Monitoring device, monitoring method, and program

Abstract

To provide a monitoring device, a monitoring method, and a program that enables detailed and easy understanding of the status of network devices from a remote location.SOLUTION: A monitoring device includes a target node holding unit which holds one or more target nodes within a network that are to be investigated, an investigation unit which acquires and investigates the status of the target nodes via the network, a policy holding unit which holds one or more investigation policies which define a policy for investigating the nodes to be investigated, and a policy selection unit which selects an investigation policy depending on the status of the target nodes, in which the investigation unit performs an investigation of the target nodes held by the target node holding unit on the basis of the selected policy.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a monitoring device, a monitoring method, and a program that enable detailed and easy monitoring of the status of network devices from a remote location. [Background technology]

[0002] Many nodes (terminals, servers, routers, switches, etc.) are interconnected on a network, making it nearly impossible to grasp the whole picture. This is because the networks and nodes in use are not necessarily under one's ownership, and one does not necessarily manage everything by oneself. In other words, if there is a problem with a network or computer under the management of another party, there is no way to know that a problem has occurred other than by communicating with that party. For this reason, when the purpose is to monitor the status of a network or computer managed by another party, communication (probe communication) may be carried out periodically in the hope of receiving a response from the other party's nodes, etc.

[0003] Patent Document 1 discloses an invention of a device or the like in which a network investigation server investigates the state of the communication path of a network to be investigated. In this invention, order information indicating the order in which to investigate target devices (nodes) for each network is recorded, and the network investigation server investigates the communication path of the target devices based on that order. The investigation method is to first sequentially send request signals using a ping command or the like, and detect the presence or absence of a response from the target devices to determine whether or not it is possible to send an investigation command to the target devices. The server then executes an investigation command based on a command table stored therein, and investigates the state of the communication path. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2018-157292 A Summary of the Invention [Problem to be solved by the invention]

[0005] The disclosures of the above-mentioned prior art documents are incorporated herein by reference. The following analysis has been carried out by the present inventors.

[0006] As described above, in the invention disclosed in Patent Document 1, the management entity embodied as the network investigation server of Patent Document 1 centrally performs investigation communications with the target devices, thereby consolidating and reducing the management effort. In addition, even if an abnormality occurs in the communication path, it can be detected within the investigation interval at most, so that a rapid response can be made by setting the investigation interval appropriately.

[0007] However, the invention disclosed in Patent Document 1 does not mention the survey interval, which is the time interval for conducting survey communications, and as the survey interval increases, the resolution for detecting abnormalities such as failures decreases.On the other hand, as the survey interval decreases, the resolution for detecting abnormalities increases, but the communication volume increases, which may cause congestion within the route.

[0008] Secondly, even if an abnormality is detected, it is impossible to geographically locate it. In the investigation disclosed in Patent Document 1, the target devices are limited using a finite list, so if a fault is detected at a specific IP address, for example, the geographical location can be identified by referring to a list in which the IP address, server name, and installation location are associated. By placing the target devices on a map and outputting the map via a display device, it is possible to easily grasp where the abnormality is occurring.

[0009] However, in the case of an open network environment that does not have the limitations (management boundaries) described above and includes areas managed by others, it has not been easy to associate network identifiers, such as IP addresses, with geographical locations using conventional technology.

[0010] Therefore, in one aspect of the present invention, an object is to provide a monitoring device, a monitoring method, and a program that enable detailed and easy understanding of the state of network devices from a remote location. [Means for solving the problem]

[0011] According to a first aspect of the present invention, a monitoring device is provided which comprises a target node holding unit which holds one or more target nodes that are targets of investigation within a network, an investigation unit which acquires and investigates the status of the target nodes via the network, a policy holding unit which holds one or more investigation policies that define a policy for investigating the targets of investigation, and a policy selection unit which selects the investigation policy in accordance with the status of the target nodes, wherein the investigation unit performs investigation of the target nodes held by the target node holding unit based on the selected policy.

[0012] According to a second aspect of the present invention, there is provided a monitoring method that causes a computer to execute the following steps, the monitoring method including a step of acquiring one or more target nodes that are to be investigated within a network, a step of acquiring and investigating the status of the target nodes via the network, a step of acquiring one or more investigation policies that define a policy for investigating the investigation targets, a step of selecting the investigation policy according to the status of the target nodes, and a step of performing an investigation of the target nodes based on the selected policy.

[0013] According to a third aspect of the present invention, there is provided a program for causing a computer to execute the following processes: a process of acquiring one or more target nodes that are to be investigated within a network; a process of acquiring and investigating the status of the target nodes via the network; a process of acquiring one or more investigation policies that define a policy for investigating the targets to be investigated; and a process of selecting the investigation policy depending on the status of the target nodes, and a process of executing an investigation of the target nodes based on the selected policy.

[0014] The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, an optical recording medium, etc. The present invention can also be embodied as a computer program product. Effect of the Invention

[0015] According to each aspect of the present invention, it is possible to provide a monitoring device, a monitoring method, and a program that enable detailed and easy understanding of the state of network devices from a remote location. [Brief description of the drawings]

[0016] [Figure 1] 1 is a block diagram showing an example of a configuration of a monitoring device according to an embodiment; [Diagram 2] 4 is a diagram illustrating an example of a list held by a target node holding unit in the monitoring device of the first embodiment. FIG. [Diagram 3] 4 is a diagram illustrating an example of a policy table stored in a policy storage unit in the monitoring device of the first embodiment; FIG. [Figure 4] 4 is a flowchart illustrating the operation of the monitoring device of the first embodiment. [Diagram 5] 1 is a schematic diagram illustrating an example of a hardware configuration of a monitoring device according to a first embodiment. [Figure 6] FIG. 11 is a block diagram showing an example of the configuration of a monitoring device according to a second embodiment. [Figure 7] 13(a) to 13(c) are diagrams for illustrating visualization results obtained by a node visualization unit. [Figure 8] 11 is a schematic diagram showing an example of a map output by a node visualization unit. FIG. [Figure 9] 13 is a flowchart for explaining the operations of a monitoring device in a second embodiment, particularly the operations of a survey unit, a distance measuring / location unit, and a node visualization unit. [Figure 10]13A and 13B are diagrams illustrating an overview of the process of the monitoring device 10 of the third embodiment. [Figure 11] 11 is a diagram showing an example of a target node list held by a target node holding unit; FIG. [Figure 12] 11 is a diagram showing an example of a mode of target node selection by a target node selection unit; FIG. [Figure 13] FIG. 13 is a diagram showing an example of a policy applied in the fourth embodiment. [Figure 14] 13A and 13B are flowcharts illustrating the operation of a monitoring device according to a fourth embodiment. [Figure 15] FIG. 13 is a diagram showing an overview of the process according to the fifth embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] First, an overview of one embodiment will be described. Note that the reference numerals in the drawings are given to each element for convenience as an example to aid in understanding, and the description of this overview is not intended to be limiting in any way.

[0018] 1 is a block diagram showing an example of the configuration of a monitoring device according to an embodiment. The monitoring device 10 according to the embodiment includes a target node holding unit 11, an investigating unit 12, a policy holding unit 13, and a policy selecting unit 14.

[0019] The target node holding unit 11 holds one or more target nodes that are investigation targets within the network. The investigation unit 12 acquires the status of the target nodes via the network and investigates them. The policy holding unit 13 holds one or more investigation policies that define a policy for investigating the investigation targets. The policy selection unit 14 selects an investigation policy depending on the status of the target nodes. The investigation unit 12 further executes an investigation of the target nodes held by the target node holding unit 11 based on the selected policy.

[0020] In this way, the monitoring device of one embodiment can investigate the target node based on an investigation policy that defines the policy for investigating the investigation target. By investigating the target node that is the investigation target not uniformly but based on a certain policy, it is possible to execute an adaptive investigation that is more in line with the network state. This makes it possible to grasp the state of the network devices in more detail.

[0021] [First embodiment] [Device configuration] An example of the configuration of the monitoring device of the first embodiment is similar to the example of the configuration of the first embodiment, as shown in Fig. 1. The monitoring device 10 of the first embodiment includes a target node holding unit 11, an investigation unit 12, a policy holding unit 13, and a policy selection unit 14, as in the first embodiment. The feature of this embodiment is that the investigation unit 12 transmits an investigation packet based on the selected policy, The policy selection unit 14 selects a policy based on the result of sending the investigation packet.

[0022] The target node holding unit 11 holds one or more target nodes that are survey targets within a network. A "network" includes both a closed network with access restrictions, such as a LAN (Local Area Network), and an open network that anyone can access, such as the Internet. A "target node" is a node that is the subject of survey, and a "node" refers to a network device on the network that has a network interface, including terminals, servers, routers, switches, etc.

[0023] The target node storage unit 11 is a list that stores at least an IP address, a MAC address, etc., which are identification values ​​in a network, in order to identify a target node. Figure 2 shows an example of a list stored in the target node storage unit 11. As shown in this figure, for example, an IP address, a server name (FQDN), a MAC address, or a combination of these, is an identification value.

[0024] The investigation unit 12 investigates and acquires the state of the target node via the network. Specifically, an investigation packet is sent to the target node based on a policy selected by a policy selection unit 14 described later. The investigation packet is sent by, for example, a ping command using ICMP (Internet Control Message Protocol), a tracert (traceroute) command sent using ICMP or UDP, or other application software that can use SNMP (Simple Network Management Protocol), etc.

[0025] The information acquired by the investigation unit 12 includes, for example, error, packet loss rate, statistical summary of the results (minimum, maximum, average round trip time), etc. The investigation unit 12 acquires an RTT (Round Trip Time) value as a transmission result of the investigation packet. The policy selection unit 14 described later may select a policy based on the RTT value.

[0026] The policy holding unit 13 holds one or more investigation policies that define the direction for investigating an investigation target. A "policy" is the direction in which an investigation target is investigated. FIG. 3 is a diagram showing an example of a policy table held by the policy holding unit 13. As shown in this diagram, a policy ID and the contents of the policy are associated and stored. The "contents" may include items such as the target node ID, a command for execution, an investigation period, a policy switching condition, and a policy to switch to when the switching condition is satisfied.

[0027] In the policy ID:0 shown in FIG. 3, the investigation flow 1 is executed for all target node IDs (token: _ALL_). Here, the "investigation flow" is the specific content of the command executed by the investigation unit 12 in response to the policy selection by the policy selection unit 14 described later. An example of the "investigation flow 1" is flow 1 in FIG. 14(a), and an example of the "investigation flow 2" is flow 2 in FIG. 14(b). The investigation period of the policy ID:0 is 1 [sec], so an investigation packet is sent every second. Here, for example, if the response to the investigation packet times out, the policy transitions to policy ID:1. In the policy ID:1, the investigation flow 2 is executed for the set of target nodes that timed out (token: _TIMEOUT_). After execution, if the number of target items becomes 0, that is, an investigation packet is sent to all target nodes that timed out, and if the response packet is received before the timeout, the policy transitions to policy ID:0 again.

[0028] The policy selection unit 14 selects an investigation policy according to the state of the target node. Specifically, the policy is selected based on the transmission result of the investigation packet. For example, the policy may be selected based on whether the RTT value, which is the transmission result of the investigation packet, is equal to or less than a predetermined value. Referring to FIG. 3, the policy selection unit 14 corresponds to the items "switching condition" and "switching destination" in the policy table.

[0029] [Explanation of operation] 4 is a flowchart for explaining the operation of the monitoring device 10 of the first embodiment. As shown in this figure, when the monitoring device 10 starts operation, it accesses the storage area and acquires one or more target nodes (step S41). Next, the monitoring device 10 similarly accesses the storage area and acquires one or more investigation policies (step S42). Here, the one or more target nodes and the one or more investigation policies may be ones that the monitoring device 10 acquires via a network and temporarily stores in the storage area.

[0030] Next, an investigation policy is selected according to the state of the target node (step S43). When an investigation policy is selected for the first time, since the "state of the target node" is empty, a default value may be prepared and an investigation policy may be selected based on this.

[0031] Next, based on the selected policy, the state of the target mode is acquired via the network and an investigation is performed. After that, it is determined whether or not to end the monitoring. If it is determined to end (step S45, Y), the process ends, and if it is determined not to end (step S45, N), the process returns to the process of selecting the investigation policy again (step S43).

[0032] [Hardware configuration] Next, a description will be given of the hardware configuration of the monitoring device 10 according to the first embodiment. Fig. 5 is a block diagram showing an example of the hardware configuration of the monitoring device 10 according to the first embodiment.

[0033] The monitoring device 10 constituting the monitoring device can be configured by an information processing device (computer) and has the configuration exemplified in Fig. 5. For example, the monitoring device 10 includes a CPU (Central Processing Unit) 51, a memory 52, an input / output interface 53, and a NIC (Network Interface Card) 54 as a communication means, which are mutually connected by an internal bus 55.

[0034] However, the configuration shown in Fig. 5 is not intended to limit the hardware configuration of each device constituting the monitoring device 10. The monitoring devices 10 may each include hardware not shown, and may not include the input / output interface 53 as necessary. Furthermore, the number of CPUs and the like included in the monitoring device 10 is not intended to be limited to the example shown in Fig. 5, and for example, each device may include multiple CPUs.

[0035] The memory 52 is a random access memory (RAM), a read only memory (ROM), or an auxiliary storage device (such as a hard disk).

[0036] The input / output interface 53 is a means for interfacing with a display device and an input device (not shown). The display device is, for example, a liquid crystal display, etc. The input device is, for example, a keyboard, a mouse, etc. that accepts user operations.

[0037] The functions of the monitoring device 10 are realized by an acquisition program, a selection program, an investigation program, which are processing modules, a list of target nodes held in the memory 52 or the like, a table defining an investigation policy, and the like.

[0038] The above processing modules are realized, for example, by the CPU 51 executing the programs stored in the memory 52. ​​The programs can be updated by downloading them via a network or by using a storage medium storing the programs. The above processing modules may be realized by semiconductor chips. That is, it is only necessary to have some means for executing the functions performed by the above processing modules by some hardware and / or software.

[0039] [Hardware operation] When the monitoring device 10 starts operating, an acquisition program is called from the memory 52 and is executed by the CPU 51. The program accesses the storage area of ​​the monitoring device 10 itself or another device or system, and acquires a list of target nodes and a table that defines the investigation policy. The acquired data is stored in the memory 52.

[0040] Next, the selection program is called from the memory 52 and is in an execution state in the CPU 51. By that time, the investigation program has also been called from the memory 52 and is in an execution state in the CPU 51. The selection program and investigation program read the table that defines the investigation policy stored in the memory 52, and the selection program passes the policy ID to be selected to the investigation program. Since there is no selected policy in the initial state, for example, policy ID: 0 in FIG. 3 is selected as a default value and passed to the investigation program. The selection program refers to the switching conditions and switching destination in the table that defines the investigation policy, and when the switching conditions are satisfied during the operation of the investigation program, it selects the switching destination policy and passes it to the investigation program. The investigation program refers to the table that defines the investigation policy, refers to the record related to the passed policy ID, reads each field, and executes the contents described in the field. Since the investigation is performed via a network, the above process is repeated via the NIC 54 of the monitoring device 10 until the end of monitoring.

[0041] [Effect description] As described above, the monitoring device 10 of this embodiment can perform an investigation while switching the investigation policy according to the state of the target node. This makes it possible to execute an investigation according to the state of the target node, and to execute an adaptive investigation that is more in line with the state of the network. This makes it possible to grasp the state of the network devices in more detail.

[0042] [Second embodiment] In the second embodiment, a monitoring device capable of identifying the positions of nodes under investigation within a network and the distance between the nodes, and visualizing the positions of the target nodes and the distance between the nodes will be described.

[0043] [Device configuration] 6 is a diagram showing an example of the configuration of a monitoring device 10 of the second embodiment. As shown in this diagram, the monitoring device 10 of this embodiment has a target node holding unit 11, an investigation unit 12, a policy holding unit 13, and a policy selection unit 14. These components have been explained in the above embodiment, so a description thereof will be omitted. A feature of the monitoring device 10 of this embodiment is that it has a ranging and location unit 15 and a node visualization unit 16 in addition to the components of the monitoring device 10 of the above embodiment.

[0044] The ranging and location unit 15 determines the distance between nodes in the network and the positions of the nodes. "Distance between nodes" refers to the physical distance between nodes located within a route provided by the network. "Position of a node" refers to the physical position of a node (which can be shown on a map). The physical distance between nodes can be used to determine the physical position of the node.

[0045] The investigation unit 12 of the monitoring device 10 transmits an investigation packet P to other target nodes and receives a response packet R as a transmission result. The ranging and location unit 15 then obtains the transmission time Tp at which the investigation packet P was transmitted and the reception time Tr at which the response packet R was received. Next, the round trip time RTT is calculated using the transmission time Tp and the reception time Tr and equation (1).

[0046] Round trip time RTT = reception time Tr - transmission time Tp (1)

[0047] The distance measurement and location unit 15 acquires the medium speed Vm of the transmission medium between the node and another target node. The distance between the node and another target node can be calculated using the formula (2).

[0048] Distance r1 = (medium speed Vm x round trip time RTT) ÷ 2 (2)

[0049] Similarly, when distances (r2, r3) to the other target nodes are calculated from two other points (which may be nodes newly acquired by the investigation packet of the investigation unit 12) in addition to r1, the position coordinates (x, y) of the other target nodes can be calculated by so-called three-point positioning. That is, the coordinates (x, y) of the intersections of circles with radii r1, r2, and r3 centered on the coordinates of the three points (x1, y1), (x2, y2), and (x3, y3) are calculated. (x-x1)^2+(y-y1)^2=r1^2 (x-x2)^2+(y-y2)^2=r2^2 (x-x3)^2+(y-y3)^2=r3^2 By solving the above x and y, the position coordinates (x, y) of the target node are obtained.

[0050] In this way, the distance measuring and locating unit 15 can use the transmission results of the investigation packets sent by the investigation unit 12 to identify the distances between nodes in the network and the positions of the nodes.

[0051] The node visualization unit 16 visualizes and outputs the nodes by arranging them on a map based on the positions of the nodes in the network and the distances between the nodes. Fig. 7(a)-(c) are diagrams for explaining an example of the visualization result by the node visualization unit 16. Fig. 7(a) shows three observation points indicated by "x" and nodes 1-4 which have sent and received an investigation packet by the investigation unit 12 and whose positions have been specified by the ranging and location unit 15. Note that the observation points indicated by "x" may also be included in the target nodes.

[0052] Figure 7(b) shows an example of output in which node 2 has timed out in the results of sending a survey packet. In the initial survey, node 2 responded within a specified time, but in the latest transmission result, there was no response within the specified time, resulting in a timeout. In Figure 7(c), node 2 also timed out in the initial survey, and there has been no response since, so ranging and location are impossible, and a text message indicating a timeout is displayed.

[0053] The node visualization unit 16 may perform visualization using the positions of the nodes in the network identified by the distance measurement and location unit 15 and the distances between the nodes, and output a map. Fig. 8 is a schematic diagram showing an example of a map output by the node visualization unit 16. As shown in this figure, the node visualization unit 16 can arrange the nodes output in Fig. 7 on a topographical map. In this case, the coordinate values ​​indicated by (x, y) above may be expressed as values ​​based on latitude and longitude, and the nodes may be arranged on the topographical map based on these values.

[0054] [Explanation of operation] FIG. 9 is a flow chart for explaining the operation of the monitoring device 10 in the second embodiment, particularly the operation of the investigation unit 12, the distance measurement and location unit 15, and the node visualization unit 16. First, before the operation, the policy selection unit 14 selects a policy. Based on the selected policy, an investigation is performed, and t: the node to be investigated, RTT: round trip time, status: response status, and the like are acquired (step S91). From the acquired results, it is determined whether or not a timeout has occurred (step S92). If no timeout has occurred (step S92, N), distance measurement and location are performed for t (step S93). In response to the result, a figure corresponding to t is output on the map (step S94). If a timeout has occurred (step S92, Y), a display indicating that there has been no response from the target node t is output on the map (step S95). The monitoring device 10 executes the above series of processes while t exists.

[0055] [Effect description] According to the monitoring device 10 of this embodiment, it is possible to calculate the distance between nodes in a network and locate the target node using the distance. In addition, it is possible to visualize and output the result of the location, and for example, it is possible to identify the physical position of the target node on a map. Therefore, it is possible to map and refer to the state of the target node on a map, and it is possible to easily grasp the state in the network even if there are many target nodes.

[0056] [Third embodiment] In the third embodiment, based on the monitoring device 10 of the above embodiment, a monitoring device 10 capable of adding a node to the target node holding unit 11 according to the state of the target node is provided.

[0057] [Device configuration] The monitoring device 10 of the third embodiment has a target node holding unit 11, an investigation unit 12, a policy holding unit 13, and a policy selection unit 14, similarly to the above embodiments. These components have been explained in the above embodiments, so the explanation will be omitted. Although not essential components, the monitoring device 10 may also have a distance measurement and location unit 15 and a node visualization unit 16. The above components have been explained in the above embodiments, so the explanation will be omitted.

[0058] A feature of this embodiment is that the investigating unit 12 further acquires the nodes through which the investigation packet passed as a transmission result of the investigation packet, and adds the nodes to the target node holding unit 11 based on the transmission result.

[0059] 10(a) and 10(b) are diagrams showing an overview of an example of the processing of the monitoring device 10 of this embodiment. As shown in FIG. 10(a), the monitoring device 10 has found that, as a result of an investigation, there are four target nodes 1-4 within the monitoring target range. As the investigation continues, new responses to the investigation packet are received from nodes 5 and 6, resulting in the visualization shown in FIG. 10(b). Specifically, this is the case when, as a result of acquiring a route to a specific server using a tracert command, the route is changed due to a change in routing by a router, and the route passes through nodes 5 and 6, and the existence of the server is recognized.

[0060] 11 is an example of a target node list held by the target node holding unit 11. As described above, when a new target node is discovered by investigation, first, nodes 5 and 6 that have newly responded are added to the target node list as investigation targets.

[0061] As described in the above embodiment, the physical positions (positions on a map) of nodes 5 and 6 can be calculated by determining the distance from other nodes whose physical positions are known. For example, an investigation packet is sent from observation points A to C in FIG. 10(b), and a response packet is received from each. The RTT can be obtained by taking the difference between the reception time and the transmission time. Next, the media speed of each section is obtained, and the distance from each point to nodes 5 and 6 is calculated using the relationship Distance = (Media speed x Round trip time RTT) ÷ 2. Then, the physical positions of nodes 5 and 6 can be identified by calculating the coordinates of the intersections of circles whose radii are the distances from each of points A to C to nodes 5 and 6.

[0062] [Effect description] When the monitoring device 10 of this embodiment recognizes a new target node, it can add it to the target node list held by the target node holding unit. In addition, by transmitting an investigation packet, it is possible to calculate the distance to the added target node and calculate its physical location.

[0063] [Fourth embodiment] In the fourth embodiment, based on the monitoring device 10 of the above embodiment, a monitoring device 10 is provided that is capable of performing a more detailed investigation by specifying a node to be investigated preferentially depending on the state of the target node during the investigation.

[0064] [Device configuration] The monitoring device 10 of the fourth embodiment has a target node holding unit 11, an investigation unit 12, a policy holding unit 13, and a policy selection unit 14, similarly to the above embodiments. These components have been explained in the above embodiments, so the explanation will be omitted. In addition, although not essential components, the monitoring device 10 may have a distance measurement and location unit 15 and a node visualization unit 16. The above components have been explained in the above embodiments, so the explanation will be omitted.

[0065] A feature of this embodiment is that the investigating unit 12 extracts priority target nodes to be investigated in preference to the target nodes initially investigated, depending on the state of the target nodes, and investigates the priority target nodes.

[0066] Furthermore, the monitoring device 10 of this embodiment may have a target node selection unit (not shown). This unit selects nodes arranged on a map as target nodes. An example of a selection mode is shown in FIG. 12. As shown in this figure, a rectangle is selected with the mouse on the display screen, and target nodes 2 and 6 are included in the selection area. Then, nodes 2 and 6 are added to the temporary target list. The temporary target list inherits the characteristics of the priority target nodes, and the investigation unit 12 can carry out an investigation with nodes 2 and 6 included in the temporary target list as priority target nodes.

[0067] 13, when a target node is added to the temporary target list, policy ID:2 is applied accordingly. Policy ID:2 specifies that flow 1 is applied to the target node in the list, and once the investigation is complete, flow 0 is returned to.

[0068] In this way, by having a target node selection unit, it is possible to select the investigation target simply and intuitively, thereby enabling highly convenient monitoring.

[0069] [Explanation of operation] 14(a) and (b) are flow charts for explaining the operation of the monitoring device 10 of this embodiment. Here, (a) flow 1 is the operation of the monitoring device 10 in normal operation. First, the xth (x=1, 2, ...) target node in the target node list is acquired (step S1401). Next, x is incremented (step S1402), and a ping, which is a survey packet, is sent to t (step S1403). Next, the RTT is calculated using the execution result of the ping (step S1404). Here, it is determined whether a timeout has occurred (step S1405). If no timeout has occurred (step S1405, N), (t, RTT, normal termination) is returned (step S1406). On the other hand, if a timeout has occurred (step S1405, Y), t is registered in the priority list (step S1407), and (t, 0, timeout) is returned (step S1408).

[0070] Here, the policy holding unit 13 holds a policy as shown in the example of FIG. 13. The current process is being executed according to policy ID:0, and investigation flow 1 is being executed at one-second intervals. Since policy ID:0 states that if a timeout occurs, the process will move to policy ID:1, referring to policy ID:1, it states that flow 2 will be executed at one-second intervals. Then, according to policy ID:1, the process will be executed according to flow 2 in FIG. 10(b). First, the y-th (y=1, 2...) element s in the priority list is obtained (step S1409). Next, a ping, which is an investigation packet, is sent to s (step S1410). Next, the RTT is calculated using the execution result of ping (step S1411). Here, it is determined whether a timeout has occurred (step S1412). If no timeout has occurred (step S1412, N), s is deleted from the priority list (step S1413), and the number of elements in the priority list is obtained (step S1414). If a timeout occurs (step S1412, Y), the number of elements in the priority list is immediately obtained (step S1414). Next, it is determined whether the number of remaining elements is greater than 0 (step S1415). If it is greater than 0 (not 0) (step S1415, Y), y is incremented (step S1416) and y is returned as the number of elements in the priority list (step S1417). If the number of remaining elements is 0 or less (is 0) (step S1415, N), y is immediately returned as the number of elements in the priority list (step S1417).

[0071] Referring to FIG. 13, when the result of executing flow 2 in FIG. 14(b) is that 0 is returned, that is, when the remaining number of elements becomes 0, the process returns to policy 0.

[0072] [Effect description] According to the monitoring device 10 of this embodiment, the target node whose response to the investigation packet has timed out is added to the priority list, thereby switching the policy to be applied and intensively sending more investigation packets than usual to the target nodes in the priority list, making it possible to investigate the target nodes in the network in more detail.

[0073] [Fifth embodiment] In the fifth embodiment, the investigation unit 12 acquires, as a result of transmitting an investigation packet, at least the round-trip time until receiving a response packet to the transmitted investigation packet, and estimates the load state of the target node based on the round-trip time. Based on the estimation, the node visualization unit 16 performs visualization according to the load state, and provides a monitoring device 10 that can output a map with the state superimposed on the position of the target node.

[0074] [Device configuration] Similar to the above embodiments, the monitoring device 10 of the fifth embodiment includes a target node holding unit 11, an investigation unit 12, a policy holding unit 13, a policy selection unit 14, a distance measurement and location unit 15, and a node visualization unit 16. These components have been described in the above embodiments, so description thereof will be omitted.

[0075] Fig. 15 is a diagram showing an overview of the processing of the monitoring device 10 of this embodiment. As shown in this figure, a color is superimposed on each node, and the amount of communication traffic is estimated to be high according to the darkness of the color. Here, the investigation unit 12 estimates that the load of a node is high according to the magnitude of the fluctuation (variance value) of the round-trip time for the investigation packet. Furthermore, it is assumed that the high load state of a node connected to the network is caused by a large amount of communication traffic, and the amount of communication traffic is visualized by the darkness of the color.

[0076] In this way, the monitoring device 10 of this embodiment is capable of visualizing and outputting the amount of communication traffic as the investigation result, thereby making it possible to grasp the state of the target node at a glance.

[0077] Some or all of the above embodiments can also be described as follows, but are not limited to the following. [Form 1] This is the same as the monitoring device according to the first aspect described above. [Form 2] Preferably, the monitoring device according to aspect 1, wherein the investigation unit transmits an investigation packet based on the selected policy, and the policy selection unit selects a policy based on a transmission result of the investigation packet. [Form 3] Preferably, the monitoring device of aspect 2, wherein the investigation unit obtains an RTT (Round Trip Time) value as a transmission result of the investigation packet, and the policy selection unit selects a policy based on the RTT value. [Form 4] Preferably, the monitoring device of aspect 2, wherein the investigation unit obtains the nodes through which the investigation packet passed as a transmission result of the investigation packet, and adds the nodes to the target node holding unit based on the transmission result. [Form 5] A monitoring device preferably of any one of forms 2 to 4, further comprising a ranging and location unit that identifies the distance between nodes in the network and the positions of the nodes, wherein the investigation unit obtains the nodes through which the investigation packet passed as a transmission result of the investigation packet, and the ranging and location unit identifies the distance between nodes in the network and the positions of the nodes using the transmission result. [Form 6] A monitoring device of preferably form 5, further comprising a node visualization unit which visualizes and outputs the nodes by arranging the nodes on a map based on the distances between the nodes in the network and the positions of the nodes, wherein the node visualization unit visualizes and outputs a map using the positions of the nodes in the network identified by the ranging / location unit and the distances between the nodes. [Form 7] Preferably, the monitoring device of aspect 1 or 2, wherein the investigation unit extracts a priority target node to be investigated in preference to the target node initially investigated depending on the state of the target node, and investigates the priority target node. [Form 8] Preferably, the monitoring device of aspect 7 further comprises a target node selection unit which selects a node arranged on the map as a target node, and the investigation unit performs investigation by setting the target node as a priority target node. [Form 9] Preferably, a monitoring device of form 6, wherein the investigation unit obtains at least the round-trip time until receipt of a response packet in response to the investigation packet as a result of sending the investigation packet, and estimates the load state of the target node based on the round-trip time, and the node visualization unit performs visualization according to the load state and outputs a map by superimposing it on the position of the target node. [Form 10] This is the same as the monitoring method relating to the second aspect described above. [Form 11] This is as per the program related to the third perspective mentioned above. Incidentally, like mode 1, modes 10 and 11 can be expanded into modes 2 to 9.

[0078] The disclosures of the above cited patent documents and the like are incorporated herein by reference. Within the framework of the entire disclosure of the present invention (including the scope of claims), modifications and adjustments of the embodiments and examples are possible based on the basic technical ideas. Furthermore, within the framework of the entire disclosure of the present invention, various combinations and selections of the various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible. In other words, the present invention naturally includes various modifications and corrections that a person skilled in the art would be able to make in accordance with the entire disclosure including the scope of claims and the technical ideas. In particular, with regard to the numerical ranges described in this specification, any numerical value or subrange included in the range should be interpreted as being specifically described even if not otherwise specified. [Explanation of symbols]

[0079] 10: Monitoring device 11: Target node storage section 12: Research Department 13: Policy storage unit 14: Policy selection section 15: Ranging / locating section 16: Node visualization part 18: Route holding section 51: CPU 52: Memory 53: Input / Output Interface 54:NIC 55: Internal bus

Claims

1. a target node storage unit that stores one or more target nodes that are targets of investigation within a network; an investigation unit that acquires and investigates the state of the target node via a network; a policy holding unit that holds one or more investigation policies that define a policy for investigating an investigation target node; a policy selection unit that selects the investigation policy according to a state of the target node; having the investigating unit investigates the target node held by the target node holding unit based on the selected policy; Monitoring equipment.

2. The investigation unit transmits an investigation packet based on the selected policy, The monitoring device according to claim 1 , wherein the policy selection unit selects a policy based on a transmission result of the probe packet.

3. The checking unit obtains an RTT (Round Trip Time) value as a result of sending the checking packet, The policy selection unit selects a policy based on the RTT value. The monitoring device of claim 2.

4. the investigating unit acquires the nodes through which the investigation packet has passed as a result of transmission of the investigation packet, and adds the nodes to the target node holding unit based on the transmission result. The monitoring device of claim 2.

5. a ranging and location unit for determining distances between nodes and the locations of the nodes in the network; and The investigation unit acquires nodes through which the investigation packet has passed as a result of transmission of the investigation packet, The distance measuring and location unit uses the transmission results to determine distances between nodes in the network and positions of the nodes. A monitoring device according to any one of claims 2 to 4.

6. a node visualization unit that visualizes and outputs the nodes by arranging them on a map based on the distances between nodes in the network and the positions of the nodes; and the node visualization unit performs visualization using the positions of the nodes in the network identified by the distance measurement / location unit and the distances between the nodes, and outputs a map. The monitoring device of claim 5.

7. 3. The monitoring device according to claim 1, wherein the investigation unit further extracts a priority target node to be investigated in preference to the target node initially investigated, depending on the state of the target node, and investigates the priority target node.

8. a target node selection unit that selects a node placed on the map as a target node; and The investigation unit performs an investigation by setting the target node as a priority target node. The monitoring device of claim 7.

9. the investigating unit acquires, as a result of transmitting the investigation packet, at least a round trip time until a response packet corresponding to the investigation packet is received, and estimates a load state of the target node based on the round trip time; the node visualization unit performs visualization according to the load state, and outputs a map by superimposing the visualization on the position of the target node. The monitoring device of claim 6.

10. A monitoring method for causing a computer to execute the following steps: obtaining one or more target nodes to be investigated within the network; Obtaining one or more investigation policies that define a policy for investigating the investigation target; selecting the investigation policy according to a state of the target node; acquiring a state of the target node via a network and performing an investigation based on the selected policy; A monitoring method including:

11. obtaining one or more target nodes in the network to be investigated; A process of obtaining one or more investigation policies that define a policy for investigating the investigation target; A process of selecting the investigation policy according to a state of the target node; having acquiring the state of the target node via a network and performing an investigation based on the selected policy; A program for causing a computer to execute the following.

Images