KR100887874B1 - System for managing fault of internet and method thereof - Google Patents

Abstract

The present invention relates to a failure management system and method of the Internet network for analyzing the correlation between events occurring in the Internet network to find the cause of the failure and to take necessary measures. Provides reliable Internet service from the network operator's point of view by taking immediate action in case of situations that interfere with the provision of Internet service according to the result by analyzing the correlation between the received events and the received events. This is possible, and through this stable Internet communication service, there is an effect of increasing the quality of service.

Description

System for managing fault of internet network and method thereof

1 is a block diagram of a failure management system of the Internet network according to the present invention.

FIG. 2 is a detailed configuration diagram of the event management unit of FIG. 1.

The present invention relates to a failure management system and method of the Internet network, and more particularly, a failure management system of the Internet network to find the cause of the failure by analyzing the correlation between the events occurring in the Internet network and to take necessary measures And to a method thereof.

In general, the Internet network consists of at least tens to hundreds of routers and switches.

Through such an internet network, in order to ensure stable Internet service provision, failure monitoring of the routers and switches is essential, and when an abnormal situation is detected through their failure monitoring, immediate action should be taken.

The management of the Internet network is performed by providing a trap message to the network management system when a Simple Network Management Protocol (SNMP) Agent included in devices connected to the network detects an abnormal state of the device.

This is a way for the network management system to passively grasp the abnormal condition of the device based on the trap message provided by the SNMP agent installed in the device. The active method by the network management system periodically monitors the device status using SNMP. It is a way to find out the abnormal situation of the device by searching.

However, since the former method is based on User Datagram Protocol (UDP), which does not guarantee reliability by default, it cannot guarantee that trap messages are correctly transmitted from the device connected to the Internet network to the network management system. It is difficult to accurately monitor faults of devices by the management system.

In the latter method, since the network management system needs to periodically search for the state of a large number of devices, there is a problem in that it is difficult to identify an accurate network failure state due to a large load on the network management system and a long search period.

In addition, when the network management system receives a large number of events or trap messages simultaneously occurring from multiple routers and switches, it is difficult to determine the exact cause by the operator without the accurate diagnosis function.

In other words, SNMP operates based on UDP which does not guarantee the reliability of data transmission. Therefore, the SNMP agent mounted on the device transmits a trap message for notifying an abnormal situation of the device and notifying the network management system of the situation. In many circumstances, trap messages are often lost for various reasons.                         

In addition, the loss of trap messages is very serious in terms of network management systems or Internet network managers, since it is nearly impossible for a few operators to gain direct access to hundreds of routers and devices to determine the status of the device.

Therefore, although fault management by a network management system is essential, there is a problem in that a trap message through SNMP mounted on a device constituting the Internet network is hardly managed correctly due to frequent loss.

In order to solve the above problems, an object of the present invention is to analyze and process all events occurring in the various devices of the Internet network to integrate management of the failure of the Internet network.

To this end, in the failure management system of the Internet network according to the present invention, in the failure management system of the Internet network for managing the failure of the device configured in the Internet network, a failure management policy having a rule for processing the failure information and events of the device Storage unit; A trap message management unit for transferring a trap message of a device according to a processing rule; An equipment state management unit for collecting a state of a device according to a processing rule; A ping manager that manages reachability of any section and any device belonging to the Internet network periodically using a ping according to a processing rule; A system log manager configured to collect system log data of the device according to a processing rule; And an event management unit receiving event messages from the trap message management unit, the device state management unit, the ping management unit, and the system log management unit, respectively, and analyzing the correlations between the event messages.

In addition, the fault management method of the Internet network according to the present invention, in the fault management method of the Internet network using the event message for the failure of the device configured in the Internet network, the failure status of the device, the status of the device, the system log message of the device And receiving and storing information on the reachability of the device using the ping as an event message, respectively. Performing at least one filtering of filtering of duplicated events among the event messages and filtering for a predefined unnecessary event; Analyzing the filtered event messages; And notifying the analyzed result.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a failure management system of the Internet network according to the present invention.

As illustrated, the failure management system 100 includes a failure management policy database 300 that stores rules and principles for various matters for failure management, and a device 810 through which is connected to the failure management system 100 through the Internet. The trap message management unit 500 that receives and processes the trap message in real time by the SNMP agent installed in the device 830, searches for a failure monitoring target based on the network shape information, and directly uses the SNMP state of the devices 810 to 830. Equipment state management unit 400 for searching for and processing the PING management unit 700, the apparatus (810 to 830) to periodically identify and manage the reachability of any section or any port in the Internet network using the PING The system log management unit 600 collects, analyzes and manages the system log data, which records the configuration change history and the operation details in detail, and the state of such equipment. Collects various event messages provided by the resource unit 400, the trap message management unit 500, the system log management unit 600, and the PING management unit 700, and analyzes correlations between them to determine the root cause of the failure. And an event management unit 200 which notifies an operator by assigning a severity according to the ripple effect of each failure cause.

Here, the failure management policy database 300 is the equipment state management unit 400, trap message management unit 500, the system log management unit 600 and the PING management unit 700, respectively, failure information or events of the devices (810 to 830) It stores all the rules that are processed.

For example, a failure management policy for the PING management unit 700 may include a list of target devices (routers, ports of routers, etc.) to check reachability through PING, and a period of checking reachability through PING (eg, 5 minutes 10 Minutes, etc.), the PING management unit 700 checks the reachability once every designated period for only the devices 810 to 830 specified in the failure management policy database 300.

2 illustrates a detailed configuration of the event manager 200 of FIG. 1.

The event manager 200 may include a trap queue 220 for storing trap messages, a network status queue 222 for storing state information of network devices, a system log queue 224 for storing system log messages, and a PING status message. The state of the device received from the PING status queue 226 to store, the trap event receiver 210 to receive the trap message received from the trap message management unit 500 and to store it in the trap queue 220. A status receiver 212 for storing information in the network status queue 222, a system log receiver 214 for receiving various system log messages received from the system log manager 600 and stored in the system log queue 224, and a PING manager. PING status receiver 216, trap queue 220, network status queue 222, system log queue 224 and PING to receive the reachability information of the device received from the 700 and stored in the PING status queue 226 Event messages stored in status queue 226 Reads the event to determine whether or not the duplicate occurrence of the event to process only the event that occurred initially, and ignores the same event subsequently occurred, the event duplicate processing unit 230, the event duplicate processing unit 230 stores the event determined whether the duplicate An event log 232, an event filter policy database 242 storing filtering rules, and an event performing a filtering function with reference to the event filter policy database 242 for the event message delivered by the event duplication processor 230. Filter processing unit 240, an event correlation database 252 for storing rules for correlation analysis of events, an internet network shape information database 254 for storing network configuration information of the Internet, an event correlation database 252 Filter processing unit with reference to the network configuration information database 254 The event correlation unit 250 analyzes the correlation between the events received from the 240 and finds the root cause of the occurrence of the event, and the event notification unit notifying the corresponding system of the result of the event correlation analyzer 250 ( 260.

The trap event receiver 210 receives the various trap messages collected by the trap message manager 500 from a device on the Internet network and stores them in the trap queue 220.

In addition, the state receiving unit 212 receives the state information of the device collected by the equipment state management unit 400 from the Internet network device and performs the function of storing in the network state queue 222.

In addition, the system log receiver 214 receives various system log messages collected by the system log manager 600 from the Internet network device, and stores them in the system log queue 224, and the PING state receiver 216 is a PING manager 700. ) Receives the reachability information collected by accessing the Internet network device and stores it in the PING status queue 226.

The trap queue 220, the network status queue 222, the system log queue 224, and the PING status queue 226 have a frequency of occurrence of events occurring from the network device than the event management unit 200 can handle. It is a buffer device to prevent the loss because it occurs a lot, it has the characteristic that the event entered into the queue first.

The trap event receiver 210, the state receiver 212, the system log receiver 214, and the PING state receiver 216 perform only a function of receiving various event messages and storing them in a corresponding queue.

Then, the event duplication processing unit 230 reads the event messages present in the various queues from the queue to determine whether there is a duplicate event, and processes only the first event that occurred in the event of the duplicate event, and subsequently the same events Ignore it.

This is to improve the performance of the event management unit 200 of the failure management system 100.                     

The event duplication processor 230 reads messages from various queues, stores them in the event log 232, and removes them from the queue.

If an event message read from the queue is already stored in the event log 232, the event message is not stored in the event log 232 but deleted only in the queue.

Thereafter, the event duplication processor 230 transmits the corresponding event to the event filter processor 240.

The event filter processor 240 performs a filtering function on the event message delivered by the event duplicate processor 230.

Filtering is to improve the performance of event processing by ignoring events that are not needed in the failure management system 100 of the Internet network, and to improve the efficiency of diagnosing network failure states by highlighting important events and ignoring non-critical events. will be.

Rules for filtering may be defined at the time of configuring the failure management system 100 or may be changed at any time by the operator during operation of the failure management system 100, and these rules are stored in the event filter policy database 242.

The event filter processor 240 receives an event provided by removing the redundancy of the event from the event duplicate processor 230 and ignores and processes an event that needs to be ignored according to a rule stored in the event filter policy database 242. Important events that need to be forwarded are delivered to the event correlation analyzer 250.                     

The event correlation analyzer 250 receives various event messages generated from the network device from the event filter processor 240 to identify correlations between these events and to find the root cause of the event occurrence.

The event correlation analyzer 250 specifies the severity of the received event and notifies the operator so that the operator can immediately take action according to the severity type.

At this time, the severity is divided into five levels of serious, important, warning, general and release.

A severity is specified when the ripple effect of the event is an event that will prevent more than one Internet subscriber from being provided with Internet service, an importance is assigned when an individual Internet subscriber is not available, and a warning is given for the current Internet. This is not a problem for service use, but it is designated for an event that may cause a disruption in the Internet service provision in the near future if the current state persists, and the general is not an event that impedes the use of the Internet service, but the operator should be aware of it. In the event of a necessary event, the cause of the event, designated as critical, critical, or warning, is closed and the failure is recovered (if the previous severity is critical and critical), or the possibility of a failure is eliminated (the previous severity is alerted). Is specified in the

Therefore, the severity of the event allows the operator to immediately recognize the ripple effect caused by the occurrence of the event and to easily take action on the event, even if only the severity of the event is viewed.                     

In this case, the severity of the occurrence event may be immediately determined only by looking at the individual event, and is divided into two severity is determined through the analysis of the trend of the event occurred so far.

If the severity is immediately determined even by viewing individual events, the severity is assigned according to the following rules.

(Rule 1) If a down trap message of a port affecting one subscriber has occurred, and the status of the same port has been normal before, assign "important".

(Rule 2) If the up trap message of the port affecting one subscriber has occurred, and the state of the same port was previously down, assign "revocation".

(Rule 3) Allocating a "warning" when a performance degradation message has occurred for a port affecting one subscriber, and the status of the same port was normal.

(Rule 4) Allocate a "revocation" if a degraded recovery message has occurred for a port that affects one subscriber, and if the status of the same port was previously degraded.

(Rule 5) If a node down message has occurred for a router or switch, which is an Internet device, and the status of the same node has been normal, assign "severe".

(Rule 6) If a node up message has occurred for a router or switch that is an internet device, and the status of the same node was down before, assign "cancellation".

However, in order to grasp the ripple effect of individual events, the severity of each event occurrence location must be considered.                     

To do this, it is necessary to analyze the correlation between the network shape information of the Internet with the location of the event to determine the exact ripple effect of the event.

The Internet network shape information database 254 is a database that stores network configuration information of the Internet. The Internet network shape information database 254 includes a router, a list of ports installed in routers, and connection shape information between routers.

Correlation analysis of events related to such Internet network configuration information is performed according to the following rules.

(Rule 7) Allocating an "termination" if an uptrap message on a port that affects more than one subscriber has occurred and previously the state of the same port is down.

(Rule 8) Allocating a "severe" if a down trap message has occurred on a port that affects more than one subscriber, and the status of the same port has been normal previously.

(Rule 9) If two or more port down events occur and the port belongs to the same node, if the node containing the port is in a normal state, assign a "severe" to the individual port down event.

(Rule 10) If two or more port down events occur, and the port belongs to the same node, if the state of the node containing the port is down, the individual node down event is ignored and an event called "node down" instead of the port down event. Raise a new message and assign it a "serious" message.

(Rule 11) If two or more port up events occur and the port belongs to the same node, if the node containing the port is in a normal state, assign "release" to the individual port up event.

(Rule 12) If two or more port up events occur and the port belongs to the same node, the individual port up event is ignored if the node containing the port has failed.

(Rule 13) If a port down event or a node down event occurs, but the port or node is not connected to another port or node in the Internet configuration information, the event is ignored.

In addition, event messages collected through SNMP traps and event messages collected through system log analysis are treated as a single event, but reachability to devices or ports collected through PING and devices collected through SNMP-Get Or state information about a port is collected periodically.

Here, collecting the status information through SNMP-Get means that the equipment status manager 400 periodically collects network status information directly using SNMP.

Since this information is not an event message generated in real time by the network device, the information becomes a device state of the past by information collection cycle (eg, 5 minutes, 10 minutes, etc.) rather than an event reflecting the recent network state.

Therefore, in order to process them, they are processed according to the following rules.

(Rule 14) When the reachability event by PING is received, the event correlation analyzer 250 ignores the event if the previous state is "no" when the reachability is "no", If the status is "Yes", the device status manager 400 is requested to query the current status of the corresponding equipment. If the status is down, the device (node or port) down event is generated. If the status is normal, the event is ignored. .

(Rule 15) If the status of a device (node or port) collected by SNMP-Get is down, the event correlation analyzer 250 informs the PING management unit 700 of the possibility of reaching the port or node by PING. Request to check, if the result is reachable, ignore the down event message; if the result is unreachable, send down message.

In accordance with such a rule, the event correlation analyzer 250 analyzes the correlation between the events, assigns the severity for the corresponding event, and finds the root cause of the event to generate a new event that can be easily identified by the operator. Send to event notification unit 260.

Then, the event notification unit 260 notifies the corresponding system of the generated event for each event.

The event notification unit 260 manages " system location and system name " to accurately transmit an event to a system in need thereof.

In addition to the other systems, all events that occur to the management operation unit of the Internet network is transmitted.

By using the failure management system 100 as described above it is possible to manage the failure of a large-scale Internet network, thereby providing a stable Internet service.

As described above, the present invention receives all events generated by the device and analyzes the correlations between the received events to determine the exact cause, and immediately in case a situation occurs that impedes the provision of the Internet service. By taking measures, it is possible to provide stable Internet service from the perspective of network operators, and the quality of service can be enhanced through such stable Internet communication service.

Claims (14)

In the failure management system of the Internet network for managing the failure of the device configured in the Internet network, A fault management policy storage unit having fault information of the device and a processing rule for an event; A trap message manager for transmitting a trap message of the device according to the processing rule; An equipment state manager to collect a state of the device according to the processing rule; A ping manager that manages reachability of any section and any device belonging to the Internet network periodically using a ping according to the processing rule; A system log manager configured to collect system log data of the device according to the processing rule; And And an event manager configured to receive event messages from the trap message manager, the device state manager, the ping manager, and the system log manager, respectively, and analyze correlations between the event messages. The method of claim 1, The device is equipped with an SNMP agent to provide a trap message, and the status of the device is provided using the SNMP protocol, the failure management system of the Internet network. The method of claim 1, The event management unit, the failure management system of the Internet network, characterized in that for processing each event message to a queue. The method of claim 1, The event management unit, the failure management system of the Internet network, characterized in that at least one of performing filtering of the duplicate event and filtering for the predefined unnecessary events. The method of claim 1, The event management unit, the failure management system of the Internet network, characterized in that to generate a severity according to a predefined multi-step type corresponding to at least one event message. delete The method of claim 1, The event management unit, Storage means for receiving various event messages provided by the trap message management unit, the equipment state management unit, the ping management unit, and the system log management unit, and storing them in individual queues corresponding to each unit; Event duplication processing means for first filtering event duplicates by reading event messages stored in said storage means; Event filtering means for performing secondary filtering of a predefined unnecessary event among the first filtered events; Event correlation analysis means for analyzing a correlation between the second filtered events; And And event notification means for notifying the corresponding system of the result of the event correlation analysis means. delete delete delete In the failure management method of the Internet network using the event message for the failure of the device configured in the Internet network, Receiving and storing information about a failure state of the device, a state of the device, a system log message of the device, and a reachability of the device using a ping as an event message, respectively; Performing at least one filtering of filtering of a duplicate event among the event messages and filtering for a predefined unnecessary event; Analyzing correlations of the filtered event messages; And And a method of notifying the analyzed result. The method of claim 11, And the filtering of the duplicated event and the filtering of the predefined unnecessary event are performed sequentially. The method of claim 11, And generating a severity according to a predefined multi-stage type in response to at least one or more of the event messages. delete

Images