JP6149549B2 - Monitoring system and monitoring program - Google Patents

Description

  The present invention relates to a monitoring system and a monitoring program. For example, the present invention can be applied to a monitoring system and a monitoring program for monitoring a server, a network device, and the like using an SNMP (Simple Network Management Protocol) architecture.

  2. Description of the Related Art Conventionally, there is a system that uses the SNMP protocol as one of monitoring systems that monitor the operational status of devices on a network. When the monitored device to be monitored is compatible with the SNMP protocol, the monitoring device receives TRAP from the monitored device or periodically manages SNMP agent management information (for example, MIB (Management Information Base) information). Is monitored by polling to monitor the status change of the monitored device.

  Since SNMP communicates with the UDP / IP protocol, data communication between the SNMP manager and the SNMP agent is not guaranteed. In rare cases, for example, an SNMP packet loss occurs, TRAP fails, MIB information An acquisition error or the like may occur.

  The cause of packet loss has a wide range of suspicions, such as a failure of the monitored device, a bug in the OS or application installed in the monitored device, a network problem, etc., and is difficult to identify by log analysis alone. There are many cases. Therefore, traffic analysis by packet capture is used in combination with log analysis as means for identifying the suspected location.

  That is, an SNMP packet that passes through a device / device on the path between the monitoring device and the monitored device is captured. Then, when a problem event similar to that at the time of the occurrence of the failure is reproduced, the maintenance person identifies the suspected location by analyzing the packet loss occurrence location from the capture information.

  FIG. 2 is a flowchart showing a traffic analysis procedure by conventional packet capture.

  Conventionally, when a failure such as packet loss occurs, the maintenance person performs primary isolation from the failure log, and the maintenance person prepares for packet capture (S91). Specifically, the maintenance person investigates the failure log and determines a monitored device and a filtering condition (for example, a LAN interface, a port number, etc.) related to traffic monitoring.

  The maintenance person remotely connects to the monitored apparatus to be monitored using terminal software or the like, and executes packet capture according to the execution conditions determined in S91. Thereby, collection of the packet information of the SNMP packet is started (S92).

  That is, the packet information of the packet passing through the communication port of the network device on the communication path between the SNMP manager and the SNMP agent is acquired. Further, not only the packet information is acquired from the monitored device including the SNMP agent, but also the packet information that has passed through the communication port of the network device (for example, router) on the path between the SNMP manager and the SNMP agent is acquired.

  The maintenance person continuously monitors monitored devices and network devices until an event similar to the problem event occurs. If no problem event occurs, a reproduction test may be performed based on an assumed cause (S93).

  The maintenance person remotely connects to the monitored device to be monitored using terminal software or the like, and stops the packet capture executed in S92 (S94).

  After that, by analyzing the packet transmission status at the time when the problem event occurs from the packet information collected by the packet capture by the maintenance person, the apparatus and the network section where the packet loss has occurred are separated (S95).

  The technology described in Patent Document 1 relates to failure analysis at the time of network construction / construction. The packet capture unit captures packet data from the communication data received on the communication line at the reception port, and the communication connection / disconnection determination unit connects. Normality or abnormality is determined based on the state determination table, and the maintenance person displays the determination result through the GUI unit.

JP 2005-229537 A

  However, the above-described conventional traffic analysis method using packet capture may cause the following problems.

  First, when executing packet capture, there is a problem in that preparation takes time because a maintenance person first classifies from a failure log and determines a device to be captured and a filtering condition.

  Also, if packet capture is executed until the problem event is reproduced, a large amount of packet information is output to the file, so the disk capacity of the file output destination is always monitored, and if the problem is reproduced, the packet is promptly You need to stop the capture. Therefore, there is a problem that the maintenance person must always perform disk capacity monitoring and problem reproduction monitoring.

  Furthermore, when performing traffic analysis, the maintenance person must perform failure analysis from a large amount of output packet information, which causes a problem that it takes a very long time to identify a suspected place.

  Even when the technique described in Patent Document 1 is applied, it is necessary for the maintainer to issue a packet capture start or stop command. In addition, the technique described in Patent Document 1 has a similar problem in that it cannot perform fault isolation between a communication target device and a network device on a communication path.

  Therefore, there is a need for a monitoring system and a monitoring program that can automatically start or stop the execution of packet capture when a failure occurs, and that can automatically analyze a suspected location from a large amount of collected packet information. ing.

  In order to solve the above-described problem, the first aspect of the present invention is (1) a state management unit that acquires a state management packet from each of one or a plurality of monitored devices and manages the state of each monitored device; (2) When a failure is detected by the state management unit, collection of packet information of the state management packet is started from a plurality of relay devices from the state management unit to the monitored device related to the failure, and the collected packet information And a capture control means for stopping the collection of packet information based on the number of times of execution of the failure event reproduction test or the execution time of the reproduction test. is there.

  According to a second aspect of the present invention, there is provided: (1) a state management unit that acquires a state management packet from each of one or a plurality of monitored devices and manages the state of each monitored device; When a failure is detected by the means, collection of the packet information of the state management packet from a plurality of transit devices from the state management means to the monitored device related to the failure is started, and the suspected location is determined based on the collected packet information. The monitoring program is to be analyzed and to function as capture control means for stopping the collection of packet information based on the number of times of execution of the failure event reproduction test or the execution time of the reproduction test.

  According to the present invention, it is possible to automatically start or stop the execution of packet capture when a failure occurs, and to automatically analyze a suspected place from a large amount of collected packet information.

It is a block diagram which shows the whole structure image of the monitoring system which concerns on embodiment. It is a flowchart which shows the traffic analysis procedure by the conventional packet capture. It is a functional block diagram which shows the functional structure of the capture control part which concerns on embodiment. It is a block diagram which shows the structural example of the path | route information table which concerns on embodiment. It is a block diagram which shows the structural example of the apparatus information table which concerns on embodiment. It is a block diagram which shows the structural example of the filter condition table which concerns on embodiment. It is a block diagram which shows the structural example of the capture information table which concerns on embodiment. It is a block diagram which shows the structural example of the capture execution table which concerns on embodiment. It is explanatory drawing explaining the analysis process of a suspected place by the capture of the SNMP packet in the monitoring system which concerns on embodiment. It is a flowchart which shows the process of the start request | requirement or completion | finish request of a packet capture by the capture control function part which concerns on embodiment. It is a flowchart which shows the process of the packet capture end request | requirement by the capture execution time by the capture control function part which concerns on embodiment. It is a flowchart which shows the packet capture execution process by the capture execution function part which concerns on embodiment. It is the figure which enumerated some information which comprises an SNMP packet. It is explanatory drawing explaining the mode of the packet capture by the monitoring apparatus 1 which concerns on embodiment. It is explanatory drawing explaining the isolation | separation method of the suspected location of an SNMP packet in the case of the example of FIG.

(A) Main Embodiments Hereinafter, embodiments of a monitoring system and a monitoring program of the present invention will be described in detail with reference to the drawings.

  In this embodiment, for example, in a system in which the monitoring device monitors the operation state of the monitored device using SNMP, the monitoring device automatically sends a packet from a device or device on the path when a failure such as packet loss occurs. A case where the present invention is applied to a system that performs packet capture to acquire information (SNMP packet) and analyzes a failure occurrence point will be exemplified.

(A-1) Configuration of Embodiment FIG. 1 is a configuration diagram illustrating an overall configuration image of a monitoring system according to an embodiment. In FIG. 1, a monitoring system 10 according to the embodiment includes a monitoring device 1 and monitored devices 2-1 and 2-2.

  Although FIG. 1 illustrates a case where there are two monitored devices to be monitored by the monitoring device 1, the number of monitored devices is not particularly limited. When a common configuration of monitored devices is described, it is described as monitored device 2.

  FIG. 1 illustrates a case where the monitoring device 1 and the monitored devices 2-1 and 2-2 are connected via the network 5, and the monitoring device 1 is connected to the router 3-1 on the network 5. The monitored device 2-1 is connected to the router 3-2 on the network 5, and the monitored device 2-3 is connected to the router 3-3 on the network 5.

  The monitored device 2 is a device whose operation state is monitored by the monitoring device 1 using SNMP. The monitored device 2 includes, for example, a CPU, ROM, RAM, EEPROM, input / output interface unit, communication unit, and the like. The CPU executes a processing program stored in the ROM and performs software processing to execute the monitored device. The second function is realized.

  The monitored device 2 is constructed by a general-purpose OS (for example, Linux (registered trademark)), and holds packet information passing through a port of a network interface included in the monitored device 2 in a file (capture file). Is. A capture file name is given to the packet information file. Also, the header information of the SNMP packet, SNMP protocol information, PDU Type (command type), Request ID (command identifier), etc. are recorded in the capture file. That is, the capture file includes the command type and command identifier of the passed SNMP packet.

  As shown in FIG. 1, the monitored apparatus 2 functionally includes an SNMP agent 21 and MIB information (indicated as MIB in FIG. 1) 22 as management information.

  The SNMP agent 21 refers to the MIB 22 and transmits an SNMP response to the SNMP manager 13 in response to an SNMP request from the SNMP manager 13 described later. The SNMP agent 21 can apply an existing SNMP agent.

  The MIB 22 is management information indicating the state of the monitored device 2. The management information in the MIB 22 can be, for example, information defined in RFC 1156 (MIB1), information defined in RFC1213 (MIB2), or uniquely defined information.

  The routers 3-1 to 3-3 are examples of network devices that are interposed between the monitoring device 1 and the monitored device 2. In FIG. 1, the routers 3-1 to 3-3 are illustrated as an example of the network device. However, if the network device is between the monitoring device 1 and the monitored device 2, the network device is a switch device or the like. May be.

  In this embodiment, the routers 3-1 to 3-3 as network devices can be packet capture target devices by the monitoring device 1. The routers 3-1 to 3-3 that are network devices do not implement a tcpdump command that is a packet capture execution command. Therefore, the routers 3-1 to 3-3 have a port mirroring function and transfer capture information (capture file). Specifically, the routers 3-1 to 3-3 are connected to the capture device 32 via a mirror port. Further, the routers 3-1 to 3-3 have a port mirroring function of copying a packet passing through a specific communication port and transferring it to a mirror port. Thereby, a packet passing through a specific communication port can be transferred to the capture device 32 via the mirror port.

  The capture device 32 transmits packet information of packets passing through the routers 3-1 to 3-3 to the monitoring device 1 in accordance with a capture request from the monitoring device 1. As the capture device 32, for example, an information processing device (for example, a server, a personal computer, or the like) that uses a general-purpose OS (for example, Linux (registered trademark)) as an OS can be applied.

  The capture device 32 holds packet information of a packet transferred from a monitor port of a network device such as a connected router to a mirror port as a file (capture file). That is, the capture device 32 manages the monitor port and mirror port of the network device in association with each other, and manages from which monitor port the packet is port-mirrored.

  A capture file name is given to the packet information file. Also, the header information of the SNMP packet, SNMP protocol information, PDU Type (command type), Request ID (command identifier), etc. are recorded in the capture file. That is, the capture file includes the command type and command identifier of the passed SNMP packet.

  The monitoring device 1 monitors the operation state of the monitored device 2 to be monitored using SNMP.

  In addition, when a failure such as packet loss occurs in monitoring using SNMP, the monitoring device 1 is a device / equipment (hereinafter referred to as a capture target) that exists on the communication path between the monitoring device 1 and the monitored device 2. The packet information of the SNMP packet passing through the communication port of the device) is acquired (captured), and a suspicious part (suspected part) that a failure has occurred on the path between the monitoring apparatus 1 and the monitored apparatus 2 A reproduction test to be analyzed is performed.

  The monitoring device 1 displays screen information such as network traffic information of each monitored device 2, CPU and memory usage, and hardware operating status to the maintenance terminal 14 by, for example, GUI (Graphical User Interface) control. give. Various types of display formats can be applied to the screen displayed on the maintenance terminal 14, such as a map display of the network configuration of the monitored device 2, and a graph display according to the type of each device state. Further, the warning alarm sound and the display color may be changed according to the device status information of each monitored device 2.

  Here, the capture target device is a device that is involved in packet communication between the monitoring device and the monitored device, and is a device that is a target for acquiring packet information for identifying a suspected location. The capture target device includes the monitoring device 1 and the monitored device 2, and also includes a network device (for example, a router or a switch device) existing on the communication path.

  The monitoring device 1 has, for example, a CPU, a ROM, a RAM, an EEPROM, an input / output interface unit, a communication unit, and the like. The CPU executes a processing program stored in the ROM and performs software processing to execute the processing of the monitoring device 1. The function is realized. As illustrated in FIG. 1, the monitoring device 1 functionally includes an SNMP manager 13 that manages an operation state using the SNMP of the monitored device 2, a monitoring application 12, and a capture control unit 11.

  The SNMP manager 13 manages the state of the monitored device 2 on the network by SNMP. The SNMP manager 13 can apply an existing SNMP manager.

  For example, the SNMP manager 13 makes an acquisition request for management information (MIB information) indicating the state of the monitored device 2 to the SNMP agent 21 of the monitored device 2, and based on the MIB information from the monitored device 2. The state of the monitored device 2 is managed. More specifically, the SNMP manager 13 receives TRAP indicating that the state (state value) of the monitored device 2 has reached the set state (set value) from the SNMP agent 21, or MIB information of the monitored device 2. 22 (all or part of MIB information stored in the MIB of the monitored device 2) is acquired. The SNMP manager 13, based on the MIB information 22 acquired from the monitored unit 2, the operating status of the monitored device 2 connected to the network system, the operating status of the service, the status of system resources (system performance), the network It manages the traffic volume, the presence or absence of specific messages recorded in the system log, the rapid increase (or decrease) of the system log, and the like.

  The monitoring application 12 is an application that monitors the state of the monitored device 2. The monitoring application 12 instructs the SNMP manager 13 to acquire the MIB information 22 and instructs the capture control unit 11 to capture the packet information. Here, when the SNMP manager 13 transmits an acquisition request for the MIB information 22 to the monitored device 2, but the SNMP manager 13 does not receive a response from the monitored device 2, the monitoring application 12 regards it as failure detection. Then, a capture execution request is made to the capture control unit 11.

  In addition, the monitoring application 12 displays, for example, the status information of the monitored device 2 managed by the SNMP manager 13 on the display of the maintenance terminal 14, displays the route information to the monitored device 2, The collection result of the packet information captured by the control unit 11 is displayed, or the suspicious part is indicated.

  When the capture control unit 11 receives a notification of a packet information capture request from the monitoring application 12, the capture control unit 11 transmits a packet passing through the communication port of the device / device on the path between the monitoring device 1 and the monitored device 2. This is for starting or stopping execution of a capture process for acquiring packet information, accumulating capture information, analyzing capture information, confirming reproduction of a problem event, and the like.

  FIG. 3 is a functional configuration diagram illustrating a functional configuration of the capture control unit 11 according to the embodiment.

  3, the capture control unit 11 according to the embodiment includes a capture control function unit 111, a capture execution function unit 112, a capture accumulation function unit 113, a capture information database 114, a capture analysis function unit 115, and a database 116.

  The capture control function unit 111 performs execution control of the capture execution function, capture accumulation function, and capture analysis function performed by the capture control unit 11. The capture control function unit 111 is connected to the maintenance terminal 14 that is a user interface, and has a function of responding to various requests by maintenance personnel operations.

  The capture execution function unit 112 starts and stops execution of packet capture for the capture target device under the control of the capture control function unit 111.

  The capture execution function unit 112 performs packet capture using a command that can confirm transmission / reception of a monitoring control packet to / from the monitored device 2. For example, when the OS of the monitored device 2 is a general-purpose OS (for example, Linux (registered trademark)), the capture execution function unit 112 can use a tcpdump command provided by the OS standard. Of course, the command is not limited to the tcpdump command.

  The capture execution function unit 112 collects a capture file from the capture target device by packet capture. At this time, the capture execution function unit 112 temporarily saves the collected capture file in a storage area for saving. This is because a capture storage function unit 113 (to be described later) forms capture information in a predetermined table format from the contents of the collected capture file and stores it in the capture information database 114, so that the collected capture file is temporarily held. Because. For example, the capture file can be temporarily stored by transferring the capture file to the file storage directory of the monitoring device 1.

  The capture execution function unit 112 starts executing packet capture triggered by receiving a notification of failure detection from the monitoring application 12.

  Here, for example, the failure detection may be performed when the SNMP manager 13 makes a request for acquiring the MIB information 22 to the monitored device 2 but the SNMP manager 13 does not receive a response from the monitored device 2. it can. More specifically, the SNMP manager 13 holds the IP address of the monitored device 2 (SNMP agent 21) that is the acquisition request destination, and the SNMP manager 13 manages whether or not a response is received from the SNMP manager 21. Can be realized. The monitoring application 12 can start execution of packet capture by notifying the capture control function unit 111 of a failure notification including the IP address of the monitored device 2 that has not received a response. At this time, for example, failure detection may be performed when no response is received even after a predetermined time has elapsed since the acquisition request to the monitored device 2 was made. Alternatively, a predetermined number of retries may be set, and failure detection may be performed when the number of acquisition requests exceeds the number of retries.

  The capture accumulation function unit 113 reads packet information stored in the capture file collected from each capture target device by the capture execution function unit 112 under the control of the capture control function unit 111, and capture information table of the database 116 54 is accumulated. The capture accumulation function unit 113 starts capture information accumulation processing in accordance with an instruction from the capture control function unit 111 after packet capture by the capture execution function unit 112 is stopped.

  The capture analysis function unit 115 analyzes packet information stored in the capture information table 54 of the database 116 under the control of the capture control function unit 111, and isolates a packet loss occurrence location.

  The database 116 stores various information necessary for executing packet capture. As illustrated in FIG. 3, the database 116 includes a path information table 51, a device information table 52, a filter condition table 53, a capture information table 54, and a capture execution table 55.

  The route information table 51 is list information of devices through which packets pass on the route from the monitoring device 1 to the monitored device 2. The path information table 51 is used when the capture execution function unit 112 determines a capture target apparatus that captures packet information. That is, when performing the traffic analysis with the monitored apparatus 2 related to the failure notification, the capture execution function unit 112 refers to the path information table 51 to select the capture target apparatus on the path to the monitored apparatus 2. decide.

  FIG. 4 is a configuration diagram illustrating a configuration example of the route information table 51 according to the embodiment. As illustrated in FIG. 4, the route information table 51 passes through an item “monitored device” indicating identification information (for example, an IP address) of the monitored device 2 and a route from the monitoring device 1 to the monitored device 2. Items “routed device 1” to “routed device N (N is an integer)” in which identification information of all capture devices are registered in order of the packet transmission direction are associated with each other. Data to be registered in the item “routed device” may be defined in a configuration file in advance and read when the monitoring device 1 is started, or may be registered from the user interface of the maintenance terminal 14. good. For example, in the example of the first row in FIG. 4, the transit device between the monitoring device 1 and “monitored device (IP address): 192.162.2.100” is “route device 1: 192.168.0.1”,. , “Routed device N: 192.162.2.10”.

  The device information table 52 is information for recognizing whether a capture target device that captures packet information is the monitored device 2 or a network device (for example, a router or a switch device).

  FIG. 5 is a configuration diagram illustrating a configuration example of the device information table 52 according to the embodiment. As illustrated in FIG. 5, the device information table 52 includes an item “device” indicating device identification information (for example, an IP address), an item “device type” indicating a device type, an item “capture device”, and an item. The “monitor port” is associated with the item “mirror port”.

  Here, the item “device type” is information indicating whether the device (capture target device) is the monitored device 2 or a network device. For example, “device type: 1” indicates a monitored device 2 and “device type: 2” indicates a network device. The number of classifications of “device type” is not limited to the two types of monitored device 2 and network device.

  When the capture target device is a network device, the network device does not have a packet capture function. Therefore, in order to perform packet capture from a network device, it is necessary to capture on the capture device 32 using the port mirroring function of the network device. Therefore, as shown in FIG. 5, as additional information, an item “capture device” indicating the IP address of the capture device 32, an item “monitor port number” indicating a monitor port number of a specific communication port of the network device, a network It has an item “mirror port” indicating a mirror port number corresponding to a specific communication port of the device. Data to be registered in the item “capture device”, the item “monitor port”, and the item “mirror port” may be defined in the configuration file in advance and read when the monitoring device 1 is started. You may register from a user interface.

  The filter condition table 53 is information indicating packet capture filtering conditions for each capture target device. The filter condition table 53 is used by the capture execution function unit 112 to specify parameters when executing the tcpdump command when performing packet capture.

  FIG. 6 is a configuration diagram illustrating a configuration example of the filter condition table 53 according to the embodiment. As shown in FIG. 6, the filter condition table 53 associates an item “device”, an item “LAN interface”, an item “protocol”, an item “port”, and an item “capture file name”. The item “device” is identification information (for example, IP address) of the capture target device. The item “LAN interface” is the LAN interface name of the capture target device. The item “protocol” is a protocol used when capturing a packet from the capture target apparatus, and the item “port” is a port number used for packet capture from the capture target apparatus. The item “capture file name” is the file name of the capture file acquired from the capture target device.

  In the filter condition table 53, when the capture target device is a network device, it is necessary to set a filtering condition for capturing by the capture device. Data to be registered in each item of the filter condition table 53 may be defined in the configuration file in advance and read when the apparatus monitoring system is activated, or may be registered from the user interface of the maintenance terminal.

  The capture information table 54 registers packet information included in the capture file collected from each capture target device by the capture accumulation function unit 115. The packet information registered in the capture information table 54 is used by the capture analysis function unit 115 to isolate a packet loss occurrence location.

  FIG. 7 is a configuration diagram illustrating a configuration example of the capture information table 54 according to the embodiment. As illustrated in FIG. 7, the capture information table 54 associates an item “device”, an item “time stamp”, an item “PDUType (command type)”, and an item “RequestID (command identifier)”.

  In FIG. 7, the item “time stamp” indicates the transmission time of the packet information transmitted by the capture target device. For example, (HH (hour): MM (minute): SS (second). Millisecond)) Is registered.

  In the item “PDUType (command type)”, PDUType (command type) defined in SNMP is registered. That is, information indicating which PDUType the packet information collected from the capture target device is registered is registered. For example, “a0” registered in “PDUType (command type)” is “GetRequest” indicating a request for MIB information to the SNMP agent 21, and “a1” is all from the SNMP agent while increasing the value of the managed object instance. “GetNextRequest” and “a2” requesting the MIB information of “1” indicate “GetResponse” which is a response to the GetRequest command and the GetNextRequest command.

  In the item “RequestID (command identifier)”, a RequestID (command identifier) of an SNMP packet defined by SNMP is registered. That is, RequestID of packet information (SNMP packet) collected from the capture target device is registered.

  The capture execution table 55 is information indicating a packet capture execution status and an analysis result (packet loss occurrence location). The capture execution table 55 is used to manage the execution status and analysis result of packet capture.

  FIG. 8 is a configuration diagram illustrating a configuration example of the capture execution table 55 according to the embodiment. As shown in FIG. 8, the capture execution table 55 includes an item “execution flag”, an item “monitored device” indicating identification information (for example, an IP address) of the monitored device 2, an item “problem reproduction times”, and an item “ The maximum execution time, the item “capture start time”, the item “capture end time”, and the item “analysis result” are associated with each other.

  In FIG. 8, the item “execution flag” is information indicating whether or not a packet capture related to the monitored apparatus 2 is being executed. For example, “in-execution flag: 1” indicates that packet capture is being executed, and “in-execution flag: 0” indicates that execution is not in progress (completion has been completed).

  The item “number of times of problem reproduction” is a condition for stopping packet capture related to the monitored device 2, and the number of failure occurrence notifications related to the monitored device 2 is registered. The item “maximum execution time” is a condition for stopping the capture according to the execution time from the capture start time. The item “capture start time” and the item “capture end time” are the start time or the end time of packet capture. In the item “analysis result”, a packet capture analysis result (packet loss occurrence location) related to the monitored apparatus 2 is registered. For example, in the item “analysis result”, the IP address of the device in which the packet loss has occurred is registered.

  In FIG. 8, the item “execution flag”, item “monitoring target device”, item “capture start time”, and item “capture end time” are registered or updated by the capture control function unit 111. The item “problem reproduction times” and the item “maximum execution time” may be defined in the configuration file in advance, and may be read and registered when the capture control function unit 111 starts packet capture. For the item “analysis result”, the capture analysis function unit 115 updates the analysis result.

  The maintenance terminal 14 is connected to the monitoring device 1 and displays the analysis result of the status of the monitored device 2 monitored by the monitoring device 1 by SNMP and the failure occurrence location analyzed by the monitoring device 1 by packet capture, Various settings and the like are performed by a maintenance person operation.

(A-2) Operation of Embodiment Next, the operation of the suspected place analysis process by capturing the SNMP packet in the monitoring system 10 of this embodiment will be described in detail with reference to the drawings.

  FIG. 9 is an explanatory diagram for explaining a suspected place analysis process by capturing an SNMP packet in the monitoring system 10 according to the embodiment.

  FIG. 9 shows an overall processing flow in the monitoring system 10 according to the embodiment. For example, symbols such as (a) in FIG. 9 are numbers corresponding to the processing procedures described below. is there.

  Hereinafter, the processing procedure of the processing operation according to the embodiment will be described in order using the operation flowchart as appropriate.

(A) Notification of Failure First, in the monitoring device 1, the SNMP manager 13 makes a management information acquisition request by SNMP to the monitored device 2. For example, the SNMP manager 13 transmits an SNMP request that is an acquisition request for the MIB 22 to the SNMP agent 21 of the monitored device 2. The monitoring application 12 monitors the presence or absence of an SNMP response to the SNMP request of the SNMP manager 13 and confirms whether or not an SNMP response has been received from the SNMP agent 21 of the monitored device 2.

  When the SNMP response from the SNMP agent 21 is not received, the monitoring application 12 determines that a failure has occurred in monitoring related to the monitored device 2 and notifies the capture control function unit 111 of the occurrence of the failure.

  When there is no response to the SNMP request, the monitoring application 12 acquires the destination IP address of the SNMP request from the SNMP manager 13. As a result, the monitored device 2 relating to the occurrence of the failure can be determined.

  In addition, the monitoring application 12 provides information including the IP address of the monitored apparatus 2 related to the determined failure occurrence to the capture control function unit 111 as a failure occurrence notification. As a result, the capture control function unit 111 can recognize the monitored device 2 related to packet capture.

  Here, the failure detection is performed when there is no response of the MIB 22 acquisition request (SNMP request) to the monitored device 2, but the failure detection is not limited to this. For example, when the SNMP manager 13 recognizes that the SNMP agent 21 should transmit TRAP, it may be determined that a failure has occurred when there is no TRAP reception.

(B) Packet Capture Start / End Upon receiving a failure notification from the monitoring application 12, the capture control function unit 111 makes a packet capture start request or end request to the capture execution function unit 112.

  The capture control function unit 111 refers to the item “execution flag” in the capture execution table 55 in FIG. 8 and checks whether or not packet capture for the monitored device 2 is being executed, thereby starting packet capture. Determine whether to make the request.

  The packet capture end request is sent when the number of failure occurrence notifications related to the monitored device 2 reaches the item “problem reproduction number” in the capture execution table 55 in FIG. This is performed when the item “maximum execution time” of the capture execution table 55 in FIG. 8 is reached. Thereby, even when the reproduction probability of the problem event related to the failure is low, the process can be stopped according to the number of problem reproductions or the maximum execution time.

  The packet capture end request may be issued when either of the items “problem reproduction count” or the item “maximum execution time” is satisfied.

For example, if the item “number of times of problem reproduction” is not set, a packet capture end request can be made only under the condition of the item “maximum execution time”.

  FIG. 10 is a flowchart illustrating processing of a packet capture start request or end request by the capture control function unit 111 according to the embodiment.

  In FIG. 10, first, the capture control function unit 111 refers to the item “execution flag” in the capture execution table 55 in FIG. 8 in order to determine whether or not to make a packet capture start request. Then, using the IP address of the monitored device 2 included in the failure occurrence notification, it is confirmed whether packet capture is being executed for the monitored device 2 (S101). The request for starting packet capture is that the packet capture for the monitored object 2 has not been executed.

When the item “execution flag” in the capture execution table 55 in FIG. 8 is being executed,
Since the packet capture for the monitored device 2 has already been executed, the capture control function unit 111 increments the value of the problem reproduction counter held in the memory (S102). Then, when the value of the problem reproduction counter reaches the set value of the item “problem reproduction number” in the capture execution table 55 of FIG. 8 (S103), the capture control function unit 111 instructs the capture execution function unit 112 to A packet capture end request is sent to the monitored apparatus 2 (S104), and the end time is recorded in the item “capture end time” of the capture execution table 55 of FIG. 8 (S105). If the value of the problem reproduction counter has not reached the set value of the item “problem reproduction number” in the capture execution table 55 of FIG. 8 (S103), the packet capture end request is not made.

  On the other hand, if the item “execution flag” in the capture execution table 55 in FIG. 8 is not executed, the packet capture for the monitored device 2 has not been executed yet, and thus the capture control function unit 111 sends the capture execution function unit 112 to the capture execution function unit 112. On the other hand, a packet capture start request is sent to the monitored apparatus 2 (S106). At this time, the capture control function unit 111 sets a flag indicating execution in the item “execution flag” of the capture execution table 55 in FIG. 8 and registers the IP address of the monitored device 2 in the item “monitored device”. Then, a setting value as a condition for ending packet capture is set in the item “problem reproduction number” and the item “maximum execution time”, and the start time is registered in the item “capture start time” (S107).

  FIG. 11 is a flowchart illustrating a packet capture end request process based on a capture execution time by the capture control function unit 111 according to the embodiment.

  In FIG. 11, the capture control function unit 111 monitors the packet capture execution time for the monitored object 2. Here, the capture control function unit 111 sets the time obtained by subtracting the time set in the item “capture start time” of the capture execution table 55 in FIG. 8 from the current time as the execution time (S151).

  When the packet capture execution time reaches the set value of the item “maximum execution time” in the capture execution table 55 of FIG. 8 (S152), the capture control function unit 111 performs packet capture for the monitored device 2 in question. An end request is sent to the capture execution function unit 112 (S153), and the end time is recorded in “capture end time” of the capture execution table 55 of FIG. 8 (S154). If the packet capture execution time has not reached the “maximum execution time” (S152), the process returns to S151.

(C) Execution of Packet Capture (tcpdump) FIG. 12 is a flowchart showing packet capture execution processing by the capture execution function unit 112 according to the embodiment.

  In FIG. 12, when the capture execution function unit 112 receives a packet capture start request from the capture control function unit 111 (S201), the capture execution function unit 112 refers to the path information table 51 of FIG. The IP address of the monitoring device 2 and the IP address of the transit device on the path from the monitoring device 1 to the monitored device 2 are acquired (S202). That is, the IP address of the capture target device is acquired.

  Next, the capture execution function unit 112 refers to the device information table 52 in FIG. 5 and confirms whether or not the capture target device is a network device based on the “device type” of each capture target device ( S203). When the capture target device is a network device, the capture execution function unit 112 uses the device information table 52 in FIG. 5 as the IP address of the capture device 32 connected to the network device and the port mirroring setting conditions of the network device. The port number of the monitor port and the port number of the mirror port are acquired (S204).

  The capture execution function unit 112 refers to the filter condition table 53 of FIG. 6 and acquires the filter condition of each capture target device (S205). Then, the capture execution function unit 112 executes the tcpdump command using the filter condition acquired in S205 (S206).

  For example, when the capture execution function unit 112 captures a packet from a device whose IP address is “192.168.1.10”, the capture execution function unit 112 refers to the filter condition table 53 of FIG. "LAN interface: bond0", "protocol: udp", "port: 161", and "capture file name: equip_A_cap" are acquired as filter conditions, and a tcpdump command using these as filter conditions is executed.

  Note that the options for executing the tcpdump command are not limited to the conditions registered in the filter condition table 53 of FIG. 6, and other conditions may be set as options.

  When the capture execution function unit 112 performs packet capture on a network device, the port mirroring function of the network device is used to match the setting for copying and transferring packets from the monitor port of the network device to the mirror port. Do it.

  The capture execution function unit 112 executes the tcpdump command on the capture device 32 connected to the monitoring device 1 and the monitored device 2 and a network device (for example, a router or a switch device) existing on the communication path therebetween. Then, all the SNMP packet information illustrated in FIG. 13 is stored in the capture file.

  FIG. 13 shows a part of information constituting the SNMP packet. As shown in FIG. 13, the SNMP packet includes “time stamp”, “source IP address”, “destination IP address”, “SNMP Version (protocol version)”, “Community (community name)”, “PDU Type”. (Command type) ”,“ Request ID (command identifier) ”,“ Object ID (OID) ”, and“ Value (value) ”are included.

(D) Stop of packet capture (tcpdump) Upon receiving a packet capture end request from the capture control function unit 111, the capture execution function unit 112 stops the packet capture (tcpdump) executed in (c) and performs port mirroring. Cancel the setting.

  The capture file output by the tcpdump command is deleted after file transfer to the file storage directory of the monitoring device 1. In this way, by transferring the file to the file storage directory of the monitoring apparatus 1 and then deleting the collected capture file, it is not necessary for the maintenance person to monitor the disk capacity as in the past.

(E) Accumulation of Capture Information The capture control function unit 111 requests the capture accumulation function unit 113 to accumulate capture information when the stop of packet capture in (d) is completed.

  The capture accumulation function unit 113 reads the capture file of each capture target device collected by the monitoring device 1, extracts predetermined packet information from the information included in the capture file, and forms the capture information table 54 And stored in the database 116.

  In other words, the capture storage function unit 113 stores the packet information of the SNMP packet in the database 116 in the format of the capture information table 54 of FIG. Here, the capture accumulation function unit 113 obtains at least the “time stamp”, “PDU Type (command type)”, and “Request ID (command identifier)” of the SNMP packet from the capture file of each capture target device. Save as. Thereby, it is possible to recognize when the SNMP packet transmitted by the capture target device is transmitted, which ID and which type of request or response is transmitted.

(F) Analysis of capture information The capture control function unit 111 requests the capture analysis function unit 115 to analyze the capture information when the storage of the capture information of (e) is completed.

  The capture analysis function unit 115 refers to the capture information table of FIG. 7 to detect packet information having the same Request ID, and performs pattern matching according to the concept (described later) of the method of isolating the packet loss occurrence location, thereby performing packet matching. Identify the location of the loss.

  Here, the analysis processing of the capture information according to the embodiment will be described with reference to FIGS.

  FIG. 14 is an explanatory diagram illustrating a state of packet capture by the monitoring device 1 according to the embodiment. In FIG. 14, when a failure such as packet loss occurs in the monitoring device 1 monitoring the monitored device 2-1 using SNMP, the monitoring device 1, the monitored device 2-1, and the communication path between them A case where packet capture is performed for the network devices (router 3-1, router 3-2) existing above is illustrated.

  There are six packet capture locations: port A of the monitoring device 1, ports B1 and B2 of the router 3-1, ports C1 and C2 of the router 3-2, and port D of the monitored device 2.

  FIG. 15 is an explanatory diagram for explaining a method for isolating a suspected portion of an SNMP packet in the example of FIG. In FIG. 15, for example, “A” or the like corresponds to the packet capture location shown in FIG.

  The item “Request ID (command identifier)” in the capture information table 54 in FIG. 7 associates an SNMP request (for example, Get Request, Get Next Request, etc.) with a corresponding SNMP response (for example, Get Response, etc.). It is an identifier for

  The capture analysis function unit 115 refers to the item “PDU Type (command type)” and the item “Request ID (command identifier)” in the capture information table 54 of FIG. Check whether an SNMP request and an SNMP response are received. That is, when there is an SNMP request and an SNMP response with the same Request ID, it is determined that there is SNMP packet reception at the packet capture location. On the other hand, when there is no SNMP request and SNMP response with the same Request ID, it is determined that no SNMP packet is received at the packet capture location.

  As shown in FIG. 15, the capture analysis function unit 115 identifies the suspected part (packet loss occurrence part) by checking whether or not each packet capture part has received a packet in the order of the packet transmission direction.

  For example, in the case of the capture result pattern “1” in FIG. 15, since the packet is transmitted in all the packet capture locations in FIG. 14, the inside of the monitoring device 1 is considered as the suspect location. Further, for example, in the case of the capture result pattern “2”, the packet transmitted from the port B1 of the router 3-1 is not received by the monitoring device 1, so that the router 3-1 or the monitoring device 1 is considered a suspected place. It is done.

  If the suspected location can be identified, the capture analysis function unit 115 registers the IP address of the suspected device in which the packet loss has occurred in the item “analysis result” of the capture execution table in FIG.

  If the suspected place cannot be identified, the capture control function unit 111 returns to the processing procedure of (b) and performs packet capture again under the same filter conditions.

(G) Confirmation of Capture Execution Result The maintenance person can acquire information of the capture execution table 55 in FIG. 8 by using the user interface of the maintenance terminal 14. The acquisition of the capture execution table 55 information may be a method of displaying on the GUI screen or a method of outputting to a file. As a result, the maintenance person can immediately confirm the execution status of packet capture and the analysis result (packet loss occurrence location).

(A-3) Effects of the Embodiment As described above, according to this embodiment, the packet is automatically captured for the monitored device and the relay device when the failure occurs, so that the maintenance person Log primary segmentation and packet capture preparation are not required.

  Further, according to this embodiment, it is possible to automatically stop the packet capture by setting the packet capture stop condition (problem reproduction number, maximum execution time), and the maintenance person can There is no need for disk capacity monitoring or problem reproduction monitoring.

  Further, according to this embodiment, the packet loss occurrence location is automatically analyzed from the collected large amount of packet information, so that the maintenance person does not need to analyze the packet information.

(B) Other Embodiments Although various modified embodiments of the present invention have been described in the above-described embodiments, the present invention can also be applied to the following modified embodiments.

  The present invention can be widely applied to a device monitoring system using the SNMP architecture.

  In the above-described embodiment, the case where the suspicious analysis is performed based on the capture result of the SNMP packet has been exemplified. It is also possible to analyze a suspected place (packet loss occurrence place) other than the packet.

  DESCRIPTION OF SYMBOLS 10 ... Monitoring system, 1 ... Monitoring apparatus, 11 ... Capture control part, 12 ... Monitoring application, 13 ... SNMP manager, 111 ... Capture control function part, 112 ... Capture execution function part, 113 ... Capture accumulation function part, 115 ... Capture Analysis function unit 116 ... database 51 ... path information table 52 ... device information table 53 ... filter condition table 54 ... capture information table 55 ... capture execution table 2-1 and 2-2 ... monitored devices, 21 ... SNMP agent, 22 ... MIB, 3-1, and 3-2 ... router, 32 ... capture device.

Claims (8)

Status management means for acquiring a status management packet from each of one or more monitored devices and managing the status of each monitored device;
When a failure is detected by the state management unit, collection of packet information of the state management packet from a plurality of transit devices from the state management unit to the monitored device related to the failure is started, and based on the collected packet information And a capture control means for stopping the collection of packet information based on the number of times of execution of the failure event reproduction test or the execution time of the reproduction test. The capture control means is
At least a storage unit that stores capture execution information including an in-execution flag indicating whether or not a reproduction test is being executed for each monitored device;
A capture control unit that refers to the capture execution information when a failure is detected, and starts a reproduction test for the monitored device when a reproduction test for the monitored device related to the failure is not performed. The monitoring system according to claim 1, wherein: The above capture execution information includes the number of times of reproduction test reproduction,
When the reproduction control for the monitored device related to the failure is being executed, the capture control unit updates the number of times the reproduction test is executed for the monitored device, and the number of times the reproduction test is executed sets the number of times the capture execution information is reproduced. The monitoring system according to claim 2, wherein when it exceeds, the execution of the reproduction test for the monitored device is stopped. The above capture execution information includes the maximum execution time of the reproduction test,
When the capture control unit is executing a reproduction test for the monitored device related to the failure, and when the execution time of the reproduction test for the monitored device reaches the maximum execution time of the capture execution information, The monitoring system according to claim 2 or 3, wherein execution of a reproduction test on the apparatus is stopped. The storage unit is
Path information including address information of each transit device from the state management means to each monitored device;
And condition information including conditions related to packet capture of each of the above routing devices,
The capture control means
Upon receiving a reproduction test start request from the capture control unit, a reproduction test is performed on the monitored device related to the failure with reference to the path information and the condition information, and a stop request is received from the capture control unit The monitoring system according to claim 2, further comprising a capture execution unit that stops the reproduction test. The capture control means
6. A capture storage unit for storing capture information in a predetermined format using packet information of a state management packet collected from each of the relay devices by the capture execution unit. Monitoring system. The capture control means
By referring to the capture information accumulated by the capture accumulation unit, the request for the state management packet and the response to the request are associated with each other to confirm the presence / absence of packet reception in each transit device. The monitoring system according to claim 2, further comprising a capture analysis unit that performs analysis. Computer
Status management means for acquiring a status management packet from each of one or more monitored devices and managing the status of each monitored device;
When a failure is detected by the state management unit, collection of packet information of the state management packet from a plurality of transit devices from the state management unit to the monitored device related to the failure is started, and based on the collected packet information A monitoring program for analyzing a suspected part and functioning as a capture control means for stopping the collection of packet information based on the number of times of execution of a failure event reproduction test or the execution time of a reproduction test.

Images