Summary of the invention
In view of the weak point of above-mentioned prior art, the purpose of this invention is to provide a kind of management system that can receive and handle the device log that plurality of devices sends in real time.
According to a kind of journal management system of integrated network manager of the present invention, this system comprises:
A system journal module, has a syslog process module, be used for the device log that receiving equipment is sent, the forming device journal file, a system journal configuration module, be used for configuration-system daily record process module and one or more journal file module, be used to store the described equipment journal file that described syslog process module is sent;
An equipment log management system module, has a management system device log receiver module, with set up pipeline between the described journal file module and be connected, be used for receiving described equipment journal file simultaneously with the journal file module, a Log Administration System configuration module, be used to dispose described equipment log management system module, dynamically switching device log analysis processing mode;
Described equipment log management system module also comprises a log analysis processing module, be used for analyzing the device log of the equipment journal file that described management system device log receiver module received, an application process processing module, be connected with the application process module of one or more application systems, according to of the configuration of Log Administration System configuration module to described application process processing module, device log after the described log analysis processing module analyzing and processing is sent to the application process module of described application system, with a data library storage module, be used to store the device log after the described log analysis processing module analyzing and processing.
This management system can be handled the device log of all devices in real time as the equipment log management module of comprehensive network management.Flexible hand-off process mode.The coupling of reduction system is convenient to maintenance and expansion.The problems referred to above that prior art exists have been solved well.
Can receive device log in real time by the equipment log management system from various device, and according to the demand that is provided with of configuration file, other are handled, are transmitted to daily record data-in storehouse table use multiple processing modes such as processing, provide according to the method for various condition query device logs and the data that need to NMS user.Can make the user in time understand the ruuning situation of equipment.
Compare with foregoing two kinds of prior art schemes, the present invention has tangible advantage.This system can handle the device log of plurality of devices.Be fit to apply to the comprehensive network management platform or as independent device log center.This system can also can handle in real time to the device log that produces.Can make the user more in time, accurately grasp the ruuning situation of equipment.In addition, this system is flexible transformation mode that device log is handled as required, makes the information that the user can recognize to be needed.
This system has passed through strict unit testing and system testing, verifiedly can solve the defective that exists in the existing scheme well.And it is fast to show processing speed, superperformance easy to use.
Embodiment
Syslog is the general journal mechanism that UNIX provides.Its composition comprise one be configuration file (/etc/syslog.conf), be used for the record and the transmission of incidents such as control system login.The 2nd, system's monitoring program (syslogd) is used for from incidents such as reception of 514 ports and transmitting system logins.The representation that the classification of the message of syslog is adopted be facility.severity (function. safety), shown in following table 1, table 2.
The menu of table 1 syslog:
Equipment | The message explanation |
User | Produce by consumer process.This is the function of acquiescence: the message that all misfits with other functions of listing here all can be included into this class |
Kern | Produce by system kernel |
Mail | Produce by e-mail system |
Daemon | Produce by system's monitoring program |
Auth | Produce by authoring program login, su and getty |
Lpr | Produce by print system |
News | Produce by the UseNet information system |
Uucp | Produce by the UUCP system |
Cron | Produce by cron and at |
Local0-7 | Types by maximum 8 local definition produce, they be numbered 0 to 7 |
Mark | Produce by syslog oneself, for daily record covers timestamp |
The security level table of table 2 syslog:
Safety | Explanation |
Emerg | The most serious message is as shutdown system immediately |
Alert | Need the system mode of attention immediately |
Crit | Dangerous system mode, for example hardware or software failure |
Err | The other system mistake |
warning | Alert message |
Notice | The notice of noting after needing |
Info | Report property message |
Debug | The message that provides for debugging purpose |
The configuration file of syslog/etc/syslog.conf form is as follows:
#ident "@(#)syslog.conf 1.5 99/02/03 SMI"/
*SunOS 5.0
*/
#
#Copyright(c)1991-1999 by Sun Microsystems,Inc.
#
#syslog configuration file.
#
#This file is processed by m4 so be careful to quote(`′)names
#that match m4 reserved words.Also,within ifdefs,arguments
#containing commas must be quoted.
#
*.err;kern.notice;auth.notice /dev/sysmsg
*.err;kern.debug;daemon.notice;mail.crit /var/adm/messages
*.alert;kern.err;daemon.err operator
*.alert root
*.emerg *
#if a non-loghost machine chooses to have authentication messages
#sent to the loghost machine,un-comment out the following line:
#auth.notice ifdef(`LOGHOST′,/var/log/authlog,@loghost)
mail.debug ifdef(`LOGHOST′,/var/log/syslog,@loghost)
#
#non-loghost machines will use the follUowing lines to cause"user"′
#log messages to be logged locally.
#
ifdef(`LOGHOST′,,
user.err /dev/sysmsg
user.err /var/adm/messages
user.alert `root,operator′
vuser.emerg *
)
#HuaWei Device Area Begin
local0.debug /home/zhaohz/nmsdevlog/log/devlog0.log
local1.debug /home/zhaohz/nmsdevlog/log/devlog1.log
local2.debug /home/zhaohz/nmsdevlog/log/devlog2.log
local3.debug /home/zhaohz/nmsdevlog/log/devlog3.log
#HuaWei Device Area End
Multiplexing function select of the I/O of UNIX and poll.When TCP client handles two inputs simultaneously: standard input and TCP socket.The problem that may run into is that the client blocks that fgets calls in (standard input on) in this case, and server processes are killed.Though server TCP has sent out a FIN correctly for client TCP, client process is just blocking in reading in from the standard input, and it sees this EOF (may cross for a long time) up to read Shi Caineng from socket.At this moment need such ability: if when one or more I/O condition satisfies (for example: input has been ready to be read, and perhaps describing word can be accepted more output), system just is informed to.It is multiplexing that this ability is called as I/O, and function select and poll support that just this I/O is multiplexing.
I/O is multiplexing typically to be used in following network application occasion: when the client handles a plurality of describing word (generally being interactive input and network socket), must use I/O multiplexing; It is possible that a client handles a plurality of sockets simultaneously, need to use I/O multiplexing, but this situation seldom occurs; If a TCP server should be handled the monitoring socket, handle adapter sleeve interface again, it is multiplexing generally also will to use I/O; If a server should be handled TCP, handle UDP again, generally also to use I/O multiplexing; If a server will be handled a plurality of services or a plurality of agreement, generally to use I/O multiplexing.
Multiplexing function can be handled a plurality of incidents by poll, and the incident for needs are handled at first configures.Then, poll successively, if which incident is ready to and need have handled, select just begins to handle this incident.Select function permission process indication kernel is waited for any generation in a plurality of incidents, and only when one or more incidents take place or through ability wakeup process after certain fixed time.
Fig. 1 has represented first scheme of prior art.The daily record that this system utilizes syslog mechanism to send at device log foreground receiving equipment.By the time, import main control module immediately again.After handling by analysis,, deposit database in equipment journal file.Its shortcoming is because time-delay arranged, the operation that system can not real time reaction equipment.
Fig. 2 has represented another scheme of prior art.It is to have utilized the ftp agreement, in specific time, device log is passed to the device log center.User Catalog by appointment comes the forming device journal file, sends the malfunctioning module of a Trap message to network management system simultaneously, and malfunctioning module is transmitted to the device log module with information after receiving Trap.After the device log module received Trap message, the log information in the fetch equipment journal file was analyzed, is deposited equipment journal file in database then.This equipment log management system generally can only be applicable to a kind of device log of equipment.Can't distinguish the kind of device log at all.Therefore be not suitable for the unified management of multiple network equipment.
According to journal management system of integrated network manager of the present invention, the journal file that it has utilized function local0-7 among the syslog and level of security debug to define the receiving equipment daily record.Shown in above-mentioned file, the log information that equipment is sent is respectively in devlog0.1og, the devlog1.log under record/home/zhaohz/nmsdevlog/log catalogue, devlog2.log, the devlog3.log file.Relevant " tail-Of " order, promptly " tail-Of filename " is the sh order that UNIX provides.Its major function is to be that the file content of filename outputs in the standard output with name, and the content of filename file also can output to new content in the standard output when increasing.
Represented according to journal management system of integrated network manager of the present invention as Fig. 3.This system comprises unix syslog module 100 and equipment log management system 200.Unix syslog module 100 comprises syslog process module 10, system journal configuration module (not shown) and journal file module 20.Equipment log management system 200 comprises management system device log receiver module 30, Log Administration System configuration module 70, log analysis processing module 40, application process processing module 45 and database storage module 50.
The application process module of described application process processing module 45 and one or more application systems (for example, ATM webmaster application process module 60, access server webmaster application process module 61 and router applications process module 62) adopt multiplex mode to be connected, and adopt multiplex mode to send device log after the described analyzing and processing to the application process module of described application system.So-called multiplex mode is meant: for example use select and the multiplexing function of poll I/0, this function can be handled a plurality of incidents by poll, and the incident for needs are handled at first configures.Then, if which incident of poll is ready to and need have handled successively, select just begins to handle this incident.
The syslog mechanism that syslog process module 10 adopts unix system to provide receives the device log that all devices (for example ATM switch 1, access server 2, router three) is sent, and stores journal file module 20 into.
By the system journal configuration module unix syslog module is configured.The shell-command that management system device log receiver module 30 provides by unix system " tail-Of filename " is set up and is connected with the pipeline of equipment journal file module 20.Redirect the input that outputs to management system device log receiver module 30 of tail.Make the equipment log management system can receive the device log that all devices is sent in real time, so that log analysis processing module 40 is handled in real time to it.
Simultaneously, the equipment log management system provides acquiescence to write multiple processing modes such as database 50 and forwarding, will be written to database storage module 50 through the daily record data of log analysis processing module 40 analyzing and processing.The dynamic-configuration that the application process processing module is carried out according to 70 pairs of systems of Log Administration System configuration module, as required with the journal file data forwarding after the analyzing and processing to application process 60,61,62.These operations are dynamically controlled, are switched by Log Administration System configuration module configuration file.
Generally speaking, in the daily record data-in storehouse 50 after the equipment log management system will analyze.If the device log of certain equipment needs special processing.The application process module of this equipment (for example, ATM webmaster application process module 60, access server webmaster application process module and router applications process module 62) can be set up and being connected of application process processing module 45, and registers.If the application process processing module 45 of equipment log management system is judged the registration that this equipment is arranged in the registration table, the device log that just will belong to this equipment is transmitted to this application module and carries out special processing.The user can grasp the ruuning situation of equipment more timely and accurately like this, and recognizes the information that needs.
In the present invention, described application process processing module 45, whether the device log after the analyzing and processing is sent to the application process module (for example, ATM webmaster application process module 60, access server webmaster application process module and router applications process module 62) of application system according to Log Administration System configuration module decision.The application process module of described application process processing module and application system adopts multiplex mode to be connected, and adopts multiplex mode to send device log after the described analyzing and processing to the application process module of described application system.
Below systemic-function is described further.During equipment log management system start-up, configuration file in the fetch equipment Log Administration System configuration module 70 and unix syslog configuration file (/etc/syslog.conf).Like this, just can obtain processing mode to device log, and by the unix syslog configuration file (/etc/syslog.conf) in the local0-7.debug corresponding log filename of appointment.The realization of this function mainly is that the function that utilizes unix system the to provide branch that opens file reads configuration information, analyzes then, judges and draw the journal file name.
Utilizing UNIX order " tail-Of filename " to set up management system device log receiver module 30 is connected with the pipeline of each journal file 20.The realization of this function is to set up a pipeline by pipe (system call of UNIX), and the fork of system (UNIX sets up the system call of subprocess) goes out a subprocess then.In parent process, close the input descriptor, in subprocess, close the output descriptor, in subprocess, utilize dup2 (unix system calls) reproducing standards to be output as the input of pipeline in the subprocess simultaneously.Make the output of order " tail-Of filename " redirect to the input of pipeline.Therefore, management system device log receiver module 30 just can receive the device log of being sent by equipment (for example ATM switch 1, access server 2, router three) in real time.
(for example set up application process, ATM webmaster application process module 60, access server webmaster application process module and router applications process module 62) with being connected of equipment log management system applies process processing module 45, application process processing module 45 receives log-on messages.The realization of this function is to utilize interprocess communication, and as server, application process 60,61 and 62 is as client with the equipment log management system.Utilization socket (socket) connects.Equipment log management system applies process processing module 45 is set up a chained list, the adapter sleeve interface number and the device identification (sysobjectid) of record application process.
The scheduling feature of equipment log management system.This function realizes by I/O (I/O) multiplex mode.The pipeline of setting up between described management system device log receiver module 30 and the described journal file module 20 is connected, is the pipeline connection of multiplex mode.Described application process processing module 45 also adopts multiplex mode to be connected with the application process module 60,61 and 62 of application system.Be exactly to utilize select (function of UNIX) to wait for that a plurality of pipelines of foundation connect descriptors and are connected in the descriptor with socket specifically, any one incident takes place, and just handles accordingly.For example the ATM switch journal file arrives, and then wherein daily record is received, analyzes, handles and operation such as transmission.By this scheduling feature of the present invention, just realized real-time management simultaneously to the plurality of devices daily record.
The function of dynamic switching device log processing mode.The realization of this function mainly is by revising the configuration file of Log Administration System configuration module 70.Send the HUP signal to the equipment log management system process then, process reads configuration file again after receiving the HUP signal.Thereby play the effect that changes processing side, formula, in addition, the process that reads of this configuration file is that dynamic real-time ground carries out.Like this, under the situation of not interrupt system work, can revise configuration file as required flexibly, system dynamically reads configuration file, and according to the processing mode of the corresponding change daily record of configuration, thereby realized flexible switching to the log processing mode.
Protection range of the present invention is illustrated in the appended claims.But every within aim of the present invention, conspicuous modification is also due within protection scope of the present invention.