Network monitoring apparatus, communication system, and network monitoring method

Abstract

To distribute the load of a server device.SOLUTION: A network monitoring device 13 connected to a plurality of server devices 12 and a communication device 14 includes a processor for collecting a load state in each of the plurality of server devices 12, and for transferring an event issued from the communication device 14 to the server device 12 whose load is low among the plurality of server devices 12 by referring to the load state.SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] The present invention relates to a network monitoring device, a communication system, and a network monitoring method. [Background technology]

[0002] Routers, switches, servers, and client terminals provided in a communication system are sometimes monitored as monitored devices to check for the occurrence of failures.

[0003] FIG. 1 is a diagram illustrating the network monitoring process.

[0004] The network monitoring system 6 performs periodic polling by issuing commands such as Ping and SNMP (Simple Network Management Protocol) GET to the device 61 as a monitored device. For example, if the device 61 does not respond due to a shutdown of the device 61 or a network outage, or if the Management Information Base (MIB) value acquired by the SNMP GET is an abnormal value, the network monitoring system 6 outputs an alarm to a monitoring screen 64 (described later using FIG. 2).

[0005] Furthermore, the network monitoring system 6 receives an event from the device 61 by a command such as an SNMP Trap or Syslog, and outputs an alarm to the monitoring screen 64 if it determines that an abnormality has occurred based on the content of the event.

[0006] FIG. 2 is a block diagram illustrating a configuration example of a communication system 60. As shown in FIG.

[0007] The communication system 60 includes a plurality of devices 61 , a plurality of device access servers 62 , one or more management servers 63 , and a monitoring screen 64 .

[0008] When the network scale is relatively large (for example, when the number of devices 61 is large), multiple device access servers 62 are prepared, and each device access server 62 is responsible for monitoring the devices 61. Each device access server 62 monitors the devices 61 using the network monitoring process shown in Figure 1. The management server 63 collects alarm information from each device access server 62 and outputs it to a monitoring screen 64.

[0009] In the example shown in FIG. 2, the communication system 60 comprises six devices 61 .

[0010] 2, the communication system 60 includes three active device access servers 62, and each active device access server 62 is connected to two devices 61. As illustrated in FIG. 2, the communication system 60 may further include a backup device access server 62 corresponding to each active device access server 62. The device access server 62 is an example of a server device.

[0011] 2, the communication system 60 includes one active management server 63. As illustrated in the example of FIG. 2, the communication system 60 may further include a backup management server 63 corresponding to the active management server 63. [Prior art documents] [Patent documents]

[0012] [Patent Document 1] International Publication No. 2023 / 218519 Brochure [Patent Document 2] Japanese Patent Application Publication No. 2018-45403 [Patent Document 3] Japanese Patent Application Publication No. 11-355273 Summary of the Invention [Problem to be solved by the invention]

[0013] When a power outage is restored, a large number of events may occur from the device 61.

[0014] FIG. 3 is a diagram illustrating an example of the occurrence of a large number of events.

[0015] As indicated by the symbol B1, a large number of events are occurring from a base where a plurality of devices 61 are installed, by issuing commands such as Trap and Syslog.

[0016] As shown by symbol B2, the device access server 62 receives and processes a large number of events in a short period of time, which can cause a shortage of server resources (Central Processing Unit (CPU), memory, disk access, etc.), which can cause program processing delays and database (DB) slowdowns, leading to system performance degradation and system shutdown.

[0017] In one aspect, an object is to distribute the load of a server device. [Means for solving the problem]

[0018] In one aspect, the network monitoring device is connected to a plurality of server devices and a communication device, and includes a processor that collects load statuses on each of the plurality of server devices, refers to the load statuses, and transfers an event issued from the communication device to a server device among the plurality of server devices that has a lower load. [Effects of the Invention]

[0019] In one aspect, the load of the server device can be distributed. [Brief explanation of the drawings]

[0020] [Figure 1] FIG. 10 is a diagram illustrating a network monitoring process. [Figure 2] FIG. 1 is a block diagram schematically illustrating an example configuration of a communication system. [Figure 3] FIG. 10 is a diagram illustrating an example of the occurrence of a large number of events. [Figure 4] FIG. 1 is a block diagram schematically illustrating an example of the configuration of a communication system in a related example. [Figure 5] 1 is a block diagram illustrating a configuration example of a communication system according to an embodiment. [Figure 6] FIG. 6 is a block diagram schematically illustrating an example of a software configuration in the communication system illustrated in FIG. 5. [Figure 7] FIG. 10 is a diagram illustrating an example of a latest resource status table in the embodiment. [Figure 8] FIG. 10 is a diagram illustrating a resource status history table according to the embodiment. [Figure 9] FIG. 10 is a diagram illustrating an example of a table of latest resource statuses of each device access server in the embodiment. [Figure 10] FIG. 10 is a diagram illustrating an example of an allocation determination information table in the embodiment. [Figure 11] 6 is a sequence diagram illustrating a resource management process in the device access server shown in FIG. 5. FIG. [Figure 12] 6 is a sequence diagram illustrating a resource management process in the resource allocation device shown in FIG. 5. FIG. [Figure 13] 3 is a diagram illustrating an alarm management process when a failure occurs in the communication system shown in FIG. 2. FIG. [Figure 14] 5 is a diagram illustrating an alarm management process when a failure occurs in the communication system shown in FIG. 4. FIG. [Figure 15] FIG. 10 is a block diagram schematically illustrating an example of a software configuration in a communication system as a modified example. [Figure 16] 16 is a sequence diagram illustrating an alarm management process when a failure occurs in the communication system shown in FIG. 15. [Figure 17] 16 is a sequence diagram illustrating an alarm management process when the communication system shown in FIG. 15 is restored from a failure. [Figure 18] FIG. 1 is a block diagram schematically illustrating an example of a hardware configuration of an information processing device. [Figure 19]6 is a diagram comparing load leveling in the device access servers in the communication system shown in FIG. 2 and the communication system shown in FIG. 5. FIG. [Figure 20] 6 is a diagram comparing the scale-out in the communication system shown in FIG. 2 and the communication system shown in FIG. 5. FIG. [Figure 21] 6 is a diagram comparing the states of the communication system shown in FIG. 2 and the communication system shown in FIG. 5 when the device access server goes down. DETAILED DESCRIPTION OF THE INVENTION

[0021] [A] Related Examples FIG. 4 is a block diagram showing a schematic configuration example of a communication system 60a in a related example.

[0022] As shown in FIG. 4, the communication system 60a includes a plurality of devices 61 (seven in the example shown in FIG. 4), a plurality of device access servers 62 (three in the example shown in FIG. 4), and one resource allocation device 65.

[0023] In the communication system 60a shown in Figure 4, as a measure to deal with bursts in the device access servers 62 (in other words, a method to avoid concentrating the load on a specific device access server 62), the resource allocation device 65 distributes events to device access servers 62 with low loads.

[0024] However, when events are distributed according to the load of the device access server 62, if the resource allocation device 65 does not grasp the latest load status of the device access server 62, there is a risk that real-time performance may be lacking.

[0025] Furthermore, if events are distributed evenly to the device access servers 62, the timing of processing the received events may differ for each device access server 62, and the order of the received events may not be guaranteed.

[0026] [B] Embodiment Hereinafter, embodiments will be described with reference to the drawings. However, the embodiments shown below are merely examples, and are not intended to exclude various modifications or application of techniques not explicitly stated in the embodiments. In other words, the present embodiments can be implemented with various modifications within the scope of the spirit thereof. Furthermore, each figure does not intend to include only the components shown in the figure, but may include other components, etc.

[0027] [B-1] System configuration example FIG. 5 is a block diagram schematically illustrating an example of the configuration of a communication system 10 according to an embodiment.

[0028] The communication system 10 includes one or more management servers 11, multiple device access servers 12, one or more resource allocation devices 13, and multiple communication devices 14. The resource allocation device 13 manages an event management DB 101. The management server 11, the multiple device access servers 12, the resource allocation device 13, and the multiple communication devices 14 may be connected by various communication methods such as optical fiber, a wired local area network (LAN), wireless LAN, 3 Generation (G) communication, 4G communication, 5G communication, and 6G communication.

[0029] 5, the communication system 10 includes one active management server 11. As illustrated in FIG. 5, the communication system 10 may further include a backup management server 11 corresponding to the active management server 11. The management server 11 is an example of a management device.

[0030] 5, the communication system 10 includes three active device access servers 12 (in other words, device access servers #1 to #3). As illustrated in FIG. 5, the communication system 10 may further include backup device access servers 12 corresponding to the active device access servers 12. The device access servers 12 are an example of a server device.

[0031] 5, the communication system 10 includes one active resource allocation device 13. As illustrated in FIG. 5, the communication system 10 may further include a backup resource allocation device 13 corresponding to the active resource allocation device 13. The resource allocation device 13 is an example of a network monitoring device.

[0032] 5, the communication system 10 includes seven communication devices 14. However, the communication system 10 may include only one communication device 14. The communication device 14 may be, for example, a router, a switch, a server, or a client terminal.

[0033] In the communication system 10 shown in FIG. 5, a resource allocation device 13 is arranged in front of a device access server 12 facing the communication devices 14, and each communication device 14 transmits an event to the resource allocation device 13.

[0034] After receiving the event, the resource allocation device 13 transfers the event to the device access server 12 with the lowest server load.

[0035] The resource allocation device 13 also manages an event management DB 101 for ensuring the order of events. The event management DB 101 is accessed by the resource allocation device 13 as well as each device access server 12.

[0036] FIG. 6 is a block diagram schematically illustrating an example of the software configuration of the communication system 10 shown in FIG.

[0037] As shown in Fig. 6, each device access server 12 functions as a resource manager 121 and an event receiving processor 122. Each device access server 12 also executes an Operating System (OS) 123 and DB middleware 124. The resource manager 121 and the event receiving processor 122 may be applications executed under the control of the OS 123. The DB middleware 124 controls access to each DB. Note that in Fig. 6, the event receiving processor 122, OS 123, and DB middleware 124 are not shown in the illustration for some device access servers 12.

[0038] The resource allocation device 13 functions as a server resource management unit 131 and an event processing management unit 132 .

[0039] The server resource management unit 131 of the resource allocation device 13 grasps the load status of the device access server 12 via the resource management unit 121 of each device access server 12 and allocates events to each device access server 12 .

[0040] Specifically, the resource management unit 121 of each device access server 12 periodically collects server resources (CPU usage rate, memory usage rate, Input / Output (IO) waiting status, etc.) and DB load (number of connections, etc.). The server resource management unit 131 of the resource allocation device 13 collects and manages the resource status of each device access server 12. Then, the server resource management unit 131 transfers the event to the device access server 12 that has available resources when the event is received.

[0041] The event processing management unit 132 of the resource allocation device 13 ensures the order of events.

[0042] Specifically, the event processing management unit 132 of the resource allocation device 13 assigns a sequence number to the received event. The sequence number is an example of information indicating order. As a result, the event reception processing unit 122 of each device access server 12 performs event reception processing in the order of the sequence numbers. The event reception processing unit 122 of the device access server 12 performs the next event reception processing after confirming whether the event processing before the transferred event has been completed.

[0043] Next, the resource allocation process in the embodiment will be described using the reference symbols C1 to C3 in FIG.

[0044] After receiving an event from the communication device 14, the event processing manager 132 of the resource allocation device 13 assigns a sequence number to the event in the event management DB 101 (see symbol C1). As shown in Fig. 6, the event management DB 101 associates the sequence number with the processing status and event information.

[0045] The event processing manager 132 refers to the resource status of each device access server 12 collected by the server resource manager 131, and transfers the event to an available device access server 12 (see symbol C2). In the example shown in Fig. 6, the event is transferred to device access server #3.

[0046] The event receiving processor 122 of the device access server 12 checks the event management DB 101 to see if the previous event processing has been completed, and updates the processing status of the event (see symbol C3). In the example shown in Fig. 6, the processing status of sequence number 2, which follows sequence number 1 whose processing status is "normally completed," has been updated to "in processing."

[0047] FIG. 7 is a diagram illustrating an example of the latest resource status table 102 in the embodiment.

[0048] 7, the latest resource status table 102 includes, as resource management items, CPU usage rate, memory usage rate, swap area usage rate, disk IO response time, number of received packets, number of DB connections, DB response time, etc. The latest resource status table 102 also includes, as management values, value, threshold (mild), threshold (serious), threshold over-statement, and most recent threshold over-statement count.

[0049] The value indicates the latest numerical value of each resource management item. The threshold (mild) and threshold (severe) are set in advance. The threshold exceedance status is registered as normal, mild, or severe depending on whether the value exceeds the threshold (mild) or threshold (severe). The most recent threshold exceedance count indicates the number of times the threshold (mild) has been exceeded within a specified period. Note that the most recent threshold exceedance count may also indicate the number of times the threshold (severe) has been exceeded within a specified period.

[0050] The threshold (light) and the threshold (heavy) may be set according to the performance of the hardware such as the CPU, memory, disk, etc. installed in the device access server 12. Furthermore, when the hardware such as the CPU, memory, disk, etc. installed in the device access server 12 is replaced, the threshold (light) and the threshold (heavy) may be updated according to the performance of the replaced hardware.

[0051] The resource management unit 121 of the device access server 12 updates the value, the threshold exceeding status, and the most recent threshold exceeding count at the time of periodic resource collection.

[0052] FIG. 8 is a diagram illustrating an example of the resource status history table 103 in the embodiment.

[0053] The resource management unit 121 of the device access server 12 may store the resource status history table 103 for several days, for example, one table per day. In the example shown in Fig. 8, it is shown that values ​​per minute for each of the CPU usage rate, memory usage rate, swap area usage rate, disk IO response time, number of received packets, number of DB connections, and DB response time are stored for three days.

[0054] FIG. 9 is a diagram illustrating an example of each device access server latest resource status table 104 in the embodiment.

[0055] The server resource management unit 131 of the resource allocation device 13 collectively manages the latest resource status tables 102 of each device access server 12 shown in Fig. 7 as each device access server latest resource status table 104. The server resource management unit 131 periodically synchronizes the contents of each device access server latest resource status table 104 with the contents of the latest resource status table 102 of each device access server 12. Specifically, the resource management unit 121 of each device access server 12 periodically transmits the latest resource status table 102 to the server resource management unit 131. Then, the server resource management unit 131 updates each device access server latest resource status table 104 using the latest resource status table 102 received from the resource management unit 121.

[0056] FIG. 10 is a diagram illustrating an example of the allocation determination information table 105 in the embodiment.

[0057] The server resource management unit 131 of the resource allocation device 13 manages the allocation determination information table 105 shown in FIG. 10 as a summary of the current load (in other words, resource) status of each device access server 12.

[0058] In the example shown in Figure 10, the distribution judgment information table 105 registers the load (exceeding threshold) status, the most recent number of times the threshold was exceeded, and the load status of each resource (CPU usage rate, swap space usage rate, disk IO response time, number of DB connections, etc.) for each device access server 12.

[0059] If there are multiple load conditions, heavy and light, for each resource, the heaviest condition is set as the load (exceeding threshold) condition. Also, if information cannot be obtained from the device access server 12 due to a server down or the like, "server down" is set as the load (exceeding threshold) condition for device access server #3.

[0060] The most recent threshold exceedance count is set to the maximum number of times the threshold has been exceeded for each resource load status, rather than the sum of the threshold exceedance counts for each resource load status. In other words, the most recent threshold exceedance count indicates how many times the threshold has been exceeded for any resource load status.

[0061] Each resource load status is managed in order of priority for resource items in allocation decisions. For example, even if memory usage is high, it is not a problem as long as no swapping occurs, so swap area usage is managed as the resource item with priority. Each resource load status is set to the current value of the resource management item in the latest resource status table 102 shown in Figure 7.

[0062] The event processing management unit 132 of the resource allocation device 13 transfers the event to the device access server 12 whose load (exceeding threshold) status in the allocation determination information table 105 is "normal."

[0063] If there are multiple normal device access servers 12, the event processing management unit 132 refers to the most recent threshold exceedance count and transfers the event to the device access server 12 with a count of "0." This is because if a threshold exceedance has occurred recently, it is determined that there is a risk of hardware malfunction or the like.

[0064] Furthermore, if there are multiple device access servers 12 whose most recent threshold exceedance count is "0", or if there is no device access server 12 whose most recent threshold exceedance count is "0", the event processing management unit 132 refers to the load status of each resource and determines the device access server 12 to which the event will be transferred, taking into account the load status of the priority items.

[0065] Although the operation of referring to the most recent threshold exceedance count and transferring the event to the device access server 12 with a value of "0" has been exemplified, it is also possible to refer to the most recent threshold exceedance count and transfer the event to the device access server 12 with the smallest value. If there are multiple device access servers 12 with the smallest most recent threshold exceedance counts, the event processing management unit 132 refers to the load status of each resource and determines the device access server 12 to which the event is to be transferred, taking into account the load status of the priority items.

[0066] [B-2] Example of operation The resource management process in the device access server 12 shown in FIG. 5 will be described with reference to the sequence diagram (steps S1 to S5) shown in FIG.

[0067] The resource management unit 121 is started and executed, for example, at one-minute intervals, and collects resource information from the OS 123, DB middleware 124, etc. (step S1).

[0068] Then, the resource management unit 121 performs the threshold overage determination in steps S2 to S5 shown below.

[0069] The resource management unit 121 updates the "value" and "exceeding threshold status" in the latest resource status table 102 (step S2).

[0070] The resource management unit 121 sets the value at the current collection time in the resource status history table 103 (step S3).

[0071] The resource management unit 121 refers to the resource status history table 103 and counts how many times a threshold (threshold (mild) or threshold (severe)) has been exceeded for each resource item in the most recent period (for example, within 24 hours) (step S4).

[0072] The resource management unit 121 updates the "most recent threshold exceedance count" in the latest resource status table 102 (step S5), and the resource management process in the device access server 12 then ends.

[0073] Next, the resource management process in resource allocation device 13 shown in FIG. 5 will be described with reference to the flowchart (steps S11 to S17) shown in FIG.

[0074] The server resource management unit 131 is started and executed, for example, at one-minute intervals, to collect the latest resource status of the device access server #1 (step S11).

[0075] The server resource management unit 131 synchronizes the contents of the latest resource status table 102 with the latest resource status table 104 of the device access server #1 (step S12).

[0076] The server resource management unit 131 collects the latest resource status of the device access server #2 (step S13).

[0077] The server resource management unit 131 synchronizes the contents of the latest resource status table 102 with the latest resource status table 104 of the device access server #2 (step S14).

[0078] The server resource management unit 131 collects the latest resource status of the device access server #3 (step S15).

[0079] The server resource management unit 131 synchronizes the contents of the latest resource status table 102 with the latest resource status table 104 of the device access server #3 (step S16).

[0080] The server resource management unit 131 updates the allocation determination information table 105 based on the latest resource status of each device access server 12 (step S17), and the resource management process in the resource allocation device 13 then ends.

[0081] [B-3] Modified example FIG. 13 is a diagram illustrating an alarm management process when a failure occurs in the communication system 60 shown in FIG.

[0082] As shown by reference symbol D1, when a failure occurs in the device 61, an alarm generation event including, for example, a Trap (LinkDown) command is transmitted from the device 61 to the device access server 62. The device access server 62 generates alarm information 602. The alarm information 602 may include the time of occurrence, the time of recovery, the failed device, and the name of the failure. At the time shown by reference symbol D1, the recovery time field is blank.

[0083] As shown by symbol D2, when the failure in the device 61 is recovered, an alarm recovery event including, for example, a Trap (LinkUp) command is transmitted from the device 61 to the device access server 62. The device access server 62 updates the alarm information 602. That is, the device access server 12 registers the recovery time in the alarm information 602.

[0084] In the example shown in FIG. 13, alarms are managed within the same device access server 12, so that occurrence and recovery can be linked.

[0085] FIG. 14 is a diagram illustrating an alarm management process when a failure occurs in the communication system 60a shown in FIG.

[0086] As shown by reference symbol E1, when a failure occurs in device 61, an alarm generation event including, for example, a Trap (LinkDown) command is transmitted from device 61 to device access server #1 via resource allocation device 65. Device access server 62 generates alarm information 602. The alarm information 602 may include the time of occurrence, the time of recovery, the failed device, and the name of the failure. At the time shown by reference symbol E1, the recovery time field is blank.

[0087] As shown by symbol E2, when the failure in device 61 is restored, an alarm recovery event including, for example, a Trap (LinkUp) command is transmitted from device 61 to resource allocation device 65. Here, when resource allocation device 65 detects a high load situation in device access server #1, it transfers the alarm recovery event to device access server #2.

[0088] However, although device access server #1 manages alarm information 602, device access server #2 does not manage alarm information 602 that is the target of recovery. This makes it difficult for communication system 60a to accurately manage alarm occurrences and alarm recovery of each device 61.

[0089] FIG. 15 is a block diagram schematically illustrating an example of the software configuration of a communication system 10a as a modified example.

[0090] The communication system 10a shown in Figure 15, like the communication system 10 shown in Figure 5, includes one or more (one in the example shown in Figure 15) management servers 11, multiple (three in the example shown in Figure 15) device access servers 12, one or more (one in the example shown in Figure 15) resource allocation devices 13, and multiple (three in the example shown in Figure 15) communication devices 14.

[0091] In the communication system 10a shown in Figure 15, the management server 11 functions as an integrated alarm management unit 111 to manage the alarm management DB 106, and each device access server 12 manages the alarm DB 107, but the software configuration example is the same as that of the communication system 10 shown in Figure 6.

[0092] In the communication system 10a, the device access server 12 does not manage the association between the occurrence of an alarm and its recovery, but the management server 11 manages the association between the occurrence of an alarm and its recovery.

[0093] When the device access server 12 receives a recovery event, it does not update the recovery status of the existing alarm (in other words, an alarm for which only occurrence is set), but synchronizes it with the management server 11 as a new alarm for which only recovery is set.

[0094] The alarm DB 107 of the device access server 12 manages alarms received by the device access server 12 itself. Although the alarm DB 107 is shown only in device access server #1 in Fig. 15, the device access servers #2 and #3 may also be provided with alarm DBs 107. Furthermore, each device access server 12 does not have to manage the alarm DB 107, and alarms synchronized to the management server 11 may be discarded.

[0095] When the integrated alarm management unit 111 of the management server 11 detects a recovery-only alarm, it extracts the corresponding occurrence-only alarm from the alarm management DB 106 by device name and fault name, and updates it to a recovery state.

[0096] The alarm management process when a failure occurs in the communication system 10a shown in FIG. 15 will be described with reference to the sequence diagram (steps S21 to S26) shown in FIG.

[0097] When a failure occurs, the communication device 14 issues an alarm generation event Trap (LinkDown) to the resource allocation device 13 (step S21).

[0098] The event processing manager 132 of the resource allocation device 13 refers to the allocation determination information table 105 (step S22).

[0099] The event processing manager 132 transfers the event to the device access server #1 with the lightest load (step S23), and the alarm management process when a failure occurs in the resource allocation device 13 is then completed.

[0100] The event receiving processor 122 of the device access server #1 analyzes the contents of the event and creates the occurring alarm information 107a (step S24). The occurring alarm information 107a contains the time of occurrence, the faulty device, and the fault name, all registered in association with each other, with the recovery time field left blank. If the device access server #1 is provided with an alarm DB 107, the occurring alarm information 107a may be registered in the alarm DB 107 as a new entry.

[0101] The event receiving processor 122 transfers the generated alarm information 107a to the management server 11 (step S25). Then, the alarm management process when a failure occurs in the device access server #1 is completed.

[0102] The integrated alarm manager 111 of the management server 11 receives the occurred alarm information 107a and adds the occurred alarm information 107a to the alarm management DB 106 as a new alarm (step S26). Then, the alarm management process when a failure occurs in the management server 11 is completed.

[0103] 16, the occurrence time, recovery time, faulty device, and fault name are associated and registered in the alarm management DB 106. In the processing of step S26, the occurrence of a port fault in device A, indicated by the dashed frame, is registered in the alarm management DB 106 along with the occurrence time, and the recovery time column is left blank.

[0104] If an alarm with the same combination of "fault device" and "fault name" and a blank recovery time field exists in the alarm management DB 106, the integrated alarm management unit 111 determines that the same alarm has already occurred and does not add it to the alarm management DB 106.

[0105] Next, an alarm management process when the communication system 10a shown in FIG. 15 is restored from a failure will be described with reference to the sequence diagram shown in FIG. 17 (steps S31 to S36).

[0106] When the failure is restored, the communication device 14 issues an alarm restoration event Trap (LinkUp) to the resource allocation device 13 (step S31).

[0107] The event processing manager 132 of the resource allocation device 13 refers to the allocation determination information table 105 (step S32).

[0108] The event processing manager 132 transfers the event to the device access server #2 with the lightest load (step S33), and the alarm management process when the failure in the resource allocation device 13 is restored is then completed.

[0109] The event receiving processor 122 of the device access server #2 analyzes the contents of the event and creates restoration alarm information 107b (step S34). The restoration alarm information 107b contains the restoration time, the faulty device, and the fault name, all registered in association with each other, with the occurrence time field left blank. If the device access server #2 is provided with an alarm DB 107, the restoration alarm information 107b may be registered in the alarm DB 107 as a new entry.

[0110] The event receiving processor 122 transfers the recovery alarm information 107b to the management server 11 (step S35). Then, the alarm management process when the failure in the device access server #2 is recovered is completed.

[0111] The integrated alarm manager 111 of the management server 11 receives the restored alarm information 107b and sets the restoration time in the alarm management DB 106 (step S36). In the example shown in Fig. 17, the restoration time shown in the dashed frame is set for the alarm of the port failure of device A, the occurrence time of which has been registered in the alarm management DB 106. Then, the alarm management process when the failure in the management server 11 is restored is completed.

[0112] [B-4] Hardware configuration example FIG. 18 is a block diagram schematically illustrating an example of the hardware configuration of the information processing device 2. As shown in FIG.

[0113] The management server 11, the device access server 12, the resource allocation device 13, and the communication device 14 in the above-described embodiment and modifications may each have the same hardware configuration, and are an example of the information processing device 2 shown in FIG.

[0114] As shown in FIG. 18, the information processing device 2 includes a CPU 21, a memory 22, a display control device 23, a storage device 24, an input interface (IF) 25, an external recording medium processing device 26, and a communication IF 27.

[0115] The memory 22 is an example of a storage unit, and is illustratively a read-only memory (ROM) and a RAM. A program such as a basic input / output system (BIOS) may be written to the ROM of the memory 22. The software program in the memory 22 may be read and executed by the CPU 21 as appropriate. The RAM of the memory 22 may be used as a temporary storage memory or a working memory.

[0116] The display control device 23 is connected to and controls the display device 231. The display device 231 is a liquid crystal display, an organic light-emitting diode (OLED) display, a cathode ray tube (CRT), an electronic paper display, or the like, and displays various information to the operator of the information processing device 2. The display device 231 may be combined with an input device, and may be, for example, a touch panel.

[0117] For example, a solid state drive (SSD), a storage class memory (SCM), or a hard disk drive (HDD) may be used as the storage device 24. The storage device 24 of the management server 11 may store the alarm management DB 106 shown in FIG. 15 and the like.

[0118] The storage device 24 of the device access server 12 may store the latest resource status table 102 shown in Fig. 7 etc., the resource status history table 103 shown in Fig. 8 etc., and the alarm DB 107 shown in Fig. 15 etc. The storage device 24 of the resource allocation device 13 may store the event management DB 101 shown in Fig. 6 etc., the latest resource status table 104 of each device access server shown in Fig. 9 etc., and the allocation judgment information table 105 shown in Fig. 10 etc.

[0119] The input IF 25 may be connected to input devices such as a mouse 251 and a keyboard 252, and may control the input devices such as the mouse 251 and the keyboard 252. The mouse 251 and the keyboard 252 are examples of input devices, and the operator of the information processing device 2 performs various input operations via these input devices.

[0120] The external recording medium processing device 26 is configured so that the recording medium 260 can be attached. The external recording medium processing device 26 is configured so that, when the recording medium 260 is attached, the information recorded on the recording medium 260 can be read. In this example, the recording medium 260 is portable. For example, the recording medium 260 is a non-transitory recording medium such as a flexible disk, an optical disk, a magnetic disk, a magneto-optical disk, or a semiconductor memory.

[0121] The communication IF 27 is an interface that enables communication with an external device.

[0122] The CPU 21 is an example of a processor, and is a processing device that performs various controls and calculations, and realizes various functions by executing an OS and programs loaded into the memory 22. The CPU 21 may be a multiprocessor including multiple CPUs, a multi-core processor having multiple CPU cores, or a configuration having multiple multi-core processors.

[0123] The CPU 21 of the management server 11 may function as the integrated alarm manager 111 shown in Fig. 15 etc. The CPU 21 of the device access server 12 may function as the resource manager 121 and the event receiving processor 122 shown in Fig. 6 etc., and may execute the OS 123 and the DB middleware 124. The CPU 21 of the resource allocation device 13 may function as the server resource manager 131 and the event processing manager 132 shown in Fig. 6 etc.

[0124] The device for controlling the overall operation of the information processing device 2 is not limited to the CPU 21, and may be, for example, any one of an MPU, DSP, ASIC, PLD, and FPGA. The device for controlling the overall operation of the information processing device 2 may also be a combination of two or more of the CPU, MPU, DSP, ASIC, PLD, and FPGA. Note that MPU is an abbreviation for Micro Processing Unit, DSP is an abbreviation for Digital Signal Processor, and ASIC is an abbreviation for Application Specific Integrated Circuit. Furthermore, PLD is an abbreviation for Programmable Logic Device, and FPGA is an abbreviation for Field Programmable Gate Array.

[0125] [C] Effect Figure 19 is a diagram comparing load leveling in the device access server 12 in the communication system 60 shown in Figure 2 and the communication system 10 shown in Figure 5. In the following Figures 19 to 21, the communication device 14 is simply referred to as "device."

[0126] In the communication system 60 indicated by symbol F1, even though the resources of device access servers #2 and #3 are available, resource depletion in device access server #1 causes a delay in processing of device access server #1, deteriorating the performance of the communication system 60. For example, a delay occurs in cooperation between device access server #1 and management server 63.

[0127] On the other hand, in the communication system 10 shown by the symbol F2, the resource allocation device 13 equalizes the load on each device access server 12, so that the total resources of the three device access servers 12 can be fully utilized.

[0128] FIG. 20 is a diagram comparing the scale-out in the communication system 60 shown in FIG. 2 and the communication system 10 shown in FIG.

[0129] In the communication system 60 indicated by the symbol G1, when it becomes necessary to scale out the system (in other words, to add a device access server 62) due to the addition of a device 61 due to network expansion, it takes time and effort to introduce the added device access server 62. For example, information about the added device 61 is registered in the device access server 62, and the destination of an event (in other words, the address of the added device access server 62) is set in the device 61, which may take several months depending on the scale of the network expansion.

[0130] On the other hand, in the communication system 10 shown by symbol G2, it is not necessary to link the device access server 12 and the communication device 14, and therefore the preparation work described for symbol G1 is not necessary. In addition, scaling out is possible simply by incorporating the added device access server 12 into the load distribution destination of the resource allocation device 13. In particular, in a cloud environment, expansion can be easily performed by providing a virtual server, which allows for short-term expansion.

[0131] FIG. 21 is a diagram comparing the states of the communication system 60 shown in FIG. 2 and the communication system 10 shown in FIG. 5 when the device access servers 62 and 12 go down.

[0132] In the communication system 60 indicated by the symbol H1, when the device access server #3 goes down, it becomes difficult, for example impossible, to monitor the device 61 linked to the device access server #3.

[0133] On the other hand, in the communication system 10 indicated by symbol H2, even if the device access server #3 goes down, the communication device 14 transmits an event to the resource allocation device 13 without being aware of the device access server #3 going down, and the processing is performed by the device access servers #1 and #2 that are in operation. This improves the maintainability of the communication system 10.

[0134] According to the network monitoring device, communication system, and network monitoring method in the above-described embodiment and modified examples, the following effects can be achieved, for example.

[0135] The server resource management unit 131 of the resource allocation device 13 collects the load status of each of the plurality of device access servers 12. The event processing management unit 132 of the resource allocation device 13 refers to the load status, and when an event issued from the communication device 14 is received, transfers the event to the device access server 12 with the lowest load among the plurality of device access servers 12.

[0136] This makes it possible to distribute the load on the device access servers 12. Furthermore, when distributing events according to the load on the device access servers 12, the resource allocation device 13 grasps the latest load status of the device access servers 12, so real-time performance can be ensured.

[0137] In the process of transferring an event, the event processing manager 132 transfers the event to one of the device access servers 12 whose load value is less than the threshold value.

[0138] This makes it possible to prevent event reception processes from concentrating on a heavily loaded device access server 12 .

[0139] In the process of transferring an event, if there are two or more device access servers 12 among multiple device access servers 12 whose load values ​​are less than a threshold, the event processing management unit 132 transfers the event to the device access server 12 among the two or more device access servers 12 whose load value has exceeded the threshold the fewest number of times within a specified period.

[0140] This makes it possible to prevent event reception processing from concentrating on the device access server 12, which is currently lightly loaded but is prone to becoming heavily loaded.

[0141] The event processing management unit 132 assigns a sequence number to an event when it receives the event from the communication device 14. In the event forwarding process, the event processing management unit 132 forwards the event with the assigned sequence number to a device access server 12 with a low load, and causes the multiple device access servers 12 to process the events in the order of the sequence numbers.

[0142] This ensures the order of received events.

[0143] In the event forwarding process, when the event processing management unit 132 receives an event indicating the occurrence of a failure from the communication device 14, it forwards the event indicating the occurrence of a failure to a device access server 12 with a low load. The event processing management unit 132 causes the management server 11 connected to each of the multiple device access servers 12 to manage the event indicating the occurrence of a failure. When the event processing management unit 132 receives an event indicating failure recovery from the communication device 14, it forwards the event indicating failure recovery to a device access server 12 with a low load. The event processing management unit 132 causes the management server 11 to update the event indicating the occurrence of a failure using the event indicating failure recovery.

[0144] This allows the occurrence of an alarm to be linked to recovery even when events are distributed to each device access server 12.

[0145] [D] Other The disclosed technology is not limited to the above-described embodiment, and various modifications can be made without departing from the spirit of the present embodiment. The configurations and processes of the present embodiment can be selected or combined as needed.

[0146] 5, it has been described that the communication system 10 includes active and standby device access servers 12. When the communication system 10 is scaled out to add additional device access servers 12 or when a failure occurs in the active device access server 12, the resource allocation device 13 may allocate an event to the standby device access server 12.

[0147] [E] Supplementary Note The following additional notes are provided regarding the above-described embodiments.

[0148] (Appendix 1) A network monitoring device connected to a plurality of server devices and communication devices, Collecting load statuses of the plurality of server devices; referring to the load status, and transferring the event issued from the communication device to a server device having a low load among the plurality of server devices when the event is received; A network monitoring device comprising a processor.

[0149] (Appendix 2) The processor: In the process of transferring the event, the event is transferred to a server device among the plurality of server devices whose load value is less than a threshold value. 2. The network monitoring device of claim 1.

[0150] (Appendix 3) The processor: In the process of transferring the event, if there are two or more server devices among the plurality of server devices whose load value is less than the threshold, the event is transferred to the server device among the two or more server devices whose load value has been equal to or greater than the threshold the fewest number of times within a predetermined period. 3. The network monitoring device of claim 2.

[0151] (Appendix 4) The processor: When receiving the event from the communication device, adding information indicating a sequence of the event to the event; In the process of transferring the events, the events to which the information indicating the order has been assigned are transferred to the server device with the lightest load, and the plurality of server devices are caused to process the events in an order based on the information indicating the order. 4. The network monitoring device according to claim 1.

[0152] (Appendix 5) In the process of transferring the event, the processor When a first event indicating a failure is received from the communication device, the first event is transferred to the first server device having a low load, and the first event is managed by a management device connected to each of the plurality of server devices; when receiving a second event indicating recovery from the failure from the communication device, transferring the second event to the second server device having a low load, and causing the management device to update the first event using the second event; 4. The network monitoring device according to claim 1.

[0153] (Appendix 6) The system comprises a plurality of server devices, a network monitoring device, and a communication device, which are connected to each other; Each of the plurality of server devices acquires a load status of the server device itself, the network monitoring device collects the load status from each of the plurality of server devices; the network monitoring device refers to the load status and transfers the event issued from the communication device to a server device with a low load among the plurality of server devices when the event is received; Communication system.

[0154] (Appendix 7) The network monitoring device In the process of transferring the event, the event is transferred to a server device among the plurality of server devices whose load value is less than a threshold value. 7. The communication system of claim 6.

[0155] (Appendix 8) The network monitoring device In the process of transferring the event, if there are two or more server devices among the plurality of server devices whose load value is less than the threshold, the event is transferred to the server device among the two or more server devices whose load value has been equal to or greater than the threshold the fewest number of times within a predetermined period. 8. The communication system of claim 7.

[0156] (Appendix 9) The network monitoring device When receiving the event from the communication device, adding information indicating a sequence of the event to the event; In the process of transferring the event, the event to which the information indicating the order is added is transferred to the server device with the lightest load; Each of the plurality of server devices The plurality of server devices process the events in an order based on the information indicating the order. A communication system according to any one of Supplementary notes 6 to 8.

[0157] (Appendix 10) further comprising a management device connected to each of the plurality of server devices; In the process of transferring the event, when the network monitoring device receives a first event indicating the occurrence of a failure from the communication device, the network monitoring device transfers the first event to the first server device having a low load; the first server device shares the first event with the management device; the management device manages the first event; In the process of transferring the event, when the network monitoring device receives a second event indicating recovery from a failure from the communication device, the network monitoring device transfers the second event to the second server device having a low load; the second server device shares the second event with the management device; the management device updates the first event using the second event; A communication system according to any one of Supplementary notes 6 to 8.

[0158] (Appendix 11) A network monitoring method in a communication system including a plurality of server devices, a network monitoring device, and a communication device connected to each other, comprising: Each of the plurality of server devices acquires a load status of the server device itself, the network monitoring device collects the load status from each of the plurality of server devices; the network monitoring device refers to the load status and transfers the event issued from the communication device to a server device with a low load among the plurality of server devices when the event is received; Network monitoring methods.

[0159] (Appendix 12) The network monitoring device In the process of transferring the event, the event is transferred to a server device among the plurality of server devices whose load value is less than a threshold value. 12. The network monitoring method of claim 11.

[0160] (Appendix 13) The network monitoring device In the process of transferring the event, if there are two or more server devices among the plurality of server devices whose load value is less than the threshold, the event is transferred to the server device among the two or more server devices whose load value has been equal to or greater than the threshold the fewest number of times within a predetermined period. 13. The network monitoring method of claim 12.

[0161] (Appendix 14) The network monitoring device When receiving the event from the communication device, adding information indicating a sequence of the event to the event; In the process of transferring the event, the event to which the information indicating the order is added is transferred to the server device with the lightest load; Each of the plurality of server devices The plurality of server devices process the events in an order based on the information indicating the order. A network monitoring method according to any one of Supplementary Notes 11 to 13.

[0162] (Appendix 15) In the process of transferring the event, when the network monitoring device receives a first event indicating the occurrence of a failure from the communication device, the network monitoring device transfers the first event to the first server device having a low load; the first server device shares the first event with management devices connected to each of the plurality of server devices; the management device manages the first event; In the process of transferring the event, when the network monitoring device receives a second event indicating recovery from a failure from the communication device, the network monitoring device transfers the second event to the second server device having a low load; the second server device shares the second event with the management device; the management device updates the first event using the second event; A network monitoring method according to any one of Supplementary Notes 11 to 13. [Explanation of symbols]

[0163] 10, 10a, 60, 60a: Communication systems 11, 63: Management Server 111: Integrated alarm management unit 12, 61: Device access server 121: Resource Management Department 122: Event receiving processing unit 123 :OS 124:DB middleware 13, 65: Resource allocation device 131: Server Resource Management Unit 132: Event processing management unit 14: Communication equipment 101: Event management database 102: Latest resource status table 103: Resource status history table 104: Latest resource status table 104: Device access server latest resource status table 105: Allocation judgment information table 106: Alarm management database 107: Alarm DB 107a: Alarm information 107b: Alarm recovery information 2: Information processing equipment 21: CPU 22: Memory 23: Display control device 231:Display device 24:Storage device 25: Input IF 251: Mouse 252: Keyboard 26: External recording medium processing device 260: Recording media 27: Communication IF 6: Network monitoring system 61: Equipment 64: Monitoring screen 602: Alarm information

Claims

1. A network monitoring device connected to a plurality of server devices and communication devices, Collecting load statuses of the plurality of server devices; referring to the load status, and transferring the event issued from the communication device to a server device having a low load among the plurality of server devices when the event is received; A network monitoring device comprising a processor.

2. The processor: In the process of transferring the event, the event is transferred to a server device among the plurality of server devices whose load value is less than a threshold value. The network monitoring device according to claim 1 .

3. The processor: In the process of transferring the event, if there are two or more server devices among the plurality of server devices whose load value is less than the threshold, the event is transferred to the server device among the two or more server devices whose load value has been equal to or greater than the threshold the fewest number of times within a predetermined period. The network monitoring device according to claim 2 .

4. The processor: When receiving the event from the communication device, adding information indicating a sequence of the event to the event; In the process of transferring the events, the events to which the information indicating the order has been assigned are transferred to the server device with the lightest load, and the plurality of server devices are caused to process the events in an order based on the information indicating the order. The network monitoring device according to any one of claims 1 to 3.

5. In the process of transferring the event, the processor When a first event indicating a failure is received from the communication device, the first event is transferred to the first server device having a low load, and the first event is managed by a management device connected to each of the plurality of server devices; when a second event indicating recovery from a failure is received from the communication device, the second event is transferred to the second server device having a low load, and the management device updates the first event using the second event; The network monitoring device according to any one of claims 1 to 3.

6. The system comprises a plurality of server devices, a network monitoring device, and a communication device, which are connected to each other; Each of the plurality of server devices acquires a load status of the server device itself, the network monitoring device collects the load status from each of the plurality of server devices; the network monitoring device refers to the load status and transfers the event issued from the communication device to a server device with a low load among the plurality of server devices when the event is received; Communication system.

7. A network monitoring method in a communication system including a plurality of server devices, a network monitoring device, and a communication device connected to each other, comprising: Each of the plurality of server devices acquires a load status of the server device itself, the network monitoring device collects the load status from each of the plurality of server devices; the network monitoring device refers to the load status and transfers the event issued from the communication device to a server device with a low load among the plurality of server devices when the event is received; Network monitoring methods.

Images