WO2015129632A1 - Remote passive-type performance monitoring system - Google Patents

Remote passive-type performance monitoring system Download PDF

Info

Publication number
WO2015129632A1
WO2015129632A1 PCT/JP2015/055062 JP2015055062W WO2015129632A1 WO 2015129632 A1 WO2015129632 A1 WO 2015129632A1 JP 2015055062 W JP2015055062 W JP 2015055062W WO 2015129632 A1 WO2015129632 A1 WO 2015129632A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet
information
request
response
server device
Prior art date
Application number
PCT/JP2015/055062
Other languages
French (fr)
Japanese (ja)
Inventor
キニ　グレン　マンスフィールド
Original Assignee
株式会社サイバー・ソリューションズ
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 株式会社サイバー・ソリューションズ filed Critical 株式会社サイバー・ソリューションズ
Priority to JP2016505206A priority Critical patent/JP6458002B2/en
Publication of WO2015129632A1 publication Critical patent/WO2015129632A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/10—Active monitoring, e.g. heartbeat, ping or trace-route
    • H04L43/106—Active monitoring, e.g. heartbeat, ping or trace-route using time related information in packets, e.g. by adding timestamps
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0805—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability
    • H04L43/0817—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability by checking functioning
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/02—Standardisation; Integration
    • H04L41/0213—Standardised network management protocols, e.g. simple network management protocol [SNMP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0852—Delays
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/16—Threshold monitoring

Definitions

  • the present invention relates to a technique for remotely monitoring the load state of a server device by measuring an application processing time executed by the server device by a passive monitoring method.
  • Patent Document 1 discloses that a response time measurement apparatus that periodically connects to a WEB server to be monitored and measures response time regularly observes fluctuations in the response time of the WEB server. ing. *
  • a “monitoring unit” that repeatedly transmits a pseudo service request to a monitoring target server device at a predetermined cycle and measures a response time until the response is returned is obtained from a response time measurement result. It is disclosed that a variance of the response time distribution is estimated and it is determined that a failure has occurred when the value exceeds a threshold value.
  • An object of the present invention is to provide a system for remotely monitoring the load state of a server device by measuring the application processing time executed by the server device in response to a request from a client device by a passive monitoring method.
  • the invention according to claim 1 is executed by the server apparatus S in response to a request from the client apparatus Cn in a network to which the client apparatus Cn, the server apparatus S, and the remote monitoring apparatus M are connected.
  • a remote / passive type performance monitoring system that measures application processing time with a remote monitoring device M by a passive monitoring method and monitors a load state of a server device, and is connected to the same segment as the server device S, and the server It has a packet collection device PS that monitors the transmission / reception packet of the device S and records the transmission / reception packet information with time stamp information added thereto, and the remote monitoring device M has the packet information recorded in the packet collection device PS.
  • the invention according to claim 2 is the remote passive performance monitoring system according to claim 1, wherein the packet collection device PS monitors transmission / reception packets of the server device S, and records packets from the information of the transmission / reception packets.
  • the IP address information included in the IP header information, the application information included in the TCP / UDP header information, and the payload information corresponding to the application information are recorded with time stamp information added for each packet.
  • the invention according to claim 3 is the remote passive type performance monitoring system according to claim 1 or 2, wherein the specifying means of the remote monitoring device M is packet information regarding the client device Cn extracted by the extracting device.
  • a request packet from the client device Cn to the server device S is selected, and a response packet corresponding to the request packet (from the server device S to the client) is selected based on the IP address information, application information, and payload information included in the packet information.
  • a response packet to the device Cn) is specified.
  • the invention according to claim 4 is the remote passive performance monitoring system according to claims 1 to 3, wherein the measuring means of the remote monitoring device M is time stamp information of the request packet specified by the specifying means.
  • a difference value ⁇ TS2-TS1 ⁇ between ⁇ Time Stamp: TS1 ⁇ and time stamp information ⁇ Time Stamp: TS2 ⁇ of the response packet is calculated as an application processing time executed by the server device S.
  • the invention according to claim 5 is the remote / passive type performance monitoring system according to claims 1 to 4, wherein the display means of the remote monitoring device M stores information on the application processing time calculated by the measurement means. In addition to displaying on the monitor, when the application processing time exceeds a preset threshold, an alarm warning is provided.
  • the invention according to claim 6 is the remote passive type performance monitoring system according to claim 1, wherein the client apparatus Cn is connected to the same segment, monitors the transmission / reception packet of the client apparatus Cn, and A packet collection device PCn that records the information with time stamp information added thereto, and the remote monitoring device M takes out packet information related to the server device S from the packet information recorded in the packet collection device PCn; Based on the packet information, a request packet from the client device Cn to the server device S, a specifying means for specifying a response packet of an application executed in the server device S by the request packet, time stamp information of the request packet, From the response packet time stamp information Measuring means for calculating the application response time; and display means for displaying on the monitor information related to the application response time calculated by the measuring means.
  • the client apparatus Cn is connected to the same segment, monitors the transmission / reception packet of the client apparatus Cn, and A packet collection device PCn that records the information with time stamp information added thereto, and the remote monitoring device M takes out packet information related to the
  • the invention according to claim 7 is the remote passive type performance monitoring system according to claim 6, wherein the packet collection device PCn monitors the transmission / reception packet of the client device Cn, and from the information of the transmission / reception packet, records packets As information, the IP address information included in the IP header information, the application information included in the TCP / UDP header information, and the payload information corresponding to the application information are recorded with time stamp information added for each packet.
  • the packet collection device PCn monitors the transmission / reception packet of the client device Cn, and from the information of the transmission / reception packet, records packets As information, the IP address information included in the IP header information, the application information included in the TCP / UDP header information, and the payload information corresponding to the application information are recorded with time stamp information added for each packet.
  • the invention according to claim 8 is the remote passive performance monitoring system according to claims 6 to 7, wherein the specifying means of the remote monitoring device M is packet information relating to the server device S extracted by the extracting means.
  • a request packet from the client device Cn to the server device S is selected, and a response packet corresponding to the request packet (from the server device S to the client) is selected based on the IP address information, application information, and payload information included in the packet information.
  • a response packet to the device Cn) is specified.
  • the invention according to claim 9 is the remote passive type performance monitoring system according to claims 6 to 8, wherein the measuring means of the remote monitoring device M is time stamp information of the request packet specified by the specifying means.
  • a difference value ⁇ TC2-TC1 ⁇ between ⁇ Time Stamp: TC1 ⁇ and time stamp information ⁇ Time Stamp: TC2 ⁇ of the response packet is calculated as an application response time executed by the server apparatus S.
  • the invention according to claim 10 is the remote passive performance monitoring system according to claims 6 to 9, wherein the display means of the remote monitoring device M stores information on the application response time calculated by the measurement means. Displaying a monitor, alarming when the application response time exceeds a preset threshold, and calculating a difference value between the application response time and the application processing time as a network delay time, and the network delay An alarm warning is provided when the time exceeds a preset threshold value.
  • the invention according to claim 11 is the remote passive performance monitoring system according to any one of claims 1 to 10, wherein an SNMP agent is mounted on the packet collection device PS and PCn, and an SNMP agent is installed on the remote monitoring device M.
  • a manager is installed, and in the take-out means of the remote monitoring device M, the SNMP manager takes out the packet information recorded in the packet collection device PS and the packet collection device PCn using SNMP polling.
  • the load state of the server device can be accurately monitored without imposing a load on the server device. It becomes possible.
  • the application response time executed by the server device in response to a request from the client device using a remote monitoring device using a passive monitoring method, the application response time and network delay state can be reduced without imposing a load on the client device. It becomes possible to monitor accurately.
  • FIG. 3 is a schematic diagram illustrating an example of data recorded in a packet data collection device PCn in the remote / passive performance monitoring system according to the first embodiment of the present invention.
  • a remote / passive type performance monitoring system will be described with reference to the network configuration diagram shown in FIG.
  • a client device Cn (n: a natural number of 1 or more)
  • a server device S and a remote monitoring device M are connected on the network
  • a packet collection device PS is connected on the same segment as the server device S.
  • the network may be either an in-house LAN / intranet or the Internet.
  • the remote / passive performance monitoring system of the present invention passively processes the application processing time executed on the server device S in response to a request from the client device Cn without directly accessing the server device S (without applying a load to the server device). -Monitor the load status of the server device by remote monitoring device M using the monitoring method. Details will be described below. *
  • the packet collection device PS monitors transmission / reception packets of the server device S, and from the transmission / reception packet information, as recording packet information, IP address information included in IP header information, application information included in TCP / UDP header information, and Payload information corresponding to this application information is recorded with time stamp information added for each packet.
  • the packet is composed of Ethernet (registered trademark) Header, IP Header, TCP / UDP Header, Payload.
  • the IP header includes information of ⁇ Source IP address, Destination IP IP Address ⁇ .
  • TCP / UDP Header includes information of ⁇ Source Port, Destination Port ⁇ .
  • Payload includes Payload information ⁇ Request ID, Request I Content ⁇ corresponding to application information (Source Port / Destination Port).
  • the Payload is composed of different information for each application. Therefore, the information of Request ID and Request ⁇ ⁇ ⁇ ⁇ Content is also unique information for each application. *
  • FIG. 3 shows an example of data recorded in the packet collection device PS.
  • the packet collection device PS includes, as recorded packet information, IP header information IP address information ⁇ Source IP Address, Destination IP Address ⁇ , application information included in the TCP / UDP header information ⁇ Source Port, Destination Port ⁇ , and this application information.
  • Corresponding payload information ⁇ Request ID, Request Content ⁇ is recorded with time stamp information added for each packet.
  • packet information of a request packet HTTP Request (C1 ⁇ S) from the client device C1 to the server device S is recorded at time TS1.
  • “ID1” is recorded as Request ID
  • “URL information” is recorded as Request Content.
  • the packet information of the response packet HTTP Response (S ⁇ C1) of the application executed on the server apparatus S in response to this request packet is recorded at time TS3.
  • the same “ID1” is recorded as the Request ID
  • the same “URL information” is recorded as the Request Content.
  • packet information of a request packet FTP Request (C2 ⁇ S) from the client device C2 to the server device S is recorded at time TS2.
  • ID2 is recorded as the Request ID
  • File Name information is recorded as the Request Content.
  • the packet information of the response packet FTP Response (S ⁇ C2) of the application executed on the server apparatus S in response to this request packet is recorded at time TS5.
  • the same “ID2” is recorded as the Request ID
  • the same “File Name information” is recorded as the Request Content.
  • packet information of a request packet SNMP Request (C1 ⁇ S) from the client device C1 to the server device S is recorded at time TS4.
  • “ID3” is recorded as the Request ID
  • “MO Name information” is recorded as the Request Content.
  • the packet information of the response packet SNMP Response (S ⁇ C1) of the application executed on the server apparatus S in response to this request packet is recorded at time TS6.
  • the same “ID3” as above is recorded as the Request ID
  • the same “MO Name information” as above is recorded as the Request Content.
  • the remote monitoring device M takes out packet information related to the client device Cn from the packet information recorded in the packet collection device PS (extraction means), and based on the packet information, a request packet from the client device Cn to the server device S,
  • the response packet of the application executed in the server device S is specified by this request packet (identifying means), and the difference value between the time stamp information of the request packet and the time stamp information of the response packet is calculated as the application processing time ( Measuring means) and information related to the application processing time is displayed on the monitor (display means). That is, the remote monitoring device M adopts a passive monitoring method in which the application processing time executed by the server device S in response to a request from the client device Cn is not accessed directly (without loading the server device S). To measure. *
  • the specifying unit selects a request packet from the client device Cn to the server device S from the packet information regarding the client device Cn extracted by the extracting unit, and includes IP address information, application information, and payload information included in the packet information. Based on this, a response packet (response packet from the server device S to the client device Cn) corresponding to the request packet is specified.
  • the specifying means specifies the packet using any of the following methods. (1) When the payload information ⁇ Request ID, Request Content ⁇ is included in the request packet, the specifying unit transmits the server device S to the server device Sn based on the packet information regarding the client device Cn extracted by the extracting unit. Request packet is selected, and a response packet (response packet from the server device S to the client device Cn) having the same ⁇ Request ID, Request Content ⁇ as the request packet is specified. (2) If the request packet does not include the payload information ⁇ Request ID, Request Request Content ⁇ , the specifying means sends the server device S to the server device Sn based on the packet information related to the client device Cn extracted by the extracting device.
  • Request packet is selected, and among the response packets having the same ⁇ Source Port ⁇ as ⁇ Destination Port ⁇ of this request packet, the response packet having the same ⁇ Destination Port ⁇ as ⁇ Source Port ⁇ of the request packet (server A response packet from the device S to the client device Cn) is identified.
  • the specifying unit selects a request packet from the client device Cn to the server device S based on the packet information regarding the client device Cn extracted by the extracting unit, and the TCP header of the request packet Using the information ⁇ Sequence ⁇ ⁇ ⁇ Number, Acknowledgment Number ⁇ , a response packet corresponding to this request packet (response packet from the server device S to the client device Cn) is specified.
  • FIG. 5 shows an example of a process when the specifying means uses the above method (1).
  • the extraction unit 101 performs processing for extracting time stamp information, IP address information, application information, and payload information as packet information related to the client device Cn from the packet information recorded in the packet collection device PS.
  • the extraction unit 101 uses (i) time stamp information ⁇ Time Stamp: TS1 ⁇ , IP address information ⁇ Source as packet information related to the client device C1 from the packet information recorded in the packet collection device PS.
  • Timestamp Information ⁇ Time Stamp: TS3 ⁇ IP address information ⁇ Source IP Address: IP (S), Destination IP IP Address: IP (C1) ⁇ , application information ⁇ Source Port 80: Payload information ⁇ Request ID: ID1, Request Content: URL ⁇ (iii ) Time stamp information ⁇ Time Stamp: TS4 ⁇ , IP address information ⁇ Source IP Address: IP (C1), Destination IP Address: IP (S) ⁇ , application information ⁇ Destination Port: 161 ⁇ , Payload information ⁇ Request ID: ID3 , Request Content: MO Name ⁇ (iv)
  • the specifying unit 102 selects a request packet from the client device Cn to the server device S based on the packet information regarding the client device Cn extracted by the extracting unit 101, and has the same ⁇ Request ID, Request ⁇ ⁇ Content ⁇ as this request packet.
  • the response packet (response packet from the server apparatus S to the client apparatus Cn) is specified.
  • the specifying unit 102 uses the packet information ((i) to (iv)) regarding the client device C1 extracted by the extracting unit 101 as a packet having the same ⁇ Request ID, Request Content ⁇ .
  • a request packet (i) and a response packet (ii) related to HTTP are specified.
  • the specifying unit 102 uses the packet information (the above (i) to (iv)) extracted by the extracting unit 101 as a packet having the same ⁇ Request ID, Request Content ⁇ , and a request packet (iii) and response regarding SNMP. Identify packet (iv). *
  • the measuring means 103 uses the difference value ⁇ TS2-TS1 ⁇ between the time stamp information ⁇ Time Stamp: TS1 ⁇ of the request packet specified by the specifying means 102 and the time stamp information ⁇ Time Stamp: TS2 ⁇ of the response packet as the server device. Processing to calculate the application processing time executed in S is performed. *
  • the measuring means 103 uses the difference value between the time stamp information ⁇ Time Stamp: TS1 ⁇ of the request packet (i) related to HTTP and the time stamp information ⁇ Time Stamp: TS3 ⁇ of the response packet (ii). ⁇ TS3-TS1 ⁇ is calculated as the HTTP application processing time executed by the server apparatus S. Similarly, the measuring means 103 uses the difference value ⁇ TS6-TS4 ⁇ between the time stamp information ⁇ Time Stamp: TS4 ⁇ of the request packet (iii) related to SNMP and the time stamp information ⁇ Time Stamp: TS6 ⁇ of the response packet (iv). Is calculated as the SNMP application processing time executed by the server apparatus S. *
  • the remote monitoring device M accurately measures the application processing time executed on the server device S by the passive monitoring method without directly accessing the server device S (without loading the server device S). Can do. *
  • the application processing time is calculated using the last packet for the request packet and the first packet for the response packet.
  • the SNMP agent is installed in the packet collection device PS
  • the SNMP manager is installed in the remote monitoring device M
  • the SNMP manager is recorded in the packet collection device PS using SNMP polling in the extraction means of the remote monitoring device M Packet information can also be extracted.
  • Second Embodiment A remote monitoring system according to a second embodiment of the present invention will be described with reference to the network configuration diagram shown in FIG.
  • a system has been described in which the time is measured by the remote monitoring device M by the passive monitoring method and the load state of the server device is monitored.
  • the packet collection device PCn is connected on the same segment as the client device Cn based on the configuration of the first embodiment. *
  • an application response time executed by the server device S in response to a request from the client device Cn is a passive monitoring method without directly accessing the client device Cn (without applying a load to the client device Cn).
  • the remote monitoring device M measures the load state and network delay state of the server device S remotely. Details will be described below.
  • the packet collection device PCn monitors the transmission / reception packet of the client device Cn, and from the transmission / reception packet information, as the recording packet information, the IP address information included in the IP header information, the application information included in the TCP / UDP header information, and Payload information corresponding to this application information is recorded with time stamp information added for each packet.
  • FIG. 4 shows an example of data recorded in the packet collection device PCn.
  • the packet collection device PCn includes, as recorded packet information, IP address information ⁇ SourceIPIP Address, Destination IP Address ⁇ included in the IP header information, application information ⁇ Source Port, Destination Port ⁇ included in the TCP / UDP header information, and Payload information ⁇ Request ID, Request Content ⁇ corresponding to application information is recorded with time stamp information added for each packet.
  • IP address information ⁇ SourceIPIP Address, Destination IP Address ⁇ included in the IP header information
  • application information ⁇ Source Port, Destination Port ⁇ included in the TCP / UDP header information
  • Payload information ⁇ Request ID, Request Content ⁇ corresponding to application information is recorded with time stamp information added for each packet.
  • packet information of a request packet HTTP ⁇ ⁇ ⁇ ⁇ Request (C1 ⁇ S) from the client device C1 to the server device S is recorded at time TC11.
  • “ID1” is recorded as Request ID
  • “URL information” is recorded as Request Content.
  • the packet information of the response packet HTTP Response (S ⁇ C1) of the application executed on the server apparatus S in response to this request packet is recorded at time TC12.
  • the same “ID1” is recorded as the Request ID
  • the same “URL information” is recorded as the Request Content.
  • packet information of a request packet SNMP Request (C1 ⁇ S) from the client device C1 to the server device S is recorded at time TC13.
  • “ID3” is recorded as the Request ID
  • “MO Name information” is recorded as the Request Content.
  • the packet information of the response packet SNMP Response (S ⁇ C1) of the application executed by the server apparatus S in response to this request packet is recorded at time TC14.
  • the same “ID3” as above is recorded as the Request ID
  • the same “MO Name information” as above is recorded as the Request Content.
  • the remote monitoring device M takes out packet information related to the server device S from the packet information recorded in the packet collection device PCn (extraction means), based on the packet information, a request packet from the client device Cn to the server device S,
  • the response packet of the application executed in the server device S is specified by this request packet (identifying means), and a difference value between the time stamp information of the request packet and the time stamp information of the response packet is calculated as an application response time ( Measurement means) and information on the application response time are displayed on the monitor (display means). That is, the remote monitoring device M adopts a passive monitoring method in which the application response time executed by the server device S in response to a request from the client device Cn is not directly accessed to the client device Cn (without applying a load to the client device Cn). To measure. *
  • the specifying unit selects a request packet from the client device Cn to the server device S from the packet information regarding the server device S extracted by the extracting unit, and includes IP address information, application information, and payload information included in the packet information. Based on this, a response packet (response packet from the server device S to the client device Cn) corresponding to the request packet is specified. Further, the specifying means specifies a packet using any one of the methods (1) to (3) described above. *
  • FIG. 6 shows an example of a process when the specifying means uses the above method (1).
  • the extracting unit 201 performs processing for extracting time stamp information, IP address information, application information, and payload information as packet information related to the server device S from the packet information recorded in the packet collection device PCn.
  • the extraction unit 201 uses (i) time stamp information ⁇ Time Stamp: TC11 ⁇ , IP address information ⁇ Source as packet information related to the server device S from the packet information recorded in the packet collection device PCn.
  • the specifying unit 202 selects a request packet from the client device Cn to the server device S based on the packet information regarding the server device S extracted by the extracting unit 101, and has the same ⁇ Request ID, Request Content ⁇ as the request packet.
  • the response packet (response packet from the server apparatus S to the client apparatus Cn) is specified.
  • the specifying unit 202 uses the packet information ((i) to (iv) above) regarding the server device S extracted by the extracting unit 201 as a packet having the same ⁇ Request ID, Request Content ⁇ .
  • a request packet (i) and a response packet (ii) related to HTTP are specified.
  • the specifying unit 202 uses the packet information ((i) to (iv)) extracted by the extracting unit 201 as a packet having the same ⁇ Request ID, Request Content ⁇ , and a request packet (iii) and response regarding SNMP. Identify packet (iv). *
  • the measuring means 203 uses the difference value ⁇ TC2-TC1 ⁇ between the time stamp information ⁇ Time Stamp: TC1 ⁇ of the request packet specified by the specifying means 202 and the time stamp information ⁇ Time Stamp: TC2 ⁇ of the response packet to the server device. Processing to calculate the application response time executed in S is performed. *
  • the measuring unit 203 uses the difference value between the time stamp information ⁇ Time Stamp: TC11 ⁇ of the request packet (i) related to HTTP and the time stamp information ⁇ Time Stamp: TC12 ⁇ of the response packet (ii). ⁇ TC12-TC11 ⁇ is calculated as the HTTP application response time executed by the server apparatus S. Similarly, the measuring means 203 uses the difference value ⁇ TC14-TC13 ⁇ between the time stamp information ⁇ Time Stamp: TC13 ⁇ of the request packet (iii) related to SNMP and the time stamp information ⁇ Time Stamp: TC14 ⁇ of the response packet (iv). Is calculated as the SNMP application response time executed by the server device S. *
  • the display unit 204 performs processing for displaying information on the application response time calculated by the measurement unit 203 on a monitor and processing for alarming when the application response time exceeds a preset threshold. Further, the display unit 204 calculates a difference value between the application response time and the application processing time (first embodiment) as a network delay time, and issues an alarm warning when the network delay time exceeds a preset threshold value. Processing can also be performed. *
  • the remote monitoring device M can monitor the load state and network delay state of the server device S by the passive monitoring method without directly accessing the client device Cn (without applying a load to the client device Cn). . *
  • the SNMP agent is installed in the packet collection device PCn
  • the SNMP manager is installed in the remote monitoring device M
  • the SNMP manager recorded in the packet collection device PCn using SNMP polling in the extraction means of the remote monitoring device M Packet information can also be extracted.
  • the remote monitoring device M extracts the packet information of the request packet recorded in the packet collection device PCn, and The time interval value at which the request packet is transmitted is measured from the time stamp information included in the packet information.
  • the remote monitoring apparatus M monitors and displays information related to the time interval value measured above, and when the fluctuation of the time interval value exceeds a preset threshold (the load on the client apparatus Cn increases) Performs alarm warning processing.
  • the remote monitoring apparatus M can monitor the load state of the client apparatus Cn by the passive monitoring method without directly accessing the client apparatus Cn (without applying a load to the client apparatus Cn).

Abstract

　The present invention provides a system for measuring, by using a passive monitoring scheme, the processing time of an application executed by a server device, and remotely monitoring the load condition of the server device. A system, in a network to which are connected a client device (Cn), a server device (S), and a remote-monitoring device (M), for measuring, by using a passive monitoring scheme and using the remote-monitoring device (M), the processing time of an application executed by the server device (S) at a request from the client device (Cn), wherein: the system has a packet collection device (PS), connected in the same segment as the server device (S), for monitoring the packets transmitted/received by the server device (S) and recording packet information after adding timestamp information thereto; and, using the packet information recorded by the packet collection device (PS), the system measures, by using the remote-monitoring device (M), the processing time of the application executed by the server device (S) at a request from the client device (Cn).

Description

リモート・パッシブ型性能監視システムRemote / passive performance monitoring system
本発明は、サーバ装置で実行されるアプリケーション処理時間をパッシブ・モニタリング方式にて測定しサーバ装置の負荷状態をリモート監視する技術に関する。 The present invention relates to a technique for remotely monitoring the load state of a server device by measuring an application processing time executed by the server device by a passive monitoring method.
近年、ネットワークを経由して様々なサービスが提供されるようになってきており、サービスを提供するサーバ装置の負荷状態を監視することは益々重要になってきており、サーバ装置の負荷状態を監視するための多くの技術が開示されている。　 In recent years, various services have been provided via a network, and it has become increasingly important to monitor the load status of server devices that provide services, and monitor the load status of server devices. Many techniques for doing so have been disclosed. *
例えば、特許文献１では、監視対象となるＷＥＢサーバに定期的に接続して応答時間を計測する「応答時間計測装置」により、ＷＥＢサーバの応答時間の変動を定期的に観測することが開示されている。　 For example, Patent Document 1 discloses that a response time measurement apparatus that periodically connects to a WEB server to be monitored and measures response time regularly observes fluctuations in the response time of the WEB server. ing. *
また特許文献２では、監視対象サーバ装置に対して所定の周期で擬似サービス要求を繰り返し送信し、その応答が返信されるまでの応答時間を計測する「監視部」により、応答時間の測定結果から応答時間分布の分散を推定し、その値が閾値を超えると障害が発生したと判定することが開示されている。　 Further, in Patent Document 2, a “monitoring unit” that repeatedly transmits a pseudo service request to a monitoring target server device at a predetermined cycle and measures a response time until the response is returned is obtained from a response time measurement result. It is disclosed that a variance of the response time distribution is estimated and it is determined that a failure has occurred when the value exceeds a threshold value. *
また特許文献３では、サーバが要求を受信してから応答を返信するまでの応答時間（ターンアラウンド時間）を計測し、その計測値とサーバの負荷を段階評価した負荷レベルとを時系列に分析し、負荷レベルごとの応答時間を分析する「性能分析装置」が開示されており、この「性能分析装置」は、サーバ内部に実装されるソフトウエアを想定していることが言及されている。 In Patent Document 3, the response time (turnaround time) from when the server receives a request until the response is returned is measured, and the measured value and the load level obtained by grading the server load are analyzed in time series. In addition, a “performance analysis device” that analyzes a response time for each load level is disclosed, and it is mentioned that this “performance analysis device” is assumed to be software installed in a server.
特開２００８－１３００１０JP2008-13003 特開２０１１－１２８７８１JP2011-128781A 特開２０１１－１８６７１２JP2011-186712
しかしながら特許文献１，２のように、サーバ装置の状態を監視するために監視装置からサーバ装置に直接アクセスするアクティブ監視では、それ自体がサーバ装置の負荷となり、サーバ装置の状態を正確に判定することが難しくなる可能性がある。またアクティブ監視では、サーバ装置の応答時間にネットワーク遅延時間が含まれるため、遅延時間の変動によってサーバ装置の状態を誤って判断する可能性がある。　 However, as in Patent Documents 1 and 2, in active monitoring in which a server device directly accesses the server device in order to monitor the server device state, the server device itself becomes a load on the server device, and the server device state is accurately determined. Can be difficult. In the active monitoring, the response time of the server device includes the network delay time. Therefore, there is a possibility that the state of the server device is erroneously determined due to the fluctuation of the delay time. *
また特許文献３のように、サーバ装置の状態を監視するためのプログラムをサーバ装置に組み込み実行させるアクティブ監視では、それ自体がサーバ装置の負荷となり、サーバ装置の状態を正確に判定することが難しくなる可能性がある。　 Further, as in Patent Document 3, in active monitoring in which a program for monitoring the state of the server device is incorporated and executed in the server device, the server device itself becomes a load on the server device, and it is difficult to accurately determine the state of the server device. There is a possibility. *
本発明の目的は、クライアント装置からの要求によりサーバ装置で実行されるアプリケーション処理時間をパッシブ・モニタリング方式にて測定しサーバ装置の負荷状態をリモート監視するシステムを提供することにある。 An object of the present invention is to provide a system for remotely monitoring the load state of a server device by measuring the application processing time executed by the server device in response to a request from a client device by a passive monitoring method.
上記目的を達成するために、請求項１に係る発明は、クライアント装置Cn、サーバ装置S、およびリモート監視装置Mが接続されたネットワークにおいて、クライアント装置Cnからの要求によりサーバ装置Sで実行されるアプリケーション処理時間をパッシブ・モニタリング方式にてリモート監視装置Mで測定しサーバ装置の負荷状態を監視するリモート・パッシブ型性能監視システムであって、　前記サーバ装置Sと同一セグメント上に接続され、該サーバ装置Sの送受信パケットをモニタリングし、該送受信パケットの情報にタイムスタンプ情報を付加して記録するパケット収集装置PSを有し、　前記リモート監視装置Mは、　前記パケット収集装置PSに記録されたパケット情報からクライアント装置Cnに関するパケット情報を取出す取出手段と、　前記パケット情報を基に、クライアント装置Cnからサーバ装置Sへの要求パケットと、この要求パケットによりサーバ装置Sで実行されたアプリケーションの応答パケットを特定する特定手段と、　前記要求パケットのタイムスタンプ情報と前記応答パケットのタイムスタンプ情報からアプリケーション処理時間を算出する測定手段と、　前記測定手段で算出したアプリケーション処理時間に関する情報をモニター表示する表示手段と、　を有することを特徴とする。　 In order to achieve the above object, the invention according to claim 1 is executed by the server apparatus S in response to a request from the client apparatus Cn in a network to which the client apparatus Cn, the server apparatus S, and the remote monitoring apparatus M are connected. A remote / passive type performance monitoring system that measures application processing time with a remote monitoring device M by a passive monitoring method and monitors a load state of a server device, and is connected to the same segment as the server device S, and the server It has a packet collection device PS that monitors the transmission / reception packet of the device S and records the transmission / reception packet information with time stamp information added thereto, and the remote monitoring device M has the packet information recorded in the packet collection device PS. Means for extracting packet information related to the client device Cn from Based on the packet information, a request packet from the client device Cn to the server device S, a specifying means for specifying a response packet of an application executed in the server device S by the request packet, time stamp information of the request packet, And measuring means for calculating the application processing time from the time stamp information of the response packet, and display means for displaying on the monitor information related to the application processing time calculated by the measuring means. *
請求項２に係る発明は、請求項１に係るリモート・パッシブ型性能監視システムであって、前記パケット収集装置PSは、サーバ装置Sの送受信パケットをモニタリングし、該送受信パケットの情報から、記録パケット情報として、IPヘッダ情報に含まれるIPアドレス情報、TCP/UDPヘッダ情報に含まれるアプリケーション情報、及びこのアプリケーション情報に対応するPayload情報を、パケット毎にタイムスタンプ情報を付加して記録することを特徴とする。　 The invention according to claim 2 is the remote passive performance monitoring system according to claim 1, wherein the packet collection device PS monitors transmission / reception packets of the server device S, and records packets from the information of the transmission / reception packets. As information, the IP address information included in the IP header information, the application information included in the TCP / UDP header information, and the payload information corresponding to the application information are recorded with time stamp information added for each packet. And *
請求項３に係る発明は、請求項１乃至請求項２に係るリモート・パッシブ型性能監視システムであって、前記リモート監視装置Mの特定手段は、前記取出手段で取出したクライアント装置Cnに関するパケット情報から、クライアント装置Cnからサーバ装置Sへの要求パケットを選定し、パケット情報に含まれるIPアドレス情報、アプリケーション情報、及びPayload情報を基に、この要求パケットに対応する応答パケット（サーバ装置Sからクライアント装置Cnへの応答パケット）を特定することを特徴とする。　 The invention according to claim 3 is the remote passive type performance monitoring system according to claim 1 or 2, wherein the specifying means of the remote monitoring device M is packet information regarding the client device Cn extracted by the extracting device. A request packet from the client device Cn to the server device S is selected, and a response packet corresponding to the request packet (from the server device S to the client) is selected based on the IP address information, application information, and payload information included in the packet information. A response packet to the device Cn) is specified. *
請求項４に係る発明は、請求項１乃至請求項３に係るリモート・パッシブ型性能監視システムであって、前記リモート監視装置Mの測定手段は、前記特定手段で特定した要求パケットのタイムスタンプ情報{Time Stamp:TS1}と応答パケットのタイムスタンプ情報{Time Stamp:TS2}との差分値{TS2-TS1}をサーバ装置Sで実行されたアプリケーション処理時間として算出することを特徴とする。　 The invention according to claim 4 is the remote passive performance monitoring system according to claims 1 to 3, wherein the measuring means of the remote monitoring device M is time stamp information of the request packet specified by the specifying means. A difference value {TS2-TS1} between {Time Stamp: TS1} and time stamp information {Time Stamp: TS2} of the response packet is calculated as an application processing time executed by the server device S. *
請求項５に係る発明は、請求項１乃至請求項４に係るリモート・パッシブ型性能監視システムであって、前記リモート監視装置Mの表示手段は、前記測定手段で算出したアプリケーション処理時間に関する情報をモニター表示するとともに、前記アプリケーション処理時間が予め設定された閾値を超えた場合にアラーム警告することを特徴とする　 The invention according to claim 5 is the remote / passive type performance monitoring system according to claims 1 to 4, wherein the display means of the remote monitoring device M stores information on the application processing time calculated by the measurement means. In addition to displaying on the monitor, when the application processing time exceeds a preset threshold, an alarm warning is provided.
請求項６に係る発明は、請求項１に記載のリモート・パッシブ型性能監視システムにおいて、　前記クライアント装置Cnと同一セグメント上に接続され、該クライアント装置Cnの送受信パケットをモニタリングし、該送受信パケットの情報にタイムスタンプ情報を付加して記録するパケット収集装置PCnを有し、　前記リモート監視装置Mは、　前記パケット収集装置PCnに記録されたパケット情報からサーバ装置Sに関するパケット情報を取出す取出手段と、　前記パケット情報を基に、クライアント装置Cnからサーバ装置Sへの要求パケットと、この要求パケットによりサーバ装置Sで実行されたアプリケーションの応答パケットを特定する特定手段と、　前記要求パケットのタイムスタンプ情報と前記応答パケットのタイムスタンプ情報からアプリケーション応答時間を算出する測定手段と、　前記測定手段で算出したアプリケーション応答時間に関する情報をモニター表示する表示手段と、　を有することを特徴とする。　 The invention according to claim 6 is the remote passive type performance monitoring system according to claim 1, wherein the client apparatus Cn is connected to the same segment, monitors the transmission / reception packet of the client apparatus Cn, and A packet collection device PCn that records the information with time stamp information added thereto, and the remote monitoring device M takes out packet information related to the server device S from the packet information recorded in the packet collection device PCn; Based on the packet information, a request packet from the client device Cn to the server device S, a specifying means for specifying a response packet of an application executed in the server device S by the request packet, time stamp information of the request packet, From the response packet time stamp information Measuring means for calculating the application response time; and display means for displaying on the monitor information related to the application response time calculated by the measuring means. *
請求項７に係る発明は、請求項６に係るリモート・パッシブ型性能監視システムであって、前記パケット収集装置PCnは、クライアント装置Cnの送受信パケットをモニタリングし、該送受信パケットの情報から、記録パケット情報として、IPヘッダ情報に含まれるIPアドレス情報、TCP/UDPヘッダ情報に含まれるアプリケーション情報、及びこのアプリケーション情報に対応するPayload情報を、パケット毎にタイムスタンプ情報を付加して記録することを特徴とする。　 The invention according to claim 7 is the remote passive type performance monitoring system according to claim 6, wherein the packet collection device PCn monitors the transmission / reception packet of the client device Cn, and from the information of the transmission / reception packet, records packets As information, the IP address information included in the IP header information, the application information included in the TCP / UDP header information, and the payload information corresponding to the application information are recorded with time stamp information added for each packet. And *
請求項８に係る発明は、請求項６乃至請求項７に係るリモート・パッシブ型性能監視システムであって、前記リモート監視装置Mの特定手段は、前記取出手段で取出したサーバ装置Sに関するパケット情報から、クライアント装置Cnからサーバ装置Sへの要求パケットを選定し、パケット情報に含まれるIPアドレス情報、アプリケーション情報、及びPayload情報を基に、この要求パケットに対応する応答パケット（サーバ装置Sからクライアント装置Cnへの応答パケット）を特定することを特徴とする。　 The invention according to claim 8 is the remote passive performance monitoring system according to claims 6 to 7, wherein the specifying means of the remote monitoring device M is packet information relating to the server device S extracted by the extracting means. A request packet from the client device Cn to the server device S is selected, and a response packet corresponding to the request packet (from the server device S to the client) is selected based on the IP address information, application information, and payload information included in the packet information. A response packet to the device Cn) is specified. *
請求項９に係る発明は、請求項６乃至請求項８に係るリモート・パッシブ型性能監視システムであって、前記リモート監視装置Mの測定手段は、前記特定手段で特定した要求パケットのタイムスタンプ情報{Time Stamp:TC1}と応答パケットのタイムスタンプ情報{Time Stamp:TC2}との差分値{TC2-TC1}をサーバ装置Sで実行されたアプリケーション応答時間として算出することを特徴とする。　 The invention according to claim 9 is the remote passive type performance monitoring system according to claims 6 to 8, wherein the measuring means of the remote monitoring device M is time stamp information of the request packet specified by the specifying means. A difference value {TC2-TC1} between {Time Stamp: TC1} and time stamp information {Time Stamp: TC2} of the response packet is calculated as an application response time executed by the server apparatus S. *
請求項１０に係る発明は、請求項６乃至請求項９に係るリモート・パッシブ型性能監視システムであって、前記リモート監視装置Mの表示手段は、前記測定手段で算出したアプリケーション応答時間に関する情報をモニター表示するとともに、前記アプリケーション応答時間が予め設定された閾値を超えた場合にアラーム警告すること、及び前記アプリケーション応答時間と前記アプリケーション処理時間との差分値をネットワーク遅延時間として算出し、そのネットワーク遅延時間が予め設定された閾値を超えた場合にアラーム警告することを特徴とする。　 The invention according to claim 10 is the remote passive performance monitoring system according to claims 6 to 9, wherein the display means of the remote monitoring device M stores information on the application response time calculated by the measurement means. Displaying a monitor, alarming when the application response time exceeds a preset threshold, and calculating a difference value between the application response time and the application processing time as a network delay time, and the network delay An alarm warning is provided when the time exceeds a preset threshold value. *
請求項１１に係る発明は、請求項１乃至請求項１０に係るリモート・パッシブ型性能監視システムであって、前記パケット収集装置PSおよびにPCnにSNMPエージェントを実装し、前記リモート監視装置MにSNMPマネージャを実装し、前記リモート監視装置Mの取出手段において、SNMPマネージャがSNMPポーリングを利用して前記パケット収集装置PSおよび前記パケット収集装置PCnに記録されたパケット情報を取出すことを特徴とする。 The invention according to claim 11 is the remote passive performance monitoring system according to any one of claims 1 to 10, wherein an SNMP agent is mounted on the packet collection device PS and PCn, and an SNMP agent is installed on the remote monitoring device M. A manager is installed, and in the take-out means of the remote monitoring device M, the SNMP manager takes out the packet information recorded in the packet collection device PS and the packet collection device PCn using SNMP polling.
クライアント装置からの要求によりサーバ装置で実行されるアプリケーション処理時間を、パッシブ・モニタリング方式にてリモート監視装置で測定することで、サーバ装置に負荷をかけずにサーバ装置の負荷状態を正確に監視することが可能なる。　 By monitoring the application processing time executed on the server device in response to a request from the client device with a remote monitoring device using the passive monitoring method, the load state of the server device can be accurately monitored without imposing a load on the server device. It becomes possible. *
さらに、クライアント装置からの要求によりサーバ装置で実行されるアプリケーション応答時間を、パッシブ・モニタリング方式にてリモート監視装置で測定することで、クライアント装置に負荷をかけずにアプリケーション応答時間およびネットワーク遅延状態を正確に監視することが可能なる。 Furthermore, by measuring the application response time executed by the server device in response to a request from the client device using a remote monitoring device using a passive monitoring method, the application response time and network delay state can be reduced without imposing a load on the client device. It becomes possible to monitor accurately.
本発明の第１実施形態に係るリモート・パッシブ型性能監視システムを説明するネットワーク構成図の一例を示した模式図である。It is the schematic diagram which showed an example of the network block diagram explaining the remote passive type performance monitoring system which concerns on 1st Embodiment of this invention. 本発明の第１実施形態に係るパケットフォーマットを説明する模式図である。It is a schematic diagram explaining the packet format which concerns on 1st Embodiment of this invention. 本発明の第１実施形態に係るリモート・パッシブ型性能監視システムにおいて、パケットデータ収集装置PSに記録されるデータの一例を示した模式図である。In the remote passive type performance monitoring system concerning a 1st embodiment of the present invention, it is the mimetic diagram showing an example of the data recorded on packet data collection device PS. 本発明の第１実施形態に係るリモート・パッシブ型性能監視システムにおいて、パケットデータ収集装置PCnに記録されるデータの一例を示した模式図である。FIG. 3 is a schematic diagram illustrating an example of data recorded in a packet data collection device PCn in the remote / passive performance monitoring system according to the first embodiment of the present invention. 本発明の第１実施形態に係るリモート・パッシブ型性能監視システムにおいて、リモート監視装置が実行するプロセス（アプリケーション処理時間の測定プロセス）の一例を示したフローチャート図である。It is the flowchart figure which showed an example of the process (measurement process of application processing time) which a remote monitoring apparatus performs in the remote passive type performance monitoring system which concerns on 1st Embodiment of this invention. 本発明の第１実施形態に係るリモート・パッシブ型性能監視システムにおいて、リモート監視装置が実行するプロセス（応答時間の測定プロセス）の一例を示したフローチャート図である。It is the flowchart figure which showed an example of the process (measurement process of response time) which a remote monitoring apparatus performs in the remote passive type performance monitoring system which concerns on 1st Embodiment of this invention.
Ｓ　　　　　　　サーバ装置Ｃ１～Ｃ２　　　クライアント装置Ｍ　　　　　　　リモート監視装置ＰＳ　　　　　　パケット収集装置ＰＣ１～ＰＣ２　パケット収集装置 S server devices C1-C2 client device M remote monitoring device PS packet collection device PC1-PC2 packet collection device
以下、本発明を実施するための形態について図面を参照して詳細に説明する。なお、本発明は、以下に述べる実施形態により限定されるものではない。　 Hereinafter, embodiments for carrying out the present invention will be described in detail with reference to the drawings. In addition, this invention is not limited by embodiment described below. *
１．第１実施形態　本発明の第１実施形態に係るリモート・パッシブ型性能監視システムについて、図１に示すネットワーク構成図を用いて説明する。図１に示すように、クライアント装置Cn（ｎ：１以上の自然数）、サーバ装置S、およびリモート監視装置Mがネットワーク上に接続さ
れ、さらにサーバ装置Sと同一セグメント上にパケット収集装置PSが接続されている。ここでネットワークは、社内LAN／イントラネットまたはインターネットのいずれでもよい。　 1. First Embodiment A remote / passive type performance monitoring system according to a first embodiment of the present invention will be described with reference to the network configuration diagram shown in FIG. As shown in FIG. 1, a client device Cn (n: a natural number of 1 or more), a server device S, and a remote monitoring device M are connected on the network, and a packet collection device PS is connected on the same segment as the server device S. Has been. Here, the network may be either an in-house LAN / intranet or the Internet.
本発明のリモート・パッシブ型性能監視システムは、クライアント装置Cnからの要求によりサーバ装置Sで実行されるアプリケーション処理時間を、サーバ装置Sに直接アクセスせずに（サーバ装置に負荷をかけずに）パッシブ・モニタリング方式にてリモート監視装置Mで測定してサーバ装置の負荷状態をリモート監視する。以下、詳細に説明する。　 The remote / passive performance monitoring system of the present invention passively processes the application processing time executed on the server device S in response to a request from the client device Cn without directly accessing the server device S (without applying a load to the server device). -Monitor the load status of the server device by remote monitoring device M using the monitoring method. Details will be described below. *
パケット収集装置PSは、サーバ装置Sの送受信パケットをモニタリングし、該送受信パケットの情報から、記録パケット情報として、IPヘッダ情報に含まれるIPアドレス情報、TCP/UDPヘッダ情報に含まれるアプリケーション情報、及びこのアプリケーション情報に対応するPayload情報を、パケット毎にタイムスタンプ情報を付加して記録する。　 The packet collection device PS monitors transmission / reception packets of the server device S, and from the transmission / reception packet information, as recording packet information, IP address information included in IP header information, application information included in TCP / UDP header information, and Payload information corresponding to this application information is recorded with time stamp information added for each packet. *
図２に示すように、パケットは、Ethernet（登録商標） Header, IP Header, TCP/UDP Header, Payloadで構成されている。IP Headerには、{Source IP Address, Destination IP Address}の情報が含まれている。TCP/UDP Headerには、{Source Port, Destination Port}の情報が含まれている。Payloadには、アプリケーション情報（Source Port / Destination Port）に応じたPayload情報{Request ID, Request Content}が含まれている。ここでPayloadは、アプリケーション毎に異なる情報で構成され、したがってRequest ID, Request Contentの情報もアプリケーション毎にユニークな情報となる。　 As shown in FIG. 2, the packet is composed of Ethernet (registered trademark) Header, IP Header, TCP / UDP Header, Payload. The IP header includes information of {Source IP address, Destination IP IP Address}. TCP / UDP Header includes information of {Source Port, Destination Port}. Payload includes Payload information {Request ID, Request I Content} corresponding to application information (Source Port / Destination Port). Here, the Payload is composed of different information for each application. Therefore, the information of Request ID and Request ユ ニ ー ク Content is also unique information for each application. *
図３は、パケット収集装置PSに記録されるデータの一例を示したものである。パケット収集装置PSは、記録パケット情報として、IPヘッダ情報IPアドレス情報{Source IP Address, Destination IP Address}、TCP/UDPヘッダ情報に含まれるアプリケーション情報{Source Port, Destination Port}、及びこのアプリケーション情報に対応するPayload情報{Request ID,  Request Content}を、パケット毎にタイムスタンプ情報を付加して記録する。　 FIG. 3 shows an example of data recorded in the packet collection device PS. The packet collection device PS includes, as recorded packet information, IP header information IP address information {Source IP Address, Destination IP Address}, application information included in the TCP / UDP header information {Source Port, Destination Port}, and this application information. Corresponding payload information {Request ID, Request Content} is recorded with time stamp information added for each packet. *
図３の例では、時刻TS1に、クライアント装置C１からサーバ装置Sに対する要求パケットHTTP Request（C1→S）のパケット情報が記録されている。このときのRequest IDとして”ID1”が記録され、Request Contentとして”URL情報”が記録される。この要求パケットに対してサーバ装置Sで実行されたアプリケーションの応答パケットHTTP Response（S→C1）のパケット情報が時刻TS3に記録されている。このときのRequest IDとして前記と同じ”ID1”が記録され、Request Contentとして前記と同じ”URL情報”が記録される。　 In the example of FIG. 3, packet information of a request packet HTTP Request (C1 → S) from the client device C1 to the server device S is recorded at time TS1. At this time, “ID1” is recorded as Request ID, and “URL information” is recorded as Request Content. The packet information of the response packet HTTP Response (S → C1) of the application executed on the server apparatus S in response to this request packet is recorded at time TS3. At this time, the same “ID1” is recorded as the Request ID, and the same “URL information” is recorded as the Request Content. *
同様に、時刻TS2に、クライアント装置C2からサーバ装置Sに対する要求パケットFTP Request（C2→S）のパケット情報が記録されている。このときのRequest IDとして”ID2”が記録され、Request Contentとして”File Name情報”が記録される。この要求パケットに対してサーバ装置Sで実行されたアプリケーションの応答パケットFTP Response（S→C2）のパケット情報が時刻TS5に記録される。このときのRequest IDとして前記と同じ”ID2”が記録され、Request Contentとして前記と同じ”File Name情報”が記録される。　 Similarly, packet information of a request packet FTP Request (C2 → S) from the client device C2 to the server device S is recorded at time TS2. At this time, “ID2” is recorded as the Request ID, and “File Name information” is recorded as the Request Content. The packet information of the response packet FTP Response (S → C2) of the application executed on the server apparatus S in response to this request packet is recorded at time TS5. At this time, the same “ID2” is recorded as the Request ID, and the same “File Name information” is recorded as the Request Content. *
同様に、時刻TS4に、クライアント装置C1からサーバ装置Sに対する要求パケットSNMP Request（C1→S）のパケット情報が記録されている。このときのRequest IDとして”ID3”が記録され、Request Contentとして”MO Name情報”が記録される。この要求パケットに対してサーバ装置Sで実行されたアプリケーションの応答パケットSNMP Response（S→C1）のパケット情報が時刻TS6に記録される。このときのRequest IDとして前記と同じ”ID3”が記録され、Request Contentとして前記と同じ”MO Name情報”が記録される。　 Similarly, packet information of a request packet SNMP Request (C1 → S) from the client device C1 to the server device S is recorded at time TS4. At this time, “ID3” is recorded as the Request ID, and “MO Name information” is recorded as the Request Content. The packet information of the response packet SNMP Response (S → C1) of the application executed on the server apparatus S in response to this request packet is recorded at time TS6. At this time, the same “ID3” as above is recorded as the Request ID, and the same “MO Name information” as above is recorded as the Request Content. *
リモート監視装置Mは、パケット収集装置PSに記録されたパケット情報からクライアント装置Cnに関するパケット情報を取出し（取出手段）、前記パケット情報を基に、クライアント装置Cnからサーバ装置Sへの要求パケットと、この要求パケットによりサーバ装置Sで実行されたアプリケーションの応答パケットを特定し（特定手段）、前記要求パケットのタイムスタンプ情報と前記応答パケットのタイムスタンプ情報との差分値をアプリケーション処理時間として算出し（測定手段）、そのアプリケーション処理時間に関する情報をモニター表示する（表示手段）。すなわちリモート監視装置Mは、クライアント装置Cnからの要求によりサーバ装置Sで実行されるアプリケーション処理時間を、サーバ装置Sに直接アクセスせずに（サーバ装置Sに負荷をかけずに）パッシブ・モニタリング方式にて測定する。　 The remote monitoring device M takes out packet information related to the client device Cn from the packet information recorded in the packet collection device PS (extraction means), and based on the packet information, a request packet from the client device Cn to the server device S, The response packet of the application executed in the server device S is specified by this request packet (identifying means), and the difference value between the time stamp information of the request packet and the time stamp information of the response packet is calculated as the application processing time ( Measuring means) and information related to the application processing time is displayed on the monitor (display means). That is, the remote monitoring device M adopts a passive monitoring method in which the application processing time executed by the server device S in response to a request from the client device Cn is not accessed directly (without loading the server device S). To measure. *
前記特定手段は、前記取出手段で取出したクライアント装置Cnに関するパケット情報から、クライアント装置Cnからサーバ装置Sへの要求パケットを選定し、パケット情報に含まれるIPアドレス情報、アプリケーション情報、及びPayload情報を基に、この要求パケットに対応する応答パケット（サーバ装置Sからクライアント装置Cnへの応答パケット）を特定する。　 The specifying unit selects a request packet from the client device Cn to the server device S from the packet information regarding the client device Cn extracted by the extracting unit, and includes IP address information, application information, and payload information included in the packet information. Based on this, a response packet (response packet from the server device S to the client device Cn) corresponding to the request packet is specified. *
さらに前記特定手段では次の方法のいずれかを用いてパケットを特定する。（１）要求パケットにPayload情報{Request ID, Request Content}が含まれている場合、前記特定手段は、前記取出手段で取出したクライアント装置Cnに関するパケット情報を基に、クライアント装置Cnからサーバ装置Sへの要求パケットを選定し、この要求パケットと同じ{Request ID, Request Content}を有する応答パケット（サーバ装置Sからクライアント装置Cnへの応答パケット）を特定する。（２）要求パケットにPayload情報{Request ID, Request Content}が含まれていない場合、前記特定手段は、前記取出手段で取出したクライアント装置Cnに関するパケット情報を基に、クライアント装置Cnからサーバ装置Sへの要求パケットを選定し、この要求パケットの{Destination Port}と同じ{Source Port}を有する応答パケットの中で、前記要求パケットの{Source Port}と同じ{Destination Port}を有する応答パケット（サーバ装置Sからクライアント装置Cnへの応答パケット）を特定する。（３）TCPパケットの場合、前記特定手段は、前記取出手段で取出したクライアント装置Cnに関するパケット情報を基に、クライアント装置Cnからサーバ装置Sへの要求パケットを選定し、この要求パケットのTCPヘッダ情報の{Sequence Number, Acknowledgment Number}を用いて、この要求パケットに対応する応答パケット（サーバ装置Sからクライアント装置Cnへの応答パケット）を特定する。　 Further, the specifying means specifies the packet using any of the following methods. (1) When the payload information {Request ID, Request Content} is included in the request packet, the specifying unit transmits the server device S to the server device Sn based on the packet information regarding the client device Cn extracted by the extracting unit. Request packet is selected, and a response packet (response packet from the server device S to the client device Cn) having the same {Request ID, Request Content} as the request packet is specified. (2) If the request packet does not include the payload information {Request ID, Request Request Content}, the specifying means sends the server device S to the server device Sn based on the packet information related to the client device Cn extracted by the extracting device. Request packet is selected, and among the response packets having the same {Source Port} as {Destination Port} of this request packet, the response packet having the same {Destination Port} as {Source Port} of the request packet (server A response packet from the device S to the client device Cn) is identified. (3) In the case of a TCP packet, the specifying unit selects a request packet from the client device Cn to the server device S based on the packet information regarding the client device Cn extracted by the extracting unit, and the TCP header of the request packet Using the information {Sequence サ ー バ Number, Acknowledgment Number}, a response packet corresponding to this request packet (response packet from the server device S to the client device Cn) is specified. *
次に、リモート監視装置Mが実行するプロセス（アプリケーション処理時間の測定プロセス）の一例について図５を用いて説明する。図５では、前記特定手段が上記（１）の方法を用いた場合のプロセスの一例を示している。　 Next, an example of a process (application processing time measurement process) executed by the remote monitoring apparatus M will be described with reference to FIG. FIG. 5 shows an example of a process when the specifying means uses the above method (1). *
取出手段１０１では、パケット収集装置PSに記録されたパケット情報から、クライアント装置Cnに関するパケット情報として、タイムスタンプ情報、IPアドレス情報、アプリケーション情報、及びPayload情報を取出す処理を行う。　 The extraction unit 101 performs processing for extracting time stamp information, IP address information, application information, and payload information as packet information related to the client device Cn from the packet information recorded in the packet collection device PS. *
図３の例を用いると、取出手段１０１は、パケット収集装置PSに記録されたパケット情報からクライアント装置C１に関するパケット情報として、(i)タイムスタンプ情報{Time Stamp:TS1}、IPアドレス情報{Source IP Address:IP(C1), Destination IP Address:IP(S)}、アプリケーション情報{Destination Port:80}、Payload情報{Request ID:ID1, Request Content:URL}(ii)タイムスタンプ情報{Time Stamp:TS3}、IPアドレス情報{Source IP Address:IP(S), Destination IP Address:IP(C1)}、アプリケーション情報{Source Port:80}、Payload情報{Request ID:ID1, Request Content:URL}(iii)タイムスタンプ情報{Time Stamp:TS4}、IPアドレス情報{Source IP Address:IP(C1), Destination IP Address:IP(S)}、アプリケーション情報{Destination Port:161}、Payload情報{Request ID:ID3, Request Content:MO Name}(iv)タイムスタンプ情報{Time Stamp:TS6}、IPアドレス情報{Source IP Address:IP(S), Destination IP Address:IP(C1)}、アプリケーション情報{Source Port:161}、 Payload情報{Request ID: ID3, Request Content:MO Name}を取出す処理を行う。　 When the example of FIG. 3 is used, the extraction unit 101 uses (i) time stamp information {Time Stamp: TS1}, IP address information {Source as packet information related to the client device C1 from the packet information recorded in the packet collection device PS. IP Address: IP (C1), Destination IP Address: IP (S)}, Application Information {Destination Port: 80}, Payload Information {Request ID: ID1, Request Content: URL} (ii) Timestamp Information {Time Stamp: TS3}, IP address information {Source IP Address: IP (S), Destination IP IP Address: IP (C1)}, application information {Source Port 80: Payload information {Request ID: ID1, Request Content: URL} (iii ) Time stamp information {Time Stamp: TS4}, IP address information {Source IP Address: IP (C1), Destination IP Address: IP (S)}, application information {Destination Port: 161}, Payload information {Request ID: ID3 , Request Content: MO Name} (iv) Time stamp information {Time Stamp: TS6}, IP address information {Sou rce IP Address: IP (S), Destination IP Address: IP (C1)}, application information {Source Port: 161}, Payload information {Request ID: ID3, Request Content: MO Name} is extracted. *
次に特定手段１０２では、取出手段１０１で取出したクライアント装置Cnに関するパケット情報を基に、クライアント装置Cnからサーバ装置Sへの要求パケットを選定し、この要求パケットと同じ{Request ID, Request Content}を有する応答パケット（サーバ装置Sからクライアント装置Cnへの応答パケット）を特定する。　 Next, the specifying unit 102 selects a request packet from the client device Cn to the server device S based on the packet information regarding the client device Cn extracted by the extracting unit 101, and has the same {Request ID, Request 同 じ Content} as this request packet. The response packet (response packet from the server apparatus S to the client apparatus Cn) is specified. *
図３の例を用いると、特定手段１０２は、取出手段１０１で取出したクライアント装置C１に関するパケット情報（上記(i)～(iv)）から、同じ{Request ID, Request Content}を有するパケットとして、HTTPに関する要求パケット(i)および応答パケット(ii)を特定する。同様に、特定手段１０２は、取出手段１０１で取出したパケット情報（上記(i)～(iv)）から、同じ{Request ID, Request Content}を有するパケットとして、SNMPに関する要求パケット(iii)および応答パケット(iv)を特定する。　 Using the example of FIG. 3, the specifying unit 102 uses the packet information ((i) to (iv)) regarding the client device C1 extracted by the extracting unit 101 as a packet having the same {Request ID, Request Content}. A request packet (i) and a response packet (ii) related to HTTP are specified. Similarly, the specifying unit 102 uses the packet information (the above (i) to (iv)) extracted by the extracting unit 101 as a packet having the same {Request ID, Request Content}, and a request packet (iii) and response regarding SNMP. Identify packet (iv). *
次に測定手段１０３では、特定手段１０２で特定した要求パケットのタイムスタンプ情報{Time Stamp:TS1}と応答パケットのタイムスタンプ情報{Time Stamp:TS2}との差分値{TS2-TS1}をサーバ装置Sで実行されたアプリケーション処理時間として算出する処理を行う。　 Next, the measuring means 103 uses the difference value {TS2-TS1} between the time stamp information {Time Stamp: TS1} of the request packet specified by the specifying means 102 and the time stamp information {Time Stamp: TS2} of the response packet as the server device. Processing to calculate the application processing time executed in S is performed. *
図３の例を用いると、測定手段１０３は、HTTPに関する要求パケット(i)のタイムスタンプ情報{Time Stamp:TS1}と応答パケット(ii)のタイムスタンプ情報{Time Stamp:TS3}との差分値{TS3-TS1}をサーバ装置Sで実行されたHTTPアプリケーション処理時間として算出する。同様に、測定手段１０３は、SNMPに関する要求パケット(iii)のタイムスタンプ情報{Time Stamp:TS4}と応答パケット(iv)のタイムスタンプ情報{Time Stamp:TS6}との差分値{TS6-TS4}をサーバ装置Sで実行されたSNMPアプリケーション処理時間として算出する。　 Using the example of FIG. 3, the measuring means 103 uses the difference value between the time stamp information {Time Stamp: TS1} of the request packet (i) related to HTTP and the time stamp information {Time Stamp: TS3} of the response packet (ii). {TS3-TS1} is calculated as the HTTP application processing time executed by the server apparatus S. Similarly, the measuring means 103 uses the difference value {TS6-TS4} between the time stamp information {Time Stamp: TS4} of the request packet (iii) related to SNMP and the time stamp information {Time Stamp: TS6} of the response packet (iv). Is calculated as the SNMP application processing time executed by the server apparatus S. *
次に表示手段１０４では、測定手段１０３で算出したアプリケーション処理時間に関する情報をモニター表示する処理と、そのアプリケーション処理時間が予め設定された閾値を超えた（サーバ装置Sの負荷が大きくなった）場合にアラーム警告する処理を行う。　 Next, in the display unit 104, when the process related to the application processing time calculated by the measurement unit 103 is displayed on the monitor and the application processing time exceeds a preset threshold value (the load on the server device S increases) The alarm warning process is performed. *
以上から、リモート監視装置Mは、サーバ装置Sに直接アクセスせずに（サーバ装置Sに負荷をかけずに）パッシブ・モニタリング方式にてサーバ装置Sで実行されるアプリケーション処理時間を正確に測定することができる。　 From the above, the remote monitoring device M accurately measures the application processing time executed on the server device S by the passive monitoring method without directly accessing the server device S (without loading the server device S). Can do. *
なお、上記で説明した例では、要求パケットおよび応答パケットが１個の場合について説明したが、送受信データが長くなりパケットが複数個になる場合がある。この場合、要求パケットについては最後のパケット、応答パケットについては先頭のパケットを使用してアプリケーション処理時間を算出する。　 In the example described above, the case where there is one request packet and one response packet has been described. However, there are cases where transmission / reception data becomes long and a plurality of packets are present. In this case, the application processing time is calculated using the last packet for the request packet and the first packet for the response packet. *
また、パケット収集装置PSにSNMPエージェントを実装し、リモート監視装置MにSNMPマネージャを実装し、リモート監視装置Mの取出手段において、SNMPマネージャがSNMPポーリングを利用してパケット収集装置PSに記録されたパケット情報を取出すこともできる。　 Also, the SNMP agent is installed in the packet collection device PS, the SNMP manager is installed in the remote monitoring device M, and the SNMP manager is recorded in the packet collection device PS using SNMP polling in the extraction means of the remote monitoring device M Packet information can also be extracted. *
２．第２実施形態　本発明の第２実施形態に係るリモート監視システムについて、図１に示すネットワーク構成図を用いて説明する。第１実施形態では、サーバ装置Sと同一セグメント上にパケット収集装置PSを接続し、パケット収集装置PSが記録したサーバ装置Sの送受信パケットに関する情報を基に、サーバ装置Sで実行されるアプリケーション処理時間をパッシブ・モニタリング方式にてリモート監視装置Mで測定してサーバ装置の負荷状態を監視するシステムについて説明した。第２実施形態では、第１実施形態の構成を基に、クライアント装置Cnと同一セグメント上にパケット収集装置PCnが接続された構成としている。　 2. Second Embodiment A remote monitoring system according to a second embodiment of the present invention will be described with reference to the network configuration diagram shown in FIG. In the first embodiment, an application process executed on the server apparatus S based on the information related to the transmission / reception packet of the server apparatus S recorded on the packet collection apparatus PS by connecting the packet collection apparatus PS on the same segment as the server apparatus S. A system has been described in which the time is measured by the remote monitoring device M by the passive monitoring method and the load state of the server device is monitored. In the second embodiment, the packet collection device PCn is connected on the same segment as the client device Cn based on the configuration of the first embodiment. *
本発明のリモート監視システムは、クライアント装置Cnからの要求によりサーバ装置Sで実行されるアプリケーション応答時間を、ク
ライアント装置Cnに直接アクセスせずに（クライアント装置Cnに負荷をかけずに）パッシブ・モニタリング方式にてリモート監視装置Mで測定しサーバ装置Sの負荷状態およびネットワーク遅延状態をリモート監視する。以下、詳細に説明する。　 In the remote monitoring system of the present invention, an application response time executed by the server device S in response to a request from the client device Cn is a passive monitoring method without directly accessing the client device Cn (without applying a load to the client device Cn). The remote monitoring device M measures the load state and network delay state of the server device S remotely. Details will be described below.
パケット収集装置PCnは、クライアント装置Cnの送受信パケットをモニタリングし、該送受信パケットの情報から、記録パケット情報として、IPヘッダ情報に含まれるIPアドレス情報、TCP/UDPヘッダ情報に含まれるアプリケーション情報、及びこのアプリケーション情報に対応するPayload情報を、パケット毎にタイムスタンプ情報を付加して記録する。　 The packet collection device PCn monitors the transmission / reception packet of the client device Cn, and from the transmission / reception packet information, as the recording packet information, the IP address information included in the IP header information, the application information included in the TCP / UDP header information, and Payload information corresponding to this application information is recorded with time stamp information added for each packet. *
図４は、パケット収集装置PCnに記録されるデータの一例を示したものである。パケット収集装置PCnは、記録パケット情報として、IPヘッダ情報に含まれるIPアドレス情報{Source IP Address, Destination IP Address}、TCP/UDPヘッダ情報に含まれるアプリケーション情報{Source Port, Destination Port}、及びこのアプリケーション情報に対応するPayload情報{Request ID, Request Content}を、パケット毎にタイムスタンプ情報を付加して記録する。　 FIG. 4 shows an example of data recorded in the packet collection device PCn. The packet collection device PCn includes, as recorded packet information, IP address information {SourceIPIP Address, Destination IP Address} included in the IP header information, application information {Source Port, Destination Port} included in the TCP / UDP header information, and Payload information {Request ID, Request Content} corresponding to application information is recorded with time stamp information added for each packet. *
図４の例では、時刻TC11に、クライアント装置C１からサーバ装置Sに対する要求パケットHTTP Request（C1→S）のパケット情報が記録されている。このときのRequest IDとして”ID1”が記録され、Request Contentとして”URL情報”が記録される。この要求パケットに対してサーバ装置Sで実行されたアプリケーションの応答パケットHTTP Response（S→C1）のパケット情報が時刻TC12に記録されている。このときのRequest IDとして前記と同じ”ID1”が記録され、Request Contentとして前記と同じ”URL情報”が記録される。　 In the example of FIG. 4, packet information of a request packet HTTP パ ケ ッ ト Request (C1 → S) from the client device C1 to the server device S is recorded at time TC11. At this time, “ID1” is recorded as Request ID, and “URL information” is recorded as Request Content. The packet information of the response packet HTTP Response (S → C1) of the application executed on the server apparatus S in response to this request packet is recorded at time TC12. At this time, the same “ID1” is recorded as the Request ID, and the same “URL information” is recorded as the Request Content. *
同様に、時刻TC13に、クライアント装置C1からサーバ装置Sに対する要求パケットSNMP Request（C1→S）のパケット情報が記録されている。このときのRequest IDとして”ID3”が記録され、Request Contentとして”MO Name情報”が記録される。この要求パケットに対してサーバ装置Sで実行されたアプリケーションの応答パケットSNMP Response（S→C1）のパケット情報が時刻TC14に記録される。このときのRequest IDとして前記と同じ”ID3”が記録され、Request Contentとして前記と同じ”MO Name情報”が記録される。　 Similarly, packet information of a request packet SNMP Request (C1 → S) from the client device C1 to the server device S is recorded at time TC13. At this time, “ID3” is recorded as the Request ID, and “MO Name information” is recorded as the Request Content. The packet information of the response packet SNMP Response (S → C1) of the application executed by the server apparatus S in response to this request packet is recorded at time TC14. At this time, the same “ID3” as above is recorded as the Request ID, and the same “MO Name information” as above is recorded as the Request Content. *
リモート監視装置Mは、パケット収集装置PCnに記録されたパケット情報からサーバ装置Sに関するパケット情報を取出し（取出手段）、前記パケット情報を基に、クライアント装置Cnからサーバ装置Sへの要求パケットと、この要求パケットによりサーバ装置Sで実行されたアプリケーションの応答パケットを特定し（特定手段）、前記要求パケットのタイムスタンプ情報と前記応答パケットのタイムスタンプ情報との差分値をアプリケーション応答時間として算出し（測定手段）、そのアプリケーション応答時間に関する情報をモニター表示する（表示手段）。すなわちリモート監視装置Mは、クライアント装置Cnからの要求によりサーバ装置Sで実行されるアプリケーション応答時間を、クライアント装置Cnに直接アクセスせずに（クライアント装置Cnに負荷をかけずに）パッシブ・モニタリング方式にて測定する。　 The remote monitoring device M takes out packet information related to the server device S from the packet information recorded in the packet collection device PCn (extraction means), based on the packet information, a request packet from the client device Cn to the server device S, The response packet of the application executed in the server device S is specified by this request packet (identifying means), and a difference value between the time stamp information of the request packet and the time stamp information of the response packet is calculated as an application response time ( Measurement means) and information on the application response time are displayed on the monitor (display means). That is, the remote monitoring device M adopts a passive monitoring method in which the application response time executed by the server device S in response to a request from the client device Cn is not directly accessed to the client device Cn (without applying a load to the client device Cn). To measure. *
前記特定手段は、前記取出手段で取出したサーバ装置Sに関するパケット情報から、クライアント装置Cnからサーバ装置Sへの要求パケットを選定し、パケット情報に含まれるIPアドレス情報、アプリケーション情報、及びPayload情報を基に、この要求パケットに対応する応答パケット（サーバ装置Sからクライアント装置Cnへの応答パケット）を特定する。さらに前記特定手段では、上記で述べた（１）～（３）の方法のいずれかを用いてパケットを特定する。　 The specifying unit selects a request packet from the client device Cn to the server device S from the packet information regarding the server device S extracted by the extracting unit, and includes IP address information, application information, and payload information included in the packet information. Based on this, a response packet (response packet from the server device S to the client device Cn) corresponding to the request packet is specified. Further, the specifying means specifies a packet using any one of the methods (1) to (3) described above. *
次に、リモート監視装置Mが実行するプロセス（応答時間の測定プロセス）の一例について図６を用いて説明する。図６では、前記特定手段が上記（１）の方法を用いた場合のプロセスの一例を示している。　 Next, an example of a process (response time measurement process) executed by the remote monitoring apparatus M will be described with reference to FIG. FIG. 6 shows an example of a process when the specifying means uses the above method (1). *
取出手段２０１では、パケット収集装置PCnに記録されたパケット情報から、サーバ装置Sに関するパケット情報として、タイムスタンプ情報、IPアドレス情報、アプリケーション情報、及びPayload情報を取出す処理を行う。　 The extracting unit 201 performs processing for extracting time stamp information, IP address information, application information, and payload information as packet information related to the server device S from the packet information recorded in the packet collection device PCn. *
図４の例を用いると、取出手段２０１は、パケット収集装置PCnに記録されたパケット情報からサーバ装置Sに関するパケット情報として、(i)タイムスタンプ情報{Time Stamp:TC11}、IPアドレス情報{Source IP Address:IP(C1),  Destination IP Address:IP(S)}、アプリケーション情報{Destination Port:80}、Payload情報{Request ID:ID1, Request Content:URL}(ii)タイムスタンプ情報{Time Stamp:TC12}、IPアドレス情報{Source IP Address:IP(S),  Destination IP Address:IP(C1)}、アプリケーション情報{Source Port:80}、Payload情報{Request ID:ID1, Request Content:URL}(iii)タイムスタンプ情報{Time Stamp:TC13}、IPアドレス情報{Source IP Address:IP(C1), Destination IP Address:IP(S)}、アプリケーション情報{Destination Port:161}、Payload情報{Request ID:ID3, Request Content:MO Name}(iv)タイムスタンプ情報{Time Stamp:TC14}、IPアドレス情報{Source IP Address:IP(S),  Destination IP Address:IP(C1)}、アプリケーション情報{Source Port:161}、Payload情報{Request ID:ID3, Request Content:MO Name}を取出す処理を行う。　 When the example of FIG. 4 is used, the extraction unit 201 uses (i) time stamp information {Time Stamp: TC11}, IP address information {Source as packet information related to the server device S from the packet information recorded in the packet collection device PCn. IP Address: IP (C1), Destination IP Address: IP (S)}, Application Information {Destination Port: 80}, Payload Information {Request ID: ID1, Request Content: URL} (ii) Timestamp Information {Time Stamp: TC12}, IP address information {Source IP Address: IP (S), Destination IP Address: IP (C1)}, application information {Source Port 80: Payload information {Request ID: ID1, Request Content: URL} (iii ) Time stamp information {Time Stamp: TC13}, IP address information {Source IP Address: IP (C1), Destination IP Address: IP (S)}, application information {Destination Port: 161}, Payload information {Request ID: ID3 , Request Content: MO Name} (iv) Time stamp information {Time Stamp: TC14}, IP address information {Source IP Address: IP (S), Destination IP Address: IP (C1)}, application information {Source Port: 161}, payload information {Request ID: ID3, Request Content: MO Name} are extracted. *
次に特定手段２０２では、取出手段１０１で取出したサーバ装置Sに関するパケット情報を基に、クライアント装置Cnからサーバ装置Sへの要求パケットを選定し、この要求パケットと同じ{Request ID, Request Content}を有する応答パケット（サーバ装置Sからクライアント装置Cnへの応答パケット）を特定する。　 Next, the specifying unit 202 selects a request packet from the client device Cn to the server device S based on the packet information regarding the server device S extracted by the extracting unit 101, and has the same {Request ID, Request Content} as the request packet. The response packet (response packet from the server apparatus S to the client apparatus Cn) is specified. *
図４の例を用いると、特定手段２０２は、取出手段２０１で取出したサーバ装置Sに関するパケット情報（上記(i)～(iv)）から、同じ{Request ID, Request Content}を有するパケットとして、HTTPに関する要求パケット(i)および応答パケット(ii)を特定する。同様に、特定手段２０２は、取出手段２０１で取出したパケット情報（上記(i)～(iv)）から、同じ{Request ID, Request Content}を有するパケットとして、SNMPに関する要求パケット(iii)および応答パケット(iv)を特定する。　 Using the example of FIG. 4, the specifying unit 202 uses the packet information ((i) to (iv) above) regarding the server device S extracted by the extracting unit 201 as a packet having the same {Request ID, Request Content}. A request packet (i) and a response packet (ii) related to HTTP are specified. Similarly, the specifying unit 202 uses the packet information ((i) to (iv)) extracted by the extracting unit 201 as a packet having the same {Request ID, Request Content}, and a request packet (iii) and response regarding SNMP. Identify packet (iv). *
次に測定手段２０３では、特定手段２０２で特定した要求パケットのタイムスタンプ情報{Time Stamp:TC1}と応答パケットのタイムスタンプ情報{Time Stamp:TC2}との差分値{TC2-TC1}をサーバ装置Sで実行されたアプリケーション応答時間として算出する処理を行う。　 Next, the measuring means 203 uses the difference value {TC2-TC1} between the time stamp information {Time Stamp: TC1} of the request packet specified by the specifying means 202 and the time stamp information {Time Stamp: TC2} of the response packet to the server device. Processing to calculate the application response time executed in S is performed. *
図４の例を用いると、測定手段２０３は、HTTPに関する要求パケット(i)のタイムスタンプ情報{Time Stamp:TC11}と応答パケット(ii)のタイムスタンプ情報{Time Stamp:TC12}との差分値{TC12-TC11}をサーバ装置Sで実行されたHTTPアプリケーション応答時間として算出する。同様に、測定手段２０３は、SNMPに関する要求パケット(iii)のタイムスタンプ情報{Time Stamp:TC13}と応答パケット(iv)のタイムスタンプ情報{Time Stamp:TC14}との差分値{TC14-TC13}をサーバ装置Sで実行されたSNMPアプリケーション応答時間として算出する。　 Using the example of FIG. 4, the measuring unit 203 uses the difference value between the time stamp information {Time Stamp: TC11} of the request packet (i) related to HTTP and the time stamp information {Time Stamp: TC12} of the response packet (ii). {TC12-TC11} is calculated as the HTTP application response time executed by the server apparatus S. Similarly, the measuring means 203 uses the difference value {TC14-TC13} between the time stamp information {Time Stamp: TC13} of the request packet (iii) related to SNMP and the time stamp information {Time Stamp: TC14} of the response packet (iv). Is calculated as the SNMP application response time executed by the server device S. *
次に表示手段２０４では、測定手段２０３で算出したアプリケーション応答時間に関する情報をモニター表示する処理と、そのアプリケーション応答時間が予め設定された閾値を超えた場合にアラーム警告する処理を行う。さらに表示手段２０４では、アプリケーション応答時間と前記アプリケーション処理時間（第１実施形態）との差分値をネットワーク遅延時間として算出し、そのネットワーク遅延時間が予め設定された閾値を超えた場合にアラーム警告する処理を行うこともできる。　 Next, the display unit 204 performs processing for displaying information on the application response time calculated by the measurement unit 203 on a monitor and processing for alarming when the application response time exceeds a preset threshold. Further, the display unit 204 calculates a difference value between the application response time and the application processing time (first embodiment) as a network delay time, and issues an alarm warning when the network delay time exceeds a preset threshold value. Processing can also be performed. *
以上から、リモート監視装置Mは、クライアント装置Cnに直接アクセスせずに（クライアント装置Cnに負荷をかけずに）パッシブ・モニタリング方式にてサーバ装置Sの負荷状態およびネットワーク遅延状態を監視することができる。　 From the above, the remote monitoring device M can monitor the load state and network delay state of the server device S by the passive monitoring method without directly accessing the client device Cn (without applying a load to the client device Cn). . *
また、パケット収集装置PCnにSNMPエージェントを実装し、リモート監視装置MにSNMPマネージャを実装し、リモート監視装置Mの取出手段において、SNMPマネージャがSNMPポーリングを利用してパケット収集装置PCnに記録されたパケット情報を取出すこともできる。　 Also, the SNMP agent is installed in the packet collection device PCn, the SNMP manager is installed in the remote monitoring device M, and the SNMP manager recorded in the packet collection device PCn using SNMP polling in the extraction means of the remote monitoring device M Packet information can also be extracted. *
３．第３実施形態　本発明の第３実施形態に係るリモート監視システムについて説明する。第１実施形態、第２実施形態では、クライアント装置Cnからの要求によりサーバ装置Sで実行されるアプリケーション処理時間／応答時間を、リモート監視装置Mで測定するシステムについて説明したが、第３実施形態では、クライアント装置Cnの負荷状態をリモート監視装置Mで監視するリモート監視システムについて説明する。　 3. Third Embodiment A remote monitoring system according to a third embodiment of the present invention will be described. In the first and second embodiments, the system has been described in which the remote monitoring device M measures the application processing time / response time executed by the server device S in response to a request from the client device Cn, but the third embodiment. A remote monitoring system that monitors the load state of the client device Cn with the remote monitoring device M will be described. *
クライアント装置Cnにおいて定期的に（同じ時間間隔で継続して）外部と通信するアプリケーションが実行される場合、リモート監視装置Mは、パケット収集装置PCnに記録された要求パケットのパケット情報を取出し、該パケット情報に含まれるタイムスタンプ情報から要求パケットが送信された時間間隔値を測定する。　 When an application that communicates with the outside is executed periodically (continuously at the same time interval) in the client device Cn, the remote monitoring device M extracts the packet information of the request packet recorded in the packet collection device PCn, and The time interval value at which the request packet is transmitted is measured from the time stamp information included in the packet information. *
リモート監視装置Mは、前記で測定した時間間隔値に関する情報をモニター表示する処理と、その時間間隔値の変動が予め設定された閾値を超えた（クライアント装置Cnの負荷が大きくなった）場合にアラーム警告する処理を行う。　 The remote monitoring apparatus M monitors and displays information related to the time interval value measured above, and when the fluctuation of the time interval value exceeds a preset threshold (the load on the client apparatus Cn increases) Performs alarm warning processing. *
以上から、リモート監視装置Mは、クライアント装置Cnに直接アクセスせずに（クライアント装置Cnに負荷をかけずに）パッシブ・モニタリング方式にてクライアント装置Cnの負荷状態を監視することができる。  From the above, the remote monitoring apparatus M can monitor the load state of the client apparatus Cn by the passive monitoring method without directly accessing the client apparatus Cn (without applying a load to the client apparatus Cn).

Claims (11)

  1. クライアント装置Cn、サーバ装置S、およびリモート監視装置Mが接続されたネットワークにおいて、クライアント装置Cnからの要求によりサーバ装置Sで実行されるアプリケーション処理時間をパッシブ・モニタリング方式にてリモート監視装置Mで測定しサーバ装置の負荷状態を監視するリモート監視システムであって、　前記サーバ装置Sと同一セグメント上に接続され、該サーバ装置Sの送受信パケットをモニタリングし、該送受信パケットの情報にタイムスタンプ情報を付加して記録するパケット収集装置PSを有し、　前記リモート監視装置Mは、　前記パケット収集装置PSに記録されたパケット情報からクライアント装置Cnに関するパケット情報を取出す取出手段と、　前記パケット情報を基に、クライアント装置Cnからサーバ装置Sへの要求パケットと、この要求パケットによりサーバ装置Sで実行されたアプリケーションの応答パケットを特定する特定手段と、　前記要求パケットのタイムスタンプ情報と前記応答パケットのタイムスタンプ情報からアプリケーション処理時間を算出する測定手段と、　前記測定手段で算出したアプリケーション処理時間に関する情報をモニター表示する表示手段と、　を有することを特徴とするリモート・パッシブ型性能監視システム。 In a network to which the client device Cn, the server device S, and the remote monitoring device M are connected, the application processing time executed on the server device S in response to a request from the client device Cn is measured by the remote monitoring device M using the passive monitoring method. A remote monitoring system for monitoring the load state of the server device, which is connected to the same segment as the server device S, monitors transmission / reception packets of the server device S, and adds time stamp information to the information of the transmission / reception packets. The remote monitoring device M is based on the packet information, taking out means for taking out packet information about the client device Cn from the packet information recorded in the packet collecting device PS, and Request from client device Cn to server device S A specifying means for specifying a response packet of an application executed by the server device S by the request packet, a measuring means for calculating an application processing time from the time stamp information of the request packet and the time stamp information of the response packet; A remote / passive type performance monitoring system comprising: display means for monitoring and displaying information related to the application processing time calculated by the measuring means.
  2. 前記パケット収集装置PSは、サーバ装置Sの送受信パケットをモニタリングし、該送受信パケットの情報から、記録パケット情報として、IPヘッダ情報に含まれるIPアドレス情報、TCP/UDPヘッダ情報に含まれるアプリケーション情報、及びこのアプリケーション情報に対応するPayload情報を、パケット毎にタイムスタンプ情報を付加して記録することを特徴とする請求項１に記載のリモート・パッシブ型性能監視システム。 The packet collection device PS monitors the transmission / reception packet of the server device S, and from the information of the transmission / reception packet, as recording packet information, IP address information included in the IP header information, application information included in the TCP / UDP header information, 2. The remote passive performance monitoring system according to claim 1, wherein the payload information corresponding to the application information is recorded with time stamp information added for each packet.
  3. 前記リモート監視装置Mの特定手段は、前記取出手段で取出したクライアント装置Cnに関するパケット情報から、クライアント装置Cnからサーバ装置Sへの要求パケットを選定し、パケット情報に含まれるIPアドレス情報、アプリケーション情報、及びPayload情報を基に、この要求パケットに対応する応答パケット（サーバ装置Sからクライアント装置Cnへの応答パケット）を特定することを特徴とする請求項１乃至請求項２に記載のリモート・パッシブ型性能監視システム。 The specifying unit of the remote monitoring device M selects a request packet from the client device Cn to the server device S from the packet information regarding the client device Cn extracted by the extracting unit, and includes IP address information and application information included in the packet information. And a response packet (response packet from the server device S to the client device Cn) corresponding to the request packet is specified based on the payload information. Mold performance monitoring system.
  4. 前記リモート監視装置Mの測定手段は、前記特定手段で特定した要求パケットのタイムスタンプ情報{Time Stamp:TS1}と応答パケットのタイムスタンプ情報{Time Stamp:TS2}との差分値{TS2-TS1}をサーバ装置Sで実行され
    たアプリケーション処理時間として算出することを特徴とする請求項１乃至請求項３に記載のリモート・パッシブ型性能監視システム。     The measuring means of the remote monitoring device M includes a difference value {TS2-TS1} between the time stamp information {Time Stamp: TS1} of the request packet specified by the specifying means and the time stamp information {Time Stamp: TS2} of the response packet The remote / passive performance monitoring system according to claim 1, wherein the processing time is calculated as an application processing time executed by the server device.
  5. 前記リモート監視装置Mの表示手段は、前記測定手段で算出したアプリケーション処理時間に関する情報をモニター表示するとともに、前記アプリケーション処理時間が予め設定された閾値を超えた場合にアラーム警告することを特徴とする請求項１乃至請求項４に記載のリモート・パッシブ型性能監視システム。 The display unit of the remote monitoring device M displays information related to the application processing time calculated by the measuring unit and displays an alarm warning when the application processing time exceeds a preset threshold. The remote passive type performance monitoring system according to claim 1.
  6. 請求項１に記載のリモート監視システムにおいて、　前記クライアント装置Cnと同一セグメント上に接続され、該クライアント装置Cnの送受信パケットをモニタリングし、該送受信パケットの情報にタイムスタンプ情報を付加して記録するパケット収集装置PCnを有し、　前記リモート監視装置Mは、　前記パケット収集装置PCnに記録されたパケット情報からサーバ装置Sに関するパケット情報を取出す取出手段と、　前記パケット情報を基に、クライアント装置Cnからサーバ装置Sへの要求パケットと、この要求パケットによりサーバ装置Sで実行されたアプリケーションの応答パケットを特定する特定手段と、　前記要求パケットのタイムスタンプ情報と前記応答パケットのタイムスタンプ情報からアプリケーション応答時間を算出する測定手段と、　前記測定手段で算出したアプリケーション応答時間に関する情報をモニター表示する表示手段と、　を有することを特徴とする請求項１に記載のリモート・パッシブ型性能監視システム。 2. The remote monitoring system according to claim 1, wherein the packet is connected to the same segment as the client device Cn, monitors transmission / reception packets of the client device Cn, and records the transmission / reception packet information with time stamp information added thereto. The remote monitoring device M has a collection device PCn, the remote monitoring device M takes out packet information related to the server device S from the packet information recorded in the packet collection device PCn, and a server from the client device Cn based on the packet information. A request packet to the device S, a specifying means for identifying a response packet of the application executed in the server device S by the request packet, and an application response time from the time stamp information of the request packet and the time stamp information of the response packet. Measuring means to calculate The remote / passive performance monitoring system according to claim 1, further comprising: display means for monitoring and displaying information related to the application response time calculated by the measurement means.
  7. 前記パケット収集装置PCnは、クライアント装置Cnの送受信パケットをモニタリングし、該送受信パケットの情報から、記録パケット情報として、IPヘッダ情報に含まれるIPアドレス情報、TCP/UDPヘッダ情報に含まれるアプリケーション情報、及びこのアプリケーション情報に対応するPayload情報を、パケット毎にタイムスタンプ情報を付加して記録することを特徴とする請求項６に記載のリモート・パッシブ型性能監視システム。 The packet collection device PCn monitors the transmission / reception packet of the client device Cn, and from the information of the transmission / reception packet, as recording packet information, IP address information included in the IP header information, application information included in the TCP / UDP header information, 7. The remote passive performance monitoring system according to claim 6, wherein the payload information corresponding to the application information is recorded with time stamp information added for each packet.
  8. 前記リモート監視装置Mの特定手段は、前記取出手段で取出したサーバ装置Sに関するパケット情報から、クライアント装置Cnからサーバ装置Sへの要求パケットを選定し、パケット情報に含まれるIPアドレス情報、アプリケーション情報、及びPayload情報を基に、この要求パケットに対応する応答パケット（サーバ装置Sからクライアント装置Cnへの応答パケット）を特定することを特徴とすることを特徴とする請求項６乃至請求項７に記載のリモート・パッシブ型性能監視システム。 The specifying unit of the remote monitoring device M selects a request packet from the client device Cn to the server device S from the packet information regarding the server device S extracted by the extracting unit, and includes IP address information and application information included in the packet information. And a response packet (response packet from the server device S to the client device Cn) corresponding to the request packet is specified based on the payload information. The remote passive performance monitoring system described.
  9. 前記リモート監視装置Mの測定手段は、前記特定手段で特定した要求パケットのタイムスタンプ情報{Time Stamp:TC1}と応答パケットのタイムスタンプ情報{Time Stamp:TC2}との差分値{TC2-TC1}をサーバ装置Sで実行されたアプリケーション応答時間として算出することを特徴とする請求項６乃至請求項８に記載のリモート・パッシブ型性能監視システム。 The measuring means of the remote monitoring device M includes the difference value {TC2-TC1} between the time stamp information {Time Stamp: TC1} of the request packet specified by the specifying means and the time stamp information {Time Stamp: TC2} of the response packet The remote passive performance monitoring system according to claim 6, wherein the response time is calculated as an application response time executed by the server device S.
  10. 前記リモート監視装置Mの表示手段は、前記測定手段で算出したアプリケーション応答時間に関する情報をモニター表示するとともに、前記アプリケーション応答時間が予め設定された閾値を超えた場合にアラーム警告すること、及び前記アプリケーション応答時間と前記アプリケーション処理時間との差分値をネットワーク遅延時間として算出し、そのネットワーク遅延時間が予め設定された閾値を超えた場合にアラーム警告することを特徴とする請求項６乃至請求項９に記載のリモート・パッシブ型性能監視システム。 The display means of the remote monitoring device M displays on the monitor information related to the application response time calculated by the measurement means, and issues an alarm warning when the application response time exceeds a preset threshold, and the application 10. The difference between the response time and the application processing time is calculated as a network delay time, and an alarm warning is issued when the network delay time exceeds a preset threshold value. The remote passive performance monitoring system described.
  11. 前記パケット収集装置PSおよびにPCnにSNMPエージェントを実装し、前記リモート監視装置MにSNMPマネージャを実装し、前記リモート監視装置Mの取出手段において、SNMPマネージャがSNMPポーリングを利用して前記パケット収集装置PSおよび前記パケット収集装置PCnに記録されたパケット情報を取出すことを特徴とする請求項１乃至請求項１０に記載のリモート・パッシブ型性能監視システム。  An SNMP agent is mounted on the packet collection device PS and PCn, an SNMP manager is mounted on the remote monitoring device M, and the packet collection device uses SNMP polling by the SNMP manager in the extraction means of the remote monitoring device M. 11. The remote / passive performance monitoring system according to claim 1, wherein packet information recorded in the PS and the packet collection device PCn is taken out.
PCT/JP2015/055062 2014-02-27 2015-02-23 Remote passive-type performance monitoring system WO2015129632A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
JP2016505206A JP6458002B2 (en) 2014-02-27 2015-02-23 Remote / passive performance monitoring system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
JP2014037306 2014-02-27
JP2014-037306 2014-02-27

Publications (1)

Publication Number Publication Date
WO2015129632A1 true WO2015129632A1 (en) 2015-09-03

Family

ID=54008950

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2015/055062 WO2015129632A1 (en) 2014-02-27 2015-02-23 Remote passive-type performance monitoring system

Country Status (2)

Country Link
JP (1) JP6458002B2 (en)
WO (1) WO2015129632A1 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107085561A (en) * 2016-02-04 2017-08-22 三星电子株式会社 Semiconductor equipment and its operating method

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH11346238A (en) * 1998-01-23 1999-12-14 Hewlett Packard Co <Hp> Response time measurement system
WO2006095506A1 (en) * 2005-02-10 2006-09-14 Nec Corporation Information system management device
JP2011090512A (en) * 2009-10-22 2011-05-06 Fujitsu Ltd Monitoring device, monitoring method, and monitoring program

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH11346238A (en) * 1998-01-23 1999-12-14 Hewlett Packard Co <Hp> Response time measurement system
WO2006095506A1 (en) * 2005-02-10 2006-09-14 Nec Corporation Information system management device
JP2011090512A (en) * 2009-10-22 2011-05-06 Fujitsu Ltd Monitoring device, monitoring method, and monitoring program

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107085561A (en) * 2016-02-04 2017-08-22 三星电子株式会社 Semiconductor equipment and its operating method
CN107085561B (en) * 2016-02-04 2022-01-18 三星电子株式会社 Semiconductor device and method of operating the same

Also Published As

Publication number Publication date
JP6458002B2 (en) 2019-01-30
JPWO2015129632A1 (en) 2017-03-30

Similar Documents

Publication Publication Date Title
CN108989136A (en) Business end to end performance monitoring method and device
CN109462490B (en) Video monitoring system and fault analysis method
CN106441402A (en) Sensor assembly calibration method, device and system
CN103873298B (en) A kind of method that quality of data of operation maintenance center&#39;s northbound interface monitors automatically
WO2019006008A1 (en) Apparatus and method for monitoring network performance of virtualized resources
JP6220625B2 (en) Delay monitoring system and delay monitoring method
JP2008283621A (en) Apparatus and method for monitoring network congestion state, and program
US20190007285A1 (en) Apparatus and Method for Defining Baseline Network Behavior and Producing Analytics and Alerts Therefrom
CN105530137B (en) Data on flows analysis method and data on flows analysis system
CN115776449A (en) Train Ethernet communication state monitoring method and system
WO2015129632A1 (en) Remote passive-type performance monitoring system
CN102780612B (en) Method and apparatus to estimate the sender&#39;s congestion window throughout the life of a TCP flow/socket connection
US11736504B2 (en) Method and system to detect abnormal message transactions on a network
CN109120468B (en) Method, device and storage medium for obtaining end-to-end network delay
JP6015881B2 (en) Device that displays trends related to process variables
JP7274438B2 (en) ASSET INFORMATION MANAGEMENT SYSTEM AND ASSET INFORMATION MANAGEMENT METHOD
US11556120B2 (en) Systems and methods for monitoring performance of a building management system via log streams
CN108737368A (en) A kind of method, apparatus and system that package information is transmitted, stores, inquired
US20120066370A1 (en) Business processes tracking
CN103297480A (en) System and method for automatically detecting application service
CN108880920B (en) Cloud service management method and device and electronic equipment
JP2012133414A (en) Testing device, testing method and testing program
US20210149374A1 (en) Information processing device, information processing method, and recording medium
CN106161339A (en) Obtain the method and device of IP access relation
WO2017051518A1 (en) Communication information calculation apparatus, communication information calculation method, recording medium, and communication management system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15755244

Country of ref document: EP

Kind code of ref document: A1

DPE1 Request for preliminary examination filed after expiration of 19th month from priority date (pct application filed from 20040101)
ENP Entry into the national phase

Ref document number: 2016505206

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15755244

Country of ref document: EP

Kind code of ref document: A1