JP3672192B6 - Monitoring device, monitoring method, recording medium, and program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a monitoring device, a monitoring method, a recording medium, and a program for managing the status of a user's network system in a remote place, and particularly enables easy installation of equipment and providing a safe service at low cost. It is.
[0002]
[Prior art]
Conventionally, in a company, other organizations, etc., a network in which computers installed in a relatively narrow area such as an office or a building can exchange data, and each computer can share peripheral devices such as printers The system is widely used.
[0003]
On the other hand, the maintenance method becomes an important issue with the spread of such network systems, but since this requires specialized knowledge and technology, it is generally entrusted to specialized service operators. Has been made. In this case, the network system and the service center server are connected by a dedicated line, and the status of the network system is constantly monitored by the service center.
[0004]
[Problems to be solved by the invention]
However, in the above conventional example, since it is necessary to newly introduce a dedicated line to the existing network system, there is a risk of breaking the security policy of the network system, and a considerable amount of time is required for arranging the dedicated line. It took time and effort.
[0005]
In general, a network monitoring system consists of two types of subsystems, a “monitoring agent” that collects data and a “monitoring manager” that aggregates and processes the data. It is possible to monitor with. For this reason, it seems that it is possible to monitor multiple users with a single monitoring manager using the conventional monitoring software in the service operating body as described above, but in reality this causes serious problems. Such a configuration cannot be taken.
[0006]
This is because conventional monitoring software assumes that the monitoring range is a network of one user. In other words, only the device-specific ID (IP address) is used as a key to specify the device to be monitored (PC, router, etc.), and in the monitoring manager used in the conventional monitoring software, the monitored device belongs to which user's network I can't specify what it is. In particular, in the address system in the currently used protocol IPV4 (Internet Protocol Version 4), a private address is generally used in each user's company, and when a monitoring manager monitors a plurality of users, the IP address is IP. A fatal problem arises that address duplication occurs.
[0007]
In addition, when the address system or MAC address in IPV6 (Internet Protocol Versino 6) is used, the above-mentioned problems caused by duplication of device IDs are solved. However, to which user belongs to the monitoring manager? Cannot be specified.
[0008]
For this reason, in the above conventional example, a monitoring manager must be installed on the outsourcer side whenever the number of networks to be monitored increases (N: N type monitoring), which requires a great deal of cost to construct a network monitoring system. In addition, it is impossible to perform unified management for a plurality of users.
[0009]
The present invention has been made in view of the above problems, and enables monitoring using at least a device ID, which is an ID of a monitoring target device, and a user ID for identifying a user as a key. The purpose is to realize a central monitoring (N: 1 type monitoring) of a user's environment by one monitoring manager, and also to monitor the monitoring device itself by the monitoring manager.
[0010]
[Means for Solving the Problems]
In order to achieve such an object, the monitoring device according to claim 1 is acquired by a state information acquisition unit that acquires state information of one or a plurality of monitored devices that are communicably connected, and the state information acquisition unit. Generating an electronic mail including status information, device identification information for identifying a monitored device corresponding to the status information, and group identification information for identifying a group including the one or more monitored devices, E-mail generation and transmission means for transmitting to the information management apparatus that manages the operating status of the monitored apparatus based on the status information, the device identification information, and the group identification information, and performs predetermined encryption on the e-mail The electronic mail generation and transmission means transmits a plurality of types of electronic mail, and at least the status information of the monitored device is transmitted. An e-mail for notifying the information management device and an e-mail for notifying the information management device of the operating status of the device itself are transmitted to the information management device, and the status information of the monitored device is managed by the information management device. An e-mail for notifying a communication device of a predetermined destination other than the device is transmitted in a format different from the e-mail transmitted to the information management device, and the e-mail transmitted to the information management device includes A predetermined encryption is performed by the encryption means, and an e-mail transmitted to the communication device of a predetermined destination connected to the intranet is transmitted without being encrypted.
[0011]
The monitoring method according to claim 2 is a monitoring method of a monitored device by a monitoring device, the status information acquisition step of acquiring status information of one or a plurality of monitored devices connected to be communicable, Including status information acquired by the status information acquisition step, device identification information for identifying a monitored device corresponding to the status information, and group identification information for identifying a group of the one or more monitored devices An e-mail generating and transmitting step of generating an e-mail and transmitting the e-mail to an information management apparatus that manages an operating state of the monitored apparatus based on the status information, the device identification information, and the group identification information; And an e-mail generation and transmission step for transmitting a plurality of types of e-mails. And sending at least an e-mail for notifying the information management apparatus of the status information of the monitored apparatus and an e-mail for notifying the information management apparatus of the operating state of the own apparatus to the information management apparatus, An e-mail for notifying the status information of the monitored apparatus to a communication device of a predetermined destination other than the information management apparatus is transmitted in a format different from the e-mail transmitted to the information management apparatus. The e-mail to be transmitted to the information management device is subjected to predetermined encryption in the encryption step, and the e-mail to be transmitted to the communication device at a predetermined destination connected to the intranet is transmitted without being encrypted. It is a step.
[0012]
The recording medium according to claim 3 is a recording medium that records a program to be executed by a computer of a monitoring device that monitors the monitored device, and the state of one or a plurality of monitored devices that are communicably connected A status information acquisition procedure for acquiring information, status information acquired by the status information acquisition procedure, device identification information for identifying a monitored device corresponding to the status information, and the one or more monitored devices For an information management apparatus that generates an electronic mail including group identification information for identifying a group and manages an operating state of the monitored apparatus based on the state information, the device identification information, and the group identification information An e-mail generation and transmission procedure to be transmitted, and an encryption procedure for performing predetermined encryption on the e-mail, and the e-mail generation and transmission procedure includes a plurality of types. For sending at least the status information of the monitored device to the information management device and the email for notifying the information management device of the operating status of the device itself Is sent to the information management device, and an email for notifying the status information of the monitored device to a communication device of a predetermined destination other than the information management device is an email sent to the information management device The e-mail to be transmitted in a different format is subjected to predetermined encryption by the encryption procedure for the e-mail to be transmitted to the information management apparatus, and the e-mail to be transmitted to the communication apparatus at a predetermined destination connected to the intranet Is a computer-readable recording medium that records a program for causing a computer to execute a procedure for transmission without encryption. That.
[0013]
The program according to claim 4 is a program to be executed by a computer of a monitoring device that monitors the monitored device, and status information for acquiring status information of one or more monitored devices that are communicably connected For identifying an acquisition procedure, status information acquired by the status information acquisition procedure, device identification information for identifying a monitored device corresponding to the status information, and a group of the one or more monitored devices E-mail generation and transmission that generates an e-mail including group identification information and transmits the e-mail to an information management apparatus that manages the operating state of the monitored apparatus based on the state information, the device identification information, and the group identification information And an encryption procedure for performing predetermined encryption on the e-mail, and the e-mail generation and transmission procedure includes a plurality of types of e-mails. The information management includes at least an e-mail for notifying the information management apparatus of status information of the monitored apparatus and an e-mail for notifying the information management apparatus of an operating state of the own apparatus. An e-mail to be sent to the apparatus and to notify the status information of the monitored apparatus to a communication device of a predetermined destination other than the information management apparatus is transmitted in a format different from the e-mail to be transmitted to the information management apparatus The e-mail to be transmitted to the information management apparatus is subjected to predetermined encryption by the encryption procedure, and the e-mail to be transmitted to the communication apparatus at a predetermined destination connected to the intranet is encrypted. This is a program for causing a computer to execute a procedure for transmission without application.
[0036]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.
[0037]
FIG. 1 is a block diagram showing a configuration of a network monitoring system according to an embodiment of the present invention. Reference numeral 1 denotes a user site that enjoys a remote monitoring service of a network system by this network monitoring system. Reference numeral 2 denotes a support center site that provides the remote monitoring service.
[0038]
The user site 1 includes a network monitoring device 11 that monitors the status of each monitoring target device connected to a network (for example, an intranet) in the user site 1, and a monitoring target device 12 (printer) that is a monitoring target of the network monitoring device 11. , A server, a router, etc.) and a mail server 13 that transmits the status information of each monitored device 12 attached to an electronic mail under the control of the network monitoring device 11.
[0039]
The support center site 2 also includes a center server 21 that receives an email from the mail server 13, a database management server 22 that stores status information attached to the email, and a history of status information stored in the database management server 22. Based on the history of the status information stored in the document generation server 23, which similarly generates a paper report document relating to the status of the corresponding network, and prints it out by the printer, and also on the status of the corresponding network. A web report that can be browsed by a web browser is generated and transmitted to a communication device (for example, a mobile phone, a PC, etc.) having a specific address, and stored in the database management server 22 in a connected client PC. State Composed by the management console server 25 to sequentially display the broadcast.
[0040]
Next, an outline of the overall operation of the network monitoring system according to the present embodiment will be described with reference to FIG. The network monitoring device 11 monitors the status of each monitored device 12 by acquiring each status information from the monitored devices 12 such as routers and servers existing on the network. The network monitoring device 11 controls the mail server 13 to attach the acquired status information to the support center site 2 via the Internet by attaching it to the e-mail on a regular or immediate basis.
[0041]
In the support center site 2, the electronic mail is received by the center server 21, the state information attached to the electronic mail is stored in the database management server 22, and the management console server 25 is stored in the database management server 22. Information is sequentially read and the analysis result of the state information is displayed on the client PCs 31a to 31d.
[0042]
The support member of the support center monitors the network system by referring to the analysis result of the state information on the screen of the client PC 31. Thereby, this network monitoring system can manage the operation state (performance) of each monitoring target device 12 of the network system in the support center site 2 (hereinafter referred to as performance management).
[0043]
Further, when the network monitoring device 11 detects a failure in the monitoring target device 12, the network monitoring device 11 attaches the status information at that time as an alert notification to an e-mail and transmits it to the support center site 2.
[0044]
Upon receiving the alert notification, the support center site 2 also displays the screen on the client PC 31 and turns on the revolving lamp 32 to notify the support member that the alert notification has been received. The support member of the support center recognizes that a failure has occurred in the monitored device 12 by checking the screen of the client PC 31 or the rotating light. Thereby, this network system can manage the failure of each monitored device 12 of the network system in the support center site 2 (hereinafter referred to as failure management).
[0045]
Further, as shown in FIG. 9, a user ID that is identification information of each user site A, B, C,... And a device ID that is identification information of the monitoring target device 12 are given to the e-mail. . Here, the user ID is set in association with each network monitoring device 11. For example, one user has a plurality of network environments, and tries to install the network monitoring device 11 and manage them. In that case, the user has a plurality of user IDs. In this case, if one network environment is a group composed of a plurality of monitoring target devices 12, the user ID plays a role as a group ID for identifying each group.
[0046]
The device ID is unique identification information associated with each of the plurality of monitoring target devices 12 belonging to one network environment, and this association is managed in the corresponding network monitoring apparatus 11. As a device ID management method in the present embodiment, the IP address or MAC address of each monitored device 12 and the device ID are managed in association with each other on the master table. When the network monitoring device 11 acquires the status information from each monitored device 12, the network monitoring device 11 refers to the device ID corresponding to the IP address of the monitored device 12 from the master table, and adds the device ID to the e-mail for support. Transmit to the center site 2.
[0047]
For example, when the monitored device 12 is replaced with another device having the same function in a certain network environment (when the IP address or MAC address of the monitored device 12 changes), or the IP address of the monitored device 12 changes. In such a case, the conventional monitoring software cannot determine which device has acquired the status information. In contrast, in the present embodiment, since the IP address and MAC address can be updated on the master table, the device ID does not change even when the IP address is changed. It can be determined that the status information transmitted from the monitored device 12 is from the same device. For example, even when an old router is replaced with a new one, the device ID does not change, so that the support center site 2 can similarly determine that the status information of the router.
[0048]
In the support center site 2, a user ID and a device ID are set by the group master table and the device master table shown in FIG. When the support center site 2 receives an e-mail from each network monitoring apparatus 11, the support center site 2 refers to the group master table and the apparatus master table for the user ID and the apparatus ID added to the e-mail, and is attached to the e-mail. In addition, it is possible to identify which network environment the status information is, and which monitoring target device 12 in the network environment.
[0049]
As described above, in this embodiment, the monitoring target devices are managed by the two keys of “device ID” and “user ID” throughout, and the network environment of a plurality of users is centrally monitored (N: 1 type monitoring). Accordingly, the support member who operates the monitoring agent can manage each network environment by operating one monitoring manager, and can individually monitor the status of monitored devices belonging to each network environment in detail. it can. Further, according to the present embodiment, it is not necessary to increase the number of monitoring managers as in the case of conventional monitoring software, so that the costs (especially expensive license fees) and installation man-hours of the monitoring manager that have been generated so far can be reduced. Is possible.
[0050]
Furthermore, according to the present embodiment, since the support center site 2 manages the person-in-charge contact information in association with each user ID in the group master table, there is a problem in monitoring the person-in-charge at each user site. An alert mail related to the target device can be transmitted. In addition, by using a management method using the user ID as a key, it is possible to create a report regarding each network environment state independently for each user site (user).
[0051]
Next, the remote management service provided by this network monitoring system will be described in detail. First, the performance management will be described.
[0052]
The network monitoring apparatus 11 can periodically acquire performance data indicating the operating state of the monitoring target device 12 as the status information of the monitoring target device 12 and investigate the state of each monitoring target device 12. Items that can be investigated (hereinafter referred to as management items) include “CPU (Central Processing Unit) usage rate” and “NIC (Network Interface Card) bandwidth usage”. The support center site 2 can create, for example, a graphed report based on such state information and provide it to the user.
[0053]
The network monitoring device 11 can investigate the following items as the management items.
(1) Bandwidth usage rate of network interface (2) Number of error packets transmitted / received (3) Number of dropped packets generated during transmission / reception (4) CPU usage rate (5) Memory usage rate (6) Disk usage rate
The “network interface bandwidth usage (1)” indicates how much bandwidth is actually used with respect to the bandwidth of the network interface (for example, 100 Mbps). This usage rate can be aggregated for each network interface.
[0055]
The “number of error packets transmitted / received (2)” indicates the number of broken packets transmitted / received per unit time, and the network monitoring apparatus 11 can total the number of packets for each network interface. is there.
[0056]
“Number of dropped packets (3)” indicates the number of packets missed when the communication is in a high load state, and the network monitoring device 11 investigates the number of dropped packets per unit time. . Similarly, the network monitoring device 11 can investigate the number of dropped packets for each network interface.
[0057]
“CPU usage rate (4)” indicates, for example, an average CPU usage rate per 5 minutes. “Memory usage rate (5)” indicates the usage rate of the memory of the server that is one monitored device 12. “Disk usage rate (6)” indicates the usage rate of the disk of the server, which is one monitored device 12, and the network monitoring device 11 can individually count up when there are multiple disks to be monitored. Is possible.
[0058]
The support center site 2 can create a Web report and a paper report to be provided to the user based on the performance data of the management items. First, an operation until the network monitoring apparatus 11 collects performance data from each monitoring target device 12 and provides a user with a Web port based on the performance data will be described with reference to FIGS. 3 and 11.
[0059]
The network monitoring apparatus 11 acquires performance data from each monitored device 12 for each of the above management items, and controls the mail server 13 to send an e-mail attached with the acquired performance data via the Internet to the support center site. 2 to send.
[0060]
In the support center site 2, the e-mail is received by the center server 21, and the performance data attached to the e-mail is stored in the database management server 22. Next, when the web report server 24 receives the login ID and password input on the PC 41 by the user staff (step S111), the web report server 24 authenticates the legitimacy of the user staff based on the information (step S112). ).
[0061]
The “user person in charge” here means a person in charge of managing the network system on the user side. When creating this report, various types of graphs can be created in response to a request from the user staff. Of course, what can be searched here is limited to the monitoring target device associated with the corresponding user ID. Thereby, in this embodiment, since it is possible to prevent a problem that a certain user accesses information corresponding to another user, it is possible to maintain confidentiality for each user's network state.
[0062]
As a result of authentication, when the validity of the person in charge of the user is authenticated, the person in charge of the user designates a device and a date and time for which a Web report is to be output on the PC 41 (step S113). When the Web report server 24 receives the specified information and confirms the content of the specified information (step S114), the Web report server 24 searches the DB management server 22 for performance data of the specified device and date (step S115). Next, parameter data designated for the user is extracted from the DB management server 22 (step S116), a graph is created from the performance data searched in step S115 based on the extracted parameters, and then the PC 41 is used as a Web report. (Step S117).
[0063]
The “parameter” in step S116 is data that is an initial setting value related to graph creation. For example, an average value of parameter data acquired during a predetermined period is taken and plotted to create a graph. Alternatively, it can be set to create a graph by plotting the maximum value of the parameter data in a predetermined period. Finally, the Web report server 24 confirms that the PC 41 has logged out (step S118) and completes the processing. Thereby, a Web report is displayed on the screen of the PC 41, and the person in charge of the user can grasp the state transition related to the corresponding network system. The parameter data referred to when creating the graph can be freely set according to a request from the user staff, and various forms of graphs can be created based on this.
[0064]
Next, a paper report creation operation will be described in detail with reference to FIG. The document generation server 23 shown in FIG. 1 lists up users who are to create preset paper reports (step S121). Next, the period of performance data to be graphed is set (step S122). The period set by this setting operation may be registered in advance, or may be set by appropriately inputting on the document generation server 23.
[0065]
Next, one user is selected from the users listed in step S121, and the performance data of the monitoring target device 12 belonging to the network environment of the user is searched from the database management server 22 (step S123). In this search operation, performance data within the period set in step S122 is a search target. Further, the document generation server 23 extracts parameter data corresponding to the user (step S124) and creates a graph (step S125), as in step S116.
[0066]
Next, the document generation server 23 determines whether or not a report has been created for all the users listed in step S121 (step S126). A comment is input to each report on the screen, and the process ends (step S127).
[0067]
Next, the operation when the support center site 2 performs failure management of the network system based on the alert notification transmitted from the network monitoring device 11 will be described in detail with reference to FIG.
[0068]
The network monitoring device 11 acquires the current status information and the like from the performance data as well as the performance data from each monitoring target device 12, and monitors the operating state of each monitoring target device 12 based on the acquired information. As a result of the monitoring, if changes are detected in these, the network monitoring apparatus 11 controls the mail server 13 so that the status change is performed on the support center site 2, the user's staff PC 41, and the field engineer's PC 51. Send by email as alert notification. In particular, data is transmitted to the PC 41 and the PC 51 in a data format in which humans can easily recognize the state change. As a result, the support center site 2, the person in charge of the user, and the field engineer can monitor the status of the network system in real time and can respond to the occurrence of a failure. The “field engineer” here refers to a person in charge of maintenance of each network system on the support center side.
[0069]
The investigation items related to the failure management by the network monitoring device 11 include the following items, for example.
(1) Performance monitoring (2) Ping test (3) Log collection and monitoring (4) Process monitoring
FIG. 13 is a flowchart showing the operation flow of the “performance monitoring (1)”. After the initialization (step S131), the network monitoring device 11 determines the monitoring target device 12 to be monitored from its own network environment (step S132). Next, the network monitoring device 11 acquires performance data from the monitoring target device 12 to be monitored in response to the inquiry, and stores it (step S133). Next, the network monitoring device 11 determines whether or not the state value of the monitoring target device 12 such as the CPU usage rate indicated in the acquired performance data is equal to or greater than a predetermined threshold (step S134). If it is determined by this determination that the state value is equal to or greater than a predetermined threshold, the network monitoring device 11 detects that a failure has occurred in the monitored device 12, and supports performance data as an alert notification at that time. The data is transmitted to the center site 2 (step S135) and enters a standby state (step S136). In addition to the performance data, the PC 41 and 51 of the user staff and the field engineer are notified of the faulty device and its location in addition to the performance data so that it can be recognized that which part of which device has failed. Alert notifications in a format that can be done.
[0071]
FIG. 14 is a flowchart showing an operation flow of the “ping test (2)”. After the initialization (step S141), the network monitoring device 11 determines the monitoring target device 12 to be monitored (step S142). Next, the network monitoring apparatus 11 inquires status information to the monitoring target device 12, and acquires status information as a response (step S143). Next, the network monitoring apparatus 11 compares the test result obtained this time with the previous test result, and detects a status change (operation state to stop state, or stop state to operation state) (step S144). . If there is a change in the test result as a result of the comparison, the network monitoring device 11 detects a change in status, and at that time, transmits status information as an alert notification to the support center site 2 (step S145). (Step S146). In addition to status information, the PCs 41 and 51 of the person in charge of the user and the field engineer can be notified of the device whose operating state has changed in addition to the status information so that it can be recognized which device has changed its operating state. Alert notification.
[0072]
FIG. 15 is a flowchart showing the flow of the operation of “log collection and monitoring (3)”. After the initialization (step S151), the network monitoring device 11 enters a standby state for log messages (operation records) generated by each monitored device 12 (step S152). Next, the network monitoring device 11 determines whether or not a log message has been received from the monitoring target device 12 (step S153). If it is determined that the log message has been received, the log message is an important log message. It is determined whether or not there is (step S154). If it is determined by this determination that the log message is an important log message, the network monitoring device 11 transmits the log message to the support center site 2 as an alert notification at that time (step S155). In addition, in order to be able to recognize which device the log message is, the user staff and the field engineer PCs 41 and 51 can notify the device that generated the log message in addition to the log message. Alert notification.
[0073]
Here, when the network monitoring device 11 selects an important one from the collected log messages, if the “priority” preset in the log message is equal to or higher than a predetermined standard, the log message is important. Treat as. For example, this “priority” has 8 levels of “debug, info, notice, warning, err, crit, alert, emerge” in descending order of importance. In the present embodiment, the network monitoring apparatus 11 is notified by notice. Even when a message with high importance is received, an alert is notified.
[0074]
In the “process monitoring (4)”, when the monitored device 12 is a server, the network monitoring device 11 acquires performance data from the server that is the one monitored device 12 by an inquiry, and the process status ( This is performed by determining “starting”, “stop”, or “restart”.
[0075]
FIG. 16 is a flowchart showing the operation flow of the “process monitoring”. After performing initialization (step S161), the network monitoring device 11 determines the monitoring target device 12 to be monitored (step S162). Next, the network monitoring device 11 acquires performance data from the monitoring target device 12 by inquiry (step S163), and determines the status of the process from the performance data. Next, the network monitoring apparatus 11 detects a change in status by comparing the determination result relating to the current status with the previous determination result (step S164). If a change in status is detected in step S164, status information at that time is transmitted to the support center site 2 (step S165), and a transition is made to a standby state (step S166). In addition to the status information, the PC 41 and 51 of the person in charge of the user and the field engineer are notified of an alert in a format that can notify the device and OS corresponding to the status information.
[0076]
FIG. 17 is a flowchart showing in detail the alert notification operation in steps S135, S145, S155, and S165. The network monitoring apparatus 11 adds the user ID and the device ID of the monitoring target device 12 to the e-mail (step S171), and then creates an e-mail for the support center site 2 (center server 21) (step S172) and transmits it. (Step S173).
[0077]
Next, the network monitoring device 11 determines whether or not an alert notification is to be sent to the user staff (step S174). If it is determined that an alert notification is to be sent to the user staff, an email is sent to the PC 41 of the user staff. Is transmitted (step S175). Next, the network monitoring device 11 similarly determines whether or not to notify the field engineer of the alert (step S176). If it is determined that the alert notification is to be sent to the field engineer, an e-mail is sent to the field engineer's PC 51. Is transmitted (step S177). Here, whether the alert notification is sent to the user staff or the field engineer is determined depending on whether the alert notification setting is ON / OFF for the user staff or the fold engineer.
[0078]
FIG. 18 shows an example of an e-mail format in the alert notification. In the example of FIG. 18, the support center site 2 (center server 21) is sent as the destination in the e-mail, the network monitoring device (care box) is mainly sent, and an alert is described in “Subject”. In “Text”, the user ID, device ID, and alert notification content are attached to the e-mail.
[0079]
Next, a communication method (protocol) between the network monitoring device 11 and each monitoring target device 12 will be described with reference to FIG. The network monitoring device 11 acquires various types of information from each monitoring target device 12 using the following communication method.
[0080]
Regarding the above “performance management”, “performance monitoring”, and “process monitoring”, the network monitoring device 11 periodically (for example, once every 5 minutes) to the monitored device 12 by SNMP (Simple Network Management Protocol). ) And the performance data is obtained by the response. Thereby, the network monitoring apparatus 11 can investigate the state of each device of the monitoring target device 12.
[0081]
With respect to the “ping test (2)”, the network monitoring apparatus 11 periodically inquires the monitoring target device 12 using the ping program (for example, once / one minute), and the monitoring target target device 12 determines from the response result. Identifies whether or not it is in operation.
[0082]
Regarding the above “log collection and monitoring (3)”, log monitoring is performed by the network monitoring device 11 collecting log messages autonomously transmitted from each monitoring target device 12 by Syslog or TRAP. .
[0083]
FIG. 6 is a diagram showing processing contents of the network monitoring device 11 in failure management. When the network monitoring apparatus 11 obtains performance data from each monitored device 12 as described above, the fault management performs the following two determinations and decides whether or not to perform alert notification for each piece of information. Yes.
[0084]
For the log message acquired from each monitoring target device 12, the network monitoring device 11 collates the log message with a pre-registered filter list, and transmits the alert message as an alert mail if the log message is not in the filter list. Control. On the other hand, if the log message includes the same content as the filter list, the network monitoring device 11 controls not to transmit the message as an alert mail. As a result, only necessary log messages can be extracted and transmitted to the support center site 2, and the network resources can be used effectively.
[0085]
Further, the network monitoring device 11 detects a change in the state of the monitored device 12 under certain conditions, such as comparing the performance data acquired from each monitored device 12 with a predetermined threshold as described above. Control alert emails to be sent.
[0086]
FIG. 7 is a diagram illustrating a flow when the network monitoring apparatus 11 transmits data collected from the monitoring target device 12 to the support center site 2 by electronic mail. When the network monitoring device 11 acquires various information such as performance data from each monitored device 12, the network monitoring device 11 attaches the information to an e-mail by controlling the mail server 13, for example, on a regular basis by SMTP (Simple mail transfer protocol) or Send to the immediate support center site 2. At that time, the network monitoring device 11 encrypts the e-mail by, for example, the PGP method in order to avoid leakage of transmission information and ensure the safety of system operation.
[0087]
The support center site 2 receives the e-mail transmitted from the user site 1 at the center server 21, stores the status information such as performance data attached to the e-mail in the database management server 22, and the database management server 22 The network system of the user site 1 is managed using the information stored in.
[0088]
Next, the types of e-mails transmitted from the user site 1 to the support center site 2 will be described in detail with reference to FIG. The user site 1 transmits the following four types of e-mails for remote management of its network system.
(1) Alive mail (2) Config mail (3) Daily mail (4) Alert mail [0089]
The support center site 2 receives the e-mail at the center server 21, stores various information attached to the e-mail in the database management server 22, and uses it for analysis for remote monitoring of the network system. .
[0090]
The alive mail (1) is a mail for notifying the support center site 2 of the operation status of the network monitoring device 11. The support center site 2 makes an inquiry to the user site 1 once an hour, for example, and receives an alive mail from the network monitoring device 11 as a response. In the alive mail, the operation status of the network monitoring device 11 itself (for example, CPU usage rate, network interface load, etc.) is recorded, and the support center site 2 also stores these information attached to the alive mail. In addition, the operating status of the network monitoring device 11 can be grasped.
[0091]
On the other hand, when the network monitoring device 11 is in a normal operation state, the network monitoring device 11 returns the operation status of the network monitoring device 11 attached to the alive mail in response to the inquiry from the support center site 2 in this way. Can't reply. Therefore, the support center site 2 makes an inquiry to the user site 1 and determines that the network monitoring device 11 has failed if the reply from the network monitoring device 11 is not consecutive several times.
[0092]
The support center site 2 can also make the above inquiry irregularly. For example, when it becomes necessary to grasp the operation status of the network monitoring apparatus 11, the inquiry is appropriately issued and the alive mail is received. You can also
[0093]
The configuration mail (2) is used when the registered content (for example, IP address, serial number, etc.) regarding the monitoring target device 12 is changed on the network monitoring device 11 at the user site 1, that is, a new monitoring target device on the network 12 when the setting related to the monitored device 12 is made on the network monitoring apparatus 11 or when the setting related to the monitored device 12 already installed on the network is changed. This is an e-mail attached with the changed setting contents to notify the support center site 2 of the registered contents. The network monitoring device 11 transmits a configuration mail to the support center site 2 when such a setting change or the like is performed. As a result, the support center site 2 can sequentially grasp changes in the registered contents on the network monitoring device 11. Further, when the third party changes the registered contents on the network monitoring device 11 without permission, the support center site 2 is notified by the config mail, so the support center site 2 can also detect it.
[0094]
The daily mail (3) is a mail for regularly transmitting performance data such as “CPU usage rate” and “memory usage rate” collected by the network monitoring apparatus 11 through performance management to the support center site 2. Yes, for example, it is transmitted to the support center site 2 once a day. The support center site 2 receives this mail at the center server 21 and stores it in the database management server 22. The application server 23 or the web report server 24 creates a report using a performance graph or the like based on the history of performance data stored in the database management server 22 as necessary.
[0095]
As described above, the alert mail (4) is a mail for notifying the support center site 2 and the like immediately when any failure is detected from the performance data collected by the network monitoring apparatus 11 through performance management. It is. There are four types of alert emails as described above. That is, an e-mail notified when the status value indicated by the performance data exceeds a predetermined threshold, an e-mail notified when a status change of the monitoring target device 12 is detected by a ping test, and a monitoring target device 12 is an e-mail notified when a “priority” set in a log collected from 12 is higher than a predetermined standard, and an e-mail notified when a change in process status is detected.
[0096]
In addition, the network monitoring device 11 has alert mail transmission destinations (for example, support center site 2, field engineer, user person in charge, etc.) and security levels of the respective transmission destinations registered in advance, and according to each security level. Select the mail format and control to send each alert mail at the same time. That is, the alert mail is transmitted to the network manager without being encrypted because the alert mail is transmitted through the company where security is ensured on the user side. Since the alert mail is transmitted to the support center site 2 via the Internet, it is encrypted and transmitted so as to ensure security in service operation. If the communication device possessed by the field engineer has a function that enables decryption, an encrypted alert mail is transmitted to the field engineer. In the support center site 2, when the sensor server 21 receives the encrypted alert mail, it is decrypted and the encryption is released.
[0097]
In the above embodiment, a plurality of servers (center server 21, database management server 22, document generation server 23, Web report server 24, management console server 25) are arranged in the support center site 2. The invention is not limited to this, and the function of a plurality of servers can be provided in one server, and the support center site 2 can be configured with fewer hardware resources than in the present embodiment.
[0098]
Another object of the present invention is to supply a storage medium storing software program codes for realizing the functions of the above-described embodiments to a system or apparatus, and the computer (or CPU or MPU) of the system or apparatus stores the storage medium. Needless to say, this can also be achieved by reading and executing the program code stored in.
[0099]
In this case, the program code itself read from the storage medium realizes the functions of the above-described embodiments, and the storage medium storing the program code constitutes the present invention.
[0100]
As a storage medium for supplying the program code, for example, a flexible disk, a hard disk, an optical disk, a magneto-optical disk, a CD-ROM, a CD-R, a magnetic tape, a nonvolatile memory card, a ROM, or the like can be used.
[0101]
Further, by executing the program code read by the computer, not only the functions of the above-described embodiments are realized, but also an OS (operating system) running on the computer based on the instruction of the program code. It goes without saying that a case where the function of the above-described embodiment is realized by performing part or all of the actual processing and the processing is included.
[0102]
Further, after the program code read from the storage medium is written in a memory provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer, the function is determined based on the instruction of the program code. It goes without saying that the CPU or the like provided in the expansion board or function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.
[0103]
【The invention's effect】
Further, according to the present invention, when a notification regarding the operating state is sent from the monitoring apparatus by electronic mail, the mail format can be selected according to the security level.
[0104]
Further, according to the present invention, the monitoring device acquires the status information of each monitoring target device, and transmits the acquired status information to the information management device by e-mail. The risk of security policy collapse and labor associated with the introduction of the system can be avoided. In addition, when introducing a monitoring device, it is only necessary to add one account to an electronic mail transmission device that is generally widely used, which makes it easy for service providers to install. Furthermore, since this monitoring apparatus can be easily introduced as described above, the time required for introduction can be shortened compared to a conventional monitoring system using a dedicated line, and a service can be provided to the user quickly.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a network monitoring system according to an embodiment of the present invention.
FIG. 2 is a diagram for explaining the outline of the overall operation of the network monitoring system according to the embodiment of the present invention.
FIG. 3 is a diagram for explaining an operation until a network monitoring apparatus according to an embodiment of the present invention collects performance data from each monitored device and provides a performance report to a user based on the performance data.
FIG. 4 is a diagram for explaining an operation when a support center site in the embodiment of the present invention performs failure management of a network system based on an alert notification transmitted from a network monitoring device.
FIG. 5 is a diagram for explaining a communication method (protocol) between a network monitoring apparatus and each monitoring target apparatus in an embodiment of the present invention.
FIG. 6 is a diagram showing processing contents at the time of failure management of the network monitoring device in one embodiment of the present invention.
FIG. 7 is a diagram illustrating a flow when the network monitoring apparatus according to the embodiment of the present invention transmits data collected from monitored devices to a support center site by e-mail.
FIG. 8 is a diagram for explaining types of electronic mail transmitted from a user site to a support center site in an embodiment of the present invention.
FIG. 9 is a diagram illustrating a state in which the network monitoring apparatus according to the embodiment of the present invention transmits a device ID and a group ID added to an electronic mail.
FIG. 10 is a diagram schematically showing a group master table and a device master table in an embodiment of the present invention.
FIG. 11 is a flowchart showing an operation flow of the Web report server according to the embodiment of the present invention.
FIG. 12 is a flowchart showing a flow of operation of the document generation server according to the embodiment of the present invention.
FIG. 13 is a flowchart showing a flow of performance monitoring operation according to the embodiment of the present invention.
FIG. 14 is a flowchart showing a flow of a Ping test operation in an embodiment of the present invention.
FIG. 15 is a flowchart showing the flow of log collection and monitoring operations in an embodiment of the present invention.
FIG. 16 is a flowchart showing a flow of a process monitoring operation in one embodiment of the present invention.
FIG. 17 is a flowchart showing in detail an alert notification operation flow according to an embodiment of the present invention;
FIG. 18 is a diagram schematically showing an e-mail format in an embodiment of the present invention.
[Explanation of symbols]
1: User site 2: Support center site 11: Network monitoring device 12: Monitored device 13: Mail server 21: Center server 22: Database management server 23: Document generation server 24: Web report server 25: Management console server 31: Client PC
41, 51: PC

Claims (4)

Status information acquisition means for acquiring status information of one or a plurality of monitored devices connected to be communicable;
Status information acquired by the status information acquisition means, device identification information for identifying a monitored device corresponding to the status information, and group identification information for identifying a group consisting of the one or more monitored devices E-mail generation and transmission means for generating an e-mail including, and transmitting to an information management apparatus that manages an operating state of the monitored apparatus based on the status information, the device identification information, and the group identification information;
Having an encryption means for performing predetermined encryption on the e-mail;
Further, the e-mail generation and transmission means transmits a plurality of types of e-mail, and at least the e-mail for notifying the information management apparatus of the status information of the monitored apparatus and the operating state of the own apparatus Regarding an e-mail for transmitting an e-mail for notifying an information management apparatus to the information management apparatus and notifying a status information of the monitored apparatus to a communication device of a predetermined destination other than the information management apparatus An e-mail transmitted to the information management apparatus in a format different from the e-mail transmitted to the information management apparatus, the e-mail transmitted to the information management apparatus is subjected to predetermined encryption by the encryption means, and is connected to an intranet An electronic mail transmitted to the communication apparatus is transmitted without being encrypted. A monitoring method of a monitored device by a monitoring device,
A status information acquisition step of acquiring status information of one or a plurality of monitored devices connected to be communicable;
Status information acquired by the status information acquisition step, device identification information for identifying a monitored device corresponding to the status information, and group identification information for identifying a group consisting of the one or more monitored devices Generating an e-mail including, and transmitting to an information management device that manages an operating state of the monitored device based on the status information, the device identification information, and the group identification information; and
An encryption step for applying a predetermined encryption to the email;
Further, the e-mail generation and transmission step is for transmitting a plurality of types of e-mails, and at least the e-mail for notifying the information management apparatus of the status information of the monitored apparatus and the operating state of the own apparatus E-mail for notifying the information management device to the information management device and notifying the status information of the monitored device to a communication device of a predetermined destination other than the information management device Is transmitted in a format different from the e-mail transmitted to the information management apparatus, and the e-mail transmitted to the information management apparatus is subjected to predetermined encryption in the encryption step and connected to the intranet. A monitoring method, comprising: a step of transmitting an e-mail to be transmitted to the communication device at a predetermined destination without encryption. A recording medium recording a program to be executed by a computer of a monitoring device that monitors the monitored device,
Status information acquisition procedure for acquiring status information of one or a plurality of monitored devices connected to be communicable;
Status information acquired by the status information acquisition procedure, device identification information for identifying a monitored device corresponding to the status information, and group identification information for identifying a group composed of the one or more monitored devices An e-mail generation transmission procedure for generating an e-mail including and transmitting the e-mail to an information management apparatus that manages an operating state of the monitored apparatus based on the state information, the device identification information, and the group identification information;
An encryption procedure for applying a predetermined encryption to an email;
Further, the e-mail generation / transmission procedure is a procedure for transmitting a plurality of types of e-mails, and at least an e-mail for notifying the information management device of status information of the monitored device and an operating state of the device itself E-mail for notifying the information management device to the information management device and notifying the status information of the monitored device to a communication device of a predetermined destination other than the information management device Is transmitted in a format different from the e-mail transmitted to the information management apparatus, and the e-mail transmitted to the information management apparatus is subjected to predetermined encryption by the encryption procedure and connected to the intranet. A program for causing a computer to execute a procedure for transmitting an e-mail to be transmitted to the communication device at a predetermined destination without encryption. Recording a computer-readable recording medium. A program to be executed by a computer of a monitoring device that monitors a monitored device,
Status information acquisition procedure for acquiring status information of one or a plurality of monitored devices connected to be communicable;
Status information acquired by the status information acquisition procedure, device identification information for identifying a monitored device corresponding to the status information, and group identification information for identifying a group composed of the one or more monitored devices An e-mail generation transmission procedure for generating an e-mail including and transmitting the e-mail to an information management apparatus that manages an operating state of the monitored apparatus based on the state information, the device identification information, and the group identification information;
An encryption procedure for applying a predetermined encryption to an email;
Further, the e-mail generation / transmission procedure is a procedure for transmitting a plurality of types of e-mails, and at least an e-mail for notifying the information management device of status information of the monitored device and an operating state of the device itself E-mail for notifying the information management device to the information management device and notifying the status information of the monitored device to a communication device of a predetermined destination other than the information management device Is transmitted in a format different from the e-mail transmitted to the information management apparatus, and the e-mail transmitted to the information management apparatus is subjected to predetermined encryption by the encryption procedure and connected to the intranet. A program for causing a computer to execute a procedure for transmitting an e-mail to be transmitted to the communication device of a predetermined destination without encryption.

Images