JP2004348640A - Method and system for managing network - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system for managing a network which enables a user to accurately identify a cause of trouble without having enough operating information. <P>SOLUTION: The system for managing the network comprises acquisition units 121, 131, and 141 for acquiring the operating information of each monitored machine 150, 160, 170, and 180; a database 108 for storing the operating information which stores the operating information acquired by the acquisition units for each monitored machine; a status database 109 that stores the information of a status for each monitored machine classified by each monitored computer to represent whether the operating information is lost for each monitored machine; and a unit 101 for analyzing the operating information which identifies a particular machine as a candidate for being monitored due to a cause to change the utilization of the machine, and displays an identified result by using a correlation analysis on the basis of the status information stored in the status database and the information of the utilization of the monitored machine stored in a machine utilization database. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a network management system and a network management method, and more particularly to a network management system and a network management method capable of specifying a cause of a trouble that has occurred in a computer network.
[0002]
[Prior art]
2. Description of the Related Art In recent years, stable operation of a Web system or the like built on the Internet has been desired. A computer network system that constitutes a Web system or the like generally includes a plurality of network devices. For example, as shown in Patent Literature 1, the state is obtained by acquiring operation information and the like using various kinds of dedicated software. Monitoring. For example, when the response of the Web page is reduced, the administrator manually investigates the cause based on the operation information.
[0003]
Japanese Patent Application Laid-Open No. H11-163873 discloses a method for deteriorating the performance of a specific application presented by a specific server by using traffic information that can be acquired as standard in a multimedia network, minimizing the influence of a load on an operation server, and the like. To be able to be analyzed.
[0004]
Patent Document 3 discloses that the relationship between the components of the system to be managed is quantified based on the operation information, thereby narrowing down the components causing a performance bottleneck or a failure. It is shown that the identification can be realized early.
[0005]
[Patent Document 1]
JP 2001-144761 A [0006]
[Patent Document 2]
JP 2001-195285 A
[Patent Document 3]
JP-A-2002-342182
[Problems to be solved by the invention]
According to the method of Patent Document 1, when a trouble such as a decrease in the response of a Web page occurs, it is a root cause of the problem based on operation information of a large number of network devices stored in advance. The potential must be investigated manually. Such a task is difficult without a skilled network administrator.
[0009]
Further, according to the methods described in Patent Documents 2 and 3, it is difficult to accurately identify the cause of the trouble when information such as operation information to be acquired has a defect.
[0010]
The present invention has been made in view of these problems, and provides a network management system and a network management method capable of accurately specifying the cause of a trouble even when operation information has a defect.
[0011]
[Means for Solving the Problems]
The present invention employs the following means in order to solve the above problems.
[0012]
An operation information acquisition unit that acquires operation information of each monitored machine; an operation information database that stores operation information of the monitored machines acquired by the movable information acquisition unit for each monitored machine; A status database that stores status information indicating the presence or absence of lack of operation information for each computer to be monitored, and a specific database based on the operation information of the monitored machine stored in the operation information database and the status information stored in the status database. An operation information analysis unit is provided for identifying and displaying a candidate of the monitored machine that causes a change in the operation rate of the monitored machine by correlation analysis.
[0013]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. FIG. 1 is a diagram illustrating a network management system according to an embodiment of the present invention. The operation information analysis computer 100 acquires the operation information (CPU utilization, memory utilization, Web page response time, etc.) acquired by the operation information collection computer 120, and performs a correlation analysis or the like based on the acquired operation information. Search for the cause of computer system troubles (problems).
[0014]
The operation information analysis computer 100 includes an analysis unit 101, an operation information collection unit 105, a screen display unit 107, an operation information database 108, and a status database 109. The analysis unit 101 is a unit that actually performs analysis, and includes a correlation analysis unit 102, a risk degree calculation unit 103, and a cause degree calculation unit 104. The operation information collection unit 105 periodically obtains operation information from the operation information collection computer 120. In addition, when the operation information cannot be obtained, a status generation unit 106 that generates a status indicating that fact is provided.
[0015]
The screen display unit 107 performs display corresponding to various processes such as selection of an analysis target, display of an analysis result, and narrowing of an analysis range. The operation information database 108 is storage means for storing operation information periodically acquired from the operation information collection computer 120. The status database 109 is a storage unit that stores status information generated when the operation information extracted from the operation information collection computer 120 has a partial loss. The operation information analysis computer 100 can acquire operation information from an arbitrary number of operation information collection computers 120.
[0016]
The operation information collection computer 120 collects operation information of the monitored machine 150 to be actually monitored on the computer network, and responds to the operation information acquisition request from the collected operation information analysis computer 100 to convert the operation information. Has the ability to send. The operation information collection computer 120 includes an operation information acquisition unit 121 and an operation information collection tool 122. The operation information acquisition unit 121 acquires the operation information collected by the operation information collection tool 122, and transmits the obtained information to the operation information analysis computer. The operation information collection tool 122 is a general commercially available network management tool, and collects operation information from a plurality of monitored machines 150.
[0017]
The monitored machine 150 is a network device constituting a computer network, and generally corresponds to a router, a hub, a switch, a workstation, a PC, or the like.
[0018]
FIG. 2 is a diagram illustrating an example of a computer network to which the network management system of the present invention is applied. This example is an example of a typical Web system constructed when implementing a Web shopping mall or the like.
[0019]
As shown in the figure, a client PC 220 and a Web system 220 are configured with a network (WAN) 210 interposed therebetween. The Web system 200 includes network devices such as a firewall 201, a router 202, a Web server 203, AP (application) servers 204 and 205, and DB (database) servers 206, 207, and 208.
[0020]
The operation information of each network device is generally collected by a plurality of network management applications. In the case of the example shown in the figure, the machine (router 202, server 204, etc.) on which the network management application is installed is the operation information collection computer 120.
[0021]
FIG. 3 is a diagram illustrating the status generation processing. Status is a method introduced to make up for the shortcomings of correlation analysis. Correlation analysis is a statistical method that compares two different pieces of operation information and checks whether the time-series data is correlated (causal relationship). It is.
[0022]
Correlation analysis cannot perform accurate correlation analysis if part of the target data has a defect. If a network device constituting the network is temporarily stopped due to the occurrence of a trouble, the operation information is not collected during the stop period. In this case, the suspended network device or server cannot be a target of the correlation analysis even though there is a high possibility of causing a network trouble.
[0023]
The present invention introduces the concept of status in order to solve this problem. The status is assigned, for example, “1” during a period in which the operation information is collected, and “0”, for example, in a period during which the operation information is not collected. The status is assigned to all network devices separately from the operation information. Assign and accumulate. When performing a correlation analysis, the correlation analysis is performed by referring to a status in addition to the operation information. This makes it possible to perform correlation analysis on network devices for which operation information could not be collected (network devices stopped due to a trouble) by referring to the status instead of the operation information.
[0024]
The status generation processing is performed by the status generation unit 106 of the operation information collection unit 105 of the operation information analysis computer 100. First, in step 300, the operation information collection unit 105 acquires operation information from the operation information acquisition unit 121 of the operation information collection computer 120. In step 301, the collected operation information is examined in chronological order, and it is determined whether the operation information has been acquired in that time zone. If the operation information has been acquired, the status is set to 1 in step 302 and stored in the status database 109. At the same time, the operation information itself is stored in the operation information database 108 in step 304. If the operation information has not been acquired, the status is set to 0 in step 303 and stored in the status database 109. This process is performed until the collected operation information is exhausted.
[0025]
FIG. 4 is a diagram illustrating an image of the status information. When the operation information 400 whose information is missing due to the stoppage of the network device or the server is acquired, when the status is generated by the status generation process shown in FIG. 3, the status data 401 is obtained.
[0026]
As described above, among the monitoring target periods, “1” is assigned to a period during which operation information can be collected, and “0” is assigned to a period during which operation information cannot be collected.
[0027]
As shown in the figure, when the change of the operation information 402 of the network device or the like to be analyzed is affected by the stop of the network device or the like, the correlation between the status data 401 and the operation information 402 is determined using the status data 401. The cause of the change in the operation information 402 can be specified by analyzing the information.
[0028]
FIG. 5 is a diagram illustrating a process of identifying a monitored machine candidate (cause candidate) that causes a change in the operation rate by correlation analysis.
[0029]
First, in step 500, the operation information of the monitored machine to be analyzed is selected, and the analysis period (time range) is determined. This is done by the network administrator. As described above, in the case of a Web system, generally, a response time of a Web page is an analysis target. Next, in step 501, the range of the network device to be investigated as a cause candidate is determined. This operation is also performed by the network administrator. Note that elements that are not sure cause candidates are excluded from the scope of investigation here.
[0030]
Step 502 and subsequent steps are automatically performed by the operation information analysis computer 100. First, in step 502, a correlation analysis with the analysis target is performed on the operation information of the network device to be investigated as a cause candidate, and a correlation coefficient in the range of 0 to 1 is calculated. The larger the correlation coefficient is, the higher the correlation with the analysis target is. If there is a defect in the operation information, in step 503, status information is acquired from the status database, a correlation analysis is performed based on the operation rate and the status information to be analyzed, and a correlation coefficient is calculated. In step 504, the operation information of some of the higher correlation coefficients (for example, 10 values designated in advance, for example, 10) is determined as a cause candidate that has affected the operation information to be analyzed.
[0031]
FIG. 6 is a diagram illustrating a process of calculating the degree of cause of a cause candidate. First, in step 600, the threshold value of the operation information of the network device that has become the cause candidate by the processing shown in FIG. 4 is read. Note that the threshold value is appropriately set in advance by a network administrator. In step 601, it is calculated how long the operation information of the network device that has become the cause candidate has exceeded the threshold value in the analysis target period, and a risk ratio in the range of 0 to 1 is calculated. For example, if the operation information exceeds the threshold for 15 minutes during one hour, the risk ratio of the operation information is set to 0.25. In step 602, the cause is calculated from the correlation coefficient and the risk ratio. The degree of cause is calculated by ((correlation coefficient × α) + (risk ratio × (100−α))) / 100, and is in the range of 0 to 1. Here, α is a coefficient for weighting and an arbitrary value from 0 to 100 can be designated. When α is increased, the degree of correlation is regarded as important, and when α is decreased, the risk ratio is regarded as important.
[0032]
FIG. 7 is a diagram illustrating the configuration of the operation information database 108. The operation information database stores operation information of each network device at predetermined time intervals. As shown in the figure, Web page response time, line usage rate, CPU usage rate, cache hit rate, and the like are stored as operation information. When the operation information has not been acquired, there is no value.
[0033]
FIG. 8 is a diagram illustrating the configuration of the status database 109. The status database stores the status of each network device. Only one status exists for each network device, and a value of 0 or 1 is stored at regular intervals.
[0034]
FIG. 9 is a diagram illustrating an example of an image of the analysis result list screen 900. The analysis result list screen 900 is displayed on the screen display unit 107 of the operation information analysis computer 100. The analysis result list screen 900 includes an analysis time view 901, an analysis target view 902, an analysis result view 903, and a graph display button 904. The analysis time view 901 displays the analysis target range (period) by time. The analysis target view 903 displays operation information designated as an analysis target and a machine name representing a network device that has acquired the operation information. The analysis result view 903 displays the final analysis result. The analysis result view 903 displays a list of candidates having the highest possibility (causes having a high degree of cause) as cause candidates in order. It is considered that there is a high possibility that the operation information at the top of the list is the operation information of the machine that causes the response time of the Web page to be analyzed to deteriorate. The analysis result view 903 displays a rank, a cause candidate name, a cause degree, a correlation coefficient, and a risk ratio. When the graph display button 904 is pressed, an analysis result graph screen is displayed.
[0035]
FIG. 10 is a diagram illustrating an example of an image of the analysis result graph screen 1000. When the graph display button 904 of the analysis result list screen 900 is pressed, the analysis result graph screen 1000 is displayed on the screen display unit 107 of the operation information analysis computer 100. The analysis result graph screen 1000 includes a graph view 1001, a graph element view 1002, and an analysis time view 1003. The graph view 1001 simultaneously displays a graph of operation information as an analysis target and a candidate for a cause. The graph element view 1002 displays which operation information each of the displayed graphs belongs to. The analysis time view 1003 displays the analysis target range by time.
[0036]
As described above, according to the present embodiment, when a trouble occurs in a computer system, the cause of the trouble can be accurately specified even if there is a defect in the operation information, and the possibility of the cause may be determined. A network device can be shown to a network administrator. As a result, the network administrator can quickly perform the primary isolation of the problem and the recovery processing. The functions described in the specification of the operation information analysis computer 100 and the operation information collection computer 120 can be realized by software.
[0037]
Further, as described above, the monitoring target period is divided into predetermined periods, and among the divided periods, “1” is set during a period in which operation information is collected, and “0” is set during a period in which operation information is not collected. The correlation analysis is performed by using the status data to which the status data is assigned. For this reason, a network device or the like that has been temporarily stopped due to the occurrence of a trouble (it is highly likely to be a cause of a decrease in the operation rate) can be subjected to the correlation analysis.
[0038]
【The invention's effect】
As described above, according to the present invention, it is possible to provide a network management system capable of accurately specifying the cause of a trouble even when operation information has a defect.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating a network management system according to an embodiment of the present invention.
FIG. 2 is a diagram illustrating an example of a computer network to which the network management system of the present invention is applied.
FIG. 3 is a diagram illustrating a status generation process.
FIG. 4 is a diagram illustrating an image of status information.
FIG. 5 is a diagram illustrating a process of identifying a monitored machine candidate that causes a change in the operation rate by correlation analysis;
FIG. 6 is a diagram illustrating a process of calculating the degree of cause of a cause candidate.
FIG. 7 is a diagram illustrating a configuration of an operation information database.
FIG. 8 is a diagram illustrating a configuration of a status database 109.
FIG. 9 is a diagram illustrating an example of an image of an analysis result list screen 900.
FIG. 10 is a diagram illustrating an example of an image of an analysis result graph screen 1000.
[Explanation of symbols]
101 operation information analysis computer 102 correlation analysis unit 103 risk calculation unit 104 cause calculation unit 105 operation information collection unit 106 status generation unit 107 screen display unit 108 operation information database 109 status database 110 networks 120, 130, 140 operation information collection computer 121, 131, 141 Operation information acquisition unit 122, 132, 142 Operation information collection tool 150, 160, 170, 180 Monitored machine 200 Web system 201 Firewall 202 Router 203 Web server 204, 205 AP server 206, 207, 208 DB Server 210 Network 220 Client PC

Claims (5)

An operation information acquisition unit that acquires operation information of each monitored machine;
An operation information database that stores operation information of the monitored machines acquired by the movable information acquisition unit for each monitored machine,
A status database that stores status information indicating whether or not the operation information is missing for each monitored machine for each monitored computer;
Based on the operation information of the monitored machine stored in the operation information database and the status information stored in the status database, the candidate of the monitored machine causing the change in the operation rate of the specific monitored machine is identified by correlation analysis. A network management system comprising an operation information analysis unit for displaying. The network management system according to claim 1,
The analysis unit acquires operation information of a computer that is a candidate of the monitored machine that causes a change in the operation rate of the specific monitored machine, and the operation rate indicated by the operation information exceeds a predetermined threshold. A network management system for calculating a risk based on a period. The network management system according to claim 2,
The network management system, wherein the analysis unit calculates a cause based on the correlation coefficient obtained by the correlation analysis and the risk. A step of acquiring operation information of each monitored machine;
Storing the operation information of the monitored machine acquired by the movable information acquisition unit in an operation information database for each monitored machine;
A step of storing status information indicating presence or absence of loss of operation information of each monitored machine in a status database for each monitored computer;
Based on the operation information of the monitored machine stored in the operation information database and the status information stored in the status database, the candidate of the monitored machine causing the change in the operation rate of the specific monitored machine is identified by correlation analysis. A network management method comprising a step of displaying. The network management method according to claim 4,
The analysis unit acquires operation information of a computer that is a candidate of the monitored machine that causes a change in the operation rate of the specific monitored machine, and the operation rate indicated by the operation information exceeds a predetermined threshold. A network management method comprising calculating a risk level based on a period.

Images