JP2001086117A - Network monitoring method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To conclude which fault is the cause of the plurality of faults and to detect the highest order fault by providing a means for discriminating a real fault and a pseudo-fault based on hierarchical information when a fault occurs in a certain unit. SOLUTION: A configuration information obtaining means S02 for creating a definition table in a hierarchy number at every IP address executes an operation and a connection related information means S03 for defining a master IP address at every IP address executes an operation. A network monitoring part is provided with a monitor information receiving means for receiving the trap event of the fault, a monitor information selecting means S05 for sorting the multiple faults and the trap events into the real fault or the pseudo- fault after receiving the plurality of fault trap events and a monitor screen control means S07 for message-displaying the sorted real fault. Then the network monitoring part receives the plurality of fault trap events, sorts the real faults from the multiple faults and message-displays the real fault.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a communication apparatus connected to a network system or a network monitoring method for monitoring a network state.
The present invention relates to a network monitoring method in which a communication device and a route order are automatically determined in advance, and a failure detection of a communication device to be monitored is detected based on the information.

[0002]

2. Description of the Related Art Conventionally, when monitoring the existence of a device to be monitored by network monitoring, polling is performed at a fixed cycle, and the survival is monitored when the polling times out. A method for displaying all communication devices that have timed out is known on the monitoring screen.

In the case of a tree-structured network,
In many cases, network route information is set by static routing in order to make use of the characteristics of the network.

[0004] Furthermore, at present, large-scale networking is in progress.

[0005] Under such conditions, when monitoring the network, polling is performed for each device, and the polling is determined as a failure for all devices that have timed out. Then, in order to identify the actual failure, the system administrator or the management operator looks at the alarm information displayed on the monitoring screen, determines whether the failure is an actual failure or a simulated failure, and notifies the maintenance person of the occurrence of the failure. Then, the maintenance person who was contacted collected the failure information and performed the diagnosis according to the maintenance manual.

However, at present, when a system administrator or a management operator investigates a fault location by the above-mentioned means in a network that is becoming larger in scale, the actual fault identification time is delayed in proportion to the size of the network. There is a problem.

In order to solve such a problem, a skilled person constructs a knowledge base based on his or her own experience, and realizes a diagnosis system for applying knowledge engineering so that inference is performed using this knowledge base. Attempted.

For example, in JP-A-2-200048 (Prior Art 1), a failure case database including items such as a failure status, a failure location, and a failure search procedure is prepared, and when a failure occurs, failure information is stored. A method has been proposed in which similar cases are searched from the case database based on the above and statistically analyzed to thereby specify a failure site.

Further, Japanese Patent Application Laid-Open No. Hei 5-14899 (prior art 2)
In this example, when a failure occurs, a set of failure site candidates is grouped, and a set of failure site candidates obtained for the next failure is obtained, thereby specifying the failure site.

Furthermore, in the prior art 3, the communication path order of each device is manually input by the management operator every time a device is added, and the actual fault detection is specified based on the route information.

[0011]

However, in the method of the prior art 1 described above, a case similar to a newly generated failure is searched for, and a failure location is specified based on past cases. For obstacles without similar cases,
There is a problem that the location and the cause of the failure cannot be determined.

Further, in the method of the prior art 2, the actual failure is determined by obtaining a set of failure site candidates when a failure occurs, and further obtaining a set of failure site candidates for the next failure. When the scale is increased, it takes time to find a set of the failure site candidates, and there is a problem that a load is imposed on the network device.

Further, in the method of the prior art 3, there is a problem that a burden is imposed on the management operator to define the route information of each device for each additional device.

According to the present invention, when the network is in a healthy state, the path information of all the communication devices is automatically detected and held as management information.

When a failure occurs, the location of the actual failure is determined from the management information.

[0016]

According to the present invention, in order to achieve the above object, before monitoring a network, configuration information concerning a network is determined in advance, and connection-related information between communication devices is determined from the configuration information. Keep it.

Thus, when a plurality of faults occur in a communication device due to polling, it is possible to determine which fault has caused the plurality of faults and to detect the highest fault.

[0018]

Embodiments of the present invention will be described below in detail with reference to the drawings.

FIG. 2 is a network configuration diagram comprising a plurality of communication devices (202 to 211) expressing the present invention using a network configuration, wherein the communication devices are connected between IP addresses. In addition, the communication device (202
To 211) are represented so that the physical hierarchy can be seen from the network monitoring device (201). For example, it is defined that the communication device (202) exists in one layer, the communication device (203, 210) exists in the second layer, and the communication device (204, 207, 21) exists in the third layer.
1) is defined as existing, communication equipment (205, 208) is defined in four layers, and communication equipment (206, 209) is defined in five layers. Is defined. Therefore, the IP belonging to each communication device
The address belongs to the hierarchy of the network. The assignment of each layer number to each hierarchical number in this manner is the first aspect of the present invention.

Next, as viewed from the network monitoring device (201), the network monitoring device stores in advance which route each IP address follows.

For example, what route the IP address (2i) follows to reach the network monitoring device (201) is defined in advance. That is, IP
In order for the address (2i) to reach the network monitoring device (201), the IP address (2h) must pass through without fail.

In order to reach the network monitoring device, the IP address (2h)
g). As described above, in order to reach the network monitoring device (201) for each IP address, it is necessary to clearly define the next IP address. The next IP address to reach the network monitoring device (201) for each IP address is defined as a parent IP address.

That is, the parent IP address of the IP address (2i) is the IP address (2h), the parent IP address of the IP address (2h) is the IP address (2g), and the parent IP address of the IP address (2g) is , IP address (2f), and the parent IP of the IP address (2f)
The address is the IP address (2e), and the parent IP address of the IP address (2e) is the IP address (2d)
And the parent IP address of the IP address (2d) is I
The P address (2c) becomes the parent IP address of the IP address (2c) becomes the IP address (2b), and the parent IP address of the IP address (2b) becomes NULL.
Thus, for each IP address, the parent IP address
It is a second aspect of the present invention to clearly define whether the address is a P address.

FIG. 3 is a network configuration diagram to which the network monitoring system of the present invention is applied.

The communication device (302) is provided with a network monitoring device (301), and the communication device (303,
306).

Communication equipment (302) and communication equipment (303)
Is connected to the IP address (3b) and the IP address (3
C) are connected by a branch line (31).

The communication device (303) and the communication device (3)
In connection 04), the IP address (3d) and the IP address (3e) are connected by a branch line (32).

Communication equipment (303) and communication equipment (305)
Is connected to the IP address (3f) and the IP address (3
g) are connected by a branch line (33).

Communication device (302) and communication device (306)
Is connected to the IP address (3h) and the IP address (3
i) are connected by a branch line (34).

Communication device (306) and communication device (307)
Is connected to the IP address (3j) and the IP address (3
k) are connected by a branch line (35).

In such a network configuration, when a single failure of the IP address 3b occurs, a failure recognition result when the conventional technique is used and a failure recognition result at each IP address when the present invention is applied are described. It is described in Table (a), Table (b), and Table (c) of FIG.

Table (a) in FIG. 4 shows the result of fault recognition when the conventional technique is used.

In this case, the IP addresses (3b, 3c,
As a result of polling 3d, 3e, 3f, and 3g), it can be understood that failures are determined in all the places where the timeout has occurred.

Table (b) in FIG. 4 shows a failure result when the network configuration acquisition unit according to the present invention is used.

In this case, the IP addresses (3b, 3c,
As a result of polling 3d, 3e, 3f, and 3g, a timeout occurred, but the network monitoring device (30
The IP address (3b) that is present in the nearest hierarchy when viewed from 1) and is closest to the network monitoring device (301) is determined to be faulty.

Table (c) of FIG. 4 shows a failure recognition result when the network information editing unit according to the present invention is used.

In this case, the IP addresses (3b, 3c,
3d, 3e, 3f, 3g), a timeout occurred as a result of polling, but the IP address (3b)
The connection path to the address (3e) is I
Through the P address (3b), through the IP address (3c), through the IP address (3d), and through the IP address (3
e) is reached.

In the case of such a route, the IP address (3b) is determined to be faulty, and other faults for which a polling timeout has occurred are determined to be normal.

Next, in the network configuration shown in FIG.
The difference between the case where the prior art is used when a double failure occurs and the case where the present invention is applied will be described.

FIG. 5 shows that the communication equipment (502) is provided with a network monitoring device (501) and has a path for the communication equipment (503, 506).

Communication device (502) and communication device (503)
Is connected to the IP address (5b) and the IP address (5
C) are connected by a branch line (51).

The communication device (503) and the communication device (5)
In connection 04), the IP address (5d) and the IP address (5e) are connected by a branch line (52).

Communication equipment (503) and communication equipment (505)
Is connected to the IP address (5f) and the IP address (5
g) are connected by a branch line (53).

Communication equipment (502) and communication equipment (506)
Is connected to the IP address (5h) and the IP address (5
i) are connected by a branch line (54).

Communication device (506) and communication device (507)
Is connected to the IP address (5j) and the IP address (5
k) are connected by a branch line (55).

In the case where a double failure of the IP address (5b) and the IP address (5j) occurs in such a network configuration, a failure recognition result in the case of using the prior art and a case in which the present invention is applied. Tables (a), (b), and (c) in FIG. 6 show the failure recognition results at each IP address.
It is described in.

Table (a) in FIG. 6 shows the result of fault recognition when the conventional technique is used.

In this case, the IP addresses (5b, 5c,
As a result of polling at 5d, 5e, 5f, 5g, 5j, and 5k), it can be understood that all locations where a timeout has occurred have determined failure.

Table (b) in FIG. 6 shows a failure result when the network configuration acquisition unit according to the present invention is used.

In this case, the IP addresses (5b, 5c,
As a result of polling 5d, 5e, 5f, 5g, 5j, and 5k), a time-out occurred.
In addition, the closest IP address (5b) is determined as a failure when viewed from the network monitoring device (501).

Table (c) in FIG. 6 shows the result of failure recognition when the network information editing unit according to the present invention is used.

In this case, the IP addresses (5b, 5c,
As a result of polling 5d, 5e, 5f, 5g, 5j, and 5k, a timeout occurred, but the IP address (5
The connection path from b) to the IP address (5e) passes through the IP address (5b), passes through the IP address (5c), passes through the IP address (5d), and reaches the IP address (5e) as viewed from the management terminal. .

In the case of such a route, the IP address (5b) is determined to be a real failure, and other pseudo failures in which a polling timeout has occurred are determined to be normal.

The following can be understood from the above results.

In the case of a double fault, when the conventional technique is used, a plurality of faults are detected, and the actual fault is
I can't judge. In addition, when the network configuration acquisition unit is used, it can be applied to failure detection in the case of a single failure,
It can be seen that when a double fault occurs, an actual fault is overlooked.

In other words, the use of the network information editing unit according to the present invention makes it possible to cope with a single failure and a double failure.

Now, the specific structure of the present invention will be described with reference to FIGS. 1, 7, 8, and 9. FIG.

FIG. 1 is a functional block diagram of a network device showing an embodiment of the present invention.

The network device (1) comprises a network monitoring unit (12) having a conventional function and an initial setting unit (11) for newly editing and processing configuration information.

The network monitoring unit (12) transmits a monitoring information collection request, receives a response thereto, and monitors the abnormal state or state change of a communication device unilaterally as a means similar to the conventional network monitoring apparatus. A monitoring information receiving means (12a) for receiving an event trap transmitted to the device; a monitoring information selecting means (12b) for determining the detection of an actual failure detection by referring to the connection related information table (112b) for the failure event trap; ), A fault selection information DB that stores a fault message determined to be a real fault
(12e), a failure information DB (12) that stores all failure messages received by the monitoring information receiving means (12a).
d).

The initial setting unit (11) includes a network configuration acquisition unit (111) and a network information editing unit (11).
2) It comprises a means (113) for creating network configuration information that can be obtained by a conventional network device, and a configuration information DB (114) for storing network configuration information.

The network configuration acquisition section (111) stores the network configuration information in the configuration information DB creating means (11).
3) A configuration information acquisition unit (111a) for assigning a network hierarchy number to each IP address in the information created in the configuration information DB (114), and stores information in which a hierarchy number is assigned to each IP address. It is composed of a configuration information table (111b) to be stored.

The network information editing unit (112), for each IP address stored in the configuration information table (111b), as viewed from the network monitoring device (1), has connection-related information for defining the parent-child relationship of each IP address. The means (112a) is composed of a connection-related information table that stores information in which the parent-child relationship of each IP address is determined.

The initial setting unit (11) which is the present patent range
Will be described with reference to the flowcharts of FIGS. 7, 8, and 9.

FIG. 7 is a flowchart showing the flow of processing of the initial setting unit (11) and the network monitoring unit (12).

When a network is constructed, a network monitoring device is installed at that location, and when monitoring is started,
First, as means for acquiring the network configuration information by the initial setting unit, a configuration information DB creating unit (S0
In 1), information such as an IP address and a subnet mask for each network device, a device name, a location where the device is installed, and an administrator is constructed.

Then, a configuration information acquisition means (S0) for creating a definition table for a hierarchical number for each IP address
2) is implemented, and a connection-related information unit (S03) for defining a parent IP address for each IP address is implemented. After creating the information of the initial setting units (S01, S02, and S03), network monitoring is performed by the processing of the network monitoring unit.

The network monitoring unit has monitoring information receiving means (S04) for receiving a trap event of a failure. Upon receiving a plurality of failure trap events, the network monitoring unit recognizes the large number of failures and trap events as real failures or pseudo failures. There is monitoring information selection means (S05) for selecting whether there is any
There is a monitoring screen control unit (S07) for displaying a message of the selected actual fault. Thus, the network monitoring unit receives the plurality of failure trap events,
An actual fault is selected from a large number of faults, and a message display of the selected real fault is repeatedly performed. If the user wants to terminate the network monitoring unit, the network monitoring system (S06) is terminated.

FIG. 8 shows a detailed process of the configuration information obtaining means (S02).

The configuration information obtaining means is provided with a configuration information DB (FIG. 6).
614), an IP address within the network monitoring range is searched and obtained (S0201). I found
The layer number can be obtained by executing the route information obtaining command for the P address, and the layer number for the IP address is stored in the configuration information table (111 in FIG. 1).
b) (S0202). It is checked whether there is any IP address that has not been searched in the configuration information DB (114 in FIG. 1). Until there is no IP address whose IP address is not defined in the configuration information DB (114 in FIG. 1), the process proceeds from S0201. The processing of S0202 is performed (S0
203).

The detailed processing of the connection-related information means (S03) is shown.

The connection-related information means (S03) calculates the total number of IP addresses from the configuration information table (111b in FIG. 1) and substitutes it for a variable COUNT (S0301). In the next process, it is checked whether COUNT is 0, and if it is 0, the process ends.

If COUNT is not 0, S03
03 is performed (S0302).

The layer number of the target IP address is compared with the layer number of the opposite IP address. If the layer number of the target IP address is smaller than the layer number of the opposite IP address, S
The process proceeds to 304. In the process of S0304, the target IP
It is checked whether or not the hierarchical number of the address is 1, and if the target number is 1, the process proceeds to S0307, where the parent IP address of the target IP address is set to NULL, and the target IP address closest to the network monitoring device is set.

If it is determined in step S0304 that the layer number of the target IP address is other than 1, the flow advances to step S0306, and
The parent IP address of the target IP address is the IP address of the same level connected to the IP address lower by one level.
The processing is performed from S0304, and
After proceeding to 0307, the process of S0308 is performed, and a value obtained by subtracting 1 from the current value of COUNT is substituted for COUNT, and the process of S0302 is performed from the beginning. In this process, when the COUNT number is 0
It is processed until it becomes.

If the layer number of the target IP address is larger than the layer number of the opposite IP address, the process proceeds to S0305, where the parent IP address of the target IP address is the opposite IP address.
Then, the process proceeds to step S0308. By performing the above-described processing of S03, the connection-related information table (112b) shown in FIG. 1 is automatically created.

Next, an example of network monitoring using the processing of the present invention will be described with reference to FIGS. 10, 11, and 12. FIG.

FIG. 10 shows a network configuration.

Each layer has a router (R0) as a communication device.
1, R02, R03, R04, R05, R06, R0
7, R08, R09, R10, R11, R12).

The hierarchy of each router is defined by the configuration information acquiring means of the initial setting unit (61 in FIG. 6). 1
In the hierarchy, R01 and R10 are defined.
02 and R11 are defined, and R03 and R12
Are defined, and R04, R07, and R13 are defined in the fourth hierarchy. In the five layers, R05 and R08 are defined, and
R06 and R09 are defined in the hierarchy.

Each router is set with a LAN IP address and a line IP address. This IP address is defined in the same hierarchy as that defined for the router.

When the above results are arranged, hierarchies are assigned for each IP address, and the results are as shown in FIG. IP addresses belonging to one layer are 10a, 10b, 10s, 1
0t. The IP addresses belonging to the two layers are 10c,
10d, 10u, and 10v. IP addresses belonging to the three layers are 10e, 10f, 10w, and 10x.

The IP addresses belonging to the four layers are 10 g,
10h, 10m, 10n, 10y, and 10z. The IP addresses belonging to the five layers are 10i, 10j, 10o,
10p.

The IP addresses belonging to the six layers are 10k,
10l, 10q, and 10r.

As a result, the network monitoring device determines that one layer is the closest IP address group as viewed from the network monitoring device, and that the second layer is the third layer, the fourth layer, the fifth layer, and the sixth layer. It is defined as an IP address far from the eyes.

Next, the connection information table shown in FIG. 12A is created from the configuration information table shown in FIG. 11A by the network information editing unit 112 shown in FIG. .

For example, a route from an IP address 1 belonging to six layers to a network monitoring device is defined by associating a route between each IP address.

Specifically, the parent IP address of 10l is 1
0k, the parent IP address of 10k is 10j,
The parent IP address of 10j becomes 10i and the parent I of 10i becomes
The P address becomes 10h, the parent IP address of 10h becomes 10g, the parent IP address of 10g becomes 10f, the parent IP address of 10f becomes 10e, the parent IP address of 10e becomes 10d, and the parent IP address of 10d becomes 10c. The parent IP address of 10c becomes 10b, and the parent IP address of 10b becomes 10a.
Has a NULL parent IP address. Thus, IP
When the parent IP address is NULL like the address 10a, it is the highest in the network monitoring apparatus. If a failure occurs in the highest IP address, the highest IP address is immediately determined to be a failure.

[0089]

According to the present invention, when network monitoring is carried out by polling, pseudo failures and actual failures that occur when a plurality of failures occur are clearly grasped, and the reliability of the network monitoring performance is improved.

[Brief description of the drawings]

FIG. 1 is a functional block diagram of a network device according to an embodiment of the present invention.

FIG. 2 is a diagram expressing the present invention on a network configuration diagram.

FIG. 3 is a network configuration diagram to which the network monitoring method of the present invention is applied.

FIG. 4 is a diagram showing a failure recognition result in the network configuration diagram of FIG. 2;

FIG. 5 is a network configuration diagram to which the network monitoring method of the present invention is applied.

FIG. 6 is a diagram showing a failure recognition result in the network configuration diagram of FIG. 4;

FIG. 7 is a flowchart showing a flow of processing of an initial setting unit.

FIG. 8 is a flowchart showing the flow of a configuration information acquisition unit.

FIG. 9 is a flowchart showing the flow of connection related information means.

FIG. 10 is a network configuration diagram of a specific example.

FIG. 11 is a diagram illustrating an output result of a configuration information table according to a specific example.

FIG. 12 is a diagram illustrating an output result of a connection-related information table according to a specific example.

 ──────────────────────────────────────────────────続 き Continued on the front page F term (reference) 5K030 GA14 GA16 JA10 KA05 KA07 MA01 MB01 MD07 MD08 MD10 5K035 AA03 BB03 DD01 EE01 FF01 GG13 HH06 JJ02 KK04 MM03

Claims (2)

[Claims] 1. A network monitoring apparatus for monitoring a network constituted by a plurality of network devices, means for hierarchically managing each device constituting the network in a physical connection relationship, and based on the hierarchical information. Network monitoring means for determining a real failure and a pseudo failure when a certain device fails (a failure in which a lower device is regarded as a failure because a higher-level device is a failure). method. 2. A method according to claim 1, wherein when a plurality of real faults occur, means for creating and managing respective connection relations of the respective component devices and the connection relations for discriminating between the real faults and the pseudo faults. A network monitoring method comprising: means for extracting only actual faults.