JP6502890B2 - Fault information management device, fault information management method and fault information management program - Google Patents

Description

  The present invention relates to a fault information management device, a fault information management method, and a fault information management program.

  Conventionally, an EMS (Element Management System) has been adopted as a system for managing each communication device (Element) that constitutes a network. In this EMS, each communication device to be managed issues TRAP (fault information) to the management device which is the manager when an event occurs in the own device. The management apparatus detects that there is a failure event in the communication apparatus that has issued this TRAP by receiving this TRAP. The event is a device failure such as a central processing unit (CPU) failure, a fan failure, or a device recovery. Here, in the management apparatus, the accuracy of detection of the cause of failure is improved by recording without omission of TRAP recording in time series (for example, see Patent Document 1).

JP 2012-080181 A

  In the related art, when detecting a discontinuity (dropping) of TRAP, the management device performs the TRAP reacquisition to the communication device to compensate for the missing TRAP.

  However, in the prior art, when the TRAP is missing due to a failure of the communication device itself or a failure on the network, the management device is the first time when the next TRAP from the communication device reaches the management device. Detect missing TRAP. That is, in the prior art, the management apparatus can not detect that there is a drop in TRAP from this communication apparatus until the next TRAP from the communication apparatus from which the TRAP is missing reaches the management apparatus. , Could not do its complement.

  The present invention has been made in view of the above, and it is possible to detect a missing TRAP before the next TRAP from a communication apparatus reaches it, a fault information management device, a fault information management method, and fault information It aims to provide a management program.

  In order to solve the problems described above and to achieve the object, the fault information management device according to the present invention is based on the approximation of the reception time of fault information respectively received from communication devices connected via a network. The similar device determination unit that determines a plurality of communication devices having a similar relationship among the communication device group and whether the failure information from the communication device to be detected is missing is similar to the communication device to be detected. If a failure information loss detection unit that detects failure information from a certain communication device based on the reception time, and the failure information loss detection unit detects that failure information from the communication device to be detected is missing, the detection target And a complementing unit that complements the missing failure information using the issued information list, which is a log of the time at which the communication device has issued the failure information.

  According to the present invention, it is possible to detect missing TRAPs before the next TRAP from the communication device arrives.

FIG. 1 is a schematic view showing a schematic configuration of a management system according to an embodiment of the present invention. FIG. 2 is a schematic view illustrating the configuration of the management device shown in FIG. FIG. 3 is a schematic view illustrating the configuration of the fault information management device shown in FIG. FIG. 4 is a view showing an example of the data configuration of the fault information reception data shown in FIG. FIG. 5 is a view showing an example of the data configuration of the similar device identification data shown in FIG. FIG. 6 is a view showing an example of the data configuration of the device-by-device failure information data shown in FIG. FIG. 7 is a diagram schematically illustrating processing for TRAP received by the fault information management device shown in FIG. FIG. 8 is a diagram for explaining similar device determination processing by the similar device determination unit shown in FIG. 3. FIG. 9 is a diagram for explaining loss detection processing of failure information of the failure information loss detection unit shown in FIG. 3. FIG. 10 is a diagram for explaining loss detection processing of failure information of the failure information detection unit shown in FIG. FIG. 11 is a diagram for explaining the complementing process of the complementing unit shown in FIG. FIG. 12 is a diagram for explaining the complementing process of the complementing unit shown in FIG. FIG. 13 is a flowchart showing the processing procedure of similar device determination processing according to the present embodiment. FIG. 14 is a flowchart showing the processing procedure of failure information loss detection processing and complement processing according to the present embodiment. FIG. 15 is a schematic view showing another configuration of the management device shown in FIG. FIG. 16 is a diagram illustrating an example of a computer in which a management device and a failure information management device are realized by execution of a program.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. The present invention is not limited by the embodiment. Further, in the description of the drawings, the same portions are denoted by the same reference numerals.

Embodiment
First, regarding the management system according to the embodiment, a schematic configuration of the management system and the flow and specific example of communication processing in the communication system will be described.

[Management system]
FIG. 1 is a schematic view showing a schematic configuration of a management system according to the present embodiment. As shown in FIG. 1, the management system 1 according to the present embodiment includes a management device 2 that manages communication device groups (devices 10A to 10Z) via the network 4, and between the management device 2 and the network 4. And the fault information management device 3 provided.

  The devices 10A to 10Z issue TRAP (failure information) to the management device 2 when an event (device failure such as CPU failure or FAN failure, device recovery, etc.) occurs in the own device. Each of the devices 10A to 10Z has a clock, and issues a TRAP by associating a TRAP number with an emission time from the own device. Each of the devices 10A to 10Z has a log (a list of issued information) in which the TRAP number of the TRAP issued and the issue time are associated and recorded in time series. The devices 10A to 10Z are respectively the same or approximate devices, and perform approximate operations.

  The management device 2 detects that there is a failure event in the devices 10A to 10Z that have issued the TRAP by confirming the TRAPs issued by the devices 10A to 10Z. The management device 2 performs management using TRAP data that has been subjected to TRAP loss detection, device failure detection, and TRAP complementation by the failure information management device 3 (described later). The management device 2 has a clock. The management device 2 does not constantly monitor the devices 10A to 10Z using ping or the like.

  The fault information management device 3 receives the TRAP from the devices 10A to 10Z, and for each of the devices 10A to 10Z, the TRAP number, the reception time of the TRAP number in the fault information management device 3, and the issuance time from the devices 10A to 10Z And TRAP data corresponding to the above are output to the management apparatus 2. The fault information management device 3 has a clock.

  Then, the fault information management device 3 determines a plurality of devices 10A to 10Z having a similar relationship among the devices 10A to 10Z, and detects the presence or absence of a missing TRAP from the devices 10A to 10Z to be detected. The detection time of the TRAP from the devices 10A to 10Z which are similar to 10A to 10Z is detected. The failure information management device 3 detects the missing TRAP before the next TRAP from the devices 10A to 10Z reaches. When the fault information management device 3 detects that the TRAP is missing, the fault information management device 3 complements the missing TRAP using the TRAP log of the devices 10A to 10Z where the TRAP is missing.

[Management device configuration]
Next, the configuration of the management device 2 shown in FIG. 1 will be described. FIG. 2 is a schematic view illustrating the configuration of the management device 2. As illustrated in FIG. 2, the management device 2 includes a storage unit 21, a control unit 22, an input unit 23, an output unit 24, and a communication control unit 25.

  The storage unit 21 is realized by a semiconductor memory device such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk, and has a processing program for operating the management device 2 or a processing program. Data used during execution is stored. The storage unit 21 stores TRAP data after the failure information management device 3 has performed TRAP loss detection and TRAP complementation.

  The control unit 22 has a program defining various processing procedures and the like, and an internal memory for storing required data, and executes various processing by these. For example, the control unit 22 is an electronic circuit such as a CPU or a micro processing unit (MPU). The control unit 22 has a management unit 221.

  The management unit 221 manages the devices 10A to 10Z using TRAP data from the fault information management device 3 (described later). For example, among the TRAP data from the fault information management device 3, the management unit 221 performs the device 10A to 10Z with respect to the devices 10A to 10Z for which TRAP loss detection and device failure detection have been performed by the fault information management device 3. To determine that an event such as a failure has occurred, and execute processing for handling the device failure. Further, the management unit 221 determines that, among the TRAP data from the fault information management device 3, for the devices 10A to 10Z for which the TRAP has been complemented, there is a fault in the network 4 at the time of sending out the complemented TRAP. And execute processing related to network failure handling.

  The input unit 23 is realized by using an input device such as a keyboard and a mouse, and inputs various instruction information such as processing start to the control unit 22 in response to an input operation by the operator. The output unit 24 is realized by a display device such as a liquid crystal display, a printing device such as a printer, an information communication device, and the like. The communication control unit 25 controls communication between the fault information management device 3 or an external device and the control unit 22 via a telecommunication line such as a LAN (Local Area Network) or the Internet.

[Fault information management device]
Next, the configuration of the fault information management device 3 shown in FIG. 1 will be described. FIG. 3 is a schematic view illustrating the configuration of the fault information management device 3. As shown in FIG. 3, the fault information management device 3 includes a storage unit 31, a control unit 32, an input unit 33, an output unit 34, and a communication control unit 35.

  The storage unit 31 is realized by a storage device such as a RAM, a semiconductor memory device such as a flash memory, or a hard disk or an optical disk, and a processing program for operating the fault information management device 3 or data used during execution of the processing program Etc. are stored. The storage unit 31 stores failure information reception data 311, similar device determination data 312, and device failure information data 313.

  FIG. 4 is a view showing an example of the data configuration of the failure information reception data 311. As shown in FIG. As shown in the table T1 in FIG. 4, the fault information reception data 311 is data recorded in time series, each associating the time when the fault information management device 3 receives the TRAP with the device that has issued the TRAP. . The fault information reception data 311 also stores TRAP numbers in association with each other. However, in FIG. 4, the TRAP number column is omitted in order to explain the processing of the similar device determination processing later.

  FIG. 5 is a view showing an example of the data configuration of the similar device determination data 312. As shown in FIG. As shown in the table T2 of FIG. 5, the similar device determination data 312 is data in which identification information of devices (similar devices) having a similar relationship is associated with the reception time of TRAP from this similar device. The storage unit 31 stores similar device identification data 312 illustrated in the table T2 for each of the devices 10A to 10Z. The similar device determination unit 322 (to be described later) determines the device identification information and TRAP in each table of the similar device determination data 312 according to a certain rule based on the information recorded in the failure information reception data 311 shown in the table T1. The similar device is determined by writing the reception time of.

  FIG. 6 is a view showing an example of the data configuration of the device-by-device failure information data 313. As shown in FIG. As shown in the table T3 of FIG. 6, the TRAP number, the reception time of the TRAP number in the fault information management device 3, and the emission time from the devices 10A to 10Z correspond to each other.

  As shown in the table T3, for example, in the first row, the TRAP number "1001", the time "10:00" when the fault information management device 3 received the TRAP which is the "1001" number, and the device 10A of this TRAP The dispatch time "(10:00)" in ~ 10Z is matched. The storage unit 31 stores device-by-device failure information data 313 exemplified in the table T3 for each of the devices 10A to 10Z. The device-by-device failure information data 313 of the devices 10A to 10Z are output to the management device 2 as TRAP data.

  The reception time in the device-specific fault information data 313 and the issue time in the devices 10A to 10Z may be the same as the clock of the fault information management device 3 and the clocks of the devices 10A to 10Z may be different. Not necessarily. In addition, the failure information data 313 classified by each device of the devices 10A to 10C will be described as reception tables Ta, Tb, Tc-1, and Tc-2 in the following description.

  The control unit 32 has a program defining various processing procedures and the like, and an internal memory for storing required data, and executes various processing by these. For example, the control unit 32 is an electronic circuit such as a CPU or an MPU. The control unit 32 includes a fault information management unit 321 that performs missing detection of the TRAP, complementation, and device failure detection. The fault information management unit 321 includes a similar device determination unit 322, a fault information loss detection unit 323, and a complement unit 324.

  The similar device determination unit 322 determines a plurality of devices having similar relationships among the devices 10A to 10Z based on the approximation of the reception time of each of the TRAPs received from the devices 10A to 10Z. Specifically, the similar device determination unit 322 determines that the plurality of devices 10A to 10Z that have issued the TRAP received within the predetermined time period are the plurality of devices having similar relationships. In other words, if the similar device determination unit 322 receives a TRAP from another device within a certain period of time when the TRAP is received from one of the devices 10A to 10Z, the similar device determination unit 322 Are determined to be a plurality of devices in a similar relationship.

  The failure information loss detection unit 323 detects whether TRAPs from the detection target devices 10A to 10Z are missing, based on the reception time of the TRAP from a device similar to the detection target device. That is, the failure information loss detection unit 323 compares the reception time of TRAP from the device to be detected with the reception time of TRAP from the device having a similar relation to the device to be detected. It is determined whether or not the TRAP from the device to be detected is missing based on the degree of coincidence of each reception time. Further, when the fault information loss detection unit 323 detects that the TRAP from the device to be detected is missing, the fault information loss detection unit 323 determines the reception time of the corresponding TRAP of the fault information management device 3 other than the missing portion of the TRAP. The difference with the TRAP issuance time of the device to be detected is obtained.

  When the failure information loss detection unit 323 detects that the TRAP from the device to be detected is missing, the complementing unit 324 complements the missing TRAP using the log of the TRAP that the device to be detected has. Do.

  Specifically, the complementing unit 324 refers to the TRAP log that the device detected as missing TRAP has. Then, when there is log data of the missing part of the TRAP, the complementing unit 324 acquires log data of the missing part of the TRAP from this log. Subsequently, the complementing unit 324 compares the log data of the acquired missing part of the TRAP, the reception time of the fault information management apparatus 3 corresponding to the part other than the missing part of the TRAP, and the time when the TRAP of the apparatus to be detected is issued. The difference part is used to complement the missing part of TRAP. Further, when the log data of the missing part of the TRAP can not be acquired from the device to be detected, the complementing unit detects that the device to be detected is broken.

  The input unit 33 is realized by using an input device such as a keyboard and a mouse, and inputs various instruction information such as processing start to the control unit 32 in response to the input operation by the operator. The output unit 34 is realized by a display device such as a liquid crystal display, a printing device such as a printer, an information communication device, and the like. The communication control unit 25 controls communication between the management device 2 or the devices 10A to 10Z and the control unit 32 via a telecommunication line such as a LAN or the Internet.

  FIG. 7 is a diagram for schematically explaining the process for the TRAP received by the fault information management device 3. The failure information management device 3 compares the failure information reception data 311 of similar devices with the failure information reception data 311 of similar devices, as shown in FIG. 7, to show that the TRAPs issued from the respective devices 10A to 10C are missing. Before the next TRAP from H. reaches, detection of missing TRAP, complement, or detection of device failure is performed (see arrow Y1 in FIG. 7).

  For example, in the fault information management device 3, the numbers after the TRAP number "1201" of the reception table Tb of the device 10B and the numbers between the TRAP numbers "1301" and "1303" of the reception table Tc-1 of the device 10C are The absence is detected by comparing it with the TRAP reception table Ta of the similar apparatus 10A. By this, the fault information management device 3 detects the missing TRAP before the next TRAP by the devices 10B and 10C arrives. Then, the failure information management device 3 obtains the difference between the TRAP reception time of the corresponding failure information management device 3 and the TRAP emission time of the detection target devices 10B and 10C other than the missing part, and then the device 10B. , 10C and perform TRAP reacquisition from the logs La to Lc to complement the missing part. In addition, when the TRAP reacquisition can not be performed, the fault information management device 3 detects that the device in which the TRAP reacquisition can not be performed is broken. Then, the fault information management device 3 outputs, to the management device 2, fault information data by device 313 (for example, reception tables Tb and Tc-2) for which missing detection of TRAP, complementation, and fault detection of device have been performed.

  As a result, the management device 2 can use the device-by-device failure information data 313 on which TRAP detection and complementation have already been performed, so that management of the devices 10A to 10Z can be appropriately performed. Therefore, first, among the processes of each component of the fault information management device 3, the discrimination process of the similar device performed by the similar device discrimination unit 322 will be specifically described.

[Process of Similar Device Discrimination Unit]
FIG. 8 is a diagram for explaining similar device determination processing by the similar device determination unit 322. In FIG. 8, the time axis is shown at the top. On this time axis, the TRAP reception time shown in the table T1 (see FIG. 4) in the fault information management device 3 and the devices 10A to 10C that have issued the TRAP are shown. Further, FIG. 8 shows a table which is similar device identification data 312 corresponding to the devices 10A to 10C below the time axis. In FIG. 8, three tables corresponding to the apparatuses 10A to 10C are shown in one row for each TRAP reception time so that the time change of the recorded contents of each table can be understood (see (1) to (5) in FIG. 8). ). Tables A-1 to A-5 correspond to the similar device determination data 312 of the device 10A, and tables B-1 to B-5 correspond to the similar device determination data 312 of the device 10B. -1 to C-5 correspond to the similar device determination data 312 of the device 10C.

  First, when the first TRAP by the device 10A is received at "09:59", the similar device determination unit 322 causes the first row (row Ra-1) of the table A-1 of the device 10A that has issued this TRAP to The TRAP reception time "09: 59" and the device name "10A" of the device 10A that issued this TRAP are recorded (see (1) in FIG. 8).

  Then, when the second TRAP by the device 10B is received at “10:01”, the similar device determination unit 322 searches for the TRAP reception history in the past, and is received within 3 minutes of the reception time of the second TRAP. Determine if there is a TRAP. Note that "3 minutes" is an example, and it is sufficient to set it arbitrarily.

  In the example of FIG. 8, since the first TRAP by the device 10A is received at "09:59", the similar device determination unit 322 can search for the TRAP by the device 10A received at "09:59". Therefore, the similar device determination unit 322 causes the device name “10A” of the searched device 10A to be searched for in the first row (row Rb-1) of the table B-2 of the device 10B that has issued the second TRAP and the TRAP The reception time "09: 59" is recorded (see (2) in FIG. 8). Then, the similar device determination unit 322 receives the device name “10B” that has issued the second TRAP in the second row (row Ra-2) of the table A-2 of the retrieved device 10A and the reception time of the second TRAP. Record "10:01" (see (2) in FIG. 8).

  Subsequently, the similar device determination unit 322 deletes, from all the tables A-2 to C-2, the history whose reception time exceeds 5 minutes with respect to the second TRAP reception time. Note that “five minutes” is an example, and it is sufficient if the time is longer than “three minutes” of the search target time so that history deletion can be smoothly performed. In the example of (2) of FIG. 8, the similar device determination unit 322 does not erase the history because there is no history in which the reception time exceeds 5 minutes with respect to the second TRAP reception time.

  Then, the similar device determination unit 322 determines devices having a similar relationship from all the tables A-2 to C-2. Specifically, among all the tables A-2 to C-2, it is determined that the devices recorded in each other's tables have a similar relationship. In the example of (2) of FIG. 8, the device name "10B" is recorded in the table A-2 of the device 10A, and the device name "10A" is recorded in the table B-2 of the device 10B. Therefore, the similar device determination unit 322 determines that the device 10A and the device 10B have a similar relationship.

  Next, the case where the third TRAP by the device 10C is received at "10:03" will be described. Also in this case, the similar device determination unit 322 searches the TRAP reception history in the past and determines whether there is a TRAP received within 3 minutes of the reception time of the third TRAP.

  In this case, the similar device determination unit 322 can search for a TRAP by the device 10B that has received “10:01”. Therefore, the similar device determination unit 322 causes the device name “10B” of the retrieved device 10B to be searched for in the first row (row Rc-1) of the table C-3 of the device 10C that has issued the third TRAP and the TRAP The reception time "10:01" is recorded (see (3) in FIG. 8). Then, the similar device determination unit 322 causes the device name “10C” that has issued the third TRAP to the second row (row Rb-2) of the table B-3 of the retrieved device 10B and the third TRAP reception time “ Record 10:03 "(see (3) in FIG. 8).

  Subsequently, the similar device determination unit 322 deletes, from all the tables A-3 to C-3, the history whose reception time exceeds 5 minutes with respect to the third TRAP reception time. In the example of (3) of FIG. 8, the similar device determination unit 322 does not erase the history because there is no history in which the reception time exceeds 5 minutes with respect to the third TRAP reception time. Then, the device name "10B" is recorded in the table A-3 of the device 10A, the device names "10A" and "10C" are recorded in the table B-3 of the device 10B, and the device name is stored in the table C-3 of the device 10C. "10B" is recorded. Therefore, the similar device determining unit 322 determines that the device 10A and the device 10B have a similar relationship, and the device 10B and the device 10C have a similar relationship.

  Next, the case where the fourth TRAP by the device 10C is received at "10:04" will be described. Also in this case, the similar device determination unit 322 searches the TRAP reception history in the past and determines whether there is a TRAP received within 3 minutes of the reception time of the fourth TRAP.

  In this case, the similar device determination unit 322 can search for a TRAP by the device 10B that has received “10:01”. In this case, since the device name "10B" and the TRAP reception time "10:01" have already been recorded in the first row (row Rc-1) of the table C-4, the similar device determination The unit 322 omits recording of the device 10B. Moreover, description is abbreviate | omitted in the case of the same apparatus. Therefore, the similar device determination unit 322 omits the description of the third TRAP by the device 10C that has received “10:03”. Then, the similar device determination unit 322 causes the device name “10C” that has issued the fourth TRAP to the third row (row Rb-3) of the table B-3 of the retrieved device 10B and the fourth TRAP reception time “ Record 10:04 "(see (4) in FIG. 8).

  Subsequently, the similar device determination unit 322 deletes, from all the tables A-4 to C-4, the history whose reception time exceeds 5 minutes with respect to the fourth TRAP reception time. In the example of (4) in FIG. 8, a history in which the reception time exceeds 5 minutes with respect to the fourth TRAP reception time is the first row (row Ra-1) of table A-4 and one row of table B-4. Since it is in the eye (row Rb-1), the similar device determination unit 322 deletes the history of the two rows (row Ra-1, row Rb-1). Then, the device name "10B" is recorded in the table A-4 of the device 10A, the device name "10C" is recorded in the table B-4 of the device 10B, and the device name "10B" is stored in the table C-4 of the device 10C. It is recorded. Therefore, the similar device determining unit 322 determines that the device 10A and the device 10B have a similar relationship, and the device 10B and the device 10C have a similar relationship.

  Next, the case where the fifth TRAP by the device 10A is received at "10:06" will be described. Also in this case, the similar device determination unit 322 searches the TRAP reception history in the past and determines whether there is a TRAP received within 3 minutes of the reception time of the fifth TRAP.

  In this case, the similar device determination unit 322 can search for a TRAP by the device 10C that has received “10:03” and “10:04”. Therefore, the similar device determination unit 322 causes the device name “10C” of the searched device 10C to be searched for in the third row (row Ra-3) of the table A-5 of the device 10A that has issued the fifth TRAP, and the TRAP Record the reception time "10:03". Subsequently, the similar device determination unit 322 causes the device name “10C” of the searched device 10C and the reception time “10:04 of the TRAP to be searched in the fourth row (row Ra-4) of the table A-5 of the device 10A. Is recorded (see (5) in FIG. 8).

  Then, the similar device determination unit 322 causes the device name “10A” that has issued the fifth TRAP to the second row (row Rc-2) of the table C-5 of the retrieved device 10C, and the fifth TRAP reception time “ Record 10:06 "(see (5) in FIG. 8).

  Furthermore, the similar device determination unit 322 deletes, from all the tables A-5 to C-5, the history whose reception time exceeds 5 minutes with respect to the fifth TRAP reception time. In the example of (5) of FIG. 8, since there is a history in which the reception time exceeds 5 minutes with respect to the fifth TRAP reception time in the first row (row Rc-1) of the table C-5, the similar device determination unit 322 erases the history of this line (line Rc-1). Then, the device names "10B" and "10C" are recorded in the table A-5 of the device 10A, the device name "10C" is recorded in the table B-5 of the device 10B, and the device name in the table C-5 of the device 10C. "10A" is recorded. Therefore, the similar device determining unit 322 determines that the device 10A, the device 10B, and the device 10C have a similar relationship.

  In this manner, the similar device determination unit 322 searches for devices that have issued a TRAP at a reception time that approximates the reception time of this TRAP every time a TRAP is received from the history of the past, and determines devices having a similar relationship. There is. The similar device determination unit 322 performs the above-described similar device determination process each time it receives a TRAP from the devices 10A to 10Z.

[Processing of Failure Information Missing Detection Unit]
Next, the process of the failure information loss detection unit 323 will be described. FIG. 9 is a diagram for explaining loss detection processing of failure information of the failure information loss detection unit 323.

  In FIG. 9, the device to be detected is the device 10B, and the similar device determining unit 322 determines that the device having a similar relationship to the device 10B is the device 10A. Then, in FIG. 9, the TRAP reception information of the detection target device 10B is shown as the reception table Tb on the left side of FIG. 9, and the TRAP reception information of the similar device 10A is shown on the right side of FIG. Shown as table Ta. The reception tables Ta and Tb have the same data configuration as the table T3 shown in FIG. 6, and have a data configuration in which TRAP, the TRAP reception time in the fault information management device 3 and the emission time from the devices 10A to 10Z correspond to each other. Have.

  First, the failure information loss detection unit 323 compares the reception table Tb, which is reception information of the device 10B to be detected, with the reception table Ta of the device 10A which is a similar device (see (1) in FIG. 9). Then, the failure information loss detection unit 323 determines that the TRAP number “1101” of the device 10A having the same TRAP reception time of the failure information management device 3 corresponds to the TRAP number “1201” of the device 10B (see FIG. 9 (2)).

  Here, TRAPs of “1102” to “1104” are continuous in the reception table Ta from “1101” onwards, whereas TRAP numbers “1102” to 1020 of the apparatus 10A are in the reception table Tb of the apparatus 10B. There is no number corresponding to “1104” (see (3) in FIG. 9). As a result, the failure information loss detection unit 323 detects that the TRAP from the device 10B is lost after the reception time "10:00" of the failure information management device 3 (see (4) in FIG. 9). ). In addition, the failure information loss detection unit 323 obtains the difference between the TRAP reception time of the failure information management device 3 and the TRAP emission time of the detection target device 10B other than the missing portion of TRAP. In the example of FIG. 9, the difference between the TRAP reception time “10:00” of the fault information management device 3 and the emission time “(11:00)” of the device 10B in the TRAP number “1101” is one hour. Therefore, it is found that the TRAP issuance time of the device 10B is ahead of the TRAP reception time of the fault information management device 3 by one hour.

  In addition, loss detection processing of failure information with respect to another example will be described. FIG. 10 is a diagram for explaining loss detection processing of failure information of the failure information loss detection unit 323. In FIG. 10, it is assumed that the device to be detected is the device 10C, and the similar device determination unit 322 determines that the device having a similar relationship to the device 10C is the device 10A. Then, in FIG. 10, the TRAP reception information of the detection target device 10C is shown as the reception table Tc-1 on the left side of FIG. 10, and the TRAP reception information of the similar device 10A is shown on the right side of FIG. Is shown as a reception table Ta.

  First, the failure information loss detection unit 323 compares the reception table Tc-1 with the reception table Ta (see (1) in FIG. 10). Then, the failure information loss detection unit 323 determines that the TRAP numbers “1101”, “1103”, and “1104” of the device 10A in which the TRAP reception time of the failure information management device 3 is the same, and the TRAP number “1301” of the device 10C. , “1303” and “1304” correspond to each other (see (2) in FIG. 10). Here, in the reception table Tc-1 of the device 10C, there is no number corresponding to the TRAP number "1102" of the device 10A (see (3) in FIG. 10). As a result, the failure information loss detection unit 323 detects that the TRAP from the device 10B is missing between the reception time “10:00” and “10:02” of the failure information management device 3 (see FIG. 10 (see 4)). In addition, the failure information loss detection unit 323 obtains the difference between the TRAP reception time of the failure information management device 3 and the TRAP emission time of the device 10C to be detected, other than the missing portion. In the example of FIG. 10, it is found that the TRAP issuance time of the device 10C is two hours earlier than the TRAP reception time of the fault information management device 3.

  As described above, the failure information loss detection unit 323 detects whether or not the TRAP from the devices 10A to 10Z is lost based on the reception time of the reception table of the TRAP of the device similar to the device. There is. That is, the failure information loss detection unit 323 detects the loss of TRAP by comparing the TRAP reception table of the device to be detected with the TRAP reception table of the similar device. Therefore, the fault information loss detection unit 323 does not have to wait for the next TRAP from the devices 10A to 10Z from which the TRAP is missing in order to detect the loss of TRAP. In other words, the failure information loss detection unit 323 detects the loss of TRAP before the next TRAP from the devices 10A to 10Z from which the TRAP is lost reaches. That is, the failure information loss detection unit 323 can detect the loss of TRAP from the devices 10A to 10Z as long as there is even one TRAP lost among the plurality of devices 10A to 10Z in a similar relationship. .

[Processing of the complement section]
Subsequently, the complementing process of the complementing unit 324 will be described. FIG. 11 is a diagram for explaining the complementing process of the complementing unit 324. In FIG. 11, the apparatus 10B in which the failure information loss detection unit 323 detects that the TRAP is missing after the reception time "10:00" of the failure information management apparatus 3 will be described as a complementation target. And in FIG. 11, the reception table of TRAP of the apparatus 10B of complementation object is shown as reception table Tb of the left of FIG. 11, and the log of TRAP which the apparatus 10B has is shown as log Lb of the right of FIG.

  First, the complementing unit 324 refers to the log Lb of the TRAP possessed by the device 10B detected as missing TRAP by performing communication processing via the network 4 (see (1) in FIG. 11). In this case, since the issuance time of the TRAP of the apparatus 10B is advanced by one hour earlier than the reception time of the fault information management apparatus 3, the complementing unit 324 determines that the issuance time of the apparatus 10B is later than "(11:00)". Determine if there is log data.

  In this case, since the log Lb does not have log data after the issuance time of the apparatus 10B after “(11:00)”, the complementing unit 324 acquires log data of the TRAP missing part from the log Lb of the apparatus 10B. It can not be done (see (2) in FIG. 11). Therefore, for the device 10B, the complement unit 324 determines that the TRAP after the issuance time of the device 10B is "(11:00)" is missing from the TRAP emission of the device 10B, and this device 10B Detects that there is a failure (see (3) in FIG. 11). Therefore, for the device 10B, the complementing unit 324 outputs the reception table Tb to the management device 2 as the failure information data by device 313 together with the result of detecting that the device 10B is broken.

  Also, the complementing process for another example will be described. FIG. 12 is a diagram for explaining the complementing process of the complementing unit 324. In FIG. 12, the failure information loss detection unit 323 complements the device 10C in which it is detected that the TRAP is missing between the reception times "10:00" and "10:02" of the failure information management device 3. It explains as an object. In FIG. 12, the TRAP reception table of the device 10C to be complemented is shown as the reception table Tc-1 on the left side of FIG. 12, and the log of the TRAP possessed by the device 10C is shown as the log Lc on the right side of FIG. .

  First, the complement unit 324 refers to the log Lc of the TRAP that the device 10C has by performing communication processing via the network 4 (see (1) in FIG. 12). In this case, since the issuance time of the TRAP of the apparatus 10C is advanced by 2 hours earlier than the reception time of the fault information management apparatus 3, the complementing unit 324 sets “(12:00)” and “((12:00) It is determined whether there is log data between 12:02). In this case, since the log Lc has log data of the TRAP number "1302" in the issue time "(12:01)" between "(12:00)" and "(12:02)" The unit 324 acquires, from the log Lc, the TRAP number “1302” and the data of the TRAP number “1302” (delivery time “(12:01)” from the device 10C) (see (2) in FIG. 12).

  Subsequently, the complementing unit 324 complements the acquired TRAP number "1302" and the emission time "(12:01)" from the log Lc of the device 10C to the reception table Tc-1 ((3) in FIG. 12). reference). Furthermore, the complementing unit 324 determines the TRAP number based on the difference ("2 hours") between the TRAP reception time of the corresponding fault information management device 3 and the TRAP emission time of the detection target device 10C other than the missing part. The reception time of the fault information management device 3 of the part corresponding to "1302" is obtained. Specifically, the complementing unit 324 is a TRAP number of the reception table Tc-1 that is a time "10:01" obtained by advancing the issuance time "(12:01)" acquired by the TRAP reacquisition from the apparatus 10C by 2 hours. The reception time column corresponding to “1302” is complemented (see (3) in FIG. 10). In this case, for the device 10C, the complementing unit 324 outputs the reception table Tc-2 in which the portion corresponding to the TRAP number “1302” is complemented to the management device 2 as the failure information data by device 313.

  As described above, the complementing unit 324 is the TRAP log possessed by the devices 10A to 10Z in which the TRAP is missing, and the TRAP reception time and the device to be detected of the fault information management device 3 corresponding to other than the TRAP missing portion. The difference from the TRAP emission time of 10B and 10C is used to complement the missing TRAP. As described above, since the failure information loss detection unit 323 can detect the loss of TRAPs from the devices 10A to 10Z as long as there is even one TRAP lost among the plurality of devices 10A to 10Z in a similar relationship, The complementing unit 324 can quickly perform TRAP complementation and device failure detection.

[Processing procedure of similar device identification processing]
Next, the processing procedure of similar device determination processing performed by the similar device determination unit 322 will be described. FIG. 13 is a flowchart of the similar device identification process.

  As shown in FIG. 13, when receiving the first TRAP (step S11), the similar device determination unit 322 determines the device that has issued this first TRAP (step S12). Then, the similar device determination unit 322 records the TRAP reception time in the table of the similar device determination data 312 of the device that has issued this first TRAP (step S13).

  Then, the similar apparatus determination unit 322 determines whether the next TRAP has been received (step S14). Then, if the similar device determination unit 322 determines that the next TRAP has not been received (step S14: No), the similar device determination unit 322 returns to step S14 and performs the determination process of step S14. On the other hand, if the similar device determination unit 322 determines that the next TRAP has been received (step S14: Yes), the similar device determination unit 322 searches the past TRAP reception history (step S15), and receives the second TRAP reception time. It is determined whether or not there is a TRAP received within a predetermined time (for example, 3 minutes) of (step S16).

  If the similar device determination unit 322 determines that there is a TRAP received within a predetermined time of reception time of the main TRAP (step S16: Yes), the similar device determination data 312 of the device that has issued the second TRAP The retrieved device name and its reception time are recorded in the table (step S17). Subsequently, the similar device determination unit 322 records the name of the second TRAP and the receiving time of the second TRAP in the table of the similar device determination data 312 of the searched device (step S18). .

  If the similar device determination unit 322 determines that there is no TRAP received within a predetermined time of reception time of the main TRAP (step S16: No), or after the recording process of step S18 is completed, the similar device determination data 312 is obtained. The history exceeding a predetermined time (for example, 5 minutes) is erased from all the tables (step S19). Then, the similar device determination unit 322 determines a similar device using the table for the similar device determination data 312 (step S20). The determination result of the similar device is output to the failure information absence detection unit 323 and the complementation unit 324.

  Then, the similar device determination unit 322 determines whether there is an instruction to end the determination processing of the similar device (step S21). If the similar device determination unit 322 determines that there is an instruction to end the similar device determination process (step S21: Yes), the determination process ends. If the similar device determination unit 322 determines that there is no instruction to end the similar device determination process (step S21: No), the process returns to step S14, and the process after step S14 is performed for the next TRAP.

[Processing Procedure for Failure Information Missing Detection Processing and Complementation Processing]
Next, processing procedures of the failure information loss detection processing and the complement processing performed by the failure information loss detection unit 323 and the complement unit 324 will be described. FIG. 14 is a flowchart showing the procedure of the failure information loss detection process and the complement process. The process shown in FIG. 14 is executed each time any one of a plurality of devices in a similar relationship receives a TRAP. Also, the process illustrated in FIG. 14 may be performed periodically, or may be performed according to the input of instruction information that instructs the start of the process execution.

  As shown in FIG. 14, the failure information loss detection unit 323 reads the failure information reception data 311 of the device to be detected from the storage unit 31 (step S31). Then, the failure information absence detection unit 323 reads the failure information reception data 311 of the similar device of the device to be detected from the storage unit 31. Subsequently, the failure information loss detection unit 323 compares the TRAP reception time of the failure information reception data 311 of the device to be detected with the TRAP reception time of the failure information reception data 311 of the similar device (step S32). It is determined whether or not there is a missing portion in the failure information reception data 311 of the device of (step S33).

  If the failure information absence detection unit 323 determines that there is no missing part in the failure information reception data 311 of the device to be detected (step S33: No), the failure information reception data 311 read out is the failure information reception data of this device It outputs to the management apparatus 2 as 311 (step S34).

  If the failure information loss detection unit 323 determines that there is a missing portion in the failure information reception data 311 of the device to be detected (step S33: Yes), it detects that there is a loss in the TRAP from this device (step S35). ). Subsequently, the failure information loss detection unit 323 accesses the device to be detected and refers to the TRAP log that the device to be detected has (step S36). Then, the failure information loss detection unit 323 determines whether or not there is log data of a missing portion in the TRAP log that the device to be detected has (step S37).

  The failure information loss detection unit 323 detects a failure of the detection target device (step S38) when it is determined that there is no log data of the missing portion in the TRAP log included in the detection target device (step S37: No). The fault information reception data 311 read out is output to the management apparatus 2 as fault information reception data 311 of this apparatus along with the result of detection of the apparatus failure (step S34).

  On the other hand, when the failure information loss detection unit 323 determines that there is log data of a missing portion in the TRAP log included in the device to be detected (step S37: Yes), the complementing unit 324 generates log data of the missing portion from this log. Is acquired (step S39). Then, the complementing unit 324 sets the log data of the dropout portion of the acquired TRAP, the TRAP reception time of the fault information management device 3 corresponding to other than the dropout portion, and the TRAP emission time of the detection target devices 10B and 10C. The missing part of the TRAP is complemented using the difference of (step S40). Then, the failure information loss detection unit 323 outputs the failure information reception data 311 with the missing portion complemented to the management device 2 as the failure information reception data 311 of the device to be detected (step S41).

[Effect of the embodiment]
As described above, the fault information management device 3 according to the embodiment finds a similar relationship between the devices 10A to 10Z which are management targets of TRAP. Then, the fault information management device 3 detects whether or not the TRAP from the devices 10A to 10Z to be detected is missing, based on the reception time of the TRAP from the device similar to the device to be detected. ing.

  Therefore, the fault information management device 3 does not have to wait for reception of the next TRAP from the devices 10A to 10Z from which the TRAP is missing in order to detect the lack of TRAP. Also, in other words, the fault information management device 3 does not have to transmit a command such as ping in order to detect a missing TRAP. Therefore, the failure information management device 3 can reliably detect the missing TRAP before the next TRAP from the devices 10A to 10Z from which the TRAP is missing has arrived. In other words, the fault information management device 3 can detect the lack of TRAP from the devices 10A to 10Z as long as there is even one missing TRAP among the plurality of devices 10A to 10Z in a similar relationship.

  In addition, when the fault information management device 3 detects that the TRAP is missing, the fault information management device 3 complements the missing TRAP by reacquiring TRAP from the TRAP log of the devices 10A to 10Z where the TRAP is missing. Do. Therefore, the fault information management device 3 can compensate for the missing TRAP before the next TRAP from the devices 10A to 10Z where the TRAP is missing has arrived. Further, when the TRAP can not be reacquired from the TRAP log of the devices 10A to 10Z from which the TRAP is missing, the fault information management device 3 detects that there is a failure in the devices 10A to 10Z. Failure can be detected quickly.

  As described above, according to the present embodiment, it is possible to detect the lack of TRAP from the devices 10A to 10Z as long as there is only one missing TRAP among the plurality of devices 10A to 10Z in a similar relationship. As a result, TRAP complementation and device failure detection can be performed quickly.

  Although the case where the failure information management device 3 is provided separately from the management device 2 to detect a missing TRAP has been described as an example, the management device may, of course, perform missing detection and complementation of the TRAP. FIG. 15 is a schematic view showing another configuration of the management device. As illustrated in FIG. 15, in the management device 2A, the control unit 22A further includes a fault information management unit 321. Then, the storage unit 21 stores failure information reception data 311, similar device determination data 312, and device failure information data 313. In this case, the management unit 221 may manage the devices 10A to 10Z based on the received data on which the failure information management unit 321 has performed TRAP loss detection and complementation. Further, in this case, the failure information management device 3 between the management device 2A and the network 4 can be omitted.

Other Embodiments
[System configuration etc.]
The components of the illustrated devices are functionally conceptual and do not necessarily have to be physically configured as illustrated. That is, the specific form of the dispersion and integration of each device is not limited to that shown in the drawings, and all or a part thereof may be functionally or physically dispersed in any unit depending on various loads and usage conditions It can be integrated and configured. Furthermore, all or any part of each processing function performed by each device may be realized by a CPU and a program analyzed and executed by the CPU, or may be realized as wired logic hardware.

  Further, among the processes described in the present embodiment, all or part of the process described as being automatically performed can be manually performed, or the process described as being manually performed. All or part of can be performed automatically by a known method. In addition to the above, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above documents and drawings can be arbitrarily changed unless otherwise specified.

[program]
FIG. 16 is a diagram illustrating an example of a computer in which the management device 2A and the failure information management device 3 are realized by execution of a program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These units are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. Disk drive interface 1040 is connected to disk drive 1100. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, the display 1130.

  The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program defining each process of the management device 2A and the fault information management device 3 is implemented as a program module 1093 in which a code executable by the computer 1000 is described. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, the hard disk drive 1090 stores a program module 1093 for executing the same process as the functional configuration of the management apparatus 2A and the fault information management apparatus 3. The hard disk drive 1090 may be replaced by a solid state drive (SSD).

  The setting data used in the process of the above-described embodiment is stored as program data 1094 in, for example, the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads out the program module 1093 and the program data 1094 stored in the memory 1010 and the hard disk drive 1090 to the RAM 1012 as needed, and executes them.

  The program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, and may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (LAN, WAN, etc.). The program module 1093 and the program data 1094 may be read by the CPU 1020 from another computer via the network interface 1070.

  Although the embodiment to which the invention made by the inventor is applied has been described above, the present invention is not limited by the description and the drawings that form a part of the disclosure of the present invention according to the present embodiment. That is, all other embodiments, examples, operation techniques and the like made by those skilled in the art based on the present embodiment are included in the scope of the present invention.

Reference Signs List 1 management system 2 management apparatus 3 fault information management apparatus 4 network 10A to 10Z apparatus 21, 31 storage unit 22, 32 control unit 23, 33 input unit 24, 34 output unit 25, 35 communication control unit 221 management unit 311 fault information reception Data 312 Similar device determination data 313 Failure information data by device 321 Failure information management unit 322 Similar device determination unit 323 Failure information missing detection unit 324 Complement unit

Claims (7)

A similar device determination unit that determines a plurality of communication devices having a similar relationship among the communication device group based on an approximation of each reception time of failure information respectively received from the communication device group connected via the network;
Failure information loss detection that detects whether or not the failure information from the communication device to be detected is missing based on the reception time of the failure information from the communication device having a similar relationship to the communication device to be detected Department,
When the fault information loss detection unit detects that the fault information from the communication device to be detected is missing, the issue information which is a log of the time at which the fault information of the communication device to be detected is issued A complementing unit that complements the missing fault information using a list;
A fault information management device characterized by having.   The similar device determination unit determines that the plurality of communication devices that have issued the failure information received within a predetermined time period are the plurality of communication devices having the similar relationship. Failure information management device.   The failure information loss detection unit compares the reception time of the failure information from the communication device to be detected with the reception time of the failure information from a communication device having a similar relationship to the communication device to be detected; 3. The failure information management device according to claim 1, wherein it is determined whether or not failure information from the communication device is missing based on the degree of coincidence of reception times of the failure information management device.   The complementing unit refers to the issued information list of the fault information included in the communication device to be detected which is detected that the fault information is missing, and when there is log data of the missing part of the fault information The log data of the missing part of the fault information is acquired from the issue information list, and the acquired log data of the missing part of the fault information and the fault information management apparatus corresponding to the other than the missing part of the fault information 4. The missing part of the fault information is complemented using the difference between the reception time of the fault information and the time when the fault information of the device to be detected is issued. Failure information management device described in the above.   The said complementation part detects that the apparatus of the said detection target is out of order, when the log data of the missing part of the said fault information can not be acquired from the apparatus of the said detection target. The fault information management device described. A failure information management method is executed by a failure information management device that receives failure information from a group of communication devices connected via a network and manages the failure information.
A similar device determining step of determining a plurality of communication devices having a similar relationship among the communication device group based on an approximation of each reception time of failure information respectively received from the communication device group;
Failure information loss detection that detects whether or not the failure information from the communication device to be detected is missing based on the reception time of the failure information from the communication device having a similar relationship to the communication device to be detected Process,
When it is detected in the failure information loss detection step that the failure information from the communication device to be detected is missing, a log indicating the time at which the failure information of the communication device to be detected is issued is issued A complementing step of complementing the missing fault information using an information list;
A fault information management method characterized by including: On the computer
A similar device determining step of determining a plurality of communication devices having a similar relationship among the communication device group based on an approximation of each reception time of failure information respectively received from the communication device group connected via the network;
Failure information loss detection that detects whether or not the failure information from the communication device to be detected is missing based on the reception time of the failure information from the communication device having a similar relationship to the communication device to be detected Step and
If it is detected in the failure information loss detection step that the failure information from the communication device to be detected is missing, a log of the time at which the failure information of the communication device to be detected is issued is issued A complementing step of complementing the missing fault information using an information list;
Fault information management program that runs

Images