JP2012178681A - Network information acquiring device and acquiring method, and program - Google Patents

Abstract

When the number of network devices and parameters to be monitored increases, it is possible to perform information analysis such as fault detection without increasing the load of the network management system and tightening the traffic of the monitoring network.
A network information acquisition apparatus includes an acquisition parameter list that defines parameters to be acquired from a network device, a processing rule that specifies rules for processing and processing results for parameters, and a parameter that is defined in the acquisition parameter list. Data acquisition means to acquire from, a database to hold the acquired parameters in time series, time series data processing means to analyze whether the parameters held in time series deviate from the processing rules, and deviate from the processing rules A notification means for notifying the analysis result.
[Selection] Figure 2

Description

  The present invention relates to a device for acquiring performance and failure information in a network, an acquisition method, and a program.

  A network that provides Internet access, IP-VPN, wide area LAN service, and the like is mainly configured by an Ethernet (registered trademark) switch and an IP / MPLS router. These network devices use the network management protocol SNMP of Non-Patent Document 1. It is generally used to exchange network and device configuration information, performance information such as transmission / reception traffic volume, notification of failure, and the like with a network management system installed in an operation center of a service provider.

  In SNMP, an agent program on a network device to be managed takes out a parameter indicating a device state stored in a database called MIB (Management Information Base) in a device defined in Non-Patent Document 2 or the like, By exchanging with the manager program, the state of the device is judged on the network management system side based on the parameters.

Structure of Management Information forversion 2 of the Simple Network Management Protocol (SNMPv2), IETF RFC1442 Management Information Base for Network Management of TCP / IP-based internets: MIB-II, IETF RFC 1213

  The parameters and providing method provided by the SNMP agent program of the network device such as the Ethernet switch, the IP / MPLS router, etc., are those in which the device supports the MIB defined by standardization as in Non-Patent Document 2, or the device-specific extended MIB It is fixedly implemented by the definition called and cannot be changed by the user. Therefore, when an abnormality is detected from a time series of parameters indicating a specific state of a device, the manager program of the network management system periodically acquires the parameter, and the network management system determines the abnormality based on the trend. There is a need to. Here, when the parameter acquisition cycle is shortened to determine the immediacy of abnormality detection, or the number of network devices and parameters to be monitored increases, the load of parameter acquisition processing and analysis processing of the network management system increases. However, there is a problem that it takes time to complete the process, leading to a detection delay such as occurrence of a failure. In addition, there is a problem that traffic of the monitoring network is tight due to a notification (trap) message due to erroneous detection of parameter abnormality (FIG. 1).

  Therefore, according to the present invention, when the number of network devices and parameters to be monitored increases, information analysis such as fault detection can be performed without increasing the load on the network management system and tightening the traffic on the monitoring network. An object of the present invention is to provide a network information acquisition device, an acquisition method, and a program.

  In order to achieve the above object, a network information acquisition apparatus according to the present invention includes an acquisition parameter list that defines parameters to be acquired from a network device, a processing rule that specifies rules for processing and processing results for the parameters, and a list of acquisition parameters. Data acquisition means for acquiring defined parameters from one or a plurality of network devices, a database for storing the acquired parameters in time series, and the parameters held in time series deviating from the processing rule A time-series data processing means for analyzing whether or not the processing rule has been deviated, and a notification means for notifying the analysis result.

  In addition, the data compression means further compresses the data, and the notification means compresses the analysis result and the parameters held in time series by the data compression means when the processing rule is not satisfied. It is also preferable to notify.

  The data acquisition means is preferably means for acquiring the parameter from an SNMP agent program or a command line interface of a network device.

  In order to achieve the above object, a network information acquisition method according to the present invention includes an acquisition parameter list that defines parameters to be acquired from a network device, a processing rule that specifies a process for the parameter and a rule for a processing result, and a time series of the parameter. In a network information acquisition method in an apparatus comprising a database stored in a data acquisition step, a data acquisition step of acquiring parameters defined in the acquisition parameter list from one or more network devices, and the acquired parameters in the database A step of storing in a series, a time series data processing step of analyzing whether the parameters held in the time series deviate from the processing rule, and a notification for notifying the analysis result when deviating from the processing rule Step and A.

  In order to achieve the above object, a program according to the present invention holds an acquisition parameter list that defines parameters to be acquired from a network device, processing rules that specify rules for processing and processing results for the parameters, and the parameters in time series. A computer comprising a database, data acquisition means for acquiring parameters defined in the acquisition parameter list from one or more network devices, means for storing the acquired parameters in the database in time series, and The time series data processing means for analyzing whether the parameters held in time series deviate from the processing rule, and the notification means for notifying the analysis result when deviating from the processing rule are operated.

  It is also preferable to operate as an SNMP agent program.

  According to the present invention, even when the number of network devices to be monitored increases, it is possible to improve the performance of information analysis such as failure detection by distributed processing of the network information acquisition device instead of scaling up the management system, Reduce operational costs and maintain and improve customer satisfaction.

The parameter acquisition processing and analysis processing by the existing network management system are shown. 1 shows a configuration of a network information acquisition apparatus according to the present invention. The operation | movement flowchart of a network information acquisition apparatus is shown.

  The best mode for carrying out the present invention will be described in detail below with reference to the drawings. FIG. 2 shows a configuration of a network information acquisition apparatus according to the present invention. The network information acquisition apparatus 1 includes a data acquisition unit 11, an acquisition parameter list 12, a database 13, a time series data processing unit 14, a processing rule 15, and a notification unit 16.

  The data acquisition unit 11 is means for acquiring parameters from an SNMP agent program or a command line interface of a network device that supports the MIB definition of Non-Patent Document 2. Parameters can be obtained from a plurality of network devices in order to satisfy the load distribution for parameter exchange with the network management system. The data acquisition unit 11 acquires the parameters defined by the user in the following acquisition parameter list 12 from the network device at regular intervals.

  The acquisition parameter list 12 is a list in which a user defines parameters to be acquired from a network device. Note that the parameters to be acquired can be different for each network device or each network device type.

The database 13 is means for holding the parameters acquired by the data acquisition unit 11 based on the acquisition parameter list 12 in time series. When it is designated to acquire parameter 1, parameter 2,..., Parameter n from a certain network device, data as shown in Table 1 below is retained.

  The time series data processing unit 14 is a means for processing and analyzing the time series of parameters held in the database 13 based on the following processing rule 15. When the rule set in the processing rule 15 is not violated (when the network device is normal), the network management system is not notified. Conversely, when the set rule is deviated (when an abnormality is detected), the processing analysis result is notified to the network management system.

  The processing rule 15 is one in which a user specifies a parameter processing method (rule).

  The notification unit 16 is means for notifying the network management system based on the processing analysis result. When notifying the result of the process analysis, in addition to this result, the time series of parameters that need to be acquired on the system side, such as the time series of parameters used for the process analysis, is notified to the network management system.

  The network information acquisition apparatus 1 can further include a data compression unit. The data compression unit compresses the time series of the process analysis result and parameters notified to the network management system. The notification unit 16 performs notification using the compressed data.

FIG. 3 shows an operation flow diagram of the network information acquisition apparatus. The flow will be described below.
(S1) Start: The acquisition parameter list 12 and the processing rule 15 are set in advance.
(S2) Time-series data acquisition: Parameters described in the acquisition parameter list 12 are acquired from a network device and added to the database 13.
(S3) Processing rule reading: The time-series data processing unit 14 reads processing rules.
(S4) Rule deviation? : Check whether the data stored in the database 13 deviates from the processing rule. If deviating, the process proceeds to S5, and if not deviating, the process proceeds to S7.
(S5) Necessary data acquisition: A time series of parameters to be notified to the network management system is extracted from the database 13.
(S6) Alarm notification: An alarm is notified to the network management system. At the same time, the time series of the parameters extracted in the above step is also notified.
(S7) Read all processing rules? : Check whether the time series of parameters has been processed and analyzed for all the rules described in the processing rules. When all the processes are analyzed, the process proceeds to S8, and when there is an unprocessed process rule, the process returns to S3.
(S8) End

（１）時刻ｔ０からｔ２は、設定値内であるため、時系列データ処理部１４は、ネットワーク管理システムに通知しない。このため、ネットワーク管理システムの負荷を増大させることおよび監視ネットワークのトラヒックを逼迫することにならない。
（２）時刻ｔ３からｔ５は、設定値＋１０％を２回超えているが、５周期未満であるため、時系列データ処理部１４は、ネットワーク管理システムに通知しない。一時的に閾値を超えただけであり、正常に戻ったため、ネットワーク管理システムが障害を分析する必要がないためである。ネットワーク管理システムが障害を分析することがないため、ネットワーク管理システムの負荷を減少させることができる。
（３）時刻ｔ６からｔ１０は、時刻ｔ１０で設定値＋１０％を５回超える。５周期以上であるためネットワーク管理システムに警報を通知する。この場合は、異常が発生し、ネットワーク管理システムが障害を分析する必要があるため、時系列データ処理部１４は、通知を行う。また、パラメータの時系列データとして、例えば、時刻ｔ６からｔ１０の値、または前回通知以降の全ての時系列データを圧縮して同時に通知する。 An example of the processing rule 15 will be described below.
Example 1: Only when the parameter for the collection period of 5 cycles continuously exceeds ± 10% of the set value, it is regarded as a parameter error and notified to the network management system. For example, when the parameter whose setting value is 100 is stored in the database 13 as shown in Table 2,

(1) Since the times t0 to t2 are within the set value, the time series data processing unit 14 does not notify the network management system. For this reason, the load of the network management system is not increased and the traffic of the monitoring network is not strained.
(2) From time t3 to t5 exceeds the set value + 10% twice, but is less than 5 cycles, so the time-series data processing unit 14 does not notify the network management system. This is because the network management system does not need to analyze the failure because the threshold is temporarily exceeded and the state returns to normal. Since the network management system does not analyze the failure, the load on the network management system can be reduced.
(3) From time t6 to t10, the set value + 10% is exceeded five times at time t10. Since it is 5 cycles or more, an alarm is notified to the network management system. In this case, since an abnormality has occurred and the network management system needs to analyze the failure, the time-series data processing unit 14 performs notification. Further, as the time series data of the parameter, for example, the values from time t6 to t10 or all the time series data after the previous notification are compressed and notified at the same time.

（１）時刻ｔ０からｔ５は、指定周期分の平均値が全て閾値以下であるため、時系列データ処理部１４は、ネットワーク管理システムに通知しない。このため、ネットワーク管理システムの負荷を増大させることおよび監視ネットワークのトラヒックを逼迫することにならない。この場合、ｔ１で一時的に閾値を超えただけであり、その後正常に戻ったため、ネットワーク管理システムが障害を分析する必要がない。
（２）時刻ｔ６は、指定周期分の平均値が１１１を超え、閾値を上回るため、ネットワーク管理システムに警報を通知する。この場合は、異常が発生し、ネットワーク管理システムが障害を分析する必要があるため、時系列データ処理部１４は、通知を行う。また、パラメータの時系列データとして、例えば、時刻ｔ４からｔ６の値、または前回通知以降の全ての時系列データを圧縮して同時に通知する。 Example 2: Notification is made when the average value of the parameters for the specified period exceeds the threshold value or the absolute value of the slope exceeds the threshold value. In this way, sliding window processing is also possible. For example, when the specified period is 3 periods and the parameter having a threshold value of 110 is accumulated in the database 13 as shown in Table 3,

(1) From time t0 to t5, since the average values for the specified period are all equal to or less than the threshold value, the time series data processing unit 14 does not notify the network management system. For this reason, the load of the network management system is not increased and the traffic of the monitoring network is not strained. In this case, since the threshold value is only temporarily exceeded at t1 and then returns to normal, there is no need for the network management system to analyze the failure.
(2) Since the average value for the specified period exceeds 111 and exceeds the threshold value at time t6, an alarm is notified to the network management system. In this case, since an abnormality has occurred and the network management system needs to analyze the failure, the time-series data processing unit 14 performs notification. As parameter time-series data, for example, values from time t4 to t6 or all time-series data after the previous notification are compressed and notified simultaneously.

  As described above, as long as the parameters are normal based on the rules, the parameter time series is basically not exchanged. For this reason, the load of the network management system is not increased and the traffic of the monitoring network is not strained. Conversely, only when a notification event for one of the parameters to be monitored by the user occurs, a time series of other parameters that need to be acquired by the network management system is added to exchange data.

  The present invention can also be implemented as a program on an Ethernet switch or IP / MPLS router having an execution space for a user program, not an independent device.

  In addition, this program can be operated as an SNMP agent program that provides data acquired from a network device. The parameter providing method provided by the program as the SNMP agent program is the same as the method for providing the extended MIB. Thereby, it is possible to do the same thing as the user can freely define the extended MIB.

  Moreover, all the embodiments described above are illustrative of the present invention and are not intended to limit the present invention, and the present invention can be implemented in other various modifications and changes. Therefore, the scope of the present invention is defined only by the claims and their equivalents.

DESCRIPTION OF SYMBOLS 1 Network information acquisition apparatus 11 Data acquisition part 12 Acquisition parameter list 13 Database 14 Time series data processing part 15 Processing rule 16 Notification part

Claims (6)

An acquisition parameter list that defines parameters to be acquired from network devices,
A processing rule that specifies a rule for the process and a processing result for the parameter;
Data acquisition means for acquiring parameters defined in the acquisition parameter list from one or more network devices;
A database that holds the acquired parameters in time series;
Time-series data processing means for analyzing whether the parameters held in the time series deviate from the processing rules;
A network information acquisition apparatus comprising: notification means for notifying the analysis result when the processing rule is deviated. A data compression means for compressing the data;
2. The notification unit according to claim 1, wherein, when the processing unit deviates from the processing rule, the data compression unit notifies the analysis result and the parameters held in the time series after being compressed by the data compression unit. Network information acquisition device.   The network information acquisition apparatus according to claim 1, wherein the data acquisition unit is a unit that acquires the parameter from an SNMP agent program or a command line interface of a network device. An acquisition parameter list that defines parameters to be acquired from network devices,
A processing rule that specifies a rule for the process and a processing result for the parameter;
In a network information acquisition method in an apparatus comprising a database that holds the parameters in time series,
A data acquisition step of acquiring the parameters defined in the acquisition parameter list from one or more network devices;
Storing the acquired parameters in the database in time series;
A time series data processing step for analyzing whether the parameters held in the time series deviate from the processing rules;
And a notification step of notifying the analysis result when the processing rule is deviated. An acquisition parameter list that defines parameters to be acquired from network devices,
A processing rule that specifies a rule for the process and a processing result for the parameter;
A computer comprising a database that holds the parameters in time series,
Data acquisition means for acquiring parameters defined in the acquisition parameter list from one or more network devices;
Means for storing the acquired parameters in the database in time series;
Time-series data processing means for analyzing whether the parameters held in the time series deviate from the processing rules;
A program that operates as notifying means for notifying the analysis result when it deviates from the processing rule.   6. The program according to claim 5, wherein the program operates as an SNMP agent program.

Images