Summary of the invention
In view of the above problems, the present invention is proposed to provide a kind of overcoming the problems referred to above or the method for supervising of content distributing network solved the problem at least in part and supervisory control system.
According to one aspect of the present invention, provide a kind of method for supervising of content distributing network.This content distributing network comprises the multiple network nodes be associated with the webserver, the method comprises: obtain the access log before the appointment moment of the webserver, therefrom obtain network node and return Source log, return Source log according to network node and determine effective network node list; Active block node listing is sent to one or more monitor node, make each network node in one or more monitor node access active block node listing, and access log is monitored in record separately; And according to the monitoring access log that multiple monitor node records, determine abnormal network node listing; Each abnormal network node in traversal abnormal network node listing, search from the access log after appointment moment of the webserver whether there is this abnormal network node return Source log, if there is no, then this abnormal network node is deleted from abnormal network node listing.
Alternatively, obtain the access log before the appointment moment of the webserver, therefrom obtain network node to return Source log and comprise: travel through each access log before the appointment moment of the webserver obtained, judge whether this access log returns Source log as network node by the access links in this access log, retain, otherwise delete, thus acquisition network node returns Source log.
Alternatively, return Source log according to network node and determine that effective network node list comprises: network node is returned to each network node occurred in Source log, according to network node return Source log judge this network node return source number of times whether be less than preset value and last Hui Yuan whether before second specifies the moment, be judge that this network node is invalid, otherwise network node put into effective network node list.Wherein, second the moment is specified to be specify a time point before the moment.
Alternatively, according to the monitoring access log that multiple monitor node records, determine that abnormal network node listing comprises: for a network node, if the monitoring access log that one or more monitor node records shows, at least one monitor node accesses this network node abnormality, and the number of times of access exception reaches pre-determined number, then determine that this network node is abnormal network node, this node is put into abnormal network node listing.
Alternatively, multiple monitor node is the multiple monitor nodes being distributed in heterogeneous networks position.
According to a further aspect in the invention, provide a kind of supervisory control system of content distributing network, this supervisory control system comprises: one or more monitor node and monitoring server.Each monitor node is suitable for accessing each network node in active block node listing, and record monitoring access log, recorded monitoring daily record is returned to monitoring server; This monitoring server comprises: journal processing unit, is suitable for the access log obtained before the appointment moment of the webserver, therefrom obtains network node and returns Source log; Effective node determining unit, the network node being suitable for obtaining according to journal processing unit returns Source log and determines effective network node list; Monitor node linkage unit, active block node listing is suitable for send to one or more monitor node, and receive the monitoring access log that one or more monitor node returns, generate monitoring access log is accessed each network node in active block node listing during by monitor node; And abnormal nodes determining unit, be suitable for, according to monitoring access log, determining abnormal network node listing.
Alternatively, journal processing unit is suitable for the access log after the appointment moment of the acquisition webserver; Abnormal nodes determining unit is suitable for traveling through each abnormal network node in abnormal network node listing, from journal processing unit obtain the webserver the appointment moment after access log search whether exist this abnormal network node return Source log, if there is no, then this abnormal network node is deleted from abnormal network node listing.
Alternatively, journal processing unit is suitable for each access log traveled through before the appointment moment of the webserver obtained, judge whether this access log returns Source log as network node by the access links in this access log, retain, otherwise delete, thus acquisition network node returns Source log.
Alternatively, effective node determining unit is suitable for returning to network node each network node occurred in Source log, according to network node return Source log judge this network node return source number of times whether be less than preset value and last Hui Yuan whether before second specifies the moment, be judge that this network node is invalid, otherwise network node put into effective network node list.Wherein, second the moment is specified to be specify a time point before the moment.
Alternatively, the monitoring access log that abnormal nodes determining unit is suitable for recording at one or more monitor node shows, for a network node, at least one monitor node accesses this network node abnormality, and the number of times of access exception is when reaching pre-determined number, determine that this network node is abnormal network node, this node is put into abnormal network node listing.
Alternatively, multiple monitor node is distributed in different network sites.
According to the access log before appointment moment of this acquisition webserver of the present invention, therefrom obtain network node and return Source log, return Source log according to network node and determine effective network node list, active block node listing is sent to one or more monitor node, make each network node in one or more monitor node access active block node listing, and access log monitored in record separately, and, according to the monitoring access log that multiple monitor node records, determine the technical scheme of abnormal network node listing, can effectively monitor the abnormal network node of content distributing network, solve the monitoring problem of the abnormal network node in content distributing network thus, achieve the beneficial effect effectively content distributing network being carried out to maintenance and management.
Above-mentioned explanation is only the general introduction of technical solution of the present invention, in order to technological means of the present invention can be better understood, and can be implemented according to the content of specification, and can become apparent, below especially exemplified by the specific embodiment of the present invention to allow above and other objects of the present invention, feature and advantage.
Embodiment
Below with reference to accompanying drawings exemplary embodiment of the present disclosure is described in more detail.Although show exemplary embodiment of the present disclosure in accompanying drawing, however should be appreciated that can realize the disclosure in a variety of manners and not should limit by the embodiment set forth here.On the contrary, provide these embodiments to be in order to more thoroughly the disclosure can be understood, and complete for the scope of the present disclosure can be conveyed to those skilled in the art.
Fig. 2 shows the composition of the supervisory control system 200 of content distributing network according to an embodiment of the invention and outside connection diagram.Here content distributing network comprises in the multiple network nodes 320, Fig. 2 be associated with the webserver 310 incidence relation do not illustrated between the webserver 310 and network node 320.Network node 320 realizes the distribution of the service content provided with the webserver 310.The supervisory control system 200 of content distributing network comprises one or more monitor node 210 and monitoring server 220.The supervisory control system 200 of content distributing network realizes the monitoring management to each network node 320.
Fig. 3 shows the deployment schematic diagram of supervisory control system in real network of content distributing network according to an embodiment of the invention.See Fig. 3, in this network design schematic diagram, illustrate user terminal 110, CDN node 120, Web server 130, monitor node 210 and monitoring server 220.User terminal 110 obtains by CDN node 120 service that Web server 130 provides, CDN node 120 is for ensureing the ageing of the service that web server 130 provides, timer access web server 130, to ensure the consistency of the information in CDN node 120 and the information in web server 130, these CDN node 120 constitute a content distributing network.And the supervisory control system of monitor node 210 and monitoring server 220 constitution content distributing network, for realizing the monitoring to each CDN node 120.Here, Web server 130 is the webserver 310 in Fig. 2, and CDN node 120 is the network node 320 in Fig. 2.
Referring to Fig. 2 and Fig. 3, technical scheme of the present invention is described in detail.
See Fig. 2 and Fig. 3, the supervisory control system 200 of content distributing network comprises one or more monitor node 210 and monitoring server 220.Illustrate in fig. 2 in two monitor nodes 210, Fig. 3 and illustrate three monitor nodes 210, but this all can not as the restriction of the monitor node number in the supervisory control system to content distributing network of the present invention.
See Fig. 2, monitoring server 220 comprises journal processing unit 221, effectively node determining unit 222, monitor node linkage unit 223 and abnormal nodes determining unit 224.
Access log before the appointment moment that journal processing unit 221 obtains the webserver 310, therefrom obtains network node and returns Source log, use when determining effective network node list for effective node determining unit 222.
Specifically, journal processing unit 221 is suitable for each access log traveled through before the appointment moment of the webserver 310 obtained, judge whether this access log returns Source log as network node by the access links in this access log, retain, otherwise delete, thus acquisition network node returns Source log.
Such as, in the network design shown in Fig. 3, it is as follows that CDN node returns Source log example:
119.146.194.11121.8.137.56--[18/Sep/2012:23:59:59+0800]"GET/secache.html?39130838.html HTTP/1.1″20085861"-""Mozilla/4.0(compatible;MSIE8.0;Windows NT6.1;WOW64;Trident/4.0;SLCC2;.NETCLR2.0.50727;.NET CLR3.5.30729;.NET CLR3.0.30729;MAAR;.NET4.0C;.NET CLR1.1.4322;.NET4.0E;Media Center PC6.0;360SE)″"-"hao.360.cn75686138167984
Wherein " GET/secache.html 39130838.html HTTP/1.1 " represents the http request secache.html(page of access node, this page does not exist in fact, web server receives this request will return home tip), namely CDN node returns the http request that source request will send to web server as upper pathway.Because request is with timestamp parameter, and CDN node is not preserved corresponding page info, therefore request penetrates CDN node and directly accesses web server.
The log example of normal users request is as follows:
61.164.60.244175.180.112.40,203.66.41.51--[19/Sep/2012:00:00:00+0800]"GET/xinwenmeiti.html HTTP/1.1"20015886"http://hao.360.cn/""Mozilla/5.0(compatible;MSIE9.0;Windows NT6.1;WOW64;Trident/5.0;MAAU)""-"hao.360.cn702161377374
Above-mentioned daily record represents the normal http request xinwenmeiti.html page of http request, belongs to normal user request, not CDN node request.
Therefore, in the network design shown in Fig. 3, distinguish CDN node according to the access links in daily record and return Source log and other daily record.If the access links in daily record starts with secache.html, then this daily record is that CDN node returns Source log.As returned in the example of Source log in above-mentioned CDN node, access links is " GET/secache.html 39130838.html HTTP/1.1 ", and it starts with secache.html, therefore can confirm that this daily record is that CDN node returns Source log.And in the log example of above-mentioned normal users request, access links is " GET/xinwenmeiti.html HTTP/1.1 ", not with secache.html beginning, therefore not that CDN node returns Source log.Above to being whether that the judgement that CDN node returns Source log is only way of example, so the CDN node can distinguished in web server log returns the mode of Source log and general access log all within protection scope of the present invention.
In addition, first IP address in daily record is the IP address of visitor.Therefore confirming after CDN node returns Source log, CDN node is determined in first the IP address can returned in Source log according to CDN node.As returned in the example of Source log in above-mentioned CDN node, 119.146.194.11 is the IP address of CDN node.
The network node that effective node determining unit 222 is suitable for obtaining according to journal processing unit 221 returns Source log and determines effective network node list, and what comprise in active block node listing is the IP address of active block node.Specifically, effective node determining unit 222 is suitable for returning to network node each network node occurred in Source log, according to network node return Source log judge this network node return source number of times whether be less than preset value and last Hui Yuan whether before second specifies the moment, if it is judge that this network node is invalid, otherwise this network node is put into effective network node list, specifically effective network node list is put in the IP address of this network node.Wherein, second the moment is specified to be specify a time point before the moment.
Such as, in one embodiment of the invention, specify the moment to be the zero point of today, then second specify the moment be zero point today before sometime, such as, before can being zero point today moment of 1 hour, i.e. 23 points of yesterday.If the time of a last Hui Yuan of network node before 23 of yesterday, then illustrate this network node 23 of yesterday to zero point today during this period of time in there is no Hui Yuan, this network node may fail when zero point today.Therefore, by returning source number of times and whether be less than preset value and whether last Hui Yuan specifying judgment rule before the moment second, failed network node when effective node determining unit 222 can eliminate zero point today, thus unspent each network node when remaining into zero point today, these are the objects will monitored today to each network node unspent during zero point today.
Monitor node linkage unit 223 and the communication of each monitor node 210, issue the active block node listing that will monitor to each monitor node 210, and receive the monitoring access log that each monitor node reports.Specifically, active block node listing is sent to one or more monitor node 210 by monitor node linkage unit 223, and receive the monitoring access log that one or more monitor node 210 returns, generate monitoring access log is accessed each network node in active block node listing during by monitor node 210.
Each monitor node 210 is suitable for accessing each network node in active block node listing, and record monitoring access log, recorded monitoring daily record is returned to the monitor node linkage unit 223 in monitoring server 220.In Fig. 2, multiple monitor node 210 is distributed in different network sites.Specifically, each monitor node 210, after receiving the active block node listing issued, carries out the access of respective service to the all-network node in this active block node listing, and record monitoring daily record.Have recorded the abnormal conditions of access in monitoring daily record.
Abnormal nodes determining unit 224 is suitable for, according to monitoring access log, determining abnormal network node listing.Specifically, the monitoring access log that abnormal nodes determining unit 224 is suitable for recording at one or more monitor node shows, for a network node, at least one monitor node accesses this network node abnormality, and the number of times of access exception is when reaching pre-determined number, determine that this network node is abnormal network node, this node is put into abnormal network node listing.
In one embodiment of the invention, for a network node, abnormal nodes determining unit 224 can just determine that when a monitor node accesses this network node abnormality this network node is abnormal network node.Or consider that the position of different monitor nodes residing for it is different, some monitor node may be that the network environment residing for himself is poor and cause accessing the problem of this network node abnormality, in another embodiment of the present invention, abnormal nodes determining unit 224 can access this network node abnormality at multiple monitor node or even whole monitor node, and the number of times of access exception is when reaching pre-determined number, determine that this network node is abnormal network node.
Alternatively, abnormal nodes determining unit 224 can also determine abnormal network node further in conjunction with journal processing unit 221.First, journal processing unit 221 can also be suitable for the access log after the appointment moment of the acquisition webserver.Subsequently, abnormal nodes determining unit 224 is after as mentioned above according to monitoring access log determination abnormal network node listing, the each abnormal network node in abnormal network node listing can also be traveled through, from journal processing unit 221 obtain the webserver the appointment moment after access log search whether exist this abnormal network node return Source log, if there is no, then this abnormal network node is deleted from abnormal network node listing.Here, if what there is this abnormal network node in the access log after the appointment moment returns Source log, then show this abnormal network node still in a network not by undercarriage, illustrate that CDN does not also find this abnormal network node, therefore need the keeper to CDN to notify this abnormal network nodal information.Otherwise show this abnormal network node in CDN by normal undercarriage, so there is no necessaryly this network node to be placed in abnormal network node listing and to inform the keeper of CDN.
Thus, abnormal nodes determining unit 224 can be deleted further from abnormal network node listing, specifying after the moment to be found its network node that is abnormal and normal undercarriage.
Above-mentioned supervisory control system can be monitored the abnormal network node of content distributing network effectively, solve the monitoring problem of the abnormal network node in content distributing network thus, achieve the beneficial effect effectively content distributing network being carried out to maintenance and management.
Fig. 4 shows a kind of according to an embodiment of the invention flow chart of method for supervising of content distributing network.This content distributing network comprises the multiple network nodes be associated with the webserver.
The method for supervising of this content distributing network starts from step S410 as shown in Figure 4, the access log before the appointment moment obtaining the webserver in this step, therefrom obtains network node and returns Source log.
This step is time Source log filtering out network node from the daily record of the webserver.In one embodiment of the invention, obtain the access log before the appointment moment of the webserver, therefrom obtain network node to return Source log and comprise: travel through each access log before the appointment moment of the webserver obtained, judge whether this access log returns Source log as network node by the access links in this access log, retain, otherwise delete, thus acquisition network node returns Source log.
This step S410 can perform in the monitoring server 220 of the system above shown in Fig. 1, is specifically performed by journal processing unit 221 in monitoring server 220.
Subsequently in the step s 420, return Source log according to network node and determine effective network node list.
In one embodiment of the invention, return Source log according to network node and determine that effective network node list comprises: network node is returned to each network node occurred in Source log, according to network node return Source log add up this network node return source number of times whether be less than preset value and last Hui Yuan whether before second specifies the moment, be judge that this network node is invalid, otherwise network node put into effective network node list.Wherein, second the moment is specified to be specify a time point before the moment.
Such as, in one embodiment of the invention, specify the moment be the zero point of today, then second specify the moment be zero point today before sometime.Effective node determining unit 222 is unspent each network node before can determining zero point today, and these unspent each network nodes before zero point today are the objects will monitored today.Failed network node today is eliminated in the effect of this step S420 as far as possible.
This step S420 can perform in the monitoring server 220 of the system above shown in Fig. 1, is specifically performed by the effective node determining unit 222 in monitoring server 220.
In step S430, active block node listing is sent to one or more monitor node, make each network node in one or more monitor node access active block node listing, and access log monitored in record separately.
In one embodiment of the invention, each monitor node, after receiving the active block node listing issued, carries out the access of respective service to the all-network node in this active block node listing, and record monitoring daily record.Have recorded the abnormal conditions of access in monitoring daily record.The plurality of monitor node is the multiple monitor nodes being distributed in heterogeneous networks position.
This step S430 can perform in the monitoring server 220 of the system above shown in Fig. 1, is specifically performed by the monitor node linkage unit 223 in monitoring server 220.
In step S440, according to the monitoring access log that multiple monitor node records, determine abnormal network node listing.
In one embodiment of the invention, according to the monitoring access log that multiple monitor node records, determine that abnormal network node listing comprises: for a network node, if the monitoring access log that one or more monitor node records shows, at least one monitor node accesses this network node abnormality, and the number of times of access exception reaches pre-determined number, then determine that this network node is abnormal network node, this node is put into abnormal network node listing.
In one embodiment of the invention, for a network node, can just determine that when a monitor node accesses this network node abnormality this network node is abnormal network node.Or consider that the position of different monitor nodes residing for it is different, some monitor node may be that the network environment residing for himself is poor and cause accessing the problem of this network node abnormality, in another embodiment of the present invention, this network node abnormality can be accessed at multiple monitor node or even whole monitor node, and the number of times of access exception is when reaching pre-determined number, determine that this network node is abnormal network node.
This step S440 can perform in the monitoring server 220 of the system above shown in Fig. 1, is specifically performed by the abnormal nodes determining unit 224 in monitoring server 220.
In step S450, each abnormal network node in traversal abnormal network node listing, search from the access log after appointment moment of the webserver whether there is this abnormal network node return Source log, if there is no, then this abnormal network node is deleted from abnormal network node listing.
In this step S450, specify in the access log after the moment there is this abnormal network node return Source log, then show this abnormal network node still in a network not by undercarriage, otherwise show this abnormal network node normal undercarriage.Thus, can delete further from abnormal network node listing specifying after the moment to be found its network node that is abnormal and normal undercarriage.
This step S450 can perform in the monitoring server 220 of the system above shown in Fig. 1, is specifically performed by the abnormal nodes determining unit 224 in monitoring server 220.
Above step is only a kind of execution mode of the method for supervising of content distributing network of the present invention, and the inventive method can realize by other means.Especially, step S450 is optional step, if by the abnormal network node of normal undercarriage after not needing to confirm to specify the moment, then can not perform step S450, execution of step S440 is process ends just.
Above-mentioned method for supervising can be monitored the abnormal network node of content distributing network effectively, solve the monitoring problem of the abnormal network node in content distributing network thus, achieve the beneficial effect effectively content distributing network being carried out to maintenance and management.
It should be noted that:
Intrinsic not relevant to any certain computer, virtual system or miscellaneous equipment with display at this algorithm provided.Various general-purpose system also can with use based on together with this teaching.According to description above, the structure constructed required by this type systematic is apparent.In addition, the present invention is not also for any certain programmed language.It should be understood that and various programming language can be utilized to realize content of the present invention described here, and the description done language-specific is above to disclose preferred forms of the present invention.
In specification provided herein, describe a large amount of detail.But can understand, embodiments of the invention can be put into practice when not having these details.In some instances, be not shown specifically known method, structure and technology, so that not fuzzy understanding of this description.
Similarly, be to be understood that, in order to simplify the disclosure and to help to understand in each inventive aspect one or more, in the description above to exemplary embodiment of the present invention, each feature of the present invention is grouped together in single embodiment, figure or the description to it sometimes.But, the method for the disclosure should be construed to the following intention of reflection: namely the present invention for required protection requires feature more more than the feature clearly recorded in each claim.Or rather, as claims below reflect, all features of disclosed single embodiment before inventive aspect is to be less than.Therefore, the claims following embodiment are incorporated to this embodiment thus clearly, and wherein each claim itself is as independent embodiment of the present invention.
Those skilled in the art are appreciated that and adaptively can change the module in the equipment in embodiment and they are arranged in one or more equipment different from this embodiment.Module in embodiment or unit or assembly can be combined into a module or unit or assembly, and multiple submodule or subelement or sub-component can be put them in addition.Except at least some in such feature and/or process or unit be mutually repel except, any combination can be adopted to combine all processes of all features disclosed in this specification (comprising adjoint claim, summary and accompanying drawing) and so disclosed any method or equipment or unit.Unless expressly stated otherwise, each feature disclosed in this specification (comprising adjoint claim, summary and accompanying drawing) can by providing identical, alternative features that is equivalent or similar object replaces.
In addition, those skilled in the art can understand, although embodiments more described herein to comprise in other embodiment some included feature instead of further feature, the combination of the feature of different embodiment means and to be within scope of the present invention and to form different embodiments.Such as, in the following claims, the one of any of embodiment required for protection can use with arbitrary compound mode.
All parts embodiment of the present invention with hardware implementing, or can realize with the software module run on one or more processor, or realizes with their combination.It will be understood by those of skill in the art that the some or all functions that microprocessor or digital signal processor (DSP) can be used in practice to realize according to the some or all parts in the monitoring server of the content distributing network of the embodiment of the present invention and supervisory control system.The present invention can also be embodied as part or all equipment for performing method as described herein or device program (such as, computer program and computer program).Realizing program of the present invention and can store on a computer-readable medium like this, or the form of one or more signal can be had.Such signal can be downloaded from internet website and obtain, or provides on carrier signal, or provides with any other form.
The present invention will be described instead of limit the invention to it should be noted above-described embodiment, and those skilled in the art can design alternative embodiment when not departing from the scope of claims.In the claims, any reference symbol between bracket should be configured to limitations on claims.Word " comprises " not to be got rid of existence and does not arrange element in the claims or step.Word "a" or "an" before being positioned at element is not got rid of and be there is multiple such element.The present invention can by means of including the hardware of some different elements and realizing by means of the computer of suitably programming.In the unit claim listing some devices, several in these devices can be carry out imbody by same hardware branch.Word first, second and third-class use do not represent any order.Can be title by these word explanations.