JP5217853B2 - Address association method, address association program, and apparatus - Google Patents

Description

  The present invention relates to a system visualization technique in a multilayer system.

  2. Description of the Related Art In recent years, a large-scale system that realizes a business such as a transfer process or an account reference from a WEB server, such as a banking business, is generally configured as a multilayer system by a plurality of servers having different functions. In a multilayer system, a three-tier system is often adopted. As shown in FIG. 15, the three-tier system includes a web server, an application server, and a database server. The three-tier system performs a series of processes (businesses and transactions) by an operation in which a Web server that receives a request from a client calls an application and the application accesses the database server. In addition, a call related to the process is performed by a request.

  In addition, as shown in FIG. 16, in such a three-tier system, the call relationship related to processing is extracted by observing data flowing between devices, model construction and matching are performed, and analysis for each constructed model is performed. System visualization analysis is performed. By this system visualization analysis, reporting (current status analysis and analysis) of a three-tier system is performed.

  Hereinafter, model construction and matching in such system visualization analysis will be described. FIG. 17 is a diagram showing a request in the three-tier system. FIG. 18 is a diagram illustrating an inclusion relationship between requests having different protocols.

  Model construction and matching are performed based on the call relationship between devices. These calling relationships are determined by a request from a certain device to a different device. The request type differs depending on the type of device. For example, in a general three-tier system, as shown in FIG. 17, an HTTP request is sent from the client to the WEB server, an IIOP request is sent from the WEB server to the application, and an SQL request is sent from the application server to the database server. Request exists. These requests are extracted from communication data in the network for configuring the three-tier system, and each device is uniquely associated with its IP address in the system visualization analysis.

  In order to extract the call relationship by such a request, the call destination IP address of the upper request (parent request) matches the call source IP address of the lower request (child request), and the processing time of the parent request The condition that the band includes the processing time period of the child request is used as a condition.

As a related art related to the present invention, in a time-series event record analysis method for analyzing the contents of a time-series event record generated by software when an event of operation or operation on the apparatus occurs, Defining a start part of a semantic set representing one or more elements among a plurality of elements included in an event record as a start part, defining an end part of the semantic set as an end part, and defining the start part and the end part In accordance with the above, a time series event record analysis method and apparatus, a program, and a recording medium are known in which each semantic set is detected from a time series event record to be analyzed and the time series event record is decomposed into a plurality of semantic sets ( For example, see Patent Document 1).
JP 2003-308229 A

  However, as shown in FIG. 19, there is a case where one device includes a plurality of network cards and as a result has a plurality of IP addresses. In such a case, since the call destination of the parent request and the call source of the child request do not match, there is a problem that the call relation of the request is not correctly extracted. Taking FIG. 19 as an example, since the IP address 3 as the call destination of the IIOP request does not match the IP address 3 'as the call source of the SQL request, the call relationship cannot be extracted according to the above-described conditions.

  In addition, as shown in FIG. 20, some requests cannot be observed due to encryption of communication of a specific protocol, observation time shift caused by a physical distance between devices, and the like. There is a case. In such a case, there is a problem that the indirect call relationship between the upper and lower requests of the request that cannot be observed cannot be extracted. Taking FIG. 20 as an example, since the IP address 2 as the call destination of the HTTP request and the IP address 3 as the call source of the SQL request do not match, an indirect call relationship cannot be extracted according to the above-described conditions.

  Further, a three-tier system in which there is a problem that one device has a plurality of addresses is as shown in FIG. 21. In the server 1 and the server 2, the caller address and the callee address are different. Therefore, when these IP addresses are used, as shown in FIG. 22, all requests are independent, and as a result, a correct model configuration cannot be obtained.

  These problems are caused by the fact that the system visualization analysis of the conventional multi-layer system cannot treat the call destination of the request having the different IP address and the call source of the request as the same.

  The present invention has been made to solve the above-described problems, and an address association method, an address association program, and an apparatus capable of matching a call destination address in a request with a call source address having a different address. The purpose is to provide.

  In order to solve the above-described problem, an address association method is a method executed by a computer, and in the request information which is information including a transmission source address, a transmission destination address, and a processing time zone of a plurality of requests, A first request extraction step for extracting a set of requests that include a processing time zone of a predetermined request and whose transmission destination address matches the transmission source address of the predetermined request, as a first request, A first association step in which the first request extracted in the first request extraction step is associated with the predetermined request and stored in a storage unit; and the request information includes the first request in the first association step. Requests associated with and not stored in the storage unit A first address extraction step of extracting a set of addresses having a ratio equal to or higher than a first threshold, which is a predetermined threshold, as a first address, and a first address extracted by the first address extraction step among the plurality of requests. A second request extracting step for extracting a set of requests having an address as a source address as a second request, and a predetermined address other than the first address in the request information extracted by the second request extracting step. A second address extraction step of extracting, as a second address, a set of addresses that are request source addresses including the processing time of any of the second requests and satisfy the first condition regarding the ratio of the requests; A predetermined address in the first address; and A second address that is stored in the storage unit in association with an address that satisfies the second condition related to the processing time period with respect to a predetermined address in the first address among the second addresses extracted in the two-address extracting step. The association step is executed by the computer.

  Further, the address association program includes a processing time zone of a predetermined request among the plurality of requests in request information which is information including a transmission source address, a transmission destination address, and a processing time zone of a plurality of requests. And a first request extraction step of extracting a set of requests whose transmission destination addresses match the transmission source address of the predetermined request as a first request, and the first request extracted by the first request extraction step A first association step that is associated with the request and stored in the storage unit, and a ratio of requests that are associated with the first request by the first association step and are not stored in the storage unit in the request information Set of addresses that are greater than or equal to a first threshold that is a predetermined threshold A first address extracting step for extracting as a first address, and a set of requests having the first address extracted by the first address extracting step as a transmission source address among the plurality of requests as a second request. 2 request extraction step, and a request source including the processing time of any request of the second request extracted by the second request extraction step among the predetermined addresses other than the first address in the request information A second address extracting step for extracting a set of addresses that satisfy the first condition regarding the request ratio as a second address, a predetermined address in the first address, and the second address extracting step. Out of the second address For a given address in the first address, to execute a second correlation step of storing in the storage unit in association with the second condition is satisfied address relating to the processing time period to the computer.

  Further, the address association device includes a processing time zone of a predetermined request among the plurality of requests in request information which is information including a transmission source address, a transmission destination address, and a processing time zone of a plurality of requests, And a first request extraction unit that extracts a set of requests whose transmission destination addresses match the transmission source address of the predetermined request as a first request, and the first request extracted by the first request extraction unit, A request that is associated with the predetermined request and stored in the storage unit, and a request that is associated with the first request by the first association unit and is not stored in the storage unit in the request information A set of addresses whose ratio is equal to or higher than a first threshold which is a predetermined threshold is extracted as a first address A first address extraction unit; a second request extraction unit that extracts, as a second request, a set of requests having the first address extracted by the first address extraction unit as a transmission source address among the plurality of requests; The request source address including the processing time of any one of the second requests extracted by the second request extraction unit among the predetermined addresses other than the first address in the request information; and A second address extraction unit that extracts, as a second address, a set of addresses that satisfy the first condition regarding the ratio of requests, a predetermined address in the first address, and a second address extracted by the second address extraction unit Of these, the processing time for a predetermined address in the first address Relates in association with the second condition is satisfied address and a second associating unit to be stored in the storage unit.

  According to the present invention, in a multi-layer system, there is an effect that a call destination address in a request can be matched with a call source address having a different address.

Embodiment 1 FIG.
Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram showing a three-tier system according to the present embodiment.

  In the three-tier system according to the present embodiment, as shown in FIG. 1, a client 2, a WEB server 3, an AP (Application) server 4, an AP server 5, and a DB (Data Base) server 6 are connected via a router 7. It is constituted by being done. In such a three-tier system, when the WEB server 3 receives a request from the client 2, the WEB server 3 calls the AP server 4 (or 5), and the AP server 4 (or 5) accesses the DB server. Processing is performed.

  In such a three-tier system, the WEB server 3 receives a request from the client 2 to which the IP address A is allocated, and requests the AP server 4 (or 5) for processing related to the received request. A device to which an address B is assigned. Further, the AP servers 4 and 5 acquire and execute the processing requested by the WEB server 3 by requesting the DB server 6 for data related to the processing. The AP server 4 includes two network cards, and is assigned with an IP address C as a call destination from the WEB server 3 and an IP address D as a call source to the DB server. Since the AP server 4 is a device that holds a plurality of IP addresses, it is a device that becomes an obstacle in the conventional system visualization analysis. The AP server 5 is a device to which the IP address E is assigned. The DB server 6 stores data related to processing by the AP servers 4 and 5, and is a device to which the IP address F is assigned.

  In this embodiment, a request from the client 2 to the WEB server 3 is an HTTP request, and a call of the AP server 4 (or 5) by the WEB server 3 is an IIOP (Internet Inter-ORB Protocol) request, an AP server 4 (or Calling the DB server 6 according to 5) is an SQL request.

  In addition, a request by each server in such a three-tier system is acquired as request data by the collection server 1 (address association device) connected to the router 7. Note that the configuration of the three-tier system according to the present embodiment is merely an example, and any multilayer system that executes a series of processing requested by a client using a plurality of devices connected via the router 7 may be used.

  Next, the configuration of the collection server according to the present embodiment will be described. FIG. 2 is a diagram illustrating a configuration of the collection server according to the present embodiment.

  As shown in FIG. 2, the collection server 1 according to the present embodiment includes a request data reading unit 11, a parent request candidate detecting unit 12 (first request extracting unit, first associating unit), and a source address candidate detecting unit. 13 (first address extraction unit), IP address translation rule generation unit 14, translation destination address candidate detection unit 15 (first address extraction unit), translation destination address selection unit 16 (second request extraction unit, second address extraction unit) , A second association unit), a conversion rule set output unit 17, and a CPU 18 and a memory 19 (storage unit) that substantially execute the functions of these units. Further, in the present embodiment, the collection server 1 uses the IP address (IP address D) as a call source in a device having a different IP address, such as the AP server 4, as the conversion source address and the IP address ( The processing for setting the IP address C) as the conversion destination address is performed. Further, the collection server 1 outputs an IP address conversion rule as a rule for converting the conversion source address to the conversion destination address. This IP address conversion rule is a rule for identifying different IP addresses in the system visualization analysis.

  The request data reading unit 11 reads request data (request information) into the memory 19. Further, the parent request candidate detection unit 12 obtains a request that is a call source of a request as a parent candidate based on the request data. The translation source address candidate detection unit 13 obtains a call source address candidate as a translation source candidate. The translation address candidate detection unit 15 selects an IP address that satisfies a predetermined condition from the translation address candidates. The IP address conversion rule generation unit 14 generates an IP address conversion rule based on the conversion source address and the conversion destination address.

  Next, the overall operation of the collection server according to this embodiment will be described. FIG. 3 is a flowchart showing the overall operation of the collection server according to the present embodiment. FIG. 4 is a diagram showing request data. FIG. 5 is a diagram illustrating a temporal relationship between requests. FIG. 6 is a diagram showing request data to which a parent candidate set is added.

  First, the request data reading unit 11 reads request data from the router 7 (S101). As shown in FIG. 4, this request data is associated with ID, protocol (request type), caller IP address (source address), callee IP address (destination address), start time, and end time. Data. In the request data, the protocol indicates the protocol of the request. The call source IP address indicates the IP address of the request call source (source) device. The call destination IP address indicates the IP address of the request call destination (transmission destination) device. The start time indicates a request transmission time, that is, a start time of a predetermined process in the device. The end time indicates a response reception time, that is, an end time of a predetermined process in the device. These times indicate the processing time zone of the processing by the request. The ID is a unique identifier for the associated parameter. This request data is a communication log in the router 7. Further, the request data may be generated by the request data reading unit 11 based on the communication log. For example, request data may be generated based on a request log and a corresponding response log.

  Next, the parent request candidate detection unit 12 refers to the request data read by the request data reading unit 11, and determines the parent candidate request set (first request) from the inclusion relationship of the processing time zones in each request and the IP address. (S102, first request extraction step). Specifically, as shown in FIG. 5, the processing time zone of one request is within the processing time zone of another request, and the source IP address of the former request matches the latter destination. The latter is the parent candidate of the former. In FIG. 5, as an example, the processing time zone of the request 17 is covered by the processing time zone of the request 16, and the transmission source of the request 17 matches the transmission destination of the request 16. Shown to be a candidate. Further, as shown in FIG. 6, the parent request candidate detection unit 12 adds a set of requests that are parent candidates as a “parent candidate set” indicated by an ID to each request in the request data. Remember.

  Next, the conversion source address candidate detection unit 13 executes a conversion source address candidate detection process to be described later (S103). This conversion source address candidate detection process is a process for obtaining an IP address satisfying a predetermined condition based on the parent candidate request set obtained by the parent request candidate detection unit 12.

  Next, a destination address determination process described later is executed by the IP address translation rule generation unit 14, the destination address candidate detection unit 15, and the destination address selection unit 16 (S104). This conversion destination address determination process is a process for determining a conversion destination for a conversion source address candidate.

  Next, the conversion rule set output unit 17 generates and outputs the obtained conversion source address / translation destination address pair as a conversion rule (S105).

  Next, the conversion source address candidate detection process will be described. FIG. 7 is a flowchart showing the operation of the source address candidate detection process according to the present embodiment. FIG. 8 is a diagram illustrating conversion source candidates obtained by the conversion source address candidate detection process.

  First, the source address candidate detection unit 13 selects a predetermined IP address in the request data to which the parent candidate set is added (S201), and obtains a request using the selected IP address as a caller (S202). The number of requests Ni is obtained (S203).

  Next, the translation source address candidate detection unit 13 uses the ratio between the number of requests Li and the Ni that makes the parent candidate an empty set in the request obtained in step S202 in the request data to which the parent candidate set is added ( Li / Ni) is determined as Mi (S204).

  The translation source address candidate detection unit 13 that has obtained the ratio Mi determines whether Ni is greater than or equal to a predetermined threshold value V1 (V1 = 2 in the present embodiment) set in advance (S205).

  When Ni is V1 or higher (S205, YES), the source address candidate detection unit 13 determines whether Mi is equal to or higher than a preset threshold V2 (V2 = 0.99 in the present embodiment) different from V1. Is determined (S206).

  When Mi is V2 or more (S206, YES), the source address candidate detection unit 13 adds the selected IP address to the source address set Fs (first address) (S207, first address set step). It is determined whether there is an unselected IP address (S208).

  On the other hand, when Mi is smaller than V2 (S206, NO), the source address candidate detection unit 13 determines whether there is an unselected IP address in the request data to which the parent candidate set is added (S208). If there is, one of them is selected (S201).

  If Ni is smaller than V1 in step S205 (S205, NO), the source address candidate detection unit 13 determines whether there is an unselected IP address in the request data to which the parent candidate set is added. If so, one of them is selected (S201).

  In the present embodiment, the source address obtained by the source address candidate detection process described above based on the request data to which the parent candidate set is added has two or more requests as shown in FIG. The ratio of requests that do not have A and D is 0.99 or more.

  Next, the conversion destination address determination process will be described. FIG. 9 is a flowchart showing the operation of the conversion destination address determination process. FIG. 10 is a diagram showing a request that can be a parent candidate with the shortest processing time for the IP address D. FIG. 11 is a diagram illustrating IP addresses in which the ratio of requests with a parent candidate among requests without a parent is equal to or higher than a predetermined threshold. FIG. 12 is a diagram showing a request that can be a parent candidate with the shortest processing time for the IP address A.

  First, the translation destination address candidate detection unit 15 determines whether or not the translation source address set Fs obtained by the translation source address candidate detection process is an empty set (S301).

  When Fs is not an empty set (S301, NO), the conversion destination address candidate detection unit 15 selects the conversion source address X from Fs and removes X from Fs (S302). In this embodiment, since Fs = {A, D}, when the source address X = D is taken as an example, Fs = {A, D} − {D} = {A}.

  Next, the translation destination address candidate detection unit 15 obtains a set Ys of IP addresses Y other than X and a set NPs (X) (second request) of requests without parent candidates whose source is X (S303, Second request extraction step). In this embodiment, since X = D, Ys = {A, B, C, E, F}, and NPs (D) = {3, 11, 15}.

  The translation destination address candidate detection unit 15 that has obtained Ys and NPps (X) includes, for each IP address Y included in Ys, a request that temporally includes a request r as an element included in NPs (X). Requests p (r, Y) whose destination IP address is Y and whose processing time is the shortest are respectively determined as parent candidates (S304, second association step). A request as a parent candidate is usually a request in which the call source and call destination of a request are the same IP address, and the processing time includes the processing time of a child request. However, since the destination address candidate detection unit 15 assumes that X and Y having different IP addresses are the same server, the conversion destination address candidate detection unit 15 obtains a parent candidate based only on the inclusion relationship of request processing times. In the present embodiment, p (r, Y) is as shown in FIG. When p (11, B) in FIG. 10 is taken as an example, assuming that IP address B and IP address D are the IP addresses of the same server, as shown in FIG. It is done. Referring to FIG. 6, the processing time of 7 is 34-21 = 13, and the processing time of 9 is 37-23 = 14. As a result, p (11, B) = 7.

  Next, the conversion destination address candidate detection unit 15 assumes that the element Y of X and Ys is the same server in the request without parent having X as the transmission source, that is, the request r included in NPs (X). In this case, a set of IP addresses whose parent candidate is present, that is, the ratio of p (r, Y) is greater than or equal to the threshold value V3 (= 1) (first condition) is defined as an X conversion destination set T (X) S305, second address extraction step). In the present embodiment, when attention is paid to B in Y, the requests with D as the caller and without parent are 3, 11, and 15. Further, since there is a parent candidate in all these requests, the ratio of the parent candidate P (r, Y) in the request with no parent is 1 as shown in FIG. Since an IP address equal to or higher than V3 (= 1) is a translation destination address, B is added to the translation destination set. Similarly, C is added to the conversion destination set.

  Here, the threshold value V3 will be described. In a multi-layer system, since a lower layer request is always called to process an upper layer request, a parent candidate always exists as long as an IP address corresponding to the same server can be correctly recognized. That is, ideally, the threshold value V3 may be 1. However, in practice, the request data shown in FIG. 4 cannot be input in a complete form for various reasons, so a value slightly smaller than 1 is set. The biggest reason why the request data is incomplete is that the router 7 may not be able to capture all communications. In the present embodiment, communication between servers is performed by TCP / IP. A continuous message number is assigned to this TCP / IP. The translation destination address candidate detection unit 15 refers to the TCP / IP message number in the captured log, determines the number of message numbers captured within a predetermined period as L1, and the number of missing message numbers as L1. And the ratio of L1 subtracted by L2 is divided by L1 to obtain the ratio of no capture loss. By using such a ratio as a threshold value, it is possible to exclude the influence of capture loss in obtaining the conversion destination address.

  When the conversion destination set T (X) is obtained by the conversion destination address candidate detection unit 15, the conversion destination address selection unit 16 determines whether T (X) is an empty set (S306).

  When T (X) is not an empty set (S306, NO), the conversion destination address selection unit 16 uses the parent-less request r having X as the transmission source and the parent at the IP address Y included in T (X). Y (second condition) that minimizes the average processing time difference from the candidate p (r, Y) is selected as the conversion destination address of X (S307, second association step). In this embodiment, when Y = B, {(1 processing time−3 processing time) + (7 processing time−11 processing time) + (13 processing time−15 processing) Time)} / 3 = {(7-1) + (13-2) + (11-2)} / 3 = 26/3. When Y = C, {(2 processing time−3 processing time) + (8 processing time−11 processing time) + (14 processing time−15 processing time)} / 3 = { (5-1) + (11-2) + (8-2)} / 3 = 19/3. Therefore, C is selected as the X conversion destination address.

  When the conversion destination address is selected by the conversion destination address selection unit 16, the IP address conversion rule generation unit 14 adds (X, Y) to the memory 19 as a set Rs of conversion source address / translation destination address pairs. (S308). In the present embodiment, Rs = {(D, C)}.

  In step S306, when T (X) is an empty set (S306, YES), the conversion destination address selection unit 16 determines again whether Fs is an empty set (S301).

  In step S301, when Fs is an empty set (S301, YES), the conversion destination address candidate detection unit 15 ends the conversion destination address determination process.

  In this embodiment, A is selected after D is selected as X and the above processing is performed. Hereinafter, a processing example when A is selected as X will be described. First, when A is selected as X in step S301, X = A and Fs = {{A}-{A}} = {}. Next, in step S303, {B, C, D, E, F} is obtained as a set Ys of IP addresses other than A. Further, NPs (A) = {1, 4, 7, 9, 13, 16}. If p (r, Y) is obtained in step S304 based on this NPs (A), there is no request that includes the processing time for all requests included in NPs (X). As shown. Therefore, in S305, the conversion destination set T (X) is an empty set, and the process for X = A ends. Further, since Fs is also an empty set, the result is Rs = {(D, C)}.

  The Rs thus obtained is generated and output as a conversion rule by the conversion rule set output unit 17. The conversion rule output in this way is used in system visualization analysis.

  As described above, according to this embodiment, by converting different IP addresses, as a result, even when one server has a plurality of IP addresses, it is possible to obtain a calling relationship in a multi-layer system. it can. Further, when requests that cannot be observed are sandwiched between them, it is possible to extract the request source devices before and after the request that cannot be observed by identifying them by IP address conversion. Specifically, when the IIOP request shown in FIG. 20 cannot be observed, the WEB server and the application are temporarily identified by converting the IP address 3 to the IP address 2, and the indirect connection between the client and the database server is performed. Call relationships can be extracted.

Embodiment 2. FIG.
In the first embodiment, the conversion destination set T (X) of X is obtained from the inclusion relation of the request processing time. However, in this embodiment, an IP address that further satisfies the hierarchical relation of the request protocol. Select. Hereinafter, the operation (S305) of this embodiment different from that of Embodiment 1 will be described with reference to FIG. FIG. 13 is a diagram illustrating parent candidates when using a protocol hierarchy. The configurations of the three-tier system and the collection server 1 according to this embodiment are the same as those in the first embodiment.

  In the present embodiment, the conversion destination address candidate detection unit 15 uses the parent when the IP address X is assumed to be the same as Y for the request r included in NPs (X) in step S304 of the conversion destination address determination process. When request candidates are obtained, only requests that satisfy the hierarchical relationship of protocols that limit the order relationship of requests in addition to the inclusion relationship of processing time zones are set as parent candidates. A specific processing example is shown below. In the present embodiment, the hierarchical relationship of the protocol is HTTP → IIOP → SQL. That is, the parent request of the request whose protocol is IIOP is an HTTP request, and the parent request of the SQL request is an IIOP request. For example, for the request 11 that is an element of NPs (D) in the case of X = D, the parent candidate p (11, B) is assumed when the IP address B that is the element of X = D and Ys is the same server. When requesting, there are two requests 7 and 9 that include the processing time of the request 11 from the start and end times of each request shown in FIG. However, the request 11 is an SQL request, and the protocol of the parent request must be IIOP from the hierarchical relationship of the protocol. However, requests 7 and 9 both have HTTP protocol and do not satisfy the hierarchical relationship. Therefore, it does not become a parent candidate, and there is no parent candidate in the request 11. Similarly, for all requests included in NPs (D), FIG. 13 shows a result of obtaining a parent request candidate having the shortest processing time for each IP address Y included in Ys. As a result, when the set of conversion destination candidates T (D) for IP address D is obtained in S305, the only IP address for which the ratio of the parent candidates is threshold V3, that is, 1 or more, is C. Therefore, T (D) = {C}. This indicates that the conversion destination candidates can be further narrowed down as compared with the conversion destination candidate set T (D) = {B, C} when the hierarchical relationship of the protocol is not used.

  As described above, narrowing down the candidates for the conversion destination address based on the hierarchical relationship of the protocol increases the possibility of obtaining a correct conversion rule as a result.

  The present invention can be implemented in various other forms without departing from the gist or main features thereof. Therefore, the above-described embodiment is merely an example in all respects and should not be interpreted in a limited manner. The scope of the present invention is shown by the scope of claims, and is not restricted by the text of the specification. Moreover, all modifications, various improvements, substitutions and modifications belonging to the equivalent scope of the claims are all within the scope of the present invention.

  The present invention can be applied to the following computer system. FIG. 14 is a diagram illustrating an example of a computer system to which the present invention is applied. A computer system 900 shown in FIG. 14 includes a main body 901 with a built-in CPU, disk drive, and the like, a display 902 that displays an image according to an instruction from the main body 901, a keyboard 903 for inputting various information to the computer system 900, A mouse 904 for designating an arbitrary position on the display screen 902a of the display 902 and a communication device 905 for accessing an external database or the like and downloading a program or the like stored in another computer system are provided. The communication device 905 may be a network communication card, a modem, or the like.

  A program for executing the above steps in the computer system constituting the collection server 1 as described above can be provided as an address conversion program. By storing this program in a recording medium readable by the computer system, the computer system constituting the collection server 1 can be executed. A program for executing the above steps is stored in a portable recording medium such as a disk 910 or downloaded from a recording medium 906 of another computer system by the communication device 905. Further, an address conversion program (address conversion software) that causes the computer system 900 to have at least an address conversion function is input to the computer system 900 and compiled. This program causes the computer system 900 to operate as a system visualization analysis system having a system visualization function. Further, this program may be stored in a computer-readable recording medium such as a disk 910, for example. Here, as a recording medium readable by the computer system 900, various storage media accessible by a computer system such as a flexible disk, a CD-ROM (Compact Disk Read Only Memory), a DVD disk, a magneto-optical disk, and an IC card are available. Including.

As mentioned above, according to this Embodiment, the technical idea shown with the following additional remarks is disclosed.
(Supplementary note 1) An address mapping method executed by a computer,
In the request information, which is information including a source address, a destination address, and a processing time zone of a plurality of requests, the processing time zone of a predetermined request is included among the plurality of requests, and the destination address is the predetermined address. A first request extraction step for extracting a set of requests that match the source address of the request as a first request;
A first association step of storing the first request extracted in the first request extraction step in a storage unit in association with the predetermined request;
In the request information, a first set of addresses in which the ratio of requests that are associated with the first request in the first association step and are not stored in the storage unit is equal to or greater than a first threshold that is a predetermined threshold. A first address extraction step of extracting as an address;
A second request extracting step of extracting, as a second request, a set of requests having the first address extracted in the first address extracting step as a source address among the plurality of requests;
The request source address including the processing time of any request of the second request extracted by the second request extraction step among the predetermined addresses other than the first address in the request information; and A second address extracting step of extracting a set of addresses satisfying the first condition regarding the ratio of requests as a second address;
Of the predetermined address in the first address and the second address extracted in the second address extraction step, an address satisfying a second condition related to the processing time zone with respect to the predetermined address in the first address A second associating step of associating and storing the information in the storage unit, wherein the computer executes the address associating method.
(Supplementary note 2) The address mapping method according to supplementary note 1, wherein
The first condition is characterized in that, in a request that is a source address, a ratio of requests including a request processing time in the second request is equal to or higher than a second threshold that is a threshold different from the first threshold. Address mapping method.
(Supplementary note 3) The address mapping method according to supplementary note 1, wherein
The plurality of requests in the request information further includes a request type that limits the order relationship of the requests,
The first condition is that, in a request that is a transmission source address, a ratio of requests including a request processing time in the second request is equal to or greater than a second threshold that is a threshold different from the first threshold, and the order relation In claim 2, the type of request is correct with respect to the type of the second request.
(Additional remark 4) It is the address matching method of Additional remark 1, Comprising:
The second condition is that, in the second request, for each request whose source is a predetermined address in the first address, a request having the shortest processing time in the request including the processing time zone of the request. Selected as a selection request, and a processing time based on a processing time zone of each request having a predetermined address in the first address as a transmission source, and a processing time based on a processing time zone of the selection request selected for the request, An address associating method characterized in that an average value of each difference for each source address is minimum.
(Additional remark 5) It is the address matching method of Additional remark 1, Comprising:
The request information is information based on information acquired in a communication line to which a device that transmits or receives the request is connected,
The address association method, wherein the second threshold value is a value based on an acquisition rate of the information.
(Supplementary note 6) The address mapping method according to supplementary note 5, wherein
A serial number is added to the information acquired on the communication line,
The address association method, wherein the acquisition rate is calculated based on information in which the serial numbers are not continuous.
(Supplementary note 7) The address mapping method according to supplementary note 3, wherein
An address association method, wherein the request type is a protocol.
(Supplementary Note 8) In request information that is information including a source address, a destination address, and a processing time zone of a plurality of requests, a processing time zone of a predetermined request among the plurality of requests is included, and a destination address A first request extracting step for extracting a set of requests that match the source address of the predetermined request as a first request;
A first association step of storing the first request extracted in the first request extraction step in a storage unit in association with the predetermined request;
In the request information, a first set of addresses in which the ratio of requests that are associated with the first request in the first association step and are not stored in the storage unit is equal to or greater than a first threshold that is a predetermined threshold. A first address extraction step of extracting as an address;
A second request extracting step of extracting, as a second request, a set of requests having the first address extracted in the first address extracting step as a source address among the plurality of requests;
The request source address including the processing time of any request of the second request extracted by the second request extraction step among the predetermined addresses other than the first address in the request information; and A second address extracting step of extracting a set of addresses satisfying the first condition regarding the ratio of requests as a second address;
Of the predetermined address in the first address and the second address extracted in the second address extraction step, an address satisfying a second condition related to the processing time zone with respect to the predetermined address in the first address An address associating program for causing a computer to execute a second associating step of associating and storing in the storage unit.
(Supplementary note 9) The address association program according to supplementary note 8,
The first condition is characterized in that, in a request that is a source address, a ratio of requests including a request processing time in the second request is equal to or higher than a second threshold that is a threshold different from the first threshold. Address mapping program.
(Additional remark 10) It is an address matching program as described in additional remark 8, Comprising:
The plurality of requests in the request information further includes a request type that limits the order relationship of the requests,
The first condition is that, in a request that is a transmission source address, a ratio of requests including a request processing time in the second request is equal to or greater than a second threshold that is a threshold different from the first threshold, and the order relation The address association program according to claim 1, wherein the request type is correct with respect to the second request type.
(Supplementary note 11) The address association program according to supplementary note 8,
The second condition is that, in the second request, for each request whose source is a predetermined address in the first address, a request having the shortest processing time in the request including the processing time zone of the request. Selected as a selection request, and a processing time based on a processing time zone of each request having a predetermined address in the first address as a transmission source, and a processing time based on a processing time zone of the selection request selected for the request, An address associating program characterized in that the average value for each source address of the difference is minimum.
(Supplementary note 12) The address association program according to supplementary note 8,
The request information is information based on information acquired in a communication line to which a device that transmits or receives the request is connected,
The address association program, wherein the second threshold value is a value based on an acquisition rate of the information.
(Supplementary note 13) The address association program according to supplementary note 12,
A serial number is added to the information acquired on the communication line,
The acquisition rate is calculated based on information in which the serial numbers are not continuous.
(Supplementary note 14) An address mapping program according to supplementary note 10,
An address association program, wherein the request type is a protocol.
(Supplementary Note 15) In request information, which is information including a transmission source address, a transmission destination address, and a processing time zone of a plurality of requests, a processing time zone of a predetermined request among the plurality of requests is included, and a transmission destination address A first request extraction unit that extracts a set of requests that match a source address of the predetermined request as a first request;
A first association unit that stores the first request extracted by the first request extraction unit in a storage unit in association with the predetermined request;
In the request information, a set of addresses in which the ratio of requests that are associated with the first request by the first association unit and are not stored in the storage unit is equal to or greater than a first threshold value that is a predetermined threshold value. A first address extracting unit for extracting as one address;
A second request extraction unit that extracts, as a second request, a set of requests having the first address extracted by the first address extraction unit among the plurality of requests as a source address;
The request source address including the processing time of any one of the second requests extracted by the second request extraction unit among the predetermined addresses other than the first address in the request information; and A second address extraction unit that extracts a set of addresses that satisfy the first condition regarding the ratio of requests as a second address;
Of the predetermined address in the first address and the second address extracted by the second address extraction unit, an address satisfying a second condition related to the processing time zone with respect to the predetermined address in the first address An address associating device comprising: a second associating unit that associates and stores the information in the storage unit.
(Supplementary note 16) The address association device according to supplementary note 15,
The first condition is characterized in that, in a request that is a source address, a ratio of requests including a request processing time in the second request is equal to or higher than a second threshold that is a threshold different from the first threshold. Address mapping device.
(Supplementary note 17) The address association device according to supplementary note 15,
The plurality of requests in the request information further includes a request type that limits the order relationship of the requests,
The first condition is that, in a request that is a transmission source address, a ratio of requests including a request processing time in the second request is equal to or greater than a second threshold that is a threshold different from the first threshold, and the order relation The address association apparatus according to claim 1, wherein the request type is correct with respect to the second request type.
(Supplementary note 18) The address association device according to supplementary note 15,
The second condition is that, in the second request, for each request whose source is a predetermined address in the first address, a request having the shortest processing time in the request including the processing time zone of the request. Selected as a selection request, and a processing time based on a processing time zone of each request having a predetermined address in the first address as a transmission source, and a processing time based on a processing time zone of the selection request selected for the request, An address associating apparatus characterized in that the average value of the difference between the source addresses is minimum.
(Supplementary note 19) The address association device according to supplementary note 15,
The request information is information based on information acquired in a communication line to which a device that transmits or receives the request is connected,
The address association apparatus, wherein the second threshold value is a value based on an acquisition rate of the information.
(Supplementary note 20) The address association device according to supplementary note 19,
A serial number is added to the information acquired on the communication line,
The address association apparatus, wherein the acquisition rate is calculated based on information in which the serial numbers are not continuous.

1 is a diagram showing a three-tier system according to Embodiment 1. FIG. 2 is a diagram illustrating a configuration of a collection server according to Embodiment 1. FIG. 3 is a flowchart illustrating an overall operation of the collection server according to the first embodiment. It is a figure which shows request data. It is a figure which shows the temporal relationship between requests. It is a figure which shows the request data to which the parent candidate set was added. 6 is a flowchart illustrating an operation of a source address candidate detection process according to the first embodiment. It is a figure which shows the conversion source candidate calculated | required by the conversion source address candidate detection process. It is a flowchart which shows the operation | movement of a conversion destination address determination process. It is a figure which shows the request which can become a parent candidate with the shortest processing time regarding IP address D. It is a figure which shows the IP address whose ratio of a request with a parent candidate among requests without a parent is more than a predetermined threshold value. It is a figure which shows the request which can become a parent candidate with the shortest processing time regarding IP address A. It is a figure which shows the parent candidate at the time of using a protocol hierarchy. It is a figure which shows an example of the computer system to which this invention is applied. It is a figure which shows the structure of the conventional three-tier system. It is a figure which shows the conventional system visualization analysis. It is a figure which shows the request in a three-tier system. It is a figure which shows the inclusion relationship between the requests from which a protocol differs. It is a figure which shows the case where one apparatus has a several IP address. It is a figure which shows the case where a one part request is not observed. 1 is a diagram illustrating a specific example of a three-tier system in which one device has a plurality of IP addresses. FIG. It is a figure which shows an independent request.

Explanation of symbols

  1 collection server, 2 client, 3 WEB server, 4 AP server, 5 AP server, 6 DB server, 7 router, 11 request data reading unit, 12 parent request candidate detection unit, 13 source address candidate detection unit, 14 IP address Conversion rule generation unit, 15 conversion destination address candidate detection unit, 16 conversion destination address selection unit, 17 conversion rule set output unit, 18 CPU, 19 memory.

Claims (6)

An address mapping method executed by a computer,
In the request information, which is information including a source address, a destination address, and a processing time zone of a plurality of requests, the processing time zone of a predetermined request is included among the plurality of requests, and the destination address is the predetermined address. A first request extraction step for extracting a set of requests that match the source address of the request as a first request;
A first association step of storing the first request extracted in the first request extraction step in a storage unit in association with the predetermined request;
In the request information, a set of source addresses in which the ratio of requests that are associated with the first request by the first association step and are not stored in the storage unit is equal to or greater than a first threshold that is a predetermined threshold. A first address extracting step for extracting as a first address;
A second request extracting step of extracting, as a second request, a set of requests having the first address extracted in the first address extracting step as a source address among the plurality of requests;
A request destination address including a request processing time of any one of the second requests extracted by the second request extraction step among the predetermined addresses other than the first address in the request information; and A second address extracting step of extracting a set of addresses satisfying the first condition regarding the ratio of requests as a second address;
Of the predetermined address in the first address and the second address extracted in the second address extraction step, an address satisfying a second condition related to the processing time zone with respect to the predetermined address in the first address A second associating step of associating and storing the information in the storage unit, wherein the computer executes the address associating method. The address association method according to claim 1,
The first condition is characterized in that, in a request that is a source address, a ratio of requests including a request processing time in the second request is equal to or higher than a second threshold that is a threshold different from the first threshold. Address mapping method. The address association method according to claim 1,
The plurality of requests in the request information further includes a request type that limits the order relationship of the requests,
The first condition is that, in a request that is a transmission source address, a ratio of requests including a request processing time in the second request is equal to or greater than a second threshold that is a threshold different from the first threshold, and the order relation In claim 2, the type of request is correct with respect to the type of the second request. The address association method according to claim 1 or 2, wherein:
In the request having the second address as a transmission destination address , the second condition is for a request including a processing time zone of the request for each request having a predetermined address in the first address as a transmission source. A request having the shortest processing time is selected as a selection request, a processing time based on a processing time zone of each request having the predetermined address in the first address as a transmission source, and processing of the selection request selected for the request address mapping method, wherein the average value for each destination address of the difference between the processing time based on the time zone is minimal. In the request information, which is information including a source address, a destination address, and a processing time zone of a plurality of requests, the processing time zone of a predetermined request is included among the plurality of requests, and the destination address is the predetermined address. A first request extraction step for extracting a set of requests that match the source address of the request as a first request;
A first association step of storing the first request extracted in the first request extraction step in a storage unit in association with the predetermined request;
In the request information, a set of source addresses in which the ratio of requests that are associated with the first request by the first association step and are not stored in the storage unit is equal to or greater than a first threshold that is a predetermined threshold. A first address extracting step for extracting as a first address;
A second request extracting step of extracting, as a second request, a set of requests having the first address extracted in the first address extracting step as a source address among the plurality of requests;
A request destination address including a request processing time of any one of the second requests extracted by the second request extraction step among the predetermined addresses other than the first address in the request information; and A second address extracting step of extracting a set of addresses satisfying the first condition regarding the ratio of requests as a second address;
Of the predetermined address in the first address and the second address extracted in the second address extraction step, an address satisfying a second condition related to the processing time zone with respect to the predetermined address in the first address An address associating program for causing a computer to execute a second associating step of associating and storing in the storage unit. In the request information, which is information including a source address, a destination address, and a processing time zone of a plurality of requests, the processing time zone of a predetermined request is included among the plurality of requests, and the destination address is the predetermined address. A first request extraction unit that extracts a set of requests that match a request source address as a first request;
A first association unit that stores the first request extracted by the first request extraction unit in a storage unit in association with the predetermined request;
In the request information, a set of source addresses in which the ratio of requests that are associated with the first request by the first association unit and are not stored in the storage unit is equal to or greater than a first threshold that is a predetermined threshold. A first address extraction unit for extracting as a first address;
A second request extraction unit that extracts a set of requests having the first address extracted by the first address extraction unit as a source address among the plurality of requests as a second request;
A destination address of a request including a processing time of a request of any of the second requests extracted by the second request extraction unit among the predetermined addresses other than the first address in the request information, and A second address extraction unit that extracts a set of addresses that satisfy the first condition regarding the ratio of requests as a second address;
Of the predetermined address in the first address and the second address extracted by the second address extraction unit, an address satisfying a second condition related to the processing time zone with respect to the predetermined address in the first address An address associating device comprising: a second associating unit that associates and stores the information in the storage unit.

Images