Proxy system for syslog messages

Abstract

An industrial automation system includes a collector component that is communicatively coupled to a first network and is configured to receive one or more event logs via a first communication protocol. The industrial automation system also includes a first industrial automation component that is communicatively coupled to the first network and the collector component. The first industrial automation component is configured to communicate via the first communication protocol. In addition, the industrial automation system includes a second industrial automation component that is configured to communicate via a second communication protocol, generate a first event log representing an attribute associated with the second industrial automation component, and send the first event log to the first industrial automation component. The first industrial automation component is configured to convert the first event log into a second event log that can be understood by the collector component, and send the second event log to the collector component via the first network.

Description

Technical Field

[0001] The present disclosure generally relates to enabling event reporting for devices in a network, including devices that access the network following different communication protocols or devices that are connected to a network different from the network hosting the collector of event reports. More specifically, the present disclosure relates to systems and methods for utilizing an event proxy server and client to receive events logged by devices that communicate according to different communication protocols and devices that are connected to a network different from the collector. Background Art

[0002] This section is intended to introduce the reader to various aspects of the technology that may be related to various aspects of the technology described and / or claimed below. This discussion is considered to be helpful in providing the reader with background information to facilitate a better understanding of the various aspects of the present disclosure. Therefore, it should be understood that these statements are to be understood from this perspective, and not as an admission of the prior art. Summary of the invention

[0003] The following describes an overview of the specific embodiments disclosed herein. It should be understood that these aspects are presented only to provide the reader with a brief overview of these specific embodiments, and these aspects are not intended to limit the scope of the present disclosure. In fact, the present disclosure may cover various aspects that may not be described below.

[0004] In one embodiment, the industrial automation system includes a collector component that is communicatively coupled to the first network and is configured to receive one or more event logs via a first communication protocol. The industrial automation system also includes a first industrial automation component that is communicatively coupled to the first network and the collector component. The first industrial automation component is configured to communicate via the first communication protocol. In addition, the industrial automation system includes a second industrial automation component that is configured to communicate via a second communication protocol different from the first communication protocol, generate a first event log representing an attribute associated with the second industrial automation component, and send the first event log to the first industrial automation component. The first industrial automation component is configured to convert the first event log into a second event log that can be understood by the collector component, and send the second event log to the collector component via the first network.

[0005] In another embodiment, the non-transitory computer-readable medium includes instructions that, when executed, cause a processing circuit of a first industrial automation component to receive log data representing an attribute associated with the second industrial automation component from a second industrial automation component using a first communication protocol. When the instructions are executed, the processing circuit is also caused to generate one or more system log messages that can be transmitted using a second protocol different from the first protocol based on the log data. In addition, when the instructions are executed, the processing circuit is caused to send one or more system log messages to a system log collector or a third industrial automation component using a second communication protocol.

[0006] In another embodiment, a computer-implemented method includes receiving log data from a second industrial automation component via a first industrial automation component using a first communication protocol. The log data represents an attribute associated with the second industrial automation component. The method also includes generating one or more system log messages based on the log data via the first industrial automation component. In addition, the method includes sending one or more system log messages to a system log collector via the first industrial automation component using a second communication protocol different from the first communication protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] These and other features, aspects and advantages of the present invention will become better understood when the following detailed description is read with reference to the accompanying drawings, in which like reference numerals represent like parts throughout the several views, and in which:

[0008] Figure 1 is a perspective view of an example industrial automation system according to implementations presented herein;

[0009] Figure 2 It is shown that according to the embodiments presented herein, it may be included in Figure 1 Example components of a portion of a control / monitoring device in an industrial control system;

[0010] Figure 3 The embodiment presented herein includes Figure 2 Control systems for control / monitoring devices;

[0011] Figure 4 A block diagram of a control system according to an embodiment presented herein is shown, the control system comprising Figure 2 A control / monitoring device and several modules coupled to each other via a data backplane;

[0012] Figure 5 A block diagram of an industrial automation system in which log data from some components of the industrial automation system are inaccessible to a Syslog protocol collector is shown according to embodiments presented herein;

[0013] Figure 6 A block diagram of an industrial automation system in which log data from each component of the industrial automation system is accessible to a system log collector according to embodiments presented herein is shown;

[0014] Figure 7 A flowchart of a process for configuring a component of an industrial automation device as an event proxy server, an event proxy client, or a pseudo event proxy server according to embodiments presented herein is shown;

[0015] Figure 8 A flow chart showing a process performed by an event proxy server according to embodiments presented herein to provide a system log or event message to a system log collector based on event log data received from another component; and

[0016] Fig. 9 A flowchart of a process performed by a pseudo event proxy server to forward data to an event proxy server according to an embodiment presented herein is shown. DETAILED DESCRIPTION

[0017] One or more specific embodiments will be described below. In order to provide a concise description of these embodiments, not all features of the actual implementation are described in the specification. It should be understood that in the development of any such actual implementation, as in any engineering or design project, many implementation-specific decisions must be made to achieve the developer's specific goals, for example, to meet system-related and business-related constraints, which may vary depending on the implementation. In addition, it should be understood that such development work may be complex and time-consuming, but is nothing more than a routine task of design, production and manufacturing for those of ordinary skill in the art who benefit from the present disclosure.

[0018] When introducing elements of various embodiments of the present invention, the unmodified singular forms, "the," and "said" are intended to mean that there are one or more elements. The terms "comprising," "including," and "having" are intended to be inclusive and mean that there may be additional elements besides the listed elements.

[0019] Embodiments of the present disclosure relate to techniques for enabling log data (e.g., security or other information associated with an industrial automation system or component) from industrial automation devices that are not on the same network or do not support a particular communication protocol to be provided to a log collector (e.g., a system log collector). More specifically, the techniques described below enable the use of several different transport mechanisms and protocols to send log data across non-converged networks, generate log messages based on the log data, and provide the log messages to a system log collector. The log data can then be used to make security or control decisions about industrial automation systems, etc. Therefore, these techniques can increase the security of industrial automation systems while enhancing the functionality of industrial automation devices that are not on the same network or do not support the same communication protocol as a particular log collector component.

[0020] As an introduction, Figure 1 is a perspective view of an example industrial automation system 10 in which the present embodiments described herein may be implemented. Figure 1 As depicted, the industrial automation system 10 can be controlled by one or more industrial control systems 12 and can include a station 14 having machine components and / or machines for performing functions in an automated process (e.g., silicon wafer manufacturing). An example automated process can begin at station 14A, which is used to load an object (e.g., a substrate) into the industrial automation system 10 via a conveyor section 16A. The conveyor section 16A can transport the object to station 14B to perform a first action, such as printing solder paste to the substrate by stenciling. As the object leaves station 14B, the conveyor section 16B can transport the object to station 14C for solder paste inspection (SPI) to check the printing results, to stations 14D, 14E, and 14F for surface mount technology (SMT) component placement, to station 14G to allow a convection reflow oven to melt the solder to make electrical couplings, and finally to station 14H for automated optical inspection (AOI) to inspect the manufactured object (e.g., a manufactured printed circuit board). After the object travels through the various stations, the object may be removed from station 14H, for example, for storage in a warehouse or for shipping.

[0021] Obviously, for other applications, specific systems, machine parts, machines, stations and / or conveyors may be different or particularly suitable for the application. For example, the industrial automation system 10 may include machinery that performs various operations in compressor stations, refineries, batch operations for making food, chemical processing operations, brewing operations, mining operations, mechanized assembly lines, etc. Therefore, the industrial automation system 10 may include various operating components, such as motors, valves, actuators, temperature elements, pressure sensors, or a large number of machines or devices for manufacturing, processing, material handling and other applications. The industrial automation system 10 may also include electrical equipment, hydraulic equipment, compressed air equipment, steam equipment, machine tools, protective equipment, refrigeration equipment, power lines, hydraulic lines, steam lines, etc. Some example types of equipment may include mixers, machine conveyors, tanks, slideways, dedicated original equipment manufacturer machines, etc. In addition to the above equipment, the industrial automation system 10 may also include motors, protective devices, switchgear, compressors, etc. Each of these described operational components can correspond to and / or generate various operational technology (OT) data regarding operations, status, sensor data, operating modes, alarm conditions, etc., which can be expected to be output for analysis using IT data from an information technology (IT) network, stored in the IT network, analyzed using desired operational set points (e.g., thresholds), etc.

[0022] In some embodiments, one or more properties of the industrial automation system 10 equipment (e.g., site 14) can be monitored and controlled by the industrial control system 12 to adjust the control variable. For example, a sensing device (e.g., sensor 18) can monitor various properties of the industrial automation system 10 and can be used at least in part by the industrial control system 12 to adjust the operation of the industrial automation system 10 (e.g., as part of a control loop). In some cases, the industrial automation system 10 can be associated with devices used by other equipment. For example, scanners, meters, valves, flow meters, etc. can be set on or inside the industrial automation system 10. Here, the industrial control system 12 can receive data from the associated devices and use the data to perform their respective operations more efficiently. For example, a controller associated with a motor drive of the industrial automation system 10 can receive data about the temperature of the connected motor and can adjust the operation of the motor drive based on the data.

[0023] The industrial control system 12 can be communicatively coupled to a display / operator interface 20 (e.g., a human-machine interface (HMI)) and devices of the industrial automation system 10. It should be understood that any suitable number of industrial control systems 12 can be used in a particular embodiment of the industrial automation system 10. In addition, the display / operator interface 20 can facilitate representing components of the industrial automation system 10 through programming objects, which can be instantiated and executed to provide simulated functions similar to or the same as actual components and visualization of components, or both. The programming objects may include code and / or instructions stored in the industrial control system 12 and executed by processing circuitry of the industrial control system 12. The processing circuitry can communicate with memory circuitry to allow visualization of stored components.

[0024] As shown, the display / operator interface 20 depicts a representation 22 of a component of the industrial automation system 10. The industrial control system 12 can use the data transmitted by the sensor 18 to update the visualization of the component via changes to one or more states, conditions and / or indications of the current operation of the component. These sensors 18 can be any suitable device suitable for providing information about process conditions. In fact, the sensor 18 can be used in a process loop (e.g., a control loop) that can be monitored and controlled by the industrial control system 12. Therefore, the processing loop can be activated based on a process input (e.g., an input from the sensor 18) or a direct input by a person via the display / operator interface 20. People who operate and / or monitor the industrial automation system 10 can refer to the display / operator interface 20 to determine the various states, conditions and / or current operations of the industrial automation system 10 and / or specific components. In addition, the personnel who operate and / or monitor the industrial automation system 10 can adjust various components to start, stop, power off, power on or otherwise adjust the operation of one or more components of the industrial automation system 10 by interacting with a control panel or various input devices.

[0025] The industrial automation system 10 can be considered as a data-rich environment with several processes and operations that each generate various data. For example, the industrial automation system 10 can be associated with material data (e.g., data corresponding to substrate or raw material properties or characteristics), parameter data (e.g., data corresponding to the performance of machines and / or sites such as during operation of the industrial automation system 10), test result data (e.g., data corresponding to various quality control tests performed on final or intermediate products of the industrial automation system 10), etc., which can be organized and classified as OT data. In addition, the sensor 18 can collect OT data indicating one or more operations of the industrial automation system 10 or the industrial control system 12. In this way, the OT data can be analog data or digital data indicating measurement results, status, alarms, etc. associated with the operation of the industrial automation system 10 or the industrial control system 12.

[0026] The industrial control system 12 described above can operate in an OT space where OT data is used to monitor and control OT assets (e.g., equipment shown in the site 14 of the industrial automation system 10 or other industrial equipment). The OT space, environment, or network typically includes direct monitoring and control operations coordinated by the industrial control system 12 and corresponding OT assets. For example, a programmable logic controller (PLC) can operate in an OT network to control the operation of OT assets (e.g., drives, motors). The industrial control system 12 can be specifically programmed or configured to communicate directly with the corresponding OT assets.

[0027] As shown, in some embodiments, the industrial automation system 10 may include a system log collector 24. The system log collector 24 may be a computing device (e.g., a server or computer), a data repository, a software application, or other suitable component that stores and / or processes logs (e.g., system logs or event messages) provided to the system log collector 24. More specifically, the industrial automation devices of the industrial automation system 10 (e.g., devices included in stages 14A to 14H, the industrial control system 12, or the display / operator interface 20) may generate log data related to various features of the industrial automation devices. For example, the log data may include event logs (e.g., messages) indicating potential security issues or threats, the initiation or completion of specific tasks or processes, data (e.g., data collected by sensors 18), etc. The log data and the system log protocol are described in more detail in the Network Working Group Request for Comments (RFC) 5424 entitled "The Syslog Protocol", which is an Ethernet protocol that can be used to transmit system log messages between devices (e.g., the system log collector 24 and another component of the industrial automation system 10).

[0028] In an industrial automation system, some devices may be connected to a different network from the system log collector 24, may not be able to use the system log protocol (or other Ethernet protocols such as EtherCAT, Ethernet / IP, PROFINET, POWERLINK, SercosIII, ModbusTCP, CC-linkIE), or both. However, other devices connected to the same network as the system log collector 24 and capable of communicating using the system log protocol may receive log data from a device that cannot generate a system log message. For example, data may be received in a format different from the system log message, and the communication protocol used to transmit data between the two devices may be a communication protocol different from the system log protocol. For example, one or more industrial control systems 12 may include an Ethernet port 32 (e.g., an Ethernet adapter) for sending system log messages to the system log collector 24. It should also be noted that although the industrial control system 12 is shown to have a connection to the system log collector 24, any component of the industrial automation system 10 can be communicatively coupled to the industrial control system 12 (e.g., via an Ethernet connection or via a device that acts as an event proxy server that can forward system log messages to the system log collector 24).

[0029] Continuing to refer to the attached drawings, Figure 2 Example components that may be part of an industrial control system 12 according to embodiments presented herein are shown. For example, the industrial control system 12 may include a communication component 72, a processor 74, a memory 76, a storage device 78, an input / output (I / O) port 80, an image sensor 82 (e.g., a camera), a position sensor 84, a display 86, additional sensors (e.g., a vibration sensor, a temperature sensor), etc. The communication component 72 may be a wireless or wired communication component that may facilitate communication between the industrial control system 12, industrial automation equipment (e.g., a device for implementing stages 14A to 14H), a system log collector 24, and other devices with communication capabilities. For example, the communication component 72 may include a network interface that may enable the industrial control system 12 to communicate with the industrial automation equipment via a network such as Ethernet / IP Control Network Device Network or any other industrial communication network protocol. In addition, the communication component 72 can enable the industrial control system 12 to communicate via various protocols such as Wi-Fi, mobile telecommunication technologies (e.g., 2G, 3G, 4G, 5G, LTE), The industrial control system 12 may be connected to the industrial automation system 10 by a variety of wired or wireless communication protocols such as near field communication (NFC) technology. In addition, the communication component 72 communicatively couples the industrial control system 12 to one or more devices (e.g., components of the industrial automation system 10, including the system log collector 24) via a network, and the network may be of any suitable type, such as an Ethernet / IP network, a ControlNet network, a DeviceNet network, a Data Highway Plus network, a remote I / O network, a Foundation Fieldbus network, a serial DH-485 network, a SynchLink network, or any combination thereof.

[0030] The processor 74 may be any type of computer processor or microprocessor capable of executing computer executable code. The processor 74 may also include multiple processors that can perform the operations described below. The memory 76 and the storage device 78 may be any suitable product that can be used as a medium for storing processor executable code, data, etc. These products may represent computer-readable media (e.g., any suitable form of memory or storage device) that can store processor executable code used by the processor 74 to perform the currently disclosed technology. Typically, the processor 74 can execute a software application including a program that enables a user to track and / or monitor the operation of industrial automation equipment via a local or remote communication link. That is, the software application can communicate with the industrial control system 12 and collect information associated with the industrial automation equipment determined by the industrial control system 12 via sensors 18 provided in the industrial automation system 10, etc.

[0031] The memory 76 and storage 78 may also be used to store data, analysis of the data, software applications, etc. The memory 76 and storage 78 may represent non-transitory computer-readable media (e.g., any suitable form of memory or storage) that may store processor-executable code used by the processor 74 to perform the various techniques described herein. It should be noted that non-transitory merely indicates that the medium is tangible and not a signal.

[0032] The I / O port 80 may be an interface that may be coupled to other peripheral components such as input devices (e.g., keyboard, mouse), sensors, input / output (I / O) modules, etc. The I / O modules may enable the industrial control system 12 to communicate with industrial automation equipment or other devices in the industrial automation system 10 via the I / O modules.

[0033] The image sensor 82 may include any image acquisition circuit, such as a digital camera capable of acquiring digital images, digital videos, etc. The position sensor 84 may include a circuit designed to determine the physical location of industrial automation equipment. In one embodiment, the position sensor 84 may include a global positioning system (GPS) sensor that acquires the GPS coordinates of the industrial control system 12.

[0034] The display 86 may depict visualizations associated with the software or executable code being processed by the processor 74. In one embodiment, the display 86 may be a touch display capable of receiving input from a user of the industrial control system 12 (e.g., parameter data for operating industrial automation equipment). Thus, the display 86 may be used as a user interface for communicating with industrial automation equipment. The display 86 may be used to display a graphical user interface (GUI) for operating industrial automation equipment, for tracking maintenance of industrial automation equipment, and the like. The display 86 may be any suitable type of display, such as a liquid crystal display (LCD), a plasma display, or an organic light emitting diode (OLED) display. In addition, in one embodiment, the display 86 may be provided in conjunction with a touch-sensitive mechanism (e.g., a touch screen), which may be used as part of a control interface for industrial automation equipment or a plurality of industrial automation equipment in the industrial automation system 10 to control the general operation of the industrial automation system 10. In some embodiments, the operator interface may be characterized as a display / operator interface 20 (e.g., an HMI), and the like.

[0035] Although the above components have been discussed with respect to the industrial control system 12, it should be noted that similar components may constitute other computing devices described herein or be included in industrial automation equipment included in the industrial automation system 10. In addition, it should be noted that the listed components are provided as example components, and the embodiments described herein are not limited to reference to Figure 3 Describe the parts.

[0036] The industrial control system 12 may be part of a collection of modules, such as Figure 3 The control system 100 is depicted. Figure 3 As shown, the control system 100 may include an industrial control system 12 as a single module among multiple modules that perform various types of operations. Figure 4As shown, the control system 100 may also include an artificial intelligence (AI) module 102 and an input / output module 104. The control system 100 may be coupled to a data backplane 106, which may facilitate communication between modules of the control system 100. More specifically, the industrial control system 12, the AI ​​module 102, and the I / O module 104 may be coupled to each other via the data backplane 106. In addition, the data backplane 106 may be used to send system log messages to the system log collector 24 and receive system log messages (e.g., log events related to the system log).

[0037] As described above, various components of the industrial automation system 10 may include different types of circuits that enable the components to communicate with other devices within the industrial automation system 10. However, in some cases, a device may not include a specific type of communication circuit for transmitting a specific type of data. For example, a system log message may be an Ethernet-based event log message generated by an industrial automation component included in the industrial automation system 10. Devices that do not include Ethernet communication circuits may be unable to provide system log messages to the system log collector 24. In addition, the system log collector 24 may be communicatively coupled to a network or backplane that is different from the network or backplane connected to the industrial automation component. In other words, there may be a non-converged network in which a device is communicatively coupled to a network that is different from the network to which the system log collector 24 is communicatively coupled.

[0038] For example, Figure 5 1 is a block diagram of an industrial automation system 130A including a system log collector 24, industrial automation devices 132A, 134A, and backplanes 136, 138. It should be noted that backplanes 136, 138 may represent a communication network, a backplane, or both. More specifically, in a particular embodiment, backplanes 136, 138 may be Ethernet networks.

[0039] In some embodiments, the industrial automation device 132A may include an Ethernet adapter 140 that is communicatively coupled to the backplane 136, which is also communicatively coupled to the system log collector 24. Therefore, the Ethernet adapter 140 may receive data messages that are incompatible with the system log collector 24 (e.g., log data or messages that are different from the system log message format). Therefore, the Ethernet adapter 140 (or processing circuitry associated therewith) may convert the data message into an equivalent system log message and provide the converted system log message to the system log collector 24 according to the Ethernet protocol. The industrial automation device 132A may also include a controller 142, an I / O 144, an I / O 146, an I / O 148, and another Ethernet adapter 150, each of which may not be communicatively coupled to the backplane 136 (but may be communicatively coupled to each other using other backplanes). For example, an Ethernet adapter 150 that may communicate according to an Ethernet protocol (e.g., a system log protocol) may be communicatively coupled to the backplane 138 instead of the backplane 136. Furthermore, the controller 142 and the I / Os 144, 146, and 148 may not be configured to communicate using the Ethernet protocol, but may be configured to communicate using other communication protocols (e.g., Therefore, data messages generated by controller 142 , I / O 144 , I / O 146 , I / O 148 , and Ethernet adapter 150 cannot be provided to system log collector 24 .

[0040] In the same manner, the industrial automation device 134A may include an Ethernet adapter 152 that is communicatively coupled to the backplane 138 instead of the backplane 136. The Ethernet adapter 152 may support the Ethernet communication protocol. The industrial automation device 134A also includes I / O 154, I / O 156, I / O 158, I / O 160, and I / O 162 that are not communicatively coupled to any of the backplanes 136, 138 and may communicate with other devices using a protocol different from the Ethernet protocol. Therefore, the data message generated by the Ethernet adapter 152 may be provided to the Ethernet adapter 150 of the industrial automation device 132A instead of being provided to the system log collector 24. In addition, because I / O 154, I / O 156, I / O 158, I / O 160, I / O 162 are non-communicatively coupled to any of the backplanes 136, 138, data messages generated by I / O 154, I / O 156, I / O 158, I / O 160, I / O 162 cannot be received by the system log collector 24.

[0041] In order to enable data messages generated by each of the parts of the industrial automation device to be provided to the system log collector 24, the parts of the device can act as event proxy clients and event proxy servers, both of which can be used to provide data from one industrial automation device (or part thereof) to another industrial automation device (or part thereof). In this way, industrial automation components that do not include Ethernet adapters, automation components connected to a network or backplane other than the system log collector 24, or both of the above can provide system log messages to the system log collector 24. In other words, by utilizing the technology described below, data messages (e.g., event logs) generated by devices that do not access the system log collector 24 can be received and forwarded by other devices until the event log reaches a device that accesses the system log collector 24, at which time such a device can generate a system log message and provide the system log message to the system log collector 24.

[0042] With this in mind, Figure 6 1 is a block diagram of an industrial automation system 130B including a system log collector 24, industrial automation devices 132B, 134B, and backplanes 136, 138. More specifically, Figure 6 An embodiment of an industrial automation system 130 (i.e., industrial automation system 130B) is depicted, wherein the Ethernet adapter 140 is configured as an event proxy server that can: receive event log data (e.g., log data or event messages originating from other interfaces or parts of the industrial automation device 132B (e.g., controller 142, I / O 144, I / O 146, I / O 148, and Ethernet adapter 150) or log data or data messages originating from the industrial automation device 134B); generate system log messages based on the received data; and send the system log messages to the system log collector 24 via the backplane 136 (e.g., using an Ethernet protocol).

[0043] More specifically, controller 142, I / O 144, I / O 146, I / O 148, and Ethernet adapter 150 may be enabled as event proxy clients that send event log data (e.g., data messages) to an event proxy server (e.g., Ethernet adapter 140) using a mechanism that is independent of the network transport layer. For example, the event proxy client may execute computer-readable instructions to utilize an application layer protocol that is supported by multiple devices (e.g., event proxy clients, event proxy servers, and pseudo event proxy servers (as described below)) and functions on any network transport layer utilized by the devices. In one embodiment, the event proxy client may employ a protocol that utilizes the Common Industrial Protocol (CIP) TM) services (e.g., by executing computer-readable instructions), and using methods such as The various protocols and protocols supported by the backplanes 136 and 138 communicate. Therefore, the event proxy client can send data to the event proxy server, and the event proxy server can generate one or more system log messages based on the event log data received from the event proxy client. In addition, as the data (e.g., data message) is transmitted (e.g., transmitted between the event proxy clients until received by the event proxy server, the event proxy server will generate a system log message to provide to the system log collector 24), data about the path of the data (e.g., the origin point and each event proxy client or event proxy server after the origin point) can be added to the data. That is, the system log message generated by the event proxy server may include information about the origin point (e.g., a specific device or part thereof) and each device (e.g., an event proxy client or an event proxy server) through which the data for generating the system log message is routed. By way of example, each of the system log messages may include a specific format consisting of a plurality of fields, a header, a trailer, and other parts of the message (e.g., as defined by the system log protocol). For example, in some embodiments, the APP-NAME field of the header of a system log message generated by an event proxy server may include details about the origin and path through which data from which the system log message was generated was routed to the event proxy server.

[0044] continue Figure 6As discussed above, each component of the industrial automation device 134B can be configured as an event proxy client. However, an event proxy client that is communicatively coupled (e.g., directly communicatively coupled) to an event proxy client of a different network (or a different backplane) can operate as an event server, so that data from a different network (or backplane) can ultimately be provided to the event proxy server, which can provide the system log message to the system log collector 24. For example, an Ethernet adapter 150 and an Ethernet adapter 152 that are communicatively coupled via a backplane 138 and can communicate with each other by using an Ethernet protocol can be event proxy clients that can modify their operation to function as event proxy servers. An event proxy client that can function as an event proxy server can be referred to as a "pseudo event proxy server." Thus, Ethernet adapter 152 may receive event log data (e.g., data messages) from I / O 154, I / O 156, I / O 158, I / O 160, I / O 162, generate system log messages, and provide system log messages (or data received from I / O 154, I / O 156, I / O 158, I / O 160, I / O 162) to Ethernet adapter 150. Ethernet adapter 150 may provide the received system log message or data to Ethernet adapter 140, which may provide the system log message to system log collector 24 or generate a system log message based on the received data and provide the system log message to system log collector 24. Alternatively, Ethernet adapter 150 may generate a system log message, and Ethernet adapter 140 may provide the system log message to system log collector 24. In this way, data from a device or a portion of a device that cannot generate or send a system log message (for example, due to an inability to use the Ethernet protocol) and a device connected to a network (or backplane) different from the system log collector 24 can be provided to an event proxy server that can generate a system log message, and the system log message can be provided to the system log collector 24. In other words, the event proxy server can receive data originally generated by an industrial automation component that communicates using a protocol and convert the data into a system log message according to the Syslog Protocol, and provide the system log message to the system log collector 24.

[0045] To configure itself as an event proxy server, an event proxy client, or a pseudo event proxy server, the industrial automation device 132B, 134B or each component of the industrial automation device 132B, 134B (e.g., the controller 142, I / O 144, I / O 146, I / O 148, I / O 154, I / O 156, I / O 158, I / O 160, I / O 162, and the Ethernet adapters 140, 150, 152) may include processing circuitry and computer-readable media including computer-readable instructions executable by the processing circuitry. With this in mind, Figure 7 is a flow chart of a process 200 for configuring components of an industrial automation device that may be performed by such a processing circuit by executing instructions stored on a computer-readable medium. For example, the process 200 may be performed when the industrial automation device 132B, 134B is powered on or reset.

[0046] At decision block 202, the processing circuitry may determine whether the component is configured to report to the system log collector 24. In other words, the processing circuitry may determine whether the component is capable of communicating directly with the system log collector 24. The processing circuitry may make such a determination by reading a value indicating a setting for a particular component included in an instruction executed by the processing circuitry (e.g., one or more bit values ​​indicating that the component should be set as an event proxy server, an event proxy client, or a pseudo event proxy server). As another example, the processing circuitry may determine that the component is capable of communicating directly with the system log collector 24 by determining that the component and the system log collector 24 are connected to the same network (e.g., a backplane) and determining that the component can communicate using one or more specific protocols (e.g., an Ethernet protocol). Upon determining that the component is configured to report system log messages to the system log collector 24, the processing circuitry may proceed to processing block 204, which may cause the component to be set as an event proxy server. Refer to the following for details. Figure 8 Describes additional details related to operating as an event proxy server.

[0047] However, if at decision block 202, the processing circuit determines that the industrial automation component is not configured to report system log messages to the system log collector 24, the processing circuit can proceed to processing block 206 and can cause the component to identify an event proxy server coupled thereto. In other words, the processing circuit can cause the component to search for another component that has been set up as an event proxy server. For example, the processing circuit can cause a request to be sent within a network or backplane to a component or another portion of an industrial automation device in which the processing circuit is included, and determine which of the received responses indicate that the component of the portion of the industrial automation device is an event proxy server. As another example, the processing circuit can query each connection to the component in which the processing circuit is included, and determine the component to be used as an event proxy server based on the received responses.

[0048] At decision block 208, the processing circuit may determine whether an event proxy server has been found. If no event proxy server is found, the processing circuit may return to processing block 206 to continue searching for an event proxy server. In other words, the processing circuit may continue searching for an event proxy server until an event proxy server is located.

[0049] At decision block 208, if the processing circuitry determines that an event proxy server has been found, the processing circuitry may set the component as an event proxy client for the identified event proxy server at processing block 210. As described above, the event proxy client may provide data messages (e.g., event log messages or data) to an event proxy server (or pseudo event proxy server), which may generate a system log message that may be provided to the system log collector 24.

[0050] At decision block 212, the processing circuit may determine whether a component (e.g., an event proxy client) supports an event proxy server function. The processing circuit may make such a determination by reading a value indicating a setting of a particular component included in an instruction executed by the processing circuit (e.g., one or more bit values ​​indicating that the component should be set to an event proxy server, an event proxy client, or a pseudo event proxy server). If the value indicates that the component should be set to a pseudo event proxy server, the processing circuit may determine that the component supports the event proxy server function. Alternatively, the processing circuit may determine whether the component includes a communication circuit (e.g., an I / O circuit, an Ethernet port, etc.) that communicatively couples the component to another device (e.g., a different industrial automation device connected to a network or backplane different from the system log collector 24). The processing circuit may determine that the component supports the event proxy server function when it is determined that the component is communicatively coupled to another industrial automation device. When it is determined that the component supports the event proxy server function, at processing block 214, the processing circuit may cause the component to be set to a pseudo event proxy server. For example, processing circuitry executing computer readable instructions to perform process 200 may cause a state of a programming object (eg, a "server" object) to become an "enabled" state. Fig. 9 As discussed in more detail, the pseudo event proxy may receive data from a component and provide the data to an event proxy to be converted into system log messages that may be provided to system log collector 24 .

[0051] However, if at decision block 212, the processing circuitry determines that the component does not support event proxy server functionality, then process 200 may end at processing block 216. In other words, the component is still configured as an event proxy client.

[0052] With the foregoing in mind and returning to reference processing block 204, Figure 8 230 is a flow chart of a process 230 that a component may perform after being configured as an event proxy server. In practice, the event proxy server may provide a system log message to the system log collector 24 based on event log data received from another component. Figure 7 Process 230 is performed after process block 204 of process 200 described above.

[0053] At processing block 232, the event proxy server may receive one or more messages from one or more event proxy clients. The messages may be or include event log data generated by the event proxy client. As described above, such data may be sent using a communication protocol different from the Ethernet protocol. For example, a component of an industrial automation device may be communicatively coupled to the event proxy server via a connection different from the Ethernet connection.

[0054] At processing block 234, the event proxy server may generate one or more system log messages based on the received message. As described above, the header of the system log message may include data indicating the origin of the system log message (or underlying data for the system log message) and the path of the data (e.g., from the origin to the event proxy server, inclusive). In addition, although the received data may be formatted in a particular manner (e.g., according to another data format), the event proxy server may reformat the received data according to the system log protocol.

[0055] At processing block 236, the event proxy server may send the system log message to the system log collector 24. For example, the event proxy server may send the system log message to the system log collector 24 according to the Ethernet protocol. In other words, the system log message may be sent to the system log collector 24 using an Ethernet connection to the system log collector 24. More specifically, the event proxy server may send the system log message to the system log collector 24 using a Transmission Control Protocol (TCP) port or a User Datagram Protocol (UDP) port included as an Ethernet adapter (e.g., Ethernet port 3, Ethernet adapter 140).

[0056] Fig. 9 250 is a flowchart of a pseudo event proxy server that can perform to forward data to an event proxy server. Figure 7 Process 250 is performed after the component has been set as a pseudo event proxy server at process block 214 of process 200 .

[0057] At processing block 252, the pseudo event proxy server can receive a message from the event proxy client. The message can be or include event log data generated by the event proxy client. As described above, such data can be sent using a communication protocol different from the Ethernet protocol. For example, the components of the industrial automation device can be communicatively coupled to the pseudo event proxy server via a connection different from the Ethernet connection. The pseudo event proxy server can receive a message from the event proxy client in response to an announcement that can be used as an event proxy server or in response to being queried by other devices or components (e.g., an event proxy client). For example, the pseudo event proxy server can transmit to the event proxy client and other pseudo event proxy servers that the pseudo event proxy server can be used as an event proxy server, and receive a message in response to such communication. In addition, the event proxy client and other pseudo event proxy servers can query the pseudo event proxy server to determine whether the "server" object of the pseudo event proxy server has an "enabled" state. In response to determining that the "server" object of the pseudo event proxy server has an "enabled" state, the event proxy client and other pseudo event proxy servers can determine that the pseudo event proxy server is a pseudo event proxy server, and send a message (e.g., event log data) to the pseudo event proxy server.

[0058] At processing block 254, the pseudo event proxy server can forward received message to event proxy server or another pseudo event proxy server. The pseudo event proxy server can utilize the communication protocol different from the Ethernet protocol to do so. Yet, if the pseudo event proxy server and the event proxy server or another pseudo event proxy server to which a message is sent supports the Ethernet protocol, the pseudo event proxy server can use the Ethernet protocol to forward message. In such a case, the pseudo event proxy server can generate a system log message according to the message, and the system log message is offered to the event proxy server or another pseudo event proxy server.

[0059] Thus, the techniques described herein enable log data from industrial automation devices that are not on the same network or that do not support a particular communication protocol to be provided to a log collector (e.g., system log collector 24). More specifically, the techniques enable the use of several different transport mechanisms and protocols to send log data across unconverged networks, generate system log messages based on the log data, and provide the system log messages to a system log collector (e.g., to be used to make security or control decisions about the industrial automation system). Thus, these techniques can increase the security of industrial automation systems while enhancing the functionality of industrial automation devices that are not on the same network or that do not support the same communication protocol as the log collector.

[0060] Although only certain features of the present embodiments described herein have been shown and described herein, many modifications and changes will occur to those skilled in the art. It is therefore to be understood that the appended claims are intended to cover all such modifications and changes that fall within the true spirit of the present disclosure.

[0061] The technology presented and claimed herein is cited and applied to specific examples of material objects and actual properties that significantly improve the art and are therefore not abstract, intangible, or purely theoretical. In addition, if any claim attached at the end of this specification contains one or more elements designated as "means for performing (function) ..." or "steps for performing (function) ...", it is intended that such elements will be interpreted in accordance with 35 U.S.C. 112(f). However, for any claim containing elements designated in any other manner, it is intended that such elements will not be interpreted in accordance with 35 U.S.C. 112(f).

Claims

1. An industrial automation system, comprising: a collector component communicatively coupled to the first network and configured to receive one or more event logs via a first communication protocol; a first industrial automation component communicatively coupled to the first network via a first adapter, wherein the first industrial automation component is configured to communicate via the first communication protocol, and wherein the first adapter is configured as an event proxy server; and A second industrial automation component includes one or more parts and a second adapter, wherein each of the one or more parts and the second adapter are configured as an event proxy client, wherein the second adapter is coupled to a second network, the second network being different from the first network, wherein the second adapter is configured to: communicating via a second communication protocol different from the first communication protocol to receive event log data from the one or more portions of the second industrial automation component; generating a first event log based on the event log data, the first event log representing attributes associated with the second industrial automation component; and The first event log is sent to a third adapter of the first industrial automation component, wherein the third adapter provides the first event log to the first adapter for sending to the collector component via the first network.

2. The industrial automation system according to claim 1, wherein: The first communication protocol is the Ethernet protocol.

3. The industrial automation system according to claim 1, wherein: The first event log includes system log messages.

4. The industrial automation system according to claim 3, wherein: The system log message includes data indicating that the second industrial automation component is the origin of the first event log and that the first industrial automation component has received the first event log from the second industrial automation component.

5. The industrial automation system according to claim 1, wherein: The first network includes a first backplane, and the second network includes a second backplane different from the first backplane.

6. The industrial automation system according to claim 1, wherein: The second network includes a ControlNet network, a DeviceNet network, a data highway plus network, a remote I / O network, a basic fieldbus network, a serial DH-485 network, a synchronous link network or any combination thereof.

7. A non-transitory computer-readable medium comprising instructions that, when executed, cause a processing circuit of a first industrial automation component communicatively coupled to a first network through a first adapter configured as an event proxy server using a first communication protocol to: receiving event log data from the one or more parts from a second industrial automation component including the one or more parts and a second adapter using a second communication protocol different from the first communication protocol, wherein: Each of the one or more portions and the second adapter are configured as an event proxy client, wherein the second adapter is coupled to a second network different from the first network and sends the event log data to a third adapter of the first industrial automation component, the third adapter providing the event log data to the first adapter of the first industrial automation component; generating one or more system log messages based on the event log data, the one or more system log messages being communicable using the first communication protocol; and The one or more syslog messages are sent to a syslog collector over the first network via the first adapter of the first industrial automation component.

8. The non-transitory computer readable medium of claim 7, wherein: Each of the one or more system log messages includes data indicating an origin of the event log data and that the first industrial automation component has received the event log data from the second industrial automation component.

9. The non-transitory computer readable medium of claim 7, wherein: When the instructions are executed, the processing circuit performs the following operations: determining whether the first industrial automation component is configured to report to the system log collector; as well as After determining that the first industrial automation component is configured to report to the system log collector, the event log data is received from the second industrial automation component.

10. The non-transitory computer readable medium of claim 7, wherein: The first industrial automation component comprises an Ethernet adapter; and The second communication protocol includes an Ethernet protocol.

11. A computer-implemented method comprising: receiving, via a first industrial automation component communicatively coupled to a first network through a first adapter configured as an event proxy server using a first communication protocol, event log data from a second industrial automation component including one or more parts and a second adapter using a second communication protocol different from the first communication protocol, wherein each of the one or more parts and the second adapter are configured as an event proxy client, wherein the second adapter is coupled to a second network and sends the event log data to a third adapter of the first industrial automation component, the third adapter providing the event log data to the first adapter of the first industrial automation component, the second network being different from the first network, wherein the event log data represents attributes associated with the second industrial automation component; generating, via the first industrial automation component, one or more system log messages based on the event log data, the one or more system log messages being communicable using the first communication protocol; and The one or more syslog messages are sent to a syslog collector over the first network via the first adapter of the first industrial automation component.

12. The computer-implemented method of claim 11, wherein: The first communication protocol is not supported by the second industrial automation component.

13. The computer-implemented method of claim 11 , wherein: The second communication protocol includes an Ethernet protocol.

14. The computer-implemented method of claim 11, wherein: The first industrial automation component includes a controller of an industrial automation system.

15. The computer-implemented method of claim 11, wherein: The first industrial automation component comprises a first Ethernet adapter; and The second industrial automation component includes a second Ethernet adapter.

16. The computer-implemented method of claim 11, wherein: Each of the one or more system log messages includes data indicating an origin of the event log data and that the first industrial automation component has received the event log data from the second industrial automation component.

Images