Network management device, method, and program

Abstract

A network management device according to one embodiment comprises: an acquisition unit that acquires information indicating a connection relationship between a plurality of monitoring devices in a communication network which perform operational status monitoring with respect to each other and a non-monitoring device which is provided on a communication path between the plurality of monitoring devices and which does not perform the operational status monitoring; and a generation unit that, on the basis of the information acquired by the acquisition unit, generates first rendering information which indicates a logical connection relationship indicating the relation of mutual operational status monitoring between the plurality of monitoring devices and which, when one of the monitoring devices has issued an alarm relating to the operational status monitoring, indicates information indicating the monitoring device which issued the alarm, and that generates second rendering information in which a physical connection relationship between the monitoring devices and the non-monitoring device is rendered, and which indicates information indicating a non-monitoring device that is provided on the communication path between the plurality of monitoring devices for which the alarm was issued and that is suspected to have an abnormality.

Description

Network management device, method and program

[0001] FIELD Embodiments of the present invention relate to a network management device, method, and program.

[0002] In mobile communication networks, there are communication networks in which only some of the multiple communication devices are mutually monitored for aliveness. Mutual aliveness monitoring refers to a situation in which monitoring devices, which are paired communication devices that are the targets of mutual aliveness monitoring, mutually monitor the status of each other via ping. When an abnormality occurs in a non-monitoring device, which is a device that is not a monitored device (i.e., a device that does not perform aliveness monitoring) installed on the communication path (sometimes called a communication line) connecting two monitoring devices, an alarm related to the abnormality is generated from both of the two monitoring devices connected to the communication path on which this device is installed.

[0003] Here, when multiple non-monitored devices are installed on the communication path between monitoring devices that monitor each other's health, it becomes difficult to determine which monitoring device will be affected if an abnormality occurs in one of the non-monitored devices, and when an alarm is issued from a monitoring device, it takes a long time to identify the non-monitored device that is suspected of having an abnormality.

[0004] For example, Patent Document 1 discloses a method for visualizing a device network that comprises a physical layer, a transmission layer, and an IP (Internet Protocol) layer, and visualizing which network services are affected by a device failure.

[0005] Japanese Patent Application Publication No. 2020-65202

[0006] However, Patent Document 1 does not address device networks consisting only of alive monitoring devices. Therefore, in reality, when multiple alarms occur in a situation where monitoring domains are mixed, specialized operators for each domain at an operations center must refer to the network topology of non-monitored devices and monitoring devices. As such, currently, a lot of work is required to understand the relationship between alarms from monitoring devices and failed non-monitored devices.

[0007] This invention has been made in light of the above circumstances, and its purpose is to provide a network management device, method, and program that can properly identify a device in which an abnormality has occurred in the communication path between multiple communication devices that monitor each other.

[0008] A network management device according to one aspect of the present invention comprises an acquisition unit that acquires information indicating the connection relationships between multiple monitoring devices in a communication network that perform mutual health monitoring, and non-monitoring devices that are located on communication paths between the multiple monitoring devices and do not perform the health monitoring; and a generation unit that generates, based on the information acquired by the acquisition unit, first drawing information that indicates the logical connection relationships that indicate the mutual health monitoring relationships between the multiple monitoring devices, and that, when any of the monitoring devices issues an alarm related to the health monitoring, indicates information indicating the monitoring device that issued the alarm, and generates second drawing information that depicts the physical connection relationships between the monitoring devices and the non-monitoring devices, and that indicates information indicating the non-monitoring device that is located on communication paths between the multiple monitoring devices that issued the alarm and is suspected of having an abnormality.

[0009] A network management method according to one aspect of the present invention is a method performed by a network management device, comprising: an acquisition unit of the network management device acquiring information indicating the connection relationships between multiple monitoring devices that perform mutual health monitoring in a communication network, and non-monitoring devices that are located on communication paths between the multiple monitoring devices and do not perform the health monitoring; a generation unit of the network management device generating, based on the information acquired by the acquisition unit, first drawing information that indicates the logical connection relationships that indicate the mutual health monitoring relationships between the multiple monitoring devices, and that, when any of the monitoring devices issues an alarm related to the health monitoring, indicates information indicating the monitoring device that issued the alarm; and generating second drawing information that depicts the physical connection relationships between the monitoring devices and the non-monitoring devices, and that indicates information indicating the non-monitoring device that is located on the communication paths between the multiple monitoring devices that issued the alarm and is suspected of having an abnormality.

[0010] According to the present invention, it is possible to appropriately identify a device in which an abnormality has occurred in a communication path between a plurality of communication devices that mutually monitor each other.

[0011] FIG. 1 is a diagram showing an application example of a network management device according to an embodiment of the present invention. FIG. 2 is a flowchart showing an example of the procedure of processing operations by a network management device according to an embodiment of the present invention. FIG. 3 is a diagram showing an example of a network configuration showing the connection relationships between monitoring devices and non-monitoring devices. FIG. 4 is a diagram showing an example of the contents of a network topology drawing. FIG. 5 is a diagram showing an example of a network topology in which an alarm detection result associated with an abnormality in a communication path between monitoring devices and the location of the abnormality are identified. FIG. 6 is a block diagram showing an example of the hardware configuration of a network management device according to an embodiment of the present invention.

[0012] An embodiment of the present invention will be described below. In one embodiment of the present invention, regardless of domain, the physical connections between monitored devices and non-monitored devices and the logical connections between monitored devices are drawn in an overlapping manner and presented to the user. The physical connections are referred to as a physical network, and the logical connections are referred to as a ping network. A ping network is a network consisting only of monitored devices. Either network can be drawn as a layer on a plane. In this embodiment, these two layers are drawn in an overlapping manner.

[0013] In this embodiment, a network topology related to the physical network is drawn, with monitoring devices and non-monitoring devices as vertices on the physical network and the physical connections connecting these devices as edges. Furthermore, in this embodiment, a network topology is drawn on the ping network, with monitoring devices as vertices and the logical connections between the monitoring devices for mutual alive monitoring as edges. Note that non-monitoring devices are not drawn in the network topology related to the ping network.

[0014] In this embodiment, the above two types of network topologies are drawn overlapping each other. At this time, monitoring devices that appear in both network topologies can be drawn connected by, for example, a dotted line so that they can be visually recognized as the same device.

[0015] In this embodiment, by visually representing the device that is suspected of being the source of an abnormality among multiple non-monitored devices between the monitoring devices, the user can efficiently understand which non-monitored device is causing an abnormality in the monitoring device to issue an alarm.

[0016] Fig. 1 is a diagram showing an example of an application of a network management device according to an embodiment of the present invention. Fig. 2 is a flowchart showing an example of a procedure of processing operations by the network management device according to an embodiment of the present invention. In the example shown in Fig. 1, the network management device 100 according to an embodiment of the present invention includes a network configuration input unit 11, a network topology drawing unit 12, an alarm detection unit 13, and an abnormality location identification unit 14.

[0017] The network configuration input unit 11 accepts and acquires input of network configuration information indicating the connection relationships between monitoring devices and non-monitoring devices (S10). This information includes information on pairs of monitoring devices that perform mutual alive monitoring. Based on the network configuration acquired by the network configuration input unit 11, the network topology drawing unit 12 draws a network topology related to the physical network (sometimes referred to as a physical layer network topology) and a network topology related to the ping network (sometimes referred to as a ping layer network topology), and presents them to the user, for example, via a display (not shown) (S20). Here, a two-layer network topology can be drawn, with the network topology related to the physical network as the lower layer and the network topology related to the ping network as the upper layer.

[0018] The alarm detection unit 13 detects a group of multiple monitoring devices that have issued an alarm related to alive monitoring from among the multiple monitoring devices in the network configuration acquired by the network configuration input unit 11, and sends the detection results to the network topology drawing unit 12. As a result, the network topology drawing unit 12, to which the detection results have been sent, draws the multiple monitoring devices that have issued alarms in the network topology related to the ping network so as to distinguish them from other monitoring devices, i.e., monitoring devices that have not issued alarms, and presents the resulting drawing to the user (S30).

[0019] The abnormality location identification unit 14 identifies, among the plurality of non-monitoring devices in the network configuration acquired by the network configuration input unit 11, one or more non-monitoring devices that are provided on a communication path between the two monitoring devices that issued the alarm, as indicated by the detection result by the alarm detection unit 13, as a suspected location of the abnormality, and sends this identification result to the network topology drawing unit 12. Here, when one or both of the two monitoring devices that issued the alarm also perform mutual alive monitoring with other monitoring devices other than the two monitoring devices, and part of the communication path between the monitoring devices that issued the alarm also serves as a communication path with the other monitoring device, and the other monitoring device has not issued an alarm, the abnormality location identification unit 14 can exclude, from the targets for identification as the suspected location, non-monitoring devices that are provided on a communication path with the other monitoring device, among the non-monitoring devices provided on the communication path between the two monitoring devices that issued the alarm, i.e., non-monitoring devices that do not affect the alive monitoring of the other monitoring devices. As a result, the network topology drawing unit 12, to which the above-mentioned identified results are sent, draws the above-mentioned identified non-monitored device as a suspected location of an abnormality in the network topology related to the physical network, distinguishing it from other non-monitored devices, and presents it to the user (S40).

[0020] The following describes the processing when this embodiment is applied to an actual network configuration. Fig. 3 is a diagram showing an example of a network configuration showing the connection relationships between monitoring devices and non-monitoring devices. In the example shown in Fig. 3, the connection relationships between three monitoring devices "1", "2", and "3" and four non-monitoring devices "A", "B", "C", and "D" are shown.

[0021] Monitoring device "1" performs mutual alive monitoring with monitoring device "2." The above-mentioned monitoring device "1" also performs mutual alive monitoring with monitoring device "3." Non-monitoring devices "A," "B," and "C" are provided on the communication path between monitoring device "1" and monitoring device "2." Non-monitoring device "A" is provided closer to monitoring device "1," non-monitoring device "C" is provided closer to monitoring device "2," and non-monitoring device "B" is provided midway between non-monitoring devices "A" and "C."

[0022] In addition, non-monitoring devices "A" and "D" are provided on the communication path between monitoring device "1" and monitoring device "3." Non-monitoring device "A" is provided closer to monitoring device "1," and non-monitoring device "D" is provided closer to monitoring device "3." In other words, monitoring device "1" is connected to monitoring devices "2" and "3" in separate domains. In this configuration, the communication path between monitoring device "1" and monitoring device "2" and the communication path between monitoring device "1" and monitoring device "3" share the communication path between monitoring device "1" and non-monitoring device "A." In other words, the communication path between monitoring device "1" and non-monitoring device "A" on the communication path between monitoring device "1" and monitoring device "2" and the communication path between monitoring device "1" and non-monitoring device "A" on the communication path between monitoring device "1" and monitoring device "3" are configured as a single communication path. In this configuration, the communication path from monitoring device "1" appears to branch into two at non-monitoring device "A", with the first communication path connecting to monitoring device "2" via non-monitoring devices "B" and "C", and the second communication path connecting to monitoring device "3" via non-monitoring device "D".

[0023] Fig. 4 is a diagram showing an example of the contents of a network topology drawing, which is an example of a network topology relating to a ping network and a network topology relating to a physical network, drawn based on the network configuration shown in Fig. 3.

[0024] These monitored devices and non-monitored devices are drawn separately in the ping layer and the physical layer. In the example shown in Fig. 4, in the lower layer, a network topology of the physical layer is drawn, which corresponds to the physical connection relationships between monitored devices "1," "2," and "3" and non-monitored devices "A," "B," "C," and "D" shown in Fig. 3. In addition, in the upper layer, a network topology of the ping layer is drawn by the network topology drawing unit 12, which corresponds to the logical connection relationships between the mutual alive monitoring of monitored devices "1," "2," and "3" shown in Fig. 3.

[0025] In addition, in the example shown in Figure 4, the network topology drawing unit 12 also draws a connecting line (symbol a1 in Figure 4) indicating that the monitoring device "1" drawn in the network topology of the ping layer and the monitoring device "1" drawn in the network topology of the physical layer are the same device, a connecting line (symbol a2 in Figure 4) indicating that the monitoring device "2" drawn in the network topology of the ping layer and the monitoring device "2" drawn in the network topology of the physical layer are the same device, and a connecting line (symbol a3 in Figure 4) indicating that the monitoring device "3" drawn in the network topology of the ping layer and the monitoring device "3" drawn in the network topology of the physical layer are the same device.

[0026] 5 is a diagram showing an example of a network topology in which an alarm detection result due to an abnormality in a communication path between monitoring devices and the location of the abnormality are identified. When an abnormality occurs in a non-monitoring device located between the monitoring devices, an alarm is issued from both of the two monitoring devices that are located on the communication path where the non-monitoring device is located and that perform mutual alive monitoring. In the example shown in FIG. 5, the alarm detection unit 13 detects that an alarm has been issued from both monitoring device "1" and monitoring device "3" due to an abnormality in a non-monitoring device located on a communication path between monitoring device "1" and monitoring device "3," but not on the communication path between monitoring device "1" and monitoring device "2." This detection results in a network topology in which the drawing content in the ping layer has been changed.

[0027] In the example shown in Figure 5, upon detection of the above alarm, a mark indicating that an alarm has been issued from monitoring device "1" as described above (symbol a1 in Figure 5) and a mark indicating that an alarm has been issued from monitoring device "3" as described above (symbol a2 in Figure 5) are added to the network topology of the ping layer drawn by the network topology drawing unit 12.

[0028] Furthermore, in the example shown in Figure 5, of the multiple non-monitored devices "A" and "D" on the communication path between monitoring device "1" that issued the alarm and monitoring device "3", non-monitored device "D", excluding non-monitored device "A" that is installed on the communication path between monitoring device "1" and monitoring device "2" that is not the source of the alarm, is identified by the abnormality location identification unit 14 as the suspected location of the abnormality, and a network topology in which the drawing content in the physical layer has been changed due to this identification is displayed.

[0029] In the example shown in Figure 5, following the identification of the suspected location, a mark (symbol b in Figure 5) indicating that the non-monitored device "D" is the suspected location of the abnormality is added to the physical layer network topology drawn by the network topology drawing unit 12.

[0030] This makes it possible to visualize which monitoring devices are affected by an abnormality in a non-monitored device. Also, even when multiple non-monitored devices are installed between monitoring devices, it is possible to narrow down the number of non-monitored devices that are suspected of causing an abnormality.

[0031] 6 is a block diagram showing an example of the hardware configuration of a network management device 100 according to an embodiment of the present invention. In the example shown in FIG. 6, the network management device 100 according to the embodiment is configured, for example, as a server computer or a personal computer, and has a hardware processor 111A such as a CPU (Central Processing Unit). A program memory 111B, a data memory 112, an input / output interface 113, and a communication interface 114 are connected to this hardware processor 111A via a bus 115.

[0032] The communication interface 114 includes, for example, one or more wireless communication interface units, and enables transmission and reception of information to and from a communication network. As the wireless interface, for example, an interface that adopts a low-power wireless data communication standard such as a wireless LAN (Local Area Network) is used.

[0033] An input device 300 and an output device 400 attached to the network management device 100 and used by a user or the like are connected to the input / output interface 113. The input / output interface 113 receives operation data input by a user or the like via the input device 300, such as a keyboard, touch panel, touchpad, or mouse, and outputs and displays output data to an output device 400, which may include a display device using a liquid crystal or organic electroluminescence (EL) display or an audio output device. The input device 300 and the output device 400 may be devices built into the network management device 100, or may be input devices and output devices of other information terminals that can communicate with the network management device 100 via the network NW.

[0034] The program memory 111B is a non-transitory tangible storage medium that is a combination of a non-volatile memory that can be written to and read from at any time, such as a hard disk drive (HDD) or a solid state drive (SSD), and a non-volatile memory such as a read only memory (ROM), and stores programs necessary to execute various control processes, etc., according to one embodiment.

[0035] The data memory 112 is a tangible storage medium that is, for example, a combination of the above-mentioned nonvolatile memory and a volatile memory such as RAM (Random Access Memory), and is used to store various data acquired and created during various processing steps.

[0036] A network management device 100 according to an embodiment of the present invention may be configured as a software-based processing function unit, i.e., a data processing system or information processing device having the units shown in FIG. 1. A storage system used as a work memory or the like by the network management device 100 may be configured using the data memory 112 shown in FIG. 6. However, these configured storage areas are not essential components within the network management device 100, and may be areas provided in a storage system such as an external storage medium such as a USB (Universal Serial Bus) memory, or a database server located in the cloud.

[0037] The processing function unit can be realized by having the hardware processor 111A read and execute a program stored in the program memory 111B, but the processing function unit may also be realized in various other forms, including an integrated circuit such as an application specific integrated circuit (ASIC) or a field-programmable gate array (FPGA).

[0038] The methods described in each embodiment can be stored as a program (software means) that can be executed by a computer on a recording medium such as a magnetic disk (floppy disk, hard disk, etc.), optical disk (CD-ROM, DVD, MO, etc.), or semiconductor memory (ROM, RAM, flash memory, etc.), and can also be distributed by transmitting it via a communication medium. The program stored on the medium also includes a configuration program that configures the software means (including not only execution programs but also tables and data structures) that the computer executes. The computer that realizes this device reads the program stored on the recording medium and, in some cases, configures the software means using the configuration program, and executes the above-mentioned processing by controlling the operation of this software means. The term "recording medium" as used herein is not limited to a storage medium for distribution, but also includes storage media such as a magnetic disk or semiconductor memory installed inside the computer or in a device connected via a network.

[0039] The present invention is not limited to the above-described embodiments, and various modifications can be made in the implementation stage without departing from the spirit of the invention. Furthermore, the embodiments may be implemented in appropriate combinations, in which case the combined effects can be obtained. Furthermore, the above-described embodiments include various inventions, and various inventions can be extracted by combining selected elements from the disclosed elements. For example, if the problem can be solved and the desired effect can be obtained even if some elements are deleted from all elements shown in the embodiments, the configuration from which these elements are deleted can be extracted as an invention.

[0040] REFERENCE SIGNS LIST 100: Network management device 11: Network configuration input unit 12: Network topology drawing unit 13: Alarm detection unit 14: Abnormality location identification unit

Claims

1. A network management device comprising: an acquisition unit that acquires information indicating the connection relationships between multiple monitoring devices in a communication network that perform mutual health monitoring, and non-monitoring devices that are provided on communication paths between the multiple monitoring devices and do not perform the health monitoring; and a generation unit that, based on the information acquired by the acquisition unit, generates first drawing information that indicates the logical connection relationships that indicate the mutual health monitoring relationships between the multiple monitoring devices, and when any of the monitoring devices issues an alarm related to the health monitoring, indicates information indicating the monitoring device that issued the alarm, and generates second drawing information that depicts the physical connection relationships between the monitoring devices and the non-monitoring devices, and indicates information indicating a non-monitoring device that is provided on communication paths between the multiple monitoring devices that issued the alarm and is suspected of having an abnormality.

2. A network management device as described in claim 1, wherein the generation unit hierarchizes the first drawing information and the second drawing information and generates drawing information to which information indicating the same monitoring device in the first drawing information and the second drawing information is added.

3. A method performed by a network management device, comprising: an acquisition unit of the network management device acquiring information indicating the connection relationships of a plurality of monitoring devices that perform mutual alive monitoring in a communication network, and non-monitoring devices that are provided on communication paths between the plurality of monitoring devices and do not perform the alive monitoring; and a generation unit of the network management device generating, based on the information acquired by the acquisition unit, first drawing information that indicates the logical connection relationships that indicate the mutual alive monitoring relationships between the plurality of monitoring devices, and that, when any of the monitoring devices issues an alarm related to the alive monitoring, indicates information indicating the monitoring device that issued the alarm, and second drawing information that depicts the physical connection relationships between the monitoring device and the non-monitoring devices, and that indicates information indicating the non-monitoring device that is provided on communication paths between the plurality of monitoring devices that issued the alarm and is suspected of having an abnormality.

4. A network management processing program that causes a processor to function as each unit of the network management device according to claim 1 or 2.

Images