System call collection system and maintenance server

Abstract

A system call collection system (100) includes a maintenance server (30) and communication servers (10) as constituents of a network system. The maintenance server (30) is provided with a condition setting unit (33) for setting a predetermined collection condition including the information amount and of information of the system call in accordance with the function of the network service of each of the communication servers (10). Each of the communication servers (10) is provided with a system call collection unit (15) for collecting system calls in accordance with the predetermined collection condition according to the network function of the communication server (10).

Description

System call collection system and maintenance server

[0001] The present invention relates to a system call collection system and a maintenance server.

[0002] In network systems such as the 5th Generation Core network (5GC), various network functions are defined as network functions (NFs), and a wide variety of communication services can be provided by combining NFs. Virtualized NF (VNF), which realizes NFs as containers, a type of virtualization technology, has also been proposed.

[0003] In order to operate a network system normally and stably, it is necessary to detect signs of abnormalities or failures in the servers that make up the network system. Examples of such detection technologies are as follows: Patent Document 1 describes the use of statistical information on the issuance of system calls by a host OS (Operating System). Non-Patent Document 1 describes an EDR (Endpoint Detection and Response) product that detects signs of abnormalities by monitoring statistical information on system calls.

[0004] JP 2011-258019 A

[0005] Falco, "The Falco Project," [online], [Retrieved May 1, 2024], Internet <URL: https: / / falco.org / docs / >

[0006] Conventional security tools, such as those described in Patent Document 1 and Non-Patent Document 1, detect abnormal signs on a single server. On the other hand, in a network system, multiple communication servers share functions to provide network services. These functions include, for example, a gateway (GW) function (distributing and collecting traffic with other networks), a relay function, and a user accommodation function. If system call information is uniformly collected and analyzed on various servers performing different functions in a network service, it is expected that the information processing burden on each communication server and the accuracy of abnormal sign detection will not be appropriate. In other words, it is necessary to improve the accuracy of abnormal sign detection while imposing an appropriate information processing burden on the collection and analysis of system call information according to the network service performed by each communication server so as not to affect the network service.

[0007] Therefore, an object of the present invention is to set, in each communication server, the type and amount of information suitable for the network service being executed when collecting and analyzing system call information.

[0008] In order to solve the above problems, the system call collection system of the present invention comprises the following means: The present invention is a system call collection system including communication servers constituting a network system and a maintenance server that monitors abnormal signs in the network system, wherein the maintenance server comprises a condition setting unit that sets predetermined collection conditions including the type and amount of system call information according to the network service function of each of the communication servers, and each of the communication servers comprises a system call collection unit that collects the system calls according to the predetermined collection conditions according to the network function of the communication server itself.

[0009] According to the present invention, in collecting and analyzing system call information, the type and amount of information suitable for the network service being executed can be set for each communication server.

[0010] FIG. 1 is a diagram illustrating an example of a network configuration (network system) of a communication server that is a target for detecting abnormal signs in a system call collection system according to this embodiment. FIG. 2 is a diagram illustrating the overall configuration of a system call collection system according to this embodiment. FIG. 3 is a diagram illustrating the network service functions of a gateway server that is a communication server according to this embodiment. FIG. 4 is a diagram illustrating the network service functions of a relay server that is a communication server according to this embodiment. FIG. 5 is a diagram illustrating the network service functions of a user accommodating server that is a communication server according to this embodiment. FIG. 6 is a diagram illustrating the overall configuration of a system call collection system according to a first modified example of this embodiment. FIG. 7 is a diagram illustrating an example of a change in collection conditions for the system call collection system according to a second modified example of this embodiment. FIG. 8 is a diagram illustrating the hardware configuration of each device in the system call collection system according to this embodiment.

[0011] <Overview> First, an overview of the system call collection system 100 (see FIG. 2) according to this embodiment will be described. Fig. 1 is a diagram illustrating an example of a network configuration (network system) of a communication server that is a target for detecting abnormal signs in the system call collection system 100 according to this embodiment.

[0012] As shown in Figure 1, the communication network is made up of multiple communication servers 10. Each communication server 10 in the communication network provides a relay service and a user accommodation service in the network service. The relay service function is set in a gateway server 10G (10) connected to other networks and a relay server 10R (10) that transfers data within the network. The user accommodation service function is set in a user accommodation server 10U (10) that is connected to end users (user terminals) and distributes and aggregates data.

[0013] 1 , in a network system, multiple communication servers 10 share functions to realize network services. When uniform (same settings) system call information is collected and analyzed among communication servers 10 that perform different network service functions, such as a gateway function network service provided by a gateway server 10G, a relay function network service provided by a relay server 10R, and a user accommodation function network service provided by a user accommodation server 10U, it is expected that the information processing load on each communication server 10, the types of abnormal symptoms to be detected, and the detection accuracy corresponding to those abnormal symptoms will not be appropriate. Therefore, in the system call collection system 100 according to this embodiment, when collecting and analyzing system call information, the type and amount of information appropriate for the network service function being executed are set for each communication server 10.

[0014] <Present Embodiment> An embodiment of the present invention will be described in detail below with reference to the drawings. Fig. 2 is a diagram showing the overall configuration of a system call collection system 100 according to this embodiment. In the system call collection system 100, multiple communication servers 10, an analysis server 20, and a maintenance server 30 are connected via a network. The multiple communication servers 10 are configured to share functions to realize network services, such as a gateway server 10G (10), a relay server 10R (10), and a user accommodation server 10U (10), and constitute a network system such as that shown in Fig. 1.

[0015] The analysis server 20 analyzes the system call information (system call information) collected by each communication server 10 to detect the occurrence of an abnormality (failure) in the communication server 10 or signs of an abnormality (such as signs of an abnormality).

[0016] The maintenance server 30 determines the collection conditions (type and amount of information) of system call information according to the functions of the network services executed by each communication server 10, for example, the gateway function by the gateway server 10G, the relay function by the relay server 10R, and the user accommodation function by the user accommodation server 10U, and sets these conditions in each communication server 10 via the analysis server 20. Each communication server 10, the analysis server 20, and the maintenance server 30 will be described in detail below.

[0017] 1, each communication server 10 is set in the network system as, for example, a gateway server 10G, a relay server 10R, or a user accommodation server 10U, for each function that provides a network service. The functional configuration shared by each communication server 10 will be described below.

[0018] The communication server 10 is realized using hardware resources such as a CPU and a storage device. As shown in FIG. 2 , the communication server 10 includes a virtualization infrastructure layer 10V that provides OS functions and an application layer 10A that runs on the virtualization infrastructure layer 10V. The application layer 10A includes an application 11 that provides services using VNFs and the like, and a collection control unit 12 that controls a system call collection unit 15. The application 11 performs processing using hardware resources such as a CPU and memory by outputting processing for executing the service to a kernel 14 via a system call. The collection control unit 12 instructs the system call collection unit 15 to set up system call collection according to predetermined collection conditions (e.g., type and frequency of collection) notified by the maintenance server 30 via the analysis server 20. The collection control unit 12 also transmits the system calls collected by the system call collection unit 15 to the analysis server 20.

[0019] The virtualization infrastructure layer 10V has a kernel 14, which is a core function of the OS, and a system call collection unit 15 that collects system calls from the kernel 14. The kernel 14 allows the application 11 to run and manages processes based on system calls from the application 11. The system call collection unit 15 collects (copies) system calls that the kernel 14 receives from the application 11 (e.g., VNF) and outputs them to the collection control unit 12 in the application layer 10A. Note that when the OS is Linux (registered trademark), the system call collection unit 15 can be implemented in the kernel 14 using an extended Berkeley Packet Filter (eBPF).

[0020] Next, the network service functions of each communication server 10 (gateway server 10G, relay server 10R, user accommodation server 10U) will be described.

[0021] [Gateway Server] Figure 3 is a diagram illustrating the network service functions of the gateway server 10G, which is the communication server 10 according to this embodiment. As indicated by reference numeral 301 in Figure 3, the gateway server 10G has a function of receiving traffic from other networks (NWs) and distributing that traffic to the relay servers 10R and user accommodating servers 10U connected to itself (the gateway server 10G). Also, as indicated by reference numeral 302 in Figure 3, the gateway server 10G has a function of aggregating traffic from the relay servers 10R and user accommodating servers 10U connected to itself and transmitting it to other networks.

[0022] The gateway server 10G includes a gateway application 11G, which is software that realizes the gateway function as the application 11 of the communication server 10 shown in FIG. 2 , and a collection control unit 12. The gateway server 10G also includes a system call collection unit 15 in the kernel 14. The system call collection unit 15 collects (copies) system calls that the kernel 14 receives from the gateway application 11G, and outputs them to the collection control unit 12. The collection control unit 12 transmits the system calls collected by the system call collection unit 15 to a system call analysis unit 21 of the analysis server 20.

[0023] 3, the gateway application 11G transmits traffic received from another network to the destination relay server 10R or user accommodating server 10U connected to the gateway application 11G based on the result of data processing via the kernel 14. Also, as indicated by reference numeral 302 in FIG. 3, the gateway application 11G transmits traffic acquired from the relay server 10R or user accommodating server 10U connected to the gateway application 11G to another network based on the result of data processing via the kernel 14.

[0024] [Relay Server] Fig. 4 is a diagram illustrating the network service functions of the relay server 10R, which is the communication server 10 according to this embodiment. As shown in Fig. 4, the relay server 10R has functions to distribute and aggregate traffic between relay servers and intermediate servers, distribute and aggregate traffic between relay servers and user accommodating servers, and distribute and aggregate traffic between user accommodating servers.

[0025] The relay server 10R has a relay application 11R, which is software that realizes the function of transferring data as the application 11 of the communication server 10 shown in FIG. 2 , and a collection control unit 12. The relay server 10R also has a system call collection unit 15 in the kernel 14. The system call collection unit 15 collects (duplicates) system calls that the kernel 14 receives from the relay application 11R, and outputs them to the collection control unit 12. The collection control unit 12 transmits the system calls collected by the system call collection unit 15 to the system call analysis unit 21 of the analysis server 20.

[0026] As shown in Figure 4, this relay application 11R receives traffic from another relay server 10R or user accommodating server 10U and transmits the traffic to the destination relay server 10R or user accommodating server 10U connected to its own server based on the results of data processing via the kernel 14.

[0027] [User Accommodation Server] Figure 5 is a diagram illustrating the network service functions of the user accommodation server 10U, which is the communication server 10 according to this embodiment. As shown by the reference numeral 501 in Figure 5, the user accommodation server 10U has the function of receiving traffic from the relay server 10R or the user terminal 5 (5X) and distributing that traffic to the user terminals 5 (5A, 5B) connected to itself (the user accommodation server 10U). Also, as shown by the reference numeral 502 in Figure 3, the user accommodation server 10U has the function of aggregating traffic from the user terminals 5 (5A, 5B) connected to itself and transmitting it to the relay server 10R or the user terminal 5 (5X) connected to itself.

[0028] The user accommodating server 10 (10U) has a user accommodating application 11U, which is software that realizes the functions of the user accommodating server as the application 11 of the communication server 10 shown in FIG. 2, and a collection control unit 12. The user accommodating server 10U also has a system call collection unit 15 in the kernel 14. The system call collection unit 15 collects (duplicates) system calls that the kernel 14 receives from the user accommodating application 11U and outputs them to the collection control unit 12. The collection control unit 12 transmits the system calls collected by the system call collection unit 15 to a system call analysis unit 21 of the analysis server 20.

[0029] 5, the user accommodation application 11U transmits traffic received from the relay server 10R or the user terminal 5 (5X) to the user terminal 5 (5A, 5B) connected to the server itself based on the result of data processing via the kernel 14. Also, as indicated by reference numeral 502 in Fig. 5, the user accommodation application 11U transmits traffic acquired from the user terminal 5 (5A, 5B) connected to the server itself to the relay server 10R or the user terminal 5 (5X) based on the result of data processing via the kernel 14.

[0030] 2 , we will continue to explain the maintenance server 30 and the analysis server 20. <Maintenance Server> The maintenance server 30 includes a network maintenance unit 31 that manages each communication server 10 by monitoring for abnormal signs in a network system made up of multiple communication servers 10. This network maintenance unit 31 includes a topology storage unit 32 and a condition setting unit 33.

[0031] The topology storage unit 32 stores the topology of the network system formed by the communication servers 10. The topology is arrangement information indicating how the communication servers 10 are connected for communication, and is input in advance by, for example, an administrator. Furthermore, the arrangement information within the network based on this topology identifies which functions each communication server 10 will realize in the network service.

[0032] For example, if a communication server 10 is located at a gateway to another network, it is classified as a gateway server 10G. A communication server 10 located at a relay position within a network is classified as a relay server 10R. A communication server 10 that accommodates user terminals is classified as a user accommodating server 10U. In addition to topology information, information regarding the functional classification of each communication server 10 (gateway server, relay server, user accommodating server) may be obtained in advance by an administrator or the like.

[0033] In collecting and analyzing system call information, the condition setting unit 33 sets predetermined collection conditions suitable for the network service functions of each communication server 10 in the network system to each communication server 10. These predetermined collection conditions are set as conditions according to the network service functions (gateway, relay, user accommodation) of the communication server 10, such as the type and frequency of system call collection and the amount of collected data.

[0034] (Gateway Server System Call Collection Conditions) Due to the structure of the communication network, the gateway server 10G constantly processes a large amount of traffic, and therefore tends to have a high processing load. Therefore, the condition setting unit 33 sets the type of system call information to be collected to be information that requires a light collection processing load, such as traffic routing information and IP addresses (source IP address and destination IP address). Furthermore, the condition setting unit 33 sets the collection frequency of system call information to be lower than that of communication servers 10 with other functions. Setting conditions in this manner makes it possible to keep the information processing load to an appropriate level that does not affect the currently running network services. Note that the condition setting unit 33 may limit the distribution destination server or collection source server to a specific communication server 10 as a condition for collecting system call information. This further reduces the load on the gateway server 10G associated with collecting system call information.

[0035] (System Call Collection Conditions for Relay Server) Depending on the network topology, the relay server 10R may be expected to have a high processing traffic. Therefore, the condition setting unit 33 sets the type of system call information to be collected to be information with a low collection processing load, such as traffic routing information and IP addresses (source IP address and destination IP address), similar to the gateway server 10G. The condition setting unit 33 may also set the collection frequency of the system call information to be equal to or higher than that of the gateway server 10G. Setting the conditions in this manner makes it possible to reduce the information processing load to an appropriate level that does not affect the currently running network services. The condition setting unit 33 may also set the system call information collection condition to limit the distribution destination server or collection source server to a specific communication server 10, thereby collecting the system call information. This further reduces the load on the relay server 10R associated with collecting the system call information.

[0036] (System Call Collection Conditions for User Accommodating Servers) The user accommodating server 10U is generally expected to have a lower processing load than the gateway server 10G or the relay server 10R. Therefore, the condition setting unit 33 can collect not only information from the header portion of IP packets but also information from the data portion, which has a heavy collection processing load (large volume). The condition setting unit 33 may also set a higher collection frequency for system call information than the gateway server 10G or the relay server 10R. Because the user accommodating server 10U accommodates user terminals, acquiring information similar to the communication content of the user terminals enables accurate detection of abnormalities (faults) or abnormal symptoms in the user accommodating server 10U associated with the user terminal. The condition setting unit 33 may also collect system call information by limiting the destination communication server 10 or user terminal, or the source communication server 10 or user terminal, to a specific communication server 10 or user terminal. This further reduces the load on the user accommodating server 10U associated with collecting system call information.

[0037] After determining collection conditions suitable for the network service functions of each communication server 10 , the condition setting unit 33 transmits collection condition setting information including the determined collection conditions of each communication server 10 to the analysis server 20 .

[0038] <Analysis Server> The analysis server 20 acquires and analyzes system call information from each communication server 10 to detect abnormalities and signs of abnormalities (such as abnormal signs) in the communication servers 10. Furthermore, based on collection condition setting information acquired from the maintenance server 30, the analysis server 20 sets collection conditions suitable for network service functions in each communication server 10 (gateway server 10G, relay server 10R, user accommodation server 10U). The analysis server 20 has each communication server 10 set collection conditions for system call information, and also has a system call analysis unit 21 that collects and analyzes system call information. This system call analysis unit 21 has an abnormal sign detection unit 22 and a condition setting processing unit 23.

[0039] The abnormality sign detection unit 22 detects abnormalities or signs of abnormalities in the communication server 10 based on a predetermined analysis logic, for example, by detecting changes from normal times. When the abnormality sign detection unit 22 detects an abnormality sign or the like, it transmits an analysis result notification including identification information of the communication server 10 to the maintenance server 30.

[0040] The condition setting processing unit 23 sets collection conditions suitable for the network service functions for each communication server 10 based on the collection condition setting information acquired from the maintenance server 30. This allows each communication server 10 to collect system calls under collection conditions suitable for its own network service functions. That is, in the system call collection system 100 according to this embodiment, the collection and analysis of system call information by each communication server 10 can be kept to an appropriate information processing load that does not affect the running network service. Furthermore, collecting system call information suitable for the network service can improve the accuracy of detecting abnormal signs.

[0041] <Variation 1 of this Embodiment> Next, Variation 1 of the system call collection system 100 ( FIG. 2 ) according to this embodiment will be described. FIG. 6 is a diagram showing the overall configuration of a system call collection system 100A according to Variation 1 of this embodiment. Components having the same functions as those of the system call collection system 100 shown in FIG. 2 are given the same names and reference numerals, and descriptions thereof will be omitted. The system call collection system 100A ( FIG. 6 ) differs from the system call collection system 100 of FIG. 2 in that it does not include the analysis server 20, and each communication server 10 includes the functions of the system call analysis unit 21 (abnormal sign detection unit 22, condition setting processing unit 23) that the analysis server 20 had.

[0042] When the maintenance server 30 (condition setting unit 33) of the system call collection system 100A determines collection conditions suitable for the network service functions of each communication server 10, it transmits collection condition setting information including the determined collection conditions for each communication server 10 to each communication server 10. Then, the system call analysis unit 21 (condition setting processing unit 23) in the communication server 10 instructs the collection control unit 12 to set collection conditions for system calls in accordance with the collection conditions. In addition, the collection control unit 12 outputs the collected system call information to the system call analysis unit 21, thereby causing the abnormal sign detection unit 22 to perform abnormal sign detection processing.

[0043] In this way, the system call collection system 100A can set, for each communication server, the type and amount of information that is suitable for the network service being executed when collecting and analyzing system call information.

[0044] <Variation 2 of the Present Embodiment> Next, Variation 2 of the system call collection system 100 ( FIG. 2 ) according to the present embodiment will be described. FIG. 7 is a diagram showing the overall configuration of a system call collection system 100B according to Variation 2 of the present embodiment. Components having similar functions to those of the system call collection system 100 shown in FIG. 2 are given the same names and reference numerals, and descriptions thereof will be omitted. The system call collection system 100B ( FIG. 7 ) differs from the system call collection system 100 shown in FIG. 2 in that the application layer 10A of the communication server 10 includes a resource monitoring unit 13, and the maintenance server 30 includes a resource status storage unit 34 and a condition setting unit 33B. The condition setting unit 33B of the maintenance server 30 suspends or reduces collection of system call information for communication servers 10 with high loads according to the resource usage status (e.g., CPU usage rate) of each communication server 10. Meanwhile, the condition setting unit 33B changes the condition setting so that downstream servers in the traffic connected to the communication server 10 with high load share the suspended or reduced collection of system call information.

[0045] The resource monitoring unit 13 of the communication server 10 monitors the usage status (CPU usage rate, etc.) of its own server's resources (CPU, memory, etc.). The resource monitoring unit 13 then transmits the collected resource usage status to the maintenance server 30. The resource status storage unit 34 of the maintenance server 30 acquires and stores information on the resource usage status from each communication server 10.

[0046] When the resource usage status of each communication server 10 stored in the resource status storage unit 34 exceeds a predetermined threshold, the condition setting unit 33B changes the collection conditions so as to stop or reduce collection of system call information for that communication server 10. Furthermore, the condition setting unit 33B changes the collection conditions so as to increase collection of system call information for a communication server 10 that is connected to that communication server 10 and is downstream in traffic. In other words, the collection conditions are changed so that collection of system call information for a communication server 10 whose processing load has exceeded the predetermined threshold and is increasing is shared by a communication server located downstream of that communication server 10.

[0047] 8 is a diagram illustrating an example of changing the collection conditions of the system call collection system 100B according to Modification 2 of this embodiment. When the resource usage status of the gateway server 10G exceeds a predetermined threshold, the system call collection system 100B stops (or reduces) the collection of system call information by the gateway server 10G and changes the collection conditions so that the communication servers 10 (#02, 04) connected to the gateway server 10G and located downstream in the traffic share the collection of system call information.

[0048] In this way, the system call collection system 100B can suppress the information processing load to an appropriate level that does not affect the running network services, even if the processing load increases in some of the communication servers 10. Furthermore, by having the communication servers 10 that can handle the load share the collection of system call information appropriate for the network services, it is possible to prevent a decrease in the accuracy of detecting abnormal signs.

[0049] <Hardware Configuration> Figure 9 is a hardware configuration diagram of each device of the system call collection systems 100, 100A, and 100B according to this embodiment. Each device (communication server 10, analysis server 20, and maintenance server 30) of the system call collection systems 100, 100A, and 100B is configured as a computer 900 having a CPU 901, RAM 902, ROM 903, HDD 904, communication I / F 905, input / output I / F 906, and media I / F 907. The communication I / F 905 is connected to an external communication device 915. The input / output I / F 906 is connected to an input / output device 916. The media I / F 907 reads and writes data from a recording medium 917. Furthermore, the CPU 901 controls each unit by executing a program (system call collection program) loaded into the RAM 902. This program (also called an application, or simply "app") can be distributed via a communication line or recorded on a recording medium 917 such as a USB memory and distributed.

[0050] [Effect] The system call collection system of the present invention is a system call collection system 100 including each communication server 10 that constitutes a network system and a maintenance server 30 that monitors abnormal signs in the network system, and is characterized in that the maintenance server 30 has a condition setting unit 33 that sets predetermined collection conditions including the type and amount of system call information according to the network service functions of each communication server 10, and each communication server 10 has a system call collection unit 15 that collects system calls in accordance with the predetermined collection conditions according to the network functions of its own communication server 10.

[0051] In this way, the system call collection system 100 can set, for each communication server, the type and amount of information that is suitable for the network service being executed when collecting and analyzing system call information.

[0052] In addition, in the system call collection system 100, each communication server 10 of the network system is either a gateway server 10G having a gateway function that serves as an entrance and exit for data to and from other networks as a network service function, a relay server 10R having a relay function that relays data, or a user accommodating server 10U having a user accommodating function that accommodates user terminals, and the condition setting unit 33 of the communication server 10 is characterized in that it limits the system call collection conditions to system calls related to data obtained from a specific communication server 10 or a specific user terminal 5.

[0053] In this way, the system call collection system 100 can reduce the load imposed on the gateway server 10G, the relay server 10R, and the user accommodation server 10U in collecting system call information.

[0054] Furthermore, in the system call collection system 100 (100B), each communication server 10 further includes a resource monitoring unit 13 that monitors the usage status of its own resources, and when the resource usage status acquired from each communication server 10 exceeds a predetermined threshold, the condition setting unit 33B of the maintenance server 30 stops or reduces the collection of system calls from the communication server 10 that has exceeded the predetermined threshold, and increases the collection of system calls from the communication server 10 located downstream of the data sent by the communication server 10 that has exceeded the predetermined threshold.

[0055] In this way, the system call collection system 100 (100B) can suppress the information processing load to an appropriate level that does not affect the network services being executed, even if the processing load increases in some of the communication servers 10. Furthermore, by having communication servers 10 with sufficient load capacity share the collection of system call information appropriate for the network services, it is possible to prevent a decrease in the accuracy of detecting abnormal signs.

[0056] REFERENCE SIGNS LIST 10 Communication server 10G Gateway server 10R Relay server 10U User accommodation server 10A Application layer 10V Virtualization infrastructure layer 11 Application (application) 12 Collection control unit 13 Resource monitoring unit 14 Kernel 15 System call collection unit 20 Analysis server 21 Abnormal sign detection unit 22 Condition setting processing unit 30 Maintenance server 31 Network maintenance unit 32 Topology storage unit 33, 33B Condition setting unit 34 Resource status storage unit 100, 100A, 100B System call collection system

Claims

1. A system call collection system including communication servers that make up a network system and a maintenance server that monitors abnormal signs in the network system, wherein the maintenance server has a condition setting unit that sets predetermined collection conditions including the type and amount of system call information according to the network service functions of each of the communication servers, and each of the communication servers has a system call collection unit that collects the system calls according to the predetermined collection conditions according to the network functions of the communication server itself.

2. The system call collection system of claim 1, wherein each communication server of the network system is one of a gateway server having a gateway function that serves as an entrance and exit for data to and from other networks, a relay server having a relay function that relays data, and a user accommodation server having a user accommodation function that accommodates user terminals, as a function of the network service, and wherein the condition setting unit of the communication server limits the system call collection conditions to system calls related to data obtained from a specific communication server or a specific user terminal.

3. The system call collection system according to claim 1, wherein each of the communication servers further comprises a resource monitoring unit that monitors the usage status of its own resources, and when the resource usage status acquired from each of the communication servers exceeds a predetermined threshold, the condition setting unit of the maintenance server suspends or reduces the collection of system calls in the communication server that has exceeded the predetermined threshold, and increases the collection of system calls in the communication server located downstream of the data sent by the communication server that has exceeded the predetermined threshold.

4. A maintenance server that monitors abnormal signs of each communication server that constitutes a network system, characterized in that it has a condition setting unit that determines predetermined collection conditions, including the type and amount of system call information, according to the network service functions of each communication server, and sets the conditions for each communication server.

Images