Monitoring device, communication monitoring method, and program

Abstract

To provide a monitoring device capable of obtaining a log relating to processes by a communication device before and after an event.SOLUTION: A monitoring device 10 is configured to: communicate with a communication device 30 in a wired or wireless scheme; and communicate with, in a wireless scheme, an access point 50 with which the communication device communicates in a wireless scheme. The monitoring device includes: an event monitoring unit that monitors an event included in a log relating to a process and received from the communication device or in packet capture data received from the access point; and a data creating unit that extracts, when the event monitoring unit detects the event, the logs before and after the event, and the pieces of packet capture data before and after the event.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a monitoring device, a communication monitoring method, and a program. [Background technology]

[0002] In some cases, communication devices such as image forming devices connect to a network using wireless communication such as wireless LAN. If an event such as a failure occurs in the wireless communication, inconveniences such as the communication device being unable to accept processing may occur, so it is desirable to analyze the cause of the failure and recover from it as soon as possible.

[0003] A technology for analyzing the cause of wireless communication failures has been devised (see, for example, Patent Document 1). Patent Document 1 discloses a technology for collecting status management packets from monitored devices, analyzing suspected areas based on the packet information, and automatically controlling packet capture. Summary of the Invention [Problem to be solved by the invention]

[0004] However, conventional techniques have a problem in that they do not collect logs related to the processing of communication devices before and after an event. For example, when irregular failures occur in wireless communication between a communication device and an access point, the amount of collected packet data becomes enormous. Analyzing only packet data takes time to narrow down the information required for failure analysis and to analyze the failure.

[0005] In view of the above-mentioned problems, an object of the present invention is to provide a monitoring device that acquires a log relating to processing of a communication device before and after an event. [Means for solving the problem]

[0006] In view of the above-mentioned problems, the present invention provides a monitoring device that communicates with a communication device via wired or wireless communication and wirelessly communicates with an access point with which the communication device communicates wirelessly, the monitoring device including: a log relating to processing received from the communication device; andThe system is characterized by having an event monitoring unit that monitors events contained in packet capture data received from the access point, and a data creation unit that, when the event monitoring unit detects the event, extracts the log before and after the event and the packet capture data before and after the event. [Effects of the Invention]

[0007] It is possible to provide a monitoring device that acquires a log relating to the processing of a communication device before and after an event. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a schematic diagram illustrating an example of a communication system. [Figure 2] FIG. 1 is a system configuration diagram of an example of a communication system. [Figure 3] FIG. 2 is a diagram illustrating a hardware configuration of an example of a monitoring device. [Figure 4] FIG. 2 is a diagram illustrating a hardware configuration of an image forming apparatus that is an example of a communication apparatus. [Figure 5] FIG. 2 is a diagram illustrating an example of functional configurations of a monitoring device, a communication device, and an access point. [Figure 6] FIG. 10 is a diagram illustrating an example of a list of communication data for detecting a monitored event. [Figure 7] FIG. 10 is a diagram illustrating an example of information stored in a device information setting storage unit. [Figure 8] FIG. 10 is a diagram illustrating an example of packet capture data stored in a capture data storage unit. [Figure 9] FIG. 4 is a diagram illustrating an example of a device log stored in a device log storage unit. [Figure 10] FIG. 10 is a flowchart illustrating an example of a process flow in which a monitoring device acquires device logs and packet capture data. [Figure 11] FIG. 10 is a diagram illustrating an example of integrated data. [Figure 12]FIG. 10 is a sequence diagram illustrating an example of a process in which a monitoring device saves a device log and packet capture data when an access point does not respond to an ICMP (ping) packet. DETAILED DESCRIPTION OF THE INVENTION

[0009] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A communication system and a communication monitoring method performed by the communication system will be described below as an example of an embodiment of the present invention with reference to the accompanying drawings. [Example]

[0010] <Outline of operation> Fig. 1 shows a schematic configuration diagram of a communication system 100. In the configuration shown in Fig. 1, the monitoring device 10 operates as follows.

[0011] (1) The communication device 30 transmits and receives packet data to and from the access point 50 wirelessly.

[0012] (2) The monitoring device 10 acquires the device log of the communication device 30, receives (captures) packet data between the access point 50 and the communication device 30, and monitors the device log and packet capture data.

[0013] (3) When the monitoring device 10 detects a predetermined event to be monitored from the device log or packet capture data, it associates the packet data before and after the event detection with the device log and saves them. Examples of predetermined events to be monitored include authentication, connection, and disconnection. The monitoring device 10 filters the packet capture data by the MAC address of the communication device 30 or the access point 50, and filters the device log for the range before and after the event detection. This allows the monitoring device 10 to significantly reduce the amount of device log and packet capture data to be analyzed for a failure. By analyzing the device log before and after the event detection, the user can determine whether there is a failure in the device log, what the monitored event is, and what processing was performed by the communication device 30, thereby identifying the cause of the failure.

[0014] Furthermore, the monitoring device 10 integrates the narrowed-down device logs and packet capture data in chronological order. This makes it easier for the user to analyze two different sets of data. For example, because the narrowed-down device logs and packet capture data are arranged in chronological order, the user can easily identify which device has a problem or which device the problem occurred first.

[0015] In this way, the monitoring device 10 of this embodiment can acquire not only packet data but also device logs for identifying the cause of a failure related to wireless communication authentication, connection, disconnection, etc., and can identify the cause of the failure using the device logs. Because the packet data and device logs are narrowed down, the amount of accumulated packet capture data can be reduced even when failures occur irregularly. In addition, because the packet capture data is integrated in chronological order, the time required for failure analysis can be shortened.

[0016] <Terminology> Packet capture refers to collecting packet data of traffic actually flowing on a network. When communicating on a TCP / IP network, data is divided by IP (Internet Protocol), and each of these divided data is called a packet. Packets flowing on a LAN are sometimes called frames, and frames may also be captured in this embodiment.

[0017] A log is data that records whether a certain process has been executed (or not executed) by a computer or communication device 30. The type of data to be recorded is described in the program that saves the log.

[0018] Authentication refers to determining whether the device or person requesting connection is a legitimate authority. In this embodiment, authentication is performed to determine whether the communication device 30 has the authority to connect to the access point 50.

[0019] A connection is a process that enables communication according to a communication protocol, such as the three-way handshake in TCP / IP.

[0020] Disconnection means terminating communication according to the communication protocol.

[0021] <System configuration example> 2 is a block diagram showing the system configuration of the communication system 100. The monitoring device 10 is communicatively connected to the communication device 30 via a USB or LAN cable or the like. The monitoring device 10 and the communication device 30 may communicate wirelessly using Direct Wi-Fi, Bluetooth (registered trademark), or the like. Furthermore, the monitoring device 10 and the communication device 30 each have a wireless LAN communication module and can communicate wirelessly with an access point 50. The access point 50 is connected to a network N such as an in-house LAN.

[0022] The communication device 30 may be any device that communicates wirelessly with the access point 50. In this embodiment, an image forming device will be described as an example. The communication device 30 may also be an MFP (Multifunction Peripheral), a projector, an electronic whiteboard, a video conference terminal, a digital camera, or the like. Furthermore, the communication device 30 may also be an output device such as a digital signage, industrial machinery, a sound collection device, medical equipment, a network home appliance, a PC, a mobile phone, a smartphone, a tablet terminal, a game console, a PDA (Personal Digital Assistant), a wearable PC, or the like.

[0023] The monitoring device 10 is an information processing device having a wireless LAN communication module. As described above, the monitoring device 10 acquires the device log from the communication device 30, and also communicates wirelessly with the access point 50 to acquire packet capture data.

[0024] The monitoring device 10 may be connected to the communication device 30 via a bridge. The bridge has a function of learning MAC addresses and transfers data only to a port that has a device with the destination MAC address.

[0025] By using a bridge connection, the monitoring device 10 can avoid the inconvenience of being unable to simultaneously communicate over a wired LAN when communicating via a wireless LAN communication module. If communication via the wireless LAN communication module and communication via a wired LAN can be performed simultaneously, the bridge may be a LAN interface. The bridge may also be an L2 switch, an L3 switch, or a hub.

[0026] The access point 50 is a type of wireless device that connects wireless LAN clients to each other and to other networks (wired LAN, etc.). An "SSID," a unique string of characters used for identification, is assigned to the access point 50, and a wireless LAN client can connect to the access point 50 by selecting the SSID to which the user wishes to connect and entering an encryption key. The access point 50 may also be equipped with a router function. A router is a communication device that relays data between two or more different networks.

[0027] <Hardware configuration> The hardware configurations of the monitoring device 10 and the communication device 30 included in the communication system 100 according to this embodiment will be described with reference to FIGS.

[0028] <<Monitoring device>> Fig. 3 is a diagram showing an example of the hardware configuration of the monitoring device 10 according to this embodiment. As shown in Fig. 3, the monitoring device 10 is constructed by a computer 500. The computer 500 includes a CPU 501, a ROM 502, a RAM 503, a hard disk (HD) 504, a hard disk drive (HDD) controller 505, a display 506, an external device connection interface (I / F) 508, a network I / F 509, a bus line 510, a keyboard 511, a pointing device 512, a digital versatile disk rewritable (DVD-RW) drive 514, a media I / F 516, and a wireless LAN communication module 517.

[0029] Of these, the CPU 501 controls the overall operation of the computer 500. The ROM 502 stores programs, such as an IPL, used to drive the CPU 501. The RAM 503 is used as a work area for the CPU 501. The HD 504 stores various data, such as programs. The HDD controller 505 controls the reading and writing of various data from and to the HD 504 under the control of the CPU 501. The display 506 displays various information, such as a cursor, menus, windows, characters, or images. The external device connection I / F 508 is an interface for connecting various external devices. In this case, the external device is, for example, the communication device 30, and the external device connection I / F 508 is, for example, a bridge, a USB (Universal Serial Bus) cable, or the like. The network I / F 509 is a network interface card (NIC) for data communication over a network. The bus line 510 is an address bus, a data bus, or the like for electrically connecting the components, such as the CPU 501, shown in FIG. 3.

[0030] The keyboard 511 is a type of input means having multiple keys used to input characters, numbers, various instructions, etc. The pointing device 512 is a type of input means for selecting and executing various instructions, selecting a processing target, moving a cursor, etc. The optical drive 514 controls reading and writing of various data from an optical storage medium 513, which is an example of a removable storage medium. The optical storage medium is a CD, a DVD, Blu-Ray (registered trademark), etc. The media I / F 516 controls reading and writing (storing) of data from a storage medium 515, such as a flash memory.

[0031] The wireless LAN communication module 517 is responsible for processing the physical layer and data link layer in accordance with standards such as IEEE802.11b / g / n / ac. The wireless LAN communication module performs wireless communication with the access point 50 while avoiding collisions using a method called CSMA / CA (Carrier Sense Multiple Access with Collision Avoidance).

[0032] The hardware configuration of the access point 50 may be the same as that of an information processing device having a wireless LAN communication module 517 .

[0033] <<Communication Devices>> 4 is a hardware configuration diagram of an image forming apparatus, which is an example of the communication device 30. As shown in FIG. 4, the image forming apparatus includes a controller 910, a short-range communication circuit 920, an engine control unit 930, an operation panel 940, and a network I / F 950.

[0034] Of these, the controller 910 has a CPU 901, which is the main part of the computer, a system memory (MEM-P) 902, a north bridge (NB) 903, a south bridge (SB) 904, an ASIC (Application Specific Integrated Circuit) 906, a local memory (MEM-C) 907, which is a storage unit, an HDD controller 908, and an HD 909, which is also a storage unit, and is configured such that the NB 903 and the ASIC 906 are connected by an AGP (Accelerated Graphics Port) bus 921.

[0035] Of these, the CPU 901 is a control unit that performs overall control of the image forming apparatus. The NB 903 is a bridge that connects the CPU 901 with the MEM-P 902, the SB 904, and the AGP bus 921, and includes a memory controller that controls reading and writing to the MEM-P 902, a PCI (Peripheral Component Interconnect) master, and an AGP target.

[0036] The MEM-P 902 comprises a ROM 902a, which is memory for storing programs and data that realize the functions of the controller 910, and a RAM 902b, which is used for expanding the programs and data and as a drawing memory during memory printing. The programs stored in the RAM 902b may be provided by being recorded in an installable or executable file format on a computer-readable recording medium such as a CD-ROM, CD-R, or DVD.

[0037] The SB 904 is a bridge connecting the NB 903 with PCI devices and peripheral devices. The ASIC 906 is an integrated circuit (IC) for image processing applications that has hardware elements for image processing and acts as a bridge connecting the AGP bus 921, PCI bus 922, HDD controller 908, and MEM-C 907. The ASIC 906 includes a PCI target and AGP master, an arbiter (ARB) that forms the core of the ASIC 906, a memory controller that controls the MEM-C 907, multiple direct memory access controllers (DMACs) that perform image data rotation using hardware logic, and a PCI unit that transfers data between the scanner unit 931, printer unit 932, and facsimile unit via the PCI bus 922. The ASIC 906 may also have a universal serial bus (USB) interface or an IEEE 1394 (Institute of Electrical and Electronics Engineers) interface.

[0038] The MEM-C907 is a local memory used as an image buffer for copying and a code buffer. The HD909 is a storage for storing image data, font data used during printing, and forms. The HD909 controls the reading and writing of data from and to the HD909 under the control of the CPU901. The AGP bus 921 is a bus interface for a graphics accelerator card proposed to speed up graphics processing, and direct high-throughput access to the MEM-P902 enables the graphics accelerator card to operate at high speed.

[0039] Further, the short-range communication circuit 920 is provided with a short-range communication circuit antenna 920a. The short-range communication circuit 920 is a communication circuit such as NFC or Bluetooth (registered trademark).

[0040] The engine control unit 930 further includes a scanner unit 931, a printer unit 932, and a facsimile unit 933. The operation panel 940 includes a panel display unit 940a, such as a touch panel, that displays current setting values ​​and selection screens and receives input from the operator, as well as hard keys 940b including a numeric keypad that receives setting values ​​for image formation conditions such as density settings and a start key that receives a command to start copying. The controller 910 controls the entire image forming apparatus, and controls, for example, drawing, communication, and input from the operation panel 940. The scanner unit 931 or the printer unit 932 includes an image processing unit that performs error diffusion, gamma conversion, and the like.

[0041] The image forming apparatus allows the user to sequentially switch between the document box function, copy function, printer function, and facsimile function using the application switching key on the operation panel 940. When the user selects the document box function, the image forming apparatus enters document box mode, when the user selects the copy function, the image forming apparatus enters copy mode, when the user selects the printer function, the image forming apparatus enters printer mode, and when the user selects the facsimile mode, the image forming apparatus enters facsimile mode.

[0042] The network I / F 950 is an interface for wireless or wired data communication. The short-range communication circuit 920 and the network I / F 950 are electrically connected to the ASIC 906 via a PCI bus 922.

[0043] <About the function> Next, the functional configuration of the monitoring device 10 according to this embodiment will be described with reference to Fig. 5. Fig. 5 is a diagram showing an example of the functional configuration of the monitoring device 10, the communication device 30, and the access point 50 according to this embodiment.

[0044] <<Communication Devices>> The communication device 30 has a communication unit 31, a wireless communication unit 32, and a device log storage unit 39. Each of these functional units of the communication device 30 is a function or means realized by the CPU 901 in Fig. 4 executing instructions contained in one or more programs installed in the communication device 30. The device log storage unit 39 is constructed in the HD 909 or the like shown in Fig. 4. Note that Fig. 4 omits general functions of the communication device 30 that are not used in this embodiment, such as a printing function.

[0045] The communication unit 31 communicates with the monitoring device 10 and transmits the device logs stored in the device log storage unit 39 to the monitoring device 10. Since the device log storage unit 39 successively stores the processing history of the device, the communication unit 31 transmits the device log to the monitoring device 10 whenever a new device log is stored. Alternatively, the communication unit 31 may transmit the device logs every time a certain amount of device logs is accumulated, or may transmit the device logs in response to a request from the monitoring device 10.

[0046] The wireless communication unit 32 communicates wirelessly with the access point 50. The wireless communication unit 32 receives print jobs from a PC via the access point 50, transmits the remaining amounts of consumables to the server, and requests the server to execute a workflow.

[0047] The device log storage unit 39 continues to store the processing history each time the device performs a process. The device processing history is diverse, and may include, for example, the execution details of various jobs, the detection of abnormalities such as paper jams, communication details, communication abnormalities, etc. The device log will be described with reference to FIG. 9.

[0048] <<Access point>> The access point 50 has a wireless communication unit 51. The wireless communication unit 51 transmits beacons, establishes communication connections, and performs actual communication. The wireless communication unit 51 transmits and receives packet data to the communication device 30, and also transfers the transmitted and received packet data to the monitoring device 10. This packet data received by the monitoring device 10 is called packet capture data. The wireless communication unit 51 starts transmitting the packet capture data in response to a request from the monitoring device 10, and also ends the transmission in response to a request.

[0049] <<Monitoring device>> The monitoring device 10 includes a wireless communication unit 11, a UI control unit 12, a communication unit 13, a communication device information setting unit 14, an access point searching unit 15, a log acquisition unit 16, an event monitoring unit 17, a packet capture unit 18, and a data creation unit 19. Each of these functional units included in the monitoring device 10 is a function or means realized by the CPU 501 executing instructions included in one or more programs installed in the monitoring device 10. The monitoring device 10 also includes a device information setting storage unit 21, a device log storage unit 22, a capture data storage unit 23, and an integrated data storage unit 24, which are constructed in the HD 504 or the like shown in FIG. 3 .

[0050] The wireless communication unit 11 transmits a start and stop of transmission of packet capture data to the access point 50, and also receives packet capture data in real time from the access point 50. "Real time" means that the completion of processing is guaranteed within a certain delay.

[0051] The communication unit 13 receives the device log from the communication device 30. The communication device 30 may transmit the device log on its own initiative, or the communication unit 13 may receive the device log by requesting the communication device 30 to send it.

[0052] The UI control unit 12 displays network information (IP address, MAC address, SSID, etc.) of the access point 50 and the communication device 30. The UI control unit 12 also displays the packet capture status and, when an event is detected, notifies the user of the event detection with a pop-up.

[0053] The communication device information setting unit 14 identifies the MAC address of the communication device 30 based on the device log and stores it in the device information setting storage unit 21. The communication device information setting unit 14 also stores information about the access point 50 (MAC address, SSID, channel, channel width, etc.) in the device information setting storage unit 21 based on the packet capture data.

[0054] The access point search unit 15 scans for beacons transmitted by the access points 50 and passes information about the access point 50 to be connected to (MAC address, SSID, channel, channel width, etc.) to the communication device information setting unit 14. The beacon includes the SSID, encryption method, etc.

[0055] The log acquisition unit 16 acquires the device log from the communication device 30 via the communication unit 13 and stores the device log in the device log storage unit 22. From the viewpoint of monitoring events in the device log, it is preferable that the log acquisition unit 16 acquires the device log in real time.

[0056] The packet capture unit 18 receives information about the access point 50 (SSID, encryption method, channel, channel width) from the communication device information setting unit 14 and starts packet capture (receives packet capture data). The encryption key is set in advance in the monitoring device 10. Furthermore, upon receiving an event notification from the event monitoring unit 17, the packet capture unit 18 stops packet capture after a certain period of time.

[0057] The event monitoring unit 17 monitors the device log and packet capture data to determine whether or not there is an event to be monitored. Events to be monitored include authentication, connection, and disconnection. When the event monitoring unit 17 detects an event to be monitored, it notifies the packet capture unit 18 of the event (stops receiving packet capture data).

[0058] When the data creation unit 19 detects a monitoring target event in the packet capture data, it filters the packet capture data before and after the event detection using the MAC addresses of the communication device 30 and the access point 50 to narrow down the packet capture data. Conversely, when the event monitoring unit 17 detects a monitoring target event in the device log, it saves the device log before and after the event detection. In this case as well, the data creation unit 19 filters the packet capture data before and after the event detection using the MAC addresses of the communication device 30 and the access point 50 to narrow down the packet capture data.

[0059] The data creation unit 19 extracts time information from the filtered device log and packet capture data obtained after the event detection, and generates integrated data by integrating both in chronological order.

[0060] <About monitored events> Figure 6 shows a list of communication data for detecting monitored events. Note that Figure 6 also shows the communication data included in the device log and the communication data included in the packet capture data. The communication data included in the monitored events in the device log is as follows: Authentication (success) handshake completed ·connection authenticated connected Cutting disconnected ·any ping error The arbitrary data is communication data obtained when the monitoring device 10 performs communication such as ping to the communication device 30 for abnormality monitoring.

[0061] The communication data included in the monitored event in the packet capture data is as follows: Authentication, connection authentication Cutting deauthentication Therefore, the event monitoring unit 17 can detect the occurrence of a monitoring target event by searching the device log or packet capture data using this communication data.

[0062] Note that monitored events may occur due to the occurrence of an abnormality or failure in the monitored event itself, or there may be a tendency for abnormalities or failures to occur after the monitored event. In either case, the cause of the abnormality or failure is often contained in the device logs and packet capture data before and after the monitored event.

[0063] <Information about each memory unit> 7 shows an example of information stored in the device information setting storage unit 21. Reference numeral 301 denotes information acquired from the communication device 30. The device information setting storage unit 21 stores the MAC address of the communication device 30 and the SSID acquired from the communication device 30. This SSID is the SSID of the access point 50 to which the communication device 30 is connected.

[0064] Reference numeral 302 denotes information acquired from packet capture data. The device information setting storage unit 21 stores the MAC address of the access point 50, the SSID of the access point 50, the channel, the channel width, etc. This SSID is the SSID of the access point 50 to which the communication device 30 is connected.

[0065] FIG. 8 shows an example of packet capture data stored in the capture data storage unit 23.

[0066] ·time indicates the current time.

[0067] ·Source is the IP address of the sender, but the MAC address is also saved.

[0068] Destination is the IP address of the destination, but the MAC address is also saved.

[0069] ·Protocol indicates the protocol used for communication.

[0070] Length displays the frame length in bytes.

[0071] Info displays an outline of the meaning of the packet. The communication data that is the monitored event is mainly contained in Info, but it may also be contained in Protocol.

[0072] 9 shows an example of a device log stored in the device log storage unit 22. A device log 311 is a device log that is recorded when an access point 50 is detected. A device log 312 is a device log that is recorded when the access point 50 and the communication device 30 are connected. It can be seen that the device log 312 includes authenticated and CONNECTED, which indicate that a connection has been made.

[0073] The device log 313 is a device log that is recorded when authentication is completed. It can be seen that the device log 313 contains handshake completed, which indicates successful authentication. The device log 314 is a device log that is recorded when disconnection from the access point 50 is completed. It can be seen that the device log 314 contains DISCONNECTED, which indicates disconnection.

[0074] <Processing flow> FIG. 10 is a flowchart showing a processing flow in which the monitoring device 10 acquires device logs and packet capture data.

[0075] After the communication device 30 is started up, the log acquisition unit 16 receives the device log from the communication device 30 in almost real time (S1). The IP address of the communication device 30 is registered in advance in the log acquisition unit 16. Any communication protocol may be used, but the Simple Network Management Protocol (SNMP) is known as a communication protocol for monitoring. In the present embodiment, the device log is stored in chronological order in the device log storage unit 22, but an event may be detected on the communication device side, and the communication device 30 may transmit only the device logs before and after the event to the monitoring device 10.

[0076] The communication device information setting unit 14 obtains the MAC address of the communication device 30 and the SSID set in the communication device 30 from the device log of the communication device 30 that is connected to the monitoring device 10 via a wired or wireless connection, and stores the information about these communication devices in the device information setting memory unit 21 (S2).

[0077] The access point search unit 15 uses the SSID saved in step S2 to scan for beacons of access points 50 in the vicinity of this device, and finds an access point 50 that is communicating with the communication device 30 (S3).

[0078] The communication device information setting unit 14 acquires the scan results from the access point searching unit 15, and stores the MAC address, SSID, channel, and channel width of the access point 50 in the device information setting storage unit 21 (S4).

[0079] Furthermore, the packet capture unit 18 starts receiving packet capture data in the frequency band of the channel acquired in step S3 (S5).

[0080] The event monitoring unit 17 determines whether the device log monitored after step S1 or the packet capture data monitored after step S5 includes a monitoring target event related to authentication, connection, or disconnection (S6). If communication data related to the above authentication, connection, or disconnection is included, the event monitoring unit 17 detects the monitoring target event (S7).

[0081] When the event monitoring unit 17 detects a monitoring target event, the packet capturing unit 18 stops packet capturing (S8) in order to prevent the packet capture data to be analyzed from increasing.

[0082] The event monitoring unit 17 may also notify a user at a remote location by e-mail or the like that a monitored event has been detected. This allows the user to analyze the problem without visiting the site. The event monitoring unit 17 may also display a pop-up message on the display 506 to indicate that a monitored event has been detected.

[0083] Regardless of whether a monitoring target event is detected in the packet capture data or the device log, the data creation unit 19 filters the packet capture data and the device log.

[0084] The data creation unit 19 extracts packet capture data before and after the monitoring target event from the packet capture data obtained during steps S5 to S8 at most. Then, the data creation unit 19 applies filtering using the MAC addresses of the communication device 30 and the access point 50 to extract packet capture data related to communication with the communication device 30 (S9). The period before and after the monitoring target event is several seconds to several minutes. To add, When the event monitoring unit 17 detects a monitored event from the packet capture data, the data creation unit 19 filters the packet capture data before and after the monitored event based on the MAC addresses of the communication device 30 and the access point 50, and extracts the device logs before and after the time the event occurred. When the event monitoring unit 17 detects a monitored event from the device log, the data creation unit 19 extracts the device log before and after the monitored event, extracts packet capture data before and after the time the monitored event occurred from the packet capture data, and extracts the packet capture data based on the MAC addresses of the communication device 30 and the access point 50.

[0085] The data creation unit 19 also acquires device logs before and after the event to be monitored from the device log storage unit 22 (S10). This process corresponds to filtering the device logs. This makes it possible to narrow down the device logs and packet capture data for the time period when the event to be monitored occurred.

[0086] The data creation unit 19 uses the packet capture data extracted in step S9 and the time information (timestamp) in the device log extracted in step S10 to generate integrated data in which the two data are arranged in chronological order (S11).

[0087] As a result, the device logs and packet capture data before and after the monitored event were compressed using filtering and then combined into a single integrated data set.

[0088] Figure 11 shows an example of integrated data. Note that the protocol and length of the packet capture data have been omitted. In the integrated data, the device log and packet capture data are integrated in chronological order. For example, in Figure 11, reference numerals 101, 103, 105, and 107 are packet capture data, and reference numerals 102, 104, and 106 are device logs. Looking at the Time item and the time of the device log, it can be seen that the packet capture data and device log are integrated in chronological order.

[0089] By arranging the machine log and packet capture data in chronological order, it becomes easier for the user to determine which of the machine log and packet capture data recorded the failure first. It is possible to discriminate whether the monitored event or failure that caused the occurrence of the failure is a problem within the device of the communication device 30 or a problem with the access point 50 or the surrounding environment.

[0090] In addition, when the UI control unit 12 outputs integrated data, it may be emphasized by changing the color of the monitored event to be detected.

[0091] <Main effects> As described above, the monitoring device 10 of the present embodiment can obtain not only packet data but also a machine log for specifying the cause of a failure related to authentication, connection, disconnection, etc. of wireless communication, and can specify the cause of the failure using the machine log. Since the packet data and the machine log are narrowed down, the amount of packet capture data accumulated even when a failure occurs irregularly can be reduced. In addition, since the packet capture data is integrated in chronological order, the time required for failure analysis can be shortened.

Example

[0092] In this example, a monitoring device 10 that transmits a ping command to the communication device 30 and monitors the monitored event caused by the ping command will be described.

[0093] In addition, in this example, it will be described assuming that the hardware configuration diagrams of FIGS. 3 and 4 and the functional block diagram shown in FIG. 5 described in the above example can be used.

[0094] <Monitoring of monitored events using the ping command> 10, the monitoring device 10 monitors communication between the communication device 30 and the access point 50 for processing. However, the monitoring device 10 can also periodically send an ICMP (ping) event to the communication device 30 and monitor the execution result of the ICMP (ping) event as a monitored event. If the monitoring device 10 obtains the execution result of the ICMP event from the device log, it can detect the monitored event. The processing to be performed when the access point 50 does not respond to the ICMP (ping) packet will be described below.

[0095] 12 is an example of a sequence diagram illustrating a process in which the monitoring device 10 saves a device log and packet capture data when the access point 50 does not respond to an ICMP (ping) packet. It is assumed that the communication device 30 and the access point 50 are already connected and the monitoring device 10 has started packet capture before the process in FIG. 12 starts. In this process, the monitoring device 10 focuses on the ICMP (ping) packet, and when the communication device 30 sends a ping error to the monitoring device 10, the monitoring device 10 acquires a device log from the communication device 30.

[0096] S21: The event monitoring unit 17 periodically sends an ICMP event (ping transmission request) to the communication device 30, for example. Ping is a command mainly used to check network connectivity. Ping uses the echo command of ICMP (Internet Control Message Protocol) to send a character string to a specified destination (IP address or host name), and checks the network connection based on whether or not the character string is returned. The response speed is also displayed, so the network speed can also be checked.

[0097] S22: The communication unit 31 of the communication device 30 receives a request for an ICMP event from the monitoring device 10. The wireless communication unit 32 determines whether to execute an ICMP event, taking into consideration the load on the communication device 30 and other factors. Note that the communication device 30 may execute an ICMP event even if there is no request from the monitoring device 10.

[0098] S23: The wireless communication unit 32 of the communication device 30 transmits a ping command to the access point 50. For convenience of explanation, it is assumed that there is no response from the access point 50 to the ping command.

[0099] S24: Since there is no ping response from the access point 50, the communication device 30 generates a device log including a ping error.

[0100] S25: The communication unit 31 of the communication device 30 notifies the monitoring device 10 that the execution result of the ping command was a ping error.

[0101] S26: The communication unit 13 of the monitoring device 10 receives the execution result of the ping command, and the event monitoring unit 17 detects a monitoring target event based on the ping error.

[0102] S27: The data creation unit 19 of the monitoring device 10 requests the communication device 30 via the communication unit 13 to send the device logs before and after the event to be monitored.

[0103] S28: In response to the request for the device log, the communication unit 31 of the communication device 30 acquires the device logs before and after the monitored event from the device log storage unit 39 and transmits them to the monitoring device 10. The communication unit 13 of the monitoring device 10 receives the device logs before and after the monitored event.

[0104] The subsequent processes of "Stop packet capture" in step S29, "Packet filtering" in step S30, and "Create integrated data" in step S31 are similar to steps S8, S9, and S11 in FIG.

[0105] In the process of Fig. 12, the monitoring device 10 does not constantly monitor the device log, thereby reducing the communication load. Furthermore, the monitoring device 10 may execute the processes of Fig. 10 and Fig. 12 in parallel, or may execute either the process of Fig. 10 or the process of Fig. 12.

[0106] 12, the monitoring device 10 requests the communication device 30 to execute a ping command, but it is sufficient if the command is one that causes the communication device 30 to communicate with the access point 50.

[0107] <Major Effects> The monitoring device 10 of this embodiment monitors the execution result of a command for communication as a monitoring target event and can acquire device logs and packet capture data. Since the monitoring device 10 acquires the device log after the monitoring target event is detected, the communication load can be reduced.

[0108] <Other application examples> The best mode for carrying out the present invention has been described above using examples, but the present invention is not limited to these examples in any way, and various modifications and substitutions can be made within the scope that does not deviate from the gist of the present invention.

[0109] In this embodiment, monitored events are detected based on commands for authentication, connection, disconnection, and communication, but the monitoring device 10 may also detect an event of transitioning to power-saving mode. In the case of a wireless LAN failure, the packets received by the communication device 30 differ depending on whether the device is in power-saving mode or normal communication, so whether the device was in power-saving mode or not is useful information for failure analysis.

[0110] Furthermore, the configuration examples in Fig. 5 and the like are divided according to main functions to facilitate understanding of the processing by the communication device 30, the access point 50, and the monitoring device 10. The method of dividing the processing units and the names thereof do not limit the present invention. The processing by the communication device 30, the access point 50, and the monitoring device 10 can be divided into even more processing units depending on the processing content. Furthermore, the processing can be divided so that one processing unit includes even more processes.

[0111] Each function of the above-described embodiments can be realized by one or more processing circuits. Here, the term "processing circuit" in this specification includes a processor programmed to perform each function by software, such as a processor implemented by an electronic circuit, as well as devices such as an ASIC (Application Specific Integrated Circuit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and conventional circuit modules designed to perform each of the above-described functions. [Explanation of symbols]

[0112] 10 Monitoring equipment 30 Communication equipment 50 access points 100 Communication Systems [Prior art documents] [Patent documents]

[0113] [Patent Document 1] JP 2015-29173 A

Claims

1. A monitoring device that communicates with a communication device via wired or wireless communication and wirelessly communicates with an access point with which the communication device communicates wirelessly, an event monitoring unit that monitors events included in a log relating to processing received from the communication device and packet capture data received from the access point; a data creation unit that, when the event monitoring unit detects the event, extracts the packet capture data before and after the event and the logs before and after the event; A monitoring device comprising:

2. The data creation unit uses time information included in the log before and after the event and the packet capture data before and after the event, The monitoring device according to claim 1 , wherein integrated data is generated by chronologically integrating the logs before and after the event and the packet capture data before and after the event.

3. When the event monitoring unit detects the event from the packet capture data, the data creation unit filters the packet capture data before and after the event based on MAC addresses of the communication device and the access point; 3. The monitoring device according to claim 1, wherein the logs are extracted from before and after the time when the event occurred.

4. When the event monitoring unit detects the event from the log, The data creation unit extracts the logs before and after the event, The monitoring device according to claim 1 or 2, characterized in that the packet capture data before and after the time when the event occurred is extracted from the packet capture data, and the packet capture data is extracted based on the MAC addresses of the communication device and the access point.

5. A monitoring device as described in any one of claims 1 to 4, characterized in that the event monitored by the event monitoring unit is an event related to authentication, connection, or disconnection, and the event monitoring unit detects the event when communication data corresponding to the predetermined authentication, connection, or disconnection is included in the log or the packet capture data.

6. the event monitoring unit requests the communication device to transmit a command to confirm communication with the access point; 6. The monitoring device according to claim 1, wherein the event is detected when a notification that there is no response to the command is received from the communication device.

7. A communication monitoring method in which a monitoring device that communicates with a communication device via wired or wireless communication and wirelessly communicates with an access point with which the communication device communicates wirelessly monitors communication, comprising: an event monitoring unit monitoring events included in a log relating to processing received from the communication device and packet capture data received from the access point; When the event monitoring unit detects the event, a data creation unit extracts the log before and after the event and the packet capture data before and after the event, respectively; A communication monitoring method comprising:

8. A monitoring device that communicates with a communication device by wire or wirelessly and that communicates wirelessly with an access point with which the communication device communicates wirelessly, an event monitoring unit that monitors events included in a log relating to processing received from the communication device and packet capture data received from the access point; a data creation unit that, when the event monitoring unit detects the event, extracts the log data before and after the event and the packet capture data before and after the event; A program to function as a

Images