Patent Application
20180062954
The present invention relates to a telegram analysis apparatus and a telegram analysis method and is suited for use in a telegram analysis apparatus and telegram analysis method for analyzing telegrams transmitted and received between systems.
In recent years along with widespread use of APM (Application Performance Management) tools, it has been expected to provide services with unprecedented operational levels, such as to acquire seamless statistic information of back-end systems from a large amount of web screens, and provide job analysis information. It is required, as preliminary steps before providing the above-described information, to accumulate data such as telegrams and SQL on the web, shorten customers' failure analysis information, and reduce the number of analysis processes.
For example, PTL 1 aims at promoting efficiency of maintenance work of, for example, network communication by referring to a mapping table in which, for example, the correspondence relationship between telegrams running through the network, associating telegrams such as web telegrams and SQL telegrams transmitted and received between servers with each other, and determining whether the telegrams are transmitted and received normally.
PTL 1: U.S. Pat. No. 5,420,112
When failure analysis, data analysis, and so on are performed, it is necessary to identify from which servers or applications the telegrams have been issued. However, the above-mentioned PTL 1 only associates the telegrams with each other and cannot identify issuing sources of the associated telegrams. Thus, it is necessary to identify tasks executed by each server by checking logs and tracing information of each server. Therefore, there is a problem of the incapability to shorten research time for failure analysis, data analysis, and so on.
The present invention was devised in consideration of the above-described circumstances and aims at proposing a telegram analysis apparatus and telegram analysis method capable of identifying the issuing sources of the telegrams on the basis of the relevance between the telegrams transmitted and received between the servers.
In order to solve the above-described problems, provided according to the present invention is a telegram analysis method for a telegram analysis apparatus for associating telegrams with each other, which are transmitted and received between a plurality of servers connected via a network apparatus, wherein the telegram analysis method includes: a step executed by the telegram analysis apparatus capturing packets transmitted and received between the servers; a step executed by the telegram analysis apparatus identifying protocols of the packets and a telegram type indicative of either a request telegram or a response telegram, and assembling the protocols into telegrams; and a step executed by the telegram analysis apparatus associating a plurality of telegrams with each other, which are transmitted and received between the respective servers on the basis of request receipt times and response receipt times of the telegrams.
In order to solve the above-described problems, provided according to the present invention is a telegram analysis apparatus including: a control unit that analyzes telegrams transmitted and received between a plurality of servers connected via a network apparatus; and a storage unit that stores an analysis result of the telegrams, wherein the control unit; captures packets transmitted and received between the servers; identifies protocols of the packets and a telegram type indicative of either a request telegram or a response telegram, and assembles the protocols into telegrams; and associates a plurality of telegrams with each other, which are transmitted and received between the respective servers on the basis of request receipt times and response receipt times of the telegrams.
In order to solve the above-described problems, provided according to the present invention is a telegram analysis system including: a plurality of servers connected via a network apparatus; and a telegram analysis apparatus that captures packets from the network apparatus, wherein the telegram analysis apparatus: identifies protocols of the captured packets and a telegram type indicative of either a request telegram or a response telegram, and assembles the protocols into telegrams; and associates a plurality of telegrams with each other, which are transmitted and received between the respective servers on the basis of request receipt times and response receipt times of the telegrams.
According to the present invention, the system can be visualized without making changes to the servers or telegrams by identifying the issuing sources of the telegrams on the basis of the relevance between the telegrams transmitted and received between the servers.
An embodiment of the present invention will be explained in detail below with reference to the drawings.
Firstly, the outline of the present embodiment will be explained. Recently, there have been demands to accumulate data such as telegrams and SQL on the web, shorten clients' failure analysis information, and reduce the number of analysis processes. Thus, the present embodiment makes it possible to visualize a system without adding any changes to servers or telegrams by identifying issuing sources of the telegrams on the basis of the relevance between the telegrams transmitted and received between the servers.
For example, when any problem such as a response delay occurs in a web system, it is necessary to identify a server or task which had the problem. In the present embodiment, the issuing sources of the telegrams are identified by analyzing protocols and telegram types of the telegrams (packets) running between the respective servers in the web system and associating the telegrams with each other.
Specifically speaking, examples of servers for the web system include web servers, AP servers, and DB servers: and packets running between the respective servers are captured by utilizing a mirroring function of network switches located between a client and a web server, between the web server and an AP server, and between the AP server and a DB server. Then, telegrams are assembled by identifying the protocols of the packets and the telegram type (either a request telegram or a response telegram) and the telegrams are associated with each other on the basis of request telegram receipt times and the response telegram receipt times of the assembled telegrams. According to the present embodiment as described above, it becomes possible to identify the issuing sources of the telegrams on the basis of telegram associating information without adding any changes to the servers or the telegrams and shorten research time for failure analysis, data analysis, and so on.
Furthermore, in the present embodiment, an application which has issued the relevant telegram is also identified on the basis of key information included in the telegram. It becomes possible to execute, for example, more detailed failure analysis and data analysis by associating applications with each other by combining the above-mentioned telegram associating information with information about the applications which have issued the telegrams.
Next, a hardware configuration of a telegram analysis apparatus 100 will be explained with reference to
An explanation will be given below about a case where the telegram analysis apparatus 100 analyzes telegrams running through the web system; however, without limitation to such an example, the telegrams can be analyzed by applying the present invention to a system other than the web system as long as there are three or more types of devices including the client 10 and the telegrams between the devices are according to protocols for transmitting request and response telegrams. For example, the present invention can be applied to an OLTP (Online Transaction Processing) system.
Referring to
The CPU 110 functions as an arithmetic processing unit and a control apparatus and controls the entire operation of the telegram analysis apparatus 100 in accordance with various programs.
The input device 120 is composed of, for example, input means for a user to enter information such as a mouse, a keyboard, a touch panel, buttons, a microphone, switches, and levers and an input control circuit for generating an input signal according to the user's inputs and outputting the input signal to the CPU 110.
The output device 130 is composed of, for example, display devices such as a CRT (Cathode Ray Tube) display device, a liquid display (LCD) device, an OLED (Organic Light Emitting Display) device, and lamps and sound output devices such as a speaker and a headphone.
The communication device 140 is, for example, a communication interface composed of a communication device for connecting to a network. Moreover, the communication device 140 may be a wireless LAN (Local Area Network) compatible communication device, a wireless USB compatible communication device, or a wired communication device for performing wired communication.
The storage device 150 is storage media such as a RAM (Read Access Memory) and a ROM (Read Only Memory). The storage device 150 stores a processing unit 160 storing programs for executing various processing and a storage unit 170 storing various data and tables, etc.
Next, a functional configuration of the telegram analysis apparatus 100 will be explained with reference to
Referring to
The packet capturing unit 151 acquires packets running between the respective servers and provides the telegram assembling/analysis unit 152 with the acquired packets. Referring to
The telegram assembling/analysis unit 152 assembles a telegram by identifying a protocol and telegram type of the relevant packet and acquires request telegram receipt time and response telegram receipt time of the assembled telegram. Specifically speaking, the telegram assembling/analysis unit 152 identifies the protocol and the telegram type of the packet on the basis of a source IP address and a destination IP address included in the telegram by referring to the telegram protocol list 155 prepared in advance. The telegram type means whether the target telegram is a request telegram or a response telegram.
Now, the telegram protocol list 155 will be explained with reference to
The source IP address 1551 is information about a source of the relevant packet and the destination IP address 1552 is information about a destination of the relevant packet. The protocol 1553 is a protocol between the relevant servers and includes, for example, an http protocol between the client 10 and the web server 20, an AJP protocol between the web server 20 and the AP server 30, and an SQL protocol between the AP server 30 and the DB server 40. The type 1554 shows the type of the relevant telegram and examples of the type include a request telegram and a response telegram.
The telegram assembling/analysis unit 152 extracts the source IP address and the destination IP address of the acquired packet and identifies the protocol and the type corresponding to the extracted IP addresses by referring to the telegram protocol list 155. For example, when the source IP address is “2.2.2.2” and the destination IP address is “3.3.3.3,” the protocol can be identified as “AJP” and the type can be identified as a “request.”
Then, the telegram assembling/analysis unit 152 identifies the protocol and the type, assembles the packet into a telegram, acquires the request receipt time and the response receipt time of the assembled telegram, and stores them in the list of telegrams under analysis 157.
The telegram associating unit 153 associates telegrams with each other on the basis of request telegram receipt times and response telegram receipt times of the telegrams assembled by the telegram assembling/analysis unit 152. Specifically speaking, the telegram associating unit 153 compares the request telegram receipt times and the response telegram receipt times of the respective protocols which are stored in the list of telegrams under analysis 157 and determines that the http protocol, the AJP protocol, and the SQL protocol which satisfy the following Condition 1 and Condition 2 are related to each other.
(Condition 01) An AJP telegram whose request and response times are acquired between the request and response times of an http telegram
(Condition 02) An SQL telegram whose request and response times are acquired between the request and response times of the kW telegram
Associating telegrams by the telegram associating unit 153 will be explained with reference to
As shown in the explanatory diagram 210 of
Therefore, http1, AJP1, SQL1 and SQL2 can be associated with each other; and the explanatory diagram 211 of
Furthermore, the telegram associating unit 153 identifies applications which have issued telegrams on the basis of key information included in the telegrams. Specifically speaking, the telegram associating unit 153 associates the applications by referring to the application list 156 prepared in advance. The application list 156 and the association between the applications will be explained later in detail.
The telegram association result display unit 154 displays the results of telegram association by the telegram associating unit 153 on a display screen in response to the user's request. The telegram association result display unit 154 displays the associated telegrams on an http request basis. As a result, the user can get a full picture of the captured http telegrams.
It is also possible to identify, for example, a problematic task(s) from information of the applications corresponding to http telegrams by chronologically displaying AJP telegrams and SQL telegrams which are associated with http requests and displaying detailed information about each telegram. Display screen examples displayed by the telegram association result display unit 154 will be explained later hi detail. Incidentally, in the present embodiment, the telegram association result display unit 154 is a component of the telegram analysis apparatus 100; however, the invention is not limited to this example and the telegram association result display unit 154 may be configured as a display device separate from the telegram analysis apparatus 100.
Next, the details of telegram associating processing by the telegram associating unit 153 will be explained with reference to
When it is determined in step S102 that the http response telegram is received, the telegram associating unit 153 executes processing in step S104 and subsequent steps. On the other hand, when it is determined in step S102 that the http response telegram has not been received yet, the telegram associating unit 153 generates a pair of an AJP telegram and an SQL telegram (S103).
When the telegram received in step S103 is a request telegram, the telegram associating unit 153 stores the request telegram until it receives a response telegram which forms a pair with the request telegram. Then, when the received telegram is a response telegram, the telegram associating unit 153 generates a telegram pair by pairing the response telegram with the target request telegram if the following conditions are satisfied.
(Condition 11) Receipt time is earlier than that of the target response telegram.
(Condition 12) Source IP address of the target response telegram=destination IP address of the request telegram
(Condition 13) Destination IP address of the target response telegram=source IP address of the request telegram
In step S104, the telegram associating unit 153 searches for a pair for the received http response telegram and generates an http telegram pair in the same manner as in step S103 above (S104).
The telegram associating unit 153 searches for an MP telegram pair to be associated with the http telegram pair generated in step S104 (S105). Specifically speaking, the telegram associating unit 153 searches for the MP telegram pair to be associated with the http telegram pair under the following search conditions.
(Condition 21) Request telegram receipt time of the target http telegram pair<request telegram receipt time of AJP telegram pair
(Condition 22) Response telegram receipt time of the target http telegram pair>response telegram receipt time of kW′ telegram pair
(Condition 23) Destination IP address of the http request telegram=source IP address of AJP telegram
Subsequently, the telegram associating unit 153 searches for an SQL telegram pair to be associated with the AJP telegram pair associated with the target http telegram pair in step S105 (S106). Specifically speaking, the telegram associating unit 153 searches for the SQL telegram pair to be associated with the AJP telegram pair under the following search conditions.
(Condition 31) Request telegram receipt time of AJP telegram pair<request telegram receipt time of SQL telegram pair
(Condition 32) Response telegram receipt time of AJP telegram pair>response telegram receipt time of SQL telegram pair
(Condition 33) Destination IP address of AJP request telegram=source IP address of SQL telegram
The telegram associating unit 153 associates the target http telegram pair with the AJP telegram pair and the SQL telegram pair, which are found by the searches in step S105 and step S106, and stores them in the analyzed telegram list 158 (S107).
Next, the association between applications will be explained with reference to
The application list 156 will be explained with reference to
Regarding the key information 1563, for example, a URL may be key information for an http telegram, an application name on an AP server may be key information for an AJP telegram, and a database name on a DB server may be key information for an SQL telegram.
Next, the details of the application associating processing by the telegram associating unit 153 will be described with reference to
Specifically speaking, for example, when “http: XX/YY/ZZ” is included in an http request telegram, the telegram associating unit 153 identifies that an application which is its issuing source is “HTTP_APP_USER_ADD.” Furthermore, when “ajp_app_put_user” is included in an AJP request telegram, the telegram associating unit 153 identifies that an application which is its issuing source is “WEB_APP_USER_ADD,” Furthermore, when “USER_LIST” is included in an SQL request telegram, the telegram associating unit 153 identifies that an application is “ajp_app_put_user.” Then, the telegram associating unit 153 associates these identified applications with each other and stores them.
Next, display examples of the telegram and application association results by the above-mentioned telegram associating processing will be explained.
The http request list display example 303 displays starting time, ending time, a source IP address, a destination IP address, and key information of the relevant http protocol extracted from the analyzed telegram list 158. Moreover, when response time (ending time−starting time) of the protocol exceeds a specified threshold value, “Y” indicating that the response time exceeds the threshold value may be displayed in a threshold value excess column. The user can get a full picture of the captured http telegrams and which http telegram(s) had a problem, according to the http request list display example 303.
If the user wishes to check AJP telegrams and SQL telegrams associated with the http telegrams displayed on the http request list display example 303, the user selects a time-series display 302. When the time-series display 302 is selected by the user, the telegram association result display unit 154 extracts AJP telegrams associated with the http telegrams and also extracts SQL telegrams associated with the AJP telegrams from the analyzed telegram list 158 and displays the associated telegrams on the time-series display screen 310 on a time axis basis.
The time-series display screen 310 displays the http telegrams, the AJP telegrams, and the SQL telegrams so that the association between them can be recognized as illustrated in
Furthermore, when any one of the associated telegram display frames displayed on the time-series display screen 310 is selected by the user, the telegram association result display unit 154 displays a detailed telegram display screen 320 which displays the details of the selected telegram and an application corresponding to the selected telegram.
Referring to
You can tell from
According to the present embodiment, the protocol of the relevant packet transmitted and received between the respective servers and its telegram type indicating whether it is a request telegram or response telegram are identified, the protocol is assembled into a telegram, and a plurality of telegrams transmitted and received between the respective devices are associated with each other on the basis of request receipt times and response receipt times of the telegrams. As a result, the issuing sources of the telegrams can be identified on the basis of the relevance between the telegrams transmitted and received between the servers and the system can be visualized without adding changes to the servers or the telegrams.
For example, any delayed telegram(s) can be recognized on the time-series display screen 310 illustrated in
Since the IP address of a machine with a problem can be identified from the detailed application information in
The first embodiment has been described about the case where there are only one http telegram and one AJP telegram in the same time slot; however, in the present embodiment, an explanation will be given about a case where there are pluralities of http telegrams and AJP telegrams in the same time slot. When there are pluralities of http telegrams and AJP telegrams in the same time slot, the association between telegrams cannot be sometimes uniquely decided. The case where the association between telegrams cannot be uniquely decided will be explained with reference to
For example, when request-to-response receipt time of http1 overlaps with request-to-response receipt time of http2 as illustrated in
Incidentally, since the telegram analysis apparatus 100 according to the present embodiment has the same configuration as that of the first embodiment, any detailed explanation about it has been omitted. In the following explanation, the details of telegram associating processing by the telegram associating unit 153 which is different from the first embodiment will be explained,
The telegram associating processing explained below is premised on that functions which call applications have no difference in the same applications even if telegrams which call those applications are different from each other. That is, the present embodiment is based on the premise that a telegram issued from an application 1 is associated with a telegram issued from an application 2.
The outline of the telegram associating processing according to the present embodiment will be explained with reference to
Under this circumstance, it is assumed that applications of AJP2′ and AJP2 are the same application and applications of SQL1 and SQL1 are the same application. In this case, if the association between AJP2′ and SQL1 is confirmed, it is possible to confirm the association between AJP2′ and SQL1′ which has been unconfirmed.
Accordingly, in the present embodiment, even when the request-to-response receipt time overlaps with that of another telegram and the association between the telegrams cannot be thereby uniquely decided, the relevant telegrams can be associated with each other by utilizing a combination of applications for other telegrams,
The details of the telegram associating processing according to the present embodiment will be explained with reference to
Referring to
The association list 451 is a list for managing applications related to the associated telegrams as “related applications”; and an association number 4510, an association status 4511, related application No. 1 4512, related application No. 2 4513, and a telegram number combination 4514 are associated with each other as illustrated in
The association number 4510 is the number indicative of an association item number. The association status 4511 is information indicating whether the association is confirmed or unconfirmed. The related application No. 1 4512 and the related application No. 2 4513 are numbers for identifying applications included in the associated telegrams. The telegram number combination 4514 is information indicating a combination of the associated telegrams. The combined telegrams in the telegram number combination 4514 are stored as the same combination when the application information of two associated telegrams is identical to each other.
When the associating unit 153 captures new telegrams and associates the telegrams with each other as described above, it registers a combination of the telegram numbers of the associated telegrams in the association list 451. When the telegram numbers of the associated telegrams are paired and the application information of the two associated issuing sources is identical to each other, the combination of the telegram numbers is registered in the telegram number combination 4514.
The application list 452 is a list for managing the detailed information about applications and an application number 4520, a source IP address 4521, a destination IP address 4522, a telegram protocol 4523, and key information 4524 are associated with each other as illustrated in
The application number 4520 is a number for identifying an application included in the captured telegram. The source IP address 4521 is information about a source IP address of a telegram which is an issuing source of the application. The destination IP address 4522 is information about a destination IP address of the telegram which is the issuing source of the application. The protocol 4523 is information about a protocol type of the telegram which is the issuing source of the application. The key information 4524 is key information of the relevant application.
The telegram list 453 is a list of captured telegrams and a telegram number 4530, request telegram receipt time 4531, response telegram receipt time 4532, an application number 4533, and an association number 4534 are associated with each other as illustrated in
The telegram number 4530 is a number for identifying the captured telegram. The request telegram receipt time 4531 is receipt time of a request telegram and the response telegram receipt time 4532 is receipt time of a response telegram. The application number 4533 is a number for identifying an application which is identified on the basis of the key information included in the telegram. The association number 4534 is a number indicative of the association item number of the association list 451.
Referring back to
In step S203, the associating unit 153 determines whether the association between telegrams which are the current targets to be associated with each other is confirmed or not (S203). If it is determined in step S203 that the association between telegrams which are the current targets to be associated with each other cannot be uniquely decided and is unconfirmed, the associating unit 153 adds the combination of the telegram numbers to the telegram number combination 4514 of the association list 451 (S206).
Meanwhile, if it is determined in step S203 that the association between the telegrams which are the current targets to be associated with each other is confirmed, the associating unit 153 determines whether the same association in the association list 451 is confirmed or not (S204). Specifically speaking, the associating unit 153 refers to the association list 451 and checks if the association status of the same association number as that of the current associated telegrams is “confirmed” or “unconfirmed.”
If it is determined in step S204 that the same association in the association list 451 is confirmed, the associating unit 153 adds the combination of the telegram numbers of the current associated telegrams to the telegram number combination 4514 of the association list 451 (S206).
On the other hand, if it is determined in step S204 that the same association in the association list 451 is unconfirmed, the associating unit 153 changes “unconfirmed” in the corresponding association status 4511 to confirmed (S205) and adds the combination of the telegram numbers of the current associated telegrams to the telegram number combination 4514 of the association list 451 (S206).
For example, let us assume that telegram list No. 5 and telegram list No. 6 in the telegram list 453 in
Then, the association list 451 in
When there are pluralities of http telegrams and AJP telegrams in the same time slot as described above and even if the association between the telegrams cannot be uniquely decided, the association between the telegrams can be uniquely decided on the basis of the correspondence relationship between the applications according to the present embodiment. As a result, it becomes possible to enhance the accuracy of the association between the telegrams and execute, for example, more detailed failure analysis and data analysis.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2015/064831 | 5/22/2015 | WO | 00 |
