WO2007069702A1

WO2007069702A1 - Network management information collection method and network management system

Info

Publication number: WO2007069702A1
Application number: PCT/JP2006/324980
Authority: WO
Inventors: Glenn Mansfield Keeni
Original assignee: Cyber Solutions Inc.
Priority date: 2005-12-15
Filing date: 2006-12-14
Publication date: 2007-06-21

Abstract

Provided is a method for reducing a network load and effectively collecting management information in a network management system for collecting management information held in a device to be managed and performing a diagnosis. An SNMP manager (101) periodically collects MIB information of upper node level from an SNMP agent (201). An event processing unit (105) analyzes the MIB information of the upper node level by using a knowledge database (106). When an event is detected, the event processing unit (105) decides an event identification and requests a polling request processing unit (102) to collect MIB information associated with the event identification. The polling request processing unit (102) periodically collects the MIB information by polling so that MIB information required for performing diagnosis is stored in the management information accumulation unit (104). That is, when an event has occurred, detailed MIB information corresponding to the event is collected and it is possible to reduce the network load of MIB information collection at an ordinary state.

Description

Network management information collection method and network management system technical field

[0001] The present invention relates to a network management system for diagnosing managed devices connected to a network, and relates to a technique for collecting management information necessary for diagnosing managed devices connected to a network. is there.

Background art

[0002] In the current Internet environment, SNMP is the standard protocol for network management.

(Simple Network Management Protocol) is used, and the SNMP network management system consists of a management system (manager) that manages the network configuration and a managed system (agent). SNMP is a transport protocol used by managers to acquire management information called MIB (Management Information Base) held by agents, and is standardly implemented in many network devices. The agent stores network management information such as setting information, event count information, and real-time status information unique to its own network device in the MIB, and passes the ML information to the manager according to the request from the manager. Each network device can be managed based on the collected MIB information.

[0003] On the other hand, in order to diagnose the state of a communication device connected to a network in real time, the manager needs to collect and accumulate appropriate management information required for diagnosis from the agent. When collecting management information necessary for diagnosis, it is impossible to predict in advance what kind of problems will actually occur, so it is basically necessary to collect all management information. come. However, a large number of objects to be monitored are defined in MIB information as management information. Collecting all of these MIB information leads to an increase in network traffic and the main communication in the network. The problem is that it will have a fatal effect. Therefore, collecting all MIB information is not practical. In particular, this problem becomes more prominent as the network scale increases and the number of managed communication devices (agents) increases. As a result, unrelated data can be The problem is that a very large amount of network storage is required.

[0004] Patent Document 1 describes a method for reducing the load for collecting management information. An extended MIB is added as management information held by the agent, and when each agent monitors and analyzes standard MIB information and an individual value detects an abnormal value, a management information identifier uniquely defined in the extended MIB is set. To do. Managers can detect anomalies by receiving and analyzing extended MIB information from agents, so the load can be reduced compared to conventional methods.

Patent Document 1: Japanese Patent Laid-Open No. 7-129482

Disclosure of the invention

Problems to be solved by the invention

[0006] However, Patent Document 1 requires an agent program that implements an extended MIB on a managed communication device (agent) and sets the result of monitoring and analyzing standard MIB information in the extended MIB. Therefore, the extension MIB is implemented, and it is connected to a communication device! There was a problem that it was impossible to manage. In addition, there is a problem that the time and cost of the work for implementing the agent program or the work for customization are increased in the communication equipment (agent) to be managed.

[0007] The present invention relates to a network management system for collecting and diagnosing existing MIB information held by an existing communication device. The MIB information necessary for diagnosing a managed device is stored in the network load. An object of the present invention is to provide a method for efficiently collecting data with a reduced amount.

Means for solving the problem

[0008] In order to achieve the above object, the network management information collection method according to claim 1 is a network management information collection method in which a manager collects information about managed devices connected to a network from an agent. A management information collecting step of collecting high-level management information and storing it in a management information storage unit; an event determination step of determining event identification by analyzing the high-level management information; and relevance to the event identification And an event information collecting step for collecting the management information having a certain amount and storing it in the management information storage unit. [0009] In the management information collecting step according to claim 2, the manager periodically collects high-level management information from the agent and stores it in the management information storage unit, and the high-level management information is an event. It is pre-defined as the information necessary for detecting this. Here, the high-level management information is defined as the minimum necessary information for detecting an event, for example. An event indicates an exceptional state that occurs in a network, for example.

[0010] The event determination step according to claim 3, wherein the event identification is determined by analyzing the higher-level management information based on a predefined knowledge rule, and the event identification It is pre-defined as information necessary for diagnosing managed devices when detected.

[0011] The knowledge rule according to claim 4 determines information power event identification such as a type and a value range of the management information based on the high-level management information stored in the management information storage unit. It is defined for that purpose.

[0012] The event information collecting step according to claim 5 determines an action corresponding to the event identification using a predefined knowledge rule, and identifies the event over a certain period based on the action. It is characterized by collecting management information that is related to, and storing it in the management information storage unit. Here, the management information related to event identification is management information necessary for performing a detailed diagnosis when an event occurs, and is defined separately from the high-level management information.

[0013] The knowledge rule according to claim 6 is defined to determine management information and an action related to the event identification based on the information such as the event identification. Features.

[0014] The action described in claim 7 is characterized in that it is defined to start collection of management information relevant to the event identification and to end the collection. . In addition to collecting the current management information in real time, the action to start the collection is necessary if the managed device holds the past management information (information with a time stamp). This includes collecting past management information.

[0015] The SNMP network management system according to claim 8, wherein the SNMP manager is a network In an SNMP network management system that collects information about managed devices connected to a network from an SNMP agent, management information collection means for collecting high-level MIB information and storing it in a management information storage unit; Event determining means for determining event identification by analyzing the MIB information of the event information, and event information collecting means for collecting MIB information relevant to the event identification and storing it in the management information storage unit. Features.

[0016] The management information collecting means according to claim 9 has means for the SNMP manager to periodically collect high-level MIB information from the SNMP agent and store it in the management information storage unit, and the upper information Level MIB information is pre-defined as information necessary to detect an event. Here, the high-level MIB information is defined as, for example, the minimum necessary information for detecting an event. An event indicates an exceptional condition that occurs, for example, in a network.

[0017] The event determining means according to claim 10 has means for analyzing the higher level MIB information and determining event identification based on the knowledge rules defined in the knowledge database, and The event identification is preliminarily defined as information necessary for diagnosing a management target device when an event is detected.

[0018] The knowledge rule according to claim 11 determines information power event identification such as the type and value range of the MIB information based on the high-level MIB information stored in the management information storage unit. It is defined for that purpose.

[0019] The event information collecting means according to claim 12 determines an action corresponding to the event identification using a knowledge rule defined in a knowledge database, and over a certain period of time based on the action. It has means for collecting MIB information related to the event identification and storing it in a management information storage unit. The MIB information relevant to event identification here is the MLB information necessary for performing a detailed diagnosis when an event occurs, and is defined separately from the high-level MIB information.

[0020] The knowledge rule according to claim 13 is defined to determine MIB information and an action related to the event identification based on the information such as the event identification. And [0021] The action according to claim 14 is characterized in that it is defined to start collection of MIB information relevant to the event identification and to terminate the collection. . In addition to collecting the current management information in real time, the action to start the collection is necessary if the managed device holds the past management information (information with a time stamp). This includes collecting past management information. The invention's effect

[0022] According to the invention of claim 1 or claim 8, when the manager collects information on the state of the network device by polling, only the upper-level management information is targeted in normal times. Since detailed management information corresponding to the event is targeted when an event occurs, the manager is required to reduce the network traffic load caused by polling and diagnose the managed device. Management information can be collected. Furthermore, the storage capacity of the management information storage unit that stores the collected management information can be reduced.

[0023] According to the invention of claim 2 or claim 9, since the high-level management information is periodically collected by polling and stored in the management information storage unit, the manager can perform network traffic by polling. Management information necessary for diagnosing managed devices can be collected. Furthermore, the storage capacity of the management information storage unit that stores the collected management information can be reduced.

[0024] According to the inventions according to claims 3 to 4, or claims 10 to 11, the type of management information and the level of management information stored in the management information storage unit Since event identification is determined from information such as the range of values, it is possible to determine whether an event has occurred from higher-level management information.

[0025] According to the inventions according to claims 5 to 7, or claims 12 to 14, the action corresponding to the event identification is determined using a predefined knowledge rule, and the action is determined. Management information related to event identification is collected over a certain period of time and stored in the management information storage unit, and detailed management information corresponding to the occurrence of an event is collected. It is possible to perform powerful diagnosis.

Brief Description of Drawings FIG. 1 is a block diagram showing a configuration between SNMP managers and SNMP agents according to an embodiment of the present invention.

FIG. 2 is a diagram for explaining the contents of the definition of the knowledge database according to the embodiment of the present invention.

FIG. 3 is a diagram for explaining a specific example of the definition of the knowledge database according to the embodiment of the present invention.

FIG. 4 is a flowchart showing an algorithm of the network management information collecting method according to the embodiment of the present invention.

Explanation of symbols

101 SNMP manager

102 Polling request processor

103 Management information storage processing section

104 Management information storage

105 Event processing section

106 Knowledge Database

201 SNMP agent

202 Polling response processing part

203 MIB information read processing block

204 MIB information storage

205 Trap transmission processor

BEST MODE FOR CARRYING OUT THE INVENTION

Next, in order to describe the embodiment of the present invention in more detail, a case where SNMP is adopted as a network management protocol will be described as an example with reference to the drawings. Note that the present invention is not limited to the embodiments.

FIG. 1 is a block diagram showing a configuration between SNM p manager SNMP agents according to an embodiment of the present invention in an SNMP network management system.

[0030] The SNMP manager 101 receives information on the state of the network device from the SNMP agent.

The polling request processing unit 102 is provided with a means for acquiring from the 201 by polling. A data acquisition request (GetRequest) is transmitted to each SNMP agent 201 in the network at a set time interval. The SNMP agent 201 holds information related to the state of its own network device in the MIB table 204. When the polling response processing unit 202 receives a data acquisition request (GetRequest) from the S NMP manager 101, the MIB information reading process is performed. The unit 203 is instructed to read data. The MIB information read processing unit 203 reads the latest data from the MIB information storage unit 204 and delivers it to the polling response processing unit 202. The polling response processing unit 202 transmits the data delivered from the MIB information reading unit 203 to the SNMP manager 101 as a response (GetResponse). When receiving the response data (GetResponse) from the SNMP agent 201, the polling request processing unit 102 of the SNMP manager 101 instructs the management information storage processing unit 103 to store data. The management information storage processing unit 103 stores the data delivered from the polling request processing unit 102 in the management information storage unit 104.

[0031] In normal times, when the SNMP manager 101 makes a data acquisition request to the SNMP agent 201, only high-level MIB information is targeted. By reducing the amount of data by narrowing down the types of MIB information to be collected, it is possible to reduce the network traffic load caused by polling. Furthermore, the storage capacity of the management information storage unit 104 that stores the collected MIB information can be reduced.

[0032] The high-level MIB information is defined in advance as information necessary for detecting an event, for example. Here, the event indicates an exceptional state that occurs in the network, for example, and a specific example is an event such as “the response of a certain network device is slow!”.

[0033] Next, the event processing unit 105 reads and analyzes the high-level MIB information stored in the management information storage unit 104 using the knowledge rules defined in the knowledge database 106, and analyzes the MIB information. Event identification is determined from information such as type and value range. Here, event identification is defined in advance as information necessary for diagnosing managed devices. The knowledge rule is used to determine information power event identification such as the type of MIB information and the range of values based on higher-level MIB information stored in the management information storage unit. It is defined.

Next, the event processing unit 105 uses the knowledge rules defined in the knowledge database 106. Then, the action corresponding to the event identification is determined, and the polling request processing unit 102 is notified to collect MIB information related to the event identification based on the action. The polling request processing unit 102 periodically collects the MIB information by polling, so that the MIB information necessary for diagnosis is stored in the management information storage unit 104.

[0035] Here, the knowledge rule is defined to determine MIB information and an action related to the event identification based on the information such as the event identification. As actions, actions such as starting the collection of MIB information related to the event identification and ending the collection are defined. In addition to collecting the current management information in real time, the action to start the collection is necessary when the managed device holds the past management information (information with time stamp)! It also includes collecting past management information depending on the situation.

[0036] When the collection of action force information corresponding to event identification is to be ended, the event processing unit 105 notifies the polling request processing unit 102 to stop collecting the MIB information. The polling request processing unit 102 returns to the normal operation and collects high-level MIB information.

[0037] As described above, when the SNMP manager 101 makes a data acquisition request to the SNMP agent 201, it normally targets only high-level MIB information and when an event occurs. By targeting detailed MIB information corresponding to the event, the SNMP manager 101 reduces the network traffic load caused by polling and collects the MIB information necessary for diagnosing managed devices. Is possible.

[0038] Furthermore, when SNMP manager 101 receives a trap of SNMP agent 201, it reads the event processing ¾¾ ^ 105ii, the trap field value (Enterprise, ueneric Trap Type, Specinc Trap Type, etc.) Analyzes the event and determines the event identification as a result of the analysis.

[0039] Next, the event processing unit 105 determines an action corresponding to the event identification using a predefined knowledge database 106, and is related to the event identification based on the action. Notify polling request processing unit 102 to collect MIB information To do. The polling request processing unit 102 periodically collects the MIB information by polling, so that the MIB information necessary for diagnosis is stored in the management information storage unit 104.

[0040] As described above, even when a trap is received, MIB information necessary for diagnosis is collected and stored in the management information report storage unit 104. The SNMP manager 101 relates to the managed device. Diagnosis can be performed in real time.

Next, the definition contents of the knowledge database will be described. FIG. 2 shows a definition example of the knowledge database according to the embodiment of the present invention.

[0042] Definition example (1) defines high-level management information M0, where n is the total number of high-level management information (1≤i≤n) ₀ where management information is MIB information The ML information includes information such as “interface status”, “throughput statistics”, “traffic load”, and “error packet amount”. In addition, the high-level management information is, for example, defined in advance as information necessary for detecting an event, and more specific examples include information such as “iflnOctetsJ“ ipInRecevies ”“ icmpInMsgs ”.

[0043] Definition example (2) defines event identification E, where m is the total number of events (1 ≤ j ≤ m). Assuming that the set of upper-level management information is M, let M be the subset from which some elements of the element M0i of set M are extracted (M c M) ₀ For each element of M

J J J

If there is a function F (M) that determines the range of values, and the value is true, it is determined that an event has occurred, and an event identification E corresponding to the event is determined. If the value of F (M) j 1 1 force F (M) is not true, an event occurs and m m

Event identification is not determined. Here, event identification is defined as information necessary for diagnosing managed devices when an event occurs.

[0044] Definition example (3) defines management information Z and actions related to event identification E. When the entire set of management information is Z, element MO of set Z (1≤ k N) k

Let Z be a subset of some elements extracted from Z (Z c Z). Here, N is the number of elements of the entire management information, and is considerably larger than the total number n of the higher-level management information (n «N). There is a function f (E, M) that determines based on each element of event identification E and M. The management information Zj and action (start I stop) related to the event identification Ej are determined by the function of. Here, the management information Z related to the event identification E is the management information necessary for making a detailed diagnosis when an event occurs, and is defined separately from the high-level management information M. It is. An action is defined as starting management information collection related to event identification E and ending the collection. Furthermore, in addition to collecting the current management information in real time, the action to start the collection is as necessary when the managed device holds past management information (information with a time stamp). It also includes collecting past management information.

[0045] As described above, the total number N of management information as a whole is a value (n «N) that is more powerful than the total number n of higher-level management information, and management related to the event identification E Since it is a value larger than the total number of information Z, there is a method of collecting only high-level management information during normal times and collecting detailed management information corresponding to the event when an event occurs. This makes it possible to reduce the network traffic load and collect management information necessary for diagnosing managed devices.

Next, FIG. 3 shows a specific example of the definition of the knowledge database. High-level management information M is defined, and one element is inOctets. Where inOctets is the number of octets of all packets input to the managed device. M (M c M) is defined as a subset of set M, and its elements are inOctets. Here

1 1

A function F is defined to determine whether the value of M (inOctets) is 100 or more.

1 1

Event identification E (Large Traffic) is derived. Furthermore, there is a relationship with event identification E.

1 1

Function f that defines management information and actions to be defined, and f (E, inOctets)

1 1 1

When executed, {apOctets.i.j} is stored as management information related to event identification E.

1

As a result, Start is derived, and collection of management information {apOctets 丄 j} is started. Where apOctets.ij is the number of octets of the packet with port number j input from the i-th interface of the managed device (i = l,---, K: j = 1, · ·-, 65535) oi is the number of interfaces of the managed device, j is the port number (application type), and information is collected for each interface and port number. This allows events (Lar When ge Traffic) occurs, it is possible to track which part (interface) is responsible for which application type (port number).

Next, a specific example when the number of interfaces of managed devices is 4 (K = 4) will be described. High level management information 部分 subset Μ = {inOctets} is defined and managed

1

Since the number of octets inOctets of all packets input to the target device exceeds 100, the event identification E is determined by the function F (M), and the management information (apO

1 1 1 1 1 1

ctets.l.j: apOctets.2.j: apOctets.3.j: collection of apOctets.4.j} is started (j = 1,..., 65535).

[0048] Next, an algorithm for collecting network management information by the SNMP manager! / Will be described. FIG. 4 is a flowchart showing an algorithm of the network management information collecting method according to the embodiment of the present invention.

[0049] First, as normal processing, in step S01, the SNMP manager periodically collects upper level management information M = {MO, MO, ···, ΜΟ} by polling, and manages the information as management information.

1 2 η

Store in the information storage unit. Here, collect all MOs with l≤i≤n, where η is the total number of high-level management information. By reducing the amount of data by narrowing down the types of management information to be collected, the network traffic load due to polling can be reduced. High-level management information (MO) is defined in advance as the minimum information necessary to detect an event.

[0050] Next, in step S02, the management information (MO) stored in the management information storage unit is read and analyzed, and the event identification E is determined from information such as the type and value range of the management information (MO). Determine. Here, assuming that the total number of event identifications is m, all E of l≤j≤m are defined in advance as information necessary for diagnosis of managed devices.

[0051] By repeating the processes of steps S01 to S02 at regular time intervals, the SNMP manager collects information on the management target device by polling.

[0052] Next, in step S03, an action corresponding to the event identification E is determined from the event identification E determined in step S02 using a knowledge database. Here, the knowledge database defines an action corresponding to the event identification, and starts collecting MIB information related to the event identification as the action, and terminates the collection. Ending is defined.

[0053] Next, in step S04, it is determined whether the action force determined in step S03 starts the collection of MIB information related to event identification, or ends. In the case of start, the process of step S05 is performed, and in the case of end, the process of step S07 is performed.

[0054] Next, in step S05, management information Z relevant to the event identification E is extracted from the event identification E determined in step S02 using a knowledge database. Here, Z j J J is a subset of Z (Zj c Z), and Z is the entire set of management information. As explained in Fig. 2, the knowledge database is pre-defined as information necessary for diagnosing MIB information power management target devices that are relevant for each event identification!

[0055] Next, in step S06, the management information Z extracted in step S05 is periodically collected by polling, and the information is stored in the management information storage unit. As a result, management information necessary for diagnosis is stored in the management information storage unit for a certain period of time.

[0056] Next, step S07 is a process when it is determined as an end action in step S04, and polling for collecting management information Z related to event identification E is ended.

[0057] As described above, when the SNMP manager collects information on managed devices by polling, it normally targets only high-level MIB information. When an event occurs, the event By targeting detailed MIB information corresponding to, the SNMP manager can reduce the network traffic load caused by polling and collect the MIB information necessary for diagnosing managed devices. .

Industrial applicability

[0058] In recent years, the network scale has increased and the number of communication devices to be managed has increased. In this situation, a system that efficiently collects management information and performs network management is required. It is related to a network management system that collects and diagnoses existing MIB information held by communication devices. When collecting MIB information necessary for diagnosing managed devices, it is normally a high-level Targeting only management information and, when an event occurs, detailed management information corresponding to the event reduces the network load. Provide an efficient collection method. By using the technology of the present invention in the network management system, the manager can reduce the network traffic load caused by polling and collect management information necessary for diagnosing managed devices. At the same time, the storage capacity of the management information storage unit that stores the collected management information can be reduced. Furthermore, based on the collected management information, the action corresponding to the event identification is determined using the predefined knowledge rule, and the management information related to the event identification is collected over a certain period based on the action. Because it is stored in the management information storage unit, it is possible to perform detailed diagnosis by collecting detailed management information corresponding to the event occurrence.

Claims

The scope of the claims

[1] Network management information collection method in which the manager collects information about managed devices connected to the network from the agent! Management information that collects high-level management information and stores it in the management information storage A collection step, an event determination step for determining event identification by analyzing the higher-level management information, and an event information collection step for collecting management information related to the event identification and storing it in a management information storage unit And a network management information collecting method.

[2] In the management information collection step, a manager periodically collects high-level management information from an agent and stores it in a management information storage unit, and the high-level management information is necessary for detecting an event. 2. The network management information collecting method according to claim 1, wherein the network management information is predefined as secure information.

[3] The event determination step analyzes the higher level management information based on a predefined knowledge rule to determine event identification, and the event identification is managed when an event is detected. 2. The network management information collecting method according to claim 1, wherein the information is predefined as information necessary for diagnosing the target device.

[4] The knowledge rule is defined to determine event identification from information such as a type of management information and a range of values based on higher-level management information stored in the management information storage unit. 4. The network management information collecting method according to claim 3, wherein the network management information is collected.

[5] The event information collecting step determines an action corresponding to the event identification using a predefined knowledge rule, and is related to the event identification over a certain period based on the action. 2. The network management information collecting method according to claim 1, wherein management information is collected and stored in a management information storage unit.

6. The knowledge rule is defined to determine management information and an action related to the event identification based on the information such as the event identification. 5. The network management information collection method described in 5.

[7] The action is defined to start collection of management information related to the event identification, to end the collection, and the like. Item 7. The network management information collection method according to item 5 or item 6.

[8] The SNMP manager collects information about managed devices connected to the network from the SNMP agent. Collects high-level MIB information and stores it in the management information storage unit. Management information collection means, event determination means for determining event identification by analyzing the higher-level MIB information, and events for collecting MIB information related to the event identification and storing it in the management information storage section An SNMP network management system comprising an information collection unit.

[9] The management information collection means includes means for an SNMP manager to periodically collect high-level MIB information from an SNMP agent and store it in a management information storage unit, and the high-level MIB information includes an event. 9. The SNMP network management system according to claim 8, wherein the SNMP network management system is pre-defined as information necessary for detection.

[10] The event determining means has means for determining event identification by analyzing the higher-level MIB information based on knowledge rules defined in a knowledge database, and the event identification detects an event. 9. The SNMP network management system according to claim 8, wherein the SNMP network management system is pre-defined as information necessary for diagnosing the management target device when the management target device is diagnosed.

[11] The knowledge rule is defined to determine an event identification from information such as a type of MIB information and a range of values based on high-level MIB information stored in the management information storage unit. The SNMP network management system according to claim 10, wherein

[12] The event information collection means determines an action corresponding to the event identification using a knowledge rule defined in a knowledge database, and relates to the event identification over a certain period based on the action. 9. The SNMP network management system according to claim 8, further comprising means for collecting certain MIB information and storing it in a management information storage unit.

[13] The knowledge rule is defined to determine MIB information and an action related to the event identification based on the information such as the event identification. The SNMP network management system according to Item 12. 14. The action according to claim 12 or 13, wherein the action is defined to start collecting MIB information related to the event identification, to end the collecting, and the like. SNMP network management system.