TW202011725A - Method for generating network event warning and network management device using the same - Google Patents

Abstract

The disclosure provides a method for generating a network event warning and a network management device using the same method. The method includes: scanning a management information base (MIB) of specific equipment based on a plurality of object identifiers (OID) recorded in an editable file to retrieve a plurality of object values corresponding to the OIDs, wherein the OIDs correspond to a specific trap of the specific equipment; generating a programmable profile for monitoring the specific trap based on the object values; when an unknown trap is received, retrieving trap information corresponding to the object values; when the trap information matches event rules defined in the programmable profile, determining the unknown trap is the specific trap and sending an event warning of the unknown trap according to the event rules.

Description

Method for generating network event alarm and its network management device

The invention relates to a method and system for generating an alarm, and in particular to a method and network management device for generating an alarm for a network event.

Because the network device event alarm judgment process is quite complicated and must be executed in accordance with the differences of various types of heterogeneous network devices, it is difficult to centrally manage the rule list of all device events. Specifically, in the judgment process of the conventional active event reward mechanism, a dedicated event warning judgment process will be developed for each type of device. In this case, if you need to modify the event rules of the device, you must re-plan the code again after completing the relevant modification logic analysis, which leads to a lower efficiency of the overall operation process.

Therefore, for those skilled in the art, how to simplify the above-mentioned network device alarm event judgment process to improve the overall operation efficiency is actually an important issue.

In view of this, the present invention provides a method for generating a network event alarm and its network management device, which can be used to solve the above technical problems and improve the overall operation efficiency.

The invention provides a method for generating a network event alarm, including: scanning a management information database of a specific device based on a plurality of first object identification codes recorded in an editable document file to find out from the management information database A plurality of first object values corresponding to the first object identification code, wherein the first object identification code corresponds to a first specific trap of a specific device; based on the first object value, a first specific trap is generated for monitoring A first programmable profile, where the first programmable profile includes a plurality of first event rules corresponding to the aforementioned first object values; when an unknown trap is received, the corresponding is extracted from the unknown trap A plurality of first trap information in the first object value; when the first trap information meets the first event rule defined in the first programmable profile, the unknown trap is determined as the first specific trap , And correspondingly send an event alarm of unknown trapping according to the aforementioned first event rule defined in the first programmable profile.

The invention provides a network management device, including a storage circuit and a processor. The storage circuit stores multiple modules. The processor is coupled to the storage circuit and accesses the aforementioned module to perform the following steps: scan a management information database of a specific device based on a plurality of first object identification codes recorded in an editable document file, from the management information database Find a plurality of first object values corresponding to the first object identification code, wherein the first object identification code corresponds to a first specific trap of a specific device; based on the first object value, a first object value is generated for monitoring the first object value A first programmable profile for a specific trap, where the first programmable profile includes a plurality of first event rules corresponding to the aforementioned first object values; when an unknown trap is received, the trap is unknown Extract multiple pieces of first trap information corresponding to the value of the first object; when the first trap information meets the first event rule defined in the first programmable profile, it is determined that the unknown trap is the first Specific trap, and correspondingly send an event alarm of unknown trap according to the aforementioned first event rule defined in the first programmable profile.

Based on the above, the method for generating a network event alarm and the network management device thereof provided by the present invention allow network administrators to record information about a first specific trap to be monitored on a specific device in an editable document file. Then, the network management device can scan the management information database of each device according to the aforementioned editable document file to generate a corresponding programmable profile (which includes one or more event rules), which can then be used as an unknown trap Comparison basis for judging whether to send related event alarms.

In order to make the above-mentioned features and advantages of the present invention more obvious and understandable, the embodiments are specifically described below in conjunction with the accompanying drawings for detailed description as follows.

Please refer to FIG. 1, which is a schematic diagram of a network management system according to an embodiment of the present invention. In FIG. 1, the network management system 10 includes a network management device 100 and devices 111, 112, ..., 11n. In different embodiments, the devices 111-11n may be various network devices, and the network management apparatus 100 may be used to receive traps reported by the devices 111-11n, and the received traps meet certain requirements. In the event rules, relevant event alarms are sent for relevant network management personnel to take corresponding measures such as maintenance or debugging.

As shown in FIG. 1, the network management device 100 includes a storage circuit 102 and a processor 104. The storage circuit 102 is, for example, a memory, a hard disk, or any other device that can be used to store data, and can be used to record multiple codes or modules. The processor 104 is coupled to the storage circuit 102, and may be a general-purpose processor, a special-purpose processor, a conventional processor, a digital signal processor, a plurality of microprocessors, or one or more combined digital signal processing The core of the processor is the microprocessor, controller, microcontroller, application specific integrated circuit (ASIC), field programmable gate array (FPGA), any other kind of integrated circuit, State machine, processor based on Advanced Reduced Instruction Set Machine (Advanced RISC Machine, ARM) and similar products.

In this case, the processor 104 can access the module in the storage circuit 102 to execute the method for generating a network event alarm provided by the present invention, which will be further described below.

Please refer to FIG. 2, which is a flowchart of a method for generating a network event alarm according to an embodiment of the invention. The method of this embodiment can be executed by the network management device 100 of FIG. 1, and the details of each step of the method will be described below with the components shown in FIG. 1.

First, in step S210, the processor 104 may scan the management information base (MIB) of a specific device based on a plurality of first object identifiers (OIDs) recorded in the editable document file, from A plurality of first object values corresponding to the first object identification code are found in the MIB, wherein the aforementioned first object identification code corresponds to the first specific trap of the specific device. Specifically, the aforementioned editable document file is, for example, an electronic spreadsheet (for example, a .csv file) that can be edited by a network administrator or other related users, but it is not limited thereto.

In different embodiments, the network administrator can adjust the content of the above-mentioned editable file according to the limit setting to be monitored. For ease of description, the above-mentioned set limit to be monitored will be referred to as the first specific set limit, and the above-mentioned specific device will be assumed to be the device 111, but it is not intended to limit the possible implementation manners of the present invention. For example, the network administrator can first find out the name and OID of the first specific trap in the device 111, and fill this information into the editable document file.

In an embodiment, the name of the first specific trap may be represented by an index value, that is, the network administrator may assign an index value corresponding to the name of the first specific trap (for example, a protocol data unit (PDU) ) Fill in the above-mentioned editable document file, so that when the processor 104 scans the MIB, it can find out a plurality of first object values related to the first specific trap according to the index value. In other words, network administrators only need to have simple document processing techniques (for example, knowledge of editing spreadsheets) to adjust the traps and related object values to be monitored, so there is no need to carry out the planning code in the conventional method. Waiting for more complex behaviors.

In another embodiment, assuming that the network administrator also needs to monitor the second specific setting limit on the device 111, the network administrator may also fill in the above-mentioned editable document file with the relevant information of the second specific setting. The processor 104 reads and then finds out a plurality of second object values related to the second specific trap from the MIB, but the invention may not be limited to this.

In step S220, the processor 104 may generate a first programmable profile for monitoring the first specific trap based on the first object value. In this embodiment, the aforementioned first programmable profile is, for example, a YAML file, but in other embodiments, the designer may use other programming languages to present the aforementioned first programmable profile according to requirements.

Please refer to FIG. 3, which is a schematic diagram of a first programmable configuration file according to an embodiment of the present invention. As shown in FIG. 3, the first programmable profile 300 may include an event sending and receiving OID 310, an event name 320, an event associated object 330, an event level 340, an event description 350, and a PDU object value 360 (hereinafter collectively referred to as the first event rule) . In one embodiment, after the processor 104 reads the above-mentioned editable document file edited by the network administrator, a first programmable configuration file 300 having the structure shown in FIG. 3 can be generated based on the content therein. After that, the first programmable configuration file 300 can be stored in the directory of the service engine used by the network management device 100 to manage the devices 111-11n. In this way, when the network management apparatus 100 executes the aforementioned service engine to monitor the trapping of the device 111, it only needs to read the first programmable configuration file 300 to know that the network administrator wants to be on the device 111 Information about the first specific trap monitored.

In addition, if there is relevant information associated with the second specific trap in the editable document file, the processor 104 may also generate a second related to the second specific trap after reading the editable document file Programmable configuration file (not shown), and its structure may be similar to the first programmable configuration file. In addition, the second programmable configuration file can also record event sending and receiving, event name, event related object, event level, event description and PDU object value (hereinafter collectively referred to as the second event rule), and can be stored in the network management device 100 is used to manage the service engines 111~11n in the directory of the service engine. In this way, when the network management apparatus 100 executes the aforementioned service engine to monitor the trapping on the device 111, it only needs to read the second programmable configuration file to know that the network administrator wants to monitor on the device 111 Information about the second specific trap.

Please refer to FIG. 4, which is a schematic diagram of an editable document file according to an embodiment of the present invention. In FIG. 4, the network administrator can fill in the corresponding object in the field of the editable document file 400 (for example, electronic spreadsheet) as shown in the trapped state on the device (for example, device 112). value. Thereby, the processor 104 can generate another programmable configuration file having a similar structure to the first programmable configuration file 300 of FIG. 3 after reading the editable document file 400, and the other programmable The configuration file can also be stored in the directory of the service engine used by the network management device 100 to manage the devices 111-11n. In this way, when the network management apparatus 100 executes the aforementioned service engine to monitor the trapping on the device 112, it is only necessary to read the above another programmable configuration file to know that the network administrator wants to be on the device 112 Information about monitored trapping.

Please refer to FIG. 2 again. In step S230, when an unknown trap is received, the processor 104 may retrieve a plurality of first trap information corresponding to the first object value from the unknown trap, such as an unknown trap device Enterprise OID, Trap OID and PDU object value etc. Furthermore, in step S240, when the first trap information meets the first event rule defined in the first programmable profile 300, it is determined that the unknown trap is the first specific trap, and the first programmable setting The aforementioned first event rule defined in the file 300 accordingly sends an event alarm of unknown trapping. For example, if the values of the Enterprise OID, Trap OID, and PDU object of the device with unknown trapping all match the corresponding content recorded in the first programmable profile 300, the processor 104 can determine that the unknown trapping is the network administrator's desire to monitor The first specific trap.

It should be understood that, since the above first event rules (such as device Enterprise OID, Trap OID, and PDU object values) can be written into the editable document file by the network administrator as required, the network administrator can easily adjust the foregoing The content of the editable document file can be adjusted accordingly to adjust the thickness of the above-mentioned comparison mechanism accordingly, without the need to perform more complicated activities such as writing code.

In an embodiment, after determining that the unknown trap is the first specific trap, the processor 104 may send an event alarm of the unknown trap. For example, the processor 104 may send an event alarm of an unknown trap according to the event title, event level, event description, and event target defined in the first programmable profile 300 for reference by relevant network management personnel. In this way, the network management personnel can know that a specific device (for example, device 111) may have a problem based on the content of the event alarm, and then can take corresponding maintenance or adjustment measures.

In an embodiment, if the problem on the device 111 has been resolved, the device 111 may automatically send a clear trap message to inform the network management device 100 to clear the unknown trap.

In other embodiments, if the unknown trap does not match the first specific trap, the processor 104 may continue to determine whether the unknown trap corresponds to the second specific trap, that is, to determine the first trap of the unknown trap Whether the information complies with multiple second event rules defined in the second programmable profile. If yes, the processor 104 can send an event alarm of unknown trapping according to the event title, event level, event description, and event target defined in the second programmable profile for reference by relevant network management personnel.

In summary, the method and network management device for generating network event alarms provided by the present invention can allow network administrators to easily record various types of traps and related event rules to be monitored on different devices in editable In the file. Then, the network management device can scan the MIB of each device according to the aforementioned editable file file to generate a corresponding programmable configuration file, which can be used as a comparison basis for determining whether to send related event alarms when an unknown trap is received.

Moreover, when it is determined that the unknown trap corresponds to a specific trap to be monitored, embodiments of the present invention may also be based on the event title, event level, event description and event defined in the programmable profile corresponding to the specific trap The target is to send an event alert for unknown traps for reference by relevant network management personnel. In this way, the network management personnel can know that the specific device may have a problem based on the content of the event alarm, and then can take corresponding maintenance or adjustment measures.

In this way, the embodiments of the present invention can effectively increase the flexibility and convenience of network management personnel management equipment, and can also adjust the thickness of event rules according to requirements. In other words, the embodiments of the present invention provide a mechanism that allows network administrators to easily centrally manage the event rules of various types of network devices, so that it is not necessary to design special network devices in response to different network devices as is common practice. Event alarm judgment process, which can improve management efficiency and convenience accordingly.

Although the present invention has been disclosed as above with examples, it is not intended to limit the present invention. Any person with ordinary knowledge in the technical field can make some changes and modifications without departing from the spirit and scope of the present invention. The scope of protection of the present invention shall be subject to the scope defined in the appended patent application.

10: Network management system 100: Network management device 102: Storage circuit 104: Processors 111, 112, ..., 11n: Device 300: First programmable profile 310: Event sending and receiving OID 320: Event name 330: Event correlation Object 340: Event Level 350: Event Description 360: PDU Object Value 400: Editable Document File S210~S240: Steps

FIG. 1 is a schematic diagram of a network management system according to an embodiment of the invention. FIG. 2 is a flowchart of a method for generating a network event alarm according to an embodiment of the invention. FIG. 3 is a schematic diagram of a first programmable profile according to an embodiment of the invention. 4 is a schematic diagram of an editable document file according to an embodiment of the invention.

S210~S240: Steps

Claims (10)

A method for generating a network event alarm includes: scanning a management information database of a specific device based on a plurality of first object identification codes recorded in an editable document file to find the corresponding information from the management information database A plurality of first object values of the first object identification codes, wherein the first object identification codes correspond to a first specific trap of the specific device; generated based on the first object values for monitoring the first object value A first programmable profile for a specific trap, where the first programmable profile includes a plurality of first event rules corresponding to the first object values; when an unknown trap is received, from the Extract a plurality of first trap information corresponding to the first object values from the unknown trap; when the first trap information meets the first event rules defined in the first programmable profile, It is determined that the unknown trap is the first specific trap, and an event alarm of the unknown trap is sent accordingly according to the first event rules defined in the first programmable profile. The method as described in item 1 of the patent application scope, wherein the editable document file is an electronic spreadsheet. The method as described in item 1 of the patent application scope, wherein the first programmable profile includes an event sending and receiving object identifier, an event name, an event-related object, an event level, an event description, and an agreement data unit object value. The method as described in item 1 of the patent application scope further includes: scanning the management information database of the specific device based on the plurality of second object identification codes recorded in the editable document file to remove the management information database from the management information database Find a plurality of second object values corresponding to the second object identification codes, wherein the second object identification codes correspond to a second specific trapping of the specific device; based on the second object values, generate Monitoring a second programmable profile of the second specific trap, where the second programmable profile includes a plurality of second event rules corresponding to the values of the second objects. The method as described in item 4 of the patent application scope further includes: when the first trap information does not conform to the first event rules defined in the first programmable profile, determining the first settings Whether the trap information conforms to the second event rules defined in the second programmable profile; if so, determine that the unknown trap is the second specific trap and based on the definition in the second programmable profile The second event rules send the event trap of the unknown trap accordingly. A network management device includes: a storage circuit storing a plurality of modules; and a processor coupled to the storage circuit, accessing the modules to perform the following steps: based on the number of records in an editable document file A first object ID scans a management information database of a specific device to find multiple first object values corresponding to the first object IDs from the management information database, wherein the first objects The identification code corresponds to a first specific setting of the specific device; based on the first object values, a first programmable setting file for monitoring the first specific setting is generated, wherein the first programmable setting The file includes a plurality of first event rules corresponding to the first object values; when an unknown trap is received, a plurality of first trap information corresponding to the first object values is extracted from the unknown trap ; When the first trap information meets the first event rules defined in the first programmable profile, determine the unknown trap as the first specific trap, and based on the first programmable The first event rules defined in the configuration file correspondingly send an event alarm of the unknown trap. The network management device as described in item 6 of the patent application scope, wherein the editable document file is an electronic spreadsheet. The network management device as described in item 6 of the patent application scope, wherein the programmable configuration file includes event sending and receiving object identification codes, event names, event related objects, event levels, event descriptions, and protocol data unit object values. The network management device as described in item 6 of the scope of the patent application further includes: scanning the management information database of the specific device based on the plurality of second object identification codes recorded in the editable document file to extract the management information from the management information Find a plurality of second object values corresponding to the second object identification codes in the database, wherein the second object identification codes correspond to a second specific trap of the specific device; based on the second object values A second programmable profile for monitoring the second specific trap is generated, wherein the second programmable profile includes a plurality of second event rules corresponding to the values of the second objects. The network management device described in item 9 of the scope of the patent application further includes: when the first trapping information does not conform to the first event rules defined in the first programmable profile, determining the ones Whether the first trap information conforms to the second event rules defined in the second programmable profile; if so, determine that the unknown trap is the second specific trap and based on the second programmable profile The second event rules defined in correspondingly send the event trap of the unknown trap.

Images