The present invention generally relates to a flow information collection apparatus for collecting flow information indicating a traffic state from routers in a network.
In
Error rate (%)≈196×√(1/C)
Subsequently, the core router CR1 identifies a flow from a label applied to the captured packet, obtains an aggregation of the traffic amount for each label, and generates the flow information by performing a statistic process (step ST4). The flow information is stored in a net flow cache in a memory, and is used as flow statistic information.
Then, the core router CR1 sends the flow information to the flow information collection apparatus 1 by a UDP (User Datagram Protocol) or the like (step ST5). The flow information collection apparatus 1 accumulates the flow information received from the core router CR1 (step ST6).
The flow information collected in the above-mentioned manner is utilized for expansion and reduction of network devices and the like.
However, in order to improve the error rate and accuracy of the flow information, there is a problem in the above-mentioned method in which the sampling value “s” is the fixed system value.
First, in the Sampled Net Flow method, an error occurs in the statistic information in the above-described expression. In the expression, in order to simply reduce the error rate, the sample number “C” is increased. In order to increase the sample number “C”, it is required to make an aggregation time be longer. Otherwise, it is required to increase a sample rate by reducing a sampling value “s” of the router.
However, in traffic measurement in an operational system including the function, it is not possible to easily extend the aggregation time, since the collection period is defined by a fixed interval. In addition, if the sample rate is increased at the router, workload is increased and a routing process of the router is interfered with by the increased workload.
In detail, in a case in which the traffic amount (number of packets and etc.) passing the router is relatively high, the sampling value “s” is set to be large. In this case, if the collection period is set as the fixed interval not to influence the workload of the router in a system operation, there may not be a problem according to a calculation result of the error rate.
However, in a case in which the traffic amount is relatively low or the workload is not heavy (is moderate), if the sampling value “s” is set to be large, many cases occur in which the traffic amount of packets passing the router cannot be accurately captured. In this case, the sampling value “s” is required to be smaller and to be sampled at a shorter period.
On the other hand, even if by utilizing an existing error rate calculation, the traffic amount is adequately obtained with a proper sampling value “s” in an initial setting condition (for example, at a time of starting an operation), since the workload of the network is constantly fluctuating from day to day, depending on conditions of a use state of a network user, a region, time, a use type of the router (the core router, the edge router, or the like) and the like, the workload and the amount of resources in the network are varied and a flow control process can be delayed.
Moreover, since each of the routers may have a different product specification and operates depending on a version of internal software and setting contents of a configuration (Config), a use resource amount indicates a different amount depending on a situation as well as workload information of a CPU. Thus, in an actual operation, in a case in which the sampling value “s” is the fixed system value, the packets may not be captured and measured at a proper sampling value.
Accordingly, in a case of simply applying a fixed sampling value defined beforehand by a method using various calculation logic schemes, other conditions, and the like, since the traffic amount of packages constantly passing the routers is varied depending on operations and the workload condition of the network, a problem occurs in that the flow information cannot be properly collected.
In the above, a collection of the flow information in the MPLS-VPN is described as an example. The above-described problems can be generally raised in the flow information collection apparatus in which the flow information is acquired in each of the routers and the flow information is collected from each of the routers.
On the other hand, Japanese Laid-open Patent Application No. 2003-244195 discloses a technology for extracting a peak traffic amount which indicates a higher value than other traffic amounts acquired at the times before and after the peak traffic amount is acquired, in chronological data of communication traffic. Japanese Laid-open Patent Application No. 7-15512 discloses a technology for totaling information sampled at every call, editing as traffic data, and correcting subsequent information being sampled by the traffic data. However, technologies disclosed in the above Japanese Laid-open Patent Applications do not overcome the above-described problems.
According to an aspect of the embodiment, a flow information collection apparatus includes a flow information accumulation part configured to periodically collect and accumulate flow information which is sampled based on a predetermined sampling value, from a router being a subject; a distribution result calculation process part configured to specify a group of distributions of values for each measurement subject, from data in which the values for the each measurement subject in the flow information accumulated by the flow information accumulation part are distributed in a time period in a plurality of past days; a distribution information determination process part configured to specify a representative group from the group specified by the distribution result calculation process part and to acquire an average; and a correction information determination process part configured to determine the sampling value after a next time from the average of the representative group specified by the distribution information determination process part.
The object and advantages of the embodiment will be realized and attained by means of the elements and combinations particularly pointed out in the claims.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the embodiment as claimed.
In the following, an embodiment of the present invention will be described with reference to the accompanying drawings.
In
Also, the flow information collection apparatus 100 retains accumulated data D100 of traffic measurement results, process counter data D101 for traffic measurement, basic calculation data D102 of the traffic measurement results, MIB data D103, survey data D104 of traffic distribution, calculation result data D105 of the traffic distribution, accumulation data D106 of correction information, and system schedule information D107, as data for various processes.
The flow information collection part B10 includes a process for periodically collecting the flow information from routers (core routers CR1 through CR3, and the like in
The flow information accumulation part B11 includes a process for accumulating the flow information collected from each of the routers through the flow information collection part B10, in the accumulated data D100 of the traffic measurement results.
The flow information output part B12 includes a process for outputting the flow information accumulated in the accumulated data D100 of the traffic measurement results for an operator in order to utilize the flow information for expansion and reduction of network devices and the like.
The MIB information collection part B20 includes a process for collecting MIB (Management Information Base) information including a CPU use rate from each of the routers, and accumulating the MIB information in the MIB data D103.
The correction control process part B100 is activated via the flow information accumulation part B11 after collecting the flow information by applying the sampling value of the initial value at the flow information accumulation part B11 in a certain period, and includes a control process as a whole to correct the sampling value used at each of the routers to acquire the flow information.
The accumulated information edit process part B101 is activated by the correction control process part B100, and includes a process for extracting necessary information from the flow information accumulated in the accumulated data D100 of the traffic measurement results and accumulating basic data used in later processes in the basic calculation data D102 of the traffic measurement results.
The accumulated information control process part B102 is activated by the correction control process part B100, and includes a further detailed control process to correct the sampling values used at each of the routers to acquire the flow information.
The accumulated information calculation process part B103 is activated by the accumulated information control process part B102, and includes a process for calculating an error rate of basic traffic information, calculating the CPU use rate at the routers from the MIB information accumulated in MIB data D103, and accumulating a result in the basic calculation data D102 of the traffic measurement results.
The distribution result calculation process part B104 is activated by the accumulated information control process part B102, and includes a process for specifying a group of distribution of values which are measurement subjects in the basic calculation data D102 of the traffic measurement results, and accumulating a result in the calculation result data D105 of the traffic distribution. In this case, the survey data D104 of traffic distribution are used as input information defining a survey range.
The distribution information determination process part B105 is activated by the accumulated information control process part B102, and includes a process for specifying a representative group from groups of distribution results accumulated in the calculation result data D105 of the traffic distribution, acquiring an average of the groups of the distribution result, and accumulating a result in the calculation result data D105 of the traffic distribution.
The correction information determination process part B106 is activated by the accumulated information control process part B102, and includes a process for determining the correction value of the sampling value based on the results accumulated in the calculation result data D105 of the traffic distribution and accumulating a result in the accumulation data D106 of the correction information.
The measurement information conformity process part B107 is activated by the correction information determination process part B106, and includes a process for determining whether or not a correction of the sampling value is valid in terms of the CPU use rate, the packet number, and a measurement delay time with respect to the result accumulated in the accumulation data D106 of the correction information, and conforming the sampling value to be a further adequate value.
The special analysis process part B108 is activated by the correction information determination process part B106, and includes a process for adjusting the sampling value based on an outstanding value which is determined by the measurement information conformity process part B107 as a value which is not conformed with respect to the results accumulated in the accumulation data D106 of the correction information and is excluded from the group of the distribution results
The special diagnosis process part B109 is activated by the special analysis process part B108, and includes a process for determining validity of the outstanding value excluded from the group of the distribution results based on the system schedule information D107 with respect to the results accumulated in the accumulation data D106 of the correction information, and adjusting the sampling value.
Various data structures of data described with reference to
In
In
In
In
In
In
In
In
In the following, operations according to the embodiment will be described.
The flow information accumulation part B11 conducts a sampling correction with respect to the routers being subjects, and accumulates the flow information collected from each of the routers in the accumulated data D100 of traffic measurement results. Then, after the collection being performed in the certain period is completed, the flow information accumulation part B11 activates the correction control process to be conducted by the correction control process part B100.
In the following, the correction control process by the correction control process part B100 and processes activated from the correction control process will be described in accordance with flowcharts depicted in
In
In
In a case in which this process is conducted a first time and the time period for starting the correction control will be next, the accumulated information edit process part B101 conducts initial settings of the flag of the measurement in operation (a measurement will be started next time) and the router counter (a loop process conducted one time for each router), and initializes other counters and flags (the pre-process is conducted), and the like (step P-203).
On the other hand, in a case in which the accumulated information edit process has been already performed in the time period for starting the correction control after the process is conducted the first time, the accumulated information edit process part B101 sets initial settings to the flag of the measurement in operation (the measurement is being conducted) and the router counter, and initializes other counters and flags (the pre-process is conducted), and the like (step P-204).
Next, the accumulated information edit process part B101 initializes the collection counter utilized in one router loop and acquires related information (step P-205). The accumulated information edit process part B101 obtains a traffic measurement result as basic calculation data by a calculation using necessary items for a measurement result, that is, the packet number, the measurement delay time, and the like, and accumulates the measurement results in the basic calculation data D102 of the traffic measurement results (step P-206). The error rate is calculated and accumulated later in an accumulated information calculation process by the accumulated information calculation process part B103. At this point, the CPU use rate cannot be acquired and thus, is not a subject to process.
After the above calculation process of the basic data ends, the accumulated information edit process part B101 determines whether or not the process ends for each collection area (step P-207). The collection counter is used in this determination.
When the process for all of the collection areas has not ended, the accumulated information edit process part B101 updates the collection counter (step P-208), and repeats the process (from step P-206) for a next collection area.
When the process has ended for all of the collection areas, the accumulated information edit process part B101 determines whether or not a process for all of the related routers ends (step P-209). The router counter is used for this determination.
When the process for all of the related routers has not ended, the accumulated information edit process part B101 updates the router counter (step P-210), and conducts the above process (starting from the step P-205) for a next router.
When the process for all of the related routers has ended, the accumulated information edit process by the accumulated information edit process part B101 is terminated, and returns to a call origin which is the correction control process by the correction control process part B100.
Returning to
If the result includes the abnormal end of the accumulated information edit process, the correction control process conducts a later process (step P-107), is terminated, and goes back to the existing flow control process conducted by the flow information accumulation part B11.
If the result includes the normal end of the accumulated information edit process, the correction control process sets input information to activate an accumulated information control process (step P-105). Then, the accumulated information control process is started by the accumulated information control process part B102 (step P-106).
In
Subsequently, the correction control process initializes the collection counter utilized in one router loop, and acquires the related information (step P-302).
Next, the correction control process acquires information of one router for one collection area corresponding to the collection counter (step P-303).
After that, the correction control process sets input information to activate the accumulated information calculation process (step P-304), and activates the accumulated information calculation process by the accumulated information calculation process part B103 (step P-305).
In
Returning to
In
Returning to
If it is determined that all calculations have not ended for all of the collection areas since the collection counter has not reached the final value, the accumulated information control process updates the collection counter (step P-310), and conducts the above calculation processes (starting from the step P-303) for a next collection area.
On the other hand, if it is determined that all calculations have ended for all of the collection areas since the collection counter reaches the final value, in
If all calculations have not ended for all of the related routers, the accumulated information control process updates the router counter (step P-312), and repeats the above process (starting from the step P-302 in
On the other hand, if all calculations have ended for all of the related routers, the accumulated information control process makes transition to a distribution result calculation process by the distribution result calculation process part B104.
First, the accumulated information control process by the accumulated information control process part B102 initializes the router counter (step P-313), and initializes the collection counter (step P-314). If the distribution calculation process including accumulated past results is conducted a first time, the final value of the collection counter is set as [past days×24]+[remaining time period]. If the distribution result calculation process has been already conducted, the final value is set to be two.
Next, the accumulated information control process sets input information to activate the distribution result calculation process (step P-315), and activates the distribution result calculation process by the distribution result calculation process part B104 (step P-316).
In
Next, the distribution result calculation process part B104 initializes the distribution survey counter (step P-502). In this case, a process is sequentially conducted for the survey 50, the survey 25, the survey 10, the survey 5, . . . , the survey n until a function is determined. The survey range is acquired from the survey data D104 of the traffic distribution.
Subsequently, the distribution result calculation process part B104 specifies the groups of the distribution results (step P-503). In detail, the following processes will be conducted.
Returning to
If the survey determination flag is “OFF” indicating that the survey has not ended, the process is repeated from conducting the survey of the distribution state (starting from step P-503). Data of a distribution result are surveyed until the survey end is set with the survey determination flag.
If the survey determination flag is “ON” indicating that the survey ends, the distribution result calculation process part B104 accumulates determination information in the calculation result data D105 of the traffic distribution retain results (step P-505).
Next, the distribution result calculation process part B104 determines that the survey ends, by checking whether or not the distribution survey counter reaches the final value (step P-506).
If the distribution survey counter does not indicate the survey end, the distribution result calculation process part B104 updates the distribution survey counter (step P-507), and conducts a next survey (starting from step P-503).
When the distribution survey counter indicates the survey end and the survey for all distribution results is completed for one collection survey area, the distribution result calculation process is terminated, and returns to a call origin which is the accumulation information control process by the accumulation information control process part B102.
Returning to
In
Next, the distribution information determination process part B105 determines that a current determination process is a last process, by checking whether or not the collection counter has ended (step P-602).
If the collection counter has ended, subsequently, the distribution information determination process part B105 determines that a current process for the routers is a last process, by checking whether or not the router counter has ended (step P-603).
If the router counter has ended, as a final result, the distribution information determination process part B105 determines final averages for the packet number, the error rate of the packets, and the CPU use rate from valid values being determined in distribution result values for each collection area for each time period of each router, and stores the final values in the calculation result data D105 of the traffic distribution (step P-604). Accordingly, the distribution information determination process is terminated, and returns to a call origin which is the accumulated information control process by the accumulated information control process part B102.
If the collection counter has not ended or if the router counter has not ended, the distribution information determination process is terminated, and returns to a call origin which is the accumulated information control process by the accumulated information control process part B102.
In
On the other hand, if completed, the accumulated information control process part B102 determines whether or not all calculations have ended for all of the related routers (step P-321). If the calculations are not completed for all of the related routers, the accumulated information control process part B102 updates the router counter (step P-322), and goes back to initializing the collection counter (starting from the step P-314).
If the calculations are completed for all of the related routers, the accumulated information control process part B102 makes the transition to the correction control process in
First, the accumulated information control process part B102 initializes the router counter (step P-323). Next, the accumulated information control process part B102 initializes the collection counter (step P-324).
Then, the accumulated information control process part B102 sets input information to activate the correction information determination process (step P-325), and activates the correction information determination process conducted by the correction information determination process part B106 (step P-326).
In
Next, an ideal proper sampling value is acquired based on a result of an expected packet number obtained from the error rate which has been already determined, and is accumulated in the accumulation data D106 of the correction information (step P-701).
Subsequently, an inclination value (angle) of a current measurement result value is acquired from the CPU use rate of a previous measurement result value in the same time period, and a coefficient is also obtained with respect to the inclination value (step P-702).
Next, based on this current measurement result value, the correction information determination process part B106 activates the measurement information conformity process conducted by the measurement information conformity process part B107 (step P-703). A conformity check is performed with respect to the current measurement result value.
In
In a case of a calculation process of a past accumulation value (the correction control process is started next time), it is determined whether or not the CPU use rate of the proper value tends to increase more than a previous time period (step P-801).
If the CPU use rate tends to decrease, it is determined whether or not the packet number tends to increase more than a previous measurement result in the same time period (step P-802).
If the CPU use rate tends to increase, it is determined whether or not a measurement time result is delayed with respect to a required line of the distribution result (step P-803).
If the measurement time result is delayed, the conformity flag is set to make a sampling correction value directed to a dense direction, and a sampling coefficient value by an inclination value (angle) is also calculated (step P-804).
On the other hand, if the CPU use rate of the proper value tends to increase more than the previous time period, it is determined whether or not the packet number tends to increase more than the previous measurement result in the same time period (step P-805).
If the packet number tends to increase, it is determined with respect to the required line of the distribution result whether or not the measurement time result is delayed (step P-806).
On the other hand, if the measurement time result is delayed, the conformity flag is set to make the sampling correction value directed to a rough direction, and the sampling coefficient value is also calculated for each inclination value (angle) (step P-807).
Next, the measurement information conformity process part B107 sets the conformity flag (conformity state=1:ON) (step P-808), and terminates the measurement information conformity process.
Also, when it is determined by the above determination of the packet number (steps P-802 and P-805) that the packet number tends to decrease more than the previous measurement result in the same time period, or when it is determined by the above determination of a delay of the measurement time result (steps P-803 and P-806) that the measurement time result is not delayed, the measurement information conformity process part B107 sets the conformity flag (inconformity state=0:OFF) (step P-809), and terminates the measurement information conformity process. In this case, the special analysis process is conducted by the special analysis process part B108.
On the other hand, in the branch depending on the subject of the calculation area of the distribution information (step P-800), in a case of conducting the correction control process for the proper value and the current measurement result value (in a case in which the correction control process has been already started), a process is conducted for a correction adjustment between a proper value level being already fixed and a result being measured (
In
After that, it is determined whether the error rate (proper value), which has been already acquired, tends to increase more than a previous proper value result (step P-811).
If the error rate tends to decrease (is effective), it is determined that a sampling value result, which has been already applied, is appropriate, and it is determined whether or not an inclination value of the CPU use rate of the router is greater than the proper value result (step P-812).
If the inclination value of the CPU use rate is smaller, since it is determined that the CPU use rate tends to decrease, the sampling value applied by the proper value is retained (multiplication of an adjustment coefficient 1.0) (step P-813).
On the other hand, if the inclination value of the CPU use rate of the router is greater than the proper value result, since it is determined that an error rate is small and the CPU use rate tends to increase, the sampling value applied by using the proper value is multiplied with the adjustment coefficient which is selected so that the CPU use rate tends to increase and the sampling value becomes smaller (step P-814).
Subsequently, the conformity flag is set to “ON” (conformity=1) (step P-815). Returning to
On the other hand, in
If it is determined that the CPU use rate tends to decrease, since the error rate is great and the CPU use rate tends to decrease, a coefficient to make the sampling value applied by the proper value be dense is multiplied with the sampling value, and its result is set as the proper value (step P-817).
If it is determined that the inclination value of the CPU use rate of the router tends to increase, since the error rate is great and the CPU use rate tends to increase, a coefficient to make the sampling value applied by the proper value be rough is multiplied with the sampling value, and its result is set as the proper value (step P-818).
After that, the conformity flag is set to “OFF” (conformity=0) (step P-819). Returning to
In
If this check result indicates the conformity (conformity flag=ON:1), a final correction coefficient value is multiplied to the proper sampling value, and then, the sampling value for a next measurement is determined (step P-705). The correction information determination process part B106 stores its determination value in the accumulation data D106 of the correction information, and terminates the correction information determination process.
On the other hand, if the check result indicates nonconformity (conformity flag=OFF:0), the correction information determination process part B106 sets the special analysis flag (=1) for a correction value determination (step P-706), sets input information to activate the special analysis process (step P-707), and activates the special analysis process conducted by the special analysis process part B108 (step P-708).
In
In this determination, if the special analysis flag is “ON”, it is assumed that the special analysis process is required and the following special analysis is conducted.
First, the special analysis process part B108 branches depending on the calculation area of the distribution information of the traffic distribution calculation result data (step P-901).
In a case of a calculation process of the past accumulation value (the correction control process is started next time), past distribution result information is searched for, and the distribution result calculation process is repeated with respect to a region having outstanding value to be subject (step P-902). That is, the special analysis process part B108 conducts a process similar to the distribution result calculation process by the distribution result calculation process part B104.
Next, past distribution result information is searched for, and the distribution result determination process is repeated (step P-903). That is, the special analysis process part B108 conducts a process similar to the distribution result determination process conducted by the distribution result determination process part B105.
After that, the special analysis process part B108 accumulates a subject coefficient value of correction information for a future special analysis process in the accumulation data D106 of the correction information (step P-904).
Subsequently, the special analysis process part B108 sets input information to activate the special diagnosis process (step P-905), and activates the special diagnosis process conducted by the special diagnosis process part B109 (step P-906). The special diagnosis process is further conducted.
In a case of conducting the correction control for the proper value and the current measurement result (the correction control process has been already started), the distribution result calculation process is repeated with the distribution result information of previously determined outstanding values for an outstanding value determined by a current measurement (step P-907). That is, the special diagnosis process part B109 conducts a process similar to the distribution result calculation process conducted by the distribution result calculation process part B104.
Next, the distribution result determination process is repeated with the distribution result information of previously determined outstanding values for the outstanding value determined by the current measurement (step P-908). That is, the special diagnosis process part B109 conducts a process similar to the distribution information determination process by the distribution information determination process part B105.
After that, the special diagnosis process part B109 acquires the sampling coefficient value from calculation data and the like of an outstanding value group (a majority distribution and an average group thereof) obtained from the previous and current measurement results and accumulates the sampling coefficient value in the accumulation data D106 of the correction information (step P-909).
Subsequently, the special diagnosis process part B109 sets input information to activate the special diagnosis process (step P-910), and activates the special diagnosis process conducted by the special diagnosis process part B109 (step P-911). A further diagnosis process is conducted.
In
In a case of the calculation process of the past accumulation value (the correction control process is started next time), a check is conducted using the system schedule information D107 (step P-A01). In detail, the following processes are conducted.
On the other hand, in a case of conducting the correction control for the proper value and the current measurement result (the correction control process has been already started), future plan event information is read from the system schedule information D107, regarding the schedule and timetable for a distribution in interest, after the multiplication coefficient is acquired, set as a sampling correction value, and accumulated in the accumulation data D106 of the correction information to utilize for the next traffic collection result (step P-A02).
After that the special diagnosis process part B109 terminates the special diagnosis process and returns to the special analysis process conducted by the special analysis process part B108. Moreover, the special analysis process part B108 terminates the special analysis process and returns to the correction information determination process conducted by the correction information determination process part B106. Furthermore, the correction information determination process part B106 terminates the accumulated information control process conducted by the accumulated information control process part B102.
In
If all calculations have not ended, the accumulation information control process part B102 updates the collection counter (step P-328), and repeats from the process for setting input information to activate the correction information determination process (in the step P-325).
If all calculations end, the accumulation information control process part B102 determines whether or not all calculations end for all of the related routers (step P-329).
If all calculations have not ended for all of the related routers, the accumulation information control process part B102 updates the router counter (step P-330), and repeats from the process for initializing the collection counter (in the step P-324).
If all calculations end, the accumulation information control process part B102 terminates the accumulation information control process, and returns to the correction control process conducted by the correction control process part B100.
Returning to
As described above, with respect to all routers, for each collection time period, a degree of accuracy is finely defined, and the error rate is made to be gradually smaller and to be within a target value (for example, 5%).
By conducting the above-described processes, it is possible to acquire the distribution result whose accuracy is improved.
As described above, according to the embodiment, the following advantages can be achieved.
All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the invention and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions, nor does the organization of such examples in the specification relate to a showing of the superiority and inferiority of the invention. Although the embodiment(s) of the present invention has (have) been described in detail, it should be understood that the various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the invention.
This application is a U.S. continuation application filed under 35 USC 111(a) claiming benefit under 35 USC 120 and 365(c) of PCT application JP2008/055544, filed on Mar. 25, 2008. The foregoing application is hereby incorporated herein by reference.
Number | Date | Country | |
---|---|---|---|
Parent | PCT/JP2008/055544 | Mar 2008 | US |
Child | 12874358 | US |