JP2010141655A - Network monitoring device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a network monitoring device capable of appropriately comprehending monitoring data necessary for a fault analysis. <P>SOLUTION: The network monitoring device connected to a device to be monitored through the network comprises: a monitoring setting means for setting a monitoring policy; a monitoring means for obtaining monitoring data expressing the status of the network or the device to be monitored on the basis of the monitoring policy; a monitor-predicting means for predicting and calculating predict-monitoring data expressing the future status of the network or the device to be monitored on the basis of the past and/or current monitoring data obtained by the monitoring means; and a monitor setting management means for varying the monitoring policy on the basis of the predict-monitoring data calculated by the monitor-predicting means. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a network monitoring apparatus that grasps the performance of a network system to which various devices are connected, and more particularly to predicting fluctuations in network performance with higher accuracy.

  In a network system in which multiple servers, relay devices such as routers and switches (hereinafter referred to as network devices), and various terminals such as server machines and client machines are connected via a network, excessive requests to servers, attacks, and failures The performance may be deteriorated due to the occurrence of the above. Therefore, conventionally, in order to ideally operate such a network system, a network monitoring apparatus that measures, monitors, and monitors the performance of the network system has been proposed.

  A conventional network monitoring apparatus performs monitoring according to a monitoring policy that is monitoring content such as a monitoring condition defined in advance. In this monitoring policy, a monitoring target, a monitoring item related to the monitoring target, a predetermined interval for monitoring, and the like are determined in advance, and monitoring is performed without change even when the state of the network / network system changes.

  By the way, in the conventional network monitoring apparatus, when the monitoring policy needs to be changed, the network administrator manually sets and changes the monitoring policy. However, when monitoring a network that changes every moment, there is a problem that it is difficult to set an appropriate monitoring policy flexibly according to the situation when the network administrator manually sets and changes it. .

  On the other hand, there is a method in which monitoring targets and monitoring items as much as possible are set in advance, and network information is always monitored without omission. However, there is a new problem that a large load is applied to the network device, the network, and the entire network system to be monitored.

  On the other hand, in the conventional network monitoring device, there is a method of dynamically changing the monitoring item according to the network state. In this case, there is a merit that monitoring can always be performed efficiently because there is no time lag until the monitoring setting by the network administrator is performed while minimizing the load applied to the monitoring target device.

  As a prior art document related to such a network monitoring apparatus, there is the following Patent Document 1.

JP 2005-275815 A

  FIG. 6 is a block diagram showing a configuration example of a conventional network monitoring apparatus. In FIG. 6, the network monitoring apparatus 1 provides, for example, a Web server or the like via a network 2 which is a wired network such as Ethernet (registered trademark). Connected to the monitored device 3 which is a server or network device to be monitored. Although not particularly illustrated, the network 2, the monitored device 3, and other network devices / various terminal devices not illustrated constitute a network system.

  The network monitoring device 1 includes a communication unit 11 that performs data communication with the monitored device 3 via the network 2, an arithmetic control unit 12 that controls operations of each unit and each unit, a storage unit 13, and the like. Monitor the operation of the entire network system. The arithmetic control unit 12 includes a monitoring unit 12A, a monitoring setting unit 12B, and a monitoring setting management unit 12C.

  The monitoring unit 12A collects data from the monitored device 3 that is the monitoring target obtained through the communication unit 11 based on a preset monitoring policy, and the monitored device 3, the network 2, and the network system Monitoring and monitoring the behavior of

  Based on these data, basic performance data serving as a basis for a performance evaluation value indicating the performance of the network 2 and the entire network system is calculated and stored in the storage means 13. In other words, the monitoring means 12A monitors and monitors the behavior of the network 2 and the network system.

  The monitoring setting unit 12 </ b> B sets the monitoring policy stored in the storage unit 13. The monitoring setting management unit 12C derives the optimum monitoring content based on the monitoring result obtained by the monitoring unit 12A, and resets / changes the monitoring policy stored in the storage unit 13.

  The storage unit 13 includes a monitoring policy 13A in which monitoring targets, monitoring items related to the monitoring targets, a predetermined interval for monitoring, and the like are stored in association with each other, and collected and calculated by the monitoring unit 12A, for example, response time, traffic volume, And a monitoring data DB 13B in which monitoring data such as the number of error packets and the date of measurement are stored in association with each other.

  FIG. 7 is a flowchart for explaining the operation of the conventional network monitoring apparatus. In step SP101, the monitoring unit 12A of the arithmetic control unit 12 of the network monitoring device 1 is able to monitor the behavior of the monitored device 3 based on the monitoring policy set by the monitoring setting unit 12A and collect monitoring data. Data is stored in the storage means 13.

  Specifically, the monitoring unit 12A executes processing corresponding to the WEB server (monitored target device 3) in response to a request from a WEB client (or network monitoring device 1) (not shown) based on the monitoring policy, and the WEB client. Measures the time until the processing result is received (hereinafter referred to as response time) at 10-minute intervals using software installed on the WEB server, and stores the obtained response time in the storage means 13 To do.

  In step SP102, the monitoring unit 12A of the arithmetic control unit 12 of the network monitoring device 1 determines whether or not a failure has been detected in the network 2, the monitored device 3, and the network system based on the collected monitoring data. If a failure is detected, the process proceeds to step SP103, and otherwise, the process proceeds to step SP101.

  In step SP103, the monitoring setting management unit 12C of the arithmetic control unit 12 of the network monitoring apparatus 1 extracts a monitoring item to be newly monitored based on the monitoring data in which the failure is detected, and stores the monitoring item in the storage unit 13. Add to policy.

  Specifically, the monitoring setting management unit 12C automatically monitors the traffic amount of the network path from the client (or the network monitoring device 1) (not shown) to the monitored device 3 and the CPU usage rate of the monitored device 3 as monitoring items. To add.

  In step SP104, the monitoring unit 12A of the arithmetic control unit 12 of the network monitoring device 1 starts monitoring the traffic amount and the CPU usage rate of the monitored device 3 in addition to the response time based on the monitoring policy. The monitoring data is stored in the storage means 13.

  Here, if the network administrator examines based on the monitoring value of the traffic amount, which is a newly added monitoring item, it is possible to find out the congestion on a certain network route and solve it.

  In step SP105, the monitoring unit 12A determines whether a failure is detected in the network system based on the collected communication data. If a failure is detected, the process proceeds to step SP103, and otherwise, the process proceeds to step SP106.

  In step SP106, when it is determined that there is no failure in the monitored apparatus 3, the monitoring setting management unit 12C deletes the newly added monitoring item in step SP104.

  Specifically, when the response time (for example, 40 milliseconds) falls below a threshold value (for example, 50 milliseconds), the monitoring setting management unit 12C determines the traffic amount that is a monitoring item newly added in step SP104. Delete the CPU usage rate from the monitoring policy.

  As described above, in the conventional network monitoring apparatus, the monitoring item can be dynamically changed according to the network state.

  However, since the conventional network monitoring apparatus adds a monitoring item after detecting a failure, the situation (in other words, the real-time situation) at the time when the failure of the monitored apparatus 3 occurs and the situation before that are detected. There was a problem of not knowing. Then, information necessary for failure analysis is lost, and there is a problem that appropriate analysis and monitoring item setting cannot be performed.

FIG. 8 is an explanatory diagram of problems of the conventional network monitoring device. In FIG. 8, for example, if the state has changed as follows, the cause of the failure (congestion occurrence) cannot be specified. there were.
Time A) Congestion occurs on the network 2 B) The network monitoring device 1 sends an HTTP request to the monitored device 3 which is a Web server, and the monitored device 3 is monitored B) The network monitoring device 1 responds with an HTTP response To get the response time. The monitoring means 12A determines that the HTTP response time has exceeded the threshold and detects a failure.
Time D) Congestion occurring on the network 2 is temporarily resolved. Time E) The monitoring setting management means 12C is added to the monitoring policy with the traffic volume and CPU usage as monitoring items. F) The monitoring means 12A is added. The monitoring start time G is also applied to the monitored items G) Since the congestion of the traffic amount monitored by the monitoring means 12A is temporarily eliminated, the newly added monitoring items are automatically deleted.

  As described above, when congestion on the network 2 is temporarily resolved after the monitoring unit 12A detects a failure, trouble-free monitoring data is acquired, so the cause of the HTTP response time exceeding the threshold is specified. There was a problem that it was not possible.

  Then, in the conventional network monitoring device, as shown in FIG. 8B, even for congestion that repeatedly occurs in a short time on the network 2 (congestion that occurs in a burst manner), the monitoring means 12A temporarily detects the failure. When congestion on the network 2 is eliminated, there is a problem that monitoring data having no problem is acquired (it is repeated) and the cause of the failure cannot be specified.

  The present invention solves the above-described problems, and an object thereof is to realize a network monitoring apparatus that can appropriately grasp monitoring data necessary for failure analysis.

In order to achieve such a problem, the invention according to claim 1 of the present invention is:
Network monitoring having monitoring setting means connected to a monitored device via a network and setting a monitoring policy, and monitoring means for acquiring monitoring data indicating a state of the network or the monitored device based on the monitoring policy In the device
Monitoring and predicting means for predicting and calculating predicted monitoring data indicating the future state of the network or the monitored device based on past and / or current monitoring data obtained by the monitoring means;
Monitoring setting management means for changing the monitoring policy based on the predicted monitoring data calculated by the monitoring prediction means;
A network monitoring device.

The invention according to claim 2 is the network monitoring apparatus according to claim 1, wherein the monitoring prediction means is
The prediction monitoring data is calculated based on an arbitrary prediction model, and the monitoring policy is changed to increase the monitoring frequency and expand the monitoring target and the monitoring items.

The invention according to claim 3 is the network monitoring device according to claim 2, wherein the monitoring setting management means includes:
If it is predicted that a future failure will be detected in the network or the monitored device based on the predicted monitoring data calculated by the monitoring prediction means, the monitoring policy is changed to change the monitoring frequency. It is characterized by expanding and expanding the monitoring target and monitoring items.

The invention according to claim 4 is the network monitoring apparatus according to any one of claims 1 to 3,
The monitoring setting management means includes:
If it is predicted that the service level of the network or the monitored device will be reduced in the future based on the prediction monitoring data calculated by the monitoring prediction unit before, the monitoring frequency is changed by changing the monitoring policy. And increase the number of monitoring targets and monitoring items.

The invention according to claim 5 is the network monitoring device according to any one of claims 1 to 4,
The monitoring prediction means includes
The calculation is performed simultaneously using a plurality of prediction models stored in advance based on the monitoring data, and the prediction monitoring data is predicted and calculated by selecting the prediction model having the highest prediction accuracy.

  As described above, the network monitoring apparatus according to the present invention is configured such that the network monitoring apparatus according to the present invention receives monitoring data indicating the state of the network or the monitored apparatus based on the monitoring policy set by the monitoring setting means by the monitoring setting means. The monitoring and prediction means calculates and predicts prediction monitoring data from the past and current monitoring data obtained, and the monitoring setting management means changes the monitoring policy based on this prediction data to predict the network status. Monitoring items can be dynamically changed according to the predicted state, and monitoring data necessary for failure analysis can be appropriately grasped.

  FIG. 1 is a block diagram showing an embodiment of a network monitoring apparatus according to the present invention. Parts common to those in FIG. The difference between FIG. 1 and FIG. 6 is that, in FIG. 1, there is a monitoring prediction unit 12D for predicting future monitoring data based on past monitoring data and current monitoring data monitored by the monitoring unit 12A, and monitoring setting management. For example, the means 12C sets the monitoring item of the monitoring policy according to the failure that can be detected in the future based on the future monitoring data predicted by the monitoring prediction means 12D.

  In FIG. 1, a network monitoring device 1 is connected to a monitored device 3 that is a server or a network device that provides a Web server or the like via a network 2 that is a wired network such as Ethernet (registered trademark). . Although not particularly illustrated, the network 2, the monitored device 3, and other network devices / various terminal devices not illustrated constitute a network system.

  The network monitoring device 1 includes a communication unit 11 that performs data communication with the monitored device 3 via the network 2, an arithmetic control unit 12 that controls operations of each unit and each unit, a storage unit 13, and the like. Monitor the operation of the entire network system. The arithmetic control unit 12 includes a monitoring unit 12A, a monitoring setting unit 12B, a monitoring setting management unit 12C, and a monitoring prediction unit 12D.

  The monitoring unit 12A controls the communication unit 11 based on a preset monitoring policy to collect monitoring data from the monitored device 3 via the network 2, and the monitored device 3, the network 2, and the network system Monitoring and monitoring the behavior of

  Further, the monitoring unit 12A calculates basic performance data serving as a basis of the performance evaluation value indicating the performance of the network 2 and the entire network system based on these data, stores the basic performance data in the storage unit 13, and the behavior of the network 2 and the network system. It may be monitored or monitored.

  The monitoring setting unit 12 </ b> B sets the monitoring policy stored in the storage unit 13. The monitoring setting management unit 12C derives the optimum monitoring contents based on the monitoring result obtained by the monitoring unit 12A, executes the resetting / changing of the monitoring policy stored in the storage unit 13, and the monitoring prediction unit 12D A monitoring policy monitoring item is set according to a failure that can be detected in the future based on predicted future monitoring data.

  For example, the monitoring setting management unit 12C changes the monitoring content set in the monitoring policy 13A when the monitoring prediction unit 12D predicts that the service level of the network 2 or the monitoring target device 3 is lowered. The monitoring frequency may be increased, and the number of monitoring targets and monitoring items may be expanded.

  The monitoring prediction unit 12D predicts the state of the future network or the monitored device 3 based on the past monitoring data monitored by the monitoring unit 12A stored in the storage unit 13 and the current monitoring data, that is, obtained in the future. Predict monitoring data (hereinafter referred to as predictive monitoring data).

  The storage unit 13 includes a monitoring policy 13A in which monitoring targets, monitoring items related to the monitoring targets, a predetermined interval for monitoring, and the like are stored in association with each other, and collected and calculated by the monitoring unit 12A, for example, response time, traffic volume, And a monitoring data DB 13B in which monitoring data such as the number of error packets and the date of measurement are stored in association with each other.

  FIG. 2 is a flowchart for explaining the operation of the network monitoring apparatus of the present invention. In step SP201, the monitoring unit 12A of the arithmetic control unit 12 of the network monitoring device 1 is able to monitor the behavior of the monitored device 3 based on the monitoring policy set by the monitoring setting unit 12A and collect monitoring data. Data is stored in the storage means 13.

  Specifically, the monitoring unit 12A executes processing corresponding to the WEB server (monitored target device 3) in response to a request from a WEB client (or network monitoring device 1) (not shown) based on the monitoring policy, and the WEB client. Measures the time until the processing result is received (hereinafter referred to as response time) at 10-minute intervals using software installed on the WEB server, and stores the obtained response time in the storage means 13 To do.

  In step SP202, the monitoring prediction unit 12D of the arithmetic control unit 12 of the network monitoring device 1 performs future monitoring based on past monitoring data and current monitoring data collected and monitored by the monitoring unit 12A stored in the storage unit 13. Predict and calculate data (hereinafter referred to as predictive monitoring data). (An example of a specific operation will be described later with reference to FIG. 3.)

  In step SP203, the monitoring prediction unit 12D of the arithmetic control unit 12 of the network monitoring device 1 determines whether or not a future failure is detected in the network 2, the monitored device 3, and the network system based on the predicted monitoring data. . If a failure is detected, the process proceeds to step SP204, and otherwise, the process proceeds to step SP201.

  For example, the monitoring prediction unit 12D is an example of the prediction monitoring data based on the prediction monitoring data, and when the response time exceeds a threshold value (for example, 50 milliseconds) set and stored in the storage unit 13 in advance after 3 hours It is determined that a failure has been detected.

  In step SP204, the monitoring setting management unit 12C of the arithmetic control unit 12 of the network monitoring apparatus 1 extracts a monitoring item to be newly monitored based on the predicted monitoring data from which a future failure can be detected, and stores it in the storage unit 13. Add to a monitoring policy. Alternatively, the monitoring policy may be changed.

  Specifically, the monitoring setting management unit 12C automatically monitors the traffic amount of the network path from the client (or the network monitoring device 1) (not shown) to the monitored device 3 and the CPU usage rate of the monitored device 3 as monitoring items. To add. This is because the response time is the sum of the data transfer time (time required for the request + time required for the response) and the processing time in the Web server, and the response time is affected by the traffic volume and the CPU usage rate.

  When the monitoring prediction unit 12D predicts that the service level of the future network or the device to be monitored will decrease in the future, the monitoring setting management unit 12C changes the monitoring policy to increase the frequency of monitoring. And expand monitoring items.

  Further, the monitoring setting management unit 12C may extract a monitoring item to be newly monitored based on the predicted monitoring data in which a future failure can be detected and the monitoring policy 13A of the storage unit 13.

  For example, the monitoring policy 13A stores in advance that monitoring items such as traffic volume and CPU usage rate should be monitored for detailed monitoring of response time as one of the policies. When a failure is detected based on the time, the monitoring item traffic volume / CPU usage rate to be newly monitored may be extracted based on the monitoring policy 13A.

  In step SP205, the monitoring unit 12A of the arithmetic control unit 12 of the network monitoring device 1 starts monitoring the traffic amount and the CPU usage rate of the monitored device 3 in addition to the response time based on the monitoring policy. The monitoring data is stored in the storage means 13.

  In step SP206, the monitoring unit 12A of the arithmetic control unit 12 of the network monitoring device 1 determines whether or not a failure has been detected in the network 2, the monitored device 3, and the network system based on the collected monitoring data. If a failure is detected, the process proceeds to step SP207, and otherwise, the process proceeds to step SP209.

  In step SP207, the monitoring unit 12A of the network monitoring apparatus 1 detects a failure in a network management terminal of a user (not shown) that controls the communication unit 11 and is connected via the network 2 by a network system or the like. Send a message (e-mail etc.) to notify that it has been done. Alternatively, the arithmetic control unit 12 of the network monitoring device 1 displays that a failure has been detected on a display unit (not shown) provided in the network monitoring device 1.

  Here, based on this notification / display, the network administrator examines based on the monitoring data of the traffic amount which is a newly added monitoring item, finds out the congestion on a certain network route, and solves it.

  In step SP208, the monitoring unit 12A of the arithmetic control unit 12 of the network monitoring device 1 determines whether or not a failure has been detected in the network 2, the monitored device 3, and the network system based on the collected monitoring data. If a failure is detected, the process proceeds to step SP207, and otherwise, the process proceeds to step SP209.

  In step SP209, the monitoring setting management unit 12C of the arithmetic control unit 12 of the network monitoring device 1 determines that the failure in the monitored device 3 has been eliminated, and deletes the newly added monitoring item in step SP204.

  Specifically, the monitoring setting management unit 12C of the arithmetic control unit 12 of the network monitoring device 1 adds a new response at step SP204 if the response time (for example, 4 seconds) falls below a threshold value (for example, 50 milliseconds). The monitored traffic items, such as traffic volume and CPU usage rate, are deleted from the monitoring policy.

  As a result, the network monitoring apparatus according to the present invention obtains monitoring data indicating the state of the network or the monitored apparatus based on the monitoring policy set by the monitoring setting means by the monitoring means, and the monitoring prediction means is obtained. Predictive monitoring data is calculated / predicted from past and current monitoring data, and the monitoring setting management means changes the monitoring policy based on the prediction data, thereby predicting the network state and dynamically responding to the predicted state. Monitoring items can be changed and monitoring data necessary for failure analysis can be properly grasped.

  Note that the network monitoring apparatus according to the present invention has a predicted monitoring data notification means for notifying the network manager of the fact and the monitoring data when the occurrence of a problem can be predicted by the monitoring data predicted by the monitoring prediction means 12D. It may be a thing. In this case, the prediction monitoring data notification means controls the communication means 12 to indicate that a failure has been detected in the network management terminal of the user (not shown) connected via the network 2 by a network system or the like. Send a notification message (such as email).

  For this reason, when the occurrence of a problem can be predicted by the monitoring data, it is possible to predict and maintain the failure by notifying the monitoring data to the network administrator in advance before the failure occurs. In addition, predictive maintenance based on predictive monitoring data that may cause problems according to the present invention automatically obtains information necessary for failure analysis in addition to prediction of the failure itself automatically (efficiently) at a necessary timing. In that respect, it is more effective for failure analysis and prevention than normal predictive maintenance based on future prediction. As a result, it is possible to shorten the time from when a failure is predicted until actually responding.

  Here, the network monitoring apparatus according to the present invention will describe an example in which the monitoring prediction unit 12D predicts the predicted monitoring data based on the past monitoring data and the current monitoring data. FIG. 3 is a flowchart for explaining the operation of the network performance monitoring apparatus of the present invention.

  In FIG. 3, in step SP301, the monitoring unit 12A of the arithmetic control unit 12 of the network performance monitoring apparatus 1 collects monitoring data (for example, response time) of the network device 3.

  In step SP302, the monitoring unit 12A of the network performance monitoring apparatus 1 stores and stores the monitoring data (for example, response time) in the storage information DB 13B of the storage unit 13 in association with the date of measurement.

  In step SP303, the monitoring predicting unit 12C of the network performance monitoring apparatus, based on a plurality of monitoring data (for example, response times) stored / stored in the storage information DB 13A, the prediction model (not shown) stored in the storage unit 13 is used. A future response time is predicted using a plurality of prediction models stored in the DB.

  For example, the monitoring prediction unit 12C calculates an average response time for one month based on the response time stored in the accumulated information DB 13B, and calculates (predicts) an average response time for the next month. FIG. 4 is an explanatory diagram showing past monthly response times. FIG. 5 is an explanatory diagram showing prediction monitoring data (response time) by each prediction model, (A) is a prediction result by a model using linear approximation, (B) is a prediction result by a model using logarithmic approximation, C) is a prediction result based on a model using polynomial approximation, (D) is a prediction result based on a model using power approximation, and (E) is a prediction result based on a model using exponential approximation.

  As shown in FIG. 8, the monitoring predicting means 12D calculates and stores the average monthly response time (January: 14 milliseconds, February: 18 milliseconds, March: 24 milliseconds,...) For the past seven months. The response time of the next month degree (August degree) is predicted using each prediction model as shown in FIG. 5 (for example, (A) linear approximation: 34 milliseconds, (B) logarithmic approximation: 30. 6 milliseconds, (C) polynomial approximation: 31.7 milliseconds, (D) power approximation: 31.9 milliseconds, (E) exponential approximation: 36.8 milliseconds).

  In step SP304, the monitoring prediction unit 12D compares each prediction accuracy of the prediction result calculated using each model.

  Specifically, the monitoring prediction unit 12D calculates an R-2 power value in each prediction model, and compares the prediction accuracy using the R-2 power value. This R-2 power value indicates that the closer the value is to 1, the higher the reliability.

  In step SP305, the monitoring prediction unit 12D selects the prediction model with the highest prediction accuracy as a result of comparing the prediction accuracy, and thereafter sets and stores it as a prediction model for calculating response time prediction data. . For example, in the example of FIG. 8, the prediction model using the power approximation with the highest R-2 power value is selected.

  In step SP306, the monitoring prediction unit 12D calculates response time prediction data using the prediction model selected in step SP305, and stores it in the storage unit 13. It is also displayed on a display unit (not shown).

  Specifically, the monitoring prediction unit 12D calculates a predicted value (31.9 milliseconds) of the monthly response time using a prediction model using power approximation and stores it in the storage unit 13.

  Thus, the network performance monitoring apparatus of the present invention can predict future monitoring data of the network system.

  In the network performance monitoring apparatus according to the above-described embodiment, it is described that the network performance is grasped based on the response time required to acquire the resources of the website provided by the monitored apparatus 3 (Web server). However, the present invention is not limited to this, and the response time may be measured using an ICMP packet to grasp the network performance.

  In addition, the arithmetic control unit 12 of the network monitoring device of the present invention starts up the OS stored in the storage unit 13 and reads and executes the program stored on the OS, thereby executing the entire network monitoring device 1. (For example, the arithmetic control unit 12 reads out and executes a program to control the monitoring unit 12A, the monitoring setting unit 12B, the monitoring setting management unit 12C, the monitoring prediction unit 12D, etc.) and perform operations unique to the network monitoring device. You can do it.

  At this time, the storage unit 13 expands the program or application executed by the arithmetic control unit 12 in the program storage area, and temporarily stores the input data or data such as the processing result generated when the program or application is executed in the work area. To remember.

  As described above, according to the present invention, the network monitoring apparatus can predict the network state, dynamically change the monitoring item according to the predicted state, and can appropriately grasp the monitoring data necessary for failure analysis. Therefore, the failure of the network can be analyzed with higher accuracy, and communication resources can be optimally controlled based on the analysis result, thereby contributing to the removal of the failure of the entire network system and appropriate operation.

It is a block diagram which shows one Example of the network monitoring apparatus which concerns on this invention. It is a flowchart explaining operation | movement of the network monitoring apparatus 1 of this invention. It is a flowchart explaining operation | movement of the network performance monitoring apparatus 1 of this invention. It is explanatory drawing which shows the past monthly response time. It is explanatory drawing which shows the prediction monitoring data (response time) by each prediction model. It is a block diagram which shows the structural example of the conventional network monitoring apparatus. It is a flowchart explaining operation | movement of the conventional network monitoring apparatus. It is description of the problem of the conventional network monitoring apparatus.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Network monitoring apparatus 11 Communication means 12 Operation control part 12A Monitoring means 12B Monitoring setting means 12C Monitoring change means 12D Monitoring prediction means 13 Storage means 13A Monitoring policy 13B Monitoring data DB
2 Network 3 Network equipment

Claims (5)

Network monitoring having monitoring setting means connected to a monitored device via a network and setting a monitoring policy, and monitoring means for acquiring monitoring data indicating a state of the network or the monitored device based on the monitoring policy In the device
Monitoring and predicting means for predicting and calculating predicted monitoring data indicating the future state of the network or the monitored device based on past and / or current monitoring data obtained by the monitoring means;
Monitoring setting management means for changing the monitoring policy based on the predicted monitoring data calculated by the monitoring prediction means;
A network monitoring apparatus comprising: The monitoring prediction means includes
The network monitoring apparatus according to claim 1, wherein the predictive monitoring data is calculated based on an arbitrary predictive model, and the monitoring policy is changed to increase the monitoring frequency and expand the monitoring target and the monitoring items. The monitoring setting management means includes:
If it is predicted that a future failure will be detected in the network or the monitored device based on the predicted monitoring data calculated by the monitoring prediction means, the monitoring policy is changed to change the monitoring frequency. 3. The network monitoring apparatus according to claim 1, wherein the increase and the monitoring target and the monitoring item are expanded. The monitoring setting management means includes:
If it is predicted that the service level of the network or the monitored device will be reduced in the future based on the prediction monitoring data calculated by the monitoring prediction unit before, the monitoring frequency is changed by changing the monitoring policy. The network monitoring apparatus according to claim 1, wherein the number of monitoring targets and monitoring items are expanded. The monitoring prediction means includes
The prediction monitoring data is predicted and calculated by simultaneously calculating using a plurality of prediction models stored in advance based on the monitoring data, and selecting a prediction model having the highest prediction accuracy. The network monitoring apparatus according to claim 4.

Images