Server, communication system, control method and computer program

Abstract

To provide a server, a communication system, a control method and a computer program which can reduce loads on a facility monitoring person.SOLUTION: A server according to one embodiment comprises: an acquisition unit which acquires a log from an external device by outputting a signal for requesting log transmission to the external device at a fixed period; a determination unit which calculates frequencies in which similar events occur in a specific period by classifying the events included in the acquired log for every event, and determines whether the calculated frequencies of the events exceed a threshold; and an alarm unit which raises an alarm on the basis of a determination result to be output by the determination unit.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] FIELD Embodiments of the present invention relate to a server, a communication system, a control method, and a computer program. [Background technology]

[0002] Monitoring and control systems for electrical equipment, air conditioning equipment, and other equipment within a facility are primarily operated by connecting host and subordinate devices via backbone network switches. Therefore, if a failure or other abnormality occurs in the backbone network switch connecting the host and subordinate devices, it becomes difficult to continue monitoring as normal. In such cases, it becomes necessary to use alternative operations until the equipment can be repaired or replaced, which can have a significant impact on system operation. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2018-129712 Summary of the Invention [Problem to be solved by the invention]

[0004] If system monitoring becomes impossible in the facility's monitoring room, the facility manager will be required to take measures such as directly checking the monitored equipment to identify the cause of the monitoring inability, which is expected to increase the burden on the facility manager.

[0005] The embodiments of the present invention have been made in consideration of the above circumstances, and provide a server, a communication system, a control method, and a computer program that can reduce the burden on facility monitors. [Means for solving the problem]

[0006] A server according to one embodiment includes an acquisition unit that acquires logs from an external device by outputting a signal to the external device at regular intervals requesting the external device to send a log; a determination unit that calculates the number of times similar events occurred in a specific period by classifying events contained in the acquired logs into categories and determines whether the calculated number of events exceeds a threshold; and an alarm unit that issues a warning based on the determination result output by the determination unit. [Brief explanation of the drawings]

[0007] [Figure 1] FIG. 1 is a schematic diagram illustrating an example of the configuration of a communication system according to an embodiment. [Figure 2] FIG. 2 is a block diagram illustrating an example of the configuration of the control server according to the embodiment. [Figure 3] FIG. 3 is a block diagram showing an example of the configuration of a network switch according to the embodiment. [Figure 4] FIG. 4 is a diagram illustrating an example of a log transmitted by the network switch according to the embodiment. [Figure 5] FIG. 5 is a flowchart illustrating an example of the detection process according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0008] The server, the communication system, the control method, and the computer program will be described in detail below with reference to the accompanying drawings. In the following description of each embodiment and modification, the same reference numerals are used. The parts have substantially the same functions, and the description of the overlapping parts will be omitted as appropriate.

[0009] 1 is a schematic diagram showing an example of the configuration of a communication system according to an embodiment. The communication system includes a control server 1 as a higher-level device, a network switch 2 as a backbone network, and multiple monitoring and control targets as lower-level devices. For example, the monitoring and control targets are assumed to be a first monitoring and control target 3, a second monitoring and control target 4, a third monitoring and control target 5, and an nth monitoring and control target, for a total of n monitoring and control targets.

[0010] The control server 1, network switch 2, first monitored and controlled object 3, second monitored and controlled object 4, third monitored and controlled object 5, and other monitored and controlled objects are connected by wires so as to be able to communicate with each other. Note that the control server 1, network switch 2, first monitored and controlled object 3, second monitored and controlled object 4, third monitored and controlled object 5, and other monitored and controlled objects may also be connected wirelessly so as to be able to communicate with each other.

[0011] Each of the n monitored and controlled objects has one or more monitored and controlled devices, receives commands from the control server 1 via the network switch 2, which is a backbone network switch, and sends the commands to the destination monitored and controlled device via a network switch within the monitored and controlled object. In addition, each of the n monitored and controlled objects constantly sends the status of the monitored and controlled device to the control server 1 via the network switch 2.

[0012] 2 is a block diagram showing an example of the configuration of a control server according to an embodiment. The control server 1 is a higher-level device that controls and monitors lower-level devices using a backbone network switch. The control server 1 includes a processor 11, a ROM (Read-Only Memory) 12, a RAM (Random-Access Memory) 13, an auxiliary storage unit 14, an input unit 15, an output unit 16, and a communication unit 17. The processor 11, the ROM 12, the RAM 13, the auxiliary storage unit 14, the input unit 15, the output unit 16, and the communication unit 17 are connected to each other via a bus communication line so that they can communicate with each other. The control server 1 is an example of a server.

[0013] The processor 11 is typically a central processing unit (CPU) and / or a graphics processing unit (GPU), but may also be a microcomputer, a field programmable gate array (FPGA), a digital signal processor (DSP), or the like.

[0014] The processor 11 can realize various functions of the control server 1 by executing programs such as system software, application software, or firmware stored in at least one of the ROM 12 and the auxiliary storage unit 14. The control server 1 may combine two or more processors 11 and execute various processes through cooperation of these two or more processors.

[0015] By executing the above program, the processor 11 has the functions of transmitting various signals to each of the n monitored and controlled objects via the network switch 2, acquiring various signals received from each of the n monitored and controlled objects, acquiring logs from the network switch 2, analyzing the acquired logs, and outputting warnings based on the logs, etc.

[0016] The processor 11 includes an acquisition unit 111, a determination unit 112, and an alarm unit 113. The acquisition unit 111 periodically outputs a signal requesting the network switch 2 to transmit a log. The acquisition unit 111 also acquires the log from the network switch 2.

[0017] The determination unit 112 acquires a log from the acquisition unit 111 or the auxiliary storage unit 14, and classifies events contained in the log into groups of the same event. The determination unit 112 also calculates the number of times the same event occurred within a specific period. The determination unit 112 also determines whether the calculated number of events exceeds a preset threshold. The determination unit 112 also sets the threshold depending on the length of the specific period and the type of event.

[0018] The warning unit 113 outputs a warning based on the determination result output by the determination unit 112. Note that the warning unit 113 may output a warning by acquiring a determination result by the determination unit 112 that the number of events has exceeded a threshold, or may output a warning by acquiring a determination result by the determination unit 112 that the number of events is equal to or less than a threshold.

[0019] ROM 12 is a read-only nonvolatile memory that corresponds to the main memory of processor 11, which corresponds to a computer. ROM 12 stores programs such as an operating system or application software. ROM 12 also stores data used by processor 11 when performing various processes.

[0020] The RAM 13 is a volatile memory that corresponds to the main memory of the processor 11, which corresponds to a computer. The RAM 13 is used as a so-called work area for storing data that is temporarily used when the processor 11 performs various processes.

[0021] The auxiliary storage unit 14 corresponds to an auxiliary storage portion of the processor 11, which corresponds to a computer. The auxiliary storage unit 14 is, for example, an EEPROM (registered trademark) (electric erasable programmable read-only memory), an HDD (hard disk drive), or an SSD (solid state drive). The auxiliary storage unit 14 may store some or all of the above programs. The auxiliary storage unit 14 also stores data used by the processor 11 in performing various processes, data generated by the various processes performed by the processor 11, various setting values, etc.

[0022] The ROM 12 and the auxiliary storage unit 14 are non-transitory computer-readable storage media, and the control server 1 may be transferred with the above-mentioned program stored therein, or may be transferred without the program stored therein. In the latter case, the control server 1 reads the above-mentioned program stored in a removable storage medium such as an optical disk or semiconductor memory, and writes the read program to the auxiliary storage unit 14, etc. The control server 1 downloads the above-mentioned program via a network, etc., and writes the downloaded program to the auxiliary storage unit 14, etc.

[0023] The input unit 15 may include a user interface such as a mouse, keyboard, or numeric keypad for receiving input commands from the operator or administrator of the control server 1, and various sensors such as a microphone or touch panel.

[0024] The output unit 16 is, for example, a device that displays various information under the control of the processor 11, and includes a monitor or the like. The output unit 16 may also include an audio output means, such as a speaker, that audibly supplies information to the operator and manager of the control server 1. The input unit 15 and the output unit 16 may be integrally formed. For example, the output unit 16 receives a warning output from the alarm unit 113, and displays the contents of the warning on a monitor or the like, or issues an alarm via a speaker or the like.

[0025] The communication unit 17 receives information from the network switch 2, transmits the received information to the configuration in the control server 1, and transmits information received from the configuration in the control server 1 to the network switch 2. The communication unit 17 may also transmit and receive information from outside via a network such as the Internet.

[0026] 3 is a block diagram showing an example of the configuration of a network switch according to an embodiment. The network switch 2 in this embodiment is, for example, a switching hub, and includes a processor 21, a ROM 22, a RAM 23, a non-volatile memory 24, a first port 25, a second port 26, and other ports. The network switch 2 is an example of an external device.

[0027] The processor 21 is typically a central processing unit (CPU) and / or a graphics processing unit (GPU), but may also be a microcomputer, a field programmable gate array (FPGA), a digital signal processor (DSP), or the like.

[0028] The processor 21 can realize various functions of the network switch 2 by executing programs such as system software, application software, or firmware stored in at least one of the ROM 22 and the non-volatile memory 24. The network switch 2 may combine two or more processors 21 and execute various processes through cooperation between these two or more processors.

[0029] By executing the above program, the processor 21 has the function of sending commands from the control server 1 to the monitored and controlled object based on a specified destination, acquiring information about the monitored and controlled object and sending the information to the control server 1, receiving a request signal from the control server 1, and sending a log to the control server 1 each time the request signal is received, etc.

[0030] The ROM 22 is a read-only nonvolatile memory that corresponds to the main memory of the processor 21, which corresponds to a computer. The ROM 22 stores programs such as an operating system or application software. The ROM 22 also stores data used by the processor 21 when performing various processes.

[0031] The RAM 23 is a volatile memory that corresponds to the main storage portion of the processor 21, which corresponds to a computer. The RAM 23 is used as a so-called work area for storing data that is temporarily used when the processor 21 performs various processes.

[0032] The nonvolatile memory 24 corresponds to an auxiliary storage portion of the processor 21. The nonvolatile memory 24 is, for example, an EEPROM (registered trademark). The nonvolatile memory 24 may store some or all of the above programs. The nonvolatile memory 24 also stores data used by the processor 21 when performing various processes, data generated by the various processes performed by the processor 21, various setting values, etc.

[0033] The ROM 22 and the nonvolatile memory 24 are non-transitory computer-readable storage media, and the network switch 2 may be transferred with the above program stored therein, or may be transferred without the program stored therein. In the latter case, the network switch 2 reads the above program stored in a removable storage medium such as an optical disk or semiconductor memory, or downloads the program via a network or the like, and writes the read or downloaded program to the nonvolatile memory 24 of the network switch 2. The ROM 22, RAM 23, and nonvolatile memory 24 are examples of memory.

[0034] The log stored in the nonvolatile memory 24 of the network switch 2 and transmitted to the control server 1 will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of a log transmitted by the network switch according to the embodiment.

[0035] The log recorded in the nonvolatile memory 24 includes, for example, six items: index, number of startups, date, time, system startup time, and event, but the items are not limited to these. For example, in the first index and the sixth index, a cold start is recorded as an event. This indicates that the network switch 2 has started up.

[0036] Furthermore, the second and fourth indexes record Port 1 link on, which indicates that the first port 25 of the network switch 2 is connected to an arbitrary monitored and controlled object and is in a state where they can communicate with each other.

[0037] Furthermore, the third and fifth indexes record "Port 1 link off," which indicates that the first port 25 of the network switch 2 has cut off connection with any monitoring and control target, making mutual communication impossible.

[0038] Next, the detection process executed by the control server 1 in this embodiment will be described with reference to Fig. 5. Fig. 5 is a flowchart showing an example of the detection process according to this embodiment.

[0039] The detection process of this embodiment is started at any timing. For example, the detection process may be started when the control server 1 is started and connected to the network switch 2, thereby enabling mutual communication. Alternatively, a trigger to start the detection process may be received from the input unit 15 by an operator or administrator of the control server 1.

[0040] The acquisition unit 111 determines whether a certain amount of time has elapsed since the start of processing (step S1). If the acquisition unit 111 determines that the certain amount of time has elapsed (step S1, YES), it transmits a request signal to the network switch 2 requesting that the network switch 2 transmit a log (step S2). The acquisition unit 111 repeats this process. That is, the acquisition unit 111 transmits a request signal to the network switch 2 at a certain interval. Note that this interval is set in advance by an operator of the control server 1 or the like, and may be changeable each time during the processing process.

[0041] After transmitting the request signal, acquisition unit 111 waits to acquire the log from network switch 2. After acquiring the log from network switch 2 (step S3), acquisition unit 111 stores the log in auxiliary storage unit 14 (step S4).

[0042] The determination unit 112 determines whether a certain time has elapsed since the start of processing (step S5). If the determination unit 112 determines that the certain time has not elapsed (step S5, NO), the process returns to step S1. If the determination unit 112 determines that the certain time has elapsed (step S5, YES), the determination unit 112 acquires the stored log and classifies the events included in the log into groups of the same event.

[0043] For example, from FIG. 4, the determination unit 112 classifies the first index and the sixth index into the first cluster, the second index and the fourth index into the second cluster, and the third index and the fifth index into the third cluster.

[0044] Next, the determination unit 112 calculates the number of events in the clusters classified for each of the same events (step S6). For example, the determination unit 112 calculates that the number of events in the first cluster is 2, and similarly calculates that the number of events in the second cluster and the third cluster is 2. That is, when the determination unit 112 detects that the specific period of time in step S5 has elapsed, it classifies the events included in the log for each of the same events and calculates the number of classified events. Note that the specific period is set in advance by an operator of the control server 1 or the like, and may be changeable each time during the processing process.

[0045] The determination unit 112 determines whether the calculated number of events exceeds a threshold value (step S7). For example, the determination unit 112 sets a threshold value according to the length of a predetermined specific period and the type of events in the first cluster. Similarly, the determination unit 112 sets threshold values ​​according to the length of a predetermined specific period and the type of events in the second and third clusters.

[0046] If the threshold associated with the first cluster is the first threshold, the threshold associated with the second cluster is the second threshold, and the threshold associated with the third cluster is the third threshold, the determination unit 112 determines whether the number of events in the first cluster exceeds the first threshold. The determination unit 112 also determines whether the number of events in the second cluster exceeds the second threshold. The determination unit 112 also determines whether the number of events in the third cluster exceeds the third threshold.

[0047] If the determination unit 112 determines that the calculated number of events exceeds the threshold value (step S7, YES), it outputs a determination result indicating that the number of events has exceeded the threshold value to the alarm unit 113. The alarm unit 113 outputs a warning based on the determination result (step S8) and ends the process. By the control server 1 detecting that startup, on / off connection, etc. has occurred a specified number of times or more, it becomes possible to issue a warning to notify that some kind of abnormality has occurred in the network switch 2.

[0048] For example, when the determination unit 112 determines that the number of events in the first cluster exceeds the first threshold, it outputs the determination result to the warning unit, and the warning unit 113 generates a warning based on the type of event in the first cluster and outputs it to the output unit 16. Note that the warning may be information including text, audio, images, etc.

[0049] Furthermore, when the determination unit 112 determines that the number of events in the second cluster has exceeded the second threshold, it outputs the determination result to the alarm unit, and the alarm unit 113 generates a warning based on the type of event in the second cluster and outputs it to the output unit 16. Similarly, when the determination unit 112 determines that the number of events in the third cluster has exceeded the third threshold, it outputs the determination result to the alarm unit, and the alarm unit 113 generates a warning based on the type of event in the third cluster and outputs it to the output unit 16.

[0050] When the determining unit 112 determines that the calculated number of events does not exceed the threshold, that is, the number of events is equal to or less than the threshold (step S7, NO), the process ends.

[0051] According to the control server 1 of this embodiment, events contained in the log acquired from the network switch 2 are classified into groups of the same event to calculate the number of events that occurred in a specific period, and an alarm is output if the calculated number exceeds a threshold, thereby making it possible to predict the health of the network switch 2 itself, which is a core network switch. Also, by predicting the detection of an abnormality in the network switch 2, it is possible to improve the reliability of the entire monitoring system. Furthermore, according to the control server 1 of this embodiment, it is not necessary to develop special hardware for detecting an abnormality in the network switch 2, and it is possible to detect an abnormality in the network switch 2 using only the control server 1.

[0052] That is, the server, communication system, control method, and computer program of this embodiment can reduce the burden on facility monitors.

[0053] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, and are also included in the scope of the invention and its equivalents as defined in the claims. [Explanation of symbols]

[0054] 1...Control server 11...Processor 111…Acquisition Department 112...Judgment section 113...Alarm section 12...ROM 13...RAM 14…Auxiliary storage unit 15...Input section 16...Output section 17…Communications Department 2. Network switch 21...Processor 22...ROM 23...RAM 24...Non-volatile memory

Claims

1. an acquisition unit that acquires a log from an external device by outputting a signal requesting the external device to transmit a log at a fixed period; a determination unit that classifies the events included in the acquired log into each event to calculate the number of times that a similar event occurred in a specific period, and determines whether the calculated number of events exceeds a threshold; an alarm unit that outputs a warning based on the determination result output by the determination unit; A server comprising:

2. The server according to claim 1 , wherein the warning unit outputs a warning when the determining unit determines that the number of events exceeds the threshold value.

3. The server according to claim 1 , wherein the determination unit sets the threshold value depending on the length of the specific period and the type of the event.

4. an acquisition unit that acquires a log from a network switch by outputting a signal requesting the network switch to transmit a log at a fixed period; a determination unit that classifies the events included in the acquired log into each event to calculate the number of times that a similar event occurred in a specific period, and determines whether the calculated number of events exceeds a threshold; an alarm unit that outputs a warning based on the determination result output by the determination unit; a server comprising: the network switch transmitting the log to the server every time a request signal is received from the server; A communication system comprising:

5. acquires a log from an external device by outputting a signal requesting the external device to transmit the log at a fixed interval; Calculating the number of times similar events occurred in a specific period by classifying the events included in the acquired log by event type, and determining whether the calculated number of events exceeds a threshold value; A control method that outputs a warning based on the judgment result.

6. Computer, an acquisition means for acquiring a log from an external device by outputting a signal requesting the external device to transmit a log at a fixed interval; a determination means for calculating the number of times similar events occurred in a specific period by classifying the events included in the acquired log into each event, and determining whether the calculated number of events exceeds a threshold value; an alarm means for outputting a warning based on the determination result output by the determination means; A computer program that functions as a

Images