Maintenance server and system call collection method

Abstract

A maintenance server (30) has a collection amount calculation unit (32) for reducing the collection amount of system call information collected from a first communication server among communication servers (10) constituting a network system when the usage status of a resource in the first communication server exceeds an upper limit value. The collection amount calculation unit (32) increases the collection amount of system call information collected from a second communication server among the communication servers (10) when the usage status of a resource in the second communication server is less than an upper limit value.

Description

Maintenance server and system call collection method

[0001] The present invention relates to a maintenance server and a system call collection method.

[0002] In network systems such as the 5th Generation Core network (5GC), various network functions are defined as network functions (NFs), and a wide variety of communication services can be provided by combining NFs. Virtualized NF (VNF), which realizes NFs as containers, a type of virtualization technology, has also been proposed.

[0003] In order to operate a network system normally and stably, it is necessary to detect signs of abnormalities or failures in the servers that make up the network system. Examples of such detection technologies are as follows: Patent Document 1 describes the use of statistical information on the issuance of system calls by a host OS (Operating System). Non-Patent Document 1 describes an EDR (Endpoint Detection and Response) product that detects signs of abnormalities by monitoring statistical information on system calls.

[0004] JP 2011-258019 A

[0005] Falco, "The Falco Project," [online], [Retrieved April 1, 2024], Internet <URL: https: / / falco.org / docs / >

[0006] Conventional security tools such as those described in Patent Document 1 and Non-Patent Document 1 acquire system call information each time a system call is invoked by a communication server, in order to obtain statistical information on system calls. Furthermore, the higher the traffic volume processed by the communication server, the more system calls are generated in response to the traffic, which increases the processing load for collecting system calls.

[0007] Because communication server resources are limited, using too many resources to process system calls reduces the resources available for communication services, making it difficult to meet performance requirements such as network latency. Note that communication services often have very strict performance requirements regarding latency, etc.

[0008] Therefore, the main object of the present invention is to set the amount of system calls to be collected to an appropriate amount within a range that does not affect the performance requirements of the communication service.

[0009] In order to solve the above problems, the maintenance server of the present invention comprises the following means: The present invention is characterized by having a collection amount calculation unit that reduces the amount of system call information collected from a first communication server when the resource usage status in the first communication server among the communication servers constituting the network system exceeds an upper limit value.

[0010] According to the present invention, the amount of system calls to be collected can be set to an appropriate amount within a range that does not affect the performance requirements of the communication service.

[0011] FIG. 1 is a configuration diagram of a system call collection system according to the present embodiment. FIG. 2 is a sequence diagram showing an overview of the operation of the system call collection system, focusing on the resource usage of one communication server according to the present embodiment. FIG. 3 is a network diagram showing a first example of a network topology formed by a communication server according to the present embodiment. FIG. 4 is a network diagram showing a second example of a topology formed by a communication server according to the present embodiment. FIG. 5 is a sequence diagram showing an overview of the operation of the system call collection system, focusing on the resource usage of a plurality of communication servers according to the present embodiment. FIG. 6 is a flowchart showing the operation of a maintenance server according to the present embodiment. FIG. 7 is a table showing a first calculation example of a collection amount calculation unit according to the present embodiment. FIG. 8 is a table showing a second calculation example of a collection amount calculation unit according to the present embodiment. FIG. 9 is a hardware configuration diagram of each device of the system call collection system according to the present embodiment.

[0012] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0013] FIG. 1 is a configuration diagram of a system call collection system 100. The system call collection system 100 is configured by connecting multiple communication servers 10, an analysis server 20, and a maintenance server 30 via a network. Each communication server 10 uses its own resources (CPU, memory, storage, NW transfer unit, etc.) to relay data. A network system is configured between the communication servers 10, as shown in FIG. 3. The analysis server 20 analyzes the system call information collected by each communication server 10 to detect the occurrence (or signs) of an abnormality (failure) in the communication server 10.

[0014] The maintenance server 30 changes the amount of system call information collected (hereinafter referred to as "collection amount") depending on the resource usage status (such as CPU usage rate) of each communication server 10. Here, the collected system call information is information on system calls executed by the kernel 14 of each communication server 10. On the other hand, the amount of information to be collected determined by the maintenance server 30 is not limited to system call information, and may be any event information (log information) generated in each communication server 10. Then, the maintenance server 30 sets condition settings in the communication server 10 that reflect the determined amount of information to be collected.

[0015] The communication server 10 includes a virtualization infrastructure layer 10V that provides OS functions and an application layer 10A that runs on the virtualization infrastructure layer 10V. The application layer 10A includes an application 11 for providing services such as VNF, a resource monitoring unit 12 that collects resource usage information related to the communication server 10, and a collection control unit 13 that controls a system call collection unit 15. The virtualization infrastructure layer 10V includes a kernel 14, which is a core function of the OS, and a system call collection unit 15 that collects system calls from the kernel 14. When the OS is Linux (registered trademark), the system call collection unit 15 can be implemented in the kernel 14 using eBPF (extended Berkeley Packet Filter).

[0016] If the collected resource usage status exceeds an upper limit (first threshold), the resource monitoring unit 12 notifies the maintenance server 30 of this. Upon receiving the notification, the maintenance server 30 instructs the analysis server 20 to change the collection conditions. The analysis server 20 determines the collection conditions and instructs the communication server 10. The collection control unit 13 specifically instructs the system call collection unit 15 to control the collection of system calls in accordance with the condition settings notified from the maintenance server 30 via the analysis server 20. The system call collection unit 15 is provided in the kernel 14, and provides the collected data to the analysis server 20 via the collection control unit 13 in the application layer 10A, causing the analysis server 20 to instruct the collection conditions.

[0017] The maintenance server 30 includes a resource status storage unit 31, a collection amount calculation unit 32, and a condition setting unit 33. The resource status storage unit 31 stores the resource usage status collected by the resource monitoring unit 12 of each communication server 10.

[0018] The collection amount calculation unit 32 changes the collection amount for each communication server 10 according to the resource usage status of each communication server 10 read from the resource status storage unit 31, as shown in the following example. When the resource usage status of a first communication server among the communication servers 10 constituting the network system exceeds an upper limit, the collection amount calculation unit 32 reduces the collection amount of system call information collected from the first communication server. That is, the collection amount calculation unit 32 reduces the collection amount of a communication server 10 (hereinafter referred to as a "pressured server") whose resource usage status is tight, such as when the CPU usage rate exceeds a first threshold. The degree of reduction in the collection amount is, for example, such that the CPU usage rate falls below the first threshold. When the resource usage status of a second communication server among the communication servers 10 is below an upper limit, the collection amount calculation unit 32 may increase the collection amount of system call information collected from the second communication server. In other words, the collection amount calculation unit 32 increases the collection amount of the communication server 10 (hereinafter referred to as the "surplus server") that has a surplus in resource usage, such as a CPU usage rate that is less than the second threshold. Here, the first threshold is set equal to or greater than the second threshold.

[0019] The condition setting unit 33 determines condition settings for collecting system call information for each communication server 10 in accordance with the collection volume for each communication server 10 calculated by the collection volume calculation unit 32. The following are examples of condition settings created by the condition setting unit 33. The type of VNF to be collected is changed depending on the collection volume for each communication server 10. For example, to reduce the collection volume, the condition setting unit 33 creates a condition setting to reduce the types of VNF to be collected (types of applications 11 that call system calls). The type of system call to be collected is changed depending on the collection volume for each communication server 10. For example, to reduce the collection volume, the condition setting unit 33 creates a condition setting to reduce the types of system calls (function names, etc.) to be collected. The frequency of the collection process is changed depending on the collection volume for each communication server 10. For example, to reduce the amount of data collected, the condition setting unit 33 creates condition settings that thin out (sample) the collection frequency by reducing the frequency of collection process startup times, reducing the collection time per collection process, reducing the collection capacity per collection process, etc. The condition setting unit 33 may be configured to be provided in the maintenance server 30 or in the analysis server 20.

[0020] 2 is a sequence diagram illustrating an overview of the operation of the system call collection system 100, focusing on the resource usage status of one communication server 10. The collection control unit 13 of the communication server 10 collects a larger amount of system call information than the amount collected in S131 (described below) (S111) and notifies the analysis server 20 of the collection results (S112). The analysis server 20 analyzes the notified system call information with a larger amount of collection (S113), enabling highly accurate analysis. The analysis server 20 notifies the maintenance server 30 of the analysis results of S113. The resource monitoring unit 12 of the communication server 10 then detects that its own resource usage status is tight and the remaining resource amount is low (S114). If the resource usage status detected in S114 exceeds the upper limit, the resource monitoring unit 12 notifies the maintenance server 30 of this fact (S115). The maintenance server 30 uses the notification of S115 as a trigger (opportunity) to determine whether to change the collection amount of the communication server 10 that sent the notification (S116).

[0021] The maintenance server 30 notifies the analysis server 20 of a collection condition change instruction, including the ID of the communication server 10 whose collection conditions are to be changed and information indicating how the collection conditions are to be changed (whether to increase or decrease the collection volume) (S121). The analysis server 20 (the condition setting unit 33 therein) receives the notification of S121 and changes the collection conditions of the communication server 10 (S122). The analysis server 20 instructs the communication server 10 of the collection conditions changed in S122 (here, a condition to reduce the collection volume so that the upper limit exceedance in S115 is resolved) (S123). The collection control unit 13 receives the instruction of S123 and collects a smaller amount of system call information than that collected in S111 (S131) ​​and notifies the analysis server 20 of the collection results (S132). The analysis server 20 analyzes the notified system call information with a smaller collection volume (S133). The analysis server 20 notifies the maintenance server 30 of the analysis results of S133.

[0022] 3 is a network diagram showing a first example of a network topology (hereinafter abbreviated as "topology") formed by the communication server 10. The topology is the layout information of the communication server 10 that shows how the communication server 10 is connected to other devices. For example, the communication server 10 is classified into the following types according to the topology: - Gateways that are entrances and exits to other networks. - Intermediate servers (non-gateway servers) that perform relay services within the network. - End servers that send and receive data to and from end users. The topology can also be considered a network diagram that shows, in a wide area, how the hardware of the communication server 10 (nodes representing devices, links representing lines) is connected.

[0023] For example, the topology in Fig. 3 shows a network system in which the communication server 10 in Fig. 1 is connected to five communication servers 111 to 115. Furthermore, the communication servers 111 and 113, marked with [GW] in the communication server box, are gateway servers (GW is an abbreviation for gateway). On the other hand, the communication servers 112, 114, and 115, marked with [Intermediate] in the communication server box, are intermediate servers.

[0024] When a network system is configured with multiple communication servers 10, the resource usage of each communication server 10 varies depending on the topology of each communication server 10 and the role of each communication server 10 in the network service. For example, a gateway server is located at the boundary between network systems operated by different organizations. Therefore, due to the structure of the communication network, gateway servers constantly process a large amount of traffic, and therefore tend to always have higher resource usage than non-gateway servers.

[0025] In other words, gateway servers are considered to be constrained servers, and non-gateway servers are considered to be surplus servers. Therefore, the collection volume calculation unit 32 calculates the collection volume of constrained servers to be less than the collection volume of surplus servers. As a result, the calculation result of the collection volume calculation unit 32 is added to the frame of each communication server, indicating either "low collection" (lowest collection volume), "medium collection volume" (medium collection volume) (Figure 4), or "high collection volume" (highest collection volume). For example, the [GW → low collection] entry in the frame of communication server 111 indicates that the calculation result of the collection volume calculation unit 32, "low collection volume," was output due to the characteristics of the gateway server (GW) topology. In other words, the collection volume calculation unit 32 refrains from collecting information from constrained servers with high resource usage.

[0026] On the other hand, the [Intermediate → Large Collection] written in the box for the communication server 112 indicates that the calculation result of the collection amount calculation unit 32, "large collection," was output due to the characteristics of the topology, which is an intermediate server. In other words, the collection amount calculation unit 32 adjusts to collect a large amount of information from slack servers with surplus resource usage. This makes it possible to ensure a high collection amount for the entire network to detect abnormal signs.

[0027] Fig. 4 is a network diagram showing a second example of the topology formed by the communication server 10. The topology in Fig. 4 shows a network system in which the communication server 10 in Fig. 1 is connected to each other as six communication servers 121 to 126. The existence of two gateway servers (communication servers 121 and 123) is common to Fig. 3 and Fig. 4.

[0028] On the other hand, in FIG. 4, the collection volume calculation unit 32 may change the collection volume according to the network distance (metric) between the gateway server and the intermediate server, as defined by the topology, even for the same classification of intermediate servers, as shown in the following examples: The collection volume of intermediate servers (communication servers 122, 124, 126) that are close to the gateway server (e.g., 0 hops or less) is set to medium (collecting) ([Intermediate → Collecting]). The collection volume of intermediate servers (communication server 125) that are far from the gateway server (e.g., 1 hop or more) is set to a value higher than medium ([Distant → High Collection]). This setting according to the distance from the gateway server may be based on all gateway servers, or may be based only on gateway servers where resource usage is constantly under pressure. Furthermore, although the number of hops is used as an example of a metric, other indicators, such as delay, may also be used.

[0029] Furthermore, the collection amount calculation unit 32 may change the collection amount depending on the priority of the server according to the packet flow defined by the topology. For example, assume that packets flow from the most upstream communication server 121 to the communication server 122 to the most downstream communication server 123. Here, the more downstream the packet flow, the more packets from various upstream locations merge together, and the traffic volume tends to increase. In this case, the collection amount calculation unit 32 assigns the most downstream communication server 123 the highest priority of 3, the midstream communication server 122 the second highest priority of 2, and the most upstream communication server 121 the lowest priority of 1. The collection amount calculation unit 32 then sets the collection amount for the entire network so that the higher the priority of the server, the smaller the collection amount.

[0030] 5 is a sequence diagram showing an outline of the operation of the system call collection system 100, focusing on the resource usage status of multiple communication servers 10. In addition to the analysis server 20 and the maintenance server 30, Fig. 5 illustrates the communication server 111, which is a constrained server (gateway server), and the communication server 112, which is a spare server (intermediate server), among the communication servers 111 to 115 in Fig. 3.

[0031] First, the resource monitoring unit 12 of the communication server 112 detects that its own resource usage has margin and the remaining amount of resources is moderate (S211), and notifies the maintenance server 30 that the resource usage is below the upper limit (within the upper limit) (S212). Meanwhile, the resource monitoring unit 12 of the communication server 111 detects that its own resource usage is tight and the remaining amount of resources is low (S213). When the resource usage detected in S213 exceeds the upper limit, the communication server 111 notifies the maintenance server 30 of this fact (S214).

[0032] The maintenance server 30, triggered by the notification of S214, decides to change the collection volume of each communication server 10 (S215). The maintenance server 30 notifies the analysis server 20 of an instruction to change the collection conditions, including the ID of the communication server 10 whose collection conditions are to be changed and information indicating how the collection conditions are to be changed (whether to increase or decrease the collection volume) (S221). The analysis server 20 (condition setting unit 33 therein) receives the notification of S221 and changes the collection conditions individually for each communication server 10 (S222).

[0033] First, for the communication server 111, which is the congested server, the analysis server 20 creates collection conditions to reduce (reduce) the collection volume from that at the time of S213 so that the upper limit exceedance at S214 is resolved, and instructs the communication server 111 of the collection conditions (S223). In response to the instruction at S223, the collection control unit 13 of the communication server 111 collects system call information with the reduced collection volume (S224), and notifies the analysis server 20 of the collection results (S231).

[0034] On the other hand, for the communication server 112, which is a slack server, the analysis server 20 creates collection conditions to increase the collection volume from that at the time of S211 (increase) as long as the resource usage status is below the upper limit, as in S212, and instructs the communication server 112 of the collection conditions (S225). The collection control unit 13 of the communication server 112 receives the instruction of S225, collects system call information with the increased collection volume (S226), and notifies the analysis server 20 of the collection results (S232). The analysis server 20 analyzes the system call information notified in S231 and S232 (S233). The analysis server 20 notifies the maintenance server 30 of the analysis results of S233. Here, the collection volume at S231 has decreased, but the collection volume at S232 has increased. Therefore, the maintenance server 30 adjusts the collection volume in cooperation with multiple servers, enabling analysis without reducing accuracy across the entire network. Furthermore, even after S233, the maintenance server 30 responds to changes in the resource usage status of each communication server 10, takes into account the status of the other communication servers 10, and adjusts the amount of data collected.

[0035] 6 is a flowchart showing the operation of the maintenance server 30. The maintenance server 30 acquires the resource usage status from the resource monitoring unit 12 of each communication server 10 and stores the resource usage status in the resource status storage unit 31 (S301). The collection amount calculation unit 32 calculates the amount of system call information to be collected so that the resource usage status of each communication server 10 falls within the upper limit value, and the condition setting unit 33 transmits the system call collection settings to each communication server 10 (S302).

[0036] Here, the collection amount calculation unit 32 determines whether there is a communication server 10 where resources are constrained (where resource usage exceeds the upper limit) based on the resource usage status collected from the resource monitoring unit 12 to the resource status storage unit 31 (S303). Note that the collection amount calculated in S302 is calculated so that the resource usage is within the upper limit at the time of calculation. However, after the collection amount is calculated, resource usage may become constrained due to factors such as an increase in traffic volume, so that the result in S303 may be Yes. If the result in S303 is Yes, the collection amount calculation unit 32 changes the collection amount of system call information at each communication server 10 so as to reduce the collection amount at the constrained server and increase the collection amount at the surplus server, as described in FIG. 3 (S304).

[0037] Then, the collection amount calculation unit 32 determines whether the congested server has recovered (the resource usage has fallen below the upper limit) based on the resource usage status collected from the resource monitoring unit 12 to the resource status storage unit 31 (S305). If the result in S305 is Yes, the collection amount calculation unit 32 returns the collection amount of system call information in each communication server to the normal collection amount calculated in S302 (S306).

[0038] FIG. 7 is a table showing a first calculation example of the collection amount calculation unit 32. This table associates, for the same communication server 10, the resource usage (CPU usage) at each point in time, the upper limit (threshold) to be compared, and the collection amount calculated by the collection amount calculation unit 32 at the time of comparison. In the first row of the table, when the CPU usage rate is 10%, the CPU usage rate is below the first threshold value of 20 corresponding to [urgency level = 1], and a collection amount of 80 corresponding to [urgency level = 1] is set. In other words, in the [urgency level = 1] situation, the CPU usage rate is low and there is ample resource surplus, so a large collection amount of 80 is set for the communication server 10. In the second row of the table, when the CPU usage rate is 30%, the CPU usage rate exceeds the first threshold value of 20 corresponding to [urgency level = 1], and therefore the CPU usage rate is compared with the second threshold value of 60 corresponding to the next [urgency level = 2]. In the situation of [urgency=2], the CPU usage rate is medium and there is some leeway in resources, so a medium collection amount=50 is set for the communication server 10 .

[0039] In the third row of the table, similar to the second row, when the CPU usage rate is 50%, the second threshold value of 60 corresponding to [urgency level = 2] is exceeded, and a collection volume of 50 corresponding to [urgency level = 2] is set. In the fourth row of the table, when the CPU usage rate is 70%, the second threshold value of 60 corresponding to [urgency level = 2] is exceeded, and therefore a comparison is made with the third threshold value of 80 corresponding to the next [urgency level = 3]. In the [urgency level = 3] situation, the CPU usage rate is high and there is little spare resource, so a small collection volume of 30 is set for the communication server 10. Although not shown in the figure, when the CPU usage rate is 90%, the third threshold value of 80 corresponding to [urgency level = 3] is also exceeded, and therefore the collection volume calculation unit 32 sets, for example, a collection volume of 0 (interruption of collection) for the communication server 10.

[0040] In this way, the collection amount calculation unit 32 may set multiple thresholds for the resource usage status to set a stepped collection amount corresponding to the urgency level according to the tightness of the resource usage status. This prevents drastic changes in the information collection process, allowing the communication server 10 to operate stably. Furthermore, the collection amount calculation unit 32 may set multiple thresholds corresponding to the importance level instead of setting multiple thresholds corresponding to the urgency level.

[0041] 8 is a table showing a second calculation example of the collection amount calculation unit 32. This table associates the values ​​before and after a change in the numerical value for each resource item. Among the items in the table, items named "~ usage rate" (CPU usage rate, memory usage rate, storage usage rate) indicate the resource usage status according to the resource type (CPU, memory, storage). Among the items in the table, items named "~ collection amount" (CPU collection amount, memory collection amount, storage collection amount) indicate the collection amount according to the resource type.

[0042] Here, the collection volume calculation unit 32 may set (change) the system call collection volume depending on the type of resource (CPU, memory, storage) that is under pressure. For example, before the table was changed, the collection volume was allocated equally to each resource type (CPU collection volume = 50, memory collection volume = 50, storage collection volume = 50), but the utilization rate varied depending on the resource type (CPU utilization = 90, "exceeding the first threshold = 60"; memory utilization = 50, storage utilization = 10, "marginal state below the second threshold = 20"). Therefore, the collection volume calculation unit 32 changes the system call collection volume depending on the level of pressure for each resource type so that the resources required for collecting system call information do not overlap with the under-utilized resources. To restore CPU utilization = 90 (over-utilization state), the CPU collection volume is reduced from 50 to 10. Since memory utilization = 50 is normal, the memory collection volume = 50 is maintained. - To take advantage of the storage utilization rate of 10 (excess storage), increase the storage collection amount from 50 to 80.

[0043] As described above with reference to FIG. 8 , when each communication server 10 uses multiple types of resources, the resource monitoring unit 12 may monitor the resource usage status for each resource type. In this case, the collection amount calculation unit 32 performs a process of comparing the resource usage status in each communication server 10 with the upper limit value for each resource type. Then, the collection amount calculation unit 32 reduces the amount of collected system call information for resource types that exceed the upper limit value in each communication server 10. Furthermore, the collection amount calculation unit 32 maintains or increases the amount of collected system call information for resource types that do not exceed the upper limit value in each communication server 10.

[0044] FIG. 9 is a hardware configuration diagram of each device in the system call collection system 100. Each device (communication server 10, analysis server 20, maintenance server 30) in the system call collection system 100 is configured as a computer 900 having a CPU 901, RAM 902, ROM 903, HDD 904, communication I / F 905, input / output I / F 906, and media I / F 907. The communication I / F 905 is connected to an external communication device 915. The input / output I / F 906 is connected to an input / output device 916. The media I / F 907 reads and writes data from a recording medium 917. Furthermore, the CPU 901 controls each unit by executing a program (system call collection program) loaded into RAM 902. This program (also called an application, or an app for short) can be distributed via a communication line or recorded on a recording medium 917 such as a USB memory stick.

[0045] [Effect] The maintenance server 30 of the present invention is characterized by having a collection amount calculation unit 32 that reduces the amount of system call information collected from the first communication server when the resource usage within the first communication server among the communication servers 10 that make up the network system exceeds the upper limit value.

[0046] This allows the maintenance server 30 to set the amount of system calls to be collected for abnormality symptom detection to an appropriate amount within a range in which resource usage does not exceed the upper limit, i.e., within a range in which the performance requirements of the communication service are not affected.

[0047] The present invention is characterized in that the collection volume calculation unit 32 increases the volume of system call information collected from the second communication server when the resource usage within the second communication server among each communication server 10 is below the upper limit value.

[0048] As a result, the maintenance server 30 adjusts to collect a large amount of information from the second communication server, which has ample resource usage, while refraining from collecting information from the first communication server, which has high resource usage. Therefore, the maintenance server 30 can improve the accuracy of detecting abnormal symptoms by ensuring a large amount of system call information for the entire network for detecting abnormal symptoms.

[0049] The present invention is characterized in that each communication server 10 uses multiple types of resources and monitors the resource usage status for each resource type, and the collection amount calculation unit 32 performs a comparison process between the resource usage status in the first communication server and an upper limit value for each resource type, and reduces the amount of system call information collected for resource types that exceed the upper limit value in the first communication server, and maintains or increases the amount of system call information collected for resource types that do not exceed the upper limit value in the first communication server.

[0050] As a result, the maintenance server 30 can reduce the amount of collection for the resource types used by the communication service (main service) of the communication server 10, thereby reducing the burden on the communication service.

[0051] REFERENCE SIGNS LIST 10 Communication server 10A Application layer 10V Virtualization infrastructure layer 11 Application 12 Resource monitoring unit 13 Collection control unit 14 Kernel 15 System call collection unit 20 Analysis server 30 Maintenance server 31 Resource status storage unit 32 Collection amount calculation unit 33 Condition setting unit 100 System call collection system 111 Communication server (first communication server) 112 Communication server (second communication server)

Claims

1. A maintenance server characterized by having a collection volume calculation unit that reduces the amount of system call information collected from a first communication server when the resource usage within the first communication server among the communication servers that make up a network system exceeds an upper limit.

2. The maintenance server of claim 1, wherein the collection volume calculation unit increases the volume of system call information collected from the second communication server when the resource usage within the second communication server among the communication servers is below the upper limit value.

3. The maintenance server according to claim 1, wherein each of the communication servers uses multiple types of resources and monitors the resource usage status for each resource type, and the collection amount calculation unit performs a comparison process for each resource type between the resource usage status in the first communication server and the upper limit value, and reduces the amount of system call information collected for resource types in the first communication server that exceed the upper limit value, and maintains or increases the amount of system call information collected for resource types in the first communication server that do not exceed the upper limit value.

4. A system call collection method characterized in that, when the resource usage within a first communication server among the communication servers constituting a network system exceeds an upper limit, a maintenance server executes a process to reduce the amount of system call information collected from the first communication server.

Images