Network failure analysis device and network failure analysis method

Abstract

To provide an operation service of a network, capable of realizing a previous solution of a defect of the network, or quickly coping with a failure when occurring by reducing the time for a countermeasure.SOLUTION: A network failure analysis device holds a log of a device constructing a network, monitoring data on the network, communication path information on the network, and inquiry information from a user, groups the inquiry information from the user on the basis of a rule patterned, obtains the communication path information of communication in regard to each inquiry information piece grouped on the basis of the device information contained in the inquiry information grouped, and acquires the log and the monitoring data contained before and after the time of the generation of a defect of the network on the basis of the device information corresponded to a node of a communication path of the communication path information.SELECTED DRAWING: Figure 22

Description

[Technical field]

[0001] The present invention relates to a network fault analysis device and a network fault analysis method, and more particularly to a method for extracting data necessary for dealing with a network fault, suitable for quickly and accurately dealing with the network fault, based on a user inquiry. [Background technology]

[0002] In recent years, with the shift to remote work, the increased use of mobile devices, and advances in technologies such as the fifth generation mobile communications system and Software Defined Network (SDN), there has been an increasing need for services that take over the operation of corporate networks and services that provide network operation functions.

[0003] In such network operation services, multiple means are often combined to monitor the network, and it is important to not only respond to failures and security incidents of individual network devices but also to maintain the quality of the network from the user's perspective by integrating the monitoring data and device operation logs obtained by multiple monitoring means. In this case, even if a network failure cannot be detected by individual monitoring, it is important to understand the network failure that is affecting users and to respond to the failure quickly.

[0004] Conventionally, a method for performing such network operation monitoring is disclosed, for example, in Patent Document 1. Patent Document 1 describes a network failure analysis system that estimates a failure in a network device by using the failure detection results of a business application and communication path information. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2014-239315 A Summary of the Invention [Problem to be solved by the invention]

[0006] According to the technology described in Patent Document 1, by estimating the occurrence of faults in overlapping network devices on the communication paths of each business application from the fault detection results of multiple business applications and communication path information, it is possible to shorten the response time to network malfunctions even if the fault is not clearly detected by monitoring the network devices.

[0007] However, when no obvious failure occurs in a business application, it is difficult to grasp the failure on the network, and it is not possible to shorten the time from the discovery of the failure to the response. Furthermore, the conventional technology does not suggest a means for effectively utilizing the inquiry information from users to analyze the cause of the network failure.

[0008] An object of the present invention is to provide a network fault analysis device and a network fault analysis method which, when providing a network operation service, effectively utilizes inquiry information from users, and can either solve network problems in advance or, when a fault occurs, reduce the time required for countermeasures and enable a rapid response. [Means for solving the problem]

[0009] The configuration of the network fault analysis device of the present invention is preferably a network fault analysis device that collects monitoring data from devices on a network or logs of devices that make up the network, and holds logs of the devices that make up the network, network monitoring data, network communication path information, and inquiry information from users, groups the inquiry information from users based on patterned rules, determines communication path information for communications related to each of the grouped inquiry information based on device information contained in the grouped inquiry information, and obtains logs and monitoring data related to the inquiry information from users based on device information corresponding to nodes of the communication path of the communication path information. Effect of the Invention

[0010] According to the present invention, it is possible to provide a network fault analysis device and a network fault analysis method that, when providing a network operation service, effectively utilizes inquiry information from users, and can either resolve network problems in advance or, when a fault occurs, reduce the time required for countermeasures and enable rapid response. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a system configuration diagram of a network failure analysis system. [Diagram 2] FIG. 2 is a functional configuration diagram of each component of the network fault analysis system. [Diagram 3] This is a hardware and software configuration diagram of each component of the network fault analysis system. [Figure 4] FIG. 11 illustrates an example of a device monitoring information table. [Diagram 5] FIG. 13 illustrates an example of a log management table of a network monitoring information DB. [Figure 6] 13 is a diagram showing an example of a log management table of a security monitoring information DB. FIG. [Figure 7] FIG. 13 illustrates an example of a service monitor information table. [Figure 8] 13 is a diagram illustrating an example of a log management table of a service monitor information DB. [Figure 9] FIG. 13 illustrates an example of an incident management table. [Figure 10] FIG. 13 illustrates an example of a configuration management table. [Figure 11] FIG. 13 illustrates an example of a model device information table. [Figure 12] FIG. 13 is a diagram illustrating an example of a model work information table. [Figure 13] FIG. 13 illustrates an example of a network performance information table. [Figure 14] FIG. 11 illustrates an example of a network performance index table. [Figure 15] FIG. 11 is a diagram illustrating an example of a communication path information table. [Figure 16] FIG. 16 is a diagram showing communication paths according to the data in the communication path information table of FIG. [Figure 17] FIG. 13 illustrates an example of an inquiry group information table. [Figure 18] FIG. 13 illustrates an example of a monitoring data group information table. [Figure 19] 13 is a flowchart showing a process of network performance analysis by an inquiry tendency analysis unit. [Figure 20] 13 is a flowchart showing an inquiry trend analysis process performed by an inquiry trend analysis unit. [Figure 21] FIG. 13 is a diagram showing an example of a grouping rule table for implementing query grouping rules; [Figure 22] 13 is a flowchart showing a related data collection process performed by a related data analysis unit. [Figure 23A] FIG. 13 is a diagram showing one example of a network failure analysis screen displayed on the operation terminal; [Figure 23B] FIG. 2 is a diagram showing an example of a network fault analysis screen displayed on an operation terminal; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, one embodiment of the present invention will be described with reference to FIGS. 1 to 23B.

[0013] This embodiment relates to a network fault analysis system that, when providing a network operation service, uses inquiry information from users suspected of having a fault to infer the occurrence of a malfunction, and based on the time information and communication path information, compiles highly relevant information from network monitoring and security monitoring alerts and logs and provides it to the operator, thereby enabling the operator of the network system to take countermeasures in advance when no obvious fault has occurred on the network, and, when a fault does occur, shortens the time required for countermeasures and enables a rapid response.

[0014] First, the configuration of a network fault analysis system according to an embodiment will be described with reference to FIGS.

[0015] The network failure analysis system 1 comprises a group of network devices 3 to be operated and a group of network analysis devices 2 .

[0016] The operation target network device group 3 includes a user terminal 20, a network device 21, a server 22, and a service environment 24. The operation target network device group 3 is connected to each other via a network NW1.

[0017] The network analysis equipment group 2 is an equipment group that provides network operation services, and includes an operation terminal 40, a network monitoring device 100, a security monitoring device 200, a service monitoring device 300, a service management device 400, and a network fault analysis device 500. The network analysis equipment group 2 is interconnected by a network NW2, and is also interconnected with a network NW1.

[0018] The network NW1 and the network NW2 may be a LAN (Local Area Network) or a global network such as the Internet, and may be a wired network or a wireless network such as Wifi.

[0019] Here, a user 10 is assumed to be an individual who performs business using a service environment 24 from a user terminal 20, and also an individual who uses the functions of a server 22. The number of users 10 may be one or two or more.

[0020] The user terminal 20 is an information processing device that the user 10 uses to use services, and is, for example, a smartphone, a tablet, a laptop PC, or a desktop PC.

[0021] The network device 21 is a device used for network communication, such as a switching hub or a router.

[0022] The server 22 is an information processing device that provides services such as a storage service, an application software execution service, a database service, a DNS (Domain Name System) service, a proxy service, and the like to the user terminal 20 as a client.

[0023] The service environment 24 is an environment that provides services such as storage services, application software execution services, and database services to the user 10 online via a network, via a service providing network 23, which is a so-called cloud environment. The difference with the server 22 is that the user 10 can use the services via the network without being aware of the internal configuration of the system.

[0024] The operator 30 is assumed to be a person who provides network operation services, and the number of operators 30 may be one or more. The operator 30 has the responsibility of referring to the information displayed on the operation terminal 40, investigating network failures, and dealing with network failures.

[0025] The operation terminal 40 is an information processing device used by the operator 30 when performing work, and is, for example, a smartphone, a tablet, a laptop PC, a desktop PC, etc. The operation terminal 40 displays monitoring results and the like for the operator 30. The user interface provided by the operation terminal 40 will be described later.

[0026] The network monitoring device 100 is an information processing device that performs network monitoring such as alive monitoring and status monitoring of the network devices 21 and log collection.

[0027] The security monitoring device 200 is an information processing device that monitors security incidents and enables automatic responses to security incidents. Here, a security incident refers to an unauthorized access from outside, data leakage to the outside, and the like.

[0028] The service monitoring device 300 is an information processing device that monitors the performance, such as the response time and throughput, of the service environment 24 when the service environment 24 is used from the user terminal 20 .

[0029] The service management device 400 is an information processing device that manages information such as inquiries from users, notifications from the network monitoring device 200, security monitoring device 300 and service monitoring device 400, and IP addresses of the user terminals 20, network devices 21 and servers 22 that are targets of monitoring.

[0030] The network failure analysis device 500 is a device that analyzes network failures based on the monitoring information and management information of various components on the network that have been described above, and on inquiry information related to the network.

[0031] The operation of the network fault analysis device 500 can be outlined as follows.

[0032] When a user 10 makes an inquiry to the service management device 400 and the inquiry is registered, the network fault analysis device 500 extracts and groups similar events from the inquiries managed by the service management device 400. Then, based on the time when the grouped inquiry events occurred and information on the communication paths related to the inquiry events, the network fault analysis device 500 extracts highly relevant data from the monitoring data managed by the network monitoring device 100, the security monitoring device 200, and the service monitoring device 300, and provides the data to the operator 30 via the operation terminal 40. The operator 30 can investigate the cause of the network failure based on the provided highly relevant data.

[0033] Next, the functional configuration of each component of the network fault analysis system will be described with reference to FIG.

[0034] In the following explanation using FIG. 2, the functional configuration of the network analysis device group 2 will be explained.

[0035] As shown in FIG. 2, the network monitoring device 100 has, as its functional components, a network monitoring unit 101 and a storage unit 102.

[0036] The network monitoring unit 101 is a functional unit that performs alive monitoring, status monitoring, and log collection of the network devices 21 and the servers 22, and manages the monitoring results and logs. Alive monitoring is performed, for example, by checking device responses using a ping command, and status monitoring is performed, for example, by checking the CPU and memory usage rates using Simple Network Management Protocol (SNMP) commands.

[0037] The storage unit 102 is a functional unit that stores data. The storage unit 102 stores a network monitoring information DB 110. The network monitoring information DB 110 is a database that stores various information managed by the network monitoring device 100. The network monitoring information DB 110 stores a device monitoring information table 111 and a log management table 112. Details of each table will be described later.

[0038] As shown in FIG. 2, the security monitoring device 200 has a security monitoring unit 201 and a storage unit 202 as functional components.

[0039] The security monitoring unit 201 is a functional unit that monitors security incidents and automatically responds to security incidents, and manages the monitoring results and logs.

[0040] The storage unit 202 is a functional unit that stores data. The storage unit 202 stores a security monitoring information DB 210. The security monitoring information DB 210 is a database that stores various information managed by the security monitoring device 200. The security monitoring information DB 210 stores a log management table 212. The details of the table will be described later.

[0041] As shown in FIG. 2, the service monitoring device 300 has a service monitoring unit 301 and a storage unit 302 as functional components.

[0042] The service monitoring unit 301 is a functional unit that executes performance monitoring and log collection for the service environment 24 used from the user terminal 20, and manages the monitoring results and logs.

[0043] The storage unit 302 is a functional unit that stores data. The storage unit 302 stores a service monitoring information DB 310. The service monitoring information DB 310 is a database that stores various information managed by the service monitoring device 300. The service monitoring information DB 310 stores a service monitoring information table 311 and a log management table 312. Details of each table will be described later.

[0044] As shown in FIG. 2, the service management device 400 has, as its functional components, a service management unit 401 and a storage unit 402.

[0045] The service management unit 401 is a functional unit that receives inquiries from the user 10 and notifications from the network monitoring device 100, the security monitoring device 200, and the service monitoring device 300, and manages information related to these notifications.

[0046] The storage unit 402 is a functional unit that stores data. The storage unit 402 stores a service management information DB 410. The service management information DB 410 is a database that stores various information managed by the service management device 400. The service management information DB 410 stores an incident management table 411 and a configuration management table 412. Details of each table will be described later.

[0047] As shown in FIG. 2, the network failure analysis device 500 has, as its functional components, an inquiry trend analysis unit 501, a related data collection unit 502, and a storage unit 503.

[0048] The inquiry trend analysis unit 501 is a functional unit that extracts similar inquiries from the inquiries from the user 10, groups them, and manages them.

[0049] The related data collection unit 502 is a functional unit that extracts and manages monitoring data and logs that are highly related to the events in response to grouped inquiries.

[0050] The storage unit 503 is a functional unit that stores data. The storage unit 503 stores a cooperation management information DB 510. The cooperation management information DB 510 is a database that stores various information managed by the network failure analysis device 500. The cooperation management information DB 510 stores a model device information table 511, a model business information table 512, a network performance information table 513, a network performance index table 514, a communication path information table 515, an inquiry group information table 516, and a monitoring data group information table 517. Details of each table will be described later.

[0051] Next, the hardware and software configuration of each component of the network failure analysis system will be described with reference to Fig. 3. In the explanation with reference to Fig. 3, the network monitoring device 100, the security monitoring device 200, the service monitoring device 300, the service management device 400, and the network failure analysis device 500 among the network analysis equipment group 2 will be described in detail.

[0052] The network monitoring device 100 can be realized by an information processing device such as a general server device as shown in Fig. 3. The network monitoring device 100 has, as hardware, a central processing unit (CPU) 121, a main memory 122, an auxiliary storage device 123, and a communication I / F (Interface) 124 connected by a bus 125.

[0053] The CPU 121 is a processor that controls each unit of the network monitoring device 100 and executes programs loaded onto the main memory 122 .

[0054] The main memory 122 is a volatile semiconductor storage device that operates at high speed, such as a random access memory (RAM), and stores programs and work data. The auxiliary storage device 123 is a large-capacity magnetic storage device or semiconductor storage device, such as a hard disk drive (HDD) or a solid state drive (SSD).

[0055] A network monitoring program 101p is installed in the auxiliary storage device 123. The network monitoring program 101p is a program that executes the functions of the network monitoring unit 101.

[0056] The auxiliary storage device 123 also stores a network monitoring information DB 110 .

[0057] The communication I / F 124 is a device for network connection to the operation target network device group 3, the network fault analysis device 500, and the operation terminal 40 via the networks NW1 and NW2.

[0058] The security monitoring device 200 can be realized by an information processing device such as a general server device as shown in Fig. 3. The security monitoring device 200 has, as hardware, a CPU 221, a main memory 222, an auxiliary storage device 223, and a communication I / F 224 connected by a bus 225.

[0059] The CPU 221 is a processor that controls each part of the security monitoring device 200 and executes programs loaded onto the main memory 222 .

[0060] The main memory 222 is a volatile semiconductor storage device that operates at high speed, such as a random access memory (RAM), and stores programs and work data. The auxiliary storage device 223 is a large-capacity magnetic storage device or semiconductor storage device, such as a hard disk drive (HDD) or a solid state drive (SSD).

[0061] A security monitoring program 201a is installed in the auxiliary storage device 223. The security monitoring program 201a is a program that executes the functions of the security monitoring unit 201.

[0062] The auxiliary storage device 223 also stores a security monitoring information DB 210 .

[0063] The communication I / F 224 is a device that connects to the operation target network device group 3, the network fault analysis device 500, and the operation terminal 40 via the networks NW1 and NW2.

[0064] The service monitoring device 300 can be realized by an information processing device such as a general server device as shown in Fig. 3. The service monitoring device 300 has, as hardware, a CPU 321, a main memory 322, an auxiliary storage device 323, and a communication I / F 324 connected by a bus 325.

[0065] The CPU 321 is a processor that controls each unit of the service monitoring device 300 and executes programs loaded onto the main memory 322 .

[0066] The main memory 322 is a volatile semiconductor storage device such as a RAM that operates at high speed and stores programs and work data. The auxiliary storage device 323 is a large-capacity magnetic storage device or semiconductor storage device such as an HDD or SSD.

[0067] A service monitoring program 301p is installed in the auxiliary storage device 323. The service monitoring program 301a is a program that executes the functions of the service monitoring unit 301.

[0068] The auxiliary storage device 323 also stores a service monitor information DB 310 . The communication I / F 324 is a device for network connection to the operation target network device group 3, the network fault analysis device 500, and the operation terminal 40 via the networks NW1 and NW2.

[0069] The service management device 400 can be realized by an information processing device such as a general server device as shown in Fig. 3. The service management device 400 has, as hardware, a CPU 421, a main memory 422, an auxiliary storage device 423, and a communication I / F 424 connected by a bus 425.

[0070] The CPU 421 is a processor that controls each unit of the service management device 400 and executes programs loaded onto the main memory 422 .

[0071] The main memory 422 is a volatile semiconductor storage device such as a RAM that operates at high speed and stores programs and work data. The auxiliary storage device 423 is a large-capacity magnetic storage device or semiconductor storage device such as an HDD or SSD.

[0072] A service management program 401p is installed in the auxiliary storage device 423. The service management program 401a is a program that executes the functions of the service management unit 401.

[0073] The auxiliary storage device 423 also stores a service management information DB 410 . The communication I / F 424 is a device for network connection to the operation target network device group 3, the network fault analysis device 500, and the operation terminal 40 via the networks NW1 and NW2.

[0074] The network fault analysis device 500 can be realized by an information processing device such as a general server device as shown in Fig. 3. The network fault analysis device 500 has, as hardware, a CPU 521, a main memory 522, an auxiliary storage device 523, and a communication I / F 524 connected by a bus 525.

[0075] The CPU 521 is a processor that controls each unit of the network failure analysis device 500 and executes programs loaded onto the main memory 522 .

[0076] The main memory 522 is a volatile semiconductor storage device such as a RAM that operates at high speed and stores programs and work data. The auxiliary storage device 523 is a large-capacity magnetic storage device or semiconductor storage device such as an HDD or SSD.

[0077] An inquiry trend analysis program 501p and a related data collection program 502p are installed in the auxiliary storage device 523. The inquiry trend analysis program 501P is a program that executes the function of the inquiry trend analysis unit 501. The related data collection program 502p is a program that executes the function of the related data collection unit 502.

[0078] The auxiliary storage device 523 also stores a cooperation management information DB 510 .

[0079] The communication I / F 524 is a device that connects to the network monitoring device 100, the security monitoring device 200, the service monitoring device 300, the service management device 400, and the operation terminal 40 via the network NW2.

[0080] Next, a data structure used in a network fault analysis system according to an embodiment will be described with reference to FIGS.

[0081] The equipment monitoring information table 111 is a table that stores information on the results of network monitoring. The equipment monitoring information table 111 can store various types of data depending on the network monitoring item, but in this embodiment, a table that stores information regarding alive monitoring will be used as an example.

[0082] As shown in FIG. 4, the device monitoring information table 111 has fields such as date and time 111a, device IP address 111b, number of transmitted packets 111c, number of received packets 111d, and packet loss rate 111e.

[0083] The date and time 111a is a field that stores, as a value, the date and time when the monitoring data was acquired in the format of yyyy / mm / dd hh:mm:ss. The device IP address 111b is a field that stores, as a value, the IP address of the monitored device. The number of transmitted packets 111c is a field that stores, as a value, the number of packets transmitted to the device for monitoring. The number of received packets 111d is a field that stores, as a value, the number of packets returned from the device. The packet loss rate 111e is a field that stores, as a value, the ratio of the number of packets not returned to the number of packets transmitted.

[0084] The log management table 112 of the network monitoring information DB 110 is a table for storing device logs collected in the network monitoring device 100.

[0085] As shown in FIG. 5, the log management table 112 has fields such as date and time 112a, source IP address 112b, source port 112c, destination IP address 112d, destination port 112e, and protocol 112d.

[0086] The date and time 112a is a field that stores the date and time when the log was output as a value in the format of yyyy / mm / dd hh:mm:ss. The source IP address 112b is a field that stores the IP address of the device that sent the IP packet, for example, the IP address of the user terminal 20 that sent the request to the service environment 24. The source port 112c is a field that stores the port number of the service that is assigned at the sending side when the IP packet is sent, for example, the port number of the service used by the user terminal 20 that was used when sending the request. The destination IP address 112d is a field that stores the IP address of the destination of the IP packet, for example, the IP address of the service environment 24 that sent the request from the user terminal 20. The destination port 112e is a field that stores the port number of the service realized at the destination of the IP packet, for example, the port number of the service environment 24 for receiving the request sent from the user terminal 20. The protocol 112f is a field that stores a character string or an identifier that indicates a protocol used in IP communication, such as HTTP, POP, or SMTP.

[0087] The log management table 212 of the security monitoring information DB 210 is a table that stores logs output by security monitoring, and as shown in FIG. 6, has fields such as date and time 212a, source IP address 212b, destination service providing server IP address 212c, query 212d, and security response 212e.

[0088] The date and time 212a is a field that stores the date and time when the log was output as a value in the format of yyyy / mm / dd hh:mm:ss. The source IP address 212b is a field that stores the IP address of the device that sent the IP packet, for example, the IP address of the user terminal 20 that sent the request to the service environment 24. The destination service providing server IP address 212c is a field that stores the IP address of the server that provides the service, for example, the IP address of the server in the service environment 24 that sent the request from the user terminal 20. The query 212d is a field that stores the content of the request when the service is provided, for example, the content of the request sent from the user terminal 20 to the service environment 24. The security response 212e is a field that stores a character string or identifier that indicates the response that the system performed for security monitoring when the service is provided, for example, the content of the automatic response performed in security monitoring for the request sent from the user terminal 20 to the service environment 24.

[0089] The service monitor information table 311 is a table for storing the performance specifications of the system when a service is provided, and as shown in FIG. 7, has fields such as date and time 311a, service providing server IP address 311b, response time 311c, and throughput 311d.

[0090] The date and time 311a is a field that stores the date and time when the monitoring data was acquired as a value in the format of yyyy / mm / dd hh:mm:ss. The service address providing server IP address 311b is a field that stores the IP address of the server that provides the service, for example, the IP address of the server in the service environment 24 that is the monitoring target. The response time 311c is a field that stores the response time of a transmitted IP packet, for example, the time from when a request is transmitted to the service environment 24 until a response is returned, in milliseconds. The throughput 311d is a field that stores a metric related to the throughput of the IP packet, for example, the number of transactions processed per unit time in the service environment 24.

[0091] The log management table 312 of the service monitor information DB 310 is a table for storing the logs of the system providing the service, and as shown in FIG. 8, has fields such as date and time 312a, service providing server IP address 312b, and message 312c.

[0092] The date and time 312a is a field that stores the date and time when the log was output as a value in the format of yyyy / mm / dd hh:mm:ss. The service providing server IP address 312b is a field that stores the IP address of a server to be monitored when the service is provided, for example, the IP address of a server in the service environment 24. The message 312c is a field that stores, in text format, a message output by the system when the service is provided, for example, a message output by the service environment 24.

[0093] The incident management table 411 is a table that stores data regarding inquiry information from the user 10, and as shown in FIG. 9, has the following fields: incident ID 411a, occurrence date and time 411b, registration date and time 411c, event content 411d, terminal ID 411e, terminal IP address 411f, site used 411g, service environment name 411h, and service environment providing server IP address 411i.

[0094] The incident ID 411a is a field that stores, as a value, an identifier (incident ID) that uniquely identifies an incident such as an inquiry. The occurrence date and time 411b is a field that stores, as a value, the date and time when the incident occurred in the format of yyyy / mm / dd hh:mm:ss. The information of the occurrence date and time 411b is information obtained by surveying the user 10 when an inquiry is made from the user 10, and is the date and time when the user 10 reported that an event related to the network, such as a network malfunction, occurred. The registration date and time 411c is a field that stores, as a value, the date and time when the inquiry from the user 10 was registered as an incident in the format of yyyy / mm / dd hh:mm:ss. The event content 411d is a field that stores the content of the inquiry from the user 10 in text format. The usage terminal ID 411e is a field that stores an identifier (usage terminal ID) that uniquely identifies the usage terminal 20 used by the user 10. The usage terminal IP address 411f is a field that stores the IP address of the usage terminal 20 used by the user 10. The usage site 411g is a field that stores information in text format about the location where the user 10 is using the usage terminal 20. The information of the usage site 411g is, for example, information such as the name of a branch office of a business. The service environment name 411h is a field that stores, in text format, the name of a service used by the user from the usage terminal 20. The service environment providing server IP address 411i is a field that stores the IP address of a server that provides a service used by the user from the usage terminal 20.

[0095] When the date and time of occurrence of a network malfunction is unknown, such as when a user does not enter necessary information in response to an inquiry from the user, the value of the occurrence date and time 411b may be set to the same value as the registration date and time 411c as a default.

[0096] The configuration management table 412 is a table that stores the hardware configuration and network configuration information of devices such as the user terminal 20, network device 21, and server 22 that provide services, and as shown in Figure 10, has fields such as device ID 412a, MAC address 412b, IP address 412c, user 412d, site used 412e, and device type 412f.

[0097] The device ID 412a is a field that stores, as a value, an identifier (device ID) that uniquely identifies the terminal 20, the network device 21, or the server 22. The MAC address 412b is a field that stores, as a value, the MAC addresses of the terminal 20, the network device 21, or the server 22. The IP address 412c is a field that stores, as a value, the IP address of the device. The user 412d is a field that stores, as a value, the affiliation or name of the user or administrator of the device in text format. The site of use 412e is a field that stores, as a value, information on the location where the terminal 20, the network device 21, or the server 22 is used in text format. The device type 412f is a field that stores, as a value, the type of device in text format.

[0098] The model device information table 511 is a table for storing information on model devices that serve as models for measuring network performance, and as shown in FIG. 11, has fields for device ID 511a, MAC address 511b, IP address 511c, and usage site 511d.

[0099] The device ID 511a is a field that stores, as a value, an identifier (device ID) that uniquely identifies the terminal 20 used by the user 10. The MAC address 511b is a field that stores, as a value, the MAC address of a model device. The IP address 511c is a field that stores, as a value, the IP address of a model device. The site of use 1103 is a field that stores, as a value, information in text format about the location where the user 10 is using the terminal 20.

[0100] The model task information table 512 is a table for storing information on a model task that serves as a model for measuring network performance, and as shown in FIG. 12, has fields including a service ID 512a, a service environment name 512b, and a service environment providing server IP address 512c.

[0101] The service ID 512a is a field that stores, as a value, an identifier (service ID) that uniquely identifies the service environment 24 of the model business being used by the user 10. The service environment name 512b is a field that stores, as a value, the name of the service environment 24 of the model business in text format. The service environment providing server IP address 512c is a field that stores, as a value, the IP address of the server of the service environment 24 that provides the model business.

[0102] The network performance information table 513 is a table for storing the measurement results of the network performance, and as shown in FIG. 13, has fields such as a device ID 513a, a service ID 513b, a measurement date and time 513c, and a measurement value 513d.

[0103] The device ID 513a is a field that stores, as a value, an identifier (device ID) that uniquely identifies the device used when measuring the network performance. The service ID 513b is a field that stores, as a value, an identifier (service ID) that uniquely identifies the service environment 24 used when measuring the network performance. The measurement date and time 513c is a field that stores, as a value, the date and time when the network performance was measured in the format of yyyy / mm / dd hh:mm:ss. The measurement value 513d is a field that stores, as a value, the measured network performance value. The measurement value 513d is, for example, the response time in milliseconds when a request is sent from the utilization terminal 20 to the service environment 24.

[0104] The network performance index table 514 is a table that stores statistical information of measurement values ​​related to network performance under normal conditions, and as shown in FIG. 14, has fields such as device ID 514a, service ID 514b, measurement value average 514c, measurement value standard deviation 514d, number of data 514e, and measurement period 514f.

[0105] The device ID 514a is a field that stores, as a value, an identifier (device ID) that uniquely identifies the device used when measuring the network performance. The service ID 514b is a field that stores, as a value, an identifier (service ID) that uniquely identifies the service environment 24 used when measuring the network performance. The measurement value average 514c is a field that stores, as a value, the average value of the measurement values. The measurement value standard deviation 514 is a field that stores, as a value, the standard deviation of the measured network performance values. The number of data 514e is a field that stores, as a value, the number of data used to calculate the measurement value average 514c and the measurement value standard deviation 514d. The measurement period 514f is a field that stores, as a value, the date and time of the start and end of the measurement period of the data used to calculate the measurement value average 514c and the measurement value standard deviation 514d in the format of yyyy / mm / dd hh:mm:ss to yyyy / mm / dd hh:mm:ss.

[0106] The communication path information table 515 is a table that stores communication path information from the user terminal 20 to the service environment 24, and as shown in FIG. 15, has fields such as a path ID 515a, a starting point 515b, an ending point 515c, a transit node 515d, a source node 515e, and a destination node 515f.

[0107] The route ID 515a is a field that stores, as a value, an identifier (route ID) that uniquely identifies a communication route from the user terminal 20 to the service environment 24. The start point 515b is a field that stores, as a value, the device ID of the user terminal 20 that is the start point of the route. The end point 515c is a field that stores, as a value, the service ID of the service environment 24 that is the end point of the route. The via node 515d is an identifier that uniquely identifies a node included in the communication route, and is a field that stores, as a value, the device ID of any of the user terminal 20, the network device 21, the server 22, and the service environment 24. The communication source node 515e is an identifier that uniquely identifies a node that transmits a packet to the via node 515d, and is a field that stores, as a value, the device ID of any of the user terminal 20, the network device 21, and the server 22. The destination node 515e is an identifier that uniquely identifies a node that receives a packet from the transit node 515d, and is a field that stores the device ID of the network device 21, the server 22, or the service environment 24, or the service ID of the service environment 24, as a value.

[0108] When the source node 515e is "None", the value of the transit node 515d is made to match the value of the start point 515b, and when the destination node 515f is "None", the value of the transit node 515d is made to match the value of the end point 515c.

[0109] If the communication paths of the information stored in FIG. 15 are shown in a graph, it will look like FIG.

[0110] The inquiry group information table 516 is a table for storing information on grouped inquiries, and as shown in FIG. 17, has fields of a group ID 516a, an incident ID 516b, and a status 516c.

[0111] Group ID 516a is a field that stores, as a value, an identifier (group ID) that uniquely identifies a group of inquiries. Incident ID 516b is a field that stores, as a value, an identifier (incident ID) that uniquely identifies an incident that belongs to a group in list format. Status 516c is a field that stores, as a value, a status of whether responses to grouped inquiries have been completed in text format.

[0112] The monitoring data group information table 517 is a table that associates and stores highly relevant monitoring data with a query group, and stores the monitoring data in JSON (JavaScript Object Notation) format as shown in Fig. 18. Here, the JSON format is a format in which a key and a value are written separated by a colon, such as {"key":"value"}.

[0113] Next, the process performed by the network fault analysis device will be described with reference to FIGS.

[0114] First, the process of network performance analysis by the inquiry trend analysis unit 501 will be described with reference to Fig. 19. The process of network performance analysis by the inquiry trend analysis unit 501 is a process that is periodically performed for the purpose of grasping the trend of network performance values ​​under normal circumstances.

[0115] The inquiry trend analysis unit 501 of the network failure analysis device 500 selects model devices to be used for measuring network performance values ​​from among the terminals 20 used by the users 10 (S101). Specifically, for example, the devices are selected randomly so as to broadly cover the networks to which the terminals 20 are connected and the locations where the devices are used.

[0116] Next, the inquiry trend analysis unit 501 selects a model task for measuring network performance values ​​from among tasks performed by the user 10 on the selected user terminal 20 (S102). Specifically, for example, a DNS (Domain Name System) server log is acquired to obtain the IP address of the server to which a request for browsing, operation, etc. is sent from the model device selected in S101. The server to which the request is sent from the user terminal 20 is considered to provide functions and data used by the user 10 in the task. From among these, the average number of requests for all the model devices is determined to be less than or equal to the threshold value Th Mean For servers with a larger number of requests, the threshold Th Req We select a server with a larger capacity as the model service. Here, Th Mean , Th Req is a predetermined value.

[0117] Next, the inquiry trend analysis unit 501 measures the network performance values ​​for the model devices and model services selected in S101 and S102 (S103).

[0118] Specifically, for example, the response time when a model task request is sent from each model device is measured and stored in the network performance information table 513 as a network performance value.

[0119] Next, the inquiry trend analysis unit 501 calculates a network performance index from the network performance values ​​measured and stored in S103 (S104). Specifically, for example, the average and standard deviation of the network performance values ​​for the past M days are calculated for each model task of each model device, and stored in the network performance index table 514 as the network performance index.

[0120] Next, the inquiry trend analysis process performed by the inquiry trend analysis unit will be described with reference to FIGS.

[0121] The inquiry trend analysis process by the inquiry trend analysis unit is a process that is performed every time an inquiry is made from the user 10 with the aim of grouping related inquiries.

[0122] In the network fault analysis device 500, the inquiry trend analysis unit 501 acquires inquiry information newly registered in the incident management table 411 from the service management unit 401 of the service management device 400 (S201). Specifically, for example, the incident ID 901 of the newly registered inquiry is received from the service management unit 401 via a messaging infrastructure or a Web API (Application Programming Interface), and the inquiry information is acquired by specifying the incident ID 901 as a parameter using an API for acquiring incident information provided by the service management unit 401.

[0123] Next, the inquiry tendency analysis unit 501 measures the network performance value for the inquired device and the service being used (S202). Specifically, for example, the response time when the inquired device transmits a request for the service being used is measured. Here, the measured value of the response time is set to Tr.

[0124] Next, the inquiry trend analysis unit 501 determines whether there is a significant difference between the measured network performance value and normal conditions (S203), and if there is a significant difference (S203: YES), the process proceeds to S204; otherwise (S203: NO), the process of the inquiry trend analysis unit 501 ends.

[0125] Specifically, for example, the device ID, usage site, and service information of the queried device are obtained from the incident management table 411, and the device ID of the model device with a matching device ID or usage site is obtained from the model device information table 511. Then, network performance index information (average measured value 514c and standard deviation of measured value 514d) with matching model device ID and service ID is obtained from the network performance index information table 514. Here, let the average value of the obtained measured values be μ and the standard deviation value of the measured values be σ. For the network performance value Tr measured in S402, the average measured value μ, and the standard deviation of measured values σ, if the relationship μ + 3σ < Tr holds, that is, when assuming that the network performance value follows a normal distribution and the network performance value Tr measured from the range of its variation significantly deviates (the probability that the network is normal and Tr is in this region is theoretically evaluated to be 0.15%), it is determined that Tr shows an abnormal value compared to normal times.

[0126] In this way, when measuring the performance of the network related to the query and recognizing an abnormality, the network failure analysis is only performed when it is first determined that there is an abnormality. This is to prevent the operator 30 from performing unnecessary work because not all incidents queried by the user 10 necessarily have network abnormalities.

[0127] Next, when it is determined in S203 that the measured network performance value shows an abnormal value as a result of the determination, the query tendency analysis unit 501 groups the query information based on the grouping rules for query information (S204). Specifically, for example, the occurrence date and time 411b, event content 411d, usage site 411g, and service environment providing server IP address 411i of a new query are obtained from the incident management table 411, and the group to which the query belongs is determined according to the rules defined in the grouping rule table in FIG. 21, for example. Then, the incidents of the grouped queries are stored in the query group information table 511, with each group as one record.

[0128] The grouping rule table shown in FIG. 21 has, as fields, a rule ID 520a, an occurrence date and time 520b, an event content 520c, a usage site 520d, a service environment providing server IP address 520e, and a judgment group 520f.

[0129] The rule ID 520a refers to an identifier that uniquely identifies the rule, and the judgment group 520f refers to the group to which the inquired incident belongs according to the values ​​of the occurrence date and time 520b, the event content 520c, the usage site 520d, and the service environment providing server IP address 520e.

[0130] As the values ​​of occurrence date and time 520b, event details 520c, usage site 520d, and service environment providing server IP address 520e, "S" means that the items (occurrence date and time, event details, usage site, or service environment providing server IP address) of different inquiry incidents are compared and are the same. Also, "D" means that the items are different when the corresponding items of different inquiries are compared. However, as for the occurrence date and time, if the difference between the occurrence dates and times is equal to or less than a predetermined threshold value, they are considered to be the same.

[0131] 9, for example, if the threshold for the difference in occurrence date and time is set to 1 hour, the difference between the occurrence date and time 411b of the incident ID 411a "IN0001" and the incident ID 411a "IN0002" is less than the threshold (for example, 5 minutes), and the event content 411d, the use site 411g, and the service environment providing server IP address 411i are the same, so they conform to the rule ID 520a "RL0001" and are classified as the same group A. In addition, for the incident IN0003, the difference between the incident ID 411a "IN0001" and the incident ID 411a "IN0002" and the occurrence date and time 411b is less than the threshold, and the event content 411d and the service environment providing IP address 411i are the same, but the use site 411g ("Shinagawa site") is different, so they are not classified as the same group.

[0132] Incidentally, the event content 411d in Fig. 9 is written as a fixed string "Response Delay", but the content of the user's inquiry may be recorded as a free format within a certain number of characters, and a similarity determination may be performed between the string and a specified template string, and if the similarity is within a certain threshold, the strings may be regarded as the same, and the "S" or "D" determination in Fig. 21 may be performed. Incidentally, the similarity determination of strings may use methods such as cosine similarity, Levenshtein distance, Jaccard coefficient, or long tail similarity.

[0133] Next, the associated data collection process performed by the associated data collection unit will be described with reference to FIG. The related data collection process in FIG. 22 is a process for collecting various monitoring data and logs of devices, etc., which are necessary for investigating a fault on a network.

[0134] The related data collection unit 502 acquires grouped inquiry information (S301). Specifically, for example, one group ID 516a in the inquiry group information table 516 is selected, and incident information belonging to the group ID 516a is acquired from the incident management table.

[0135] Next, the related data collection unit 502 acquires route information from the devices included in the inquiry group to the service being used (S302). Specifically, for example, the IP address of the device and the IP address of the service being used are specified using a command such as traceroute to acquire the IP addresses of the network devices on the communication path from the device to the service being used, and the IP addresses are used to inquire the service management device 400 to obtain the device ID stored in the configuration management table 412 and store it in the communication route information table 515.

[0136] Next, the related data collection unit 502 determines the degree of association between the malfunction on the network that caused the query and the monitoring data and logs (S303). Specifically, for example, the degree of association is determined as follows: Based on the usage terminal ID and the service environment ID, the communication path (path ID) from the usage terminal 20 where the queried event is occurring to the service environment is acquired from the communication path information table 515. Based on the node ID (device ID) included in the acquired path ID, the IP addresses of the network devices and servers on the communication path are acquired from the configuration management table 412. Among the monitoring data and logs of the network devices and servers having the acquired IP addresses and the logs of the security services that monitor their communications, the monitoring data and logs that satisfy the following conditions (1) and (2) are determined to have a high degree of association with the malfunction.

[0137] (1) For the following monitoring data, data Tn seconds before and after the date and time of the incident inquired about is considered to be highly relevant, where Tn is a threshold determined by the system specifications and network management operations (e.g., Tn=600). --Device alive monitoring (Ping monitoring) --Device port monitoring (Syslog monitoring) --Monitoring the device's temperature and other status (by periodically executing SNMP commands) --Traffic monitoring (by periodically executing SNMP commands) --Resource management (monitoring by periodically executing SNMP commands) (2) For the following types of logs, logs that occur within Tn seconds before or after the occurrence of the queried incident and have the same request destination are deemed to be highly relevant. Also, logs that occur within Tn seconds before or after the occurrence of the queried event and have the same request source are deemed to be highly relevant. --Firewall logs --DNS (Domain Name System) logs --Security monitoring log

[0138] The reason why monitoring data and logs collected in this way are collected from the time when the incident inquired about occurred is that such monitoring data and logs are likely to provide evidence that will shed light on the occurrence of a network malfunction.

[0139] Although the thresholds for the time before and after the acquisition of the monitoring data and the log are the same, they may be different. Also, in the above explanation, there are two types, relevance and no relevance, but the relevance may be classified into five levels, for example, and ranked according to the time division.

[0140] Next, the related data collector 502 acquires the monitoring data and logs that are determined to have a high degree of association, and stores them in the monitoring data group information table 517 (S304).

[0141] Specifically, for example, the API provided by the network monitoring unit 100, the security monitoring unit 200, and the service monitoring unit 300 is used to specify the date and time range and the IP addresses of the user terminal, the network device, the server, and the service environment to acquire monitoring data and logs. The date and time range is a range including the occurrence dates and times of all queries included in the group, and is the section from Tn seconds before the first occurrence date and time to Tn seconds after the last occurrence date and time. As the IP address of the user terminal 20, the value of the user terminal IP address 411f related to the queries included in the group is acquired from the incident management table 411. The IP addresses of the network device 21 and the server 22 are acquired from 412c of the configuration management table 412 using the device ID acquired in S303. As the IP address of the server providing the service environment, the service environment providing server IP address 411i of the incident management table 411 corresponding to the incident related to the query included in the group is acquired.

[0142] Also, the range of date and time 111a and the device IP address 111b are specified from the device monitoring information table 111 to obtain the packet loss rate 111e of the corresponding device. Similarly, the range of date and time 112a, the source IP address 112b (the IP address of the user terminal 20), and the destination IP address 112d (the IP address of the server in the service environment) are specified from the log management table 112 of the network monitoring information DB 110 to obtain the source port 112c, the destination port 112e, and the protocol 112f. Similarly, the range of date and time 212a, the source IP address 212b (the IP address of the user terminal 20), and the access destination service providing server IP address (the IP address of the server in the service environment) are specified from the log management table 212 of the security monitoring information DB 210 to obtain the query 212d and the security response 212e. Similarly, a response time 311c and a throughput 311d are obtained by specifying a range of date and time 311a and a service providing server address 311b (the IP address of a server in the service environment) from the service monitoring information table 311. Similarly, a range of date and time 312a and a service providing server IP address 312b (the IP address of a server in the service environment) are obtained from the log management table 312 of the service monitoring information DB 310. A group ID and an appropriate key are assigned to each item of the obtained data, and the corresponding values ​​in the monitoring data group information table 517 are stored in the JSON format as shown in FIG.

[0143] Next, the associated data collection unit 502 repeats the processes of S301 to S304 for all groups in the query (S305), and when all groups in the query have been processed (S305: YES), ends the associated data collection process by the associated data collection unit.

[0144] The operation terminal 40 displays the monitoring data and logs stored in the monitoring data group information table 517.

[0145] An example of a user interface displayed on the operation terminal will be described below with reference to FIGS. 23A and 23B.

[0146] As shown in FIG. 23A, when the operator 30 selects a network topology tab 610, a network failure analysis screen 600 displayed on the operation terminal 40 displays a communication path related to a network failure.

[0147] 23B, when the operator 30 selects a monitoring data tab 620, the network failure analysis screen 600 displayed on the operation terminal 40 displays a graph 621 showing the number of requests from each user terminal 20 to the service environment 24 in chronological order, a graph 622 showing the packet loss rate in chronological order, and a log 623 highly related to inquiries from the network devices 21 and the server 22. Also, by selecting data on the graph 621, for example, a more detailed communication log 624 is displayed.

[0148] In this embodiment, as described above, by grouping incidents related to inquiries, it is possible for an operator to deal with network malfunctions that have received many inquiries more efficiently than if the operator were to deal with each inquiry individually, and it also makes it possible to efficiently collect and analyze monitoring data and logs related to the incidents related to the inquiries.

[0149] In this manner, in this embodiment, inquiry information regarding a suspected fault is used to infer the occurrence of a fault on the network, and based on the time information and communication path information, highly relevant information from monitoring data and logs of network monitoring, security monitoring, and service monitoring is compiled and provided to the operator. This makes it possible to shorten the response time to a fault on the network even when no obvious fault has occurred on the network, or to shorten the time required for countermeasures when a fault does occur, enabling a quick response. [Explanation of symbols]

[0150] 1...Network fault analysis system, 2...Network analysis equipment group, 3...Network equipment group to be operated, 10...user, 20...user terminal, 21...network device, 22...server, 23...service providing network, 24...service environment, 30...operator, 40...operation terminal, 100... network monitoring device, 101... network monitoring unit, 102... storage unit, 110... network monitoring information DB, 200: security monitoring device, 201: security monitoring unit, 202: storage unit, 210: security monitoring information DB, 300: service monitoring device; 301: service monitoring unit; 302: storage unit; 310: service monitoring information DB; 400: service management device; 401: service management unit; 402: storage unit; 410: service management information DB; 500: network failure analysis device; 501: inquiry trend analysis unit; 502: related data collection unit; 503: storage unit; 510: cooperation management information DB; 111: device monitoring information table, 112: log management table, 212...log management table, 311: service monitoring information table; 312: log management table; 411: Incident management table, 412: Configuration management table, 511: model device information table; 512: model business information table; 513: network performance information table; 514: network performance index table; 515: communication path information table; 516: inquiry group information table; 517: monitoring data group information table

Claims

1. A network fault analysis device that collects monitoring data from devices on a network or logs from devices that constitute a network, Logs of the devices that make up the network, Network monitoring data, Network communication route information; Retain information about inquiries from users, Grouping the inquiry information from the user based on a patterned rule; determining communication path information for communication related to each of the grouped inquiry information based on device information included in the grouped inquiry information; A network fault analysis device characterized by acquiring logs and monitoring data related to the inquiry information from the user based on device information corresponding to nodes of the communication path of the communication path information.

2. The inquiry information from the user includes a date and time when a network event related to the inquiry occurred, 2. The network fault analysis device according to claim 1, wherein the patterned rules for grouping the inquiry information from the users include a rule regarding the time when a network event occurs.

3. 3. A network fault analysis device according to claim 2, wherein the log and monitoring data related to the inquiry information from the user that is acquired is data relating to a predetermined time interval before and after the date and time when a network event related to the inquiry occurred.

4. The inquiry information from the user includes the content of the network event related to the inquiry, the site used, and the address of the device with which the inquiry was made, 3. A network fault analysis device according to claim 2, wherein the patterned rules for grouping the inquiry information from the user include rules regarding the event content of the network event related to the inquiry, the site used, and the address of the device with which the communication is performed.

5. 5. A network fault analysis device according to claim 4, wherein the rule regarding the event contents of the network events is that when the similarity of character strings is within a certain value, the events are regarded as having the same event contents.

6. 2. The network failure analysis device according to claim 1, wherein the network monitoring data includes device alive monitoring, device port monitoring, device status monitoring, traffic monitoring, and resource management.

7. Furthermore, the network performance is measured, and network performance index information is stored, which stores statistical information regarding the network performance. The network fault analysis device according to claim 1, characterized in that it measures the network performance of the equipment included in the inquiry information from the user, compares statistical information based on the measured network performance values ​​with the value of the network performance index information related to the inquiry information, and, if there is a significant difference in network performance, groups the inquiry information from the user based on patterned rules.

8. A network fault analysis method for collecting monitoring data from devices on a network or logs from devices constituting a network by a network fault analysis device, comprising: The network fault analysis device includes: Logs of the devices that make up the network, Network monitoring data Network communication route information; Retain information about inquiries from users, The inquiry information from the user includes a date and time when the network event related to the inquiry occurred, the content of the network event related to the inquiry, the site used, and the address of the device with which the inquiry was made; The patterned rules for grouping the inquiry information from the user include rules regarding the time when the network event occurred, the content of the network event related to the inquiry, the site used, and the address of the device with which the communication was made; A step of grouping the inquiry information from the user based on a patterned rule; determining communication path information for communication regarding each of the grouped inquiry information based on device information included in the grouped inquiry information; A network fault analysis method comprising a step of acquiring logs and monitoring data related to inquiry information from the user based on equipment information corresponding to nodes of the communication path of the communication path information.

9. 9. A network fault analysis method according to claim 8, wherein the log and monitoring data related to the inquiry information from the user that is acquired is data relating to a specified time interval before and after the date and time when a network event related to the inquiry occurred.

10. Furthermore, the network failure analysis device measures network performance and holds network performance index information that stores statistical information on the network performance; The step of grouping the inquiry information from the user based on a patterned rule includes: The network fault analysis method according to claim 8, characterized in that it is executed when a significant difference in network performance is found by measuring the network performance of a device included in the inquiry information from the user, comparing statistical information based on the measured network performance values ​​with the value of the network performance index information related to the inquiry information.

Images