JP6542538B2 - Network monitoring system, monitoring device and monitoring method - Google Patents

Description

  The present invention relates to a network monitoring system, a monitoring apparatus and a monitoring method, and more particularly to a network monitoring system, a monitoring apparatus and a monitoring method using a Simple Network Management Protocol (SNMP) as a network monitoring protocol.

  As a monitoring interface of an IP (Internet Protocol) network device, SNMP, which is a network monitoring protocol proposed in Request For Comments (RFC) 1157 formulated by the Internet Engineering Task Force (IETF), is usually used. SNMP is used for status monitoring of network devices and servers, resource monitoring, performance monitoring, traffic monitoring and the like.

  In SNMP, a network device to be monitored is called an "SNMP agent" and a monitoring device is called an "SNMP manager". The SNMP agent manages the state information of the apparatus in units of object (Object) by Management Information Base (MIB) which is a set of information to be monitored. Then, the SNMP agent determines the current device status based on the contents of this MIB. Examples of items managed and monitored by the MIB include total traffic byte count, CPU (Central Processing Unit) load, memory usage, process status, component device failure, and so on.

  The SNMP manager can poll and collect information on the MIB of the SNMP agent using a command (such as GetRequest) defined by SNMP. Also, the SNMP agent can notify the status of its own device to the SNMP manager spontaneously using a command (Trap) defined by the SNMP. Therefore, when a failure occurs in the network device and the management information changes, the SNMP agent notifies the SNMP manager of the failure information by Trap.

  The SNMP manager displays, on the monitoring screen, the monitoring status based on the Trap information notified from the SNMP agent and the collected MIB information so that the operator can easily understand. Usually, a monitoring screen such as a map display, a tree display, and a list display is prepared so that it can be understood which network device the monitoring information belongs to and where the network device is geographically installed.

  Patent Document 1 discloses a technique of a network management system suitable for performing long-term management for a large scale network. The technology disclosed in Patent Document 1 realizes information processing such as traffic, device load, memory utilization rate, etc. in real time, and displays the entire configuration of the network on a screen in a map format with easy operation operation. It is a technology to make According to this technique, a terminal device connected to a network is used as a management terminal device, management information is automatically collected at a predetermined timing, stored as a database, and required from the database according to the administrator's request. Information can be read and displayed. A management information collection unit, a management information storage unit, and a management information display unit are provided in the management terminal device. The management information collection unit repeatedly executes, at predetermined timing, an operation of collecting management information stored in each router via the network. The management information storage unit stores the collected management information as a database together with time information of the collected date and time. Then, the management information display unit reads the management information specified by the administrator from the database and displays it in a predetermined display mode.

  Patent Document 2 discloses a technique for revealing an IP address in a network including a non-IP network such as Synchronous Digital Hierarchy (SDH). The integrated system management system disclosed in Patent Document 2 considers the current state of the IP network at the occurrence of an abnormality or failure event of the wide area monitoring control system, and cooperates with the information of the non-IP network management device to cause the abnormality or failure event. Estimate and display. In Patent Document 2, an IP address used in an IP network portion on a managed network is detected by examining a response to a ping (packet internet groper) command.

  Also, there is OpenFlow (OpenFlow) as a technology for centrally managing network devices constituting a communication network with one control device to change transfer control and network configuration. In the open flow technology, the function of routing control and the function of data transfer, which were conventionally incorporated in one network device, are separated and incorporated in separate devices. A device incorporating a path control function is an OpenFlow controller (open flow controller), and a device incorporating a data transfer function is an OpenFlow switch (open flow switch).

  In an OpenFlow network (OpenFlow network), a plurality of OpenFlow switches are assigned to one OpenFlow controller. The open flow controller sets control information for controlling a path called flow entry for each packet type in the assigned open flow switch. Each OpenFlow switch controls transfer of the received packet in accordance with the flow entry corresponding to the type of the received packet. Information is exchanged between the open flow controller and the open flow switch by the OpenFlow protocol (open flow protocol).

  Such techniques relating to open flow are disclosed in Patent Document 3 and Patent Document 4.

  Patent Document 3 discloses a technique for constructing an open flow network system inexpensively. Further, Patent Document 4 discloses a flow control method according to a protocol higher than a Transmission Control Protocol (TCP) layer in a computer system using an open flow protocol.

JP 2001-308858 A JP, 2007-060518, A JP, 2014-160887, A International Publication No. 2012/120990

  The control of the open flow network is executed by the open flow controller, and information necessary for monitoring is appropriately collected from the open flow switch by the open flow protocol. When the open flow network is incorporated into the network monitoring system, the collected information is notified to the SNMP manager of the network monitoring system by the open flow controller acting as an SNMP agent.

  The OpenFlow controller, which is an SNMP agent, notifies monitoring information, which is collected from the subordinate OpenFlow switch by the OpenFlow protocol, to the monitoring device, which is an SNMP manager, by SNMP Trap.

  The Trap includes the IP address (Agent Address) of the source network device, and the SNMP manager identifies which SNMP agent is the Trap notification based on this IP address. When registering a network device as an SNMP agent as a monitoring target in the SNMP manager, the IP address of the network device is registered as a unique key. Therefore, in the network monitoring system based on SNMP, it is not possible to redundantly register network devices of the same IP address.

  The monitoring information on the open flow switch under the open flow controller notified of by the open flow controller by Trap is treated as monitoring information of the open flow controller by the IP address included in the trap. Therefore, when displaying the monitoring information on the monitoring screen, the SNMP manager displays the screen with the device name of the open flow controller.

  As a result, the failure information generated in the open flow switch is displayed on the monitoring screen as a failure state of the open flow controller in which no failure occurs. Further, when the fault point display is performed and the installation points of the open flow controller and the open flow switch are different from each other, not the installation point of the open flow switch but the installation point of the open flow controller is displayed as a fault.

  The monitoring systems disclosed in Patent Document 1 and Patent Document 2 do not mention the monitoring display regarding the device under the control of the SNMP agent. Further, Patent Document 3 and Patent Document 4 do not disclose a technique for incorporating and monitoring an open flow network in SNMP.

  An object of the present invention is to provide a network monitoring system, a monitoring apparatus, and a monitoring method capable of notifying an SNMP manager of monitoring information related to a device under the SNMP agent to distinguish and monitor and display the SNMP agent.

  In order to realize the above object, a network monitoring system according to an aspect of the present invention connects a plurality of subnetwork devices under the network, and collects monitoring information of the collected subnetwork devices through SNMP (Simple Network Management Protocol). A network device functioning as an SNMP agent that notifies the object identifier (OID) indicating the type of the monitoring information in the notification message defined by the message including the identification information of the subnetwork device; and the notification notified from the network device The OID contained in the notification message is analyzed, and from the identification information of the subnetwork device contained in the OID, a device identifier uniquely identifying the device to be monitored, generated and assigned when registering the device to be monitored, is specified The device identifier and the monitoring information indicated by the OID And a monitoring device functioning as an SNMP manager that monitors and displays the contents of the monitoring information indicated by the OID as monitoring information of the monitoring target device corresponding to the device identifier.

  Further, according to another aspect of the present invention, there is provided a monitoring device comprising: a network device functioning as a Simple Network Management Protocol (SNMP) agent; and a plurality of subnetwork devices collected from a plurality of subnetwork devices connected by the network device. Monitoring information acquiring means for receiving monitoring information in an object identifier (OID) indicating a type of the monitoring information of a notification message defined by SNMP including identification information of the subnetwork apparatus, and the information included in the notification message The OID is analyzed, and from the identification information of the subnetwork device included in the OID, a device identifier uniquely identifying the device to be monitored, which is generated and assigned when registering the device to be monitored, is identified, Monitoring information mapping means for associating the monitoring information indicated by the OID; Monitoring screen display means for monitoring and displaying the content of the monitoring information indicated by the OID as monitoring information of the monitoring target device corresponding to the device identifier based on the association between the recording device identifier and the monitoring information indicated by the OID It is characterized by

  Further, according to another aspect of the present invention, there is provided a monitoring method comprising: collecting, from a network device functioning as a Simple Network Management Protocol (SNMP) agent, from a plurality of subnetwork devices to which the network device is connected under control; The monitoring information is received including an identification information of the subnetwork apparatus in an object identifier (OID) indicating a type of the monitoring information of a notification message defined by SNMP, and the OID contained in the notification message is analyzed. From the identification information of the subnetwork device included in the OID, a device identifier uniquely identifying the device to be monitored, generated and assigned when registering the device to be monitored, is identified, and the monitoring indicated by the device identifier and the OID Based on the association with the information, the monitoring target device corresponding to the device identifier The content of monitoring information indicated by the OID is monitored and displayed as monitoring information.

  The present invention can notify the SNMP manager of monitoring information on a device under the SNMP agent, and monitor and display the monitoring information of the device separately from the SNMP agent.

FIG. 1 is a block diagram showing a configuration of a first embodiment of a network monitoring system of the present invention. It is a block diagram showing composition of a 1st embodiment of a surveillance device of the present invention. It is a flowchart which shows operation | movement of 1st Embodiment of the monitoring method of this invention. It is a block diagram which shows the structure of 2nd Embodiment of the network monitoring system of this invention. It is a figure which shows the content of Trap which SNMP prescribes | regulates. It is a block diagram which shows the structure of the monitoring system server which is a monitoring apparatus of the 2nd Embodiment of this invention. It is a figure which shows the hierarchical model of the apparatus structure information managed by the structure information database of a monitoring system server. It is a flowchart which shows operation | movement of the monitoring system server which is a monitoring apparatus of the 2nd Embodiment of this invention. It is a figure which shows the example of the monitoring screen which displayed the monitoring item hierarchically. It is a figure which shows the example of the monitoring screen which displayed the installation area of the monitoring object apparatus geographically.

  An embodiment for carrying out the present invention will be described with reference to the drawings.

Note that the embodiment is an example, and the disclosed apparatus and system are not limited to the configurations of the following embodiments.
First Embodiment
FIG. 1 is a block diagram showing the configuration of a first embodiment of the network monitoring system of the present invention.

  A network monitoring system 1 according to an embodiment of the present invention includes a network device 20 functioning as an SNMP agent using a Simple Network Management Protocol (SNMP) and a monitoring device 10 functioning as an SNMP manager.

  The network device 20 connects a plurality of subnetwork devices 22 under its control. That is, the network device 20 is positioned as a device that controls the subnetwork 21 configured by the subnetwork device 22.

  The network device 20 notifies the collected monitoring information of the sub network device 22 to the object identifier (OID) indicating the type of the monitoring information of the notification message defined by the SNMP, including the identification information of the sub network device 22. .

  The monitoring device 10 analyzes the OID included in the notification message notified from the network device 20. The monitoring apparatus 10 identifies, from the identification information of the subnetwork apparatus 22 included in the OID, an apparatus identifier that uniquely identifies the monitoring target apparatus, which is generated and assigned when the monitoring target apparatus is registered. Then, based on the association between the device identifier and the monitoring information indicated by the OID, the monitoring device 10 monitors and displays the content of the monitoring information indicated by the OID as the monitoring information of the monitoring target device corresponding to the device identifier.

  FIG. 2 is a block diagram showing the configuration of the first embodiment of the monitoring device of the present invention.

  The monitoring apparatus 10 according to the first embodiment is configured to include a monitoring information acquisition unit 11, a monitoring information mapping unit 12, and a monitoring screen display unit 13.

  The monitoring information acquisition unit 11 receives, from a network device functioning as an SNMP agent, monitoring information collected from a plurality of subnetwork devices connected by the network device under control according to a notification message defined by SNMP. The network device notifies by including the identification information of the subnetwork device in an object identifier (OID) indicating the type of monitoring information of the notification message.

  The monitoring information mapping means 12 analyzes the OID contained in the notification message. Then, from the identification information of the subnetwork device included in the OID, a device identifier uniquely identifying the device to be monitored, which is generated and assigned when the device to be monitored is registered, is specified. Furthermore, the monitoring information mapping means 12 associates the identified device identifier with the monitoring information indicated by the OID.

  The monitoring screen display unit 13 monitors and displays the content of the monitoring information indicated by the OID as the monitoring information of the monitoring target device corresponding to the device identifier based on the association between the device identifier and the monitoring information indicated by the OID.

  FIG. 3 is a flow chart showing the operation of the first embodiment of the monitoring method of the present invention.

  The monitoring method of the first embodiment performs an operation including the following steps.

  From the network device, the monitoring information of the plurality of sub-network devices to which the network device is connected is received including the identification information of the sub-network device in the object identifier (OID) of the notification message defined by SNMP (S101) ). The network device is a device that functions as an SNMP agent.

  The OID included in the notification message is analyzed, and from the identification information of the subnetwork device included in the OID, a device identifier uniquely identifying the monitoring target device, which is generated and assigned upon registration of the monitoring target device, is specified ( S102).

  Based on the association between the device identifier and the monitoring information indicated by the OID, the content of the monitoring information indicated by the OID is monitored and displayed as the monitoring information of the monitoring target device corresponding to the device identifier (S103).

As described above, in this embodiment, the SNMP agent includes the identification information of the subnetwork apparatus in the object identifier (OID) when notifying the SNMP manager of monitoring information on the subordinate apparatus. Therefore, it is possible to notify the SNMP manager of monitoring information on a device under the SNMP agent, and to distinguish and monitor the monitoring information of the device from the SNMP agent.
Second Embodiment
A second embodiment will be described with reference to the drawings.

  FIG. 4 is a block diagram showing the configuration of a second embodiment of the network monitoring system of the present invention.

  The second embodiment is a network monitoring system 2 that targets the open flow network 210 for monitoring.

  The monitoring system server 100 functions as an SNMP manager and is redundantly configured.

  The monitoring system client 300 can be connected to any of the redundantly configured monitoring system servers 100, and displays the monitoring information from the monitoring system server 100 on a screen to convey it to the operator.

  The open flow network 210 is a Hop by Hop type open flow network, and includes an open flow controller 200 and a plurality of open flow switches 220 connected thereunder. The open flow switches 220 are distributed and installed geographically (A area, B area, C area). The open flow controller 200 exchanges information with the open flow switch 220 by an open flow protocol. In FIG. 4, the open flow switch denoted by reference numeral 221 exemplifies that the open flow switch in which a failure has occurred.

  The monitoring system server 100 connects to the OpenFlow controller 200 functioning as an SNMP agent, acquires information necessary for monitoring in real time, and displays the monitoring information on the monitoring system client 300.

  The OpenFlow controller 200 notifies the monitoring system server 100 of the monitoring information of the OpenFlow controller 200 itself and the monitoring information collected from the OpenFlow switch 220 by SNMP Trap.

  For example, when the open flow controller 200 detects the occurrence of a failure in the open flow switch 221 by the open flow protocol, it notifies the monitoring system server 100 by using Trap. The contents of Trap defined by SNMP are shown in FIG.

  At this time, the IP address of the transmission source of Trap is set in the “Agent Address” field, and the set IP address is the IP address of the OpenFlow controller 200. Then, the monitoring information of the detected open flow switch 221 is set in the “Object Data” field. Information of multiple monitoring items can be set in the "Object Data" field ("Variable-bindings" field). The information in the "Variable-bindings" field of each monitoring item includes "OID (object identifier)" indicating the type of monitoring item and "Value" indicating the content thereof.

  After the monitoring system server 100 performs state change processing on the received Trap, the monitoring system server 100 transmits state change information as monitoring display information to the monitoring system client 300 logged in to the monitoring system server 100.

  The monitoring system client 300 performs processing processing for monitoring screens for monitoring display information (state change information) received from the monitoring system server 100 and performs screen display.

  The open flow controller 200 manages the state of each monitoring item of the device on an object (Object) basis by using a MIB (management information base) in which items to be monitored are organized in a tree structure. Then, an object identifier (OID) is assigned to each object. That is, the MIB defines which information is stored in an object to which which OID is assigned.

  Therefore, the OpenFlow controller 200 notifies the monitoring system server 100 of the Trap including the OID specifying the object to be notified and the value (Value) of the object of the OID. OIDs are expressed as numbers separated by periods. Each numerical value separated by a period has a tree structure having a hierarchical structure corresponding to setting information of the MIB.

  Also, MIBs include "standard MIB", which is an MIB defined by RFC, and "private MIB", which is uniquely expanded by vendors (enterprises, organizations, and individuals).

  The standard MIB is defined in RFC1213 and contains an object that holds general management information in the IP protocol. Thus, most network devices that support SNMP support standard MIBs. The standard MIB is assigned an OID of “1 · 3 · 6 · 1 · 2 (mgmt) · 1 (mib−2)”.

  On the other hand, the private MIB is assigned an OID of “1. 3. .1.4 (private) .1 (enterprises)” family. In the private MIB, each vendor or the like defines its own management information by OID specified under "1.3.6.1.4.1". For example, under "1.3.6.1.4.1", a dedicated group such as a vendor is defined by "PEN: private enterprise numbers". Furthermore, unique information different from product to product uniquely defined by the group is defined thereunder.

  In the present embodiment, the OpenFlow controller 200 defines the identification information of the subordinate OpenFlow switch 220 using a number given to the end of the OID of the private MIB. That is, the OpenFlow controller 200 includes the identification information of the subordinate OpenFlow switch 220 in the Trap as an OID in the form of “1.3.6.1.4.1. PEN.PEN specific definition information. Identification information”. And notify the monitoring system server 100.

  As described above, in the present embodiment, the OpenFlow controller 200 that detects the occurrence of a failure in the subordinate device sets the IP address of the own device and monitors the Trap in which the identification information of the subordinate device is included in the OID. The system server 100 is notified. Then, the identification information of the subordinate device is specified by the number given to the end of the OID of the private MIB.

  Next, the configuration of the monitoring system server 100 functioning as an SNMP manager will be described with reference to FIG.

  FIG. 6 is a block diagram showing a configuration of a monitoring system server 100 which is a monitoring device of the second embodiment.

  The monitoring system server 100 is roughly divided into three blocks of a GW (gateway) unit 110, a common unit 120, and a screen unit 130. The GW (gateway) unit 110, the common unit 120, and the screen unit 130 correspond to the monitoring information acquisition unit 11, the monitoring information mapping unit 12, and the monitoring screen display unit 13 in the first embodiment, respectively.

  The GW unit 110 includes an SNMP GW unit 111 and a state change determination unit 112, and the SNMP GW unit 111 interfaces with the OpenFlow controller 200, which is an SNMP agent, to collect monitoring information events by SNMP. The state change determination unit 112 determines the presence or absence of a state change of the received monitoring information event.

  The common unit 120 executes a process of processing state change information reported as a monitoring information event into monitoring display information for monitoring display.

  The common unit 120 includes an event mapping unit 121, an alarm management unit 122, a GUI (Graphical User Interface) management unit 123, a configuration information DB (database) 124, and a state change history DB (database) 125.

  The event mapping unit 121 performs a mapping process of associating the monitoring information event determined as having the status change by the GW unit 110 with the configuration information related to the monitoring information managed by the monitoring system. In the mapping process, a configuration information database 124 described later is referred to.

  The alarm management unit 122 performs alarm identification in accordance with the degree of importance of the monitoring information event.

  The configuration information DB 124 is a database that manages configuration information related to a network managed by the monitoring system. The hierarchical model of the device configuration information described with reference to FIG. 7 is included.

  The state change history DB 125 is a database that accumulates up to a specified number of state change histories of the monitoring information event determined to have occurred state change.

  The GUI management unit 123 reconfigures the content of the monitoring information event to which the associated device name and alarm type are added into a format for screen display on the operator, and outputs the result as monitoring display information to the screen unit 130.

  The screen unit 130 includes a screen application unit 131 that outputs the monitoring display information processed by the common unit 120 to the monitoring system client 300.

  The device configuration information managed by the configuration information DB 124 will be described with reference to FIG.

  FIG. 7 is a diagram showing a hierarchical model of device configuration information managed by the configuration information DB 124 of the monitoring system server 100. As shown in FIG.

  The device configuration information is information generated for each monitoring target device registered when operating the monitoring system. A plurality of pieces of monitoring item information are linked under device information of one registered monitoring target device. In FIG. 7, monitoring item information 12411 to monitoring item information 1241 n (n is a natural number) are linked under the device information 1241.

  The device information 1241 includes information of a device identifier (device ID), an IP address, an SNMP community, and hostname (host name).

  The device ID is an identifier that makes it possible to uniquely identify the monitoring target device, and is assigned when the monitoring target device is registered.

  The IP address is the device or an IP address associated with the device. When the device is the open flow controller 200, it is the IP address of the open flow controller 200. Also in the case of the open flow switch 220 connected to the device under the control of the open flow controller 200, the IP address of the open flow controller 200 to which the open flow switch 220 is connected.

  As described above, in the present embodiment, the parameter serving as the unique key for identifying the device is the device ID, and the IP address is not the unique key. This makes it possible to assign the same IP address to a plurality of pieces of device information.

  The SNMP community and the hostname are data of parameters defined by SNMP. A community refers to a network range in which there is a host that views management information using an SNMP manager. The community name is used for authentication in communication with the SNMP agent.

  As each item of monitoring item information, a monitoring item name in the device specified by the device ID and a trap condition for detecting a change in the state of the monitoring item are set. The trap condition is specified by the OID included in the Trap and the Value indicating the value of the object of the OID.

  Further, the configuration information DB 124 includes, besides the above-described device configuration information, information that links the OpenFlow controller 200 with the OpenFlow switch 220 under control.

  For example, the information includes the information associated with the device ID described above, the IP address of the OpenFlow controller 200, and the identification information of the OpenFlow switch 220 under control. The identification information of the open flow switch 220 is identified by a number given to the end of the OID of the private MIB included in the Trap received from the open flow controller 200.

  It also includes information in which the open flow controller 200 and the open flow switch 220 identified by the device ID described above are associated with the installation area. Furthermore, the open flow controller 200 or the open flow switch 220 specified by the device ID described above may be associated with information indicating the operation state (during operation / under construction).

  With the above configuration, even a Trap notified from one Open Flow controller 200 can be identified as a monitoring item of the Open Flow switch 220 subordinate to the Open Flow controller 200 by the identification information included in the OID.

  Next, the operation of the monitoring system server 100 will be described.

  FIG. 8 is a flow chart showing the operation of the monitoring system server which is the monitoring device of the second embodiment of the present invention.

  In the monitoring system server 100 shown in FIG. 6, when the SNMP GW unit 111 receives the Trap from the open flow controller 200, it analyzes the received Trap. Then, the information included in the Trap is processed into a predetermined format, and the state change determination unit 112 is notified of the occurrence of the event of the monitoring information (S201).

  The state change determination unit 112 performs a process of comparing the event notified from the SNMP GW unit 111 with the current state information grasped by the GW unit 110, and generates a state change event if there is a difference in state. It transmits to the event mapping part 121 (S202).

  When the event mapping unit 121 receives the state change event from the state change determination unit 112, the event mapping unit 121 performs a mapping process that specifies a monitoring item to which the notified condition corresponds and associates the monitoring item with configuration information (S203).

  In the mapping process, the event mapping unit 121 refers to the configuration information DB 124 and uses the above-described apparatus configuration information and other association information. For example, the device ID of the monitoring target device is specified by the IP address of the open flow controller 200 included in the trap and the identification information of the open flow switch 220 under the open flow controller included in the OID of the trap. Then, in the device configuration information related to the specified device ID, the identification of the monitoring item name and the state change thereof are associated with the OID included in the Trap and the value (Value) of the object of the OID. Furthermore, the event mapping unit 121 associates installation area information on the specified device ID.

  The monitoring information event for which the mapping processing using the device ID as a key in the event mapping unit 121 has been performed is sent to the alarm management unit 122.

  The alarm management unit 122 determines the importance of the alarm related to the monitoring information event received from the event mapping unit 121 (S204). The alarm management unit 122 notifies the process to the necessary process according to the alarm importance, adds a time stamp when the log of the monitoring information event is generated, and stores it in the state change history DB 125 (S205). In addition, the alarm management unit 122 sends the monitoring information event to which the alarm type is also added to the GUI management unit 123.

  When receiving the monitoring information event from the alarm managing unit 122, the GUI managing unit 123 notifies the screen application unit 131 of the contents of the monitoring information event in a predetermined message format. The monitoring information event is subjected to mapping processing using the device ID as a key, and an alarm type is further added.

  The screen application unit 131 distributes the monitoring information event received from the GUI management unit 123 to the monitoring system client 300 (S206).

  In the monitoring system client 300, the event mapping unit 121 displays the result of the mapping processing using the device ID as a key, and the alarm type determined by the alarm management unit 122 on the screen.

  In the above description, the trap notified from the open flow controller 200 has been described, but the same processing is performed for monitoring information collected by polling by Get Request or the like. In response to GetRequest, GetResponse is returned from the open flow controller 200 to the monitoring system server 100. The OID included in GetResponse also includes identification information of the open flow switch 220 under the open flow controller.

  Next, an example of a monitoring screen displayed on the monitoring system client 300 in the present embodiment will be described.

  FIG. 9 and FIG. 10 are diagrams showing an example of a monitoring screen displayed on the monitoring system client 300.

  FIG. 9 is an example of a monitoring screen in which monitoring items are displayed hierarchically, and FIG. 10 is a view showing an example of a monitoring screen in which the installation area of the monitoring target device is geographically displayed.

  In FIG. 9, the monitoring screen (tree screen) has a tree structure capable of hierarchically displaying an installation area, an apparatus name, and a monitoring item, which are objects to be monitored. Each object (item) in the tree indicates the monitoring status in color, and when the status of the monitoring item changes, it changes to a previously specified status color in real time.

  In FIG. 9, “PFC01” 301 is an object representing the device state of the open flow controller, and corresponds to the device information 1241 in the device configuration information described in FIG. Reference numeral 303 denotes an object indicating each monitoring item of “PFC01” 301. These correspond to the monitoring item information 12411 to 1241 n in the device configuration information described in FIG. 7. The location where “PFC01” 301 is installed is indicated by “Tokyo” 306 of the area object, and the upper hierarchy of the tree belongs to the area hierarchy “Tokyo”.

  The monitoring item object indicated by the reference numeral 303 is mapping defined based on monitoring information notified from Trap "PFC01" 301 or polling collected by GetRequest or the like and information on alive monitoring by ping polling. Then, “PFC01” 301 is defined in the device object as a device having these monitoring items.

  “PFC01” 301 comprehensively displays the state of the monitoring item object indicated by reference numeral 303. When a failure occurs in any of the monitoring item objects indicated by reference numeral 303, the failure status is summarized and displayed in the same color as the status color of the failure severity. In addition, when multiple failures of different importance occur, the color of the highest importance is displayed.

  In FIG. 9, "PFS 12" 302 is an object that represents the device status of the open flow switch. The place where “PFS 12” 302 is installed is indicated by “Nagoya” 307 of the area object, and the upper hierarchy of the tree belongs to the area hierarchy “Nagoya”.

  Reference numerals 304 and 305 are objects representing monitoring items of “PFS 12” 302. These monitor item objects are mapping definitions based on monitor information notified from the open flow controller “PFC 01” 301 by Trap or polling collected by GetRequest or the like and information on alive monitoring by ping polling.

  Then, the “PFS 12” 302 comprehensively displays the status of these monitoring item objects. If a failure occurs in any of the monitoring item objects indicated by reference numerals 304 and 305, the failure status is summarized and displayed in the same color as the status color of the failure severity. In addition, when multiple failures of different importance occur, the color of the highest importance is displayed.

  Both the monitoring item object indicated by reference numeral 303 and the monitoring item objects indicated by reference numerals 304 and 305 are based on the information acquired from “PFC01” 301 which is the open flow controller. However, the monitoring system server 100 identifies the device corresponding to the information acquired as the device ID as key information. Therefore, in spite of the information acquired from the “PFC01” 301 which is the same device, the “PFC01” 301 and the “PFS12” 302 are displayed separately.

  FIG. 10 is a diagram showing an example of a monitoring screen on which the installation area of the monitoring target device is geographically displayed. The monitoring screen (map screen) has a map structure capable of geographically representing bases where the devices to be monitored are disposed. In FIG. 10, “Tokyo” and “Nagoya” of the area object are illustrated with the same reference numerals 306 and 307 as in FIG. 9, respectively.

  Each base object (item) on the map indicates the monitoring status of the device under the base, and when a status change occurs, it changes in real time to a previously designated status color.

  In FIG. 10, the status color indicates that a status change has occurred in the monitoring item of the device installed in the area object “Nagoya” 307. That is, even if the information acquired from the open flow controller disposed in the Tokyo area, the monitoring system server 100 identifies the apparatus corresponding to the information acquired by using the apparatus ID as the key information, and displays it as a fault in the Nagoya area doing.

  For example, comparing the configuration of the network monitoring system described with reference to FIG. 4 with FIGS. 9 and 10, the open flow controller 200 corresponds to “PFC 01” 301 and the open flow switch 221 corresponds to “PFS 12” 302. Do. The A area corresponds to the area object "Tokyo" 306, and the B area corresponds to the area object "Nagoya" 307. The processing described above is executed by the monitoring system server 100 for the fault information notified from the open flow switch 221 via the open flow controller 200. Then, as a result of the processing, it is displayed on the screen of the monitoring system client 300 that it is a failure of the open flow switch 221 (“PFS12” 302) installed in the B area (“Nagoya” 307 of the area object).

  As described above, the present embodiment can notify the SNMP manager of monitoring information on a device under the control of the SNMP agent, and monitor and display the monitoring information of the device separately from the SNMP agent.

  That is, in the present embodiment, the OpenFlow controller, which is an SNMP agent, defines the identification information of the subordinate OpenFlow switch using a number assigned to the end of the OID of the private MIB. Therefore, the monitoring system server, which is the SNMP manager, can analyze the notified Trap to specify the device ID that can uniquely identify the monitoring target device assigned at the time of registration of the monitoring target device. And, even if it is Trap notified from one Open Flow Controller using the device configuration information based on the device ID and other association information, the monitoring system server must identify it as the monitoring item of the Open Flow switch under it. Can. Therefore, by associating the device ID with the information indicating the open flow switch operation status (during operation / construction) specified by the device ID, the status change related to the specific open flow switch under construction suppresses the monitoring display. It is also possible to perform control such as

  In the embodiment described above, the SNMP agent is described as an open flow controller, and the subnetwork under the control is an open flow network. However, the present invention is not limited to this, and it may be a monitoring network in which an SNMP agent is a network control device capable of controlling a subnetwork composed of a plurality of subnetwork devices. The network control apparatus communicates with each subnetwork apparatus constituting the subnetwork by a protocol in the subnetwork to collect monitoring information of the subnetwork apparatus. Then, as in the above-described embodiment, the network control apparatus can communicate with the monitoring system server by SNMP to notify monitoring information of each subordinate subnetwork apparatus. Then, the notified monitoring information is displayed by the monitoring system server to distinguish between the network control device and the subordinate network devices under it.

  For example, it may be a monitoring system for a wireless local area network (LAN) network. A wireless LAN access point device wirelessly connected to a wireless LAN terminal may be deployed as a subnetwork, and a wireless controller managing a plurality of access point devices may be connected to a monitoring system server (SNMP manager) as an SNMP agent.

1, 2 Network Monitoring System 10 Monitoring Device 11 Monitoring Information Acquisition Means 12 Monitoring Information Mapping Means 13 Monitoring Screen Display Means 20 Network Device 21 Subnetwork 22 Subnetwork Device 100 Monitoring System Server 200 Open Flow Controller 210 Open Flow Network 220, 221 Open Flow switch 300 Monitoring system client 110 GW unit 111 SNMP GW unit 112 State change judgment unit 120 Common unit 121 Event mapping unit 122 Alarm management unit 123 GUI management unit 124 Configuration information DB
125 Status change history DB
130 screen part 131 screen application part 1241 device information 12411, 121, 421, ... 1241 n monitoring item information

Claims (10)

Connect the open flow switch under the collected monitoring information of the open flow switch, the SNMP (Simple Network Management Protocol) object identifier indicating the type of the monitoring information notification message defining (OID), the open flow An OpenFlow controller that functions as an SNMP agent that notifies including switch identification information;
The monitoring target device generated and added when registering the monitoring target device from the identification information of the open flow switch included in the OID by analyzing the OID included in the notification message notified from the open flow controller Device identifier that uniquely identifies the device ID, and based on the association between the device identifier and the monitoring information indicated by the OID, the content of the monitoring information indicated by the OID as monitoring information of the monitoring target device corresponding to the device identifier An open flow network monitoring system comprising: a monitoring device that functions as an SNMP manager that monitors and displays. The identification information of the open flow switch is specified by a number given at the end of the OID which defines a private MIB (Management Information Base: Management Information Base) uniquely extended by a company, an organization or an individual. The open flow network monitoring system according to claim 1. The monitoring device includes device configuration information indicating an association between the device identifier and the content of monitoring information indicated by the OID, and the open source IP address of the notification message included in the notification message and the open included in the OID The device identifier is identified based on the identification information of the flow switch , and the monitoring information of the monitoring information indicated by the OID is referred to by referring to the device configuration information as monitoring information of the monitoring target device corresponding to the identified device identifier. The open flow network monitoring system according to claim 2, characterized in that: From an open flow controller functioning as SNMP (Simple Network Management Protocol) agent, the monitoring information of the open flow switch collected from a plurality of open flow switches the open flow controller connected under the notification message SNMP defines Monitoring information acquisition means for receiving an object identifier (OID) indicating the type of monitoring information including identification information of the open flow switch ;
A device identifier uniquely identifying the monitoring target device, which is generated and assigned at the time of registration of the monitoring target device by analyzing the OID included in the notification message and identifying information of the open flow switch included in the OID Monitoring information mapping means for specifying and associating the device identifier with the monitoring information indicated by the OID;
Monitoring screen display means for monitoring and displaying the contents of the monitoring information indicated by the OID as monitoring information of a monitoring target device corresponding to the device identifier based on the association between the device identifier and the monitoring information indicated by the OID;
A monitoring device comprising The identification information of the open flow switch is specified by a number given at the end of the OID which defines a private MIB (Management Information Base: Management Information Base) uniquely extended by a company, an organization or an individual. The monitoring apparatus according to claim 4, wherein The monitoring information mapping means uses apparatus configuration information indicating association between the device identifier and the content of monitoring information indicated by the OID, an IP address of the open flow controller , and identification information of the open flow switch as the device identifier. A configuration information database including information to be associated is provided, and referring to the configuration information database, based on the transmission source IP address of the notification message included in the notification message and the open flow switch identification information included in the OID. 6. The monitoring device according to claim 5, wherein the device identifier is identified, and the content of the monitoring information indicated by the OID is monitored and displayed as monitoring information of a monitoring target device corresponding to the identified device identifier. The configuration information database includes information that associates information indicating the operation state of the OpenFlow switch corresponding to the device identifier with the device identifier, and the monitoring information mapping unit associates the open flow corresponding to the identified device identifier 7. The monitoring apparatus according to claim 6, wherein the monitoring display of the contents of the monitoring information indicated by the OID is suppressed when the operation state of the switch is under construction. On the computer
From an open flow controller functioning as SNMP (Simple Network Management Protocol) agent, the monitoring information of the open flow switch collected from a plurality of open flow switches the open flow controller connected under the notification message SNMP defines A monitoring information acquisition function of receiving an object identifier (OID) indicating the type of monitoring information including identification information of the open flow switch ;
A device identifier uniquely identifying the monitoring target device, which is generated and assigned at the time of registration of the monitoring target device by analyzing the OID included in the notification message and identifying information of the open flow switch included in the OID A monitoring information mapping function that identifies and associates the device identifier with the monitoring information indicated by the OID;
Based on the association between the device identifier and the OID indicates monitoring information, the monitoring screen display function for displaying monitoring the contents of the monitoring information OID indicates as the monitoring information of the monitoring target device corresponding to the device identifier,
A monitoring program that makes it possible to realize . The identification information of the open flow switch is specified by a number given at the end of the OID which defines a private MIB (Management Information Base: Management Information Base) uniquely extended by a company, an organization or an individual. The monitoring program according to claim 8, wherein.   The monitoring information mapping function uses, as the device identifier, device configuration information indicating an association between the device identifier and the content of the monitoring information indicated by the OID, an IP address of the OpenFlow controller, and identification information of the OpenFlow switch. The device identifier is specified based on the transmission source IP address of the notification message included in the notification message and the identification information of the OpenFlow switch included in the OID with reference to a configuration information database including information to be associated, 10. The monitoring program according to claim 9, wherein the content of the monitoring information indicated by the OID is monitored and displayed as the monitoring information of the monitoring target device corresponding to the identified device identifier.

Images