Maintenance server and transition method of system call collection function

Abstract

In a communication network (100), first communication software is set in a first communication server, and a first system call collection function is set in an OS of the first communication server. The maintenance server (5) includes a network maintenance unit (501) for setting, in a backup server, the same first communication software as the first communication software set in the first communication server, and setting, in an OS of the backup server, the same first system call collection function as the first system call collection function set in the first communication server, when expanding the first communication server in which the first communication software is operating.

Description

How to migrate the maintenance server and system call collection function

[0001] The present invention relates to a maintenance server that manages the system call collection function of each server in a communication network system, and a method for migrating the system call collection function.

[0002] In network systems such as 5GC (5th Generation Core network), various functions within the network are defined as NFs (Network Functions), and a wide variety of communication services can be provided by combining NFs. Virtualized NFs (VNFs), which realize NFs as virtual machines or containers using virtualization technology, have also been proposed.

[0003] In order to operate a network system normally and stably, it is necessary to detect signs of abnormalities or failures in the servers that make up the network system. To achieve this, attention is focused on system calls issued by a VNF (virtual machine / container) to the kernel of the system's OS (operating system), and system calls related to processes linked to applications are extracted to detect signs of abnormalities or failures related to the behavior of the VNF. Examples of such detection technologies are as follows: Patent Literature 1 describes the use of statistical information on the issuance of system calls by the host OS; and Non-Patent Literature 1 describes an EDR (Endpoint Detection and Response) product that detects signs of abnormalities by monitoring statistical information on system calls.

[0004] Meanwhile, with the virtualization of communication networks (NFV: Network Function Virtualization), scaling technologies have been developed to add more servers when traffic suddenly increases due to disasters, etc., and healing technologies have been developed to move virtual machines and containers to healthy servers in response to failures and cyber attacks (Non-Patent Document 2).

[0005] JP 2011-258019 A

[0006] Falco, "The Falco Project," [online], [Retrieved June 27, 2024], Internet <URL: https: / / falco.org / docs / > Oto Yoko and three others, "Application of Virtualization Technology in Communication Networks," NTT DOCOMO Technical Journal, Vol. 24 No. 1, 2026, pp. 6-11.

[0007] As shown in Non-Patent Document 2, virtualization technology is applied to the servers that make up a communication network, making it possible to automatically and easily add more servers to cope with sudden increases in traffic and migrate communication software (virtual machines or containers) to healthy servers to cope with failures, cyber attacks, etc. However, Non-Patent Document 2 does not consider migrating the system call collection function to additional servers or other existing servers, which poses a problem in that the system call collection function of the source server cannot be appropriately added to the destination server.

[0008] Therefore, an object of the present invention is to appropriately add a system call collection function in a source server to an OS of a destination server in conjunction with maintenance (addition, migration) of communication software (virtual machines or containers).

[0009] The maintenance server of the present invention is a maintenance server that is connected to each communication server that constitutes a communication network and that performs maintenance of communication software including virtual machines of each of the virtualized communication servers, wherein first communication software, which is the communication software on which a specific application runs, is set in a first communication server that is one of the communication servers, and a first system call collection function that collects system calls is set in the OS of the first communication server, and when an expansion is made to the first communication server on which the first communication software is running, the maintenance server is characterized in that it has a network maintenance unit that sets in a spare server the first communication software that is identical to the first communication software that is set in the first communication server, and sets in the OS of the spare server the first system call collection function that is identical to the first system call collection function that is set in the first communication server.

[0010] According to the present invention, in conjunction with maintenance (addition, migration) of communication software (virtual machines or containers), the system call collection function of the source server can be appropriately added to the OS of the destination server, thereby enabling the destination server to detect abnormal symptoms and improve the accuracy of abnormality detection based on system call information.

[0011] FIG. 1 is a diagram showing the overall configuration of a system call collection system including a maintenance server according to the present embodiment. FIG. 2 is a functional block diagram showing the configuration of the maintenance server according to the present embodiment. FIG. 3 is a diagram explaining the flow of adding a system call collection function by the maintenance server according to the present embodiment when a communication server is added. FIG. 4 is a flowchart showing the process of confirming migration possibility by the maintenance server according to the present embodiment when a communication server is added. FIG. 5 is a diagram explaining the flow of migration of the system call collection function by the maintenance server according to the present embodiment when a virtual machine is migrated. FIG. 6 is a flowchart showing the process of confirming migration possibility by the maintenance server according to the present embodiment when a virtual machine is migrated. FIG. 7 is a flowchart showing a modified example of the process of confirming migration possibility by the maintenance server according to the present embodiment when a virtual machine is migrated. FIG. 8 is a diagram explaining the process of setting (updating) the system call collection function by the maintenance server according to the present embodiment when a virtual machine is removed. FIG. 9 is a hardware configuration diagram showing an example of a computer that realizes the functions of the maintenance server in this embodiment.

[0012] <Overview> First, an overview of the processing performed by a system call collection system 1000 including a maintenance server 5 in this embodiment will be described. Fig. 1 is a diagram showing the overall configuration of a system call collection system 1000 including a maintenance server 5 according to this embodiment. As shown in Fig. 1, the system call collection system 1000 includes a plurality of communication servers 1 constituting a communication network 100, and a maintenance server 5 that is communicatively connected to each communication server 1 via a maintenance network 500 and performs maintenance and management of each communication server 1. Here, it is assumed that the communication servers 1 include operating communication servers 1-1 and 1-3 and a standby server 1-2 within the communication network 100.

[0013] The communication server 1 (communication servers 1-1, 1-3, and spare server 1-2) are all configured as virtualized systems and operate on a communication network. This communication server 1 is configured with a shared resource 20 consisting of an OS and hardware layer, and communication software (virtual machines 10 and containers) set in the application layer. In the following description of this embodiment, the virtual machines 10 are set in the application layer, but this is not limiting. Furthermore, applications for providing communication services are set in the virtual machines 10 and containers.

[0014] The communication server 1 includes an OS, a CPU, memory, an auxiliary storage device, etc. in the OS / hardware layer, and a virtual machine 10 in the application layer. The OS also includes a kernel (not shown), which is the core function of the OS. The kernel allows application execution and manages processes based on system calls (denoted as "SC" in each figure) from applications (virtual machines 10). A system call collection function (SC collection function) is set in the kernel by the maintenance server 5. The system call collection function collects system calls received by the kernel from applications (virtual machines 10) under specified conditions and outputs the collected system calls to the maintenance server 5.

[0015] As shown in FIG. 1 , the communication server 1-1 (first communication server) has a "system call collection function (SC collection function) a" (first system call collection function) in the kernel of the OS of the shared resource 20, and has a "virtual machine A" (first communication software) as a virtual machine 10 in the application layer. The first communication software is communication software (virtual machine, container, etc.) on which a specific application runs. The backup server 1-2 does not have a virtual machine 10, and does not have any "system call collection functions" in the kernel of the OS of the shared resource 20. The communication server 1-3 (second communication server) has a "system call collection function (SC collection function) b" (second system call collection function) in the kernel of the OS of the shared resource 20, and has a "virtual machine B" (second communication software) as a virtual machine 10 in the application layer. The second communication software is communication software (virtual machine, container, etc.) on which an application other than the specific application runs.

[0016] The maintenance server 5 is a server that manages the maintenance and operation of the communication network 100. This maintenance server 5 includes a network maintenance unit 501 and a system call analysis unit 502. The network maintenance unit 501 performs tasks such as setting and moving virtual machines, setting system call collection conditions, and setting and moving system call collection functions to servers. The system call analysis unit 502 collects and analyzes system calls. The virtual machines 10 set up on the communication server 1 can run on any communication server 1 (and spare servers) thanks to the functions of the maintenance server 5 (network maintenance unit 501), and can be moved between servers with a simple operation.

[0017] When the maintenance server 5 monitors each communication server 1 and performs maintenance on the communication network 100, there are cases where a server is added and cases where a virtual machine is migrated.

[0018] [Adding a Server] For example, if the service processing of the communication server 1-1 on which virtual machine A shown in FIG. 1 is running begins to strain the processing capacity of that server, virtual machine A can be replicated and operated on, for example, a spare server 1-2. This allows the service processing of virtual machine A to be load-balanced across the two servers, allowing the servers to operate safely. This server addition can also be used to rescue the communication service provided by virtual machine A in the event of an abnormality in the communication server 1-1.

[0019] 1, if the communication server 1-1 on which virtual machine A is running cannot continue operation due to an abnormality, in addition to the countermeasure of adding a server, the communication service of virtual machine A can be continued by migrating virtual machine A to communication server 1-3 on which another virtual machine B is running. This virtual machine migration can also be used as a means to avoid pressure on processing capacity.

[0020] The maintenance server 5 according to this embodiment performs an operation to appropriately add the system call collection function set in the source server to the OS of the destination server in response to the addition of a server or migration of a virtual machine as described above.

[0021] 1, when virtual machine A is running and the service processing of communication server 1-1, which has system call collection function a in its OS kernel, puts a strain on the processing capacity of that server, a spare server 1-2 is added (symbol a in FIG. 1), virtual machine A is set up, and system call collection function a is set up in the OS. Also, when communication server 1-1, which has virtual machine A running and has system call collection function a in its OS kernel, cannot continue operation due to an abnormality, virtual machine A is moved to communication server 1-3, where virtual machine B is running, and system call collection function a is added to the OS (symbol b in FIG. 1: migration).

[0022] In this way, the maintenance server 5 can appropriately add the system call collection function of the source server to the OS of the destination server in accordance with the maintenance (addition, migration) of the communication software (virtual machine or container). The functions of the maintenance server 5 etc. will be described in detail below.

[0023] 2 is a functional block diagram showing the configuration of the maintenance server 5 according to this embodiment. As shown in FIG. 2, the maintenance server 5 includes a control unit 50, an input / output unit 51, and a storage unit 52.

[0024] The input / output unit 51 is composed of an input / output I / F (Interface), a communication I / F, etc. The input / output unit 51 transmits and receives information to and from a management device (not shown) for the entire system call collection system 1000, each communication server 1, etc.

[0025] The storage unit 52 is composed of a ROM (Read Only Memory), a RAM, an HDD (Hard Disk Drive), etc. Information about each communication server 1 included in the communication network 100 is stored in this storage unit 52 as a server database 520. For each communication server 1 in the communication network 100, the server database 520 stores "server data" that is information about the server, "virtual machine data" that is information about the virtual machines 10 installed on the server, and "system call collection function data" that is information about the system call collection function set in the kernel of the OS of the server.

[0026] The "server data" stores identification information for each communication server 1 and the version, capacity, etc. of each shared resource (OS, CPU, memory, auxiliary storage device). The "virtual machine data" stores identification information for each virtual machine stored in the communication server 1 and the version, capacity, etc. of the shared resources (OS, CPU, memory, auxiliary storage device, etc.) on which the virtual machine is installed. The "system call collection function data" stores the identification number of the system call collection function set in the OS of the communication server 1 and the capacity, etc. of the resources (CPU, memory, auxiliary storage device, etc.) that the OS can use.

[0027] The control unit 50 controls the entire maintenance server 5 , and includes a network maintenance unit 501 , a system call analysis unit 502 , a virtual machine management unit 503 , and a system call collection function management unit 504 .

[0028] The network maintenance unit 501 monitors each communication server 1, and when an event such as a sudden increase in traffic, a failure (breakdown), or a server attack occurs, the network maintenance unit 501 determines the necessary processing, such as adding a communication server 1 or migrating a virtual machine. If the network maintenance unit 501 determines that adding a communication server 1 is necessary, the network maintenance unit 501 references the server data in the server database 520 to select a spare server. Next, the network maintenance unit 501 references the virtual machine data in the server database 520 to determine whether a virtual machine can be migrated to set the source communication server 1 as an additional spare server. The network maintenance unit 501 determines whether a virtual machine can be migrated based on the version and capacity of shared resources (OS, CPU, memory, auxiliary storage device, etc.). If the network maintenance unit 501 determines that a virtual machine can be migrated, the network maintenance unit 501 references the system call collection function data in the server database 520 to determine whether a system call collection function can be migrated based on the version of the OS library and the capacity of resources available to the OS (CPU, memory, auxiliary storage device, etc.).

[0029] Furthermore, when the network maintenance unit 501 determines that migration of the virtual machine 10 is necessary when an event occurs, it references the server data in the server database 520 to select a destination server. Next, the network maintenance unit 501 references the virtual machine data in the server database 520 to determine whether the virtual machine on the source communication server 1 can be migrated to the destination communication server 1 (migration feasibility). To determine whether migration of the virtual machine is possible, the network maintenance unit 501 determines whether migration is possible based on the version and capacity of shared resources (OS, CPU, memory, auxiliary storage device, etc.). Then, when it determines that migration of the virtual machine is possible, the network maintenance unit 501 references the system call collection function data in the server database 520 to determine whether migration of the system call collection function is possible based on the version of the OS library and the capacity of resources available to the OS (CPU, memory, auxiliary storage device, etc.). Furthermore, the network maintenance unit 501 determines migration feasibility by taking into account conflicts with virtual machines on the destination communication server 1 and conflicts with system call collection functions already set up at the destination (details will be described later).

[0030] The network maintenance unit 501 then determines the system call collection conditions to be set for each communication server 1, and sets them in the system call collection function provided in each communication server 1 via the system call analysis unit 502. The system call collection conditions include, for example, the type of system call to be collected (functions, etc.) and the frequency of collection processing. Furthermore, the network maintenance unit 501 determines signs of a communication server 1 failure or an application abnormality based on the system call information collected and analyzed by the system call analysis unit 502.

[0031] The system call analysis unit 502 sets collection conditions for each target communication server 1 based on the setting information for the system call information collection conditions set by the network maintenance unit 501. The system call collection conditions include the type of system call and the collection frequency. The type of system call is specified as a function (API) such as open, read, write, close, wait, fork, or kill. The system call analysis unit 502 also collects system call information from a system call collection function set in the kernel of each communication server 1 and, based on a predetermined analysis logic, detects signs of a failure or abnormality in the communication server 1, for example, by detecting changes from normal times. The system call analysis unit 502 then outputs the detection results to the network maintenance unit 501.

[0032] When the network maintenance unit 501 determines whether a virtual machine can be migrated and determines that it can be migrated, the virtual machine management unit 503 actually performs the process of migrating and configuring the virtual machine from the source communication server to the destination communication server or spare server.

[0033] The system call collection function management unit 504 performs a process to migrate the system call collection function provided in the OS of the source communication server 1 to the OS of the destination communication server 1, for example, when the network maintenance unit 501 determines whether the virtual machine can be migrated and determines that it can be migrated.

[0034] In addition, if the network maintenance unit 501 determines that there is a conflict between the system call collection function set in the OS of the communication server 1 from which the migration is taking place and the system call collection function set in the OS of the communication server 1 to which the migration is taking place, the system call collection function management unit 504 reconfigures the system call collection function, for example, by comparing them on a function-by-function basis that are set as collection conditions.

[0035] Specifically, when the system call information collected by system call collection function a configured in the OS of the communication server 1 at the migration source is configured by the function (f1+f2), and the system call information collected by system call collection function b configured in the OS of the communication server 1 at the migration destination is configured by the function (f2+f3), the system call collection function management unit 504 can configure the system call collection function at the migration destination using the following patterns: (Pattern 1) Set (install) the function (f1+f2) configured as system call collection function a and the function (f2+f3) configured as system call collection function b as separate collection conditions. (Pattern 2) Considering the duplication of function (f2), reconfigure the function (f1+f2+f3) configured as a new system call collection function c (third system call collection function) and set (install) it as a collection condition.

[0036] The system call collection function management unit 504 allows the selection of the above two patterns. By doing so, the maintenance server 5 can suppress an increase in resource consumption when adopting the function c (f1+f2+f3), which is a new system call collection function, in terms of the capacity of resources (CPU, memory, auxiliary storage device, etc.) dedicated to the OS.

[0037] In addition, when the system call collection function management unit 504 is reconfiguring (installing) the OS of the communication server 1 with the function (f1+f2+f3), which is the system call collection function c shared by virtual machine A and virtual machine B, as the collection condition, and deleting the function (f1+f2) set in virtual machine A, the following patterns can be selected.

[0038] (Pattern 3) The function (f1+f2+f3) configured as system call collection function c (third system call collection function) is used as the collection condition as is. (Pattern 4) System call collection function c is changed to the function (f2+f3) which is system call collection function b.

[0039] The system call collection function management unit 504 allows the user to select between the two patterns described above. By doing so, the maintenance server 5 can reduce the amount of resources (CPU, memory, auxiliary storage device, etc.) used exclusively for the OS when returning to the function (f2+f3) that is the system call collection function b before sharing.

[0040] In this embodiment, the maintenance server 5 configured in one housing is described as having a network maintenance unit 501, a system call analysis unit 502, a virtual machine management unit 503, and a system call collection function management unit 504, but each functional unit may also be provided in a server in a separate housing and made to function.

[0041] <Processing of System Call Collection System> Next, a description will be given of the flow of processing in the system call collection system including the maintenance server 5 according to this embodiment. First, a description will be given of processing performed in the system call collection system 1000 when a server is added.

[0042] 3 and 4 are diagrams illustrating the flow of adding a system call collection function by the maintenance server 5 according to this embodiment when adding a communication server 1. As shown in Fig. 3, at the time when operation starts (time t), a virtual machine A is configured on the communication server 1-1, and a system call collection function a is configured in the OS of the shared resource (reference symbol x11). Furthermore, it is assumed that no virtual machines are configured on the spare server 1-2, and the system call collection function is not configured in the OS (reference symbol y11).

[0043] Next, suppose that the system call analysis unit 502 of the maintenance server 5 detects an event such as a sudden increase in traffic on the communication server 1-1, a server failure, or a cyber attack (event occurrence: symbol α). The system call analysis unit 502 outputs the detected information to the network maintenance unit 501. Based on the content of this event, the network maintenance unit 501 determines the processing content, such as server addition, virtual machine migration, or virtual machine removal (step S1 in FIG. 4 , which will be described later). In this case, the network maintenance unit 501 of the maintenance server 5 selects the server addition processing and executes a migration feasibility confirmation process, including the selection of the backup server 1-2 as the migration destination (step S10).

[0044] The migration possibility confirmation process in step S10 will be described with reference to Fig. 4. First, the network maintenance unit 501 of the maintenance server 5 selects the process to be taken from adding a communication server 1, migrating a virtual machine, or reducing a virtual machine in response to a detected event (such as a sudden increase in traffic, a server failure, or a cyber-attack) (step S1). Here, it is assumed that the network maintenance unit 501 selects adding a server (flow 1) as a countermeasure to a sudden increase in traffic, for example.

[0045] Next, the network maintenance unit 501 selects a spare server to be added (step S101). The network maintenance unit 501 refers to the server data 521 in the server database 520 and selects spare server 1-2 (see FIG. 1) from among the spare servers that do not have virtual machines configured.

[0046] Next, the network maintenance unit 501 determines whether the source virtual machine can be migrated (step S102). Specifically, for the source communication server 1 (here, communication server 1-1), the network maintenance unit 501 checks the specifications of the virtual machine stored in the shared resources of the communication server 1-1 by referencing the virtual machine data 522 in the server database 520. For example, the network maintenance unit 501 checks the versions and capacities of the shared resources for virtual machine A of the communication server 1-1, such as the OS, CPU, memory, and auxiliary storage device. The network maintenance unit 501 then determines whether there are any problems with setting up virtual machine A on the spare server 1-2 selected in step S101 with these versions and capacities. Here, if migration of the virtual machine (virtual machine A) is not possible (step S102 → not possible), the process returns to step S101 and another spare server is selected. On the other hand, if migration is possible (step S102 → possible), the process proceeds to the next step S103.

[0047] In step S103, the network maintenance unit 501 determines whether the system call collection function of the migration source can be migrated. Specifically, for the migration source communication server 1 (here, communication server 1-1), the network maintenance unit 501 checks the specifications of the service collection function set in the OS of the communication server 1-1 by referring to the system call collection function data 523 in the server database 520. For example, the network maintenance unit 501 checks the version of the OS library for the system call collection function a set in the OS of the communication server 1-1, the capacity of resources (CPU, memory, auxiliary storage device, etc.) available to the OS, etc. Then, it determines whether there are any problems with setting up the system call collection function a in the backup server 1-2 selected in step S101 with this version, capacity, etc.

[0048] If the migration of the system call collection function (system call collection function a) is not possible (step S103 → not possible), the process returns to step S101 and another spare server is selected. On the other hand, if the migration is possible (step S103 → possible), the process proceeds to step S11 in FIG.

[0049] Returning to FIG. 3, in step S11, the network maintenance unit 501 decides to add the system call collection function a to the backup server 1-2.

[0050] Next, in step S12, the network maintenance unit 501 executes a replication process for virtual machine A, sets up virtual machine A on spare server 1-2 via the virtual machine management unit 503, and sets up system call collection function a in the OS of spare server 1-2 via the system call collection function management unit 504 (symbol y12).

[0051] Next, the network maintenance unit 501 checks whether the virtual machine A and the system call collection function a set up on the backup server 1-2 are operating normally (step S13).Then, the network maintenance unit 501 performs connection processing to the communication network 100 so that the backup server 1-2 can send and receive data for actual operation (step S14).

[0052] In addition, as the processing of virtual machine A is distributed between the two servers, communication server 1-1 and spare server 1-2, the network maintenance unit 501 changes the collection conditions for system call information of system call collection function a of communication server 1-1 via the system call analysis unit 502 (step S15).Then, the network maintenance unit 501 determines the system call collection conditions to be set for spare server 1-2 and sets them for system call collection function a of spare server 1-2 via the system call analysis unit 502 (step S16).

[0053] By doing this, the maintenance server 5 can appropriately add the same virtual machine A and system call collection function a as those of the migration source to the backup server 1-2 that has been added by expansion.

[0054] 5 and 6 are diagrams illustrating the flow of migration of the system call collection function when migrating a virtual machine by the maintenance server 5 according to this embodiment. As shown in Fig. 5, at the time when operation starts (time t), a virtual machine A is set in the communication server 1-1, and a system call collection function a is set in the OS of the shared resource (symbol x11). Also, a virtual machine B is set in the communication server 1-3, and a system call collection function b is set in the OS of the shared resource (symbol z11).

[0055] Next, suppose that the system call analysis unit 502 of the maintenance server 5 detects that the communication server 1-1 cannot continue operating due to a server abnormality or the like (event occurrence: symbol α). The system call analysis unit 502 outputs the detected details to the network maintenance unit 501. Based on the details of the event, the network maintenance unit 501 determines the processing details, such as server addition, virtual machine migration, or virtual machine removal (step S1 in FIG. 4). Then, the network maintenance unit 501 of the maintenance server 5 selects the virtual machine migration processing (flow 2) and executes a migration possibility confirmation process, including the selection of the communication server 1 as the migration destination (step S20).

[0056] The migration possibility confirmation process in step S20 will be described with reference to Fig. 6. First, the network maintenance unit 501 selects the communication server 1 (migration destination server) to which the virtual machine is to be migrated (step S201). The network maintenance unit 501 refers to the server data 521 in the server database 520 and selects the communication server 1-3 (see Fig. 1) from among the communication servers 1 currently in operation.

[0057] Next, the network maintenance unit 501 determines whether the source virtual machine can be migrated (step S202). Specifically, for the source communication server 1 (here, communication server 1-1), the network maintenance unit 501 checks the specifications of the virtual machine stored in the shared resources of the communication server 1-1 by referencing the virtual machine data 522 in the server database 520. For example, the network maintenance unit 501 checks the version and capacity of the OS, CPU, memory, auxiliary storage device, and other shared resources for virtual machine A of the communication server 1-1. The network maintenance unit 501 then determines whether there are any problems with setting up virtual machine A on the communication server 1-3 selected in step S201 with these versions and capacities. Here, if migration of the virtual machine (virtual machine A) is not possible (step S202 → not possible), the process returns to step S201, and another communication server 1 is selected. On the other hand, if migration is possible (step S202 → possible), the process proceeds to the next step S203.

[0058] In step S203, the network maintenance unit 501 determines whether the system call collection function of the migration source can be migrated. Specifically, for the communication server 1 (here, communication server 1-1) that is the migration source, the network maintenance unit 501 checks the specifications of the service collection function stored in the OS of the communication server 1-1 by referencing the system call collection function data 523 in the server database 520. For example, the network maintenance unit 501 checks the version of the OS library for the system call collection function a stored in the OS of the communication server 1-1 and the capacity of resources (CPU, memory, auxiliary storage device, etc.) available to the OS. The network maintenance unit 501 also checks whether there will be any conflict with an existing virtual machine (virtual machine B) configured in the communication server 1-3 that is the migration destination, and whether there will be any conflict with the existing system call collection function b. Then, the network maintenance unit 501 determines whether there will be any problem if the communication server 1-3 selected in step S201 is configured with this version and capacity, and whether there will be any conflict with the existing virtual machine or system call collection function.

[0059] If the transfer of the system call collection function (system call collection function a) is not possible (step S203 → not possible), the process returns to step S201 and another communication server is selected. On the other hand, if the transfer is possible (step S203 → possible), the process proceeds to step S21 in FIG. 5.

[0060] Returning to FIG. 5, in step S21, the network maintenance unit 501 determines to add a virtual machine A and a system call collection function a to the communication server 1-3.

[0061] Next, in step S22, the network maintenance unit 501 executes a replication process for virtual machine A, migrates virtual machine A to communication server 1-3 via the virtual machine management unit 503, and sets system call collection function a in the OS of communication server 1-3 via the system call collection function management unit 504 (symbol z12).

[0062] Next, the network maintenance unit 501 checks whether the virtual machines A and B and the system call collection functions a and b set in the communication server 1-3 are operating normally (step S23). The network maintenance unit 501 then disconnects the communication server 1-1 from the communication network 100 (step S24). The network maintenance unit 501 also performs a process to connect the communication server 1-3 to the communication network 100 so that data for actual operation can be sent and received (step S25). The network maintenance unit 501 then sets (inherits) the same collection conditions as those for the system call collection function a set in the OS of the communication server 1-1 to the system call collection function a stored in the OS of the communication server 1-3 via the system call analysis unit 502 (step S26).

[0063] By doing this, when the maintenance server 5 migrates a virtual machine on a communication server (communication server 1-1) that can no longer continue operating due to a server abnormality or the like, the maintenance server 5 can also inherit the system call collection function and migrate it to the destination communication server (communication server 1-3).

[0064] <Variation of the process for confirming virtual machine migration feasibility> Next, a variation of the process for confirming virtual machine migration feasibility shown in step S20 of Fig. 5 and steps S201 to S203 of Fig. 6 will be described. Fig. 7 is a diagram showing a variation of the process for confirming virtual machine migration feasibility by the maintenance server 5 according to this embodiment. In the process for confirming virtual machine migration feasibility shown in Fig. 7, steps S201 and S202 are the same as the process shown in Fig. 6, so they are given the same reference numerals and their description will be omitted. In step S203A, the network maintenance unit 501 of the maintenance server 5 determines whether or not the system call collection function of the migration source can be migrated.

[0065] Here, the network maintenance unit 501 checks the specifications of the system call collection function a stored in the OS of the communication server 1 (here, communication server 1-1) that will be the source of migration by referencing the system call collection function data 523 in the server database 520. For example, the network maintenance unit 501 checks the version of the OS library for the system call collection function a stored in the OS of the communication server 1-1, the capacity of resources (CPU, memory, auxiliary storage device, etc.) that the OS can use, etc. Furthermore, it checks whether there will be any conflict with an existing virtual machine (virtual machine B) set up in the communication server 1-3 that will be the destination of migration, and whether there will be any conflict with the existing system call collection function b.

[0066] When checking for conflicts between these system call collection functions, the network maintenance unit 501 checks for the occurrence of conflicts by comparing system call collection functions on a function-by-function basis via the system call collection function management unit 504. For example, if the system call information collected by the system call collection function a configured in the OS of the source communication server 1-1 is configured by the function (f1+f2), and the system call information collected by the system call collection function b configured in the OS of the destination communication server 1-3 is configured by the function (f2+f3), the system call collection function management unit 504 can set the following patterns. (Pattern 1) The function (f1+f2) configured as the system call collection function a and the function (f2+f3) configured as the system call collection function b are set (installed) as separate collection conditions. (Pattern 2) Taking into account the duplication of the function (f2), the function (f1+f2+f3) configured as a new system call collection function c is reconfigured and set (installed) as a collection condition. Note that it is preset whether (Pattern 1) or (Pattern 2) will be adopted.

[0067] Then, the network maintenance unit 501 determines whether it is possible to set up the system call collection function a on the communication server 1-3 selected in step S201 with this version and capacity, and whether there will be any conflict with existing virtual machines or system call collection functions.If it is not possible to migrate the system call collection function a (step S203A → Not possible), the process returns to step S201 and another communication server is selected.

[0068] On the other hand, if migration is possible (step S203A → possible) and (Pattern 1) is set, the network maintenance unit 501 determines in step S21 ( FIG. 5 ) to add virtual machine A and system call collection function a to the communication server 1-3. Also, if (Pattern 2) is set, the network maintenance unit 501 instructs the system call collection function management unit 504 to reconfigure the system call collection function (step S204). Then, the system call collection function management unit 504 generates a new system call collection function c in which the function to be collected as system call information is the function (f1 + f2 + f3) (step S205). Next, the process returns to step S21 in FIG. 5 , where it is determined to add (change) virtual machine A and system call collection function c to the communication server 1-3.

[0069] By doing this, the maintenance server 5 can collect system call information based on the function (f1+f2+f3) as a new system call collection function c, thereby reducing the increase in resource consumption compared to when functions (f1+f2) and (f2+f3) are collected separately.

[0070] 8 is a diagram illustrating the process of setting (updating) the system call collection function when a virtual machine is removed by the maintenance server 5 according to this embodiment. Here, it is assumed that virtual machines A and B are set up in the communication server 1-3, and that a system call collection function c that collects the function (f1+f2+f3) as system call information is set up in the OS of the shared resource. It is also assumed that a request to delete virtual machine A is received from a management device (not shown) of the system call collection system 1000 or the like.

[0071] First, the network maintenance unit 501 checks the status of the communication server 1 in which the virtual machine A to be deleted is set (step 301). Specifically, the network maintenance unit 501 checks, by referring to the server database 520, that, for example, virtual machine A and virtual machine B are set in the communication server 1-3 from which virtual machine A is to be deleted. Here, the network maintenance unit 501 checks that virtual machine A is to be deleted and that virtual machine B will continue to be set. The network maintenance unit 501 also checks the server database 520 to check that the system call collection function c is set as the system call collection function of the communication server in question.

[0072] Furthermore, when the function (f1+f2+f3) configured as system call collection function c shared by virtual machine A and virtual machine B is installed as a collection condition in the OS of the communication server 1, the network maintenance unit 501 confirms that the following patterns are selectable when deleting the function (f1+f2) set in virtual machine A: (Pattern 3) The function (f1+f2+f3) configured as system call collection function c is used as the collection condition as is. (Pattern 4) The system call collection function c is changed to the function (f2+f3) which is system call collection function b.

[0073] Next, the network maintenance unit 501 selects a system call collection function (step S302). Specifically, the network maintenance unit 501 checks the capacity of resources (CPU, memory, auxiliary storage device, etc.) available to the OS by referring to the server database 520, and selects whether to use the function (f1+f2+f3) configured as system call collection function c as is (pattern 3) or to change system call collection function c to the function (f2+f3) configured as system call collection function b (pattern 4). Note that this selection may be preset, or (pattern 3) (pattern 4) may be selected based on whether there is a surplus in the current capacity of the resources used by the OS.

[0074] If the network maintenance unit 501 selects (Pattern 3), it decides to continue using the system call collection function c (step S303). On the other hand, if the network maintenance unit 501 selects (Pattern 4), it decides to delete the system call collection function c and add the system call collection function b (step S304).

[0075] In this way, the maintenance server 5 can select whether to continue using the system call collecting function c or to change to the system call collecting function b in response to the deletion of the virtual machine A. If the system call collecting function is changed to the system call collecting function b, the amount of resources used can be reduced.

[0076] <Hardware Configuration> The maintenance server 5 according to this embodiment is realized, for example, by a computer 900 configured as shown in Fig. 9. Fig. 9 is a hardware configuration diagram showing an example of the computer 900 that realizes the functions of the maintenance server 5 according to this embodiment. The computer 900 has a CPU 901, a ROM (Read Only Memory) 902, a RAM 903, an HDD (Hard Disk Drive) 904, an input / output I / F (Interface) 905, a communication I / F 906, and a media I / F 907.

[0077] The CPU 901 operates based on a program stored in the ROM 902 or the HDD 904, and is controlled by the computer (the control unit 50 of the maintenance server 5). The ROM 902 stores a boot program executed by the CPU 901 when the computer 900 is started up, programs related to the hardware of the computer 900, and the like.

[0078] The CPU 901 controls an input device 910 such as a mouse or keyboard, and an output device 911 such as a display or printer, via an input / output I / F 905. The CPU 901 acquires data from the input device 910 via the input / output I / F 905, and outputs generated data to the output device 911. Note that a GPU (Graphics Processing Unit) or the like may be used as a processor together with the CPU 901.

[0079] The HDD 904 stores programs executed by the CPU 901 and data used by the programs. The communication I / F 906 receives data from other devices via a communication network (e.g., NW (Network) 920) and outputs the data to the CPU 901, and also transmits data generated by the CPU 901 to other devices via the communication network.

[0080] The media I / F 907 reads a program or data stored in the recording medium 912 and outputs it to the CPU 901 via the RAM 903. The CPU 901 loads a program related to a target process from the recording medium 912 onto the RAM 903 via the media I / F 907, and executes the loaded program. The recording medium 912 is an optical recording medium such as a DVD (Digital Versatile Disc) or a PD (Phase Change Rewritable Disc), a magneto-optical recording medium such as an MO (Magneto Optical Disc), a magnetic recording medium, a semiconductor memory, or the like.

[0081] For example, when the computer 900 functions as the maintenance server 5 of the present invention, the CPU 901 of the computer 900 executes a program loaded onto the RAM 903 to realize the functions of the computer (maintenance server 5). In addition, the HDD 904 stores data in the RAM 903. The CPU 901 reads and executes a program related to a target process from the recording medium 912. Alternatively, the CPU 901 may read a program related to a target process from another device via a communication network (NW 920).

[0082] <Effects> The following describes the effects of the maintenance server 5 and the like according to the present invention. The maintenance server 5 according to the present invention is connected to each communication server 1 constituting a communication network 100 and performs maintenance of communication software including the virtual machines 10 of each virtualized communication server 1, and is characterized in that first communication software (virtual machine A) that is communication software on which a specific application runs is configured in a first communication server (communication server 1-1) that is one of the communication servers 1, and a first system call collection function (system call collection function a) that collects system calls is configured in the OS of the first communication server, and when an expansion is performed on the first communication server on which the first communication software is running, the maintenance server 5 includes a network maintenance unit 501 that configures a spare server with the same first communication software as the first communication software configured in the first communication server and configures the spare server with the same first system call collection function as the first system call collection function configured in the first communication server.

[0083] In this way, the maintenance server 5 can appropriately add the same first communications software (virtual machine A) and first system call collection function (system call collection function a) as the source communications server 1-1 to the backup server 1-2 that has been added through expansion. Therefore, the destination server (backup server 1-2) can also detect abnormal symptoms and improve the accuracy of abnormality detection based on the system call information.

[0084] In addition, in a second communication server (communication server 1-3) other than the first communication server (communication server 1-1), which is one of the communication servers, second communication software (virtual machine B) on which an application other than a specific application runs is set, and a second system call collection function (system call collection function b) that collects system calls is set in the OS of the second communication server, and when the network maintenance unit 501 stops the first communication server (communication server 1-1) on which the first communication software (virtual machine A) is running, it migrates the first communication software set in the first communication server to the second communication server and migrates the first system call collection function (system call collection function a) to the OS of the second communication server.

[0085] In this way, when the maintenance server 5 migrates the first communication software (virtual machine A) from the first communication server (communication server 1-1) that has become unable to continue operation due to a server abnormality or the like, the maintenance server 5 can also inherit the first system call collection function (system call collection function a) and migrate it to the destination communication server (communication server 1-3). Therefore, the destination server (communication server 1-3) can also detect abnormal symptoms and improve the accuracy of abnormality detection based on the system call information.

[0086] In addition, the maintenance server 5 further includes a system call collection function management unit 504 that, when there is an overlap between the information on the system call function that is the collection condition of the first system call collection function (system call collection function a) and the information on the system call function that is the collection condition of the second system call collection function (system call collection function b), generates a third system call collection function (system call collection function c) that sets collection conditions using the system call function that eliminates the overlap, and is characterized in that the network maintenance unit 501 sets the third system call collection function in the OS of the second communication server when migrating the first communication software (virtual machine A) set in the first communication server (communication server 1-1) to the second communication server (communication server 1-3).

[0087] In this way, the maintenance server 5 can collect system call information using a third system call collection function (system call collection function c) under collection conditions that eliminate overlapping functions, thereby reducing resource consumption compared to when overlapping functions are used.

[0088] The present invention is not limited to the above-described embodiments, and many modifications can be made by a person having ordinary skill in the art within the technical concept of the present invention.

[0089] 5 Maintenance server 10 Virtual machine 20 Common resource 50 Control unit 51 Input / output unit 52 Storage unit 100 Communication network 501 Network maintenance unit 502 System call analysis unit 503 Virtual machine management unit 504 System call collection function management unit 500 Maintenance network 1000 System call collection system

Claims

1. A maintenance server that is connected to each communication server that constitutes a communication network and that performs maintenance on communication software including virtual machines of each of the virtualized communication servers, wherein a first communication software that is the communication software on which a specific application runs is set in a first communication server that is one of the communication servers, and a first system call collection function that collects system calls is set in the OS of the first communication server, and when an expansion is made to the first communication server on which the first communication software is running, the maintenance server is equipped with a network maintenance unit that sets in a spare server the first communication software that is the same as the first communication software that is set in the first communication server, and sets in the OS of the spare server the first system call collection function that is the same as the first system call collection function that is set in the first communication server.

2. A maintenance server as described in claim 1, characterized in that in a second communication server other than the first communication server, which is one of the communication servers, second communication software is set up on which an application other than the specific application runs, and a second system call collection function for collecting system calls is set up in the OS of the second communication server, and when the first communication server on which the first communication software runs is stopped, the network maintenance department migrates the first communication software set up in the first communication server to the second communication server and migrates the first system call collection function to the OS of the second communication server.

3. The maintenance server according to claim 2, further comprising a system call collection function management unit that, when there is an overlap between the information on the system call function that is the collection condition of the first system call collection function and the information on the system call function that is the collection condition of the second system call collection function, generates a third system call collection function that sets collection conditions using system call functions that eliminate the overlap, and the network maintenance unit sets the third system call collection function in the OS of the second communication server when transferring the first communication software set in the first communication server to the second communication server.

4. A method for migrating a system call collection function by a maintenance server that is connected to each communication server that constitutes a communication network and that maintains communication software including virtual machines of each of the virtualized communication servers, wherein first communication software, which is the communication software on which a specific application runs, is configured in a first communication server that is one of the communication servers, and a first system call collection function that collects system calls is configured in the OS of the first communication server, and when expanding the first communication server on which the first communication software is running, the maintenance server executes the following steps: when expanding the first communication server on which the first communication software is running, configure a spare server with the same first communication software as the first communication software configured in the first communication server; and when expanding the OS of the spare server with the same first system call collection function as the first system call collection function configured in the first communication server.

Images