided, so as to establish a new type of process operation and management system.

Description

Apparatus of operating system's process network connection visualization and method thereof}

The present invention relates to an apparatus and method for visualizing an operating system process network connection relationship, and in particular, collects process connection relationship information about a connection relationship between servers and/or a connection relationship between processes, and visualizes and provides the collected process connection relationship information. It is to provide an operating system process network connection relationship visualization device and method.

A network management system is a computer system for supporting network management tasks.

Such a network management system establishes a central monitoring system for equipment on a network (or network), provides monitoring and analysis functions, and stores related data so that it can be utilized.

At this time, in a data center or cloud environment where large-scale servers are operated, the operator executes commands for each server to check the connection relationship between processes, and checks the connection relationship between servers and processes while comparing the results. It is leading to an increase in personnel and management time.

In addition, it is difficult to efficiently identify and manage the connection relationship of a plurality of devices connected to the network.

Korean Patent Registration No. 10-1766665 [Title: Connection relationship search system between network equipment using ARP table and FDB table]

An object of the present invention is to provide an operating system process network connection relationship visualization device and method for collecting process connection relationship information about connection relationships between servers and/or connection relationships between processes, and visualizing and providing the collected process connection relationship information. is to do

Another object of the present invention is to provide an operating system process network connection relationship visualization device and method for checking a process list being used by a process and inquiring log file contents being recorded in real time and/or past log file contents. there is.

An apparatus for visualizing an operating system process network connection relationship according to an embodiment of the present invention includes a communication unit for collecting network communication status information for each server and system performance information for each server from a plurality of servers, respectively; a control unit generating a visualization analysis screen of correlation for each process based on the collected network communication state information for each of the plurality of servers and system performance information for each of the plurality of servers; and a display unit displaying, by the control unit, a visualization analysis screen of the generated relationship for each process.

As an example related to the present invention, the network communication status information for each server includes at least one of a transmission control protocol, a process ID (PID), a process name, a local IP address, a remote IP address, a local port number, a remote port number, and status information. The system performance information for each server may include at least one of a CPU utilization rate, a CPU utilization rate of a process, a memory utilization rate of a process, a network utilization rate of a process, and a CPU utilization rate of a process.

An apparatus for visualizing an operating system process network connection relationship according to an embodiment of the present invention includes a communication unit for collecting network communication status information for each server and system performance information for each server from a plurality of servers, respectively; a control unit for generating a visualization analysis screen for relational relationships for each server based on the collected network communication state information for each of the plurality of servers and system performance information for each of the plurality of servers; and a display unit for displaying, by the control unit, a visualization analysis screen of the generated correlation for each server.

A method for visualizing an operating system process network connection relationship according to an embodiment of the present invention includes collecting, by a communication unit, network communication state information for each server and system performance information for each server from a plurality of servers, respectively; generating, by a controller, a correlation visualization analysis screen for each process based on the collected network communication state information for each of a plurality of servers and system performance information for each of a plurality of servers; and controlling, by the controller, to display the generated correlation visualization analysis screen for each process on a display unit.

As an example related to the present invention, the generating of the correlation visualization analysis screen for each process may include individual processes in the server for each server based on the collected network communication state information for each of the plurality of servers and system performance information for each of the plurality of servers. The process of checking the number of connections per process, including the total number of direct connections, which is the number of connections from individual processes to one or more external processes, and the total number of indirect connections, which is the number of connections from one or more external processes to individual processes in the server. ; and generating a correlation visualization analysis screen for each process based on the collected network communication state information for each of the plurality of servers, the collected system performance information for each of the plurality of servers, and the number of connections for each process. there is.

As an example related to the present invention, the correlation visualization analysis screen for each process may be composed of a plurality of nodes representing processes, a plurality of lines representing connection relationships between the plurality of nodes, and the total number of connections between nodes.

As an example related to the present invention, the node includes a polygon representing a process, a local IP address, a CPU utilization rate of a server including the process, a process ID, a process name, a CPU utilization rate of the process, the number of alerts/alarms, and a connection in communication with the process. number, the port number in use by the process, if the port number in use by the process is included among a plurality of preset port numbers, the type of application by manufacturer corresponding to the port number, configured on one side of the node, and configured in one or more external processes At least one of the total number of indirect connections connected to processes related to the node, the total number of direct connections configured on the other side of the node and connected to one or more other external processes in the process related to the node, and the total number of direct connections according to self-calls. can include

A method for visualizing an operating system process network connection relationship according to an embodiment of the present invention includes collecting, by a communication unit, network communication state information for each server and system performance information for each server from a plurality of servers, respectively; generating, by a controller, a correlation visualization analysis screen for each server based on the collected network communication state information for each of a plurality of servers and system performance information for each of a plurality of servers; and controlling, by the controller, to display the generated correlation visualization analysis screen for each server on a display unit.

As an example related to the present invention, the correlation visualization analysis screen for each server is composed of a plurality of other nodes representing the server, a plurality of other lines representing the connection relationship between the plurality of other nodes, and the total number of connections between the other nodes. The other node is the polygon representing the server, the local IP address, the server's CPU utilization, the number of alarms/alarms, the number of connections communicating with the server, the port number the server is using, and the port number the server is using among a plurality of preset port numbers. If is included, the application type for each manufacturer corresponding to the port number, the total number of server indirect connections configured on one side of the other node and connected to the server related to the other node from one or more external servers, and the other side of the other node. It is configured and may include at least one of the total number of server direct connections connected to one or more external servers in the server related to the other node.

An apparatus for visualizing an operating system process network connection relationship according to an embodiment of the present invention includes a communication unit for collecting information related to a log file used by a process running for each server from a plurality of servers; a display unit displaying a log live tail menu or a log reader menu on one side of the dashboard; And when any one of the log live tail menu or the log reader menu displayed on one side of the dashboard of the display unit is selected, the control unit displays information related to the log file used by the collected processes running for each server. It may include a control unit that generates a log analysis screen based on the basis and controls to display the generated log analysis screen on the display unit.

The present invention collects process connection relationship information about the connection relationship between servers and/or the connection relationship between processes, and provides process connection relationship information that is provided by visualizing the collected process connection relationship information, thereby making the server/process connection relationship intuitive. It has the effect of providing a visualized dashboard that can be identified and analyzed as a system, and establishing a new type of process operation and management system.

In addition, the present invention checks the process list being used by the process and provides process connection relationship information that searches log file contents being recorded in real time and/or past log file contents, so that if there is a problem with the process, the corresponding process Find the server that is running, log in to the found server, find the process again, find the log file that the process is writing, avoid the inconvenience of having to search for the log contents of the problem, and view the log file contents related to the process you want. It can be checked immediately, which has the effect of improving server and process operation efficiency.

1 is a block diagram showing the configuration of an operating system process network connection relationship visualization apparatus according to an embodiment of the present invention.
2 is a flowchart illustrating a method for visualizing an operating system process network connection relationship according to an embodiment of the present invention.
3 is a diagram showing an example of a visualization analysis screen of correlation for each process according to an embodiment of the present invention.
4 is a diagram showing an example of a visualization analysis screen of correlation for each server according to an embodiment of the present invention.
5 to 7 are diagrams showing examples of process log file contents according to an embodiment of the present invention.

It should be noted that technical terms used in the present invention are only used to describe specific embodiments and are not intended to limit the present invention. In addition, technical terms used in the present invention should be interpreted in terms commonly understood by those of ordinary skill in the art to which the present invention belongs, unless specifically defined otherwise in the present invention, and are excessively inclusive. It should not be interpreted in a positive sense or in an excessively reduced sense. In addition, when the technical terms used in the present invention are erroneous technical terms that do not accurately express the spirit of the present invention, they should be replaced with technical terms that those skilled in the art can correctly understand. In addition, general terms used in the present invention should be interpreted as defined in advance or according to context, and should not be interpreted in an excessively reduced sense.

Also, singular expressions used in the present invention include plural expressions unless the context clearly dictates otherwise. Terms such as "consisting of" or "comprising" in the present invention should not be construed as necessarily including all of the various elements or steps described in the invention, and some of the elements or steps may not be included. It should be construed that it may, or may further include additional components or steps.

In addition, terms including ordinal numbers such as first and second used in the present invention may be used to describe components, but components should not be limited by the terms. Terms are used only to distinguish one component from another. For example, a first element may be termed a second element, and similarly, a second element may be termed a first element, without departing from the scope of the present invention.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings, but the same or similar components are given the same reference numerals regardless of reference numerals, and redundant description thereof will be omitted.

In addition, in describing the present invention, if it is determined that a detailed description of a related known technology may obscure the gist of the present invention, the detailed description will be omitted. In addition, it should be noted that the accompanying drawings are only for easily understanding the spirit of the present invention, and should not be construed as limiting the spirit of the present invention by the accompanying drawings.

1 is a block diagram showing the configuration of an operating system process network connection relationship visualization apparatus 100 according to an embodiment of the present invention.

As shown in Figure 1, the operating system process network connection relationship visualization device 100 is composed of a communication unit 110, storage unit 120, display unit 130, audio output unit 140 and control unit 150 . Not all of the components of the operating system process network connection relationship visualization device 100 shown in FIG. 1 are essential components, and the operating system process network connection relationship visualization device by more components than the components shown in FIG. 100) may be implemented, or the operating system process network connection relationship visualization apparatus 100 may be implemented with fewer components.

The operating system process network connection relationship visualization device 100 (or operating system process/service interface connection relationship visualization device) is a smart phone, a portable terminal, a mobile terminal, a foldable A foldable terminal, a personal digital assistant (PDA), a portable multimedia player (PMP) terminal, a telematics terminal, a navigation terminal, a personal computer, a notebook computer, a slate PC ( Slate PC), tablet PC (Tablet PC), ultrabook, wearable device (e.g., watch type terminal (Smartwatch), glass type terminal (Smart Glass), HMD (Head Mounted Display), etc. included) ), Wibro terminal, IPTV (Internet Protocol Television) terminal, smart TV, digital broadcasting terminal, AVN (Audio Video Navigation) terminal, A/V (Audio/Video) system, flexible terminal, digital between It can be applied to various terminals such as Nizi devices. In this case, the operating system process network connection relationship visualization device 100 may be a terminal possessed by a user (or manager) managing the corresponding operating system process network connection relationship visualization device 100 .

In addition, the operating system process network connection relationship visualization device 100 may be implemented in the form of a web server, database server, proxy server, application server, security authentication server, and the like. In addition, the operating system process network connection relationship visualization device 100 includes at least one of a network load balancing mechanism and various software that allows the corresponding operating system process network connection relationship visualization device 100 to operate on the Internet or other networks. It can be installed, through which it can be implemented as a computerized system. Also, the network can be an http network, a private line, an intranet or any other network. Furthermore, the connection between the operating system process network connection relationship visualization device 100 and other terminals/servers (not shown) may be connected to a secure network so that data is not attacked by any hacker or other third party. In addition, the apparatus 100 for visualizing the operating system process network connection relationship may include a plurality of database servers, and these database servers may connect the operating system process network connection relationship through any type of network connection including a distributed database server architecture. It may be implemented in a way that is separately connected to the visualization device 100 .

The communication unit 110 communicates with any internal component or at least one external terminal through a wired/wireless communication network. At this time, the external arbitrary terminal may include a server (not shown), another terminal (not shown), and the like. Here, wireless Internet technologies include Wireless LAN (WLAN), DLNA (Digital Living Network Alliance), Wireless Broadband (Wibro), WiMAX (World Interoperability for Microwave Access: Wimax), HSDPA (High Speed Downlink Packet Access) ), High Speed Uplink Packet Access (HSUPA), IEEE 802.16, Long Term Evolution (LTE), Long Term Evolution-Advanced (LTE-A), Wireless Mobile Broadband Service (WMBS), etc. , and the communication unit 110 transmits and receives data according to at least one wireless Internet technology within a range including Internet technologies not listed above. In addition, short-range communication technologies include Bluetooth, Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra Wideband (UWB), ZigBee, and Near Field Communication (NFC). , Ultra Sound Communication (USC), Visible Light Communication (VLC), Wi-Fi, Wi-Fi Direct, and the like may be included. In addition, wired communication technologies may include power line communication (PLC), USB communication, Ethernet, serial communication, optical/coaxial cables, and the like.

In addition, the communication unit 110 may mutually transmit information with an arbitrary terminal through a Universal Serial Bus (USB).

In addition, the communication unit 110 complies with technical standards or communication methods for mobile communication (eg, Global System for Mobile communication (GSM), Code Division Multi Access (CDMA), Code Division Multi Access 2000 (CDMA2000), EV) -DO(Enhanced Voice-Data Optimized or Enhanced Voice-Data Only), WCDMA(Wideband CDMA), HSDPA(High Speed Downlink Packet Access), HSUPA(High Speed Uplink Packet Access), LTE(Long Term Evolution), LTE-A (Long Term Evolution-Advanced), etc.) to transmit and receive radio signals with a base station, the server, and other terminals on a mobile communication network.

In addition, the communication unit 110 transmits network communication status information for each server transmitted from a plurality of servers under the control of the control unit 150, system performance information for each server, and log file related information used by a process running on the server. (or log file-related information used by running processes for each server).

The storage unit 120 stores various user interfaces (UI), graphic user interfaces (GUI), and the like.

In addition, the storage unit 120 stores data and programs necessary for the operating system process network connection relationship visualization device 100 to operate.

That is, the storage unit 120 includes a plurality of application programs (applications) running in the operating system process network connection relationship visualization device 100, and the operating system process network connection relationship visualization device 100. It can store data and instructions for operation. At least some of these application programs may be downloaded from an external server through wireless communication. In addition, at least some of these applications may exist on the operating system process network connection relationship visualization device 100 from the time of shipment for basic functions of the operating system process network connection relationship visualization device 100. On the other hand, the application program is stored in the storage unit 120, installed in the operating system process network connection relationship visualization device 100, and the operation of the operating system process network connection relationship visualization device 100 by the control unit 150 (or function).

In addition, the storage unit 120 may be a flash memory type, a hard disk type, a multimedia card micro type, or a card type memory (eg, SD or XD). memory, etc.), magnetic memory, magnetic disk, optical disk, RAM (Random Access Memory: RAM), SRAM (Static Random Access Memory), ROM (Read-Only Memory: ROM), EEPROM (Electrically Erasable Programmable Read-Only Memory), It may include at least one storage medium of PROM (Programmable Read-Only Memory). In addition, the operating system process network connection relationship visualization device 100 may operate a web storage that performs the storage function of the storage unit 120 on the Internet, or may operate in relation to the web storage. there is.

In addition, the storage unit 120 stores network communication state information for each server received through the communication unit 110 under the control of the control unit 150, system performance information for each server, and logs used by processes running on the server. Stores file-related information (or log file-related information used by processes running on each server).

The display unit (or display unit) 130 may display various contents such as various menu screens using a user interface and/or a graphic user interface stored in the storage unit 120 under the control of the control unit 150. there is. Here, the content displayed on the display unit 130 includes various text or image data (including various information data) and a menu screen including data such as icons, list menus, and combo boxes. Also, the display unit 130 may be a touch screen.

In addition, the display unit 130 may include a liquid crystal display (LCD), a thin film transistor-liquid crystal display (TFT LCD), an organic light-emitting diode (OLED), and a flexible display. (Flexible Display), a three-dimensional display (3D Display), e-ink display (e-ink display), it may include at least one of LED (Light Emitting Diode).

In addition, the display unit 130 displays network communication state information for each server received through the communication unit 110 under the control of the control unit 150, system performance information for each server, and log files used by processes running on the server. display related information, etc.

The audio output unit 140 outputs audio information included in a signal that has been subjected to predetermined signal processing by the control unit 150 . Here, the audio output unit 140 may include a receiver, a speaker, a buzzer, and the like.

In addition, the voice output unit 140 outputs a guide voice generated by the control unit 150 .

In addition, the voice output unit 140 provides network communication state information for each server received through the communication unit 110 under the control of the control unit 150, system performance information for each server, information used by a process running on the server, Outputs voice information (or sound effect) corresponding to log file related information.

The controller (or microcontroller unit (MCU) 150) executes overall control functions of the operating system process network connection relationship visualization device 100.

In addition, the control unit 150 executes overall control functions of the operating system process network connection relationship visualization device 100 using programs and data stored in the storage unit 120 . The controller 150 may include RAM, ROM, CPU, GPU, and a bus, and the RAM, ROM, CPU, and GPU may be connected to each other through a bus. The CPU may access the storage unit 120 and perform booting using the O/S stored in the storage unit 120, and use various programs, contents, data, etc. stored in the storage unit 120. You can perform a variety of actions by doing so.

In addition, the control unit 150 controls the communication unit 110 to obtain network communication status information for each server (or operating system), system performance information for each server, and processes running in the server from a plurality of servers (not shown). Collects (or receives) information related to log files in use (or information related to log files used by processes running on each server). Here, the network communication status information (or network communication status information/netstat data for each server) is a transmission control protocol, process ID (PID), and process name (or program name: Program Name) checked using the netstat command. ), local IP address (or source IP address), remote IP address (or destination IP address), local port number (or source port number), remote port number (or destination port number), status information (such as LISTEN, ESTABLISHED, SVN_SENT, SVN_RECV, TIME_WAIT, CLOSE_WAIT, LAST_ACK, CLOSED, etc.). In addition, the system performance information (or system performance information for each server) includes CPU utilization (or CPU utilization rate of the entire server/device), CPU utilization rate of the process (or CPU utilization rate used by the process), memory utilization rate of the process, and network utilization rate of the process. This includes the utilization rate, the CPU utilization rate of the process, and so on. At this time, the process ID (Process ID) is a logical number assigned when a process (or service) is started on an actual device (or terminal/server), and when a process is started, a designated port of the device is allocated and operated. can In addition, communication between processes is based on the continuous connection relationship between IP addresses and ports and the actual process (PID/Program name) assigned to the corresponding port. As the amount of communication increases, the number of connections per port increases, which It also means that the workload increases. In addition, the port is a virtual connection between programs (or processes) that communicate, and a computer (or terminal) or system on a network can be identified through an IP address, and an application program to be communicated through a port number can be identified. In addition, the port number is used to identify a process to receive data after data reaches the destination terminal (or destination server) through the MAC address (or host NIC identification) and IP address (or host identification). (For example, use port number 310 for MySQL and port number 51100 for IBM DB2). In addition, the log file related information includes a process owner, a process ID, a log file path being used by the process, a log file being used by the process, and the like. In addition, the log file includes IP address, log file path, date and time information, process normal start and normal stop messages, messages normally processed by the process, abnormal processes (eg, warnings, errors, etc.) ) including processed messages, etc.

That is, the server (or terminal) uses the netstat command (network statistics command) at preset time intervals through an agent installed on the server to obtain network communication status information related to the server, system performance information, and processes running on the server. Check (or collect) information related to log files in use (or information related to log files used by processes running on each server).

In addition, the server transmits the collected network communication status information, system performance information, log file related information used by the process running on the server, etc. related to the corresponding server to the destination (or destination IP address) preset in the corresponding agent. transmitted to the device 100 including the communication unit 110.

In addition, the control unit 150 controls the communication unit 110 to transmit network communication state information related to the server, system performance information, and log file related information used by a process running on the server (or It collects information related to log files used by processes running on each server).

As such, the control unit 150 collects network communication state information, system performance information, log file related information used by a process running on the server, and the like in relation to the plurality of servers through the communication unit 110, respectively. .

In addition, the control unit 150 controls one or more external processes in an individual process in relation to an individual process in the corresponding server for each server based on the collected (or received) network communication state information and system performance information for each of the plurality of servers. The number of connections made (or the total number of direct connections), the number of connections from one or more external processes to individual processes within that server (or the total number of indirect connections), and for each server, the number of connections from that server to one or more external servers (or server The total number of direct connections), the number of connections to the server from one or more external servers (or the total number of indirect connections to the server), etc. are checked (or calculated/calculated). Here, the external server represents another server connected to a specific server, and the external process represents a process within the other server connected to a process within the specific server.

In addition, the control unit 150 may include the collected network communication state information for each of the plurality of servers, the collected system performance information for each of the plurality of servers, and the number of connections per process (for example, calculated/calculated). Based on the total number of direct connections, the total number of indirect connections, etc.), a visualization analysis screen for correlations by process (or service) is created. At this time, the control unit 150 generates a visual analysis screen for the correlation for each process (or each service) based on the collected network communication state information for each of the plurality of servers and the collected system performance information for each of the plurality of servers. may be

Here, the correlation visualization analysis screen for each process (or the visualization analysis screen for connection relationships for each process/service) includes a plurality of nodes representing a process, a plurality of lines representing a connection relationship between a plurality of nodes, and the total number of connections between nodes (or total number of connections), etc. In addition, the node (or process node) is a polygon representing a process (eg, including a square, rectangle, rhombus, trapezoid, circle, ellipse, triangle, etc.), a local IP address, CPU utilization of the server including the process, Process ID (PID), process name (or application type/name), CPU utilization of the process, number of alerts/alarms, number of connections communicating with the process, port number the process is using (or port number), if the port number being used by the corresponding process is included among a plurality of preset port numbers, an application type by manufacturer corresponding to the corresponding port number (or an image/icon corresponding to the corresponding application type), on one side of the node ( Or the total number of indirect connections (or the total number of process indirect connections) that are configured over the boundary line area on one side of the polygon configured at the node and are connected to the process related to the corresponding node from one or more external processes, on the other side of the node (or the node The total number of direct connections (or the total number of process direct connections) connected to one or more other external processes in the process related to the node, the total number of direct connections according to self-call, etc. include At this time, the CPU usage rate of the server including the local IP address and the process displayed in the polygon of the node is determined by other information (eg, the process ID, the process name, the CPU usage rate of the process) by a preset process identifier. , the number of alerts/alarms, the number of connections communicating with the process, the port number being used by the process, etc.) and displayed (or separated). In addition, a connection relationship between the nodes may be displayed through a line (or a line including arrows), and the number of connections of each process (or the total number of connections between the nodes) may be displayed on one side of the line.

In addition, the control unit 150 displays the generated correlation visualization analysis screen for each process on the dashboard (or user interface/graphic user interface) displayed on the display unit 130 .

At this time, when a specific process is selected from among the visualization analysis screens for correlation relationships for each process displayed on the display unit 130, the controller 150 displays a visualization analysis screen for visualization analysis for each server related to the selected specific process on the display unit 130. can also be displayed on

In addition, the controller 150 may include the collected network communication state information for each of the plurality of servers, the collected system performance information for each of the plurality of servers, and the confirmed (or calculated/calculated) number of connections for each server (for example, Based on the total number of direct connections to servers, total numbers of indirect connections to servers, etc.) In this case, the control unit 150 may create a correlation visualization analysis screen for each server based on the collected network communication state information for each of the plurality of servers and the collected system performance information for each of the plurality of servers.

Here, the correlation visualization analysis screen for each server (or the visualization analysis screen for connection relationships for each server) includes a plurality of other nodes representing the server, a plurality of other lines representing the connection relationship between the plurality of other nodes, and the total number of connections between the other nodes ( or the total number of connections). In addition, the other node (or server node) may include a polygon representing a server (including, for example, a square, rectangle, rhombus, trapezoid, circle, ellipse, triangle, etc.), a local IP address, a server CPU utilization rate, and an alarm/alarm. number, the number of connections in communication with the server, the port number the server is using, and if the port number the server is using is included among the plurality of preset port numbers, the type of application (or the type of application) by manufacturer corresponding to the corresponding port number image / icon corresponding to ), configured on one side of another node (or across the border area on one side of the polygon configured on the other node) and connected from one or more external servers to the server related to the other node, the total number of server indirect connections, It is configured on the other side of the other node (or across the boundary area of the other side of the polygon configured in the other node) and includes the total number of server direct connections connected to one or more external servers from the server related to the other node. At this time, the local IP address displayed in the polygon of the other node and the CPU usage rate of the server are other information (eg, the number of alerts/alarms, the number of connections in communication with the server, the server may be displayed separately from (or separated from) the port number in use, etc.). In addition, a connection relationship may be displayed between the different nodes through another line (or another line including an arrow), and the number of connections of each server (or the total number of connections between the other nodes) may be displayed on one side of the other line. .

In addition, the control unit 150 displays the generated correlation visualization analysis screen for each server on the dashboard (or user interface/graphic user interface) displayed on the display unit 130 .

At this time, when a specific server is selected from among the visualization analysis screens for correlation relationships by servers displayed on the display unit 130, the controller 150 displays a visualization analysis screen of correlation relationships by process related to the selected specific server on the display unit 130. can also be displayed on

In addition, when any one of the log live tail menu or the log reader menu displayed on one side of the dashboard of the display unit 130 is selected, the control unit 150 is used by the collected process running on the server and A log analysis screen corresponding to the selected menu is created based on log file related information (or log file related information used by processes running on each server). At this time, the log live tail menu is a menu for providing log file related information related to a specific process collected in real time, and the log reader menu is a menu for providing past log file information of a currently running process. Here, the log analysis screen includes a process owner, process ID, log file path used by the process, log file used by the process, and the like. In addition, the log file includes IP address, log file path, date and time information, process normal start and normal stop messages, messages processed normally by the process, and messages processed abnormally by the process (including warnings and errors, for example). Include etc.

That is, when the log live tail menu is selected from the log live tail menu or the log reader menu displayed on one side of the dashboard of the display unit 130, the controller 150 collects log file related information in real time. A process list including information on the above processes is displayed on the display unit 130 .

In addition, when a specific process is selected from information about one or more processes included in the process list displayed on the display unit 130, the controller 150 includes real-time log file related information in relation to the selected specific process. Create log analysis screen (or real-time log analysis screen).

In addition, when the log reader menu is selected from the log live tail menu or the log reader menu displayed on one side of the dashboard of the display unit 130, the control unit 150 includes information about one or more collected processes. Another process list (or process list) is displayed on the display unit 130 .

In addition, when another specific process is selected from among information on one or more processes included in the other process list displayed on the display unit 130, the control unit 150 controls log files collected in relation to the selected other specific process. Creates a log analysis screen (or past log analysis screen) containing information.

Also, the controller 150 displays the generated log analysis screen on the dashboard (or user interface/graphic user interface) displayed on the display unit 130 . At this time, when receiving updated log file related information in relation to a corresponding specific process (or other specific process) in real time, the control unit 150 controls the corresponding specific process (or other specific process) received in real time The updated log file related information may be reflected (or applied) to the log analysis screen in real time and displayed.

In the embodiment of the present invention, the operating system process network connection relationship visualization device 100 processes information collected from the plurality of servers in the form of a dedicated app or website to visualize and analyze the relationship by process (or by service). , it can perform the function of providing a visual analysis screen of relational relationship by server.

In this way, process connection relationship information about connection relationships between servers and/or connections between processes may be collected, and process connection relationship information provided by visualizing the collected process connection relationship information may be provided.

In addition, in this way, a list of processes being used by a process may be confirmed, and process connection relation information for inquiring log file contents currently being recorded in real time and/or past log file contents may be provided.

Hereinafter, a method for visualizing operating system process network connection relationships according to the present invention will be described in detail with reference to FIGS. 1 to 7 .

2 is a flowchart illustrating a method for visualizing an operating system process network connection relationship according to an embodiment of the present invention.

First, the communication unit 110 provides network communication state information for each server from a plurality of servers (not shown), system performance information for each server, and log file related information used by a process running on the server (or used by a process running on each server). log file related information), etc. are collected (or received) respectively. Here, the network communication status information (or network communication status information/netstat data for each server) includes the transmission control protocol, process ID (PID), process name, local IP address, and remote IP that are checked using the netstat command. It includes address, local port number, remote port number, and status information (eg LISTEN, ESTABLISHED, SVN_SENT, SVN_RECV, TIME_WAIT, CLOSE_WAIT, LAST_ACK, CLOSED, etc.). In addition, the system performance information (or system performance information for each server) includes CPU utilization (or CPU utilization rate of the entire server/device), CPU utilization rate of the process (or CPU utilization rate used by the process), memory utilization rate of the process, and network utilization rate of the process. This includes the utilization rate, the CPU utilization rate of the process, and so on. In addition, the log file related information includes a process owner, a process ID, a log file path being used by the process, a log file being used by the process, and the like. In addition, the log file includes IP address, log file path, date and time information, process normal start and normal stop messages, messages normally processed by the process, abnormal processes (eg, warnings, errors, etc.) ) including processed messages, etc.

That is, the server (or terminal) checks (or collects) network communication status information, system performance information, etc. related to the server using the netstat command (network statistics command) at preset time intervals through an agent installed on the server. do.

In addition, the server transmits the collected network communication status information, system performance information, etc. related to the corresponding server to the device 100 including the communication unit 110 corresponding to the destination (or destination IP address) preset in the corresponding agent. send.

In addition, the communication unit 110 receives (or collects) network communication status information, system performance information, and the like related to the corresponding server transmitted from the server.

As such, the communication unit 110 collects network communication status information, system performance information, and the like in relation to the plurality of servers, respectively.

For example, the first communication unit 110 transmits an 11th network communication state from an 11th server (not shown) to a 16th server (not shown) connected to a network with the first server 100 including the corresponding first communication unit. Information to 16th network communication state information, 11th system performance information to 16th system performance information, 1st log file related information to 5th log file used by the 1st to 5th processes running on the 11th server, respectively The related information, the 11th log file-related information to the 13th log file-related information used by the 11th to 13th processes running on the 12th server, and the 21st to 22nd processes running on the 13th server, respectively Information related to the 21st to 22nd log files in use, information related to the 31st to 33rd log files used by the 31st to 33rd processes running on the 14th server, respectively, Information related to the 41st to 44th log files used by the 41st to 44th processes running on the 15th server, respectively, and information used by the 51st to 53rd processes running on the 16th server, respectively The 51st log file related information to the 53rd log file related information are respectively received (S210).

Thereafter, the controller 150 connects an individual process to one or more external processes in relation to an individual process within the corresponding server for each server based on the collected (or received) network communication state information and system performance information for each of the plurality of servers. one (or the total number of direct connections), the number of connections from one or more external processes to individual processes within that server (or the total number of indirect connections), and for each server, the number of connections from that server to one or more external servers (or server direct connections). The total number of connections), the number of connections to the server from one or more external servers (or the total number of indirect connections to the server), etc. are checked (or calculated/calculated). Here, the external server represents another server connected to a specific server, and the external process represents a process within the other server connected to a process within the specific server.

For example, the first control unit 150 controls the first server and the 11th network communication status information based on the received 11th network communication status information to 16th network communication status information and 11th system performance information to 16th system performance information. Information indicating a connection relationship between servers to the sixteenth server and information indicating a connection relationship between processes in each server are checked (S220).

Thereafter, the control unit 150 controls the collected network communication state information for each of the plurality of servers, the collected system performance information for each of the plurality of servers, and the confirmed (or calculated/calculated) number of connections for each process (for example, Based on the total number of direct connections, the total number of indirect connections, etc.), a visualization analysis screen for correlations by process (or service) is created. Here, the correlation visualization analysis screen for each process (or the visualization analysis screen for connection relationships for each process/service) includes a plurality of nodes representing a process, a plurality of lines representing a connection relationship between a plurality of nodes, and the total number of connections between nodes (or total number of connections), etc. In addition, the node (or process node) is a polygon representing a process (eg, including a square, rectangle, rhombus, trapezoid, circle, ellipse, triangle, etc.), a local IP address, CPU utilization of the server including the process, Process ID (PID), process name (or application type/name), CPU utilization of the process, number of alerts/alarms, number of connections communicating with the process, port number the process is using (or port number), if the port number in use by the corresponding process is included among a plurality of preset port numbers, application type by manufacturer corresponding to the corresponding port number (or image/icon corresponding to the corresponding application type), configured on one side of the node and the total number of indirect connections (or the total number of process indirect connections) from one or more external processes to processes associated with that node, and direct connections configured on the other side of the node from processes associated with that node to one or more other external processes. It includes the total number (or the total number of process direct connections), the total number of direct connections by self-call, and the like. In addition, a connection relationship between the nodes may be displayed through a line (or a line including arrows), and the number of connections of each process (or the total number of connections between the nodes) may be displayed on one side of the line.

In addition, the controller 150 displays the generated correlation visualization analysis screen for each process on the dashboard (or user interface/graphic user interface) displayed on the display unit 130 .

At this time, when a specific process is selected from among the visualization analysis screens for correlation relationships for each process displayed on the display unit 130, the controller 150 displays a visualization analysis screen for visualization analysis for each server related to the selected specific process on the display unit 130. can also be displayed on

As an example, the first control unit may provide the collected 11th network communication state information to 16th network communication state information, 11th system performance information to 16th system performance information, and information indicating a connection relationship between processes in each of the confirmed servers. Based on the above, a correlation visualization analysis screen for each first process is created.

In addition, as shown in FIG. 3 , the first control unit displays the generated correlation visualization analysis screen 300 for each first process on the first display unit 130 (S230).

In addition, the controller 150 may include the collected network communication state information for each of the plurality of servers, the collected system performance information for each of the plurality of servers, and the confirmed (or calculated/calculated) number of connections for each server (for example, Based on the total number of direct connections to servers, total numbers of indirect connections to servers, etc.) Here, the correlation visualization analysis screen for each server (or the visualization analysis screen for connection relationships for each server) includes a plurality of other nodes representing the server, a plurality of other lines representing the connection relationship between the plurality of other nodes, and the total number of connections between the other nodes ( or the total number of connections). In addition, the other node (or server node) may include a polygon representing a server (including, for example, a square, rectangle, rhombus, trapezoid, circle, ellipse, triangle, etc.), a local IP address, a server CPU utilization rate, and an alarm/alarm. number, the number of connections in communication with the server, the port number the server is using, and if the port number the server is using is included among the plurality of preset port numbers, the type of application (or the type of application) by manufacturer corresponding to the corresponding port number corresponding image/icon), the total number of server indirect connections configured on one side of another node and connected from one or more external servers to the server related to that other node, configured on the other side of another node and connected to the server related to that other node It includes the total number of server direct connections to one or more external servers. In addition, a connection relationship may be displayed between the different nodes through another line (or another line including an arrow), and the number of connections of each server (or the total number of connections between the other nodes) may be displayed on one side of the other line. .

In addition, the control unit 150 displays the generated correlation visualization analysis screen for each server on the dashboard (or user interface/graphic user interface) displayed on the display unit 130 .

At this time, when a specific server is selected from among the visualization analysis screens for correlation relationships by servers displayed on the display unit 130, the controller 150 displays a visualization analysis screen of correlation relationships by process related to the selected specific server on the display unit 130. can also be displayed on

For example, the first control unit controls the collected 11th network communication state information to 16th network communication state information, 11th system performance information to 16th system performance information, the identified first server and the 11th server to 11th system performance information. Based on the information indicating the connection relationship between the 16th servers, a correlation visualization analysis screen for each 1st server is created.

In addition, as shown in FIG. 4 , the first control unit displays the generated correlation visualization analysis screen 400 for each first server on the first display unit (S240).

In addition, when any one of the log live tail menu or the log reader menu displayed on one side of the dashboard of the display unit 130 is selected, the control unit 150 is used by the collected process running on the server and A log analysis screen corresponding to the selected menu is created based on log file related information (or log file related information used by processes running on each server). At this time, the log live tail menu is a menu for providing log file related information related to a specific process collected in real time, and the log reader menu is a menu for providing past log file information of a currently running process. Here, the log analysis screen includes a process owner, process ID, log file path used by the process, log file used by the process, and the like. In addition, the log file includes IP address, log file path, date and time information, process normal start and normal stop messages, messages processed normally by the process, and messages processed abnormally by the process (including warnings and errors, for example). Include etc.

That is, when the log live tail menu is selected from the log live tail menu or the log reader menu displayed on one side of the dashboard of the display unit 130, the controller 150 collects log file related information in real time. A process list including information on the above processes is displayed on the display unit 130 .

In addition, when a specific process is selected from information about one or more processes included in the process list displayed on the display unit 130, the controller 150 includes real-time log file related information in relation to the selected specific process. Create log analysis screen (or real-time log analysis screen).

In addition, when the log reader menu is selected from the log live tail menu or the log reader menu displayed on one side of the dashboard of the display unit 130, the control unit 150 includes information about one or more collected processes. A list of other processes is displayed on the display unit 130 .

In addition, when another specific process is selected from among information on one or more processes included in the other process list displayed on the display unit 130, the control unit 150 controls log files collected in relation to the selected other specific process. Creates a log analysis screen (or past log analysis screen) containing information.

Also, the controller 150 displays the generated log analysis screen on the dashboard (or user interface/graphic user interface) displayed on the display unit 130 . At this time, when receiving updated log file related information in relation to a corresponding specific process (or other specific process) in real time, the control unit 150 controls the corresponding specific process (or other specific process) received in real time The updated log file related information may be reflected (or applied) to the log analysis screen in real time and displayed.

For example, when the log live tail menu 510 displayed on one side of the dashboard of the first display unit of FIG. 5 is selected, as shown in FIG. 6 , the first control unit displays log file related information in real time. A process list 600 including information on one or more processes being collected is displayed on the first display unit.

In addition, when a first process (eg user1, PID 1981) 610 is selected from the process list 600 being displayed on the first display unit, the first control unit displays the selected first process in real time. A first log analysis screen including information related to the first log file being collected is generated.

Also, as shown in FIG. 7 , the first control unit displays the generated first log analysis screen 700 on the first display unit (S250).

As described above, an embodiment of the present invention collects process connection relationship information about connection relationships between servers and/or connections between processes, and provides process connection relationship information that visualizes and provides the collected process connection relationship information. Thus, it provides a visualized dashboard that can intuitively identify and analyze the server/process connection relationship, and can build a new type of process operation and management system.

In addition, as described above, the embodiment of the present invention checks the process list being used by the process, and provides process connection relationship information for querying log file contents being recorded in real time and/or past log file contents, , If there is a problem with the process, find the server running the process, log in to the found server, find the process again, find the log file that the process is writing, and avoid the inconvenience of searching for the log contents of the problem. You can immediately check the contents of the log file related to the process you want, so you can improve the efficiency of server and process operation.

The foregoing may be modified and modified by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention, but to explain, and the scope of the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be construed according to the claims below, and all technical ideas within the equivalent range should be construed as being included in the scope of the present invention.

100: operating system process network connection relationship visualization device
110: communication unit 120: storage unit
130: display unit 140: audio output unit
150: control unit

Claims (10)

a communication unit that collects network communication status information for each server and system performance information for each server from a plurality of servers;
a control unit generating a visualization analysis screen of correlation for each process based on the collected network communication state information for each of the plurality of servers and system performance information for each of the plurality of servers; and
An operating system process network connection relationship visualization device comprising a display unit for displaying, by the control unit, a correlation visualization analysis screen for each of the generated processes. According to claim 1,
The network communication state information for each server,
at least one of a transmission control protocol, a process ID (PID), a process name, a local IP address, a remote IP address, a local port number, a remote port number, and status information;
The system performance information for each server,
An operating system process network connection relationship visualization device comprising at least one of CPU utilization rate, CPU utilization rate of the process, memory utilization rate of the process, network utilization rate of the process, and CPU utilization rate of the process. a communication unit that collects network communication status information for each server and system performance information for each server from a plurality of servers;
a control unit for generating a visualization analysis screen for relational relationships for each server based on the collected network communication state information for each of the plurality of servers and system performance information for each of the plurality of servers; and
An operating system process network connection relationship visualization device comprising a display unit for displaying, by the control unit, a visualization analysis screen of the generated association relationship for each server. Collecting, by a communication unit, network communication status information for each server and system performance information for each server from a plurality of servers, respectively;
generating, by a controller, a correlation visualization analysis screen for each process based on the collected network communication state information for each of a plurality of servers and system performance information for each of a plurality of servers; and
and controlling, by the control unit, to display the generated correlation visualization analysis screen for each process on a display unit. According to claim 4,
The step of generating the correlation visualization analysis screen for each process,
The total number of direct connections, which is the number of connections to one or more external processes in an individual process in relation to an individual process in the server for each server based on the collected network communication state information for each of the plurality of servers and system performance information for each of the plurality of servers; checking the number of connections per process including the total number of indirect connections, which is the number of connections from one or more external processes to individual processes in the server; and
and generating a correlation visualization analysis screen for each process based on the collected network communication state information for each of the plurality of servers, the collected system performance information for each of the plurality of servers, and the number of connections for each of the identified processes. A way to visualize operating system process network connection relationships. According to claim 4,
The correlation visualization analysis screen for each process,
An operating system process network connection relationship visualization method comprising a plurality of nodes representing processes, a plurality of lines representing connection relationships between the plurality of nodes, and the total number of connections between nodes. According to claim 6,
The node is
The polygon representing the process, the local IP address, the CPU utilization of the server containing the process, the process ID, the process name, the CPU utilization of the process, the number of alarms/alarms, the number of connections communicating with the process, the port number the process is using, the preset Among the plurality of port numbers, if the port number being used by the process is included, the application type by manufacturer corresponding to the port number, the total number of indirect connections configured on one side of the node and connected to the process related to the node from one or more external processes. , an operating system process network comprising at least one of a total number of direct connections configured on the other side of the node and connected to one or more other external processes in a process related to the node and a total number of direct connections according to self-calls. How to visualize connectivity relationships. Collecting, by a communication unit, network communication status information for each server and system performance information for each server from a plurality of servers, respectively;
generating, by a controller, a correlation visualization analysis screen for each server based on the collected network communication state information for each of a plurality of servers and system performance information for each of a plurality of servers; and
The operating system process network connection relationship visualization method further comprising the step of controlling, by the control unit, to display the generated correlation visualization analysis screen for each server on a display unit. According to claim 8,
The server-specific relationship visualization analysis screen,
It consists of a plurality of other nodes representing the server, a plurality of other lines representing the connection relationship between the plurality of other nodes, and the total number of connections between the other nodes,
The other node is
The polygon representing the server, the local IP address, the server's CPU utilization, the number of alarms/alarms, the number of connections communicating with the server, the port number the server is using, and the port number the server is using among multiple preset port numbers. The type of application by manufacturer corresponding to the port number, the total number of server indirect connections configured on one side of the other node and connected to the server related to the other node from one or more external servers, and configured on the other side of the other node and the other A method for visualizing an operating system process network connection relationship comprising at least one of the total number of server direct connections connected to one or more external servers from a server related to a node. A communication unit that collects information related to log files used by processes running on each server from a plurality of servers;
a display unit displaying a log live tail menu or a log reader menu on one side of the dashboard; and
When any one of the log live tail menu or the log reader menu displayed on one side of the dashboard of the display unit is selected, the control unit based on the collected log file-related information used by the running process for each server. An operating system process network connection relationship visualization device comprising a control unit that generates a log analysis screen and controls to display the generated log analysis screen on the display unit.

Images