JP2005327261A - Performance monitoring device, performance monitoring method and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To accurately detect or predict a complicated failure which may be generated in an information processing system in which a plurality of information processors operate in cooperation, for example, shortage of resources such as a memory to the number of generation of load distribution of processing and transactions between the information processors, etc. <P>SOLUTION: A monitoring data acquisition part 1001 acquires monitoring data indicating operation states of the plurality of information processors and data communication states of each communication line which connects between the plurality of information processors, a failure detection/prediction part 1006 detects the failure which is generated in the information processing system at present or predicts probability that the failure is generated in the information processing system in the future based on the monitoring data acquired by the monitoring data acquisition part 1001. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a performance monitoring apparatus, a performance monitoring method, and a program for monitoring the operation of an information processing system in which a plurality of information processing apparatuses operate in cooperation and detecting or predicting the occurrence of a failure in the information processing system.

  Conventionally, a method for monitoring a failure of an apparatus or a method for performing operation management has been proposed. For example, in Patent Document 1, a table storing a failure occurrence prediction algorithm and failure detection parameters is stored in a memory, and a customer name, product name, model number, maintenance history, failure history, and the like are stored in a database. Disclosed is a system that sends a notification e-mail when each information stored in the database using the failure prediction algorithm and stored in the database satisfies the failure condition. ing. Further, Patent Document 2 discloses an apparatus for actively collecting and analyzing the hardware state / program operating status and giving an instruction to avoid a failure when there is a risk of causing an operational trouble. ing.

JP 2001-84276 A JP 9-31733 A

  The invention disclosed in Patent Document 1 predicts the occurrence of a failure by monitoring a specific device, but assumes that the monitoring target is only the device itself. For example, in the case of a system in which a plurality of functions operate in a coordinated manner, such as a web system having a three-layer structure including a web server, an application server, and a database server, a memory is distributed for processing load distribution between devices and the number of transactions Although a failure due to various causes such as a shortage of resources is predicted, the invention disclosed in Patent Document 1 does not take this point into consideration at all.

  In the invention disclosed in Patent Document 2, the information collection unit collects information based on the hardware / software operation information to be collected stored in the knowledge base storage device, and uses the collected information. It outputs instructions to be dealt with based on empirical rules. Also in the case of the invention disclosed in Patent Document 2, the monitoring target is only the computer itself, and there is no description of the above-described failure that may occur in a system in which a plurality of computers operate in cooperation. .

  As described above, the conventional monitoring / operation management system was able to monitor each computer itself, but it became complicated by the fact that multiple computers like today operate in a coordinated fashion. The prediction of failure occurrence is not assumed, and it has often been difficult or time-consuming to detect and predict failures and to determine the cause in monitoring for complex computer systems.

  Accordingly, an object of the present invention is to provide information processing in which a plurality of information processing devices operate in a coordinated manner, for example, there is a shortage of resources such as memory for processing load distribution among the information processing devices and the number of transactions generated. It is to be able to accurately detect or predict a complicated failure that may occur in the system.

  The performance monitoring device of the present invention is a performance monitoring device that monitors the performance of an information processing system in which a plurality of information processing devices operate in cooperation, and the operating status of the plurality of information processing devices and the plurality of information Monitoring means for monitoring the data communication status of each communication line connecting between processing devices, and detecting a fault currently occurring in the information processing system based on monitoring data by the monitoring means, or the information processing system And a failure detection / prediction means for predicting the possibility of a failure occurring in the future.

  The performance monitoring method of the present invention is a performance monitoring method by a performance monitoring device that monitors the performance of an information processing system in which a plurality of information processing devices operate in cooperation, and the operating status of the plurality of information processing devices, and A monitoring step of monitoring the data communication status of each communication line connecting the plurality of information processing devices, and based on monitoring data by the monitoring step, detecting a fault currently occurring in the information processing system, or And a failure detection / prediction step for predicting a possibility that a failure will occur in the information processing system in the future.

  The program according to the present invention causes a computer to execute the performance monitoring method.

  According to the present invention, by monitoring the operating status of a plurality of information processing devices constituting an information processing system and the data communication status of each communication monitoring connecting the plurality of information processing devices, for example, the information processing device If the processing between them is operating normally, the resources that can be used are more or less than the resources that should be used for the transaction volume that occurs. By detecting which server is running, it is possible to know which part of the system consisting of multiple information processing devices has a fault, and for an information processing system in which multiple information processing devices operate in cooperation It is possible to accurately detect or predict a complicated failure that may occur.

  Hereinafter, a preferred first embodiment to which the present invention is applied will be described in detail with reference to the accompanying drawings.

  FIG. 1 is a diagram schematically showing a configuration of a performance monitoring system according to the first embodiment of the present invention. In FIG. 1, the performance monitoring system of this embodiment includes a performance monitoring device 10, a Web server 11, an AP (application) server 12, and a DB (database) server 13. The performance monitoring apparatus 10 is connected to an information processing system including a Web server 11, an AP server 12, and a DB server 13 via a communication line such as a LAN (Local Area Network), and the state of each server is checked via this communication line. It is possible to monitor.

  The performance monitoring apparatus 10 according to the present embodiment includes a storage server 101 and an analysis server 102, and the storage server 101 monitors the usage of each resource such as a CPU and a memory by monitoring each server. Acquire log data indicating the data and processing history, etc., and acquire transaction data indicating the throughput, processing name, etc. of transactions communicated with each communication line connecting the Web server 11, AP server 12, and DB server 13. , Each is stored inside as monitoring data. In addition, as information that can be acquired from either monitoring of the server or monitoring of the communication line, a response time for a certain processing command is also stored. Based on the monitoring data stored in the storage server 101, the analysis server 102 detects a failure that currently occurs in the information processing system or predicts a failure that may occur in the information processing system in the future.

  As described above, in the present embodiment, the monitoring target of the performance monitoring apparatus 10 is the operation status of each of the plurality of devices and the data communication status of each communication line connecting the devices, whereby the plurality of information processing devices cooperate. Thus, it is possible to accurately detect or predict a failure that occurs in an information processing system that operates in the same manner.

FIG. 2 is a diagram schematically showing a hardware configuration of a computer system in the performance monitoring apparatus 10 (accumulation server 101, analysis server 102).
As shown in FIG. 2, the computer system 1200 includes a CPU 1201, a ROM 1202, a RAM 1203, a keyboard controller (KBC) 1205 of a keyboard (KB) 1209, a CRT controller (CRTC) 1206 of a CRT display (CRT) 1210 as a display unit, A disk controller (DKC) 1207 of a hard disk (HD) 1211 and a flexible disk (FD) 1212 and a network interface card (NIC) 1208 for connection to the network 1220 are communicably connected to each other via a system bus 1204. The configuration is made.

  The CPU 1201 executes software that reads information from the ROM 1202 or the HD 1211 and the like, thereby comprehensively controlling each component connected to the system bus 1204, and executes processing shown in FIGS.

  A RAM 1203 functions as a main memory or work area of the CPU 1201. The KBC 1205 controls instruction input from the KB 1209, a pointing device (not shown), or the like. A CRTC 1206 controls display on the CRT 1210. The DKC 1207 controls access to a boot program, various applications, edit files, user files, and a network management program. The NIC 1208 controls transmission / reception of data between the Web server 11, the AP server 12, the DB server 13, and a communication line connecting the servers and the performance monitoring apparatus 10.

FIG. 3 is a block diagram illustrating a functional configuration of the performance monitoring apparatus 10 (the accumulation server 101 and the analysis server 102).
The performance monitoring apparatus 10 includes a monitoring data acquisition unit 1001, a monitoring data storage unit 1002, an abnormality detection unit 1003, a correlation extraction unit 1004, a correlation storage unit 1005, a failure detection / prediction unit 1006, and a notification unit 1007. The monitoring data acquisition unit 1001 is configured by, for example, the CPU 1201, a program in the ROM 1202, and the NIC 1208. The abnormality detection unit 1003, the correlation extraction unit 1004, and the failure detection / prediction unit 1006 are configured by, for example, the programs in the CPU 1201 and the ROM 1202. The monitoring data storage unit 1001 and the correlation storage unit 1004 are configured by, for example, a recording medium such as a RAM 1203 and an HD 1211, and the notification unit 1007 is configured by, for example, a CPU 1201, a CRTC 1206, and a CRT 1210.

  The monitoring data acquisition unit 1001 acquires resource usage status data and log data from the Web server 11, AP server 12, and DB server 13, and transaction data from a communication line connecting the servers. Although not shown, the log data of the AP server 12 and the DB server 13 may be stored in the AP server 12 or the DB server 13 or may be stored in a log storage server provided separately. The acquisition unit 1001 acquires this log data by ftp or the like via a communication line. If the AP server 12 or the DB server 13 has a function of transmitting log data, the monitoring data acquisition unit 1001 may take a method of passively acquiring log data. The monitoring data storage unit 1002 accumulates the monitoring data acquired so far by the monitoring data acquisition unit 1001.

  The abnormality detection unit 1003 reads monitoring data from the monitoring data storage unit 1002 and detects an abnormality in the information processing system based on the read monitoring data. The correlation extraction unit 1004 reads two types of monitoring data from the monitoring data storage unit 1002 and determines the correlation. Although details of this correlation will be described later, the correlation extraction unit 1004 obtains a correlation when the information processing system is operating normally and a correlation when an abnormality occurs in the information processing system. It should be noted that there may be a plurality of correlations created based on a set of monitoring data, both at normal times and at abnormal times. The correlation storage unit 1005 stores the correlation obtained by the correlation extraction unit 1004 with an ID assigned thereto.

  The failure detection / prediction unit 1006 detects a failure currently occurring in the information processing system or predicts a failure that may occur in the information processing system in the future. That is, the failure detection / prediction unit 1006 correlates the above two types of monitoring data when the information processing system is operating normally, and the latest two types of monitoring data accumulated in the monitoring data storage unit 1002. And the correlation between the two types of monitoring data when a failure currently occurring in the information processing system is detected, or when an abnormality occurs in the information processing system, and the two types recently obtained A failure that may occur in the information processing system in the future is predicted based on the similarity with the correlation of the monitoring data.

  The notification unit 1007 notifies the contents when a failure occurrence is detected by the failure detection / prediction unit 1006 or when a failure occurrence is predicted. As a notification method of the present embodiment, the notification unit 1007 notifies the operator of the detected content or the predicted content by screen display, but as another embodiment, a notification method using e-mail or the like may be used.

  In this embodiment, the monitoring data acquisition unit 1001 and the monitoring data storage unit 1002 are configured in the storage server 101, the abnormality detection unit 1003, the correlation extraction unit 1004, the correlation storage unit 1005, and the failure detection / prediction unit 1006. In addition, it is assumed that the notification unit 1007 has a configuration in the analysis server 102. However, as another embodiment, the configuration of the performance monitoring device 10 is not divided into two servers, the storage server 101 and the analysis server 102. It is good also as a structure aggregated in one server.

  Next, the operation of the performance monitoring apparatus 10 will be described in detail with reference to the flowcharts of FIGS. In the performance monitoring system in the first embodiment to which the present invention is applied, there are roughly the following five processes. (1) Processing for storing the monitoring data acquired by the monitoring data acquisition unit 1001 in the monitoring data storage unit 1002. (2) A process for obtaining (generating) a correlation based on data read from the monitoring data storage unit 1002. (3) Processing for storing the correlation obtained by the correlation extraction unit 1004 in the correlation storage unit 1005. The processes (1) to (3) are performed by batch processing or real-time processing according to the monitoring purpose. Further, (4) a process of comparing the monitoring data with the correlation or the correlations. (5) There is a process of detecting an abnormality from the monitoring data and the correlation. 4 is a flowchart showing operations of the monitoring data acquisition unit 1001, the abnormality detection unit 1003, and the correlation extraction unit 1004, and FIG. 5 is a flowchart showing operations of the failure detection / prediction unit 1006.

  Note that the various data accumulated in (1) in the monitoring data storage unit 1002 are preferably left without being erased in principle after being used in each subsequent process. For example, as will be described in a second embodiment described later, there is an advantage that a large amount of data can be used for comparison with past data when the system configuration is changed.

  First, operations of the monitoring data acquisition unit 1001, the abnormality detection unit 1003, and the correlation extraction unit 1004 will be described with reference to FIG. In FIG. 4, the process of storing (1) and (3) described above and other processes are described in parallel, but it is not always necessary to perform them in parallel. First, the monitoring data acquisition unit 1001 acquires monitoring data of the Web server 11, AP server 12, DB server 13, and communication line connecting each server, and accumulates the acquired monitoring data in the monitoring data storage unit 1002. (Steps S401 and S402).

  Subsequently, after detecting two types of monitoring data from the monitoring data storage unit 1002, the abnormality detection unit 1003 reads the normal correlation corresponding to the two types of monitoring data from the correlation storage unit 1005, and monitors them. An abnormality of the information processing system is detected by comparing the two types of monitoring data read from the data storage unit 1002 with the normal correlation read from the correlation storage unit 1005 (step S403). According to the monitoring purpose, the monitoring data and the correlation are read and compared in an arbitrary cycle. Here, it is assumed that the two types of monitoring data read from the monitoring data storage unit 1002 by the abnormality detection unit 1003 are data acquired simultaneously by the monitoring data acquisition unit 1001. Here, the normal correlation used by the abnormality detection unit 1003 is a normal correlation obtained in the process of the previous step S406 for the two types of monitoring data.

  When an abnormality in the information processing system is detected, the correlation extraction unit 1004 calculates the correlation between the two types of monitoring data from the past two types of monitoring data read from the monitoring data storage unit 1002 (step S403). / YES, S404). Subsequently, the correlation extraction unit 1004 stores the calculated correlation in the correlation storage unit 1005 as a correlation at the time of abnormality together with the correlation ID (step S407). At this time, in the correlation storage unit 1005, for the two types of monitoring data, the abnormal correlation obtained in the previous step S404 is the abnormal time obtained in the current step S404. The correlation is updated. Therefore, in the present embodiment, it is possible to always use a new abnormal correlation following the operation of the information processing system for error prediction processing in step S505 described later.

  On the other hand, if no abnormality is detected in step S403, the correlation extraction unit 1004 determines whether or not a predetermined time has elapsed since the start of acquisition of the two types of monitoring data (steps S403 / NO, S405).

  When a predetermined time has elapsed from the start of acquisition of the two types of monitoring data, the correlation extraction unit 1004 reads the two types of monitoring data read from the monitoring data storage unit 1002 until the predetermined time has elapsed from the start of acquisition. Then, the correlation between the two types of monitoring data is calculated and stored in the correlation storage unit 1005 together with the correlation ID as a normal correlation (step S405 / YES, steps S406 and S407). At this time, in the correlation storage unit 1005, regarding the two types of monitoring data, the normal correlation obtained in the previous step S406 is the normal time obtained in the current step S406. The correlation is updated. Therefore, in the present embodiment, it is possible to always use a new normal correlation following the operation of the information processing system for error detection processing in step S503 described later.

  In step S405, if the predetermined time has not elapsed since the monitoring data acquisition start, the process returns to the monitoring data acquisition process in step S401. As described above, in this embodiment, the normal correlation is always accumulated unless there is any abnormality in the monitored system. When an abnormality occurs, a new correlation is generated and accumulated. To go.

  Next, the operation of the failure detection / prediction unit 1006 will be described with reference to FIG. The failure detection / prediction unit 1006 reads two types of monitoring data from the monitoring data storage unit 1002 (step S501). Note that the two types of monitoring data read here are data acquired simultaneously by the monitoring data acquisition unit 1001, and are the latest data of the two types of monitoring data stored in the monitoring data storage unit 1002. Is the premise. The period for reading the monitoring data from the monitoring data storage unit 1002 can be arbitrarily set according to the monitoring purpose, but real-time characteristics are required as much as possible for the purpose of failure detection. Therefore, it is preferable to set the monitoring data acquisition unit 1001 to read data as soon as it is acquired and stored in the monitoring data storage unit 1002.

  Subsequently, the failure detection / prediction unit 1006 compares the two types of monitoring data with the correlation at normal time corresponding to the two types of monitoring data stored in the correlation storage unit 1005, and the comparison result Based on the above, it is determined whether or not an error (abnormality) has occurred in the information processing system (steps S502 and S503).

  In step S503, when the failure detection / prediction unit 1006 determines that an error has occurred in the information processing system, the notification unit 1007 notifies the operator of the content (steps S503 / YES, S506).

  On the other hand, if the failure detection / prediction unit 1006 does not determine in step S503 that an error has occurred in the information processing system, the failure detection / prediction unit 1006 is obtained from the process of step S501 a predetermined number of times before the process of step S501 this time. Based on a plurality of the two types of monitoring data, the correlation between the two types of monitoring data is obtained, and this correlation and the past correlation between the two types of monitoring data stored in the correlation storage unit 1005 Is used to predict whether or not an error may occur (steps S503 / NO, S504, and S505).

  In step S505, when the failure detection / prediction unit 1006 determines that an error may occur in the information processing system in the future, the notification unit 1007 notifies the operator of the content (steps S505 / YES, S507). .

  On the other hand, when the failure detection / prediction unit 1006 determines that the two correlations are not similar, the process returns to reading of the monitoring data in step S501 (steps S505 / NO, S501).

  Here, the error detection processing in step S503 will be specifically described with reference to FIG. In FIG. 6, transaction data and resource usage status data are used as the two types of monitoring data, and the correlation 601 calculated from the throughput indicated by the transaction data and the disk I / O amount indicated by the resource usage status data is shown. Show. In FIG. 6, “x” marks are plotted from the relationship between the throughput and the disk I / O amount indicated by the two types of monitoring data, and correspond to the two types of monitoring data. , 12 points are plotted. A hatched range area 604 is a range that is regarded as normal when the normal correlation 601 is used as a reference, and is determined in advance according to the correlation. In FIG. 6, the range region 604 is set in parallel with the correlation 601, but it is not always necessary to set the region with a constant width centered on the correlation.

  The correlation extraction unit 1004 obtains an approximate expression (corresponding to a straight line in FIG. 6) of the 12 points. The approximate expression obtained here is a correlation 601 between the throughput and the disk I / O amount. If this correlation 601 is the normal correlation obtained in step S406, corresponding to the two types of monitoring data read in step S501 (throughput and disk I / O indicated by the two types of monitoring data). When the plotted point is 602 in FIG. 6, that is, outside the range area 604 having a predetermined width with reference to the correlation 601, the process proceeds to step S 501 above the range area 604. In the case where two types of monitoring data to be read are plotted, the failure detection / prediction unit 1006 determines that the disk I / O amount is currently excessive with respect to the throughput based on the correlation 601 at the normal time. It is possible to detect and detect an error in the information processing system due to the large amount of disk I / O. The notification unit 1007 notifies the operator of a system error and its cause (the amount of disk I / O is too large with respect to the throughput) through screen display.

  Further, a point plotted in correspondence with the two types of monitoring data read in step S501 (corresponding to the throughput and disk I / O amount indicated by the two types of monitoring data) is indicated by reference numeral 603 in FIG. In some cases, that is, when two types of monitoring data read in step S501 are plotted outside the range area 604 having a predetermined width based on the correlation 601 and below the range area 604, The detection / prediction unit 1006 determines that the throughput is currently too high with respect to the disk I / O amount on the basis of the normal correlation 601 and detects an error in the information processing system due to the high throughput. Can be detected. The notification unit 1007 notifies the operator of a system error and its cause (throughput is too high with respect to the disk I / O amount) by displaying on the screen.

  In the above-described embodiment, the content of what kind of processing is the throughput is not limited. Therefore, it may be a throughput related to a specific process, or may be a throughput obtained by adding several processes. For example, the correlation between the throughput and the disk I / O amount is obtained for each of the processing a, processing b, and processing c, and the sum of these three correlations is used as the reference disk I / O amount for the throughput. You may make it treat as.

  Further, since the performance monitoring system of this embodiment is characterized by monitoring a plurality of servers, the system error including which server's behavior is detected for the operator is included. And the cause of it.

  In the present embodiment, various other error detections can be performed based on the monitoring data acquired by the monitoring data acquisition unit 1001. For example, using transaction data obtained by monitoring a transaction to a server and resource usage status data of the server, based on the throughput indicated by the transaction data and the CPU usage rate indicated by the resource usage status data, It can be determined as an error cause of the information processing system that the CPU usage rate is low even though the throughput of the server is high, or that the CPU usage rate is high despite the low throughput of the server. .

  Further, it is possible to grasp the following error causes based on the resource usage data of two different servers. For example, in a normal operating state, the CPU usage rate between the Web server 11 and the AP server 12 should be N: M, but the CPU usage rate indicated by the resource usage status data obtained from the Web server 11 is from the AP server 12. If only the usage rate of the Web server 11 is high based on the CPU usage rate indicated by the obtained resource usage status data, it can be determined that the cause of the error in the information processing system is a failure in the AP server 12.

  Further, the following error causes can be grasped based on the resource usage status data and log data of a certain server. For example, based on the CPU usage rate indicated by the resource usage status data and the frequency of occurrence of process 1 determined from the log data, occurrence of process 1 occurs normally during the time period when the CPU usage rate of the server takes an abnormally high value. When the frequency is high, it can be determined that the cause of the error in the information processing system is that the frequency of occurrence of the process 1 in the server is high in the time period.

  Furthermore, it is possible to grasp the following error causes based on the log data of two different servers. For example, the throughput of the Web server 11 tends to increase based on the throughput of the Web server 11 determined from the log data of the Web server 11 and the throughput of the AP server 12 determined from the log data of the AP server 12. If the throughput of the AP server 12 does not increase, there is a problem with the AP server 12, so that the processing using the AP server 12 is delayed, and the ratio of processing using only the Web server 11 is increasing. Can be detected.

Next, the error prediction process in step S505 in FIG. 5 will be specifically described with reference to FIG.
FIG. 7 shows the throughput of processing 1 of the Web server 11 and the throughput of processing 2 of the AP server 12 determined by using log data of different servers (here, the Web server 11 and the AP server 12). The correlation calculated based on this is shown. A range area 701 indicates a range that is considered normal when the number of occurrences of processing 2 of the AP server 12 is determined in a normal state relative to the number of occurrences of processing 1 of the Web server 11.

  In FIG. 7, as the correlation 702, there are 702 (a) and 702 (b) as past correlations accumulated in the correlation 1005. The correlation 702 (c) obtained by the correlation extraction unit 1004 based on the log data of the Web server 11 and the AP server 12 obtained from the process of step S501 a predetermined number of times to the process of step S501 this time. Is also shown. When viewed in time series, it is assumed that the correlation obtained first is 702 (a), the next is 702 (b), and the latest data is 702 (c). Further, the correlation 703 (d) indicates a correlation that is expected in the future of the monitoring target system. For easy understanding of the figure, the correlation line corresponding to the range region 701 is not shown in FIG.

  In step 504, the past trend and the current situation of the monitoring target system are based on the correlations 702 (a) to 702 (c), that is, using data when a certain monitoring target system is periodically monitored. Predict errors.

  In step S505, the failure detection / prediction unit 1006 determines the transition of the correlation 702 with the time series, and if the correlation is likely to deviate from the range region 701 when the correlation is normal, an abnormality may occur in the information processing system in the future. Predict that there is sex. At this time, a future correlation 702 (d) is generated as necessary. In this embodiment, the criterion for determining that the correlation created from the latest monitoring data is likely to be out of the normal correlation range area 701 is used. For example, the correlation is created from the latest monitoring data. It may be determined that the calculated correlation is becoming a correlation similar to the correlation at the time of abnormality, or it is not determined by whether or not it enters the area range, but at the normal time / abnormal time You may judge by the inclination of a correlation.

  The above prediction content by the failure detection / prediction unit 1006 is notified to the operator by the notification unit 1007.

  In this embodiment, when a new information processing system having a configuration similar to the information processing system is newly installed, the correlation between normal time and abnormal time stored in the correlation storage unit 1005 of the information processing system is calculated. By storing the information in the correlation storage unit in the new information processing system, appropriate error detection processing and error prediction processing can be performed in the same manner in the new information processing system. Here, since the performance monitoring apparatus 10 is not limited to the information processing system shown in FIG. 1 and can monitor information processing systems having various configurations, the correlation that can be diverted is not limited to the example described above. It is.

  As described above, according to the present embodiment, the cause of the failure can be pursued according to the two types of monitoring data used at the time of failure detection or prediction. In this embodiment, the correlation between two types of monitoring data is used, but the correlation applicable to the present invention is not limited to that calculated from two types of monitoring data, and more types of monitoring data. The correlation may be as follows.

  Further, for convenience of explanation, the abnormality detection unit 1003 and the failure detection / prediction unit 1006 have been described as having different configurations. However, both of the monitoring data read from the monitoring data storage unit 1002 and the correlation storage unit 1005 For the process of comparing the read correlation, common software / hardware may be used.

  Next, another example of processing according to this embodiment will be described. A reference ratio between the number of occurrences of processing 1 in the Web server 11 and the number of occurrences of processing 2 in the AP server 12 is set in advance, and the current ratio between the two types of monitoring data tends to move away from the reference ratio. In some cases it is also possible to predict errors. For example, even though the reference ratio is set at 1: 1, the ratio is separated from the reference as time passes, such as 1: 1.1, 1: 1.2, 1: 1.3,. This is detected when a tendency is observed, and the operator is notified.

  Furthermore, it is possible to detect an abnormality based on one piece of correlation information obtained from two types of monitoring data. FIG. 8 is an example showing a correlation with response time for throughput data. In this figure, it can be seen that the response time becomes longer as the throughput increases, and that the response time rapidly deteriorates when the throughput exceeds a certain amount. By detecting a point where the response time is deteriorated as an error, the operator can take an early countermeasure against the response deterioration. Specifically, such correlation is stored in the correlation storage unit 1005, and the performance monitoring apparatus 10 determines that an error has occurred when it is detected that the monitoring data has reached the extreme point of such correlation. To inform the operator.

  As described above, in the present embodiment, the change of the correlation over time is captured, and when the change in the correlation inclination or the shift of the correlation in the X-axis or Y-axis direction is not permitted, these situations are detected. An error is reported based on the above. However, the present invention is not limited to this, and an error may be predicted by comparing with a normal correlation in a certain time section.

  In the above-described embodiment, resource usage status data, transaction data, and log data are given as examples of monitoring data acquired by the performance monitoring device 10, but monitoring data applicable to the present invention is not limited to these, All data that can specify the operating status of the Web server 11, the AP server 12, and the DB server 13 can be collected by the performance monitoring apparatus 10, and error detection processing and error prediction processing by similar operations are possible. Further, in the above embodiment, the configuration of the information processing system to be monitored by the performance monitoring apparatus 10 is the information processing system including the Web server 11, the AP server 12, and the DB server 13 shown in FIG. Of course, this information processing system can also be a monitoring target of the performance monitoring apparatus of the present invention.

  In the above-described embodiment, an example in which a system configured by one Web server 11, one AP server 12, and one DB server 13 is monitored by one performance monitoring apparatus 10 is described. It doesn't have to be one by one. Since the performance monitoring apparatus 10 can monitor servers and communication lines connected to the network, the performance monitoring apparatus 10 is composed of two or more sets of Web server 11, AP server 12, and DB server 13 with one performance monitoring apparatus 10. It is also possible to monitor the system.

  Further, the number of Web servers 11, AP servers 12, and DB servers 13 need not be 1: 1: 1, and a system including a plurality of M: N: L may be used. As an example, as shown in FIG. 9, six web servers 11 are connected to two AP servers 12 each three, and the two AP servers 12 are connected to one DB server 13. ing. At this time, the performance monitoring apparatus 10 can monitor individual servers and communication lines and detect errors precisely based on their behavior. Further, communication with three Web servers 11 connected to one AP server 12 can be collectively regarded as one Web server 11 and monitored as necessary. In this case, it is preferable that system configuration information is stored in the performance monitoring apparatus 10 so that a monitoring target can be arbitrarily set.

  Next, a second preferred embodiment to which the present invention is applied will be described. As described above, it is preferable to store system configuration information in the performance monitoring apparatus 10 for a system to be monitored so that the monitoring target can be arbitrarily set. Therefore, in the second embodiment, in addition to the functional configuration of the first embodiment, the system configuration information of the system to be monitored is further managed so that more various monitoring and failure prediction can be performed. .

  FIG. 10 is a diagram schematically showing the configuration of the performance monitoring system according to the second embodiment. Hereinafter, although it demonstrates in detail, referring drawings, description is abbreviate | omitted about the same function as 1st embodiment. FIG. 10 is a configuration for monitoring the performance of a system composed of the six Web servers 11, two AP servers 12, and one DB server 13 shown in FIG. Similar to the embodiment, the performance monitoring apparatus 10 constituted by the storage server 101 and the analysis server 102 collects, accumulates and analyzes information that can be acquired from the communication line. In the second embodiment, a configuration information management device 20 is further provided and connected to the performance monitoring device 10. In the following description, an example in which the configuration information management device 20 is configured as a separate device from the performance monitoring device 10 will be described, but this may be configured by a single computer.

  The configuration information management apparatus 20 stores information related to the configuration of the entire system to be monitored. Specifically, information on the information processing device itself and the information indicating the relationship between the information processing devices, such as the number of servers for each function, hardware attributes, network configuration, network attributes, software and firmware, are stored in the database. ing. In the following, in order to simplify the description, an example of handling configuration information related to hardware will be described. For example, the entire configuration shown in FIG. 9 is assigned with an ID and stored. When the configuration of the system to be monitored is changed, such as when a new server is added, an ID is separately added as new configuration information and stored in the configuration information management apparatus 20. Note that the configuration information management apparatus 20 has the basic functions of a computer as shown in FIG.

  FIG. 11 is a diagram for explaining in detail the configurations of the performance monitoring device 10 and the configuration information management device 20 used in the second embodiment. In addition to the functions described in the first embodiment, the performance monitoring apparatus 10 stores a monitoring target specifying unit 1008 for specifying a range to be monitored in the entire system configuration, and a specified monitoring target range. The monitoring data storage unit 1002 has monitoring target range data to be stored.

  As will be described later, in the second embodiment, the entire configuration of a system constituted by a plurality of hardware is stored in the configuration information management device 20 with a configuration information ID. On the other hand, the monitoring target can specify an arbitrary range of the entire configuration of the stored system. For example, in FIG. 9, the entire system can be monitored for a system composed of a total of nine computers including six Web servers 11, two AP servers 12, and one DB server 13, or Can also monitor only some of them. Therefore, the monitoring target specifying unit 1008 has a function of receiving information for specifying the monitoring target from the operator. Specifically, the range designation information is received by an operator's keyboard or mouse operation.

  The range designation information received by the monitoring target designation unit 1008 is stored in the monitoring data storage unit 1002 with a monitoring target ID assigned as monitoring target range data. When the monitoring data income unit 1001 obtains resource usage status data and log data from the Web server 11, AP server 12, and DB server 13, transaction data from the communication line connecting the servers, the monitoring target range data is acquired. Browse and get only the information in the specified range. When the monitoring data income unit 1001 actively acquires monitoring data, it accesses the designated server or the like to acquire log data or the like, and when it acquires passive monitoring data, it receives it. Among the log data, etc., only the data of the server designated as the monitoring target range is selected (filtered) and acquired.

  The configuration information management device 20 responds to requests from the configuration information registration unit 2001 for inputting and registering configuration information, the configuration information storage unit 2002 for storing the input configuration information, and the performance monitoring device 10. The configuration information extraction unit 2003 is configured to extract configuration information stored in the configuration information storage unit 2002 and transmit the configuration information to the performance monitoring apparatus 10.

  The configuration information registration unit 2001 is a function of accepting information input by an operator such as a keyboard and a mouse. For example, in FIG. 9, the operator has information about the quantity of hardware such as six Web servers, two AP servers, and one DB server as the entire configuration of the system to be monitored, It is input what kind of form each is connected to, what kind of transfer rate the network to connect to, what kind of specifications of each hardware / software is, etc. As the specifications of each hardware / software, it is preferable to register not only the specifications at the time of purchase but also the firmware and software versions. In addition to the input from the operator, the system configuration information that can be acquired by the computer via the network may be acquired automatically.

  The configuration information storage unit 2002 stores the information received by the configuration information registration unit 2001 for each monitoring target system. In addition to the configuration information ID, attribute information such as storage date / time information that received the configuration information is also added to the configuration information and stored.

  The configuration information extraction unit 2003 is a function that extracts the configuration information stored in the configuration information storage unit 2002 based on instructions from the performance monitoring apparatus 10 or an operator. As will be described later, in the second embodiment, in order to monitor the performance or detect an abnormality according to the system configuration, it is necessary to obtain a correlation from the monitored system and the behavior of the system at the normal time. Therefore, the performance monitoring apparatus 10 reads configuration information from the configuration information storage unit 2002 as necessary to create correlation data and the like.

  Here, the correlation in the correlation storage unit 1005 is stored for each environment for which the correlation is obtained. For example, the system behavior differs when there are 10 servers and 11 servers. Accordingly, the correlation when the number of servers is 10 and the correlation when the number of servers is 11, are obtained separately and stored with a correlation ID assigned thereto. Then, the monitoring target ID and / or the configuration information ID when the correlation is obtained are linked. Links can be set easily by managing them in a relational database. Such information associated with the ID may be separately stored as history information. Naturally, since a plurality of correlations are generated for one monitoring target, the correlation ID and the monitoring target ID form a link with a plurality of relationships. The same applies to the configuration information ID.

  Next, operations of the performance monitoring apparatus 10 and the configuration information management apparatus 20 will be described with reference to FIG. In the second embodiment, the monitoring and the correlation extraction process in the first embodiment described with reference to FIG. 4 are the same. However, prior to this monitoring process, a process for specifying a range to be monitored is performed. Is called. First, the configuration information registration unit 2001 receives information about the overall configuration of the system input by an operator or a computer and transfers it to the configuration information storage unit 2002 (step S1201). The configuration information storage unit 2002 that has received information related to the overall configuration of the system assigns IDs to the configuration information and sequentially stores the information. At this time, the date and time information received as described above is also stored together (step S1202).

  Subsequently, the operator inputs information about a range to be monitored among the entire system structure stored in the configuration information storage unit 2002, and the monitoring target designating unit 1008 receives the input information (step S1203). An example of the range designation method is to uniquely identify hardware such as IP addresses of a plurality of target servers. Based on the received information, the monitoring data acquisition unit 1001 instructs the configuration information extraction unit 2003 to extract, and the configuration information extraction unit 2003 extracts information about the system from the configuration information storage unit 2002 to the monitoring data acquisition unit 1001. Return it (step S1204).

  For example, in FIG. 9, when the monitoring target specifying unit 1008 receives an instruction from the operator to monitor eight servers other than the DB server, the monitoring data acquiring unit 1001 extracts the information to the configuration information extracting unit 2003. The configuration information extraction unit 2003 identifies the server using eight IP addresses and the like. The IP addresses of the plurality of servers to be identified are transmitted to the monitoring data acquisition unit 1001, and the monitoring data acquisition unit 1001 assigns and stores the monitoring target ID as monitoring target range data in the monitoring data storage unit 1002 (S1205). ).

  When the monitoring data acquisition unit 1001 performs the monitoring process, the monitoring data acquisition unit 1001 acquires monitoring data related to the hardware group specified by the monitoring target range data stored in the monitoring data storage unit 1002. In the following, processing is performed in the same manner as in the first embodiment described with reference to FIGS. At this time, the correlation used for comparison is extracted based on the monitoring target ID and the corresponding correlation ID, and each process is performed. Note that the processing from step S1201 to step S1205 in FIG. 12 is performed every time the system configuration is changed or the monitoring target range is changed.

  As described above, in the second embodiment to which the present invention is applied, information for specifying the hardware configuration and software configuration to be monitored is further provided to monitor only a specific part in the entire system. It is possible to monitor the range of the monitoring target according to the purpose. In the above-described embodiment, an example is shown in which one performance monitoring device 10 and one configuration information management device 20 are provided for one system. However, the present invention is not limited to this, for example, an ASP (Application Service Provider) service or the like. It can also be applied to other forms. That is, there are a plurality of systems to be monitored, and only a specific range in each of these systems can be set as a monitoring target. In that case, it is only necessary to store configuration information for each system and have monitoring target range data for each system.

  As another form, a plurality of monitoring target ranges may be set according to the purpose in one system. For example, in the entire system composed of 10 servers from server A to server J, the first monitoring target range is five servers A to E, and the second monitoring target range is server F to server. A range of 3 units of H may be specified. Furthermore, one server is designated as a plurality of monitoring targets, such as the first monitoring target range is seven servers A to G, and the second monitoring target range is eight servers C to J. Also good. In any case, when performing the monitoring process, the monitoring data acquisition unit 1001 refers to the monitoring target range data stored in the monitoring data storage unit 1002, identifies the monitoring target server, and acquires necessary monitoring data. The process is performed.

  Next, a preferred third embodiment to which the present invention is applied will be described. In the first embodiment and the second embodiment described above, the operating status of the computer such as resource usage status data, log data, and transaction data is collected. In contrast, in the third embodiment, information other than the computer operating status is also collected to obtain the correlation.

  The computer system is changed in hardware configuration and software configuration for various reasons. These changes change the performance of the computer system. In addition, the performance of a computer system changes with changes in the environment surrounding the computer system. This embodiment is characterized in that these changes are captured and handled as one of the monitoring data. This is particularly referred to as “event data”. “Event data” is data relating to events that occur inside and outside the target system to be monitored, including the operating status. For example, events that occur internally include system changes such as the occurrence of errors and the increase in the number of CPUs incorporated in a computer. External events include temperature changes and the occurrence of shaking due to earthquakes and shocks. Depending on the contents of the event, changes such as a decrease in throughput due to a decrease in computer computing performance may occur. Therefore, for example, when the monitoring data acquisition unit 1001 catches event data, processing such as analysis and abnormality detection is performed according to the event.

  FIG. 13 is a diagram schematically showing the configuration of the performance monitoring system according to the third embodiment. In the third embodiment, the basic information processing is the same as in the first embodiment and the second embodiment, but only the configuration for explaining the features of the present embodiment in an easy-to-understand manner is displayed. Therefore, the description of the same processing is omitted. One of the features of the third embodiment is that the input data source includes “operation management tool” and “user input” in addition to monitoring target devices such as “Web server”, “AP server”, and “DB server”. is there. The data stored in the monitoring data storage unit 1002 is separately shown for monitoring data 1002 and event data 1002 ′.

  The event data includes data that is used as it is from a monitored system, is received from an operation management tool (not shown), or is input by a human. The operation management tool manages system hardware and software. Information such as what configuration each hardware has and what version of software is installed. I manage.

  Further, as will be described later, some event data is generated based on log data received from the monitoring target system. In any case, the event data is assigned an event data ID and stored in a predetermined location in the monitoring data storage unit 1002.

  Next, the data flow in the third embodiment will be described. Each data received via the monitoring data acquisition unit 1001 is stored in the storage unit according to the type of data. First, data related to the configuration of the monitoring target system is stored in the configuration information storage unit 2002 of the configuration information management apparatus 20 as described in the second embodiment. Monitoring data such as log data and throughput received from the monitoring target system is stored in the monitoring data storage unit 1002, and similarly, event data received via the monitoring data acquisition unit 1001 is also stored in the monitoring data storage unit 1002 ′. .

  Information related to some event can be extracted from the monitoring data stored in the monitoring data storage unit 1002. For example, when the monitoring target server goes down, monitoring data is not received. That is, an event related to an error (failure) that the monitored server is down can be extracted if it can be sensed that the monitoring data that can be received periodically is not stored in the monitoring data storage unit 1002. Further, when the CPU usage rate exceeds 90% for about 10 minutes, it can be regarded as an overload, so that an event relating to the operating status of the system can be extracted.

  Therefore, in the third embodiment, an event data generation unit 1009 is provided to generate event data based on the monitoring data. The event data generation unit 1009 generates event data for the monitoring data stored in the monitoring data storage unit 1002 based on an event data generation rule stored in a rule storage unit (not shown). The event data generation rule defines what kind of event data is generated using which data at what timing. In the above-described example of an error-related event, “always” “monitoring data” is extracted, and rule generation processing is performed in accordance with an event data generation rule of “server down” if monitoring data cannot be received for a certain period of time. In the example of the event related to the operation status, “always” “CPU usage rate” is extracted, and rule generation processing is performed according to the event data generation rule “overload” when 90% abnormality continues for 10 minutes. Then, the event data ID is assigned and stored in the monitoring data storage unit 1002 ′.

  As described above, in the third embodiment, for every event occurring in the monitored system, a signal generated from the monitored system, a signal received from an operation management tool (not shown), information input by a person, or event data Data generated by the generation unit 1009 is stored in the monitoring data storage unit 1002 as event data.

  The correlation extraction unit 1004 obtains a correlation using each information stored in the monitoring data storage unit 1002 and the configuration information storage unit 2002 and stores it in the correlation 1005.

  Next, processing using event data will be described. In the first embodiment and the second embodiment, (2) a process for obtaining (generating) a correlation based on data read from the monitoring data storage unit 1002, and (4) a correlation with or correlation between the monitoring data. (5) The process of detecting an abnormality from the monitoring data and one correlation is performed. In this embodiment, (6) the monitoring data is compared with the correlation generated by using the event data as a trigger. .

  As an example of the process (6) for comparing the monitoring data and the correlation generated by using the event data as a trigger, here, a series of analysis processes using the correlation between the monitoring data and the event data called server down will be described. To do. It is assumed that “disk I / O” and “server throughput” are monitored as monitoring data.

  First, “disk I / O” and “server throughput” are continuously measured for the system to be monitored, and the measured data is acquired by the monitoring data acquisition unit 1001, and “disk I / O” is stored in the monitoring data storage unit 1002. O ”and“ server throughput ”are sequentially stored. The event data generation unit 1009 always extracts the monitoring data. If the monitoring data cannot be received for a certain period of time, it is regarded as “server down” and event data “server down” is generated and stored in the monitoring data storage unit 1002 ′. Remember.

  Next, the correlation extraction unit 1004 stores the disk “disk I / O” and “server throughput” stored in the monitoring data storage unit 1002 and “server down” event data stored in the monitoring data storage unit 1002 ′. And the correlation is extracted and stored in the correlation storage unit 1005. Specifically, if the monitoring data cannot be received for a certain period of time immediately after the monitoring data “disk I / O” and “server throughput” stored in the monitoring data storage unit 1002 increase rapidly, the “disk I / O” When the correlation as shown in FIG. 14 is obtained based on “O” and “number of server processes”, and “disk I / O” or “server throughput” exceeds a certain value. Generates information that a "server down" has occurred. In FIG. 14, the hatched area is a portion showing the relationship between “disk I / O” and “server throughput” when “server down” has occurred in the past.

  Next, the failure detection / prediction unit 1006 reads out the “disk I / O” and “server throughput” monitoring data sequentially stored in the monitoring data storage unit 1002, and the data corresponds to the correlation shown in FIG. It is determined whether the value is normal or whether there is a possibility of “server down” (failure prediction) or “server down” (failure detection). If it is determined that the failure is predicted or detected, a message such as “There is a possibility of“ Server down ”” or “A server down” is displayed on the notification unit 1007.

  In the example of the event relating to the operation status described above, the following correlation can be compared based on the generated event data “overload”. Generally, when throughput increases, CPU processing increases and the load increases. On the other hand, a state where the CPU load is not high although the throughput is high is considered abnormal. Therefore, regarding the correlation between the CPU usage rate and the throughput, the correlation between the normal state and the correlation when the event of “overload” occurs is compared to determine the failure.

  As described above, in the third embodiment, all events that occur inside and outside the monitored system are extracted as event data, and the correlation is extracted using the extracted event data and monitoring data. In the above-described embodiment, the analysis process using only the event data and the monitoring data has been described. However, the details are obtained by obtaining the correlation using the data including the configuration information as described in the second embodiment. It is also possible to detect anomalies.

  In each of the above-described embodiments, in order to obtain the correlation in advance, the correlation is extracted based on a correlation extraction rule stored in a rule storage unit (not shown). This correlation extraction rule is registered in advance by the user, but based on the stored monitoring data and event data, it automatically guesses what kind of correlation should be extracted, and the correlation The extraction rule itself may be automatically generated. In other words, monitoring data and event data are continuously accumulated, the situation where no error etc. occurs is regarded as a normal value, and if there is any monitoring data that deviates from this normal value, the correlation extraction rule generation function works, and these data A new correlation rule may be generated from

  As described above in detail, in the present invention, as in the first embodiment and the second embodiment, a method for obtaining a correlation from a plurality of types of quantitative information related to the operating status of the system, and the third embodiment As in the embodiment, a correlation is obtained from quantitative information related to the operating status of the system and event information generated for the system. The correlation obtained in this way is stored in the correlation storage unit 1005, and the monitoring data is compared with this correlation to detect and predict a failure.

  By the way, an object of the present invention is to supply a storage medium storing software program codes for realizing the functions of the above-described embodiments to a system or apparatus, and the computer (or CPU or MPU) of the system or apparatus stores the storage medium. Needless to say, this can also be achieved by reading and executing the program code stored in.

  In this case, the program code itself read from the storage medium realizes the functions of the above-described embodiments, and the program code itself and the storage medium storing the program code constitute the present invention.

  As a storage medium for supplying the program code, for example, a flexible disk, a hard disk, an optical disk, a magneto-optical disk, a CD-ROM, a CD-R, a magnetic tape, a nonvolatile memory card, a ROM, or the like can be used.

  Further, by executing the program code read by the computer, not only the functions of the above-described embodiments are realized, but also an OS (basic system or operating system) running on the computer based on the instruction of the program code. Needless to say, a case where the functions of the above-described embodiment are realized by performing part or all of the actual processing and the processing is included.

  Further, after the program code read from the storage medium is written in a memory provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer, the function is determined based on the instruction of the program code. It goes without saying that the CPU or the like provided in the expansion board or function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.

It is a figure showing roughly the composition of the performance monitoring system concerning a first embodiment of the present invention. It is a figure which shows roughly the hardware constitutions of the computer system in a performance monitoring apparatus. It is a block diagram which shows the function structure of a performance monitoring apparatus. It is a flowchart which shows operation | movement of the monitoring data acquisition part, the abnormality detection part, and a correlation extraction part. It is a flowchart which shows operation | movement of a failure detection / prediction part. It is a figure for demonstrating concretely the error detection process in step S503 of FIG. It is a figure for demonstrating concretely the error prediction process in step S505 of FIG. It is a figure which shows correlation with the response time with respect to throughput data. It is a figure which shows the other structural example of the performance monitoring system which can apply this invention. It is a figure which shows schematically the structure of the performance monitoring system which concerns on 2nd embodiment of this invention. It is a figure which shows roughly the hardware constitutions of the computer system in a performance monitoring apparatus. It is a flowchart which shows the registration and extraction process of structure information. It is a figure which shows roughly the hardware constitutions of the computer system in a performance monitoring apparatus. It is a figure which shows the correlation in 3rd embodiment of this invention.

Explanation of symbols

10: Performance monitoring device 11: Web server 12: AP server 13: DB server 20: Configuration information management device 101: Storage server 102: Analysis server 1001: Monitoring data acquisition unit 1002: Monitoring data storage unit 1003: Abnormality detection unit 1004: Correlation extraction unit 1005: Correlation storage unit 1006: Failure detection / prediction unit 1007: Notification unit 1008: Monitoring target designation unit 1009: Event data generation unit 1200: Computer system 1201: CPU
1202: ROM
1203: RAM
1204: System bus 1205: Keyboard controller (KBC)
1206: CRT controller (CRTC)
1207: Disk controller (DKC)
1208: Network interface card (NIC)
1209: Keyboard (KB)
1210: CRT display (CRT)
1211: Hard disk (HD)
1212: Flexible disk (FD)
1220: LAN
2001: Configuration information registration unit 2002: Configuration information storage unit 2003: Configuration information extraction unit

Claims (14)

A performance monitoring device that monitors the performance of an information processing system in which a plurality of information processing devices operate in cooperation,
Monitoring means for monitoring the operating status of the plurality of information processing devices and the data communication status of each communication line connecting the plurality of information processing devices;
A failure detection / prediction unit that detects a failure that currently occurs in the information processing system or predicts a possibility that a failure will occur in the information processing system based on monitoring data from the monitoring unit; A performance monitoring device.   The failure detection / prediction unit may detect a failure currently occurring in the information processing system based on a plurality of types of monitoring data obtained by the monitoring unit, or a future failure may occur in the information processing system. The performance monitoring apparatus according to claim 1, wherein the performance is predicted. Monitoring data storage means for storing monitoring data by the monitoring means;
A correlation calculation unit that reads the plurality of types of monitoring data from the monitoring data storage unit and calculates a correlation between the plurality of types of monitoring data;
The failure detection / prediction unit is configured to perform the information processing based on the correlation between the plurality of types of monitoring data calculated by the correlation calculation unit and the current plurality of types of monitoring data obtained by the monitoring unit. The performance monitoring apparatus according to claim 2, wherein a fault currently occurring in the system is detected. Monitoring data storage means for storing monitoring data by the monitoring means;
A correlation calculation unit that reads the plurality of types of monitoring data from the monitoring data storage unit and calculates a correlation between the plurality of types of monitoring data;
The failure detection / prediction unit is based on the correlation between the plurality of types of monitoring data calculated by the correlation calculation unit and the transition of the plurality of types of monitoring data obtained up to now by the monitoring unit. The performance monitoring apparatus according to claim 2, wherein the information processing system predicts that a failure may occur in the future.   The correlation calculation unit calculates a correlation between at least one of normal operation and abnormal operation of the information processing system based on the plurality of types of monitoring data read from the monitoring data storage unit, and The failure detection / prediction means detects a failure currently occurring in the information processing system using the correlation during normal operation or the correlation during abnormal operation, or a future failure occurs in the information processing system. The performance monitoring apparatus according to claim 3, wherein the possibility of occurrence is predicted.   The failure detection / prediction means detects a failure currently occurring in the information processing system, or predicts the possibility of a future failure occurring in the information processing system, from the type of correlation used 6. The performance according to claim 3, wherein a cause of a fault that currently occurs in the information processing system or a cause of a fault that may occur in the information processing system in the future is determined. Monitoring device.   The information processing system further includes a notifying unit for notifying a failure that is currently occurring in the information processing system detected or predicted by the failure detection / prediction unit or a possibility that a failure will occur in the information processing system in the future. The performance monitoring apparatus according to any one of claims 1 to 5.   A failure currently detected in the information processing system detected or predicted by the failure detection / prediction unit or a possibility that a failure will occur in the information processing system, and a failure determined by the failure detection / prediction unit The performance monitoring apparatus according to claim 6, further comprising notification means for notifying the cause of the problem. An information processing system of an information processing system in which the plurality of information processing devices operate in cooperation, configuration information storage means for storing configuration information relating to relevance between the plurality of information processing devices, and the stored configuration information A monitoring target specifying means for specifying a range to be monitored by the monitoring means;
9. The performance monitoring apparatus according to claim 1, wherein the monitoring unit monitors a range specified by the monitoring target specifying unit. The information processing device to be monitored, each communication line connecting the information processing devices, and an event data storage means for storing event data relating to an event that has occurred in at least one of the environments surrounding the information processing device,
The monitoring means acquires the event data in addition to the operating status of the information processing apparatus and the data communication status of each communication line connecting the plurality of information processing apparatuses, and stores the event data in the event data storage means The performance monitoring apparatus according to claim 1, wherein the performance monitoring apparatus is characterized. Based on the monitoring data acquired by the monitoring means, further comprising event data generating means for generating event data,
The performance monitoring apparatus according to claim 1, wherein the event data generation unit stores the generated event data in the event data storage unit.   11. The failure detection / prediction unit predicts a possibility that a future failure will occur in the information processing system based on a correlation related to event data stored in the event data storage unit. Or the performance monitoring apparatus of 11. A performance monitoring method by a performance monitoring device that monitors the performance of an information processing system in which a plurality of information processing devices operate in cooperation,
A monitoring step of monitoring the operating status of the plurality of information processing devices and the data communication status of each communication line connecting the plurality of information processing devices;
A failure detection / prediction step of detecting a failure currently occurring in the information processing system or predicting a possibility that a failure will occur in the information processing system based on monitoring data obtained by the monitoring step. A performance monitoring method characterized by the above.   A program for causing a computer to execute the performance monitoring method according to claim 13.

Images