JP2002252614A - Storage medium, network monitor, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To monitor the state of a network with the optimum number of items and timing according to the state. SOLUTION: A monitoring contents setting means 1a sets the target, frequency, and items to be monitored. A monitoring means 1b monitors the contents set by the means 1a. Monitoring contents change means 1c changes the contents set by the means 1a based on the results of monitoring by the means 1b and detection by the event detection means 1e. A resource change setting means 1d changes setting of the resources connected to a network 2 based on the result of monitoring by the means 1b. If an event occurs in the resources connected to the network 2, the means 1e detects this and informs the means 1c about it.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a recording medium, a network monitoring device, and a program, and more particularly, to a program for causing a computer to perform a process of monitoring a network state, and a computer-readable recording recording such a program. The present invention relates to a medium and a network monitoring device that performs such processing.

[0002]

2. Description of the Related Art In order to manage the operation of a network, first, a target network is monitored to grasp its state, and appropriate measures such as changing setting conditions according to the grasped state are taken. There is a need.

[0003] Conventionally, monitoring of a network has generally been performed according to a "policy" which is a predefined monitoring condition. By the way, in general, even when the state of the network changes, monitoring is performed with the policy unchanged.

When it becomes necessary to change the monitoring conditions, a network administrator (hereinafter, referred to as a network administrator) actively changes the policy manually according to a change in the state of the network. I needed to.

[0005]

However, as a method of notifying a network administrator of a change in the state of the network, for example, a threshold is set, and when a condition relating to a predetermined item changes, a warning is issued to the network administrator. The method of doing was adopted. Therefore, there is a problem that a time lag exists between when the network administrator notices a change in the state of the network and when a measure is taken.

[0006] Further, since the conditions for setting or changing the threshold are often left to the subjective judgment of the network administrator, there is a problem that the network management situation depends on the skills of the network administrator. Was.

The present invention has been made in view of the above situation, and has been made in consideration of a computer-readable program storing a program for causing a computer to perform a process of monitoring a network status while changing a policy according to a network status. It is an object of the present invention to provide a possible recording medium and a network monitoring device that executes such processing.

[0008]

According to the present invention, in order to solve the above-mentioned problems, a computer-readable recording medium in which a program for causing a computer to perform a process of monitoring a state of a network is provided. The monitoring content setting means 1a for setting the monitoring content, the monitoring means 1b for monitoring the network 2 with the monitoring content set by the monitoring content setting means 1a, and the monitoring content setting means 1a according to the monitoring result of the monitoring means 1b. Monitoring content changing means 1 for changing the monitoring content set by the
c) a computer-readable recording medium on which a program functioning as c) is recorded.

Here, the monitoring content setting means 1a sets monitoring content. The monitoring means 1b includes a monitoring content setting means 1a
The network 2 is monitored according to the monitoring contents set by. The monitoring content changing unit 1c changes the monitoring content set by the monitoring content setting unit 1a according to the monitoring result of the monitoring unit 1b.

[0010]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a principle diagram for explaining the operation principle of the present invention. In this figure, a network monitoring device 1 according to the present invention includes a monitoring content setting unit 1a, a monitoring unit 1b, a monitoring content changing unit 1c, and a resource change setting unit 1.
d and an event detecting means 1e for monitoring the status of each device connected to the network 2 or the status between the devices.

Here, the monitoring content setting means 1a sets the monitoring content when monitoring the network 2. The monitoring unit 1b monitors the network 2 based on the monitoring content set by the monitoring content setting unit 1a.

The monitoring content changing means 1c changes the monitoring content set by the monitoring content setting means 1a according to the monitoring result of the monitoring means 1b. The resource change setting means 1d
The setting of a predetermined resource on the network 2 is changed according to the monitoring result of the monitoring unit 1b.

The event detecting means 1e is connected to the network 2
Detecting that an event has occurred in the above predetermined resource, and in accordance with the detected event, monitoring content setting means 1
Change the setting of a.

The network 2 is constituted by, for example, the Internet. WEB client 3,
Reference numeral 5 includes, for example, a personal computer, accesses the WEB server 4, and acquires desired information.

The WEB server 4 is constituted by, for example, a server machine or the like.
If requested by, provide the requested information.

Next, the operation of the above principle diagram will be described. After setting data (policy) according to the monitoring content of the network 2 by the monitoring content setting means 1a, the network administrator performs an operation of starting monitoring. Then, the monitoring unit 1b refers to the policy set by the monitoring content setting unit 1a, first specifies the monitoring target, and then monitors the monitoring items related to the monitoring target at predetermined intervals.

For example, if the WEB server 4 is set as a monitoring target, and the response speed between the WEB server 4 and the WEB client 3 is set as a monitoring item, the monitoring unit 1b receives a request from the WEB client 3. The WEB server 4 transmits the data in response to the request, and measures the time (response time) until the WEB client 3 receives the data at a predetermined interval (for example, every 10 minutes).

The monitoring content changing means 1c refers to the monitoring result of the monitoring means 1b. For example, when the service level of the monitoring target is reduced, the analysis target is analyzed in order to analyze in detail the cause of the service level reduction. Web server 4 and WE
Not only the response time between the B client 3 but also the response time between the WEB server 4 and the WEB client 5 and the response time between the WEB server 4 and a router (not shown) are expanded, and the monitoring interval is increased. From 10 minutes to 5 minutes.
As a result, when the service level for the WEB server 4 is reduced, it is possible to collect materials for analyzing in detail the cause of the reduction.

When the service level has continued for a certain period or more, the resource change setting means 1d performs, for example, a setting for increasing the priority of packets from the WEB server 4 in the network 2. As a result, another W not shown
Since the packet from the WEB server 4 is given priority over the EB server, the service level can be recovered.

As described above, when the service level is restored, the monitoring content changing unit 1c reduces the monitoring target, increases the monitoring interval, and reduces the load on the network due to the monitoring. .

The above description is an example where the service level of the WEB server 4 gradually changes. However, a sudden change in the service level or a sudden change in other conditions (for example, the WEB server 4). 4 CPU (Central Processi
It is also possible to change the monitoring content, triggered by a sudden change in the usage rate of the ng Unit).

That is, the event detecting means 1e
When a predetermined event occurs in the WEB server 4 to be monitored, the setting content of the monitoring content setting unit 1a is changed according to the type of the event that has occurred, regardless of the interval of the monitoring unit 1b. For example, when the usage rate of a CPU (not shown) of the WEB server 4 suddenly increases or the service level suddenly decreases, the event detecting means 1e detects this regardless of the interval and sets the monitoring content. The monitoring content of the means 1a is changed. For example, the interval is shortened or the number of monitoring items is increased. As a result, even if a sudden situation occurs, the cause can be completely analyzed.

As described above, according to the network monitoring apparatus 1 of the present invention, the monitoring content is changed according to the monitoring result, so that the optimum monitoring according to the network status at that time is performed. It is possible to do.

Further, according to the present invention, when an event occurs, the monitoring content is changed according to the content, so that a sudden occurrence can be monitored without omission. .

Further, according to the present invention, since the resource setting state is changed according to the state of the network 2, it is possible to avoid, for example, a situation where the service level is low for a long time. Becomes possible.

Next, an embodiment of the present invention will be described. FIG. 2 is a diagram illustrating a configuration example of the embodiment of the present invention. In this figure, WEB client A (10) and WEB client B (11) (hereinafter simply WEB client)
The clients A and B are configured by, for example, a personal computer, and the WEB server A
(17) or WEB server B (18) (hereinafter simply referred to as W
EB servers A and B) to obtain desired data.

The network 12 is, for example, a LAN (Lo
Cal Area Network), and electrically connects the WEB clients A and B and the router A (13) (hereinafter simply referred to as router A) to each other, and enables information exchange between them. .

The router A connects the network 12 and the network 14 to each other, enables information to be exchanged between them, and determines on which path a packet should flow.

The network 14 is constituted by, for example, the Internet, and includes a router A and a router B.
(15) Information can be exchanged between (hereinafter simply referred to as router B).

The router B connects the network 14 and the network 16 to each other, enables information to be exchanged between them, and determines on which path the packet should flow.

The network 16 is constituted by, for example, a LAN, and electrically connects the web servers A and B and the network monitoring device 19 to each other, and enables information to be exchanged between them.

Each of the web servers A and B is constituted by, for example, a server machine.
WE that requested the corresponding information in response to the request from B
Send to B client.

The network monitoring device 19 monitors the status of the networks 12, 14, 16 and the resources connected to these networks. FIG. 3 is a diagram illustrating a detailed configuration example of hardware of the network monitoring device 19. As shown in this figure, the network monitoring device 19 includes a CPU (Central Processing Unit) 19
a, ROM (Read Only Memory) 19b, RAM (Rand
omAccess Memory) 19c, HDD (Hard Disk Drive)
19d, GB (Graphics Board) 19e, I / F (Inte
rface) 19f and a bus 19g, and a display device 19h and an input device 1
9i is connected.

Here, the CPU 19a controls each part of the apparatus according to a program stored in the HDD 19d, and executes various arithmetic processing. ROM 19b
Stores basic programs and data executed by the CPU 19a.

The RAM 19c temporarily stores a program to be executed by the CPU 19a and data being calculated. The HDD 19d stores programs and data executed by the CPU 19a.

The GB 19e executes a drawing process according to a drawing command supplied from the CPU 19a, converts the obtained image data into a video signal, and outputs it. I / F19f is
It converts the expression format of the data supplied from the input device 19i, and converts the expression format and protocol when exchanging data with the network 16.

The bus 19g includes a CPU 19a, a ROM 19
b, the RAM 19c, the HDD 19d, the GB 19e, and the I / F 19f are interconnected, and data can be exchanged among them.

The display device 19h is, for example, a CRT (Cath
ode Ray Tube) monitor, GB1
The video signal output from 9e is displayed. Input device 19
i is composed of, for example, a keyboard and a mouse,
Generate and output data according to the operation of the network administrator.

FIG. 4 is a diagram showing functional blocks of a monitoring function realized when the program recorded on the recording medium according to the present invention is installed and started in the HDD 19d shown in FIG. .

As shown in the figure, the monitoring function 20 includes a communication control unit 20a, a monitoring unit 20b, an event receiving unit 20c, a condition changing unit 20d, and a service level determining unit 2.
0e, database 20f, and condition transition management unit 2
0g.

The communication control unit 20a performs data format conversion and protocol conversion when exchanging information with another device via the network 16. The monitoring unit 20b is mainly configured by the CPU 19a, and monitors a monitoring target according to the monitoring conditions stored in the database 20f.

The event receiving section 20c is constituted by the I / F 19f, and receives an occurrence notification of an event which is generated asynchronously from a monitoring target. The condition changing unit 20d is mainly constituted by the CPU 19a, changes the monitoring condition based on the service level judgment result by the service level judging unit 20e, and also changes the resources on the networks 12, 14, 16 as necessary. Change settings.

The service level judging section 20e mainly outputs
The current SL grade is determined with reference to the monitoring result of the monitoring unit 20b, which is configured by the PU 19a, and the definition information of the service level grade (hereinafter, referred to as SL grade) stored in the database 20f. When an event is received by the event receiving unit 20c, the SL grade is determined with reference to the event.

The database 20f is constituted by the HDD 19d, and stores information for judging the SL grade. If necessary, the service level judging unit 20e
To supply.

The condition transition management unit 20g is constituted by the RAM 19c and centrally manages transition information of items to be monitored. In other words, the condition transition management unit 20g holds information indicating whether the monitoring of the monitoring target is being executed or suspended, and the current service level and other information.

Next, the operation of the above embodiment will be described. FIG. 5 is an example of a screen displayed on the display device 19h when the program recorded on the recording medium according to the present invention is activated. In this display example, a screen 50 entitled "Network Monitoring" is displayed, and a list of each monitoring target and its current SL grade and policy are displayed in a central area 50a of the screen 50. Buttons 50b to 50d operated when editing each policy are displayed on the right side of each monitoring item. Further, at the bottom of the screen 50, a button 50e operated when adding a monitoring target, a button 50f operated when deleting a monitoring target, and a button 50f operated when starting monitoring with set contents. Button 50g is displayed.

More specifically, “Web server A” is displayed as the first item in the area 50a, the current SL grade is “high”, and the policy is “Policy A”. It has been shown. In this example, the “SL grade” is the WEB server A
The SL grades for the reference items are shown. Here, the reference item refers to a basic item that is always monitored in the WEB server A.

In such a screen, the web server A
In order to change the Policy A, the user operates the button 50b. When the button 50b is operated, the condition changing unit 2
0d reads the specified policy from the database 20f and displays the screen 60 as shown in FIG.
To be displayed.

In this example, a screen 60 entitled "Policy A" is displayed, and a central area 60a is displayed.
Shows items (items 1 to 3) selected as monitoring items by this Policy A in a list format. For example, the first item is item 1 which is a response time between the web server A and the client A.
Is displayed. As the second and third items, item 2 which is the response time between the web server A and the router B, and item 3 which is the CPU usage rate of the web server A are displayed.

On the right side of each item, buttons 60b to 60d operated when setting the monitoring content of each item are displayed. Also, at the bottom of the screen 60, a button 60e operated when a new monitoring item is added, a button 60f operated when deleting an existing monitoring item,
Also, a button 60g operated when ending the setting with the input contents is displayed.

When the button 60b is operated to edit the item 1 on such a screen 60, the condition changing unit 20d acquires data on the corresponding item from the database 20f, and obtains the data on the screen 70 shown in FIG. Display device 1
9h.

In this display example, a screen 70 entitled "Edit Item 1" is displayed, and the area 70a displays the item 1
A list showing a monitoring result regarding (response time between WEB server A and WEB client A), an SL grade, and a monitoring condition is displayed. The buttons 70b and 70c or the slider 70d
By operating, any part including the non-display part can be referred to.

The button 70 displayed at the bottom is
e is operated when the default setting of item 1 is changed. The button 70f is operated when editing the settings displayed in the area 70a. The button 70g is
Operated when making settings with the input contents.

In this example, the conditions under which the SL grade is classified as “high” are that the WEB server A and the WEB client A
In this case, the response time is less than 5 seconds, in which case the monitoring conditions are doubled up to 30 minutes. Further, when the grade corresponds to the grade three times in a row and the items 2 and 3 shown in FIG. 6 are to be monitored, those items are excluded from the monitored items.
In addition, there is no particular change in the related resources in the case of the grade. Further, the event receiving unit 2
If an event is received by 0c, the SL grade is changed to "low".

The condition that the SL grade is classified as “standard” is when the response time between the WEB server A and the WEB client A is 5 seconds or more and less than 8 seconds. In this case, the monitoring condition is 30 seconds. It is extended by a factor of 1.5 up to a minute. Further, in the case where the grade falls five times in a row and the items 2 and 3 shown in FIG. 6 are to be monitored, these items are excluded from the monitoring items. In addition, there is no particular change in the related resources when the grade falls. Further, when an event is received by the event receiving unit 20c,
The SL grade is changed to "low".

In order to change the set contents, the user operates the button 70f, inputs new information, and
By operating the button 70g, the database 20
The content stored in f can be updated.

FIG. 8 is an example of a table corresponding to the setting contents of item 1 stored in the database 20f. In this example, data corresponding to the content set on the screen 70 shown in FIG. 7 is stored. In this example, the SL grades are classified into four types: “lowest”, “low”, “standard”, and “high”, and the respective ranges, monitoring conditions, and the like are defined.

The case where the response time between the WEB server A and the WEB client A is 8 seconds or more and less than 15 seconds is classified into the "low" SL grade not described in FIG. In the case of this SL grade "low", the monitoring interval is 1 / maximum of 3 minutes.
If the item is reduced twice and falls into the grade twice in succession, and items 2 and 3 are not set as monitoring items, these items are newly added as monitoring items. Further, the change of the related resource is not particularly set, and the SL grade is changed to “lowest” when an event occurs.

The case where the SL grade is "lowest" is classified when the response time between the WEB server A and the WEB client A is 15 seconds or more. If the SL grade corresponds to the “lowest”, the monitoring interval is reduced by a factor of two with a limit of one minute. In the case where the product falls under the grade, items 2 and 3
Are not set as monitoring items, these items are newly added as monitoring items. If the grade corresponds to three consecutive times, priority control is executed. Further, when an event occurs, priority control is similarly executed.

In FIG. 7, when the button 70e for performing the default setting is operated, the condition changing unit 20d reads the corresponding data from the database 20f and displays the screen 80 as shown in FIG. Apparatus 1
9h.

In this display example, a screen 80 entitled "Item 1 Default Setting" is displayed, and the monitoring condition of Item 1 when monitoring is started is displayed in the center of the screen 80. For example, the monitoring target is “response time between WEB server A and WEB client A”, the interval is “10 minutes”, the reference value is “measurement result value”, and the related event is "Event when response time exceeds a threshold of 18 seconds" is set. When changing the setting contents, the contents of the database 20f are updated by operating the button 80b after changing a predetermined item by operating the button 80b.

By changing the contents displayed on the screens 50 to 80 described above or adding new contents, the monitoring targets, monitoring items,
SL grade conditions and monitoring conditions can be set.

FIGS. 10 and 11 are diagrams showing the setting contents of item 2 and item 3 shown in FIG. 6, respectively. FIG. 10 is a diagram showing the setting contents of item 2. In this example, the SL grade of item 2 is "high", "standard",
And "low".

The reason why the SL grade corresponds to “high” is W
This is a case where the response time between the EB server A and the router B is less than the ideal value (for example, 100 milliseconds) +10 milliseconds. In that case, the monitoring interval for the item is doubled up to 30 minutes. You. In addition, if the grade corresponds to the grade three times in a row, the item is excluded from the check items. Further, if the grade falls, the related resource is not changed, and when an event occurs, the SL grade of the item is changed to “low”.

When the response time between the WEB server A and the router B is equal to or more than the ideal value + 10 ms and less than 50 ms, the SL grade of the item is classified as “standard”. In that case, the interval is extended by a factor of 1.5 up to 30 minutes. Also, if the grade corresponds to the grade five times in a row, the item is excluded from the check items. Further, if the grade falls, the related resource is not changed, and when an event occurs, the SL grade of the item is changed to “low”.

When the response time between the WEB server A and the router B is equal to or more than the ideal value + 50 milliseconds, the SL grade of the item is classified as "low". In that case, the interval is reduced by a factor of two with a limit of three minutes. In addition, if the grade corresponds to the grade twice consecutively and the item 3 is excluded from the check items, the item 3 is added as a check item. Further, when the grade is satisfied and when an event occurs, the priority of the packet is changed so that the packet from the WEB server A is preferentially distributed.

FIG. 11 is a diagram showing the setting contents of item 3. In this example, the SL grade of item 3 is “high”,
There are four types: "standard", "low", and "lowest". SL grade is classified as "high" because of WEB
This is a case where the CPU usage rate of the server A is less than 50%, and in that case, the interval is doubled up to 30 minutes. In addition, if the grade corresponds to the grade three times in a row, the item is excluded from the check items. Further, if the grade falls, the related resource is not changed, and when an event occurs, the SL grade of the item is changed to “low”.

When the CPU usage rate is 50% or more and 75% or more.
If less than, the SL grade of the item is classified as “standard”. In that case, the interval is 30
It will be extended 1.5 times in minutes. Also, if the grade corresponds to the grade five times in a row, the item is excluded from the check items. Further, if the grade falls, the related resource is not changed, and when an event occurs, the SL grade of the item is changed to “low”.

The CPU utilization is 75% or more and 95% or more.
If less than, the SL grade of the item is "low"
are categorized. In that case, the interval is reduced by a factor of two with a limit of three minutes. In addition, there is no particular setting for adding / deleting items and changing related resources. Further, when an event occurs, the SL grade for the item is changed to “lowest”.

When the CPU utilization is 95% or more, the SL grade of the item is classified as “lowest”. In that case, the interval is 1 /
It is reduced by a factor of two. In addition, there is no particular setting for adding / deleting items and changing related resources. Further, when an event occurs, a warning mail is sent to the administrator.

Next, an operation when the network monitoring device 19 monitors the WEB server A when the above settings are made will be described. If the button 50g on the screen 50 shown in FIG. 5 is operated after the setting relating to the monitoring item is performed by the operation as described above, the condition changing unit 20d responds to each item stored in the database 20f. And the monitoring condition of the monitoring unit 20b is updated.

The monitoring unit 20b first performs monitoring by referring to the default condition of Policy A, which is a reference item (always monitored item). That is, the monitoring unit 20b determines the time (response time) from when a request is issued from the WEB client A, when the WEB server A executes the corresponding process, and when the WEB client A receives the processing result, for example, the WEB server A
Measure at 10 minute intervals by software installed in At this time, if the response time exceeds 18 seconds, this is regarded as the occurrence of an event, and a corresponding process is executed.

The result of monitoring by the monitoring unit 20b is notified to the service level determination unit 20e. The service level determination unit 20e compares the response time of the WEB server A with the setting contents regarding the item 1 shown in FIG. 8, determines the SL grade for the item 1, notifies the condition transition management unit 20g, and notifies the condition transition management unit 20g of the SL grade. Change the monitoring conditions according to. For example, when the response time is 10 seconds, the SL grade is determined to be “low”, and the interval is reduced to 5 minutes which is １ ／ times the default value. Subsequently, when the monitoring result after 5 minutes is 13 seconds, the grade is determined to be “low” again, the interval is reduced to the minimum of 3 minutes, and the grade is continuously updated twice. Since the determination of “low” has been received, monitoring of item 2 (response time between the WEB server A and the router B) is newly performed at a default interval (for example, 10 minutes).

Subsequently, when the monitoring result of the item 1 after 3 minutes becomes 15 seconds, the SL grade is determined to be “lowest”, and the interval is set to 分 の of 1/3 minutes. At the same time, monitoring of item 3 (the CPU usage rate of the WEB server A) is started at a default interval (10 minutes).

Then, in the successive monitoring,
Monitoring result is SL grade "lowest" for 3 consecutive times
Is received or the response time exceeds the threshold of 18 seconds (when an event occurs), an instruction is given to the router B, which is a related resource, for priority control of traffic to the WEB server A. .

According to this instruction, the monitoring result after 3 minutes becomes 4 seconds, and when the judgment of the SL grade “high” is obtained, the interval is set to 6 minutes which is doubled. Thereafter, when the determination of the SL grade “high” is received twice consecutively, the interval is extended to 12 minutes and 24 minutes, and the monitoring items 2 and 3 that have been monitored are appropriately changed from the target. Will be excluded.

During this period, for the monitoring items 2 and 3, respective intervals, grade determination, and processing according to the determination result are executed in parallel according to the same logic as that of item 1. For this reason, the monitoring item derived as the SL grade determination result of item 1, which is the reference item, does not always end with the determination result of reference item 1. That is, even when the monitoring of the item 2 is started with the result of the item 1 as an opportunity, the monitoring is not necessarily ended with the determination result of the item 1 but may be ended with the determination of the item 2 itself. For example, item 2 starts monitoring at an interval of 10 minutes, and if the result is 130 milliseconds, the SL grade is "standard". If the interval is extended to 15 minutes and the determination of "standard" continues thereafter, After the interval has been extended to 22.5 minutes and 30 minutes, it is determined that item 2 does not need to be monitored in the fifth determination, and the monitoring is stopped.

The trigger for starting monitoring of a new item is not always caused by the monitoring result of the reference item. That is, the monitoring of the item 3 was started with the result of the item 1 as a trigger, but the monitoring may have started before that with the result of the item 2 as a trigger. For example, if item 2 starts monitoring at an interval of 10 minutes and the result is 150 milliseconds, the SL grade is “low”, the interval is shortened to 5 minutes, and thereafter, the judgment of “low” is made. Is repeated twice, the interval is reduced to the limit of 3 minutes, at which point monitoring of item 3 is started.

With the above processing, the data indicating the current state of the network is stored in the condition transition management unit 20g of the network monitoring device 19. In the area 50a of FIG. 5, the SL grade, which is the monitoring result of the above processing, is displayed. In this example, the SL grade of the WEB server A to be monitored is displayed as “high”. Here, this character "high" is a hypertext and a link is provided, and when this portion is clicked, a screen 90 shown in FIG. 12 is displayed on the display device 19h.

In this display example, a screen 90 entitled WEB server A is displayed, and a display area 90 of the screen 90 is displayed.
In a, data indicating the current status of the WEB server A to be monitored (monitoring result of item 1 as a reference item) is displayed. That is, the SL grade is “high”, the response time is “3.1 seconds”, the interval is “20 minutes”, and additional items, related resource changes, and occurrence of events are “none”. It is shown that there is.

When items 2 and 3 are added as additional items, they are displayed as hypertext in the “additional items” column of FIG. 12, and when clicked, the monitoring result of the corresponding item is displayed. Screen shown (same screen as in Fig. 12)
May be displayed.

As described above, according to the network monitoring apparatus of the present invention, the monitoring condition is dynamically tuned based on the SL grade monitoring result and the occurrence of an event. Is determined, and accordingly, the network can always be monitored under appropriate monitoring conditions. Therefore, when the SL grade is stable and monitoring is not always necessary, the monitoring interval is extended, the monitoring items are narrowed, and the increase in traffic and the load on the network due to monitoring are automatically minimized. It is possible to operate with a minimum.

Conversely, when the service level decreases, the monitoring interval is narrowed, and the items and ranges to be monitored are increased, so that monitoring data necessary for troubleshooting is automatically collected, and the service level is reduced. Related resources can be automatically set in order to improve the performance.

Next, with reference to FIGS. 13 to 16, a description will be given of a process executed in the network monitoring apparatus 19 according to the present invention, that is, a flowchart for realizing the functional blocks shown in FIG.

FIG. 13 is a flowchart executed when the network monitoring device 19 newly registers a monitoring item or edits a monitoring item that has already been registered. When this flowchart is started, the following steps are executed.

Step S10: The CPU 19a performs an operation of newly registering a monitoring target, that is, the button 5 in FIG.
When 0e is operated, when the button 60e is operated in FIG. 6, the process proceeds to step S11, otherwise, the process proceeds to step S13.

Step S11: The CPU 19a receives an input of a monitoring target and a monitoring item. Specifically, information on a new monitoring item input on screens 60 and 70 as shown in FIGS. 6 and 7 is input.

Step S12: The CPU 19a stores the information on the new monitoring item acquired in step S11 into H
Register with DD19d.

Step S13: The CPU 19a performs an operation of editing a registered monitoring item, that is, if any of the buttons 50b to 50d shown in FIG.
When the buttons 60b to 60d shown in FIG. 7 are operated, or when the button 70f shown in FIG.
Proceed to step S14, otherwise end the process.

Step S14: The CPU 19a sends the data corresponding to the monitoring target designated in step S13 to the HD
D19d.

Step S15: The CPU 19a receives editing of the data obtained in step S14. That is, CP
The U19a displays, for example, a screen 70 as shown in FIG. 7 on the display device 19h, and receives data editing.

Step S16: The CPU 19a registers the data edited in step S15 in the HDD 19d.

With the above processing, it is possible to set a new monitoring item and edit the set monitoring item. Next, a flowchart executed when monitoring the network will be described with reference to FIG. When this flowchart is started, the following steps are executed.

Step S30: The CPU 19a sets the HDD
From 19d, the default data of the reference item among the items to be monitored is acquired. For example, if the monitoring target is W
In the case of the EB server A, the default data of item 1 is obtained.

Step S31: The CPU 19a sets monitoring to a default state and starts monitoring of a monitoring target.

Step S32: The CPU 19a determines whether or not an event has occurred. If an event has occurred, the process proceeds to step S33; otherwise, the process proceeds to step S34.

Step S33: The CPU 19a executes a process of changing the SL grade in response to the occurrence of the event, ie, the "first grade".
SL grade change process ”. The details of this processing will be described later with reference to FIG.

Step S34: The CPU 19a sets the interval T corresponding to the current SL grade to the HDD 19d.
To get from.

Step S35: The CPU 19a determines whether or not the time T has elapsed since the previous monitoring. If the time T has elapsed, the process proceeds to the step S36, otherwise, the process returns to the step S32 and returns to the step S32. Is repeated.

Step S36: The CPU 19a executes a monitoring process for the set monitoring item. Step S37: The CPU 19a compares the monitoring result acquired in step S36 with the data stored in the HDD 19d, and determines the SL grade.

Step S38: If the result of the determination in step S37 is that the SL grade is the same (invariant) as the previous determination result, the CPU 19a proceeds to step S39, otherwise proceeds to step S42.

Step S39: The CPU 19a determines whether or not the determination of the same SL grade has been repeated a predetermined number of times indicated in the data stored in the HDD 19d. S4
0, otherwise return to step S32 and repeat the same process.

Step S40: The CPU 19a sets the HDD
With reference to the data stored in 19d, an item addition or deletion process corresponding to a case where a predetermined SL grade is repeated a plurality of times is executed.

Step S41: The CPU 19a sets the HDD
Referring to the data stored in 19d, a related resource change process corresponding to a case where a predetermined SL grade is repeated a plurality of times is executed.

Step S42: The CPU 19a executes a "second SL grade change process" to be executed when the SL grade has changed. The details of this process will be described later with reference to FIG.

Step S43: The CPU 19a determines whether or not the monitoring is to be terminated. If the monitoring is to be terminated, the process is terminated. Otherwise, the process returns to step S32 to repeat the same process as described above. .

With the above processing, it is possible to monitor a predetermined monitoring target and change the SL grade according to the monitoring result. The above flowchart shows an example of processing for a single monitoring target.
When a plurality of monitoring targets exist, similar processing is executed in parallel.

Next, with reference to FIG. 15, the details of the “first SL grade change process” of step S33 shown in FIG. 14 will be described. When this flowchart starts,
The following steps are performed.

Step S50: The CPU 19a stores in the RAM
The current SL grade of the reference item stored in 19c is acquired.

Step S51: The CPU 19a sets the HDD
From the policy stored in 19d, an SL grade that transitions when an event occurs is acquired.

Step S52: The CPU 19a transits to the SL grade acquired in step S51. Step S53: The CPU 19a refers to the policy stored in the HDD 19d, determines whether or not to change the related resources, and if so, proceeds to step S54,
Otherwise, the original processing (step S3 in FIG. 14)
Return to 4).

Step S54: The CPU 19a determines that the HDD 19
From 19d, data relating to the content of the change required when the related resource is changed is acquired.

Step S55: The CPU 19a changes the setting of the target resource according to the data obtained in step S54, and returns to the original processing.

According to the above flowchart, when an event occurs, it is possible to change the SL grade and the setting of the related resources. Next, the details of the “second SL grade change process” of step S42 shown in FIG. 14 will be described with reference to FIG. When this flowchart is started, the following steps are executed.

Step S70: The CPU 19a reads the RAM
The current SL grade of the reference item stored in 19c is acquired.

Step S71: The CPU 19a sets the HDD
SL which transits by referring to the data stored in 19d
Get grade.

Step S72: The CPU 19a executes a process for changing to the SL grade obtained in step S71.

Step S73: The CPU 19a changes the monitoring interval to a value corresponding to the SL grade acquired in step S71.

Step S74: The CPU 19a determines whether or not to change the related resource. If the related resource is changed, the process proceeds to step S75. Otherwise, the original process (step S43 in FIG. 14) is performed. Processing).

Step S75: The CPU 19a determines that the HDD 19
From 19d, data relating to the content of the change required when the related resource is changed is acquired.

Step S76: The CPU 19a changes the setting of the target resource in accordance with the data obtained in step S75, and returns to the original processing.

According to the above flowchart, when the SL grade changes, the interval and the related resources can be changed. In the above embodiment, a case has been described in which a web server is set as a monitoring target. However, the present invention is not limited to such a case. For example, a web server, a router, a network, A response or the like can be selected as a monitoring target.

Further, in the above embodiment, the case where the response time between the WEB server and the WEB client is the reference item has been described. However, it is also possible to select another item as the reference item. Needless to say, the present invention is not limited to this.

Finally, the above processing functions can be realized by a computer. In that case, the processing contents of the functions that the network monitoring device should have are described in a program recorded on a computer-readable recording medium, and the above processing is realized by the computer by executing this program on the computer. Is done.
Examples of the computer-readable recording medium include a magnetic recording device and a semiconductor memory. When distributing to the market, CD-ROM (Compact Disk Read Only Memory)
The program may be stored and distributed in a portable recording medium such as y) or a flexible disk, or stored in a storage device of a computer connected via a network, and transferred to another computer through the network. When executing the program on a computer, store the program in a hard disk device or the like in the computer,
Load into main memory and execute.

(Supplementary Note 1) In a computer-readable recording medium in which a program for causing a computer to perform a process of monitoring a state of a network is stored, a computer is connected to a monitoring content setting unit that sets monitoring content. A program recorded as a monitoring means for monitoring the network with the set monitoring content, and a monitoring content changing means for changing the monitoring content set by the monitoring content setting means according to the monitoring result of the monitoring means is recorded. Computer readable recording medium.

(Supplementary Note 2) The recording medium according to Supplementary Note 1, wherein the monitoring content is a monitoring frequency. (Supplementary note 3) The recording medium according to supplementary note 1, wherein the monitoring content is a monitoring target.

(Supplementary Note 4) The recording medium according to Supplementary Note 1, wherein the monitoring content is a monitoring item. (Supplementary note 5) The recording medium according to Supplementary note 1, wherein the monitoring content changing unit increases the frequency of monitoring and expands monitoring targets and monitoring items when the service level of the network is reduced.

(Supplementary note 6) The recording according to Supplementary note 1, wherein the monitoring content changing unit decreases the frequency of monitoring and reduces monitoring targets and monitoring items when the service level of the network is improved. Medium.

(Supplementary note 7) The recording medium according to supplementary note 1, further comprising a program that functions as a resource setting change unit that changes a setting of a predetermined resource on a network in accordance with a monitoring result of the monitoring unit.

(Supplementary Note 8) A program for functioning as an event detecting means for detecting occurrence of an event in a predetermined resource on the network is further recorded, and the monitoring content changing means detects that an event has occurred by the event detecting means. 2. The recording medium according to claim 1, wherein the monitoring content is changed when detected.

(Supplementary Note 9) In a network monitoring apparatus for monitoring a network state, a monitoring content setting means for setting monitoring content, a monitoring means for monitoring a network based on the monitoring content set by the monitoring content setting means, A network monitoring apparatus comprising: a monitoring content changing unit configured to change monitoring content set by the monitoring content setting unit in accordance with a monitoring result of the monitoring unit.

(Supplementary Note 10) In a network monitoring method for monitoring the status of a network, a monitoring content setting step for setting monitoring content, a monitoring step for monitoring a network based on the monitoring content set by the monitoring content setting step, A monitoring content changing step of changing the monitoring content set in the monitoring content setting step in accordance with the monitoring result of the monitoring step.

(Supplementary Note 11) In a program for causing a computer to execute a process of monitoring the state of a network, a computer is configured to execute monitoring content setting means for setting monitoring content, A program functioning as monitoring means for monitoring, and monitoring content changing means for changing the monitoring content set by the monitoring content setting means according to the monitoring result of the monitoring means.

[0134]

As described above, according to the present invention, a computer-readable recording medium storing a program for causing a computer to execute a process of monitoring the state of a network allows a computer to set a monitoring content setting means for setting a monitoring content. Monitoring means for monitoring a network with the monitoring content set by the monitoring content setting means, monitoring content changing means for changing the monitoring content set by the monitoring content setting means in accordance with the monitoring result of the monitoring means, , The monitoring can be performed at an optimal timing and the number of items according to the state of the network.

[Brief description of the drawings]

FIG. 1 is a principle diagram for explaining the operation principle of the present invention.

FIG. 2 is a diagram illustrating a configuration example of an embodiment of the present invention.

FIG. 3 is a diagram illustrating a detailed configuration example of the network monitoring device illustrated in FIG. 2;

4 is a diagram showing functional blocks realized when a program recorded on a recording medium according to the present invention is installed in the HDD shown in FIG. 3 and executed.

FIG. 5 is an example of a screen displayed on a display device when a program according to the present invention is activated.

FIG. 6 is an example of a screen displayed on a display device when a button 50b shown in FIG. 5 is operated.

FIG. 7 is an example of a screen displayed on the display device when a button 60b shown in FIG. 5 is operated.

FIG. 8 is an example of a table corresponding to setting contents of an item 1 stored in a database.

FIG. 9 is an example of a screen displayed on the display device when a button 70e shown in FIG. 7 is operated.

FIG. 10 is an example of a table corresponding to setting contents of item 2 stored in a database.

FIG. 11 is an example of a table corresponding to setting contents of an item 3 stored in a database.

FIG. 12 is an example of a screen displayed on the display device when a button 50g shown in FIG. 5 is operated.

FIG. 13 is a flowchart executed when the network monitoring device newly registers a monitoring item or edits a monitoring item that has already been registered.

FIG. 14 is a flowchart executed when monitoring a network.

FIG. 15 is a flowchart showing “first SL” in step S33 shown in FIG.
It is a flowchart for explaining the details of "grade change processing".

FIG. 16 shows “second SL” in step S42 shown in FIG.
It is a flowchart for explaining the details of "grade change processing".

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Network monitoring apparatus 1a Monitoring content setting means 1b Monitoring means 1c Monitoring content changing means 1d Resource change setting means 1e Event detecting means 2 Network 3 WEB client 4 WEB server 5 WEB client 10 WEB client A 11 WEB client B 12, 14, 16 Network 13 Router A 15 Router B 17 Web server A 18 Web server B 19 Network monitoring device 19a CPU 19b ROM 19c RAM 19d HDD 19e GB 19f I / F 19g Bus 19h Display device 19i Input device

 ──────────────────────────────────────────────────続 き Continued on the front page F term (reference) 5B089 GB02 KA03 MC01 5K030 GA11 HB19 HC01 HC14 HD03 HD06 JA10 LC13 MA01

Claims (6)

[Claims] 1. A computer-readable recording medium having recorded thereon a program for causing a computer to execute a process of monitoring a state of a network, wherein the computer is set by monitoring content setting means for setting monitoring content. A monitoring means for monitoring a network based on the monitored content; a monitoring content changing means for changing the monitoring content set by the monitoring content setting means in accordance with a monitoring result of the monitoring means; Possible recording medium. 2. The recording medium according to claim 1, wherein the monitoring content changing unit increases the frequency of monitoring and expands monitoring targets and monitoring items when a service level of the network decreases. . 3. The recording medium according to claim 1, further comprising a program that functions as a resource setting change unit that changes a setting of a predetermined resource on a network according to a monitoring result of the monitoring unit. 4. A program for functioning as an event detecting means for detecting occurrence of an event in a predetermined resource on a network, wherein the monitoring content changing means detects the occurrence of the event by the event detecting means. 2. The recording medium according to claim 1, wherein the monitoring content is changed in accordance with the content when the content is monitored. 5. A network monitoring apparatus for monitoring a state of a network, comprising: monitoring content setting means for setting monitoring content; monitoring means for monitoring a network based on monitoring content set by the monitoring content setting means; A monitoring content changing unit configured to change the monitoring content set by the monitoring content setting unit in accordance with a monitoring result of the unit. 6. A program for causing a computer to perform a process of monitoring a state of a network, the computer comprising: a monitoring content setting unit configured to set monitoring content; and a network monitored by the monitoring content set by the monitoring content setting unit. A program functioning as monitoring means, monitoring content changing means for changing the monitoring content set by the monitoring content setting means in accordance with the monitoring result of the monitoring means.