JP2009193238A - System load monitoring method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system load monitoring method and device for periodically measuring the load on a system that is an observation target to estimate the occurrence of abnormal conditions in the future in addition to simple comparison with a prepared base line, and to provide a program for the system load monitoring device. <P>SOLUTION: The system load monitor includes a storage part accumulating a deviation and a difference between the base line and a past measurement value of the system load. The system load monitor estimates a future value of the system load based on the accumulated difference and deviation. The system load monitor gives a warning to a system manager in advance when the system load exceeding a limit value is estimated. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a system load monitoring method, a system load monitoring device, and a system load monitoring program.

  Baseline monitoring is a monitoring method for determining an abnormality of a monitoring target based on a reference line (hereinafter referred to as “baseline”) indicating a temporal change in system load that is normally assumed. Generally, the degree of deviation from the baseline of the system load is monitored by comparing the observed value of the system load at a certain time with the baseline value corresponding to that time.

  By this method, a flexible threshold value can be set for a system load that changes regularly and regularly according to daily and weekly.

In relation to the above, Patent Document 1 (Japanese Patent Laid-Open No. 2002-152204) discloses an invention relating to a network monitoring device.
The network monitoring apparatus according to the invention of Patent Document 1 includes a first monitoring unit, a second monitoring unit, a determination unit, and a monitoring control unit. Here, the first monitoring means periodically monitors the operation of the network at a predetermined first time interval. The second monitoring means monitors the operation of the network at a second time interval shorter than the first time interval. The discriminating unit discriminates whether the network is normal or abnormal based on the monitoring result of the first monitoring unit. The monitoring control unit activates the second monitoring unit based on the network emergency determination result by the determining unit and stops the operation of the second monitoring unit based on the normal determination result.

Japanese Patent Laid-Open No. 2004-5305 discloses an invention relating to a memory usage monitoring method.
The memory usage monitoring method of the invention of Patent Document 2 is a method for monitoring the memory usage capacity of a computer system operating continuously. The memory usage monitoring method disclosed in Patent Document 2 periodically acquires the memory usage capacity and CPU load of a computer system, accumulates the information in time series along with the acquisition time, and based on the time series data of the memory usage capacity. Then, the arrival time at which the memory usage limit threshold is reached is predicted, and the time zone in which the CPU load decreases immediately before the arrival time is obtained based on the time-series data of the CPU load.

  The memory usage monitoring method according to the invention of Patent Document 2 is intended to store an increase in memory usage and detect an excessive memory usage in advance.

Patent Document 3 (Japanese Patent Application Laid-Open No. 2004-164737) discloses an invention relating to a method for providing a mechanism for performing baseline processing and automatic threshold processing.
The method of providing a mechanism for performing baseline processing and automatic threshold processing of the invention of Patent Document 3 collects performance data for a predetermined interval, aggregates performance data into one data point, and aggregates Update baseline objects based on data points, predict next data values based on aggregated data points, compare predicted data values with actual collected data values, prediction Generating a threshold violation event if there is a discrepancy between the measured data value and the actually collected data value.

  The method of providing a mechanism for performing baseline processing and automatic threshold processing in Patent Document 3 compares the observed value at the current time with the baseline value, but does not consider the history of past observed values. The future load is not predicted.

Japanese Patent Laid-Open No. 2005-135130 discloses an invention relating to a load monitoring condition determination program.
The load monitoring condition determination program of the invention of Patent Document 4 is for causing a computer to execute a load monitoring condition determining method for determining a load monitoring condition for performing load monitoring of a computer system composed of one or a plurality of computers. . The load monitoring condition determination program of the invention of Patent Document 4 includes a process for applying a load to the computer system from the outside, a process for measuring response or throughput outside the computer system while the load is applied to the computer system, and a computer system. While a load is being applied, a process for receiving a measurement result of the resource status inside the computer system from the computer system, an external load applied to the computer system, a response or throughput measurement result, This is to cause the computer to execute processing for determining the load monitoring condition used for load monitoring of the computer system from the measurement result of the resource status.

Patent Document 5 (Japanese Patent Laid-Open No. 2006-146668) discloses an invention relating to an operation management support apparatus.
The operation management support apparatus according to the invention of Patent Document 5 includes an operation information collection unit, an operation information storage unit, a statistical processing unit, a model information storage unit, and a determination unit. Here, the operation information collection means collects operation information of three or more elements every predetermined time. The operation information storage means stores the operation information collected by the operation information collection means. The statistical processing means obtains a statistical analysis value between the operation information of each stored element. The model information storage means stores in advance statistical analysis values between operation information of each element corresponding to a plurality of operation models. The determination unit obtains an operation model corresponding to the collected operation information by comparing the statistical analysis value obtained by the statistical processing means with the statistical analysis value stored in the model information storage means.

  The operation management support apparatus according to the invention of Patent Document 5 uses a measured value as a baseline by a statistical method and uses it for abnormality determination, but does not perform future load prediction based on the baseline. Further, the operation management support apparatus of the invention of Patent Document 5 statistically processes the operation information of a plurality of monitored elements. At this time, the operation information of one monitoring element is simply compared with the baseline, but the difference from the past baseline is not considered in order to determine abnormality.

Patent Document 6 (Japanese Patent Laid-Open No. 2006-178698) discloses an invention relating to a load monitoring device.
The load monitoring device of the invention of Patent Document 6 monitors the load state of the information processing device. The load monitoring device according to the invention of Patent Document 6 includes a measured value storage unit, a variation value calculation unit, and a load state determination unit. Here, the measured value storage means stores the measured value of the performance information of the information processing apparatus and the measurement time. The variation value calculation means reads a plurality of measurement values measured within a predetermined time from the measurement value storage means, and calculates variation values of the read plurality of measurement values. The load state determination unit determines the load state of the information processing device by comparing the variation value calculated by the variation value calculation unit with a predetermined load state determination threshold value.

  The load monitoring device of the invention of Patent Document 6 predicts a future load, but does not perform an abnormality determination based on a baseline or an abnormality determination based on a history of deviations of observed values from the baseline in the past.

JP 2002-152204 A JP 2004-5305 A JP 2004164646 A1 JP 2005-135130 A JP 2006-146668 A JP 2006-178698 A

  The system load monitoring method according to related technology determines a normal state and an abnormal state by paying attention to a difference between a system load observation value at a certain time point and a baseline. For this reason, the system load monitoring method according to the related technology cannot perform analysis in consideration of the correlation between past events.

  For example, if the observed value of the system load continues to fall below the baseline, it means that the load that is supposed to be applied is not applied. Therefore, at some point thereafter, the system load can be predicted to exceed the baseline.

  However, a system load monitoring method that only determines a normal state and an abnormal state at a certain temporary point cannot predict a future system load in relation to a past situation. That is, in the system load monitoring method according to the related art, a decrease and an increase in the system load observation value with respect to the baseline are presented as abnormal states independent of each other.

  For this reason, the system administrator must always be aware of the relationship between a plurality of abnormal states. As described above, in the system load monitoring method according to the related technology, the knowledge and work amount required for the system administrator are enormous. Therefore, there is a problem that a system load monitoring method based on related technology cannot be appropriately handled unless it is a system administrator having high skills.

  Further, the system load monitoring method according to the related art cannot predict that a load will be applied in the future even in the above case. Therefore, it is not possible to take measures such as system enhancement in advance. For example, consider a case where service user requests are concentrated and the load suddenly increases rapidly. The system load monitoring method according to the related art can detect the abnormal state at that point only by monitoring the system load. However, the system load monitoring method according to the related art has a problem that it is not possible to secure a time margin for performing the countermeasure before the abnormal state occurs. In other words, the system load monitoring method according to the related art has a problem that it is impossible to detect a sign of occurrence of an abnormal state.

  An object of the present invention is to provide a system load monitoring method, a system load monitoring device, and a system load monitoring device program that can predict the occurrence of an abnormal state in the future by analyzing a history of system load in the past. is there.

  The system load monitoring apparatus according to the present invention includes a storage unit, a collection function unit, a storage function unit, a prediction function unit, and a display function unit. Here, the storage unit stores a baseline of the system load to be monitored. The collection function unit periodically performs system load observation and baseline value reading corresponding to the observation time in the baseline. The accumulation function unit accumulates a difference in the observed system load with respect to the read baseline value and a deviation of the difference. The prediction function unit periodically predicts the future system load based on the baseline, the accumulated difference, and the accumulated deviation. The display function unit displays the prediction result.

  The system load monitoring method according to the present invention includes an observation step (a), a reading step (b), an accumulation step (c), and a prediction step (d). Here, the observation step (a) is a step for the collection function unit to regularly observe the system load to be monitored. The reading step (b) is a step for the collection function unit to read the baseline value corresponding to the observation time in the baseline of the system load from the storage unit every time observation is performed in the observation step (a). . In the accumulation step (c), every time the baseline value is read in the reading step (b), the accumulation function unit calculates the difference and deviation between the system load and the baseline value observed in the observation step (a). This is a step for accumulating in the storage unit. In the prediction step (d), the prediction function unit periodically predicts the future system load based on the baseline, the accumulated difference, and the accumulated deviation, and displays the result of the prediction. Is a step for displaying.

  The system load monitoring program according to the present invention includes an observation step (a), a reading step (b), an accumulation step (c), and a prediction step (d). Here, the observation step (a) is a step for the collection function unit to regularly observe the system load to be monitored. The reading step (b) is a step for the collection function unit to read the baseline value corresponding to the observation time in the baseline of the system load from the storage unit every time observation is performed in the observation step (a). . In the accumulation step (c), every time the baseline value is read in the reading step (b), the accumulation function unit calculates the difference and deviation between the system load and the baseline value observed in the observation step (a). This is a step for accumulating in the storage unit. In the prediction step (d), the prediction function unit periodically predicts the future system load based on the baseline, the accumulated difference, and the accumulated deviation, and displays the result of the prediction. Is a step for displaying.

  By using the system load monitoring method, system load monitoring apparatus, and system load monitoring program according to the present invention, it is possible to predict a sudden increase in system load in the future from the past system load history.

  The best mode for carrying out a system load monitoring method according to the present invention will be described below with reference to the accompanying drawings.

(First embodiment)
FIG. 1 is a block diagram of a system load monitoring apparatus for implementing a system load monitoring method according to the present invention.
The system load monitoring apparatus according to the present invention includes an input device 01, a collection function unit 10, a storage function unit 20, a storage confirmation function unit 23, an analysis function unit 30, a display function unit 40, a storage unit 50, And a prediction function unit 60. The accumulation function unit 20 includes a difference accumulation function unit 21 and a deviation accumulation function unit 22. The analysis function unit 30 includes a difference comparison unit 31 and a baseline comparison unit 32. The storage unit 50 includes a baseline storage unit 51, an accumulated difference storage unit 52, and an accumulated deviation storage unit 53.

  Each of the plurality of functional units may be an electric circuit, or some or all of the functional units may be realized by a computer. In other words, each of the plurality of functional units may be realized as a program executed on a computer including a CPU, a memory, and a data input / output unit.

  Each of the plurality of storage units may be a storage device independent of each other, or a part or all of the storage units may be realized as a storage area provided inside a single storage device. Absent.

  The collection function unit 10 is connected to the baseline storage unit 51 and the storage function unit 20. The accumulation function unit 20 is further connected to an accumulation confirmation function unit 23, an analysis function unit 30, a baseline storage unit 51, an accumulation difference storage unit 52, and an accumulation deviation storage unit 53. The accumulation check function unit 23 is also connected to the input device 01 and the display function unit 40. The analysis function unit 30 is further connected to a display function unit 40, a baseline storage unit 51, and an accumulated difference storage unit 52. The baseline storage unit 51, the accumulated difference storage unit 52, and the accumulated deviation storage unit 53 are further connected to the prediction function unit 60, respectively. The prediction function unit 60 is further connected to the display function unit 40.

  The operation of the system load monitoring apparatus according to the present invention will be described. In addition, as a preparatory stage before the system load monitoring apparatus according to the present invention operates, it is desirable that the baseline of the monitoring target system 02 is created in advance. The baseline is a reference line that indicates a temporal change in system load that is normally assumed. Here, the baseline is preferably stored in advance in a baseline storage unit 51 included in the storage unit 50. It is preferable that the baseline can be changed as appropriate even when the monitoring target system 02 and the system load monitoring apparatus of the present invention are operating. However, since the method of creating or changing the baseline is not directly related to the essence of the present invention, the description thereof is omitted.

  At time T <b> 1, the collection function unit 10 observes the load on the monitoring target system 02, acquires the observation value X <b> 1, and passes this to the storage function unit 20. This operation is desirably performed periodically.

The difference accumulation function unit 21 included in the accumulation function unit 20 reads the baseline value B1 at time T1 from the baseline storage unit 51. The difference accumulation function unit 21 compares the observed value X1 and the baseline value B1 and derives the difference D1. That is,
D1 = X1-B1
Perform the calculation.

  The difference accumulation function 21 inquires of the accumulation confirmation function 23 regarding whether or not to store the data of the difference Di at each time Ti. The accumulation check function unit 23 automatically performs the inquired determination basically using various data, but may inquire the system administrator via the display function unit 40 in parallel. . If necessary, the system administrator can return a storage permission command when it is determined that D1 should be stored, and can return a storage denial command when it is determined that it is unnecessary. Here, the system administrator may issue an accumulation permission instruction or an accumulation denial instruction for the difference Di accumulated in the past. The accumulation permission command or the accumulation denial command is preferably transmitted to the accumulation confirmation function unit 23 via the input device 01.

  As a case where the data of the difference Di is not accumulated, the following example can be considered. For example, when a fraction of the processing capacity is temporarily reduced due to maintenance of the monitoring target system 02, the difference data and deviation data between them are not useful in the future. The same applies when communication with the outside of the monitoring target system 02 is concentrated at one time and jumps to several times the normal value. In this way, it is desirable that various data in which an irregular situation has occurred be discarded by the system administrator's flexible response.

  When the difference accumulation function unit 21 receives from the accumulation confirmation function unit 23 a difference accumulation permission command that should accumulate the difference D1, the difference accumulation function unit 21 passes the data of the difference D1 to the accumulation difference storage unit 52. On the other hand, when a difference accumulation denial instruction that should not accumulate the difference D1 is received from the accumulation confirmation function unit 23, the difference accumulation function unit 21 discards the data of the difference D1.

  The accumulated difference storage unit 52 stores an accumulated difference ΣD. The accumulated difference ΣD is the sum of the differences Di accumulated for each time Ti. Here, i is an arbitrary number. The accumulation difference storage unit 52 adds the value of the difference Di to the accumulation difference ΣD so far and stores it as a new accumulation difference ΣD every time the data of the difference Di is transferred from the difference accumulation function unit 21 as an accumulation target.

  Here, it is preferable that the accumulated difference storage unit 52 stores not only the accumulated difference ΣD but also all the data of the difference Di at each time. In other words, the data of the difference Di, which is originally not subject to accumulation, is also stored in the accumulation difference storage unit. This is because there is a possibility that an accumulation denial command is issued after the data of the difference Di in the past is once accumulated, or conversely, an accumulation permission command is issued after it is once discarded. In such a case, naturally, the value of the accumulated difference ΣD in the accumulated difference storage unit 52 is also appropriately corrected by the difference accumulation function unit 21.

On the other hand, the deviation accumulation function unit 22 included in the accumulation function unit 20 as well as the difference accumulation function unit 21 derives the deviation V1 from the baseline value B1 and the observed value X1 at time T1. The deviation V1 at time T1 is a value for expressing how much the observed value X1 deviates from the baseline value B1 by a ratio. The deviation V1 does not necessarily need to be defined by a specific mathematical expression, but can be defined as follows as an example.
When B1> X1: V1 = (B / X) −1
When X1> B1: V1 = (X / B) −1
Alternatively, the deviation called in general statistical mathematics can be treated as the deviation V1 in the present application by making it dimensionless as follows.
V1 = (D1−average value of each time Di) / σ
However, since σ = definition of deviation Vi at standard deviation time Ti of deviation Vi at each time does not directly affect the essence of the present invention, further detailed description is omitted.

  Similar to the difference accumulation function 21, the deviation accumulation function 22 inquires of the accumulation confirmation function 23 to determine whether or not the deviation Vi can be accumulated at the time Ti.

  When the deviation accumulation function unit 22 receives from the accumulation confirmation function unit 23 a deviation accumulation permission command to accumulate the deviation V1, the deviation accumulation function unit 22 passes the data of the deviation V1 to the accumulation deviation storage unit 53. On the other hand, when a deviation accumulation refusal command not to accumulate the deviation V1 is received from the accumulation confirmation function unit 23, the deviation accumulation function unit 22 may discard the data of the deviation V1. However, similarly to the difference accumulation function unit 21, it is desirable that this deviation V1 is stored in the accumulation deviation storage unit as an accumulation target. This is in preparation for the possibility that the difference D1 corresponding to the deviation V1 is changed to an accumulation target in the future. If the difference D1 that was not the accumulation target becomes the accumulation target, the deviation V1 corresponding to the difference D1 should also be changed to the accumulation target.

  The accumulated deviation storage unit 53 stores all the deviations Vi and accumulated deviations V at each time Ti. The accumulated deviation V is an average value of deviations Vi that are accumulated at each time Ti. The accumulated deviation storage unit 53 stores the new accumulated deviation V by adding the value of the deviation Vi to the accumulated deviation V so far every time the deviation Vi data is transferred from the deviation accumulation function unit 17.

  The accumulation function unit 20 passes the observation value X1 at time T1 to the analysis function unit 30. The difference comparison unit 31 included in the analysis function unit 30 reads the accumulated difference ΣD stored in the accumulated difference storage unit 52. Similarly, the baseline comparison unit 32 included in the analysis function unit 30 reads the baseline value B1 stored at the baseline storage unit 51 at the time T1. The analysis function unit 30 determines whether the observation value X1 is normal or abnormal in consideration of the accumulated difference ΣD and the baseline value B1.

FIG. 2 is a flowchart for the analysis function unit 30 to determine the normality or abnormality of the observed value X1.
In step S01, the analysis function unit 30 determines whether the accumulated difference ΣD is positive or negative. If the accumulation difference ΣD is negative, the process proceeds to step S04. In step S04, the baseline comparison unit 32 obtains the absolute value | X1-B1 | of the difference between the observed value X1 and the baseline value B1. That is, the baseline comparison unit 32 obtains the fluctuation width of the observation value X1 from the baseline value B1. An allowable range is provided in advance for the fluctuation width of the observed value X1 from the baseline value B1. Hereinafter, this allowable range is represented by an allowable value C. The baseline comparison unit 32 compares the absolute value | X1−B1 | with the allowable value C. If the difference between the observed value X1 and the baseline value B1 exceeds the allowable value C, the process proceeds to step S07. Judged as “abnormal”. On the other hand, if the difference between the observed value X1 and the baseline value B1 does not exceed the allowable value C, the analysis function unit 30 proceeds to step S06 and determines “normal”.

  If the accumulated difference ΣD is positive in step S01, it can be interpreted that the load assumed to have been not applied in the past. In this case, the analysis function unit 30 proceeds to step S02, and compares the observed value X1 with the baseline value B1. If the observed value X1 is smaller than the baseline value B1, the analysis function unit 30 proceeds to step S04 described above. On the other hand, when the observed value X1 is larger than the baseline value B1, the analysis function unit 30 proceeds to step S03.

  In step S03, the difference comparison unit 31 compares the value obtained by subtracting the baseline value B1 from the observed value X1 with the sum of the allowable value C and the accumulated difference ΣD. If the value obtained by subtracting the baseline value B1 from the observed value X1 exceeds the sum of the allowable value C and the accumulated difference ΣD, the difference comparison unit 31 proceeds to step S05 and determines this state as “abnormal”. On the other hand, if the value obtained by subtracting the baseline value B1 from the observed value X1 is within the range of the sum of the allowable value C and the accumulated difference ΣD, the difference comparison unit 31 proceeds to step S06, and this state is “normal”. Judge.

  When one of the above steps S05 to S07 is reached, the analysis function unit 30 notifies the display function unit 40 of the determination result. When the display function unit 40 displays the determination result made by the analysis function unit 30, the system administrator can know that the current system load is normal or abnormal.

  The prediction function unit 60 operates periodically separately from the collection function unit 10 to predict the possibility that the system load Di will exceed the limit load value Z in the future.

FIG. 3 is a flowchart for explaining the operation of the prediction function unit 60.
In step S11, the prediction function unit 60 obtains the future time T3 from the current time T2 and the time difference ΔTa. Here, the time difference ΔTa is a predetermined constant. Note that the system administrator may determine the time difference ΔTa. The time difference ΔTa may be changeable during the operation of the monitoring target system 02 or the system load monitoring device of the present invention.

  In step S12, the prediction function unit 60 obtains the maximum value Bm of the baseline value Bi between the current time T2 and the future time T3.

  In step S15, the prediction function unit 60 obtains the past time T1 from the current time T2 and the time difference ΔTb. Here, the time difference ΔTb is a predetermined constant. Note that the system administrator may determine the time difference ΔTb.

  In step S16, the prediction function unit 60 calculates the average value V of the deviations Vi accumulated in the accumulated deviation storage unit 53 from the past time T1 to the current time T2. However, the average value V may be calculated by the deviation accumulation function unit 22 or the like and already stored in the accumulated deviation storage unit 53.

  In addition, the process of the block of steps S11-S12 and the block of steps S15-S16 is independent. Therefore, either block may be executed first, or both blocks may be executed simultaneously in parallel.

  In step S13, the prediction function unit 60 adds the baseline maximum value Bm and the accumulated difference ΣD. The sum obtained in this way is the predicted maximum value of the load on the system to be observed. The prediction function unit 60 multiplies the system load prediction maximum value by a value obtained by adding 1 to the average value V of the accumulated deviation. The prediction function unit 60 compares the product thus obtained with a predetermined system load limit value Z.

As a result of the above comparison,
(Bm + ΣD) × (V + 1)> Z
Is satisfied, the system load Bi may exceed the limit value Z. In this case, the prediction function unit 60 proceeds to step S14 and issues a warning. As described with reference to FIG. 2, the warning is displayed by the display function unit 40 so that the system administrator can know this warning.

Note that the result of the comparison is (Bm + ΣD) × (V + 1) <Z
In this case, it is determined that there is no concern that the system load Bi exceeds the limit value Z, and the prediction function unit 60 does nothing.

(Second Embodiment)
FIG. 4 is a block diagram of a system load monitoring apparatus for implementing the system load monitoring method in the present embodiment.
In the system load monitoring apparatus according to the present embodiment, the input device 01 is omitted from the system load monitoring apparatus according to the first embodiment, and a difference change database 54 is added to the storage unit 50. The accumulation check function unit 23 is connected to the difference change database 54.

  In the first embodiment, when the storage function unit 20 inquires of the storage confirmation function unit 23 whether or not data can be stored, the storage confirmation function unit 23 ultimately leaves the determination to the system administrator. In the present embodiment, the accumulation confirmation function unit 23 can independently make a high-level determination as to whether or not data can be accumulated without an instruction from the system administrator.

  An example of a method for determining whether or not data can be stored by the storage check function unit 23 will be described. For example, a difference change database 54 is prepared in advance in which the manner in which the difference Di between the system load observation value Xi and the baseline value B changes in time series is divided into a plurality of patterns.

  In FIG. 4, the difference change database 54 is stored in the storage unit 50 with a dedicated area. However, the difference change database 54 may be stored inside the accumulation check function unit 23.

  The difference change database 54 preferably includes a plurality of pieces of pattern information relating to changes in the difference Di and information relating to whether data can be stored corresponding to each pattern information. As an example of the pattern related to the change of the difference Di, the timing and period at which the difference Di increases or decreases or does not change, the width of the increase and decrease, and the like can be considered.

  First, the accumulation check function unit 23 searches the difference change database 54 for a pattern to which the change pattern of the difference Di is best applied. Next, information related to whether or not data can be stored corresponding to the pattern that best matches the change in the difference Di is read from the database 54. Finally, the storage function unit 20 is permitted or denied data storage based on the read information on whether or not data can be stored.

  By doing so, the burden on the system administrator is further reduced. However, a human system administrator can respond more flexibly than automatic control. Therefore, it is desirable that the accumulation confirmation function unit 23 also includes the same input device 01 as that of the first embodiment so that the system administrator can permit or deny data accumulation at least in an emergency.

  In addition to the above, there is no difference between the present embodiment and the first embodiment, so further explanation is omitted.

  As described above, when the system load monitoring method, the system load monitoring apparatus, and the system load monitoring program according to the present invention are used, a sudden increase in the future system load can be predicted from the past system load history. Therefore, it is possible to start in advance to cope with an increase in system load. In particular, provisioning and other actions generally take time to prepare, but according to the present invention, it becomes possible to complete before an increase in system load actually occurs. In addition, it is possible to take measures such as temporarily suspending a service with a low priority and allocating system resources to important services in a focused manner or taking a warning posture. Furthermore, when the system load monitoring method according to the present invention is used, a plurality of mutually related abnormalities can be regarded as one abnormality. As a result, the burden on the system administrator is reduced.

FIG. 1 is a block diagram of a system load monitoring apparatus for implementing the system load monitoring method according to the first embodiment of the present invention. FIG. 2 is a flowchart for explaining the operation of the analysis function unit in the system load monitoring apparatus of the present invention. FIG. 3 is a flowchart for explaining the operation of the prediction function unit in the system load monitoring apparatus of the present invention. FIG. 4 is a block diagram of a system load monitoring apparatus for implementing the system load monitoring method according to the second embodiment of the present invention.

Explanation of symbols

01 Input Device 02 Monitoring Target System 10 Collection Function Unit 20 Accumulation Function Unit 21 Difference Accumulation Function Unit 22 Deviation Accumulation Function Unit 23 Accumulation Confirmation Function Unit 30 Analysis Function Unit 31 Difference Comparison Unit 32 Baseline Comparison Unit 40 Display Function Unit 50 Storage Unit 51 Baseline storage unit 52 Accumulated difference storage unit 53 Accumulated deviation storage unit 60 Prediction function unit

Claims (24)

A storage unit for storing a baseline of the system load to be monitored;
A collection function unit that periodically performs observation of the system load and reading of a baseline value corresponding to the time of the observation in the baseline;
An accumulation function unit for accumulating a difference in the observed system load with respect to the read baseline value and a deviation of the difference;
A prediction function unit that periodically predicts future system load based on the baseline, the accumulated difference, and the accumulated deviation;
A system load monitoring device comprising: a display function unit for displaying the prediction result. In the system load monitoring device according to claim 1,
The storage unit
A baseline storage unit for storing the baseline;
An accumulated difference storage unit for accumulating the difference;
An accumulated deviation storage unit for accumulating the deviation,
The prediction function unit includes the maximum value of the baseline from the current time to the future after a predetermined period, the sum of the accumulated differences, and the average of the accumulated deviations from the current time to the past before the predetermined period. A system load monitoring device that predicts the possibility that the load of the monitored system will exceed a predetermined limit value in the future based on the value. In the system load monitoring apparatus according to claim 2,
The prediction function unit
The maximum value Bm of the baseline, the accumulated difference sum ΣD, the accumulated deviation average value V, and the predetermined system load limit value Z are:
(Bm + ΣD) × (1 + V)> Z
A system load monitoring device that predicts that the system load may exceed the system load limit value Z when the above condition is satisfied. In the system load monitoring device according to any one of claims 1 to 3,
An analysis function unit that analyzes whether the observed system load is normal or abnormal based on the baseline and the accumulated difference each time the difference is accumulated;
The display function unit further displays a result of analysis by the analysis function unit. The system load monitoring device according to claim 4,
The analysis function unit
The absolute value of the difference between the system load and the baseline value when the sum of the accumulated differences is negative or the observed system load is less than or equal to the baseline value at the observation time A difference comparison unit that determines that the observed value of the system load is normal only when is equal to or less than a predetermined allowable value;
In the case where the sign of the sum of the accumulated differences is positive and the observation value of the system load is equal to or higher than the baseline value at the observation time, the difference between the system load and the baseline value, A baseline comparison unit that compares a sum of an allowable value and the sum of the differences, and determines that the observed value of the system load is normal only when the difference is equal to or less than the sum;
The system load monitoring device, wherein the analysis function unit determines that the observed value of the system load is abnormal when the difference comparing unit and the baseline comparator do not determine that the observed value of the system load is normal. In the system load monitoring apparatus according to any one of claims 1 to 5,
The accumulation function unit includes:
A difference accumulation function unit for calculating a difference between the observed system load and the read baseline value;
A deviation accumulation function unit for calculating a deviation between the observed system load and the read baseline value;
In response to an inquiry from the storage function unit, a storage permission instruction for permitting storage of the calculated difference and the calculated deviation in the storage unit, or the calculated difference and the calculated An accumulation confirmation function unit that outputs an accumulation denial command for denying accumulation in the storage unit with a deviation;
The difference accumulation function unit accumulates the calculated difference according to the accumulation permission instruction in the storage unit, and the calculated difference according to the accumulation denial instruction is excluded from accumulation in the storage unit. Store and
The deviation accumulation function unit accumulates the calculated deviation according to the accumulation permission command in the storage unit, and the calculated deviation according to the accumulation denial command is excluded from accumulation in the storage unit. System load monitoring device to store. In the system load monitoring device according to claim 6,
The display function unit further displays the calculated difference and the calculated deviation supplied from the accumulation confirmation function unit,
The accumulation confirmation function unit
Comprising an input device for inputting the accumulation permission instruction or the accumulation rejection instruction;
The accumulation confirmation function unit outputs the accumulation denial command to the accumulation function unit when the accumulation denial command is received from the input device, and in other cases, the accumulation confirmation function unit performs the accumulation function. A system load monitoring device that outputs the accumulation permission command to a section. In the system load monitoring device according to claim 6,
The storage unit
The accumulation confirmation function unit further includes a difference change database storage unit for storing a difference change database for determining whether or not accumulation is possible in the difference and the deviation,
The accumulation confirmation function unit inquires the difference change database for a difference change pattern stored as the accumulation target, and based on a result of the inquiry, the accumulation permission instruction or the accumulation denial instruction is sent to the accumulation function. System load monitoring device that outputs to the department. (A) an observation step in which the collection function unit periodically observes a system load to be monitored;
(B) Each time the observation is performed in the observation step (a), a reading step in which the collection function unit reads a baseline value corresponding to the observation time in the baseline of the system load from the storage unit;
(C) Each time the baseline value is read in the reading step (b), the storage function unit calculates the difference and deviation between the system load and the baseline value observed in the observation step (a). , An accumulation step for accumulating in the storage unit;
(D) The prediction function unit periodically predicts a future system load based on the baseline, the accumulated difference, and the accumulated deviation, and displays the result of the prediction. A system load monitoring method comprising: a prediction step displayed by The system load monitoring method according to claim 9, wherein
The prediction step (d)
(D-1) the prediction function unit reads the baseline from the baseline storage unit included in the storage unit, and obtains the maximum value of the baseline from the current time to the future after a predetermined period;
(D-2) The prediction function unit reads the accumulated difference from the accumulated difference storage unit included in the storage unit, and obtains the sum of the accumulated differences;
(D-3) The prediction function unit reads the accumulated deviation from the accumulated deviation storage unit included in the storage unit, and obtains an average value of the accumulated deviation from the current time to the past of a predetermined period. When,
(D-4) the step of the prediction function unit predicting the possibility that the system load will exceed a predetermined limit value in the future;
(D-5) The system load monitoring method, wherein the display function unit includes a step of displaying a prediction result of the system load in the future. The system load monitoring method according to claim 10,
The step (d-4)
(D-4-a) The maximum value Bm of the baseline obtained in the step (d-1), the accumulated difference ΣD, and the average of the deviation obtained in the step (d-3) The value V and the predetermined system load limit value Z are
(Bm + ΣD) × (1 + V)> Z
A system load monitoring method comprising a step of predicting by the prediction function unit that the system load may exceed the system load limit value Z when the above condition is satisfied. The system load monitoring method according to any one of claims 9 to 11,
(E) Each time the difference is accumulated in the difference step (c), the analysis function unit observes the system observed in the step (a) based on the baseline and the accumulated difference. An analysis step for analyzing whether the load is normal or abnormal,
The analysis step (e)
(E-1) A system load monitoring method, wherein the display function unit further displays a result of the analysis. The system load monitoring method according to claim 12,
The analysis step (e)
(E-2) In the case where the sign of the sum of the accumulated differences is negative or the observed value of the system load is equal to or less than the baseline value, the observed value of the system load and the baseline A difference comparison unit included in the analysis function unit determines that the observed value of the system load is normal when an absolute value of a difference from a value is equal to or less than the allowable value;
(E-3) The sign of the accumulated sum of the differences is positive, the observed value of the system load is greater than or equal to the baseline value, the baseline value, and the sum of the differences, When the sum of the tolerance and the observed value of the system load is greater than or equal to the observed value of the system load, the baseline comparing unit of the analysis function unit determines that the observed value of the system load is normal;
(E-4) The method further includes a step in which the analysis function unit determines that the observed value of the system load is abnormal when neither the step (e-2) nor the step (e-3) applies. System load monitoring method. In the system load monitoring method according to any one of claims 9 to 13,
The difference step (c)
(C-1) The difference accumulation function unit included in the accumulation function unit calculates a difference between the system load observed in the observation step (a) and the baseline value read in the reading step (b). A calculating step;
(C-2) The deviation accumulation function unit included in the accumulation function unit calculates a deviation between the system load observed in the observation step (a) and the baseline value read in the reading step (b). A calculating step;
(C-3) Whether the storage function unit can store in the storage unit the difference calculated in step (c-1) and the deviation calculated in step (c-2). Inquiring to the accumulation confirmation function unit,
(C-4) the accumulation confirmation function unit determining whether the accumulation is possible;
(C-5) In the step (c-4), when the accumulation confirmation function unit outputs an accumulation permission command for permitting accumulation of the difference and the deviation in the storage unit, the difference accumulation function A unit that accumulates the calculated difference in the storage unit, and a deviation accumulation function unit that accumulates the calculated deviation in the storage unit;
(C-6) In the step (c-4), when the accumulation confirmation function unit outputs an accumulation denial command for denying accumulation of the difference and the deviation in the storage unit, the difference accumulation function A unit storing the calculated difference in the storage unit as a non-accumulation target, and the deviation accumulation function unit storing the calculated deviation in the storage unit as a non-accumulation target. System load monitoring method. The system load monitoring method according to claim 14,
The step (c-1)
(C-1-a) the display function unit displaying the calculated difference and the calculated deviation;
(C-1-b) when the accumulation confirmation function unit receives the accumulation denial command from the input device, the step of outputting the accumulation denial command to the accumulation function unit;
(C-1-c) A system load monitoring method comprising: a step of outputting the accumulation permission command to the accumulation function unit in a case other than the case of step (c-1-b). . The system load monitoring method according to claim 14,
The step (c-1)
(C-1-d) the accumulation check function unit reads the difference stored as an accumulation target in the storage unit and a difference change database from the storage unit;
(C-1-e) the accumulation check function unit inquires the database for information relating to a change pattern of the difference stored as the accumulation target;
(C-1-f) A system load monitoring method comprising: a step in which the accumulation confirmation function unit outputs the accumulation permission command or the accumulation denial command to the accumulation function unit based on a result of the inquiry. (A) an observation step in which the collection function unit periodically observes a system load to be monitored;
(B) Each time the observation is performed in the observation step (a), a reading step in which the collection function unit reads a baseline value corresponding to the observation time in the baseline of the system load from the storage unit;
(C) Each time the baseline value is read in the reading step (b), the storage function unit calculates the difference and deviation between the system load and the baseline value observed in the observation step (a). , An accumulation step for accumulating in the storage unit;
(D) The prediction function unit periodically predicts a future system load based on the baseline, the accumulated difference, and the accumulated deviation, and displays the result of the prediction. A system load monitoring program comprising a prediction step displayed by The system load monitoring program according to claim 17,
The prediction step (d)
(D-1) the prediction function unit reads the baseline from the baseline storage unit included in the storage unit, and obtains the maximum value of the baseline from the current time to the future after a predetermined period;
(D-2) The prediction function unit reads the accumulated difference from the accumulated difference storage unit included in the storage unit, and obtains the sum of the accumulated differences;
(D-3) The prediction function unit reads the accumulated deviation from the accumulated deviation storage unit included in the storage unit, and obtains an average value of the accumulated deviation from the current time to the past of a predetermined period. When,
(D-4) the step of the prediction function unit predicting the possibility that the system load will exceed a predetermined limit value in the future;
(D-5) A system load monitoring program, wherein the display function unit includes a step of displaying a prediction result of the future system load. The system load monitoring program according to claim 18,
The step (d-4)
(D-4-a) The maximum value Bm of the baseline obtained in the step (d-1), the accumulated difference ΣD, and the average of the deviation obtained in the step (d-3) The value V and the predetermined system load limit value Z are
(Bm + ΣD) × (1 + V)> Z
A system load monitoring program comprising the step of the prediction function unit predicting that there is a possibility that the system load exceeds the system load limit value Z when the above condition is satisfied. In the system load monitoring program in any one of Claims 17-19,
(E) Each time the difference is accumulated in the difference step (c), the analysis function unit observes the system observed in the step (a) based on the baseline and the accumulated difference. An analysis step for analyzing whether the load is normal or abnormal,
The analysis step (e)
(E-1) A system load monitoring program, wherein the display function unit further displays a result of the analysis. The system load monitoring program according to claim 20,
The analysis step (e)
(E-2) In the case where the sign of the sum of the accumulated differences is negative or the observed value of the system load is equal to or less than the baseline value, the observed value of the system load and the baseline A difference comparison unit included in the analysis function unit determines that the observed value of the system load is normal when an absolute value of a difference from a value is equal to or less than the allowable value;
(E-3) The sign of the accumulated sum of the differences is positive, the observed value of the system load is greater than or equal to the baseline value, the baseline value, and the sum of the differences, When the sum of the tolerance and the observed value of the system load is greater than or equal to the observed value of the system load, the baseline comparing unit of the analysis function unit determines that the observed value of the system load is normal;
(E-4) The method further includes a step in which the analysis function unit determines that the observed value of the system load is abnormal when neither the step (e-2) nor the step (e-3) applies. System load monitoring program. In the system load monitoring program according to any one of claims 17 to 21,
The difference step (c)
(C-1) The difference accumulation function unit included in the accumulation function unit calculates a difference between the system load observed in the observation step (a) and the baseline value read in the reading step (b). A calculating step;
(C-2) The deviation accumulation function unit included in the accumulation function unit calculates a deviation between the system load observed in the observation step (a) and the baseline value read in the reading step (b). A calculating step;
(C-3) Whether the storage function unit can store in the storage unit the difference calculated in step (c-1) and the deviation calculated in step (c-2). Inquiring to the accumulation confirmation function unit,
(C-4) the accumulation confirmation function unit determining whether the accumulation is possible;
(C-5) In the step (c-4), when the accumulation confirmation function unit outputs an accumulation permission command for permitting accumulation of the difference and the deviation in the storage unit, the difference accumulation function A unit that accumulates the calculated difference in the storage unit, and a deviation accumulation function unit that accumulates the calculated deviation in the storage unit;
(C-6) In the step (c-4), when the accumulation confirmation function unit outputs an accumulation denial command for denying accumulation of the difference and the deviation in the storage unit, the difference accumulation function A unit storing the calculated difference in the storage unit as a non-accumulation target, and the deviation accumulation function unit storing the calculated deviation in the storage unit as a non-accumulation target. System load monitoring program. The system load monitoring program according to claim 22,
The step (c-1)
(C-1-a) the display function unit displaying the calculated difference and the calculated deviation;
(C-1-b) when the accumulation confirmation function unit receives the accumulation denial command from the input device, the step of outputting the accumulation denial command to the accumulation function unit;
(C-1-c) A system load monitoring program comprising: a step other than the step (c-1-b), wherein the accumulation confirmation function unit outputs the accumulation permission command to the accumulation function unit . The system load monitoring program according to claim 22,
The step (c-1)
(C-1-d) the accumulation check function unit reads the difference stored as an accumulation target in the storage unit and a difference change database from the storage unit;
(C-1-e) the accumulation check function unit inquires the database for information relating to a change pattern of the difference stored as the accumulation target;
(C-1-f) A system load monitoring program comprising: a step in which the accumulation confirmation function unit outputs the accumulation permission command or the accumulation denial command to the accumulation function unit based on a result of the inquiry.

Images